Updating Device Tree in system without using a PC (attempt 2)

I have asked this question before, but I have new information.
Refer to Updating the Device Tree in system without using a PC for my original post.

Refer to EMC clock stuck at 204 MHz for additional details with clock issues.

We are building a Yocto release for our Linux distribution using meta-tegra:

We are currently on hash d64c6790555780809ecadaac0f100a852598765f

Which is:
Linux4Tegra release: R32.4.2
JetPack release: 4.4 Developer Preview

When we build a release image we build a RAUC image update and a Tegra update zip image. The zip image has the standard NVidia flash.sh (doflash.sh) scripts for programming a Jetson unit using the USB recovery mode. When we program a Jetson the device tree gets placed in
/dev/mmcblk0p2 and /dev/mmcblk0p6.

When the Jetson boots it tries to boot from BFS0 and KFS0 (not sure what those are, but I suspect partitions).

[0000.241] [L4T TegraBoot] (version 00.00.2018.01-l4t-2d758fea)
[0000.246] Processing in cold boot mode Bootloader 2
[0000.251] A02 Bootrom Patch rev = 1023
[0000.254] Power-up reason: pmc por
[0000.258] No Battery Present
[0000.260] pmic max77620 reset reason
[0000.264] pmic max77620 NVERC : 0x40
[0000.267] RamCode = 0
[0000.269] Platform has DDR4 type RAM
[0000.273] max77620 disabling SD1 Remote Sense
[0000.277] Setting DDR voltage to 1125mv
[0000.281] Serial Number of Pmic Max77663: 0x31ccd
[0000.288] Entering ramdump check
[0000.291] Get RamDumpCarveOut = 0x0
[0000.295] RamDumpCarveOut=0x0,  RamDumperFlag=0xe59ff3f8
[0000.300] Last reboot was clean, booting normally!
[0000.304] Sdram initialization is successful 
[0000.308] SecureOs Carveout Base=0x00000000ff800000 Size=0x00800000
[0000.315] Lp0 Carveout Base=0x00000000ff780000 Size=0x00001000
[0000.320] BpmpFw Carveout Base=0x00000000ff700000 Size=0x00080000
[0000.326] GSC1 Carveout Base=0x00000000ff600000 Size=0x00100000
[0000.332] GSC2 Carveout Base=0x00000000ff500000 Size=0x00100000
[0000.338] GSC4 Carveout Base=0x00000000ff400000 Size=0x00100000
[0000.344] GSC5 Carveout Base=0x00000000ff300000 Size=0x00100000
[0000.350] GSC3 Carveout Base=0x000000017f300000 Size=0x00d00000
[0000.366] RamDump Carveout Base=0x00000000ff280000 Size=0x00080000
[0000.372] Platform-DebugCarveout: 0
[0000.375] Nck Carveout Base=0x00000000ff080000 Size=0x00200000
[0000.381] Non secure mode, and RB not enabled.
[0000.397] Csd NumOfBlocks=0
[0000.589] *** Booting BFS0.
[0000.592] Read PT from (0:3)
[0000.598] Using BFS PT to query partitions 
[0000.602] PT: Partition LNX NOT found ! 
[0001.107] *** Booting KFS0.
[0001.110] Read GPT from (0:3)
[0001.114] Using GPT Primary to query partitions
[0001.118] Loading Tboot-CPU binary
[0001.125] Verifying TBC in OdmNonSecureSBK mode
[0001.135] Bootloader load address is 0xa0000000, entry address is 0xa0000258
[0001.142] Bootloader downloaded successfully.
[0001.147] Downloaded Tboot-CPU binary to 0xa0000258
[0001.152] MAX77620_GPIO5 configured
....

Our Yocto build produces the DTB file and the “encrypted” DTB file tegra210-maza2.dtb.encrypt
The encrypted dtb file is the same as the data programmed into /dev/mmcblk0p2 and /dev/mmcblk0p6.
If I do the following:

root@maza2:~# dd if=/dev/mmcblk0p2 of=dtb2.bin
2048+0 records in
2048+0 records out
root@maza2:~# dd if=/dev/mmcblk0p6 of=dtb6.bin
2048+0 records in
2048+0 records out
root@maza2:~# diff dtb2.bin dtb6.bin 
root@maza2:~# diff dtb2.bin /boot/tegra210-maza2.dtb
Files dtb2.bin and /boot/tegra210-maza2.dtb differ

The files are the same. The partition dump has more bytes (is larger), but they are identical.

I can now do this, reboot, and the unit boots normally:

root@maza2:~# dd if=/boot/tegra210-maza2.dtb.encrypt of=/dev/mmcblk0p2
387+1 records in
387+1 records out
root@maza2:~# dd if=/boot/tegra210-maza2.dtb.encrypt of=/dev/mmcblk0p6
387+1 records in
387+1 records out
reboot

Now if I re-build the device tree and create a new tegra210-maza2.dtb.encrypt with only a different time stamp, the unit bricks.

root@maza2:~# dd if=tegra210-maza2.dtb.encrypt.new of=/dev/mmcblk0p2
387+1 records in
387+1 records out
root@maza2:~# dd if=tegra210-maza2.dtb.encrypt.new of=/dev/mmcblk0p6
387+1 records in
387+1 records out
reboot

Tegraboot spits out the following and dies:

