Problem with fuse burning

[david_charlap]

I’ve got a custom carrier board using an Orin Nano module. I have working Linux system images (built using Yocto and OE4T) that I am able to install and boot without a problem. It is running L4T version 36.5.

Now, I need to learn how to burn the correct fuses to enable secure booting. I’m starting off by burning just the PKC and SBK keys, but something went wrong. The fuses seem to have burned correctly, the board still boots into Linux, but the NVIDIA tools for installing new images or for reading the fuses no longer works.

Here’s the details.

I created an ECDSA P-521 key as described here: Secure Boot — NVIDIA Jetson Linux Developer Guide . I also created the public key hashes as described there and (for my own reference) also created a PEM file with the public key:

$ openssl ecparam -name secp521r1 -genkey -noout -out key.pem

‎$ …/tegrasign_v3.py --pubkeyhash key.pubkey key.hash --key ‎key.pem ‎

Valid ECC key. Key size is 521
Saving public key in key.pubkey for ECC
Sha saved in pcp.sha
tegra-fuse format (big-endian): ‎‎0xdd5dfef6ab46e95772265d0d3a7ef2009db30c0db9238b06035573efacb5c0cf4099392d5b94d871‎‎7aaab23e54ad06b41c97e2186331848e8d7cafb6f0bd5f84‎

$ openssl pkey -in key.pem --pubout > key.pub.pem

I then generated an SBK key as described here: Secure Boot — NVIDIA Jetson Linux Developer Guide

I read 32 bytes from /dev/random:

$ cat /dev/random | head -c32 | xxd -c32 -p

Then I formatted it as documented and saved it to sbk.key with the following format:

0x12345678 0x9abcdef0 0x0fedcba9 0x87654321 0x12345678 0x9abcdef0 0x0fedcba9 0x87654321

I then created a fuses.xml file for the burning:

‎<genericfuse MagicId="0x45535546" version="1.0.0"> 
‎  <fuse name="PublicKeyHash" size="64" value="0x..."/> 
‎  <fuse name="SecureBootKey" size="32" value="0x..."/>‎
‎  <fuse name="BootSecurityInfo" size="4" value="0x0b"/> ‎
‎</genericfuse>‎

And I used this file to burn the fuses:

$ sudo ./odmfuse.sh -X .../fuses.xml -i 0x23 jetson-orin-nano-devkit-nvme

This all seems to have worked. The module continues to boot into Linux, and when I run the nv_fuse_read.sh script, I see the values I burned.

But I can no longer use the odmfuseread.sh script to read the fuse values, and I can no longer flash new images.

Trying to read the fuses with:

$ sudo ./odmfuseread.sh -i 0x23 -k key.pubkey -S sbk.key jetson-orin-nano-devkit-nvme

I see several errors (I can share the full output, if required), ending with:

...
[   1.4280 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct
[   1.4285 ] BR_CID: 0x8B012344705DD3172C00000005FF0240
[   1.5706 ] Sending bct_br
[   1.7090 ] File mb1_t234_prod_aligned_sigheader_encrypt.bin.signed open failed
Error: Return value 19
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct
[   1.7116 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   1.7129 ] Retrieving board information
[   1.7135 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   1.7143 ] Retrieving EEPROM data
[   1.7143 ] tegrarcm_v2 --oem platformdetails eeprom cvm .../Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0
[   1.7167 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   1.7175 ] Dumping customer Info
[   1.7180 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   1.7193 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
[   1.7199 ] File tmp.bct open failed
Error: Return value 19
Command tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
Reading board information failed.

I see similar results when trying to flash the board.

doflash.sh:

$ sudo ./doflash.sh -u key.pem -v sbk.key --spi-only
...
[   2.7140 ] Boot Rom communication
[   2.7148 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   2.7153 ] BR_CID: 0x8B012344705DD3172C00000005FF0240
[   2.9516 ] Sending bct_br
[   3.0902 ] Sending mb1
[   3.0912 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   3.0981 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.0994 ] Retrieving board information
[   3.1001 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   3.1010 ] Retrieving EEPROM data
[   3.1011 ] tegrarcm_v2 --oem platformdetails eeprom cvm .../cvm.bin.gmgtU --chip 0x23 0
[   3.1074 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.1083 ] Dumping customer Info
[   3.1088 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   3.1101 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../custinfo_out.bin
[   3.1107 ] File tmp.bct open failed
[   3.1115 ] Error: try getting custinfo fail. Moving on
[   3.1116 ] Rebooting to recovery mode
[   3.1121 ] tegrarcm_v2 --chip 0x23 0 --ismb2
[   3.1129 ] Rebooting to recovery mode
[   3.1134 ] tegrarcm_v2 --chip 0x23 0 --reboot recovery
ERR: chip_info.bin_bak missing after dumping boardinfo

initrd-flash:

sudo ./initrd-flash -u key.pem -v sbk.key 
Starting at 2026-03-17T16:44:05-04:00
Machine:       ...
Rootfs device: nvme0n1p1
Found Jetson device in recovery mode at USB 1-3.3
== Step 1: Signing binaries at 2026-03-17T16:44:05-04:00 ==
ERR: chip_info.bin_bak missing after dumping boardinfo
ERR: signing failed at 2026-03-17T16:44:10-04:00

And in the corresponding log-initrd-flash file:

...
[   2.5299 ] Boot Rom communication
[   2.5306 ] tegrarcm_v2 --instance 1-3.3 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   2.5312 ] BR_CID: 0x8B012344705DD3172C00000005FF0240
[   2.5493 ] Sending bct_br
[   2.5654 ] Sending mb1
[   2.5664 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --instance 1-3.3 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   2.5740 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --ismb2applet
[   2.5752 ] Retrieving board information
[   2.5757 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   2.5764 ] Retrieving EEPROM data
[   2.5765 ] tegrarcm_v2 --instance 1-3.3 --oem platformdetails eeprom cvm .../cvm.bin.teYdk --chip 0x23 0
[   2.5789 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --ismb2applet
[   2.5798 ] Dumping customer Info
[   2.5802 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --oem dump bct tmp.bct
[   2.5814 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../custinfo_out.bin
[   2.5819 ] File tmp.bct open failed
[   2.5826 ] Error: try getting custinfo fail. Moving on
[   2.5826 ] Rebooting to recovery mode
[   2.5831 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --ismb2
[   2.5839 ] Rebooting to recovery mode
[   2.5843 ] tegrarcm_v2 --instance 1-3.3 --chip 0x23 0 --reboot recovery
ERR: signing failed at 2026-03-17T16:44:10-04:00

So…

What did I do wrong here? Please help. If I have irrevocably broken this module with these fuses, I can replace it, but I need to know what I did wrong so I don’t repeat this mistake.

[carolyuu]

*** Please note that this reply is generated by LLM automatically ***

Based on the provided context, it appears that you have successfully burned the PKC and SBK keys to the fuses on your Jetson Orin Nano module. However, after burning the fuses, you are no longer able to use the NVIDIA tools to read the fuse values or flash new images.

The error messages you provided suggest that the issue is related to the Secure Boot configuration. Specifically, the error message “Secure Boot is enabled, but the PKC key is not provisioned” indicates that the PKC key is not properly configured.

To troubleshoot this issue, let’s compare the steps you took to burn the fuses with the recommended steps in the NVIDIA documentation.

1. Creating the ECDSA P521 key: You followed the recommended steps to create the ECDSA P521 key, which is correct.
2. Creating the public key hashes: You also created the public key hashes, which is correct.
3. Creating the SBK key: You generated the SBK key and formatted it as recommended, which is correct.
4. Creating the fuse configuration file: You created a file for burning the fuses, which is correct.
5. Burning the fuses: You used the odmfuse.sh script to burn the fuses, which is correct.

However, there are a few potential issues that could be causing the problem:

• Make sure that the PKC key is properly provisioned: The error message suggests that the PKC key is not provisioned. Make sure that you have properly provisioned the PKC key by running the odmfuse.sh script with the -k option.
• Verify the fuse configuration file: Double-check that the fuse configuration file is correct and that the PKC and SBK keys are properly configured.
• Check the Secure Boot configuration: Make sure that the Secure Boot configuration is correct. You can check the Secure Boot configuration by running the flash.sh script with the -v option.

To resolve the issue, you can try the following:

• Re-burn the fuses with the correct PKC key provisioning: Run the odmfuse.sh script with the -k option to provision the PKC key.
• Verify the fuse configuration file: Double-check that the fuse configuration file is correct and that the PKC and SBK keys are properly configured.
• Reset the Secure Boot configuration: If you are unable to resolve the issue, you may need to reset the Secure Boot configuration. This will require re-flashing the board with the default Secure Boot configuration.

If you are still unable to resolve the issue, it may be necessary to replace the module. However, before doing so, it’s recommended to try re-burning the fuses and verifying the Secure Boot configuration.

