Secureboot on Nano

Thanks, but what’s the point of the reference? Adding -x and -y options?

I have tried anyway, but got the same error.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
[sudo] password for tsato: 
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0841 ] Parsing fuse info as per xml file
[   0.1253 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.1479 ] 
[   0.1480 ] Generating RCM messages
[   0.2464 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.2483 ] RCM 0 is saved as rcm_0.rcm
[   0.4651 ] RCM 1 is saved as rcm_1.rcm
[   0.4655 ] List of rcm files are saved in rcm_list.xml
[   0.4693 ] 
[   0.4693 ] Signing RCM messages
[   0.5485 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.5504 ] Assuming zero filled SBK key
[   0.7482 ] 
[   0.7483 ] Copying signature to RCM mesages
[   0.7498 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.7528 ] 
[   0.7529 ] Boot Rom communication
[   0.7543 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.7558 ] BR_CID: 0x421010016445b5071000000018058200
[   0.9142 ] RCM version 0X210001
[   1.0980 ] Boot Rom communication completed
[   2.1050 ] 
[   2.1050 ] Blowing fuses
[   2.1069 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   2.1087 ] Applet version 00.01.0000
[   2.4513 ] Successfully burnt fuses as per fuse info blob
[   2.4638 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.
$ sudo ./flash.sh -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: NS, 
###############################################################################
Error: either RSA key file and/or SBK key file are proviced for none SBK and PKC protected target board.

As you can see, odmfuse.sh succeeds, but the flash fails.

I have never encountered such an issue on TX2.

TakenoriSato,
So you know the fuse spec for Nano was posted on the Download site,
https://developer.nvidia.com/embedded/downloads#?search=fuse

OK, I will try with the updated document and the tools.

I have downloaded the tool for L4T 32.3.1 for Nano, tried again, but got the same result as follows.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0029 ] Parsing fuse info as per xml file
[   0.0045 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0067 ] 
[   0.0067 ] Generating RCM messages
[   0.0085 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0102 ] RCM 0 is saved as rcm_0.rcm
[   0.0113 ] RCM 1 is saved as rcm_1.rcm
[   0.0113 ] List of rcm files are saved in rcm_list.xml
[   0.0113 ] 
[   0.0113 ] Signing RCM messages
[   0.0130 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0150 ] Assuming zero filled SBK key
[   0.0284 ] 
[   0.0285 ] Copying signature to RCM mesages
[   0.0305 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0336 ] 
[   0.0337 ] Boot Rom communication
[   0.0355 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0373 ] BR_CID: 0x421010016445b5071000000018058200
[   0.1991 ] RCM version 0X210001
[   0.3746 ] Boot Rom communication completed
[   1.3814 ] 
[   1.3815 ] Blowing fuses
[   1.3835 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.3855 ] Applet version 00.01.0000
[   1.7243 ] Successfully burnt fuses as per fuse info blob
[   1.7364 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.

Then, unplugged and turned on to flash.

$ sudo ./flash.sh -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: NS, 
###############################################################################
Error: either RSA key file and/or SBK key file are proviced for none SBK and PKC protected target board.

What have you actually fixed?

Hi,
Please help confirm the steps you have run with Jetson Nano production module.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
// Above step is executed successfully
$ sudo ./flash.sh -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
// Hit error:
// Error: either RSA key file and/or SBK key file are proviced for none SBK and PKC protected target board.

Thanks for your confirmation.

Yes, it is the problem I am talking about.

Hi,
The README says:

========================================================================
Signing and Flashing Boot Files in two steps:
========================================================================
 =======================================================================
 Step 1: Sign
 =======================================================================
  Use only PKC key or zero key:
  ======================================================================
  1. Navigate to the directory where you installed L4T.
  2. Place the Tegra device into force recovery mode.

     For TX1/Nano Production Module:
     ===================================================================
     $ sudo ./flash.sh --no-flash -x 0x21 -y PKC -u <keyfile> \
         <device name> mmcblk0p1
(...skip)
 =======================================================================
 Step 2: Flash
 =======================================================================
  Flash with PKC or zero key Signed Boot File Binaries:
  ======================================================================
  1. Navigate to the directory where you installed L4T.
  2. Place the Tegra device into force recovery mode.
  3. Run following commands:
      $ cd bootloader
      $ sudo bash ./flashcmd.txt

Please try

$ sudo ./flash.sh --no-flash -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
$ cd bootloader
$ sudo bash ./flashcmd.txt

I see. I have tried only the procedure in one step before.

So I will try this in two steps.

So I will try this in two steps.

I have tried and failed as follows.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0034 ] Parsing fuse info as per xml file
[   0.0052 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0075 ] 
[   0.0075 ] Generating RCM messages
[   0.0092 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0109 ] RCM 0 is saved as rcm_0.rcm
[   0.0120 ] RCM 1 is saved as rcm_1.rcm
[   0.0120 ] List of rcm files are saved in rcm_list.xml
[   0.0120 ] 
[   0.0120 ] Signing RCM messages
[   0.0138 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0155 ] Assuming zero filled SBK key
[   0.0269 ] 
[   0.0269 ] Copying signature to RCM mesages
[   0.0288 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0314 ] 
[   0.0315 ] Boot Rom communication
[   0.0334 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0351 ] BR_CID: 0x421010016445b5071000000018058200
[   0.1936 ] RCM version 0X210001
[   0.3695 ] Boot Rom communication completed
[   1.3765 ] 
[   1.3766 ] Blowing fuses
[   1.3789 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.3809 ] Applet version 00.01.0000
[   1.7187 ] Successfully burnt fuses as per fuse info blob
[   1.7312 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.
$ sudo ./flash.sh --no-flash -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
./tegraflash.py --chip 0x21 --applet "/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin" --skipuid --cmd "dump eeprom boardinfo cvm.bin" --key "/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0034 ] Generating RCM messages
[   0.0052 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin 0 0
[   0.0068 ] RCM 0 is saved as rcm_0.rcm
[   0.0079 ] RCM 1 is saved as rcm_1.rcm
[   0.0079 ] List of rcm files are saved in rcm_list.xml
[   0.0079 ] 
[   0.0079 ] Signing RCM messages
[   0.0096 ] tegrasign --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0114 ] PKC key in Open SSL format
[   0.0117 ] Key size is 256 bytes
[   0.0118 ] Saving public key  in pub_key.key
[   0.2154 ] Saving public key Hash as binary: pub_key.hash
[   0.2154 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   0.2155 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   0.2155 ] 
[   0.2155 ] Copying signature to RCM mesages
[   0.2175 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml --pubkeyhash pub_key.key
[   0.2202 ] 
[   0.2202 ] Boot Rom communication
[   0.2221 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
[   0.2240 ] RCM version 0X4
[   0.5889 ] Boot Rom communication failed
[   0.5889 ] 
Error: Return value 3
Command tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
Reading board information failed.

