Fail to resume from SC7 at MB2

nickpro · September 1, 2023, 2:35pm

Hi,
Application: We want to put our device in sc7 (deep sleep) mode than resume via USB Remote Wakeup (using LTE modem).
JP 5.1.1 / L4T: r35.3.1
AGX Orin 32GB
Custom Board
Problem: Device successfully goes into suspend, than we send SMS to the modem connected by USB, Orin starts to boot, but fails on MB2. After that cold-boot initiated.
Log:

����spe entering sc7
��[1195.809] I> MB1 (version: 0.32.0.0-t234-54845784-efdb62ac)
[1195.815] I> t234-A01-0-Silicon (0x12347) Prod
[1195.821] I> Boot-mode : SC7 Exit
[1195.825] I> Emulation:
[1195.829] I> Entry timestamp: 0x00000000
[1195.833] I> last_boot_error: 0x0
[1195.838] I> BR-BCT: preprod_dev_sign: 0
[1195.842] I> rst_source: 0xc, rst_level: 0x3
[1195.848] I> Task: Enable SLCG (0x400533fd)
[1195.854] I> Task: CRC check (0x40059919)
[1195.860] I> Skip FUSE records CRC check as records_integrity fuse is not burned
[1195.869] I> Task: Crypto init (0x40058885)
[1195.875] I> Task: Verify SDRAM params (0x40053e35)
[1195.883] I> Task: MSS Encrypt status check (0x40055265)
[1195.891] I> Task: NV_SC7 integrity check (0x40053d71)
[1195.903] I> Task: Initialize SOC Therm (0x4005816d)
[1195.910] I> Task: Program NV master stream id (0x40053641)
[1195.918] I> Task: Verify boot mode (0xd4820dd)
[1195.928] I> Task: Print SKU type (0x40054ed1)
[1195.935] I> FUSE_OPT_CCPLEX_CLUSTER_DISABLE = 0x000001c0
[1195.942] I> FUSE_OPT_GPC_DISABLE = 0x00000000
[1195.947] I> FUSE_OPT_TPC_DISABLE = 0x00000040
[1195.952] I> FUSE_OPT_DLA_DISABLE = 0x00000000
[1195.958] I> FUSE_OPT_PVA_DISABLE = 0x00000000
[1195.963] I> FUSE_OPT_NVENC_DISABLE = 0x00000000
[1195.969] I> FUSE_OPT_NVDEC_DISABLE = 0x00000000
[1195.974] I> FUSE_OPT_FSI_DISABLE = 0x00000000
[1195.979] I> FUSE_OPT_EMC_DISABLE = 0x00000000
[1195.985] I> FUSE_BOOTROM_PATCH_VERSION = 0x7
[1195.990] I> FUSE_PSCROM_PATCH_VERSION = 0x7
[1195.995] I> FUSE_OPT_ADC_CAL_FUSE_REV = 0x2
[1196.000] I> FUSE_SKU_INFO_0 = 0xd2
[1196.005] I> FUSE_OPT_SAMPLE_TYPE_0 = 0x3 PS
[1196.010] I> FUSE_PACKAGE_INFO_0 = 0x2
[1196.015] I> SKU: Prod
[1196.018] I> Task: Boost clocks (0x40055b31)
[1196.025] I> Initializing PLLC2 for AXI_CBB.
[1196.030] I> AXI_CBB : src = 35, divisor = 0
[1196.035] I> Task: Voltage monitor (0x40055de5)
[1196.042] I> VMON: Vmon re-calibration and fine tuning done
[1196.049] I> Task: TSC init (0x4005ac99)
[1196.055] I> Task: Thermal check (0x4005b01d)
[1196.062] I> max_chip_limit = 105
[1196.066] I> min_chip_limit = -28
[1196.070] I> max temp read = 30
[1196.074] I> min temp read = 29
[1196.078] I> Task: Update FSI SCR with thermal fuse data (0x4005b13d)
[1196.087] I> Task: Enable WDT 5th expiry (0x4005ad09)
[1196.094] I> Task: I2C register (0x40052a55)
[1196.101] I> Task: Set I2C bus freq (0x40052a41)
[1196.108] I> Task: Reset FSI (0x40055b41)
[1196.114] I> Task: Common rail init (0x4005582d)
[1196.121] I> DONE: Thermal config