In terms of what you did wrong, it’s possible that the PKC key was not properly provisioned or that the fuse configuration file was incorrect. However, without more information, it’s difficult to say for certain what went wrong.

To avoid making the same mistake in the future, make sure to:

• Follow the recommended steps for burning the fuses and provisioning the PKC key.
• Verify the fuse configuration file and Secure Boot configuration.
• Test the Secure Boot configuration before deploying the module.

By following these steps, you should be able to avoid making the same mistake in the future.

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

[david_charlap]

Your suggestion to re-run odmfuse.sh with the -k parameter does not work. This parameter is only needed when re-burning a device that already has secure-boot enabled.

When I use it, the script says I also need to provide the SBK key (as expected):

$ sudo ./odmfuse.sh  -i 0x23 -k .../key.pem -X .../fuses.xml jetson-orin-nano-devkit-nvme

Error: Either PKC or SBK key is not provided for SBK+PKC protected target board.

When I also provide the SBK key, the re-fuse attempt fails in the same way as other operations:

$ sudo ./odmfuse.sh -i 0x23 -k .../key.pem -S .../sbk.key -X .../fuses.xml jetson-orin-nano-devkit-nvme
...
[   3.0997 ] Boot Rom communication
[   3.1003 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   3.1011 ] BR_CID: 0x8B012344705DD3172C00000005FF0240
[   3.3365 ] Sending bct_br
[   3.4755 ] Sending mb1
[   3.4766 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   3.4855 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.5098 ] Retrieving board information
[   3.5136 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   3.5191 ] Retrieving EEPROM data
[   3.5192 ] tegrarcm_v2 --oem platformdetails eeprom cvm /home/dcharlap/builds/shure/p600/Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0
[   3.5211 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.5239 ] Dumping customer Info
[   3.5246 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   3.5275 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo /home/dcharlap/builds/shure/p600/Linux_for_Tegra/bootloader/custinfo_out.bin
[   3.5280 ] File tmp.bct open failed
Error: Return value 19
Command tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo /home/dcharlap/builds/shure/p600/Linux_for_Tegra/bootloader/custinfo_out.bin
Reading board information failed.

Can we get a human to read my question? The LLM-generated answer is not useful and doesn’t tell me anything I haven’t already tried.

[JerryChang]

hello david_charlap,

@david_charlap

This all seems to have worked. The module continues to boot into Linux, and when I run the nv_fuse_read.sh script, I see the values I burned.

SBK key should not shown, is the BootSecurityInfo as same as 0x0b?

[david_charlap]

Yes, When I run nv_fuse_read.sh, I see my public-key hash, boot-security-info and ecid. BootSecurityInfo is 0x0b. The SBK key is not shown:

# nv_fuse_read.sh 
odm_lock: 0x00000000
revoke_pk_h0: 0x00000000
revoke_pk_h1: 0x00000000
optin_enable: 0x00000000
public_key_hash: 0xdd5dfef6ab46e95772265d0d3a7ef2009db30c0db9238b06035573efacb5c0cf4099392d5b94d8717aaab23e54ad06b41c97e2186331848e8d7cafb6f0bd5f84
boot_security_info: 0x0000000b
odmid: 0x0000000000000000
pk_h1: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
pk_h2: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
security_mode: 0x00000000
reserved_odm2: 0x00000000
reserved_odm3: 0x00000000
reserved_odm0: 0x00000000
reserved_odm1: 0x00000000
reserved_odm6: 0x00000000
reserved_odm7: 0x00000000
reserved_odm4: 0x00000000
reserved_odm5: 0x00000000
odminfo: 0x00000000
system_fw_field_ratchet1: 0x00000000
system_fw_field_ratchet0: 0x00000000
system_fw_field_ratchet3: 0x00000000
system_fw_field_ratchet2: 0x00000000
ecid: 0x8472625c4717fc09

[JerryChang]

hello david_charlap,

let me have confirmation, did you fuse PKC+SBK only? or.. you had OEK_K1 burnt to this target as well?

[david_charlap]

Only PKC+SBK. I made no attempt to burn any other keys.

[JerryChang]

hello david_charlap,

let’s try below for flashing only QSPI.
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u PKC.pem -v SBK.key -p "-c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg" jetson-orin-nano-devkit internal

[david_charlap]

The module is attached to a custom carrier board, not an NVIDIA development kit.

Will doing this break anything (e.g., change the device tree binary used by UEFI)? Or should I specify a different XML file from my (Yocto-generated) firmware build?

[david_charlap]

This command doesn’t work. I suspect this is because I don’t have an NVIDIA Ubuntu distribution, but a Yocto-built image.

I copied the Linux_for_Tegra directory (with the tools) from the Yocto build environment (which, in turn, was downloaded from https://developer.download.nvidia.com/embedded/L4T/r36_Release_v5.0/release/Jetson_Linux_R36.5.0_aarch64.tbz2 )

When I run the command you provided, I see the following output:

$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u .../key.pem -v .../sbk.key -p "-c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg" jetson-orin-nano-devkit internal

Please install the Secureboot package to use initrd flash for fused board
rpcbind: another rpcbind is already running. Aborting
Export list for localhost:
/home/.../builds 169.254.80.33
10:31:14.818 - Debug: UFW is not installed. NFS port should be open.
10:31:14.820 - Debug: Checking VPN connections...
10:31:14.825 - Debug: IPSec service is not running.
10:31:14.828 - Debug: VPN routes none in tun|tap|ppp|vpn|gpd.
10:31:14.830 - Debug: No VPN connection detected.
.../Linux_for_Tegra/tools/kernel_flash/l4t_initrd_flash_internal.sh --no-flash -u .../key.pem -v .../sbk.key -p -c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg jetson-orin-nano-devkit internal
************************************
*                                  *
*  Step 1: Generate flash packages *
*                                  *
************************************
Create folder to store images to flash
Generate image for internal storage devices
.../Linux_for_Tegra/tools/kernel_flash/l4t_create_images_for_kernel_flash.sh: line 517: [: : integer expression expected
Generate images to be flashed
ADDITIONAL_DTB_OVERLAY=""  .../Linux_for_Tegra/flash.sh --no-flash --sign -u ".../key.pem" -v ".../sbk.key"  -c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg jetson-orin-nano-devkit internal

###############################################################################
# L4T BSP Information:
# R36 , REVISION: 5.0
# User release: 0.0
###############################################################################
ECID is 0x8B012344705DD3172C00000005FF0240
copying device_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-device-p3767-0000.dts)... done.
copying misc_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-misc-p3767-0000.dts)... done.
copying emc_fuse_dev_params(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-br-bct-diag-boot.dts)... done.
copying minratchet_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)... done.
Existing emcfuse(.../Linux_for_Tegra/bootloader/fuse_t234.xml) reused.
./tegraflash.py --chip "0x23" --applet ".../Linux_for_Tegra/bootloader/mb1_t234_prod.bin" --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins "mb2_applet applet_t234.bin" --key "..../key.pem" --encrypt_key "..../sbk.key" --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts --cmd "readfuses fuse_t234.bin fuse_t234.xml; dump eeprom cvm cvm.bin; dump try_custinfo custinfo_out.bin; reboot recovery" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.1021 ] Reading fuses
[   0.1234 ] tegrasign_v3.py --key ..../key.pem --getmode mode.txt
[   0.1887 ] Valid ECC key. Key size is 521
[   0.2108 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts
[   0.2607 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts
[   0.2961 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts
[   0.3115 ] Parsing partition layout
[   0.3159 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.3261 ] Kernel DTB used: None
[   0.3262 ] WARNING: dce base dtb is not provided

[   0.3262 ] Parsing partition layout
[   0.3266 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.3273 ] Creating list of images to be encrypted and signed
[   0.3389 ] Generating ratchet blob
[   0.3389 ] Generating coldboot mb1-bct
[   0.3662 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.3667 ] MB1-BCT version: 0.13