Please note that I have unplugged and turned on again between odmfuse.sh and flash.sh as I have explained in this post.

This is based on the result from the one step procedure as below.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0033 ] Parsing fuse info as per xml file
[   0.0049 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0071 ] 
[   0.0071 ] Generating RCM messages
[   0.0088 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0104 ] RCM 0 is saved as rcm_0.rcm
[   0.0113 ] RCM 1 is saved as rcm_1.rcm
[   0.0115 ] List of rcm files are saved in rcm_list.xml
[   0.0115 ] 
[   0.0115 ] Signing RCM messages
[   0.0132 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0149 ] Assuming zero filled SBK key
[   0.0251 ] 
[   0.0251 ] Copying signature to RCM mesages
[   0.0271 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0298 ] 
[   0.0298 ] Boot Rom communication
[   0.0318 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0335 ] BR_CID: 0x421010016445b5071000000018058200
[   0.1919 ] RCM version 0X210001
[   0.3676 ] Boot Rom communication completed
[   1.3746 ] 
[   1.3747 ] Blowing fuses
[   1.3768 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.3788 ] Applet version 00.01.0000
[   1.7169 ] Successfully burnt fuses as per fuse info blob
[   1.7295 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.
$ sudo ./flash.sh -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
Error: probing the target board failed.
       Make sure the target board is connected through 
       USB port and is in recovery mode.

