I was working successfully with an Orin Nano module (custom carrier board) where I burned the PKC hash fuses.
Now, I’m proceeding to the next step, installing an OEM_K1 key, and creating a custom EKB image.
I think I did everything correctly, but after I burned the fuses to add the OEM_K1 key, the module is now stuck in recovery mode and doesn’t seem to do anything else.
I burned the fuses with this file (redacting the K1 key):
<genericfuse MagicId="0x45535546" version="1.0.0">
<fuse name="PublicKeyHash" size="64" value="0xebcc1285bea9e89c53001920ca1ad2e72b6410ceba0ede5588016c8592b676e2c9a916ed936783924ddebadf56f165394855ef777dd7f680452a1e2aedcc1959"/>
<fuse name="OemK1" size="32" value="0x....."/>
<fuse name="BootSecurityInfo" size="4" value="0x3E1"/>
</genericfuse>
It was previously working without the OemK1 key, and BootSecurityInfo set to 0x1E1. I set the BootSecurityInfo bit 9, in order to indicate that the OemK1 is valid. At least that’s what I think the documentation ( Secure Boot — NVIDIA Jetson Linux Developer Guide ) is saying. But I clearly did something wrong.
Here’s the output from the module, during the fuse burning. It appears to have succeeded:
I> FSKP (version: 0.0.0.0-t234-54845784-0793996d)
I> t234-A01-1-Silicon (0x12347)
I> Emulation:
I> Entry timestamp: 0x014ee29c
I> Regular heap: [base:0x40040000, size:0x10000]
I> DMA heap: [base:0x173800000, size:0x800000]
I> Task: Crypto init
I> Task: Program CBB PCIE AMAP regions
I> Task: Burn fuses
I> Index : 1 PublicKeyHash size: 64
I> Index : 2 OemK1 size: 32
I> Index : 3 BootSecurityInfo size: 4
I> Fuse Blob found
I>
I> Burning fuses
I> 1. Start PublicKeyHash burn
I> Fuse is already burned with the same value
I> 1. PublicKeyHash burn skipped
I>
I> 2. Start OemK1 burn
I> 2. OemK1 burnt successfully
W> No handling of CRC-32 for OemK1
I>
I> 3. Start BootSecurityInfo burn
I> 3. BootSecurityInfo burnt successfully
W> No handling of CRC-32 for BootSecurityInfo
I>
I> Successfully burnt fuses as per fuse info
I> Index : 1 PublicKeyHash size: 64
I> Index : 2 OemK1 size: 32
I> Index : 3 BootSecurityInfo size: 4
I> Fuse Blob found
I> No RPMB provisioning details is found. Skip RPMB Provisioning.
I> FSKP finished
I initially assumed that this was because the EKS partitions no longer match the OEM_K1 key, so I tried to flash a new image with a new EKB, built with the new key. But the flashing script (from Yocto meta-tegra) is unable to communicate over the USB link:
sudo ./doflash.sh --spi-only
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0469 ] Parsing partition layout
[ 0.0475 ] tegraparser_v2 --pt secureflash.xml.tmp
[ 0.0540 ] Parsing partition layout
[ 0.0544 ] tegraparser_v2 --pt secureflash.xml.tmp
[ 0.0559 ] mb1_t234_prod_aligned_sigheader.bin.signed filename is from --mb1_bin
[ 0.0559 ] psc_bl1_t234_prod_aligned_sigheader.bin.signed filename is from --psc_bl1_bin
[ 0.0559 ] Boot Rom communication
[ 0.0563 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.signed
[ 0.0568 ] BR_CID: 0xA1012344705DF888180000000E008180
[ 0.2937 ] Sending bct_br
[ 0.4325 ] Sending mb1
[ 0.4335 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.signed
So my questions are:
- Are the fuses burned incorrectly? If so, what should be the correct settings?
- Is there something wrong with my image, that is causing
tegrarcm_v2fail?