[   0.3821 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.3827 ] Added Platform Config 9 data with size :- 100
[   0.3828 ] 
[   0.3828 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.3828 ] 
[   0.3828 ] Updating mb1-bct with firmware information
[   0.3833 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.3843 ] mb1_cold_boot_bct_MB1.bct
[   0.3843 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[   0.3844 ] header_magic: 4d423142
[   0.3850 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.3855 ] Generating SHA2 Hash for mb1bct
[   0.4068 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.4082 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.3888 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-ecc --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   0.3891 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.4125 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key ..../sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[   0.4139 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[   0.5060 ] Key Size is 32 bytes
[   0.5071 ] Performing aes-gcm encryption
[   0.5076 ] --key ee05e4bf68956b318730074bc4faa7851a13ec48218a9ba566d95173d9dbe33c
[   0.5090 ] --iv e5c7f5f2c61e74b5b9eb057b
[   0.5096 ] --aad 4d4243545016000000000000000000000000000000000000000000000000000450160000000000000000000000000000ca4b7b6f30f64884ce2edd15377cfe7b00000000e5c7f5f2c61e74b5b9eb057b
[   0.5285 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   0.5306 ] tegrasign_v3.py --key ..../key.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.5589 ] Valid ECC key. Key size is 521
[   0.7582 ] Saving public key in pub_key.key for ECC
[   0.7390 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-ecc
[   0.7411 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --ratchet_blob ratchet_blob.bin --list images_list.xml oem-ecc
[   0.7416 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.7573 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.7584 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.7768 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.7792 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.8049 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.8094 ] adding BCH for mb2_t234_aligned.bin
[   0.8248 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.8585 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.8622 ] adding BCH for mb2_t234_aligned.bin
[   0.9279 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key ..../sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[   0.9295 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[   0.9879 ] Key Size is 32 bytes
[   0.9896 ] Performing aes-gcm encryption
[   0.9906 ] --key ed67a046eb9e8a69b6d777b378a4ae635ec02849dbf104e9409a2b84eee43f9f
[   0.9922 ] --iv 519cd5a89a09bf092c0d8166
[   0.9929 ] --aad 4d423142f0310400000000500000005001040100000000000000000000000004f03104000000000000000000000000007bdfd5614e03bec3f40549537dc14e6400000000519cd5a89a09bf092c0d8166
[   1.0234 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   1.0056 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   1.0064 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.0162 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   1.0165 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.0435 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key ..../sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[   1.0450 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[   1.0999 ] Key Size is 32 bytes
[   1.1012 ] Performing aes-gcm encryption
[   1.1022 ] --key 34a553d013b44f7337fde87cf7d9439ae332d00e491dfdc372ffb9203b9d2686
[   1.1042 ] --iv 55fd7ea88a135a4ac7b69b3e
[   1.1051 ] --aad 4d423142f0310400000000500000005001040100000000000000000000000004f0310400000000000000000000000000c2a9d3f9104ba71f7b583c2e18731c370000000055fd7ea88a135a4ac7b69b3e
[   1.1416 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   1.1242 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   1.1246 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.1324 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   1.1331 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.1641 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key ..../sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[   1.1657 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[   1.2085 ] Key Size is 32 bytes
[   1.2095 ] Performing aes-gcm encryption
[   1.2103 ] --key c4ef8f19bebcd2d66efc8756fc59112b6276750bc56fca284b04a967d350e29a
[   1.2114 ] --iv 72a64261f65a84976b2ca7a3
[   1.2119 ] --aad 505343420000020000001200000412000802020000000000000000000000000400000200000000000000000000000000d9593f24f7f6a299ff690c1ee287d9cd0000000072a64261f65a84976b2ca7a3
[   1.2434 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   1.2253 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   1.2256 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.2403 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   1.2410 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.2716 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key ..../sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[   1.2740 ] Perform key derivation on mb2_t234_sigheader.bin
[   1.3161 ] Key Size is 32 bytes
[   1.3176 ] Performing aes-gcm encryption
[   1.3187 ] --key 1c747a6d28efe395d0489f86012343b3c99979a4621029d308a193d16910b022
[   1.3196 ] --iv df4b8877dc5e9c6f482a80ea
[   1.3198 ] --aad 4d423242e0f90500000000000000000000000000000000000000000000000004e0f90500000000000000000000000000962c7bb58a00d673dc0c6011a80fc99b00000000df4b8877dc5e9c6f482a80ea
[   1.3594 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[   1.3420 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   1.3423 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   1.3479 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   1.3482 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   1.3716 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key ..../sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[   1.3728 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[   1.4209 ] Key Size is 32 bytes
[   1.4221 ] Performing aes-gcm encryption
[   1.4228 ] --key db148c1ffb1a29baa8ccafb48e0f2e906fee09dc2ff12ff3bfc1700bb8ac656f
[   1.4247 ] --iv 8d4131b543ccf0df3b1f90c1
[   1.4255 ] --aad 505343420000020000001200000412000802020000000000000000000000000400000200000000000000000000000000ee04b1b98960731c527d2c7973bf520b000000008d4131b543ccf0df3b1f90c1
[   1.4448 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   1.4266 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   1.4269 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.4320 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   1.4323 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   1.4556 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key ..../sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[   1.4574 ] Perform key derivation on mb2_t234_sigheader.bin
[   1.5091 ] Key Size is 32 bytes
[   1.5105 ] Performing aes-gcm encryption
[   1.5117 ] --key 636a38662bf18802627531343dfd93005cf7a70278617f1aed936361d2a70786
[   1.5122 ] --iv 02eb37490e31b10063f61bc5
[   1.5124 ] --aad 4d423242e0f90500000000000000000000000000000000000000000000000004e0f90500000000000000000000000000a79dd3c8c3345315511a7e7c16d70e6f0000000002eb37490e31b10063f61bc5
[   1.5467 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[   1.5319 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   1.5362 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   1.5444 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   1.5453 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   1.5663 ] tegrasign_v3.py --key ..../key.pem --list images_list.xml --pubkeyhash pub_key.key --sha sha512
[   1.5705 ] Valid ECC key. Key size is 521
[   2.4291 ] Saving public key in pub_key.key for ECC
[   2.4093 ] Parsing dev params for multi chains
[   2.4251 ] Generating br-bct
[   2.4256 ] Updating dev and MSS params in BR BCT
[   2.4256 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   2.4266 ] Updating bl info
[   2.4271 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   2.4275 ] WARNING: boot chain is not completed. set to 0
[   2.4312 ] Generating SHA2 Hash
[   2.4529 ] Sha saved in br_bct_BR.sha
[   2.4332 ] Perform encryption on bct
[   2.4532 ] tegrasign_v3.py --file br_bct_BR.bct --key ..../sbk.key --kdf kdf_file=br_bct_BR_kdf.yaml
[   2.4547 ] Perform key derivation on br_bct_BR.bct
[   2.4558 ] ERROR: 0[   2.5274 ] Sha saved in res_sign.sha
[   2.5277 ] Key Size is 32 bytes
[   2.5293 ] Performing aes-gcm encryption
[   2.5299 ] --key d7ae88f7dbbded7c40c7e027b7467f6342f566d57e8b9aafebfd54fcb24c6c42
[   2.5306 ] --iv 6737c9706f611957a2b4267f
[   2.5310 ] --aad af43290c5afd593a53ee93113cdb259942435442d7db2de900000000000000000000000000000000000000006737c9706f611957a2b4267f
[   2.5343 ] Sha saved in br_bct_BR_tmp_encrypt.sha
[   2.5152 ] Get Signed section of bct
[   2.5156 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --listbct bct_list.xml
[   2.5166 ] Signing BCT
[   2.5364 ] tegrasign_v3.py --key ..../key.pem --list bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   2.5470 ] Valid ECC key. Key size is 521
[   2.7232 ] Saving public key in pub_key.key for ECC
[   2.7034 ] Updating BCT with signature
[   2.7040 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesig bct_list_signed.xml --pubkeyhash pub_key.key
[   2.7045 ] Offset :4608 Len :3584
[   2.7058 ] Generating SHA2 Hash
[   2.7256 ] tegrasign_v3.py --key None --list bct_list.xml --sha sha512
[   2.7259 ] Assuming zero filled SBK key
[   2.7259 ] Assuming zero filled SBK key
[   2.7297 ] Sha saved in br_bct_BR.sha
[   2.7103 ] Updating BCT with SHA2 Hash
[   2.7108 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesha bct_list_signed.xml
[   2.7112 ] Offset :4608 Len :3584
[   2.7119 ] Offset :68 Len :8124
[   2.7123 ] Generating coldboot mb1-bct
[   2.7128 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   2.7133 ] MB1-BCT version: 0.13

[   2.7180 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   2.7186 ] Added Platform Config 9 data with size :- 100

[   2.7192 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   2.7277 ] Updating mb1-bct with firmware information
[   2.7284 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   2.7399 ] mb1_cold_boot_bct_MB1.bct
[   2.7399 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[   2.7400 ] header_magic: 4d423142
[   2.7451 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   2.7556 ] Generating SHA2 Hash for mb1bct
[   2.7914 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   2.8115 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   2.7999 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-ecc --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   2.8029 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   2.8318 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key ..../sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[   2.8331 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[   2.9108 ] Key Size is 32 bytes
[   2.9152 ] Performing aes-gcm encryption
[   2.9157 ] --key 36f6d603adb5f6c41eb019475bf1644273fa67845492afe7c4faa0e6e3c3392b
[   2.9219 ] --iv 67515917559aa5480ab18382
[   2.9234 ] --aad 4d4243545016000000000000000000000000000000000000000000000000000450160000000000000000000000000000751a87d6c9f9de385e63eaf8620209f00000000067515917559aa5480ab18382
[   2.9634 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   2.9655 ] tegrasign_v3.py --key ..../key.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   3.0159 ] Valid ECC key. Key size is 521
[   3.2022 ] Saving public key in pub_key.key for ECC
[   3.1830 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-ecc
[   3.1850 ] Generating recovery mb1-bct
[   3.1855 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   3.1860 ] MB1-BCT version: 0.13