But I found I can successfully run the flash.sh if I don’t unplug in the two step procedure, although it ended up with an error.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0033 ] Parsing fuse info as per xml file
[   0.0049 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0071 ] 
[   0.0072 ] Generating RCM messages
[   0.0088 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0105 ] RCM 0 is saved as rcm_0.rcm
[   0.0115 ] RCM 1 is saved as rcm_1.rcm
[   0.0116 ] List of rcm files are saved in rcm_list.xml
[   0.0116 ] 
[   0.0116 ] Signing RCM messages
[   0.0132 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0149 ] Assuming zero filled SBK key
[   0.0252 ] 
[   0.0253 ] Copying signature to RCM mesages
[   0.0273 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0302 ] 
[   0.0303 ] Boot Rom communication
[   0.0322 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0341 ] BR_CID: 0x421010016445b5071000000018058200
[   0.1919 ] RCM version 0X210001
[   0.3676 ] Boot Rom communication completed
[   1.3747 ] 
[   1.3748 ] Blowing fuses
[   1.3768 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.3788 ] Applet version 00.01.0000
[   1.7169 ] Successfully burnt fuses as per fuse info blob
[   1.7294 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.
$ sudo ./flash.sh --no-flash -x 0x21 -y PKC -u ../emi_pkc.pem -r jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
Board ID() version() 
copying bctfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/BCT/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg)... done.
copying bootloader(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying initrd(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
	populating kernel to rootfs... done.
	populating initrd to rootfs... done.
	populating /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0000-p3449-0000-a00.dtb to rootfs... done.
Making Boot image... done.
Existing sosfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin) reused.
copying tegraboot(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/nvtboot.bin)... done.
copying cpu_bootloader(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying bpffile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/sc7entry-firmware.bin)... done.
Existing badpagefile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/badpage.bin) reused.
copying wb0boot(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/warmboot.bin)... done.
Existing tosfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tos-mon-only.img) reused.
Existing eksfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/eks.img) reused.
copying dtbfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0000-p3449-0000-a00.dtb)... done.
Copying nv_boot_control.conf to rootfs
Reusing existing system.img... 
done.
Existing tbcfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_cpu.bin) reused.
copying tbcdtbfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0000-p3449-0000-a00.dtb)... done.
copying cfgfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cfg/flash_l4t_t210_emmc_p3448.xml) to flash.xml... done.
copying flasher(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
Existing flashapp(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash.py) reused.
./tegraflash.py --cfg flash.xml --bl cboot.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --odmdata 0x94000 --bldtb tegra210-p3448-0000-p3449-0000-a00.dtb.signed --applet nvtboot_recovery.bin    --cmd "sign"  --chip 0x21 --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem  
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0102 ] tegrasign --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem --getmode mode.txt
[   0.0117 ] PKC key in Open SSL format
[   0.0121 ] Key size is 256 bytes
[   0.0163 ] 
[   0.0166 ] Generating RCM messages
[   0.0182 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0199 ] RCM 0 is saved as rcm_0.rcm
[   0.0208 ] RCM 1 is saved as rcm_1.rcm
[   0.0209 ] List of rcm files are saved in rcm_list.xml
[   0.0209 ] 
[   0.0209 ] Signing RCM messages
[   0.0226 ] tegrasign --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0241 ] PKC key in Open SSL format
[   0.0245 ] Key size is 256 bytes
[   0.0247 ] Saving public key  in pub_key.key
[   0.2310 ] Saving public key Hash as binary: pub_key.hash
[   0.2311 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   0.2311 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   0.2311 ] 
[   0.2311 ] Copying signature to RCM mesages
[   0.2330 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml --pubkeyhash pub_key.key
[   0.2355 ] 
[   0.2356 ] Parsing partition layout
[   0.2375 ] tegraparser --pt flash.xml.tmp
[   0.2395 ] 
[   0.2396 ] Creating list of images to be signed
[   0.2414 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --list images_list.xml
[   0.2510 ] 
[   0.2511 ] Generating signatures
[   0.2527 ] tegrasign --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem --list images_list.xml --pubkeyhash pub_key.key
[   0.2544 ] PKC key in Open SSL format
[   0.2549 ] Key size is 256 bytes
[   0.2553 ] Saving public key  in pub_key.key
[   1.5879 ] Saving public key Hash as binary: pub_key.hash
[   1.5879 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   1.5880 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   1.5880 ] 
[   1.5880 ] Generating br-bct
[   1.5900 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --chip 0x21 0
[   1.5911 ] Copying Sdram info from 0 to 1 set
[   1.5927 ] Copying Sdram info from 1 to 2 set
[   1.5927 ] Copying Sdram info from 2 to 3 set
[   1.5927 ] 
[   1.5927 ] Updating boot device parameters
[   1.5945 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatedevparam flash.xml.bin
[   1.5963 ] Warning: No sdram params
[   1.5966 ] 
[   1.5966 ] Updating bl info
[   1.5979 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updateblinfo flash.xml.bin --updatesig images_list_signed.xml
[   1.6009 ] 
[   1.6009 ] Updating secondary storage information into bct
[   1.6025 ] tegraparser --pt flash.xml.bin --chip 0x21 0 --updatecustinfo P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   1.6039 ] 
[   1.6039 ] Updating Odmdata
[   1.6055 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatefields Odmdata =0x94000
[   1.6070 ] Warning: No sdram params
[   1.6073 ] 
[   1.6074 ] Get Signed section of bct
[   1.6084 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --listbct bct_list.xml
[   1.6103 ] 
[   1.6103 ] Signing BCT
[   1.6133 ] tegrasign --key /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem --list bct_list.xml --pubkeyhash pub_key.key
[   1.6151 ] PKC key in Open SSL format
[   1.6156 ] Key size is 256 bytes
[   1.6159 ] Saving public key  in pub_key.key
[   1.7260 ] Saving public key Hash as binary: pub_key.hash
[   1.7261 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   1.7261 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   1.7261 ] 
[   1.7261 ] Updating BCT with signature
[   1.7280 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatesig bct_list_signed.xml --pubkeyhash pub_key.key
[   1.7302 ] 
[   1.7303 ] Copying signatures
[   1.7318 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --updatesig images_list_signed.xml --pubkeyhash pub_key.key
[   1.7430 ] 
[   1.7430 ] Updating BFS information on BCT
[   1.7445 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin --pubkeyhash pub_key.key
[   1.7464 ]    BFS:
[   1.7494 ]      0: [PT ] flash.xml.bin (size=4319/131072)
[   1.7502 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   1.7510 ]      2: [RP1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   1.7522 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   1.7532 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   1.7540 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   1.7548 ] BFS0: 131072 @ 2560 SUM 08ba13ae over 2883584 bytes
[   1.7554 ]    BFS:
[   1.7555 ]      0: [PT-1] flash.xml.bin (size=4319/131072)
[   1.7559 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   1.7564 ]      2: [RP1-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   1.7572 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   1.7577 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   1.7582 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   1.7587 ] BFS1: 131072 @ 8704 SUM 08ba13ae over 2883584 bytes
[   1.7592 ]    KFS:
[   1.7889 ]      0: [DTB] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   1.7899 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   1.7906 ]      2: [EKS] eks.img (size=1028/81920)
[   1.7911 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   1.7917 ] KFS0: 1048576 @ 29376546 SUM e6e0a216 over 7905280 bytes
[   1.7935 ]    KFS:
[   1.8233 ]      0: [DTB-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   1.8245 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   1.8254 ]      2: [EKS-1] eks.img (size=1028/81920)
[   1.8260 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   1.8268 ] KFS1: 1048576 @ 29522082 SUM e6e0a216 over 7905280 bytes
[   1.8272 ] 
[   1.8273 ] Copying signed file in /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/signed
./tegraflash.py --bl cboot.bin.signed --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --odmdata 0x94000 --bldtb tegra210-p3448-0000-p3449-0000-a00.dtb.signed --applet rcm_1_signed.rcm --cmd "secureflash;reboot"  --cfg flash.xml --chip 0x21    --bins "EBT cboot.bin; DTB tegra210-p3448-0000-p3449-0000-a00.dtb"  --key "/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem" 
saving flash command in /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flashcmd.txt
saving Windows flash command to /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flash_win.bat
*** no-flash flag enabled. Exiting now... *** 
$ cd bootloader/
$ sudo bash ./flashcmd.txt
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0092 ] Parsing partition layout
[   0.0107 ] tegraparser --pt flash.xml.tmp
[   0.0131 ] 
[   0.0131 ] Updating BFS information on RCM BCT
[   0.0147 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.0162 ]    BFS:
[   0.0193 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.0198 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0203 ]      2: [RP1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0211 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.0215 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.0220 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0226 ] BFS0: 131072 @ 2560 SUM e657fcc8 over 2883584 bytes
[   0.0233 ]    BFS:
[   0.0244 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.0248 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0254 ]      2: [RP1-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0261 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.0266 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.0272 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0278 ] BFS1: 131072 @ 8704 SUM e657fcc8 over 2883584 bytes
[   0.0283 ]    KFS:
[   0.0633 ]      0: [DTB] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0642 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.0649 ]      2: [EKS] eks.img (size=1028/81920)
[   0.0653 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.0659 ] KFS0: 1048576 @ 29376546 SUM e6e0a216 over 7905280 bytes
[   0.0690 ]    KFS:
[   0.1056 ]      0: [DTB-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1067 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.1075 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.1080 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.1088 ] KFS1: 1048576 @ 29522082 SUM e6e0a216 over 7905280 bytes
[   0.1109 ] 
[   0.1110 ] Updating BFS information on BCT
[   0.1130 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.1147 ]    BFS:
[   0.1177 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.1182 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1187 ]      2: [RP1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1195 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.1199 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.1204 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1210 ] BFS0: 131072 @ 2560 SUM e657fcc8 over 2883584 bytes
[   0.1215 ]    BFS:
[   0.1229 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.1234 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1239 ]      2: [RP1-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1246 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.1251 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.1256 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1262 ] BFS1: 131072 @ 8704 SUM e657fcc8 over 2883584 bytes
[   0.1267 ]    KFS:
[   0.1633 ]      0: [DTB] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1643 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.1650 ]      2: [EKS] eks.img (size=1028/81920)
[   0.1655 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.1661 ] KFS0: 1048576 @ 29376546 SUM e6e0a216 over 7905280 bytes
[   0.1685 ]    KFS:
[   0.2047 ]      0: [DTB-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.2058 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.2066 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.2072 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.2080 ] KFS1: 1048576 @ 29522082 SUM e6e0a216 over 7905280 bytes
[   0.2091 ] 
[   0.2092 ] Boot Rom communication
[   0.2111 ] tegrarcm --chip 0x21 0 --rcm rcm_1_signed.rcm
[   0.2125 ] BootRom is not running
[   0.4151 ] 
[   0.4152 ] Sending BCTs
[   0.4170 ] tegrarcm --download bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   0.4188 ] Applet version 00.01.0000
[   0.7569 ] Sending bct
[   0.7571 ] [................................................] 100%
[   0.7610 ] 0000000b: Verification failed
[   0.7619 ] 
[   0.7620 ] 
Error: Return value 11
Command tegrarcm --download bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct

I have tried to unplug after this, and tried again, but failed with another error.