[0000.203] [L4T TegraBoot] (version 00.00.2018.01-l4t-2d758fea)
[0000.208] Processing in cold boot mode Bootloader 2
[0000.213] A02 Bootrom Patch rev = 1023
[0000.217] Power-up reason: software reset
[0000.220] No Battery Present
[0000.223] pmic max77620 reset reason
[0000.226] pmic max77620 NVERC : 0x0
[0000.230] RamCode = 0
[0000.232] Platform has DDR4 type RAM
[0000.235] max77620 disabling SD1 Remote Sense
[0000.240] Setting DDR voltage to 1125mv
[0000.244] Serial Number of Pmic Max77663: 0x31ccd
[0000.251] Entering ramdump check
[0000.254] Get RamDumpCarveOut = 0x0
[0000.257] RamDumpCarveOut=0x0,  RamDumperFlag=0xe59ff3f8
[0000.263] Last reboot was clean, booting normally!
[0000.267] Sdram initialization is successful
[0000.271] SecureOs Carveout Base=0x00000000ff800000 Size=0x00800000
[0000.277] Lp0 Carveout Base=0x00000000ff780000 Size=0x00001000
[0000.283] BpmpFw Carveout Base=0x00000000ff700000 Size=0x00080000
[0000.289] GSC1 Carveout Base=0x00000000ff600000 Size=0x00100000
[0000.295] GSC2 Carveout Base=0x00000000ff500000 Size=0x00100000
[0000.301] GSC4 Carveout Base=0x00000000ff400000 Size=0x00100000
[0000.306] GSC5 Carveout Base=0x00000000ff300000 Size=0x00100000
[0000.312] GSC3 Carveout Base=0x000000017f300000 Size=0x00d00000
[0000.328] RamDump Carveout Base=0x00000000ff280000 Size=0x00080000
[0000.335] Platform-DebugCarveout: 0
[0000.338] Nck Carveout Base=0x00000000ff080000 Size=0x00200000
[0000.344] Non secure mode, and RB not enabled.
[0000.360] Csd NumOfBlocks=0
[0000.555] *** Booting BFS0.
[0000.558] Read PT from (0:3)
[0000.564] Using BFS PT to query partitions
[0000.568] PT: Partition LNX NOT found !
[0001.077] *** Failing over to KFS1.
[0000.288] [L4T TegraBoot] (version 00.00.2018.01-l4t-2d758fea)
[0000.294] Processing in cold boot mode Bootloader 2
[0000.298] A02 Bootrom Patch rev = 1023
[0000.302] Power-up reason: software reset
[0000.306] No Battery Present
[0000.308] pmic max77620 reset reason
[0000.312] pmic max77620 NVERC : 0x0
[0000.315] RamCode = 0
[0000.317] Platform has DDR4 type RAM
[0000.321] max77620 disabling SD1 Remote Sense
[0000.325] Setting DDR voltage to 1125mv
[0000.329] Serial Number of Pmic Max77663: 0x31ccd
[0000.336] Entering ramdump check
[0000.339] Get RamDumpCarveOut = 0x0
[0000.343] RamDumpCarveOut=0x0,  RamDumperFlag=0xe59ff3f8
[0000.348] Last reboot was clean, booting normally!
[0000.352] Sdram initialization is successful
[0000.356] SecureOs Carveout Base=0x00000000ff800000 Size=0x00800000
[0000.363] Lp0 Carveout Base=0x00000000ff780000 Size=0x00001000
[0000.368] BpmpFw Carveout Base=0x00000000ff700000 Size=0x00080000
[0000.374] GSC1 Carveout Base=0x00000000ff600000 Size=0x00100000
[0000.380] GSC2 Carveout Base=0x00000000ff500000 Size=0x00100000
[0000.386] GSC4 Carveout Base=0x00000000ff400000 Size=0x00100000
[0000.392] GSC5 Carveout Base=0x00000000ff300000 Size=0x00100000
[0000.398] GSC3 Carveout Base=0x000000017f300000 Size=0x00d00000
[0000.414] RamDump Carveout Base=0x00000000ff280000 Size=0x00080000
[0000.420] Platform-DebugCarveout: 0
[0000.423] Nck Carveout Base=0x00000000ff080000 Size=0x00200000
[0000.429] Non secure mode, and RB not enabled.
[0000.446] Csd NumOfBlocks=0
[0000.639] *** Booting BFS1.
[0000.642] Read PT from (0:3)
[0000.648] Using BFS PT to query partitions
[0000.652] PT: Partition LNX NOT found !
[0001.160] *** Failing over to KFS2.

You can see it failing over to KFS1 and then KFS2, and then just stopping. There must be an additional checksum, CRC, hash that the bootloader is comparing. Where is that check and how do I fix this?

Actually, we don’t suggest to use dd to do in-field component update anymore. Your current error is due to what this document mentions.

https://docs.nvidia.com/jetson/l4t/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/bootloader_update_nano_tx1.html#

A BCT can contain two entries that indicate the locations (offset and size) and checksums or signatures for TegraBoot, the boot files, and the kernel files. The BootROM computes and validates the checksums or signatures for each TegraBoot entry. When it finds a valid set of checksums or signatures, it transfers control to the specified instance of TegraBoot.
TegraBoot computes and validates the checksums for the first BFS and the first KFS and the signatures the individual files. When the checksums and signatures have been validated, TegraBoot loads the appropriate boot files, such as:
•The TegraBoot CPU binary
•DTB files used by Bootloader
•DTB files used by the kernel
•Warmboot binary
•Trusted OS image

Please use the BUP updater mentioned in document to do the in-field update.

1 Like

This is very helpful. But there are still a few problems. The update script l4t_payload_updater_t210 is a python2 script. Python2 is deprecated in Yocto and is no longer available. I’ve updated the script to work in Python3, but I am missing an nv_boot_control.conf. I will continue to work through this. I think I’m getting close.

1 Like