Burning ReservedOdm on Jetson Nano
I have been trying to burn a unique serial number into the reserved_odm fuses on the Jetson Nano.
Short version:
By putting the board into recovery mode, I been able to program the reserved_odm0 bank but none of the others. How can I program the other banks reserved_odm[1-6]? How can I program the fuse banks “in the field” from the board itself?
Long version:
According to “NVIDIA Jetson Nano Fuse Specification DA-09697-001_v01”, the fuses reserved_odm[0-7] are available and can be programmed “in the field”.
On the target device, the device files /sys/devices/platform/tegra-fuse/reserved_odm[0-7], along with a parallel set of device files /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm[0-7] represent the fuse banks. Reading from these devices gives the values of the fuse banks:
> cat /sys/devices/platform/tegra-fuse/reserved_odm*
0x00ab0000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
> cat /sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/reserved_odm*
0x00ab0000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
Writing to any of the device files has no effect.
Another way to program the fuses is to put the board into recovery mode and program the fuses using the odmfuse.sh script from the Linux for Tegra secure boot tools (version R32.7.1).
The following command:
./odmfuse.sh --noburn -i 0x21 -c NS -o "0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000"
was used to generate a file fuseblob.tbz2 which unpacked to a bootloader directory containing a number of files. The file of interest was odmfuse_pkc.xml, which contained the following text:
<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000" />
<fuse name="PkcDisable" size="4" value="0x1" />
</genericfuse>
I only wanted to modify the reserved_odm fuses, so removed the line containing PkcDisable, leaving the text like this:
<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00000000 0x00000000 0x00000000 0x000000AB 0x00000000 0x00000000 0x00000000 0x00000000" />
</genericfuse>
After putting the board into recovery mode, attempting to blow the fuses using the command
sudo ./fusecmd.sh
fails as follows:
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0018 ] Parsing fuse info as per xml file
[ 0.0049 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0066 ] value string exceeds fuse size!
[ 0.0068 ] Failed to convert to number
[ 0.0068 ] Failed to generate fuse info, ErrNum=1
[ 0.0068 ]
Error: Return value 4
Command tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
I noted that previous versions of Linux For Tegra tools had generated different text in the odmfuse_pkc.xml file, so I tried some of those:
-
Setting each ReservedOdm bank individually:
failed as follows:
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0006 ] Parsing fuse info as per xml file
[ 0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0033 ]
[ 0.0034 ] Generating RCM messages
[ 0.0051 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0057 ] RCM 0 is saved as rcm_0.rcm
[ 0.0061 ] RCM 1 is saved as rcm_1.rcm
[ 0.0061 ] List of rcm files are saved in rcm_list.xml
[ 0.0061 ]
[ 0.0061 ] Signing RCM messages
[ 0.0083 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0095 ] Assuming zero filled SBK key
[ 0.0178 ]
[ 0.0179 ] Copying signature to RCM mesages
[ 0.0197 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0207 ]
[ 0.0207 ] Boot Rom communication
[ 0.0225 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0231 ] BR_CID: 0x32101001643072c70400000019fc0440
[ 0.4818 ] RCM version 0X210001
[ 0.5096 ] Boot Rom communication completed
[ 1.5205 ]
[ 1.5206 ] Blowing fuses
[ 1.5240 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[ 1.5258 ] Applet version 00.01.0000
[ 1.6012 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[ 1.6240 ] 00000001: Failed to process oem command
[ 1.6244 ]
Error: Return value 1
Command tegrarcm --oem blowfuses blow_fuse_data.bin
-
Setting the whole ReservedOdm bank as a single hex number (with a stated size of 32):
failed as follows:
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0006 ] Parsing fuse info as per xml file
[ 0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0038 ]