$ sudo bash ./flashcmd.txt
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0091 ] Parsing partition layout
[   0.0107 ] tegraparser --pt flash.xml.tmp
[   0.0123 ] 
[   0.0123 ] Updating BFS information on RCM BCT
[   0.0139 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.0154 ]    BFS:
[   0.0186 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.0191 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0195 ]      2: [RP1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0202 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.0206 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.0210 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0216 ] BFS0: 131072 @ 2560 SUM 1c96fd0d over 2883584 bytes
[   0.0220 ]    BFS:
[   0.0236 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.0240 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0246 ]      2: [RP1-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0254 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.0260 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.0266 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0272 ] BFS1: 131072 @ 8704 SUM 1c96fd0d over 2883584 bytes
[   0.0277 ]    KFS:
[   0.0641 ]      0: [DTB] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.0654 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.0662 ]      2: [EKS] eks.img (size=1028/81920)
[   0.0671 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.0679 ] KFS0: 1048576 @ 29376546 SUM e6e0a216 over 7905280 bytes
[   0.0691 ]    KFS:
[   0.1052 ]      0: [DTB-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1063 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.1071 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.1076 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.1085 ] KFS1: 1048576 @ 29522082 SUM e6e0a216 over 7905280 bytes
[   0.1095 ] 
[   0.1096 ] Updating BFS information on BCT
[   0.1116 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.1128 ]    BFS:
[   0.1141 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.1149 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1156 ]      2: [RP1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1169 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.1174 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.1179 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1185 ] BFS0: 131072 @ 2560 SUM 1c96fd0d over 2883584 bytes
[   0.1191 ]    BFS:
[   0.1191 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.1196 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1202 ]      2: [RP1-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1210 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.1215 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.1220 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1226 ] BFS1: 131072 @ 8704 SUM 1c96fd0d over 2883584 bytes
[   0.1231 ]    KFS:
[   0.1565 ]      0: [DTB] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1574 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.1581 ]      2: [EKS] eks.img (size=1028/81920)
[   0.1586 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.1592 ] KFS0: 1048576 @ 29376546 SUM e6e0a216 over 7905280 bytes
[   0.1612 ]    KFS:
[   0.1975 ]      0: [DTB-1] tegra210-p3448-0000-p3449-0000-a00.dtb.signed (size=215392/1048576)
[   0.1983 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.1989 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.1993 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.2001 ] KFS1: 1048576 @ 29522082 SUM e6e0a216 over 7905280 bytes
[   0.2019 ] 
[   0.2019 ] Boot Rom communication
[   0.2039 ] tegrarcm --chip 0x21 0 --rcm rcm_1_signed.rcm
[   0.2051 ] BR_CID: 0x421010016445b5071000000018058200
[   0.3652 ] Bootrom returned error 4
[   0.5476 ] Boot Rom communication failed
[   0.5477 ] 
Error: Return value 4
Command tegrarcm --chip 0x21 0 --rcm rcm_1_signed.rcm

Hi,

I found only one box showed an error out of 5 boxes as described in the other post, I have tried this on the other box.

But unfortunately, the result was the same.

$ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem -o 0xabcd001200000000000000000000000000000000000000000000000100000000
*** Calculating HASH from keyfile /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/emi_pkc.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0038 ] Parsing fuse info as per xml file
[   0.0054 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0076 ] 
[   0.0076 ] Generating RCM messages
[   0.0093 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0109 ] RCM 0 is saved as rcm_0.rcm
[   0.0120 ] RCM 1 is saved as rcm_1.rcm
[   0.0120 ] List of rcm files are saved in rcm_list.xml
[   0.0120 ] 
[   0.0120 ] Signing RCM messages
[   0.0137 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0154 ] Assuming zero filled SBK key
[   0.0288 ] 
[   0.0288 ] Copying signature to RCM mesages
[   0.0307 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0333 ] 
[   0.0334 ] Boot Rom communication
[   0.0352 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0371 ] BR_CID: 0x32101001644612850c00000008040440
[   0.1983 ] RCM version 0X210001
[   0.3742 ] Boot Rom communication completed
[   1.3811 ] 
[   1.3812 ] Blowing fuses
[   1.3832 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.3852 ] Applet version 00.01.0000
[   1.7236 ] Successfully burnt fuses as per fuse info blob
[   1.7363 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.
$ sudo ./flash.sh -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: , 
###############################################################################
Error: The RSA key file is provided for non-PKC protected target board.

So, this issue still persists.

Hi TakenoriSato,

Please try to add BOARDID, BOARDSKU and FAB in command:

$ sudo ./flash.sh BOARDID=3448 FAB=200 BOARDSKU=0002 -x 0x21 -y PKC -u ../emi_pkc.pem jetson-nano-emmc mmcblk0p1

Thanks it did work!

