Burning PKC [DK(KEK), SBK] Fuses from Target itself without entering Rescue Mode

Hi All,

In our custom carrier the usb and recovery mode is not planned.

According to the documentation this should be done by entering Rescue Mode https://docs.nvidia.com/jetson/l4t/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide%2Fbootloader_secure_boot.html%23wwpID0E0FE0HA

Does it possible to modify the scripts and burn the fuses from the target itself, without entering Rescue Mode and burning from remote computer via usb?

For software(and probably BOOT) updates we are planning to burn the files with dd command after signing the files offline, do you see any problem with it?

Thanks in advance and Best Regards,
Alex

You can mount the module on another carrier board for flashing and other purposes, and then move it back to your carrier board (though I’d recommend testing this). Many flash operations work only from recovery mode, and do not have alternatives. In the case of Linux running you can use dd if the content being written is valid (and signed), but if you make a mistake you will not be able to correct this from your carrier board.

1 Like

Thanks a lot for the answer! Mounting on the other carrier is the solution we think about, as you said any mistake require disassembling the product system and burn it on another carrier…

To recover from dd fail I thought about “double buffer” solution - f.e keeping 2 copies of kernel, recovery kernel and operational one. In case of corrupted operational kernel, the recovery kernel can be loaded that allows to burn the operational kernel (it shouldn’t be a problem to modify the boot to read the discrete and decide which kernel to load, correct?)

There is a backup partition method available, but I’ve not worked on this. Someone else would have to give you the details of working with fallback partitions, but so far as I know this could work after a failed dd update attempt if the backup partitions are still working.