[ 0.0038 ] Generating RCM messages
[ 0.0062 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0075 ] RCM 0 is saved as rcm_0.rcm
[ 0.0082 ] RCM 1 is saved as rcm_1.rcm
[ 0.0082 ] List of rcm files are saved in rcm_list.xml
[ 0.0082 ]
[ 0.0082 ] Signing RCM messages
[ 0.0105 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0118 ] Assuming zero filled SBK key
[ 0.0196 ]
[ 0.0196 ] Copying signature to RCM mesages
[ 0.0216 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0243 ]
[ 0.0244 ] Boot Rom communication
[ 0.0273 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0289 ] BR_CID: 0x32101001643072c70400000019fc0440
[ 0.4875 ] RCM version 0X210001
[ 0.5157 ] Boot Rom communication completed
[ 1.5257 ]
[ 1.5258 ] Blowing fuses
[ 1.5292 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[ 1.5312 ] Applet version 00.01.0000
[ 1.6068 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[ 1.6293 ] 00ab0000: Failed to process oem command
[ 1.6307 ]
[ 1.6308 ] Rebooting to recovery mode
[ 1.6323 ] Rebooting to recovery mode
[ 1.6342 ] tegrarcm --reboot recovery
-
Setting the whole ReservedOdm bank as a single hex number (modifying the stated size to be 256):
failed in a different way, as it hung up such that the target board had to be switched off:
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0006 ] Parsing fuse info as per xml file
[ 0.0024 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0034 ]
[ 0.0035 ] Generating RCM messages
[ 0.0059 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0072 ] RCM 0 is saved as rcm_0.rcm
[ 0.0079 ] RCM 1 is saved as rcm_1.rcm
[ 0.0079 ] List of rcm files are saved in rcm_list.xml
[ 0.0079 ]
[ 0.0079 ] Signing RCM messages
[ 0.0103 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0115 ] Assuming zero filled SBK key
[ 0.0191 ]
[ 0.0191 ] Copying signature to RCM mesages
[ 0.0209 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0219 ]
[ 0.0219 ] Boot Rom communication
[ 0.0241 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0260 ] BootRom is not running
[ 20.1708 ]
[ 20.1709 ] Blowing fuses
[ 20.1744 ] tegrarcm --oem blowfuses blow_fuse_data.bin
<Hangs at this point until target board is switched off>
[ 20.1762 ] Cannot open usb device.Check if device is in recovery
[ 20.2037 ]
Error: Return value 8
Finally, I tried setting a single 32 bit value:
<genericfuse MagicId="0x46555345" version="1.0.0">
<fuse name="ReservedOdm" size="32" value="0x00abc000" />
</genericfuse>
which succeeded:
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
[ 0.0006 ] Parsing fuse info as per xml file
[ 0.0025 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[ 0.0032 ]
[ 0.0033 ] Generating RCM messages
[ 0.0053 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[ 0.0064 ] RCM 0 is saved as rcm_0.rcm
[ 0.0071 ] RCM 1 is saved as rcm_1.rcm
[ 0.0071 ] List of rcm files are saved in rcm_list.xml
[ 0.0072 ]
[ 0.0072 ] Signing RCM messages
[ 0.0096 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[ 0.0107 ] Assuming zero filled SBK key
[ 0.0193 ]
[ 0.0194 ] Copying signature to RCM mesages
[ 0.0212 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[ 0.0221 ]
[ 0.0222 ] Boot Rom communication
[ 0.0240 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[ 0.0257 ] BR_CID: 0x32101001643072c70400000019fc0440
[ 0.4837 ] RCM version 0X210001
[ 0.5117 ] Boot Rom communication completed
[ 1.5227 ]
[ 1.5228 ] Blowing fuses
[ 1.5262 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[ 1.5280 ] Applet version 00.01.0000
[ 1.6027 ] Successfully burnt fuses as per fuse info blob
[ 1.6172 ]
[ 1.6174 ] Rebooting to recovery mode
[ 1.6190 ] Rebooting to recovery mode
[ 1.6210 ] tegrarcm --reboot recovery
[ 1.6216 ] Applet version 00.01.0000
[ 1.6503 ]
Rebooting the target board out of recover mode and in normal mode and checking the device files shows that the fuses for bank reserved_odm0 have been programmed:
> cat /sys/devices/platform/tegra-fuse/reserved_odm*
0x00abc000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
How can I program the remaining fuse banks in the Jetson Nano? Is it possible to program the fuses from the board, “in the field”?