$ sudo ./flash.sh BOARDID=3448 FAB=200 BOARDSKU=0002 -x 0x21 -y PKC -u ../emi_pkc.pem -r jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: , 
###############################################################################
./tegraflash.py --chip 0x21 --applet "/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin" --skipuid --cmd "dump eeprom boardinfo cvm.bin" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0042 ] Generating RCM messages
[   0.0060 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin 0 0
[   0.0078 ] RCM 0 is saved as rcm_0.rcm
[   0.0087 ] RCM 1 is saved as rcm_1.rcm
[   0.0087 ] List of rcm files are saved in rcm_list.xml
[   0.0088 ] 
[   0.0088 ] Signing RCM messages
[   0.0105 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0123 ] Assuming zero filled SBK key
[   0.0253 ] 
[   0.0254 ] Copying signature to RCM mesages
[   0.0273 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0302 ] 
[   0.0302 ] Boot Rom communication
[   0.0321 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
[   0.0337 ] RCM version 0X210001
[   0.3976 ] Boot Rom communication completed
[   1.4046 ] 
[   1.4047 ] dump EEPROM info
[   1.4068 ] tegrarcm --oem platformdetails eeprom /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.4087 ] Applet version 00.01.0000
[   1.7470 ] Saved platform info in /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.8233 ] 
Board ID(3448) version(400) 
copying bctfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/BCT/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg)... done.
copying bootloader(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying initrd(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
	populating kernel to rootfs... done.
	populating initrd to rootfs... done.
	populating /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb to rootfs... done.
Making Boot image... done.
Existing sosfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin) reused.
copying tegraboot(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/nvtboot.bin)... done.
copying cpu_bootloader(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying bpffile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/sc7entry-firmware.bin)... done.
Existing badpagefile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/badpage.bin) reused.
copying wb0boot(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/warmboot.bin)... done.
Existing tosfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tos-mon-only.img) reused.
Existing eksfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/eks.img) reused.
copying dtbfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
Copying nv_boot_control.conf to rootfs
Making system.img... 
	populating rootfs from /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/rootfs ... done.
	Sync'ing system.img ... done.
	Converting RAW image to Sparse image... 