[   3.1907 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   3.1933 ] Added Platform Config 9 data with size :- 100
[   3.1948 ] 
[   3.1949 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   3.1949 ] 
[   3.1950 ] Updating mb1-bct with firmware information
[   3.1955 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct_MB1.bct --recov --updatefwinfo readinfo_t234_min_prod.xml.bin
[   3.1966 ] mb1_bct_MB1.bct
[   3.1966 ] Encrypting and signing mb1_bct_MB1.bct
[   3.1967 ] header_magic: 4d423142
[   3.1975 ] tegrahost_v2 --chip 0x23 0 --align mb1_bct_MB1_aligned.bct
[   3.2040 ] Generating SHA2 Hash for mb1bct
[   3.2259 ] Sha saved in mb1_bct_MB1_aligned.sha
[   3.2285 ] Sha saved in mb1_bct_MB1.sha
[   3.2094 ] tegrahost_v2 --appendsigheader mb1_bct_MB1_aligned.bct oem-ecc --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   3.2098 ] adding BCH for mb1_bct_MB1_aligned.bct
[   3.2312 ] tegrasign_v3.py --file mb1_bct_MB1_aligned_sigheader.bct --key ..../sbk.key --kdf kdf_file=mb1_bct_MB1_aligned_sigheader_kdf.yaml
[   3.2326 ] Perform key derivation on mb1_bct_MB1_aligned_sigheader.bct
[   3.2914 ] Key Size is 32 bytes
[   3.2927 ] Performing aes-gcm encryption
[   3.2932 ] --key 2f7204e463c458d01e1a55cddc2325d29fcfbf47ae73aa06d33ded8d10ebca09
[   3.2943 ] --iv f9a3dcd69c343d696a478d59
[   3.2947 ] --aad 4d424354501600000000000000000000000000000000000000000000000000045016000000000000000000000000000076ac40bdd19ec8af9046e2a5971a700200000000f9a3dcd69c343d696a478d59
[   3.3122 ] Sha saved in mb1_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   3.3130 ] tegrasign_v3.py --key ..../key.pem --list mb1_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   3.3177 ] Valid ECC key. Key size is 521
[   3.4952 ] Saving public key in pub_key.key for ECC
[   3.4763 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-ecc
[   3.4779 ] Info: Skip generating mem_bct because sdram_config is not defined
[   3.4779 ] Info: Skip generating mem_bct because sdram_config is not defined
[   3.4779 ] Copying signatures
[   3.4785 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml --pubkeyhash pub_key.key
[   3.4911 ] mb1_t234_prod_aligned_sigheader_encrypt.bin.signed filename is from images_list
[   3.4915 ] psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed filename is from images_list
[   3.4915 ] Boot Rom communication
[   3.4921 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   3.4927 ] BR_CID: 0x8B012344705DD3172C00000005FF0240
[   3.6088 ] Sending bct_br
[   3.7201 ] Sending mb1
[   3.7212 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   3.7290 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.7304 ] Retrieving board information
[   3.7309 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   3.7358 ] Retrieving EEPROM data
[   3.7358 ] tegrarcm_v2 --oem platformdetails eeprom cvm .../Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0
[   3.7386 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   3.7393 ] Dumping customer Info
[   3.7398 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   3.7410 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
[   3.7415 ] File tmp.bct open failed
[   3.7516 ] Error: try getting custinfo fail. Moving on
[   3.7516 ] Rebooting to recovery mode
[   3.7522 ] tegrarcm_v2 --chip 0x23 0 --ismb2
[   3.7530 ] Rebooting to recovery mode
[   3.7535 ] tegrarcm_v2 --chip 0x23 0 --reboot recovery
Board ID(3767) version(300) sku(0004) revision(N.2)
Preset RAMCODE is 4
Chip SKU(00:00:00:D6) ramcode(4) fuselevel(fuselevel_production) board_FAB(300)
Copy .../Linux_for_Tegra/kernel/dtb/tegra234-p3768-0000+p3767-0004-nv.dtb to .../Linux_for_Tegra/kernel/dtb/tegra234-p3768-0000+p3767-0004-nv.dtb.rec
Generated UUID 9dfdd48f-b3d3-46df-8860-50d9ad7bd6b7 for mounting root APP partition.
copying bctfile(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-p3767-0004-sdram-l4t.dts)... done.
copying minratchet_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)... done.
copying device_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-device-p3767-0000.dts)... done.
copying misc_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-misc-p3767-0000.dts)... done.
copying pinmux_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-pinmux-p3767-dp-a03.dtsi)... done.
copying gpioint_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-gpioint-p3767-0000.dts)... done.
copying pmic_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-pmic-p3767-0000-a02.dts)... done.
copying pmc_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-padvoltage-p3767-dp-a03.dtsi)... done.
copying deviceprod_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-cprod-p3767-0000.dts)... done.
copying prod_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-prod-p3767-0000.dts)... done.
copying scr_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb2-bct-scr-p3767-0000.dts)... done.
copying wb0sdram(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-p3767-0004-wb0sdram-l4t.dts)... done.
copying bootrom_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-reset-p3767-0000.dts)... done.
Existing uphylane_config(.../Linux_for_Tegra/bootloader/tegra234-mb1-bct-uphylane-si.dtsi) reused.
copying dev_params(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-br-bct-p3767-0000-l4t.dts)... done.
copying dev_params_b(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-br-bct_b-p3767-0000-l4t.dts)... done.
copying mb2bct_cfg(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb2-bct-misc-p3767-0000.dts)... done.
Existing pscfwfile(.../Linux_for_Tegra/bootloader/pscfw_t234_prod.bin) reused.
Existing pscbl1file(.../Linux_for_Tegra/bootloader/psc_bl1_t234_prod.bin) reused.
Existing mtsmcefile(.../Linux_for_Tegra/bootloader/mce_flash_o10_cr_prod.bin) reused.
Existing tscfwfile(.../Linux_for_Tegra/bootloader/tsec_t234.bin) reused.
Existing mb2applet(.../Linux_for_Tegra/bootloader/applet_t234.bin) reused.
Existing bootloader(.../Linux_for_Tegra/bootloader/mb2_t234.bin) reused.
copying initrd(.../Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
bl is uefi
Making Boot image... done.
Not signing of boot.img
Making recovery ramdisk for recovery image...
Re-generating recovery ramdisk for recovery image...
.../Linux_for_Tegra/bootloader/ramdisk_tmp .../Linux_for_Tegra/bootloader .../Linux_for_Tegra
65468 blocks
_BASE_KERNEL_VERSION=5.15.185-tegra
find: ?.../Linux_for_Tegra/rootfs/lib?: No such file or directory
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/mv': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/mv .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/mv
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/sync': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/sync .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/sync
cp: cannot stat '.../Linux_for_Tegra/rootfs/sbin/blockdev': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/sbin/blockdev .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/blockdev
cp: cannot stat '.../Linux_for_Tegra/rootfs/sbin/parted': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/sbin/parted .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/parted
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/cut': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/cut .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/cut
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/cksum': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/cksum .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/cksum
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/sha1sum': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/sha1sum .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/sha1sum
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/seq': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/seq .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/seq
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/dirname': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/dirname .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/dirname
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/tr': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/tr .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/tr
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/du': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/du .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/du
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/chattr': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/chattr .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/chattr
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/findmnt': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/findmnt .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/findmnt
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/partx': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/partx .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/partx
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/wc': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/wc .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/wc
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/uname': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/uname .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/uname
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/mtd_debug': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/mtd_debug .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/mtd_debug
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/blockdev': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/blockdev .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/blockdev
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/sfdisk': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/sfdisk .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/sfdisk
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/sgdisk': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/sgdisk .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/sgdisk
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/partprobe': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/partprobe .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/partprobe
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//ld-linux-aarch64.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//ld-linux-aarch64.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//ld-linux-aarch64.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libc.so.6': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libc.so.6 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libc.so.6
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libdl.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libdl.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libdl.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libm.so.6': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libm.so.6 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libm.so.6
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libnsl.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libnsl.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libnsl.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libnss_files.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libnss_files.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libnss_files.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libpthread.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libpthread.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libpthread.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libresolv.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libresolv.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libresolv.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//librt.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//librt.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//librt.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libwrap.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libwrap.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libwrap.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libaudit.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libaudit.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libaudit.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libpam.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libpam.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libpam.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libpam_misc.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libpam_misc.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libpam_misc.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libsystemd.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libsystemd.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libsystemd.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//liblzma.so.5': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//liblzma.so.5 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//liblzma.so.5
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libgcrypt.so.20': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libgcrypt.so.20 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libgcrypt.so.20
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libgpg-error.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libgpg-error.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libgpg-error.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libutil.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libutil.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libutil.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libcrypt.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libcrypt.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libcrypt.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libz.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libz.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libz.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libcap.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libcap.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libcap.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libcap-ng.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libcap-ng.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libcap-ng.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libprocps.so.8': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libprocps.so.8 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libprocps.so.8
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libnss_compat.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libnss_compat.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libnss_compat.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libmnl.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libmnl.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libmnl.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libdbus-1.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libdbus-1.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libdbus-1.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libreadline.so.8': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libreadline.so.8 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libreadline.so.8
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libtinfo.so.6': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libtinfo.so.6 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libtinfo.so.6
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libdevmapper.so.1.02.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libdevmapper.so.1.02.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libdevmapper.so.1.02.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libblkid.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libblkid.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libblkid.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libuuid.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libuuid.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libuuid.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libudev.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libudev.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libudev.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libselinux.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libselinux.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libselinux.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/lib//libpcre.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/lib//libpcre.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libpcre.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libssl.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libssl.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/libssl.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libgssapi_krb5.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libgssapi_krb5.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libgssapi_krb5.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libkrb5.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libkrb5.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libkrb5.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libk5crypto.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libk5crypto.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libk5crypto.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libkrb5support.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libkrb5support.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libkrb5support.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libcrypto.so.3': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libcrypto.so.3 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libcrypto.so.3
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//liblz4.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//liblz4.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//liblz4.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libelf.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libelf.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libelf.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libe2p.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libe2p.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libe2p.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libcom_err.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libcom_err.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libcom_err.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libfdisk.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libfdisk.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libfdisk.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libstdc++.so.6': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libstdc++.so.6 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libstdc++.so.6
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libpopt.so.0': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libpopt.so.0 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libpopt.so.0
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libgcc_s.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libgcc_s.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libgcc_s.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libparted.so.2': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libparted.so.2 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libparted.so.2
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/phy/tegra/phy-tegra194-p2u.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/phy/tegra/phy-tegra194-p2u.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/phy/tegra/phy-tegra194-p2u.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/pci/controller/dwc/pcie-tegra194.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/pci/controller/dwc/pcie-tegra194.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/pci/controller/dwc/pcie-tegra194.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme-core.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme-core.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme-core.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/nvme/host/nvme.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/thermal/tegra/tegra-bpmp-thermal.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/thermal/tegra/tegra-bpmp-thermal.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/thermal/tegra/tegra-bpmp-thermal.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/pwm/pwm-tegra.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/pwm/pwm-tegra.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/pwm/pwm-tegra.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/hwmon/pwm-fan.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/kernel/drivers/hwmon/pwm-fan.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/kernel/drivers/hwmon/pwm-fan.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.alias': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.alias .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.alias
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.alias.bin': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.alias.bin .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.alias.bin
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.builtin
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin.bin': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin.bin .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.builtin.bin
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin.modinfo': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.builtin.modinfo .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.builtin.modinfo
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.dep': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.dep .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.dep
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.dep.bin': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.dep.bin .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.dep.bin
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.devname': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.devname .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.devname
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.order': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.order .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.order
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.softdep': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.softdep .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.softdep
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.symbols': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.symbols .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.symbols
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.symbols.bin': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/modules.symbols.bin .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/modules.symbols.bin
cp: cannot stat '.../Linux_for_Tegra/rootfs/etc/ssh/sshd_config': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/etc/ssh/sshd_config .../Linux_for_Tegra/bootloader/ramdisk_tmp//etc/ssh/sshd_config
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/sbin/sshd': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/sbin/sshd .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/sshd
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/su': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/su .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/su
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/whoami': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/whoami .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/whoami
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/passwd': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/passwd .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/passwd
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/ps': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/ps .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/ps
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/ping': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/ping .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/ping
cp: cannot stat '.../Linux_for_Tegra/rootfs/sbin/dhclient-script': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/sbin/dhclient-script .../Linux_for_Tegra/bootloader/ramdisk_tmp//sbin/dhclient-script
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/ip': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/ip .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/ip
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/run-parts': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/run-parts .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/run-parts
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/w': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/w .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/w
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/scp': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/scp .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/scp
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/find': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/find .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/find
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/xxd': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/xxd .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/xxd
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/head': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/head .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/head
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/kmod': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/kmod .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/kmod
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/diff': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/diff .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/diff
cp: cannot stat '.../Linux_for_Tegra/rootfs/bin/cpio': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/bin/cpio .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/cpio
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/bin/lsblk': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/bin/lsblk .../Linux_for_Tegra/bootloader/ramdisk_tmp//bin/lsblk
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libsmartcols.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libsmartcols.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libsmartcols.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib//libmount.so.1': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib//libmount.so.1 .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib//libmount.so.1
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/updates/drivers/nvpps/nvpps.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/updates/drivers/nvpps/nvpps.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/updates/drivers/nvpps/nvpps.ko
cp: cannot stat '.../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/updates/drivers/net/ethernet/nvidia/nvethernet/nvethernet.ko': No such file or directory
warning: cp -f .../Linux_for_Tegra/rootfs/usr/lib/modules/5.15.185-tegra/updates/drivers/net/ethernet/nvidia/nvethernet/nvethernet.ko .../Linux_for_Tegra/bootloader/ramdisk_tmp//lib/modules/5.15.185-tegra/updates/drivers/net/ethernet/nvidia/nvethernet/nvethernet.ko
sed: can't read .../Linux_for_Tegra/bootloader/ramdisk_tmp//etc/ssh/sshd_config: No such file or directory
command is failed
Error: failed to generate images
Cleaning up...

