Burning reserved_odm fuses on Jetson Nano

Burning ReservedOdm on Jetson Nano

I have been trying to burn a unique serial number into the reserved_odm fuses on the Jetson Nano.

Short version:
By putting the board into recovery mode, I been able to program the reserved_odm0 bank but none of the others. How can I program the other banks reserved_odm[1-6]? How can I program the fuse banks “in the field” from the board itself?

Long version:

According to “NVIDIA Jetson Nano Fuse Specification DA-09697-001_v01”, the fuses reserved_odm[0-7] are available and can be programmed “in the field”.
On the target device, the device files /sys/devices/platform/tegra-fuse/reserved_odm[0-7], along with a parallel set of device files /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm[0-7] represent the fuse banks. Reading from these devices gives the values of the fuse banks:

> cat /sys/devices/platform/tegra-fuse/reserved_odm*
0x00ab0000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

> cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm*
0x00ab0000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

Writing to any of the device files has no effect.

Another way to program the fuses is to put the board into recovery mode and program the fuses using the odmfuse.sh script from the Linux for Tegra secure boot tools (version R32.7.1).

The following command:

./odmfuse.sh --noburn -i 0x21 -c NS -o "0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000"

was used to generate a file fuseblob.tbz2 which unpacked to a bootloader directory containing a number of files. The file of interest was odmfuse_pkc.xml, which contained the following text:

<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000" />
<fuse name="PkcDisable" size="4" value="0x1" />
</genericfuse>

I only wanted to modify the reserved_odm fuses, so removed the line containing PkcDisable, leaving the text like this:

<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000" />
</genericfuse>

After putting the board into recovery mode, attempting to blow the fuses using the command

sudo ./fusecmd.sh 

fails as follows:

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0018 ] Parsing fuse info as per xml file
[   0.0049 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0066 ] value string exceeds fuse size!
[   0.0068 ] Failed to convert to number
[   0.0068 ] Failed to generate fuse info, ErrNum=1
[   0.0068 ] 
Error: Return value 4
Command tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin 

I noted that previous versions of Linux For Tegra tools had generated different text in the odmfuse_pkc.xml file, so I tried some of those:

  1. Setting each ReservedOdm bank individually:

failed as follows:

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0006 ] Parsing fuse info as per xml file
[   0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0033 ] 
[   0.0034 ] Generating RCM messages
[   0.0051 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0057 ] RCM 0 is saved as rcm_0.rcm
[   0.0061 ] RCM 1 is saved as rcm_1.rcm
[   0.0061 ] List of rcm files are saved in rcm_list.xml
[   0.0061 ] 
[   0.0061 ] Signing RCM messages
[   0.0083 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0095 ] Assuming zero filled SBK key
[   0.0178 ] 
[   0.0179 ] Copying signature to RCM mesages
[   0.0197 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0207 ] 
[   0.0207 ] Boot Rom communication
[   0.0225 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0231 ] BR_CID: 0x32101001643072c70400000019fc0440
[   0.4818 ] RCM version 0X210001
[   0.5096 ] Boot Rom communication completed
[   1.5205 ] 
[   1.5206 ] Blowing fuses
[   1.5240 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.5258 ] Applet version 00.01.0000
[   1.6012 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[   1.6240 ] 00000001: Failed to process oem command
[   1.6244 ] 
Error: Return value 1
Command tegrarcm --oem blowfuses blow_fuse_data.bin
  1. Setting the whole ReservedOdm bank as a single hex number (with a stated size of 32):

failed as follows:

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0006 ] Parsing fuse info as per xml file
[   0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0038 ] 
[   0.0038 ] Generating RCM messages
[   0.0062 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0075 ] RCM 0 is saved as rcm_0.rcm
[   0.0082 ] RCM 1 is saved as rcm_1.rcm
[   0.0082 ] List of rcm files are saved in rcm_list.xml
[   0.0082 ] 
[   0.0082 ] Signing RCM messages
[   0.0105 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0118 ] Assuming zero filled SBK key
[   0.0196 ] 
[   0.0196 ] Copying signature to RCM mesages
[   0.0216 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0243 ] 
[   0.0244 ] Boot Rom communication
[   0.0273 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0289 ] BR_CID: 0x32101001643072c70400000019fc0440
[   0.4875 ] RCM version 0X210001
[   0.5157 ] Boot Rom communication completed
[   1.5257 ] 
[   1.5258 ] Blowing fuses
[   1.5292 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.5312 ] Applet version 00.01.0000
[   1.6068 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[   1.6293 ] 00ab0000: Failed to process oem command
[   1.6307 ] 
[   1.6308 ] Rebooting to recovery mode
[   1.6323 ] Rebooting to recovery mode
[   1.6342 ] tegrarcm --reboot recovery
  1. Setting the whole ReservedOdm bank as a single hex number (modifying the stated size to be 256):

failed in a different way, as it hung up such that the target board had to be switched off:

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0006 ] Parsing fuse info as per xml file
[   0.0024 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0034 ] 
[   0.0035 ] Generating RCM messages
[   0.0059 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0072 ] RCM 0 is saved as rcm_0.rcm
[   0.0079 ] RCM 1 is saved as rcm_1.rcm
[   0.0079 ] List of rcm files are saved in rcm_list.xml
[   0.0079 ] 
[   0.0079 ] Signing RCM messages
[   0.0103 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0115 ] Assuming zero filled SBK key
[   0.0191 ] 
[   0.0191 ] Copying signature to RCM mesages
[   0.0209 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0219 ] 
[   0.0219 ] Boot Rom communication
[   0.0241 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0260 ] BootRom is not running
[  20.1708 ] 
[  20.1709 ] Blowing fuses
[  20.1744 ] tegrarcm --oem blowfuses blow_fuse_data.bin

<Hangs at this point until target board is switched off>

[  20.1762 ] Cannot open usb device.Check if device is in recovery
[  20.2037 ] 
Error: Return value 8

Finally, I tried setting a single 32 bit value:

<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00abc000" />
</genericfuse>

which succeeded:

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0006 ] Parsing fuse info as per xml file
[   0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0032 ] 
[   0.0033 ] Generating RCM messages
[   0.0053 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0064 ] RCM 0 is saved as rcm_0.rcm
[   0.0071 ] RCM 1 is saved as rcm_1.rcm
[   0.0071 ] List of rcm files are saved in rcm_list.xml
[   0.0072 ] 
[   0.0072 ] Signing RCM messages
[   0.0096 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0107 ] Assuming zero filled SBK key
[   0.0193 ] 
[   0.0194 ] Copying signature to RCM mesages
[   0.0212 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0221 ] 
[   0.0222 ] Boot Rom communication
[   0.0240 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0257 ] BR_CID: 0x32101001643072c70400000019fc0440
[   0.4837 ] RCM version 0X210001
[   0.5117 ] Boot Rom communication completed
[   1.5227 ] 
[   1.5228 ] Blowing fuses
[   1.5262 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.5280 ] Applet version 00.01.0000
[   1.6027 ] Successfully burnt fuses as per fuse info blob
[   1.6172 ] 
[   1.6174 ] Rebooting to recovery mode
[   1.6190 ] Rebooting to recovery mode
[   1.6210 ] tegrarcm --reboot recovery
[   1.6216 ] Applet version 00.01.0000
[   1.6503 ]

Rebooting the target board out of recover mode and in normal mode and checking the device files shows that the fuses for bank reserved_odm0 have been programmed:

> cat /sys/devices/platform/tegra-fuse/reserved_odm*
0x00abc000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

How can I program the remaining fuse banks in the Jetson Nano? Is it possible to program the fuses from the board, “in the field”?

Hi,
Please check example in this topic:
How to burn ODM fuse bits?

Please note once the bit is fused to 1, it cannot be reverted back to 0.

Hi,
Thanks for the link. I had seen that posted and already worked through the suggestions. As stated in my post, for the Jetson Nano, the documented methods don’t appear to work. It looks as if tegrarcm , the script that actually burns the fuses, only recognises a single RESERVED_ODM bank of 32 bits. It doesn’t recognise a bank of 256 bits, or 8 banks of 32 bits.

I understand that a fuse, once blown, can’t be reset, but that is not the problem here.

For the record, ./tegrafuse.sh shows that none of the locks have been set:

./tegrafuse.sh
arm_jtag_disable : 0x00000000
odm_lock : 0x00000000
odm_production_mode : 0x00000000
pkc_disable : 0x00000000
sec_boot_dev_cfg : 0x00000000
sec_boot_dev_sel : 0x00000000

Note that this version of tegrafuse.sh does not show the reserved_odm fields.

I have been able to program the public key:

cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/public_key
0x<64-digit hex number>

and the first of the 8 reserved_odm banks.

cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm*
0x00abc000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

So how do I program the remaining banks, given that the suggested methods do not appear to work as documented.

Many thanks

Hi,
The option is in this format:

-o "0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000001 0x00000000"

Have you tried this?

As noted in the initial post, the command I used to generate the fuseblob.tbz2 was:

./odmfuse.sh --noburn -i 0x21 -c NS -o "0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000"

The problem, as described in the initial post, is with the file odmfuse_pkc.xml in the generated fuseblob.