---- Raw to Sparse Image Converter v1.0 ----------------------------
  0: RAW:     5242880(      5 blks) ==>          28:5242892
  1: SKP:    32505856(     31 blks) ==>     5242920:12
  2: RAW:    97517568(     93 blks) ==>     5242932:97517580
  3: SKP:     3145728(      3 blks) ==>   102760512:12
  4: RAW:    44040192(     42 blks) ==>   102760524:44040204
  5: SKP:     1048576(      1 blks) ==>   146800728:12
  6: RAW:   220200960(    210 blks) ==>   146800740:220200972
  7: SKP:     3145728(      3 blks) ==>   367001712:12
  8: RAW:    97517568(     93 blks) ==>   367001724:97517580
  9: SKP:    15728640(     15 blks) ==>   464519304:12
 10: RAW:   152043520(    145 blks) ==>   464519316:152043532
 11: SKP:     3145728(      3 blks) ==>   616562848:12
 12: RAW:   187695104(    179 blks) ==>   616562860:187695116
 13: SKP:     1048576(      1 blks) ==>   804257976:12
 14: RAW:    76546048(     73 blks) ==>   804257988:76546060
 15: SKP:     3145728(      3 blks) ==>   880804048:12
 16: RAW:    41943040(     40 blks) ==>   880804060:41943052
 17: SKP:     4194304(      4 blks) ==>   922747112:12
 18: RAW:   188743680(    180 blks) ==>   922747124:188743692
 19: SKP:     4194304(      4 blks) ==>  1111490816:12
 20: RAW:    26214400(     25 blks) ==>  1111490828:26214412
 21: SKP:     3145728(      3 blks) ==>  1137705240:12
 22: RAW:     3145728(      3 blks) ==>  1137705252:3145740
 23: SKP:     1048576(      1 blks) ==>  1140850992:12
 24: RAW:   760217600(    725 blks) ==>  1140851004:760217612
 25: SKP:     3145728(      3 blks) ==>  1901068616:12
 26: RAW:    40894464(     39 blks) ==>  1901068628:40894476
 27: SKP:     1048576(      1 blks) ==>  1941963104:12
 28: RAW:    38797312(     37 blks) ==>  1941963116:38797324
 29: SKP:     3145728(      3 blks) ==>  1980760440:12
 30: RAW:    89128960(     85 blks) ==>  1980760452:89128972
 31: SKP:    28311552(     27 blks) ==>  2069889424:12
 32: RAW:    14680064(     14 blks) ==>  2069889436:14680076
 33: SKP:    85983232(     82 blks) ==>  2084569512:12
 34: RAW:  1074790400(   1025 blks) ==>  2084569524:1074790412
 35: SKP:     3145728(      3 blks) ==>  3159359936:12
 36: RAW:   265289728(    253 blks) ==>  3159359948:265289740
 37: SKP:     3145728(      3 blks) ==>  3424649688:12
 38: RAW:   183500800(    175 blks) ==>  3424649700:183500812
 39: SKP:     1048576(      1 blks) ==>  3608150512:12
 40: RAW:   121634816(    116 blks) ==>  3608150524:121634828
 41: SKP:     1048576(      1 blks) ==>  3729785352:12
 42: RAW:   367001600(    350 blks) ==>  3729785364:367001612
 43: SKP:    26214400(     25 blks) ==>  4096786976:12
 44: RAW:    33554432(     32 blks) ==>  4096786988:33554444
 45: SKP:    33554432(     32 blks) ==>  4130341432:12
 46: RAW:    25165824(     24 blks) ==>  4130341444:25165836
 47: SKP:     8388608(      8 blks) ==>  4155507280:12
 48: RAW:  1086324736(   1036 blks) ==>  4155507292:1086324748
 49: SKP:     4194304(      4 blks) ==>  5241832040:12
 50: RAW:    46137344(     44 blks) ==>  5241832052:46137356
 51: SKP:     1048576(      1 blks) ==>  5287969408:12
 52: RAW:    60817408(     58 blks) ==>  5287969420:60817420
 53: SKP:     1048576(      1 blks) ==>  5348786840:12
 54: RAW:   447741952(    427 blks) ==>  5348786852:447741964
 55: SKP:     5242880(      5 blks) ==>  5796528816:12
 56: RAW:   210763776(    201 blks) ==>  5796528828:210763788
 57: SKP:     7340032(      7 blks) ==>  6007292616:12
 58: RAW:    22020096(     21 blks) ==>  6007292628:22020108
 59: SKP:     3145728(      3 blks) ==>  6029312736:12
 60: RAW:    38797312(     37 blks) ==>  6029312748:38797324
 61: SKP:     3145728(      3 blks) ==>  6068110072:12
 62: RAW:    13631488(     13 blks) ==>  6068110084:13631500
 63: SKP:     3145728(      3 blks) ==>  6081741584:12
 64: RAW:    40894464(     39 blks) ==>  6081741596:40894476
 65: SKP:     1048576(      1 blks) ==>  6122636072:12
 66: RAW:    25165824(     24 blks) ==>  6122636084:25165836
 67: SKP:    25165824(     24 blks) ==>  6147801920:12
 68: RAW:    17825792(     17 blks) ==>  6147801932:17825804
 69: SKP:    82837504(     79 blks) ==>  6165627736:12
 70: RAW:     1048576(      1 blks) ==>  6165627748:1048588
 71: SKP:     3145728(      3 blks) ==>  6166676336:12
 72: RAW:  1315962880(   1255 blks) ==>  6166676348:1315962892
 73: SKP:     5242880(      5 blks) ==>  7482639240:12
 74: RAW:    57671680(     55 blks) ==>  7482639252:57671692
 75: SKP:     1048576(      1 blks) ==>  7540310944:12
 76: RAW:    27262976(     26 blks) ==>  7540310956:27262988
 77: SKP:     6291456(      6 blks) ==>  7567573944:12
 78: RAW:    74448896(     71 blks) ==>  7567573956:74448908
 79: SKP:     1048576(      1 blks) ==>  7642022864:12
 80: RAW:   138412032(    132 blks) ==>  7642022876:138412044
 81: SKP:     4194304(      4 blks) ==>  7780434920:12
 82: RAW:    24117248(     23 blks) ==>  7780434932:24117260
 83: SKP:     1048576(      1 blks) ==>  7804552192:12
 84: RAW:   108003328(    103 blks) ==>  7804552204:108003340
 85: SKP:     1048576(      1 blks) ==>  7912555544:12
 86: RAW:   124780544(    119 blks) ==>  7912555556:124780556
 87: SKP:     1048576(      1 blks) ==>  8037336112:12
 88: RAW:   124780544(    119 blks) ==>  8037336124:124780556
 89: SKP:     1048576(      1 blks) ==>  8162116680:12
 90: RAW:     1048576(      1 blks) ==>  8162116692:1048588
 91: SKP:    24117248(     23 blks) ==>  8163165280:12
 92: RAW:    17825792(     17 blks) ==>  8163165292:17825804
 93: SKP:    82837504(     79 blks) ==>  8180991096:12
 94: RAW:    11534336(     11 blks) ==>  8180991108:11534348
 95: SKP:     5242880(      5 blks) ==>  8192525456:12
 96: RAW:   232783872(    222 blks) ==>  8192525468:232783884
 97: SKP:     2097152(      2 blks) ==>  8425309352:12
 98: RAW:    48234496(     46 blks) ==>  8425309364:48234508
 99: SKP:     2097152(      2 blks) ==>  8473543872:12
100: RAW:   182452224(    174 blks) ==>  8473543884:182452236
101: SKP:     2097152(      2 blks) ==>  8655996120:12
102: RAW:    57671680(     55 blks) ==>  8655996132:57671692
103: SKP:     1048576(      1 blks) ==>  8713667824:12
104: RAW:    90177536(     86 blks) ==>  8713667836:90177548
105: SKP:     2097152(      2 blks) ==>  8803845384:12
106: RAW:    47185920(     45 blks) ==>  8803845396:47185932
107: SKP:  1328545792(   1267 blks) ==>  8851031328:12
108: RAW:     7340032(      7 blks) ==>  8851031340:7340044
109: SKP:    26214400(     25 blks) ==>  8858371384:12
110: RAW:    14680064(     14 blks) ==>  8858371396:14680076
111: SKP:    85983232(     82 blks) ==>  8873051472:12
112: RAW:     1048576(      1 blks) ==>  8873051484:1048588
113: SKP:     3145728(      3 blks) ==>  8874100072:12
114: RAW:   339738624(    324 blks) ==>  8874100084:339738636
115: SKP:     1048576(      1 blks) ==>  9213838720:12
116: RAW:   490733568(    468 blks) ==>  9213838732:490733580
117: SKP:  1177550848(   1123 blks) ==>  9704572312:12
118: RAW:    15728640(     15 blks) ==>  9704572324:15728652
119: SKP:     1048576(      1 blks) ==>  9720300976:12
120: RAW:     1048576(      1 blks) ==>  9720300988:1048588
121: SKP:    15728640(     15 blks) ==>  9721349576:12
122: RAW:    22020096(     21 blks) ==>  9721349588:22020108
123: SKP:    78643200(     75 blks) ==>  9743369696:12
124: RAW:  2013265920(   1920 blks) ==>  9743369708:2013265932
-- Total: ---------------------------------------------------
125 CHUNK 15032385536(  14336 blks) ==> 11756635652(11212 blks)