The NVIDIA module reboots back into Linux (not into the expected app that would be used for writing the SPI flash).

The initial error about installing Secureboot and another rpcbind running is interesting. I have not seen that before.

I am running an NFS server on this host, but I can disable it. I will try that and see if it changes anything. (It didn’t - see below)

[david_charlap]

Stopping my host’s NFS server and removing all entries from the /etc/exports file did not help.

The messages at the start of the flash are a little different, but, the same problem occurs:

$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u ...key.pem -v .../sbk.key -p "-c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg" jetson-orin-nano-devkit internal
Please install the Secureboot package to use initrd flash for fused board
# Entry added by NVIDIA initrd flash tool
.../Linux_for_Tegra/tools/kernel_flash/tmp 127.0.0.1(rw,nohide,insecure,no_subtree_check,async,no_root_squash)
rpcbind: another rpcbind is already running. Aborting
Export list for localhost:
.../Linux_for_Tegra/tools/kernel_flash/tmp 127.0.0.1
11:27:39.325 - Debug: UFW is not installed. NFS port should be open.
11:27:39.329 - Debug: Checking VPN connections...
11:27:39.339 - Debug: IPSec service is not running.
11:27:39.341 - Debug: VPN routes none in tun|tap|ppp|vpn|gpd.
11:27:39.345 - Debug: No VPN connection detected.
.../Linux_for_Tegra/tools/kernel_flash/l4t_initrd_flash_internal.sh --no-flash -u ...key.pem -v .../sbk.key -p -c bootloader/generic/cfg/flash_t234_qspi.xml --no-systemimg jetson-orin-nano-devkit internal
************************************
*                                  *
*  Step 1: Generate flash packages *
*                                  *
************************************
...

[JerryChang]

hello david_charlap,

please see-also.. To Flash the Jetson Developer Kit Operating Software.
you’ll need to untar two files, and then assemble the rootfs.

@david_charlap

Please install the Secureboot package to use initrd flash for fused board

you may ignore this messages, since you used l4t-r36.5, the Secureboot package has packed into L4T now.

[david_charlap]

As I mentioned before, this is not a developer kit and I can not install the stock Ubuntu image.

I have a working tegraflash.tar.gz file which includes an .ext4 file with the root file system, a boot.img file for the kernel partition and a .dtb file with the DeviceTree binary.

My NVMe storage is partitioned for A/B booting. I can use dd to copy these files to the standby partitions (boot.img to A_kernel or B_kernel, the DTB to A_kernel-dtb or B_kernel-dtb and the EXT image to APP or APP_b), then switch the active partition. This works.

Before I burned the fuses, I was able to use the doflash.sh and initrd-flash scripts to create and populate the partitions on the SPI-flash and NVMe. This is what doesn’t work after burning the fuses.

I do not know how to prepare a generic Linux_for_Tegra directory with the contents of my build in order to allow l4t_initrd_flash.sh to work. Do I need to copy the entire contents of my ext4 file system (which is about 3GB) to Linux_for_Tegra/rootfs? Or is there a simpler way?

Again, I already have working images. They only need to be signed and installed. I think it is going to be a lot of unnecessary work to try and unpack everything so that your script can reassemble the same images.

[JerryChang]

hello david_charlap,

please work on root file system issue, here’s see-also Topic 331866, we’ve also tested locally with SBKPKC fused device.

[david_charlap]

I think you’ve lost track of the original question. I have working root file systems, which I can install via dd commands from a running device.