[1196.126] I> DONE: SOC rail config
[1196.131] W> PMIC_CONFIG: Rail: MEMIO rail config not found in MB1 BCT.
[1196.139] I> DONE: MEMIO rail config
[1196.144] I> DONE: GPU rail info
[1196.148] I> DONE: CV rail info
[1196.152] I> Task: Enable sc7 clock-mon (0x4005ac8d)
[1196.171] I> FMON: Fmon re-programming done
[1196.176] I> Task: CCPLEX IST init (0x4005388d)
[1196.183] I> Task: CPU WP0 (0x40053445)
[1196.189] I> Loading MCE
[1196.211] I> Sending WP0 mailbox command to PSC
[1196.226] I> Task: MB1 fixed firewalls (0x4005a569)
[1196.239] W> Firewall readback mismatch
[1196.244] W> Firewall readback mismatch
[1196.261] I> Task: BPMP fw ast config (0x4005a74d)
[1196.268] I> Task: Load nvdec-fw (0x4005a85d)
[1196.294] I> Task: Program TSEC carveout (0x40053d3d)
[1196.301] I> TSEC-FW load not enabled
[1196.305] I> Task: GPIO interrupt map (0x40055a4d)
[1196.313] I> Task: Unpowergate AOPG CAN (0x40053ef1)
[1196.320] I> Task: Misc NV security settings (0x4005368d)
[1196.328] I> NVDEC sticky bits programming done
[1196.334] I> Successfully powergated NVDEC
[1196.339] I> Task: Disable/Reload WDT (0x4005ad61)
[1196.346] I> Task: Program BPMP-IPC carveouts (0x40053d01)
[1196.354] I> Program IPC carveouts
[1196.359] I> SLCG Global override status := 0x0
[1196.365] I> MB1: MSS reconfig completed
I> MB2 (version: 0.0.0.0-t234-54845784-ef56bb9c)
I> t234-A01-0-Silicon (0x12347)
I> Boot-mode : SC7 Exit
I> Emulation:
I> Entry timestamp: 0x474fb321
I> Regular heap: [base:0x40040000, size:0x2000]
I> Task: ARI update carveout TZDRAM (0x40053cb0)
I> Task: Enable hot-plug capability (0x4006087c)
I> Task: PSC mailbox init (0x40058820)
I> Task: Crypto init (0x40055a78)
I> Task: Enable GP-SE clock (0x40053db8)
I> Task: OEM SC7 context integrity check (0x40059828)
I> Task: Restore FSI padctl config (0x40059018)
I> Task: Program CBB PCIE AMAP regions (0x40059b30)
I> Task: Load and authenticate registered FWs (0x4005b428)
I> Task: Load AUXP FWs (0x4006041c)
I> Skipping SCE FW load
I> Successfully register RCE FW load task with MB2 loader
I> Successfully register DCE FW load task with MB2 loader
I> Unpowergating APE
I> Unpowergate done
I> Successfully register APE FW load task with MB2 loader
I> Skipping FSI FW load
I> Successfully register XUSB FW load task with MB2 loader
E> SE_CRYPTO: Failed to verify RSA PSS signature.
E> MB2_FW_LOAD: Failed to load FW.
C> Task 0x0 failed (err: 0x3a3a2018)
E> Top caller module: SE_CRYPTO, error module: SE_CRYPTO, reason: 0x18, aux_info: 0x20
I> Busy Spin
��
[0000.071] I> MB1 (version: 0.32.0.0-t234-54845784-57325615)
[0000.076] I> t234-A01-0-Silicon (0x12347) Prod
[0000.081] I> Boot-mode : Coldboot
[0000.084] I> Emulation:
[0000.086] I> Entry timestamp: 0x00000000
[0000.090] I> last_boot_error: 0x0
[0000.093] I> BR-BCT: preprod_dev_sign: 0

Thank you in advance!

KevinFFF · September 2, 2023, 12:57pm

Hi nickpro,

Could your board boot up successfully before you use SMS to wake it up?