1 Like

Hi,
My apology. The correct format should be
How to burn ODM fuse bits? - #10 by DaneLLL

-o 0x0000000000000000000000000000000000000000000000000000000100000000

Please try this.

Hi,

Thanks for responding.

If I remove the -noburn option, it burns the fuses immediately. Unfortunately, it also forces you to burn the secure boot fuses (PkcDisable with -NS) which I don’t want it to do. I only want to burn the ReservedOdm fuses, and possibly the OdmLock fuses. Is there a way to do this when burning the fuses immediately (i.e. without the -noburn option)?

Many thanks

Tony Aldhous

I made a little progress. I found that using -c PKC (without any keys) instead of -c NS will only try to burn the ReservedOdm fuses.
I tried the following command:

./odmfuse.sh --test -i 0x21 -c PKC -o “0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000”

This test appeared to work, returning the following:

*** Generating fuse configuration ... done.
Test mode: removing all lines with '<fuse name=' so no fuses will be burned.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml; reboot recovery"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0012 ] Parsing fuse info as per xml file
[   0.0031 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0038 ] 
[   0.0038 ] Generating RCM messages
[   0.0056 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0062 ] RCM 0 is saved as rcm_0.rcm
[   0.0066 ] RCM 1 is saved as rcm_1.rcm
[   0.0066 ] List of rcm files are saved in rcm_list.xml
[   0.0066 ] 
[   0.0066 ] Signing RCM messages
[   0.0084 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0095 ] Assuming zero filled SBK key
[   0.0204 ] 
[   0.0204 ] Copying signature to RCM mesages
[   0.0233 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0261 ] 
[   0.0262 ] Boot Rom communication
[   0.0291 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0308 ] BR_CID: 0x32101001643072c70400000019fc0440
[   0.4902 ] RCM version 0X210001
[   0.5180 ] Boot Rom communication completed
[   1.5288 ] 
[   1.5289 ] Blowing fuses
[   1.5323 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.5341 ] Applet version 00.01.0000
[   1.6091 ] Successfully burnt fuses as per fuse info blob
[   1.6237 ] 
[   1.6238 ] Rebooting to recovery mode
[   1.6258 ] tegradevflash --reboot recovery
[   1.6264 ] Cboot is not running on device.
[   1.6554 ] 
[   1.6554 ] Rebooting to recovery mode
[   1.6585 ] tegrarcm --reboot recovery
[   1.6602 ] Applet version 00.01.0000
[   1.7494 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been burned successfully.
*** done.

Of course, this did not actually burn any fuses because it used an empty odmfuse_pkc.xml file:

<genericfuse MagicId="0x46555345" version="1.0.0">
</genericfuse>

Running the command without the --test:

./odmfuse.sh -i 0x21 -c PKC -o "0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000"

did this:

*** Generating fuse configuration ... done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml; reboot recovery"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0020 ] Parsing fuse info as per xml file
[   0.0042 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0051 ] value string exceeds fuse size!
[   0.0053 ] Failed to convert to number
[   0.0053 ] Failed to generate fuse info, ErrNum=1
[   0.0053 ] 
Error: Return value 4
Command tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
failed.

This is the same behaviour as I found when trying to burn with the fuseblob, so I believe that the --noburn option is a red herring.

The issue is that the tegra fuse burning mechanism running on the target device that reads the odmfuse_pkc.xml will only burn the first ReservedOdm fuse bank.

I do appreciate the help.

Hi,
On Jetson Nano, the supported case is like:
Odmfuse.sh always burns pkc_disable - #5 by JerryChang

pkc_disable fuse is programmed if you don’t enable PKC. So in your use-case, you don’t want to enable PKC, and don’t want to program pkc_disable fuse?

Hi,

Yes, I figured that out just after I posted!

Hi,

I can summarise my issue as this:

Both these commands fail to burn the ReservedOdm fuses:

$ ./odmfuse.sh -i 0x21 -c PKC -o “0x00000000 0x00abc000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000”

$ ./odmfuse.sh -i 0x21 -c PKC -o “0x0000000000abc000000000000000000000000000000000000000000000000000”

This command succeeds in burning the first 32 bits of the ReservedOdm fuses (ReservedOdm0) but does not burn any of the remaining 224 bits (ReservedOdm1-ReservedOdm7).

./odmfuse.sh -i 0x21 -c PKC -o “0x00abc000”

It looks as if a bug in the tegra tools is preventing it from burning the ReservedOdm1-ReservedOdm7 fuses.