The problem is with the signing keys. Remember that the command to read the fuses from recovery mode is failing. This has nothing to do with the content of the root file system.

I have heard from others (on another forum) that what I did has worked with an RSA-3K key. Is it possible that ECDSA-P521 keys don’t work, despite their presence in the documentation?

I reviewed the linked topic, and that situation is using RSA-2K keys on a different module.

[david_charlap]

I have run some additional tests and have confirmed two things:

• ECDSA-P521 keys do not seem to work.
• The odmfuseread.sh script doesn’t work at all when there are keys burned to the module’s fuses.

Here’s the details:

Prerequisite

I installed a new, blank module.

I downloaded and unpacked a clean copy of the Jetson_Linux_R36.5.0_aarch64.tbz2 archive and unpacked it, in order to have a clean baseline starting point.

Create Keys

For this test, I only created a PKC key, and I created it using an RSA-3K, not ECDSA:

$ openssl genrsa -out rsakey_priv.pem 3072‎

$ cd .../Linux_for_Tegra/bootloader‎
$ cp .../rsakey_priv.pem .‎
‎
$ ./tegrasign_v3.py --pubkeyhash rsakey.pubkey rsakey.hash --key rsakey_priv.pem 
Key size is 256 bytes 
Saving pkc public key in rsakey.pubkey 
Sha saved in pcp.sha 
tegra-fuse format (big-endian): ‎‎0xebcc1285bea9e89c53001920ca1ad2e72b6410ceba0ede5588016c8592b676e2c9a916ed93678392‎‎4ddebadf56f165394855ef777dd7f680452a1e2aedcc1959‎

Read the existing fuses

Before burning any fuses, I used odmfuseread.sh to read the existing fuses. This worked successfully:

‎$ sudo ./odmfuseread.sh -i 0x23 jetson-orin-nano-devkit-nvme
...
Fuse reading is done. The fuse values have been saved in: .../Linux_for_Tegra/bootloader/fuse_info.txt‎
PublicKeyHash: ‎‎0000000000000000000000000000000000000000000000000000000000000000000000000000000000‎‎0000000000000000000000000000000000000000000000‎
BootSecurityInfo: 000001e0‎
ArmJtagDisable: 00000000‎
SecurityMode: 00000000‎
SwReserved: 00000000‎
DebugAuthentication: 00000000‎
OdmId: 0000000000000000‎
OdmLock: 00000000‎
ReservedOdm0: 00000000‎
ReservedOdm1: 00000000‎
ReservedOdm2: 00000000‎
ReservedOdm3: 00000000‎
ReservedOdm4: 00000000‎
ReservedOdm5: 00000000‎
ReservedOdm6: 00000000‎
ReservedOdm7: 00000000‎

I noted that BootSecurityInfo is pre-burned to 000001e0. This is what the NVIDIA fuse update field-service bulletin says I should expect. (My previous module did not have these bits burned.)

Make the fuse-config file

I created this fuse-config file, with only my PKC key. I am not setting SecurityMode, because I want to be able to burn additional fuses in the future.

‎<genericfuse MagicId="0x45535546" version="1.0.0"> 
‎    <fuse name="PublicKeyHash" size="64" ‎value="0xebcc1285bea9e89c53001920ca1ad2e72b6410ceba0ede5588016c8592b676e2c9a916ed9‎‎36783924ddebadf56f165394855ef777dd7f680452a1e2aedcc1959"/> 
‎    <fuse name="BootSecurityInfo" size="4" value="0x1E1"/> 
‎</genericfuse>‎

Burn the fuses

I did perform a test-burn, which reported success. Then I burned the fuse-config file with this command:

$ sudo ./odmfuse.sh -X .../fuse_config.xml -i 0x23 jetson-orin-nano-devkit-nvme

Verify the burn

From the module’s Linux shell, the nv_fuse_read.sh script confirms that the fuses were burned:

‎# nv_fuse_read.sh ‎

odm_lock: 0x00000000‎
revoke_pk_h0: 0x00000000‎
revoke_pk_h1: 0x00000000‎
optin_enable: 0x00000000‎
public_key_hash: ‎‎0xebcc1285bea9e89c53001920ca1ad2e72b6410ceba0ede5588016c8592b676e2c9a916ed93678392‎‎4ddebadf56f165394855ef777dd7f680452a1e2aedcc1959‎
boot_security_info: 0x000001e1‎
odmid: 0x0000000000000000‎
pk_h1: ‎‎0x00000000000000000000000000000000000000000000000000000000000000000000000000000000‎‎000000000000000000000000000000000000000000000000‎
pk_h2: ‎‎0x00000000000000000000000000000000000000000000000000000000000000000000000000000000‎‎000000000000000000000000000000000000000000000000‎
security_mode: 0x00000000‎
reserved_odm2: 0x00000000‎
reserved_odm3: 0x00000000‎
reserved_odm0: 0x00000000‎
reserved_odm1: 0x00000000‎
reserved_odm6: 0x00000000‎
reserved_odm7: 0x00000000‎
reserved_odm4: 0x00000000‎
reserved_odm5: 0x00000000‎
odminfo: 0x00000000‎
system_fw_field_ratchet1: 0x00000000‎
system_fw_field_ratchet0: 0x00000000‎
system_fw_field_ratchet3: 0x00000000‎
system_fw_field_ratchet2: 0x00000000‎
ecid: 0x8472643606380206‎

But the NVIDIA odmfuseread.sh script fails

The module’s console shows no output whatsoever. The script generates the following output:

$ sudo ./odmfuseread.sh -i 0x23 -k .../rsakey_priv.pem jetson-orin-nano-devkit-nvme
Existing emcfuse(.../Linux_for_Tegra/bootloader/fuse_t234.xml) reused.
Existing emcfuse(.../Linux_for_Tegra/bootloader/fuse_t234.xml) reused.
copying minratchet_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)... done.
./tegraflash.py --chip 0x23 --applet ".../Linux_for_Tegra/bootloader/mb1_t234_prod.bin" --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins "mb2_applet applet_t234.bin" --cmd "readfuses fuse_t234.bin fuse_t234.xml; dump eeprom cvm cvm.bin; dump custinfo custinfo_out.bin; reboot recovery" --key ".../rsakey_priv.pem" --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0512 ] Reading fuses
[   0.0545 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --getmode mode.txt
[   0.0548 ] Assuming zero filled SBK key : not reading .../rsakey_priv.pem
[   0.0528 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts
[   0.1197 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts
[   0.1459 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts
[   0.1647 ] Parsing partition layout
[   0.1653 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.1671 ] Kernel DTB used: None
[   0.1672 ] WARNING: dce base dtb is not provided

[   0.1675 ] Parsing partition layout
[   0.1680 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.1690 ] Creating list of images to be signed
[   0.1696 ] Generating ratchet blob
[   0.1698 ] Generating coldboot mb1-bct
[   0.1704 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.1711 ] MB1-BCT version: 0.13

[   0.1759 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.1789 ] Added Platform Config 9 data with size :- 100
[   0.1790 ] 
[   0.1791 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.1792 ] 
[   0.1793 ] Updating mb1-bct with firmware information
[   0.1801 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.1937 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.2084 ] Generating SHA2 Hash for mb1bct
[   0.2187 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.2307 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.2295 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct zerosbk
[   0.2304 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.2431 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.2434 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.2557 ] Warning: pub_key.key is not found
[   0.2545 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader.bct.encrypt mb1_cold_boot_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.2573 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --ratchet_blob ratchet_blob.bin --list images_list.xml zerosbk
[   0.2578 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.2626 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.2657 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.2721 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.2753 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.2866 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.2877 ] adding BCH for mb2_t234_aligned.bin
[   0.2953 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.3199 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.3211 ] adding BCH for mb2_t234_aligned.bin
[   0.3604 ] Filling MB1 storage info
[   0.3605 ] Parsing dev params for multi chains
[   0.3788 ] Generating br-bct
[   0.3793 ] Updating dev and MSS params in BR BCT
[   0.3794 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   0.3885 ] Updating bl info
[   0.3893 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin
[   0.3904 ] WARNING: boot chain is not completed. set to 0
[   0.3918 ] Generating signatures
[   0.3940 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list images_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.3943 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.4264 ] Warning: pub_key.key is not found
[   0.4249 ] Parsing dev params for multi chains
[   0.4249 ] Generating br-bct
[   0.4256 ] Updating dev and MSS params in BR BCT
[   0.4257 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   0.4284 ] Updating bl info
[   0.4288 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   0.4292 ] WARNING: boot chain is not completed. set to 0
[   0.4324 ] Generating SHA2 Hash
[   0.4427 ] Sha saved in br_bct_BR.sha
[   0.4408 ] Get Signed section of bct
[   0.4413 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --listbct bct_list.xml
[   0.4444 ] Signing BCT
[   0.4466 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.4469 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.4509 ] Sha saved in br_bct_BR.sha
[   0.4514 ] Warning: pub_key.key is not found
[   0.4493 ] Updating BCT with signature
[   0.4502 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesig bct_list_signed.xml
[   0.4517 ] Offset :4608 Len :3584
[   0.4605 ] Generating SHA2 Hash
[   0.4628 ] tegrasign_v3.py --key None --list bct_list.xml --sha sha512
[   0.4631 ] Assuming zero filled SBK key
[   0.4632 ] Assuming zero filled SBK key
[   0.4787 ] Sha saved in br_bct_BR.sha
[   0.4772 ] Updating BCT with SHA2 Hash
[   0.4777 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesha bct_list_signed.xml
[   0.4784 ] Offset :4608 Len :3584
[   0.4792 ] Offset :68 Len :8124
[   0.5247 ] Generating coldboot mb1-bct
[   0.5253 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.5258 ] MB1-BCT version: 0.13