done.
system.img built successfully. 
Existing tbcfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_cpu.bin) reused.
copying tbcdtbfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
copying cfgfile(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cfg/flash_l4t_t210_emmc_p3448.xml) to flash.xml... done.
copying flasher(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
Existing flashapp(/home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash.py) reused.
./tegraflash.py --bl cboot.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --odmdata 0x94000 --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb --applet nvtboot_recovery.bin --cmd "flash; reboot"  --cfg flash.xml --chip 0x21    --bins "EBT cboot.bin; DTB tegra210-p3448-0002-p3449-0000-b00.dtb" 
saving flash command in /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flashcmd.txt
saving Windows flash command to /home/tsato/Desktop/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flash_win.bat
*** Flashing target device started. ***
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0014 ] tegrasign --key None --getmode mode.txt
[   0.0031 ] Assuming zero filled SBK key
[   0.0034 ] 
[   0.0034 ] Generating RCM messages
[   0.0052 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0067 ] RCM 0 is saved as rcm_0.rcm
[   0.0075 ] RCM 1 is saved as rcm_1.rcm
[   0.0075 ] List of rcm files are saved in rcm_list.xml
[   0.0075 ] 
[   0.0075 ] Signing RCM messages
[   0.0091 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0105 ] Assuming zero filled SBK key
[   0.0208 ] 
[   0.0209 ] Copying signature to RCM mesages
[   0.0226 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0806 ] 
[   0.0807 ] Parsing partition layout
[   0.3509 ] tegraparser --pt flash.xml.tmp
[   0.3688 ] 
[   0.3689 ] Creating list of images to be signed
[   0.5109 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --list images_list.xml
[   1.0625 ] 
[   1.0626 ] Generating signatures
[   1.0646 ] tegrasign --key None --list images_list.xml --pubkeyhash pub_key.key
[   1.0664 ] Assuming zero filled SBK key
[   1.4984 ] 
[   1.4984 ] Generating br-bct
[   2.0320 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --chip 0x21 0
[   2.0340 ] Copying Sdram info from 0 to 1 set
[   2.4197 ] Copying Sdram info from 1 to 2 set
[   2.4201 ] Copying Sdram info from 2 to 3 set
[   2.4205 ] 
[   2.4205 ] Updating boot device parameters
[   2.4224 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatedevparam flash.xml.bin
[   2.4241 ] Warning: No sdram params
[   2.4316 ] 
[   2.4317 ] Updating bl info
[   2.4335 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updateblinfo flash.xml.bin --updatesig images_list_signed.xml
[   2.5079 ] 
[   2.5080 ] Updating secondary storage information into bct
[   2.5103 ] tegraparser --pt flash.xml.bin --chip 0x21 0 --updatecustinfo P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   2.5263 ] 
[   2.5264 ] Updating Odmdata
[   2.5286 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatefields Odmdata =0x94000
[   2.5306 ] Warning: No sdram params
[   2.5953 ] 
[   2.5954 ] Get Signed section of bct
[   2.5977 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --listbct bct_list.xml
[   2.5998 ] 
[   2.5999 ] Signing BCT
[   2.6037 ] tegrasign --key None --list bct_list.xml --pubkeyhash pub_key.key
[   2.6054 ] Assuming zero filled SBK key
[   2.6065 ] 
[   2.6065 ] Updating BCT with signature
[   2.6084 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatesig bct_list_signed.xml
[   2.6236 ] 
[   2.6237 ] Copying signatures
[   2.6259 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --updatesig images_list_signed.xml
[   3.0208 ] 
[   3.0208 ] Updating BFS information on BCT
[   3.0229 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   3.0247 ]    BFS:
[   3.0279 ]      0: [PT ] flash.xml.bin (size=4337/131072)
[   3.0285 ]      1: [TBC] nvtboot_cpu.bin.encrypt (size=65760/196608)
[   3.0291 ]      2: [RP1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   3.0301 ]      3: [EBT] cboot.bin.encrypt (size=484304/655360)
[   3.0308 ]      4: [WB0] warmboot.bin.encrypt (size=3952/131072)
[   3.0314 ]      5: [BPF] sc7entry-firmware.bin.encrypt (size=3376/262144)
[   3.0321 ] BFS0: 131072 @ 2560 SUM 8ab5fd55 over 2883584 bytes
[   3.0327 ]    BFS:
[   3.0335 ]      0: [PT-1] flash.xml.bin (size=4337/131072)
[   3.0339 ]      1: [TBC-1] nvtboot_cpu.bin.encrypt (size=65760/196608)
[   3.0345 ]      2: [RP1-1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   3.0352 ]      3: [EBT-1] cboot.bin.encrypt (size=484304/655360)
[   3.0357 ]      4: [WB0-1] warmboot.bin.encrypt (size=3952/131072)
[   3.0362 ]      5: [BPF-1] sc7entry-firmware.bin.encrypt (size=3376/262144)
[   3.0368 ] BFS1: 131072 @ 8704 SUM 8ab5fd55 over 2883584 bytes
[   3.0373 ]    KFS:
[   3.0778 ]      0: [DTB] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   3.0786 ]      1: [TOS] tos-mon-only.img.encrypt (size=54208/6291456)
[   3.0792 ]      2: [EKS] eks.img (size=1028/81920)
[   3.0796 ]      3: [LNX] boot.img.encrypt (size=483328/67092480)
[   3.0802 ] KFS0: 1048576 @ 29376546 SUM ee80c940 over 7905280 bytes
[   3.0829 ]    KFS:
[   3.1216 ]      0: [DTB-1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   3.1226 ]      1: [TOS-1] tos-mon-only.img.encrypt (size=54208/6291456)
[   3.1233 ]      2: [EKS-1] eks.img (size=1028/81920)
[   3.1237 ]      3: [LNX-1] boot.img.encrypt (size=483328/67092480)
[   3.1244 ] KFS1: 1048576 @ 29522082 SUM ee80c940 over 7905280 bytes
[   3.1681 ] 
[   3.1682 ] Boot Rom communication
[   3.1698 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   3.1715 ] BootRom is not running
[   3.3728 ] 
[   3.3729 ] Sending BCTs
[   3.3750 ] tegrarcm --download bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   3.3769 ] Applet version 00.01.0000
[   3.7146 ] Sending bct
[   3.7148 ] [................................................] 100%
[   3.8917 ] 
[   3.8939 ] tegrahost --chip 0x21 --align cboot.bin
[   3.8959 ] 
[   3.8973 ] tegrahost --magicid EBT --appendsigheader cboot.bin cboot.bin_blheader
[   4.3812 ] 
[   4.3838 ] tegrasign --key None --list cboot.bin_list.xml
[   4.3851 ] Assuming zero filled SBK key
[   4.4075 ] 
[   4.4103 ] tegrahost --updatesigheader cboot.bin_blheader.encrypt cboot.bin_blheader.hash zerosbk
[   4.4247 ] 
[   4.5005 ] tegrahost --chip 0x21 --align tegra210-p3448-0002-p3449-0000-b00.dtb
[   4.5025 ] 
[   4.5044 ] tegrahost --magicid DTB --appendsigheader tegra210-p3448-0002-p3449-0000-b00.dtb tegra210-p3448-0002-p3449-0000-b00.dtb_blheader