Why it boot from MB1 rather than deep sleep mode?

nickpro · September 2, 2023, 3:20pm

Hi, KevinFFF

Thanks for prompt response. Yes cold boot works ok and we can put it into deep sleep with no problems.
I think I will provide some more details about the problem and leave comment about boot log above:

We put the system to deep sleep via sudo bash -c "echo mem > /sys/power/state"

����spe entering sc7

It sleeps well.
2. Then we send an SMS and system starts MB1 SC7-Exit sequence

��[1195.809] I> MB1 (version: 0.32.0.0-t234-54845784-efdb62ac)
[1195.815] I> t234-A01-0-Silicon (0x12347) Prod
[1195.821] I> Boot-mode : SC7 Exit
[1195.825] I> Emulation:
[1195.829] I> Entry timestamp: 0x00000000
[1195.833] I> last_boot_error: 0x0
[1195.838] I> BR-BCT: preprod_dev_sign: 0
[1195.842] I> rst_source: 0xc, rst_level: 0x3
[1195.848] I> Task: Enable SLCG (0x400533fd)
[1195.854] I> Task: CRC check (0x40059919)
[1195.860] I> Skip FUSE records CRC check as records_integrity fuse is not burned
[1195.869] I> Task: Crypto init (0x40058885)
[1195.875] I> Task: Verify SDRAM params (0x40053e35)
[1195.883] I> Task: MSS Encrypt status check (0x40055265)
[1195.891] I> Task: NV_SC7 integrity check (0x40053d71)
[1195.903] I> Task: Initialize SOC Therm (0x4005816d)
[1195.910] I> Task: Program NV master stream id (0x40053641)
[1195.918] I> Task: Verify boot mode (0xd4820dd)
[1195.928] I> Task: Print SKU type (0x40054ed1)
[1195.935] I> FUSE_OPT_CCPLEX_CLUSTER_DISABLE = 0x000001c0
[1195.942] I> FUSE_OPT_GPC_DISABLE = 0x00000000
[1195.947] I> FUSE_OPT_TPC_DISABLE = 0x00000040
[1195.952] I> FUSE_OPT_DLA_DISABLE = 0x00000000
[1195.958] I> FUSE_OPT_PVA_DISABLE = 0x00000000
[1195.963] I> FUSE_OPT_NVENC_DISABLE = 0x00000000
[1195.969] I> FUSE_OPT_NVDEC_DISABLE = 0x00000000
[1195.974] I> FUSE_OPT_FSI_DISABLE = 0x00000000
[1195.979] I> FUSE_OPT_EMC_DISABLE = 0x00000000
[1195.985] I> FUSE_BOOTROM_PATCH_VERSION = 0x7
[1195.990] I> FUSE_PSCROM_PATCH_VERSION = 0x7
[1195.995] I> FUSE_OPT_ADC_CAL_FUSE_REV = 0x2
[1196.000] I> FUSE_SKU_INFO_0 = 0xd2
[1196.005] I> FUSE_OPT_SAMPLE_TYPE_0 = 0x3 PS
[1196.010] I> FUSE_PACKAGE_INFO_0 = 0x2
[1196.015] I> SKU: Prod
[1196.018] I> Task: Boost clocks (0x40055b31)
[1196.025] I> Initializing PLLC2 for AXI_CBB.
[1196.030] I> AXI_CBB : src = 35, divisor = 0
[1196.035] I> Task: Voltage monitor (0x40055de5)
[1196.042] I> VMON: Vmon re-calibration and fine tuning done
[1196.049] I> Task: TSC init (0x4005ac99)
[1196.055] I> Task: Thermal check (0x4005b01d)
[1196.062] I> max_chip_limit = 105
[1196.066] I> min_chip_limit = -28
[1196.070] I> max temp read = 30
[1196.074] I> min temp read = 29
[1196.078] I> Task: Update FSI SCR with thermal fuse data (0x4005b13d)
[1196.087] I> Task: Enable WDT 5th expiry (0x4005ad09)
[1196.094] I> Task: I2C register (0x40052a55)
[1196.101] I> Task: Set I2C bus freq (0x40052a41)
[1196.108] I> Task: Reset FSI (0x40055b41)
[1196.114] I> Task: Common rail init (0x4005582d)
[1196.121] I> DONE: Thermal config
[1196.126] I> DONE: SOC rail config
[1196.131] W> PMIC_CONFIG: Rail: MEMIO rail config not found in MB1 BCT.
[1196.139] I> DONE: MEMIO rail config
[1196.144] I> DONE: GPU rail info
[1196.148] I> DONE: CV rail info
[1196.152] I> Task: Enable sc7 clock-mon (0x4005ac8d)
[1196.171] I> FMON: Fmon re-programming done
[1196.176] I> Task: CCPLEX IST init (0x4005388d)
[1196.183] I> Task: CPU WP0 (0x40053445)
[1196.189] I> Loading MCE
[1196.211] I> Sending WP0 mailbox command to PSC
[1196.226] I> Task: MB1 fixed firewalls (0x4005a569)
[1196.239] W> Firewall readback mismatch
[1196.244] W> Firewall readback mismatch
[1196.261] I> Task: BPMP fw ast config (0x4005a74d)
[1196.268] I> Task: Load nvdec-fw (0x4005a85d)
[1196.294] I> Task: Program TSEC carveout (0x40053d3d)
[1196.301] I> TSEC-FW load not enabled
[1196.305] I> Task: GPIO interrupt map (0x40055a4d)
[1196.313] I> Task: Unpowergate AOPG CAN (0x40053ef1)
[1196.320] I> Task: Misc NV security settings (0x4005368d)
[1196.328] I> NVDEC sticky bits programming done
[1196.334] I> Successfully powergated NVDEC
[1196.339] I> Task: Disable/Reload WDT (0x4005ad61)
[1196.346] I> Task: Program BPMP-IPC carveouts (0x40053d01)
[1196.354] I> Program IPC carveouts
[1196.359] I> SLCG Global override status := 0x0
[1196.365] I> MB1: MSS reconfig completed