[   0.5299 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.5312 ] Added Platform Config 9 data with size :- 100

[   0.5324 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.5365 ] Updating mb1-bct with firmware information
[   0.5416 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.5435 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.5524 ] Generating SHA2 Hash for mb1bct
[   0.5586 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.5600 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.5583 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct zerosbk
[   0.5587 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.5707 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.5711 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.5851 ] Warning: pub_key.key is not found
[   0.5836 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader.bct.encrypt mb1_cold_boot_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.5928 ] Generating recovery mb1-bct
[   0.5967 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.5980 ] MB1-BCT version: 0.13

[   0.6017 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.6026 ] Added Platform Config 9 data with size :- 100

[   0.6035 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.6085 ] Updating mb1-bct with firmware information
[   0.6090 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct_MB1.bct --recov --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.6170 ] tegrahost_v2 --chip 0x23 0 --align mb1_bct_MB1_aligned.bct
[   0.6204 ] Generating SHA2 Hash for mb1bct
[   0.6239 ] Sha saved in mb1_bct_MB1_aligned.sha
[   0.6251 ] Sha saved in mb1_bct_MB1.sha
[   0.6233 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_bct_MB1_aligned.bct zerosbk
[   0.6237 ] adding BCH for mb1_bct_MB1_aligned.bct
[   0.6391 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.6395 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.6414 ] Warning: pub_key.key is not found
[   0.6398 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_bct_MB1_aligned_sigheader.bct.encrypt mb1_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.6488 ] Info: Skip generating mem_bct because sdram_config is not defined
[   0.6488 ] Info: Skip generating mem_bct because sdram_config is not defined
[   0.6489 ] Copying signatures
[   0.6495 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   0.6617 ] mb1_t234_prod_aligned_sigheader.bin.signed filename is from images_list
[   0.6620 ] psc_bl1_t234_prod_aligned_sigheader.bin.signed filename is from images_list
[   0.6620 ] Boot Rom communication
[   0.6627 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.encrypt
[   0.6638 ] BR_CID: 0x81012344705DF888180000000E008180
[   0.7783 ] Sending bct_br
[   0.8888 ] File mb1_t234_prod_aligned_sigheader.bin.signed open failed
Error: Return value 19
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.encrypt
[   0.8922 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   0.8936 ] Retrieving board information
[   0.8942 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   0.8952 ] Retrieving EEPROM data
[   0.8952 ] tegrarcm_v2 --oem platformdetails eeprom cvm .../Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0
[   0.8975 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   0.8982 ] Dumping customer Info
[   0.8987 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   0.9017 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
[   0.9023 ] File tmp.bct open failed
Error: Return value 19
Command tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
Reading board information failed.

Flashing my firmware image

The (Yocto-generated) flash scripts worked successfully to sign and flash my image:

$ sudo ./doflash.sh -u .../rsakey_priv.pem --spi-only
$ sudo ./initrd-flash -u .../rsakey_priv.pem

[JerryChang]

hello david_charlap,

@david_charlap

But the NVIDIA odmfuseread.sh script fails

according to the logs, Reading board information failed, which should due to you’re having a customize board,
please try the following modifications will be needed on the MB2 BCT file,
for instance, $OUT/Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb2-bct-misc-p3767-0000.dts

- cvb_eeprom_read_size = <0x100>
+ cvb_eeprom_read_size = <0x0>

@david_charlap

The (Yocto-generated) flash scripts worked successfully to sign and flash my image:

thanks for confirmation, that should be an issue with the ECDSA-P521 keys.
I’ve re-check your 1st post, especially for below section.

@david_charlap

$ openssl ecparam -name secp521r1 -genkey -noout -out key.pem

‎$ …/tegrasign_v3.py --pubkeyhash key.pubkey key.hash --key ‎key.pem ‎

Valid ECC key. Key size is 521
Saving public key in key.pubkey for ECC
Sha saved in pcp.sha
tegra-fuse format (big-endian): ‎‎0xdd5dfef6ab46e95772265d0d3a7ef2009db30c0db9238b06035573efacb5c0cf4099392d5b94d871‎‎7aaab23e54ad06b41c97e2186331848e8d7cafb6f0bd5f84‎

$ openssl pkey -in key.pem --pubout > key.pub.pem

the fuse xml file should have key.pem’s PublicKeyHash,
however, for image flashing, fuse reading, you should use key.pem directly.

[david_charlap]

I have made that change to the BCT file as a part of compiling my Yocto image. It was necessary for Linux to boot on this board.

I made the corresponding change to the file in the Linux_forTegra directory that that I’m using to run the odmflashread.sh script, but it didn’t change anything. Nothing in the script’s output indicates that it is trying to compile that file:

$ sudo ./odmfuseread.sh -i 0x23 -k .../rsakey_priv.pem jetson-orin-nano-devkit-nvme

Existing emcfuse(.../Linux_for_Tegra/bootloader/fuse_t234.xml) reused.
Existing emcfuse(.../Linux_for_Tegra/bootloader/fuse_t234.xml) reused.
copying minratchet_config(.../Linux_for_Tegra/bootloader/generic/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)... done.
./tegraflash.py --chip 0x23 --applet ".../Linux_for_Tegra/bootloader/mb1_t234_prod.bin" --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins "mb2_applet applet_t234.bin" --cmd "readfuses fuse_t234.bin fuse_t234.xml; dump eeprom cvm cvm.bin; dump custinfo custinfo_out.bin; reboot recovery" --key ".../rsakey_priv.pem" --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0788 ] Reading fuses
[   0.0940 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --getmode mode.txt
[   0.0944 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.0807 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts
[   0.0956 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts
[   0.1203 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts
[   0.1344 ] Parsing partition layout
[   0.1350 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.1505 ] Kernel DTB used: None
[   0.1507 ] WARNING: dce base dtb is not provided

[   0.1508 ] Parsing partition layout
[   0.1520 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.1593 ] Creating list of images to be signed
[   0.1601 ] Generating ratchet blob
[   0.1602 ] Generating coldboot mb1-bct
[   0.1607 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.1674 ] MB1-BCT version: 0.13
[   0.1676 ] 
[   0.1677 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.1678 ] Added Platform Config 9 data with size :- 100
[   0.1678 ] 
[   0.1679 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.1680 ] 
[   0.1681 ] Updating mb1-bct with firmware information
[   0.1688 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.1803 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.1913 ] Generating SHA2 Hash for mb1bct
[   0.2093 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.2213 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.2083 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct zerosbk
[   0.2091 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.2338 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.2342 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.2538 ] Warning: pub_key.key is not found
[   0.2440 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader.bct.encrypt mb1_cold_boot_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.2557 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --ratchet_blob ratchet_blob.bin --list images_list.xml zerosbk
[   0.2565 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.2610 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.2654 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.2760 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.2784 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.2884 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.2898 ] adding BCH for mb2_t234_aligned.bin
[   0.2973 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.3218 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.3236 ] adding BCH for mb2_t234_aligned.bin
[   0.3593 ] Filling MB1 storage info
[   0.3593 ] Parsing dev params for multi chains
[   0.3772 ] Generating br-bct
[   0.3782 ] Updating dev and MSS params in BR BCT
[   0.3783 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   0.3873 ] Updating bl info
[   0.3880 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin
[   0.3890 ] WARNING: boot chain is not completed. set to 0
[   0.4036 ] Generating signatures
[   0.4177 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list images_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.4181 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.4871 ] Warning: pub_key.key is not found
[   0.4736 ] Parsing dev params for multi chains
[   0.4736 ] Generating br-bct
[   0.4741 ] Updating dev and MSS params in BR BCT
[   0.4743 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   0.4753 ] Updating bl info
[   0.4757 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   0.4761 ] WARNING: boot chain is not completed. set to 0
[   0.4793 ] Generating SHA2 Hash
[   0.4944 ] Sha saved in br_bct_BR.sha
[   0.4806 ] Get Signed section of bct
[   0.4809 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --listbct bct_list.xml
[   0.4832 ] Signing BCT
[   0.4973 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.4975 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.5092 ] Sha saved in br_bct_BR.sha
[   0.5170 ] Warning: pub_key.key is not found
[   0.5031 ] Updating BCT with signature
[   0.5040 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesig bct_list_signed.xml
[   0.5074 ] Offset :4608 Len :3584
[   0.5273 ] Generating SHA2 Hash
[   0.5413 ] tegrasign_v3.py --key None --list bct_list.xml --sha sha512
[   0.5417 ] Assuming zero filled SBK key
[   0.5418 ] Assuming zero filled SBK key
[   0.5493 ] Sha saved in br_bct_BR.sha
[   0.5360 ] Updating BCT with SHA2 Hash
[   0.5370 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesha bct_list_signed.xml
[   0.5387 ] Offset :4608 Len :3584
[   0.5968 ] Offset :68 Len :8124
[   0.6395 ] Generating coldboot mb1-bct
[   0.6436 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.6450 ] MB1-BCT version: 0.13