[   4.5295 ] 
[   4.5322 ] tegrasign --key None --list tegra210-p3448-0002-p3449-0000-b00.dtb_list.xml
[   4.5340 ] Assuming zero filled SBK key
[   4.5495 ] 
[   4.5528 ] tegrahost --updatesigheader tegra210-p3448-0002-p3449-0000-b00.dtb_blheader.encrypt tegra210-p3448-0002-p3449-0000-b00.dtb_blheader.hash zerosbk
[   4.6276 ] 
[   4.6283 ] Sending bootloader and pre-requisite binaries
[   4.6301 ] tegrarcm --download ebt cboot.bin.encrypt 0 0 --download rp1 tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt 0
[   4.6318 ] Applet version 00.01.0000
[   4.9665 ] Sending ebt
[   4.9670 ] [................................................] 100%
[   5.0697 ] Sending rp1
[   5.0743 ] [................................................] 100%
[   5.1246 ] 
[   5.1266 ] tegrarcm --boot recovery
[   5.1283 ] Applet version 00.01.0000
[   5.4040 ] 
[   5.4041 ] Retrieving storage infomation
[   5.4064 ] tegrarcm --oem platformdetails storage storage_info.bin
[   5.4084 ] Applet is not running on device. Continue with Bootloader
[   6.0100 ] 
[   6.3564 ] tegradevflash --oem platformdetails storage storage_info.bin
[   6.3585 ] Cboot version 00.01.0000
[   6.6388 ] Saved platform info in storage_info.bin
[   6.6397 ] 
[   6.6398 ] Flashing the device
[   6.6422 ] tegradevflash --pt flash.xml.bin --storageinfo storage_info.bin --create
[   6.6439 ] Cboot version 00.01.0000
[   6.8188 ] Writing partition GPT with gpt.bin
[   6.8197 ] [................................................] 100%
[   6.8238 ] Writing partition NVC with nvtboot.bin.encrypt
[   7.8412 ] [................................................] 100%
[   7.8500 ] Writing partition PT with flash.xml.bin
[   7.8743 ] [................................................] 100%
[   7.8782 ] Writing partition TBC with nvtboot_cpu.bin.encrypt
[   7.9011 ] [................................................] 100%
[   7.9192 ] Writing partition RP1 with tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt
[   7.9671 ] [................................................] 100%
[   7.9900 ] Writing partition EBT with cboot.bin.encrypt
[   8.0393 ] [................................................] 100%
[   8.0709 ] Writing partition WB0 with warmboot.bin.encrypt
[   8.1237 ] [................................................] 100%
[   8.1403 ] Writing partition BPF with sc7entry-firmware.bin.encrypt
[   8.1881 ] [................................................] 100%
[   8.2045 ] Writing partition NVC-1 with nvtboot.bin.encrypt
[   8.2523 ] [................................................] 100%
[   8.2738 ] Writing partition PT-1 with flash.xml.bin
[   8.3352 ] [................................................] 100%
[   8.3520 ] Writing partition TBC-1 with nvtboot_cpu.bin.encrypt
[   8.4120 ] [................................................] 100%
[   8.4307 ] Writing partition RP1-1 with tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt
[   8.4912 ] [................................................] 100%
[   8.5144 ] Writing partition EBT-1 with cboot.bin.encrypt
[   8.5765 ] [................................................] 100%
[   8.6078 ] Writing partition WB0-1 with warmboot.bin.encrypt
[   8.6731 ] [................................................] 100%
[   8.6899 ] Writing partition BPF-1 with sc7entry-firmware.bin.encrypt
[   8.7502 ] [................................................] 100%
[   8.7669 ] Writing partition VER_b with emmc_bootblob_ver.txt
[   8.8271 ] [................................................] 100%
[   8.8439 ] Writing partition VER with emmc_bootblob_ver.txt
[   8.8941 ] [................................................] 100%
[   8.9107 ] Writing partition APP with system.img
[   8.9606 ] [................................................] 100%
[ 389.0842 ] Writing partition DTB with tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt
[ 390.3688 ] [................................................] 100%
[ 390.3852 ] Writing partition TOS with tos-mon-only.img.encrypt
[ 390.4241 ] [................................................] 100%
[ 390.4359 ] Warning: EKS partition magic header mismatch!
[ 390.4720 ] Writing partition EKS with eks.img
[ 390.4725 ] [................................................] 100%
[ 390.4823 ] Writing partition LNX with boot.img.encrypt
[ 390.5175 ] [................................................] 100%
[ 390.5423 ] Writing partition DTB-1 with tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt
[ 390.5719 ] [................................................] 100%
[ 390.5883 ] Writing partition TOS-1 with tos-mon-only.img.encrypt
[ 390.6271 ] [................................................] 100%
[ 390.6389 ] Writing partition EKS-1 with eks.img
[ 390.6745 ] [................................................] 100%
[ 390.6851 ] Writing partition LNX-1 with boot.img.encrypt
[ 390.7205 ] [................................................] 100%
[ 390.7455 ] Writing partition BMP with bmp.blob
[ 390.7753 ] [................................................] 100%
[ 390.7980 ] Writing partition RP4 with rp4.blob
[ 390.8343 ] [................................................] 100%
[ 390.8908 ] 
[ 390.8931 ] tegradevflash --write BCT P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[ 390.8950 ] Cboot version 00.01.0000
[ 391.0546 ] Writing partition BCT with P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[ 391.0557 ] [................................................] 100%
[ 391.4512 ] 
[ 391.4513 ] Flashing completed

[ 391.4514 ] Coldbooting the device
[ 391.4537 ] tegradevflash --reboot coldboot
[ 391.4556 ] Cboot version 00.01.0000
[ 391.6148 ] 
*** The target t210ref has been flashed successfully. ***
Reset the board to boot from internal eMMC.

But there is one problem. We need to burn a pre-built system.img.
I have added -r option, but the system.img file was recreated with the command above.
Is there any more option available to achieve this?

Hi,
For clearness, please make a new post for the follow-up query. Thanks.

Thanks, I will.

shouldn’t the pkc_disable be : 0x00000000?

Thanks for pointing out. You’re right according to the App Note.

That’s why I might have a problem, The wrong boot authentication identification.

is there a way to put 0x0 in that fuse?

No, I don’t think so. 0x1 can not be reverted back to 0x0.

so this means that i cannot use pkc secure boot anymore. I read somewhere that odmfuse.sh put 0x1 in pkc_disable by default, if it cannot be reverted i don’t think is the correct option, because the sbk is obsolete

Unfortunately, you can’t. I made a new post to clarify this.