After that MB2 SC7-exit sequence starts but fails with an error

I> MB2 (version: 0.0.0.0-t234-54845784-ef56bb9c)
I> t234-A01-0-Silicon (0x12347)
I> Boot-mode : SC7 Exit
I> Emulation:
I> Entry timestamp: 0x474fb321
I> Regular heap: [base:0x40040000, size:0x2000]
I> Task: ARI update carveout TZDRAM (0x40053cb0)
I> Task: Enable hot-plug capability (0x4006087c)
I> Task: PSC mailbox init (0x40058820)
I> Task: Crypto init (0x40055a78)
I> Task: Enable GP-SE clock (0x40053db8)
I> Task: OEM SC7 context integrity check (0x40059828)
I> Task: Restore FSI padctl config (0x40059018)
I> Task: Program CBB PCIE AMAP regions (0x40059b30)
I> Task: Load and authenticate registered FWs (0x4005b428)
I> Task: Load AUXP FWs (0x4006041c)
I> Skipping SCE FW load
I> Successfully register RCE FW load task with MB2 loader
I> Successfully register DCE FW load task with MB2 loader
I> Unpowergating APE
I> Unpowergate done
I> Successfully register APE FW load task with MB2 loader
I> Skipping FSI FW load
I> Successfully register XUSB FW load task with MB2 loader
E> SE_CRYPTO: Failed to verify RSA PSS signature.
E> MB2_FW_LOAD: Failed to load FW.
C> Task 0x0 failed (err: 0x3a3a2018)
E> Top caller module: SE_CRYPTO, error module: SE_CRYPTO, reason: 0x18, aux_info: 0x20
I> Busy Spin

After that system reboots and starts from MB1 cold boot and loads as usual

��
[0000.071] I> MB1 (version: 0.32.0.0-t234-54845784-57325615)
[0000.076] I> t234-A01-0-Silicon (0x12347) Prod
[0000.081] I> Boot-mode : Coldboot
[0000.084] I> Emulation:
[0000.086] I> Entry timestamp: 0x00000000
[0000.090] I> last_boot_error: 0x0
[0000.093] I> BR-BCT: preprod_dev_sign: 0

So problem is that there is an error with

E> SE_CRYPTO: Failed to verify RSA PSS signature.
E> MB2_FW_LOAD: Failed to load FW.

during MB2 Sc7-exit which prevents to further resume from suspend. There is no such an error during cold-boot. So maybe something in MB1\MB2 bct or fuses makes that happenning specifically for sc7 mode? Could you please advise where should we check? In tegra234-mb1-bct-misc-p3701-0000.dts disable_sc7 =0

Thanks!