==============================================================================
The first command fails as follows:

./odmfuse.sh -i 0x21 -c PKC -o “0x00000000 0x00abc000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000”
*** Generating fuse configuration … done.
*** Start fusing …
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd “blowfuses odmfuse_pkc.xml; reboot recovery”
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[ 0.0030 ] Parsing fuse info as per xml file
[ 0.0056 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0067 ] value string exceeds fuse size!
[ 0.0069 ] Failed to convert to number
[ 0.0069 ] Failed to generate fuse info, ErrNum=1
[ 0.0069 ]
Error: Return value 4
Command tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
failed.

==============================================================================
The second command fails as follows - note that it hangs and has to be interrupted:

./odmfuse.sh -i 0x21 -c PKC -o “0x0000000000abc000000000000000000000000000000000000000000000000000”
*** Generating fuse configuration … done.
*** Start fusing …
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd “blowfuses odmfuse_pkc.xml; reboot recovery”
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[ 0.0013 ] Parsing fuse info as per xml file
[ 0.0031 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0039 ]
[ 0.0039 ] Generating RCM messages
[ 0.0058 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0064 ] RCM 0 is saved as rcm_0.rcm
[ 0.0067 ] RCM 1 is saved as rcm_1.rcm
[ 0.0067 ] List of rcm files are saved in rcm_list.xml
[ 0.0067 ]
[ 0.0068 ] Signing RCM messages
[ 0.0085 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0090 ] Assuming zero filled SBK key
[ 0.0144 ]
[ 0.0145 ] Copying signature to RCM mesages
[ 0.0163 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0173 ]
[ 0.0173 ] Boot Rom communication
[ 0.0191 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0202 ] BR_CID: 0x32101001643072c70400000019fc0440
[ 0.4808 ] RCM version 0X210001
[ 0.5087 ] Boot Rom communication completed
[ 1.5195 ]
[ 1.5195 ] Blowing fuses
[ 1.5229 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[ 1.5248 ] Applet version 00.01.0000
[ 1.5999 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[ 1.6224 ] 00abc000: Failed to process oem command
[ 1.6226 ]
[ 1.6227 ] Rebooting to recovery mode
[ 1.6249 ] tegradevflash --reboot recovery

==============================================================================
The final command succeeds as follows:

./odmfuse.sh -i 0x21 -c PKC -o “0x00abc000”
*** Generating fuse configuration … done.
*** Start fusing …
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd “blowfuses odmfuse_pkc.xml; reboot recovery”
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[ 0.0017 ] Parsing fuse info as per xml file
[ 0.0037 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0046 ]
[ 0.0047 ] Generating RCM messages
[ 0.0066 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0072 ] RCM 0 is saved as rcm_0.rcm
[ 0.0076 ] RCM 1 is saved as rcm_1.rcm
[ 0.0078 ] List of rcm files are saved in rcm_list.xml
[ 0.0078 ]
[ 0.0078 ] Signing RCM messages
[ 0.0097 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0104 ] Assuming zero filled SBK key
[ 0.0172 ]
[ 0.0173 ] Copying signature to RCM mesages
[ 0.0191 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0200 ]
[ 0.0200 ] Boot Rom communication
[ 0.0218 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0231 ] BR_CID: 0x32101001643072c70400000019fc0440
[ 0.3170 ] RCM version 0X210001
[ 0.3466 ] Boot Rom communication completed
[ 1.3559 ]
[ 1.3560 ] Blowing fuses
[ 1.3593 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[ 1.3613 ] Applet version 00.01.0000
[ 1.4366 ] Successfully burnt fuses as per fuse info blob
[ 1.4509 ]
[ 1.4511 ] Rebooting to recovery mode
[ 1.4532 ] tegradevflash --reboot recovery
[ 1.4538 ] Cboot is not running on device.
[ 1.4841 ]
[ 1.4841 ] Rebooting to recovery mode
[ 1.4863 ] tegrarcm --reboot recovery
[ 1.4881 ] Applet version 00.01.0000
[ 1.5795 ]
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been burned successfully.
*** done.

Hi,
We try this command and get expected result:

sudo ./odmfuse.sh -i 0x21 -c PKC -o 0x0000000100000000000000000000000000000000000000000000000300000000
root@nvidia-desktop:/home/nvidia# cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm*
0x00000000
0x00000003
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000001

Hi,
Thanks for trying it. Interesting that it apparently worked. I have a couple of questions:

What version of the secure boot tools did you use?
Can you share the file odmfuse_pkc.xml.sav that is left by the odmfuse command?

I am wondering if the board I am using is faulty, as it hangs when trying to blow fuses in the way that succeeded with your board.

Many thanks

I replaced the Nano module with a brand new one, and the command
./odmfuse.sh -i 0x21 -c PKC -o “0x0000000000000000000000000000000000000000000000100000001000000001”
and that worked:

cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm*
0x00000001
0x00000010
0x00000010
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000

So it looks like my problem was due to a faulty Nano module.