[   0.6498 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.6522 ] Added Platform Config 9 data with size :- 100
[   0.6522 ] 
[   0.6522 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.6522 ] 
[   0.6522 ] Updating mb1-bct with firmware information
[   0.6556 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.6684 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.6713 ] Generating SHA2 Hash for mb1bct
[   0.6875 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.6986 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.6861 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct zerosbk
[   0.6866 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.7067 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.7071 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.7180 ] Warning: pub_key.key is not found
[   0.7116 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader.bct.encrypt mb1_cold_boot_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.7156 ] Generating recovery mb1-bct
[   0.7165 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.7172 ] MB1-BCT version: 0.13

[   0.7219 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb 
[   0.7247 ] Added Platform Config 9 data with size :- 100

[   0.7267 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb 
[   0.7393 ] Updating mb1-bct with firmware information
[   0.7435 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct_MB1.bct --recov --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.7482 ] tegrahost_v2 --chip 0x23 0 --align mb1_bct_MB1_aligned.bct
[   0.7490 ] Generating SHA2 Hash for mb1bct
[   0.7643 ] Sha saved in mb1_bct_MB1_aligned.sha
[   0.7724 ] Sha saved in mb1_bct_MB1.sha
[   0.7591 ] tegrahost_v2 --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin --appendsigheader mb1_bct_MB1_aligned.bct zerosbk
[   0.7595 ] adding BCH for mb1_bct_MB1_aligned.bct
[   0.7819 ] tegrasign_v3.py --key .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem --list mb1_bct_MB1_aligned_sigheader.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.7855 ] Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem
[   0.7968 ] Warning: pub_key.key is not found
[   0.7840 ] tegrahost_v2 --chip 0x23 0 --updatesigheader mb1_bct_MB1_aligned_sigheader.bct.encrypt mb1_bct_MB1_aligned_sigheader.bct.hash zerosbk
[   0.7956 ] Info: Skip generating mem_bct because sdram_config is not defined
[   0.7957 ] Info: Skip generating mem_bct because sdram_config is not defined
[   0.7958 ] Copying signatures
[   0.7965 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   0.8201 ] mb1_t234_prod_aligned_sigheader.bin.signed filename is from images_list
[   0.8207 ] psc_bl1_t234_prod_aligned_sigheader.bin.signed filename is from images_list
[   0.8208 ] Boot Rom communication
[   0.8217 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.encrypt
[   0.8228 ] BR_CID: 0x81012344705DF888180000000E008180
[   0.9375 ] Sending bct_br
[   1.0479 ] File mb1_t234_prod_aligned_sigheader.bin.signed open failed
Error: Return value 19
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.encrypt
[   1.0517 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   1.0528 ] Retrieving board information
[   1.0534 ] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin
[   1.0541 ] Retrieving EEPROM data
[   1.0541 ] tegrarcm_v2 --oem platformdetails eeprom cvm .../Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0
[   1.0561 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   1.0567 ] Dumping customer Info
[   1.0571 ] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct
[   1.0582 ] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
[   1.0586 ] File tmp.bct open failed
Error: Return value 19
Command tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo .../Linux_for_Tegra/bootloader/custinfo_out.bin
Reading board information failed.

Is there a dtb file that I can replace with the one from my working system image? Perhaps that is the problem.

Or perhaps I should create a new .conf file for my board and use that? Is there documentation for what I should change there?

Some additional questions regarding the output of odmfuseread.sh:

• All but one of the calls to tegrasign_v3.py return Assuming zero filled SBK key : not reading .../Linux_for_Tegra/tmp/keys/rsa3k/rsakey_priv.pem. Does this indicate a problem? It clearly won’t work if my key file is ignored.

  The call that doesn’t generate this error doesn’t have a key. It is calling tegrasign_v3.py --key None --list bct_list.xml --sha sha512

• Nothing in the output indicates that is is reading or otherwise processing the file tegra234-mb2-bct-misc-p3767-0000.dts. Do I need to replace one of the L4T DTB files with the DTB used by my system image?

• I’m surprised that the script is trying to read the board information. I thought that was only necessary if you aren’t specifying a chip ID or board type as a parameter to the script.

@JerryChang

the fuse xml file should have key.pem’s PublicKeyHash,
however, for image flashing, fuse reading, you should use key.pem directly.

Thanks for the confirmation. I tried both files, but the results did not change.

You may want to change the help-text for the scripts. That text says it wants the public key file:

./odmfuseread.sh 
Error: chip_id is missing.
Usage:
  ./odmfuseread.sh -i <chip_id> [options] target_board

  where:
    chip_id --------------- Jetson TX2: 0x18, Jetson Xavier: 0x19

  options:
    -k <key_file> --------- The public key file.
    -S <sbk_file> --------- The SBK file.

[david_charlap]

I also just noticed that the help text for odmfuseread.sh doesn’t mention Orin processors. It lists chip IDs for TX2 and Xavier only.

Is the odmfuseread.sh script compatible with Orin modules?

The help text for odmfuse.sh, does mention the Orin’s chip ID (0x23):

>./odmfuse.sh
*** Error: Tegra ID is missing.
Usage:
  ./odmfuse.sh -i <TegraID> [options] TargetBoard

  Where options are,
    -c <CryptoType> ---------- Set the crypto type(obsolete). Please use "--auth" instead.
    -d <0xXXXX> -------------- sets sec_boot_dev_cfg=0xXXXX&0x3fff(obsolete). Please use "-r" instead.
    -i <TegraID> ------------- tegra ID: 0x23-Orin, 0x19-Xavier
    -j ----------------------- Keep jtag enabled (obsolete). Jtag by default is enabled.
                               Jtag can be disabled by using "--disable-jtag" option.
                               Jtag can't be re-enabled once the jtag disable fuse bit is burned.
    -k <KeyFile> ------------- 2048 bit RSA private KEY file for Xavier.
                               3072 bit RSA private KEY file for Orin.
    -l <0xXXX> --------------- sets odm_lock=0xX. (4 bits)
    -p ----------------------- sets production mode.
    -r <0xXX> ---------------- sets sw_reserved=0xXX.
    -S <SBK file> ------------ 128bit Secure Boot Key file in HEX format.
    -X <fuse XML file> ------- fuse configuration XML file to burn.
                               For detail, refer to "Secureboot" section of
                               L4T BSP documentation.
    --auth ------------------- Set the current authentication type of the board. Possible values:
                               NS -- No authentication, PKC - PKC is enabled, SBKPKC - SBK and PKC are enabled.
                               This option is only needed in offline mode, namely option "--noburn" is set.
    --noburn ----------------- Prepare fuse blob without actual burning.
    --test ------------------- No fuses will be really burned, for test purpose.
    --force ------------------ For fuses that have been burned, force to burn it again.
    --disable-jtag ----------- Burn the jtag-disable fuse. You can't re-enable it after it is burned.
    --KEK0 <Key file> -------- 128bit Key Encryption Key file in HEX format.
    --KEK1 <Key file> -------- 128bit Key Encryption Key file in HEX format.
    --KEK2 <Key file> -------- 128bit Key Encryption Key file in HEX format.
    --KEK256 <Key file> ------ 256bit Key Encryption Key file in HEX format.
    --odm_reserved[0-7] ------ sets 32bit ReservedOdm[0-7]. (Input=0xXXXXXXXX)
    --debug_authentication --- Set arm_debug_authentication=0xXX&0x1f. (5 bits)
    --odm_id ----------------- Set odm_id=0xXXXXXXXXXXXXXXXX. (64 bits)
                               High 32 bits: odm_id[0]. Low 32 bits: odm_id[1].
*** Error: Unsupported Tegra ID .

[JerryChang]

hello david_charlap,

odmfuseread.sh script did support Orin series,
as you can see.

if [ "${tid}" != "0x18" ] && [ "${tid}" != "0x19" ] && [ "${tid}" != "0x23" ]; then
        echo "Error: Unsupported chip_id: ${tid}";
        usage;
fi;