KevinFFF · September 4, 2023, 2:38am

Have you verified with the latest JP5.1.2 (R35.4.1)?

Please provide the full serial console log of the successful boot.

It seems the authentication failed.
Could you wake up the board from sc7 through pressing power key instead of sending SMS?

nickpro · September 4, 2023, 6:49pm

Please provide the full serial console log of the successful boot.
MB1_MB2_coldboot_log.txt (25.8 KB)
Could you wake up the board from sc7 through pressing power key instead of sending SMS?
Will check tomorrow and update the results
Have you verified with the latest JP5.1.2 (R35.4.1)
Not yet, it will take time to adopt latest version. But using current version on vanilla devkit with default option sc7 wakeup works ok
It seems the authentication failed.
Seems so, bu there is no such an error during normal boot. So where could be a problem?

Thanks

KevinFFF · September 5, 2023, 6:53am

I> Partition name: A_spe-fw
I> Size of partition: 589824
I> Binary@ device:3/0 block-55040 (partition size: 0x90000), name: A_spe-fw
I> RSA PSS signature check: OK

From your successful boot up log, it seems the authentication check w/o issue.

Please help to confirm if you could reproduce the issue with pressing power button to wake it up.
Or the issue is specific with waking up through SMS to modem.

nickpro · September 6, 2023, 2:07pm

I have checked the issue reproducing when using power key, also unplugging usb cable.
Could you help regarding authentication issue during sc7-exit? Or maybe give an idea where is something regarding this process?

KevinFFF · September 7, 2023, 3:14am

I’ve tried to reproduced on the devkit but it could wake up as expected through pressing power key.
Could you reproduce the same issue on the devkit?

Do you have custom modification for SPE?
Have you updated the encrypted binaries correctly?

nickpro · September 7, 2023, 11:58am

Could you reproduce the same issue on the devkit?

There is no such an issue on devkit with a vanilla jetpack but we don’t use devkit and there are some differences to vanilla.
Actually we use:

Secure Boot enabled
We are flashing via Sign and Flash Secured Images in Separate Steps
Also enabled fuses

Do you have custom modification for SPE?

No we didn’t touch anything around SPE

As error in MB2 regarding authentication maybe there special settings for autentication on MB2 sc7-exit somewhere? We use default mb2-bct.

Also we use latest binary for XUSB from here.
https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v3.1/overlay_xusb_35.3.1.tbz2/

nickpro · September 7, 2023, 1:41pm

Major updates to the post above:

tl;dr: We have test flashing devkit with vanilla Jetson Linux 35.3.1 and 35.4.1 using stock flash.sh but using our fuses configuration and problem reproduces.

SOM was previously flashed with this xml config:

<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="ArmJtagDisable" size="4" value="0x1"/>
    <fuse name="Apb2JtagDisable" size="4" value="0x1"/>
    <fuse name="DebugAuthentication" size="4" value="0x1F"/>
    <fuse name="SwReserved" size="4" value="0x1"/>
    <fuse name="PublicKeyHash" size="64" value="0x..."/>
    <fuse name="OemK1" size="32" value="0x..."/>
    <fuse name="OemK2" size="32" value="0x..."/>
    <fuse name="BootSecurityInfo" size="4" value="0x201"/>
    <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

We are flashing using this command sudo ./flash.sh -u ~/pkc_rsa_3k.pem jetson-agx-orin-devkit mmcblk0p1
Same error occurs on Vanilla Jetson Linux 35.3.1 and 35.4.1 and devkit:

I> MB2 (version: 0.0.0.0-t234-54845784-a822a8cb)
I> t234-A01-0-Silicon (0x12347)
I> Boot-mode : SC7 Exit
I> Emulation: 
I> Entry timestamp: 0x07bdc60e
I> Regular heap: [base:0x40040000, size:0x2000]
I> Task: ARI update carveout TZDRAM (0x40053cb0)
I> Task: Enable hot-plug capability (0x400609fc)
I> Task: PSC mailbox init (0x400588b4)
I> Task: Crypto init (0x40055a78)
I> Task: Enable GP-SE clock (0x40053db8)
I> Task: OEM SC7 context integrity check (0x400598bc)
I> Task: Restore FSI padctl config (0x400590ac)
I> Task: Program CBB PCIE AMAP regions (0x40059bc4)
I> Task: Load and authenticate registered FWs (0x4005b550)
I> Task: Load AUXP FWs (0x4006059c)
I> Skipping SCE FW load
I> Successfully register RCE FW load task with MB2 loader
I> Successfully register DCE FW load task with MB2 loader
I> Unpowergating APE
I> Unpowergate done
I> Successfully register APE FW load task with MB2 loader
I> Skipping FSI FW load
I> Successfully register XUSB FW load task with MB2 loader
E> SE_CRYPTO: Failed to verify RSA PSS signature.
E> MB2_FW_LOAD: Failed to load FW.
C> Task 0x0 failed (err: 0x3a3a2018)
E> Top caller module: SE_CRYPTO, error module: SE_CRYPTO, reason: 0x18, aux_info: 0x20
I> Busy Spin

Could you please help verify if we need to add/remove something in fuses to succesefully use sc7 mode?

KevinFFF · September 8, 2023, 2:34am

Could you share the full flash log when you run this command to flash on the devkit?

nickpro · September 8, 2023, 8:27am

Here is the full devkit with fuses flash log
flash_35.4.1.log (91.0 KB)

nickpro · September 14, 2023, 10:00am

Hi @KevinFFF.
Are there any news? Have you succeed checking the log or maybe reproduce the error on your devkit?

KevinFFF · September 20, 2023, 5:54am

Are you using just this command on the devkit to reproduce the issue?
Could you share your pkc_rsa_3k.pem for us to reproduce the issue locally?

nickpro · September 25, 2023, 1:05pm

We are using this command to flash dev kit which has fuses applied before, you can find the full log below. I think we can make test environment key, reproduce it and send it to you if needed.
I think major problem here are the fuses configuration. Can you suggest what additional information we need to provide to you in order to reproduce the issue? Fuses configuration can be found in the previous message.

Thanks,
Nick

KevinFFF · September 28, 2023, 8:22am

Yes, I would like to know the detailed reproduce steps for the devkit so that I could reproduce locally and do further check.

Please provide the steps and the required files (including the fuse configuration and the keys…etc) you used.

Let focus on pressing the button to wake it up from SC7.

nickpro · September 28, 2023, 5:27pm

Hi, KevinFFF

Here are the detailed instructions to reproduce:

1.1 Download SDK and sample rootfs

wget https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v4.1/release/jetson_linux_r35.4.1_aarch64.tbz2
wget https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v4.1/release/tegra_linux_sample-root-filesystem_r35.4.1_aarch64.tbz2

1.2 Unpack archives

tar -xvf jetson_linux_r35.4.1_aarch64.tbz2
sudo tar -xvf tegra_linux_sample-root-filesystem_r35.4.1_aarch64.tbz2 -C Linux_for_Tegra/rootfs/

1.3 Prepare sample rootfs

cd Linux_for_Tegra/
sudo ./apply_binaries.sh
sudo tools/l4t_create_default_user.sh -u nvidia -p nvidia --accept-license

2.1 Fill private key

Private key generated by instructions here: Secure Boot — Jetson Linux Developer Guide documentation
# openssl genrsa -out pkc_rsa_3k.pem 3072

cat >pkc_rsa_3k.pem
-----BEGIN PRIVATE KEY-----
MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQDwkwHNQmNYQY/W
pmXTc8BtWjK0bSXn+R3/0C3lkrdlWw4D8AC+i48NWuCsCyhBf+OdeZUC6f4TZXy6
YdBX/A5QAYLYh4EG9MrTjyynRDDYQyIh2sVq7X/L7Fnv9je/53lo22ia24bOYryQ
M6G98+/RTFxjChN7JN+eKMEco/GCp3zhOaxrQjh1Z+lUIeVENiE6VGNRBpOYs/Gd
9LDeDmCTqA8cEfwNYSzTt6x1N/DSovDsCCIni5aABDP/jZv34xfZ4qJyYqtk9cZh
8F/ofnLBKDSSju94ROvy3SVCSsf/+LOMS98Z04JpRY8m221B3mfU8rkd3yrpeALK
yOflabjiCN2FOPTMdvkcIpyzJsPzzP8A+yoweL1Y/dy0EYPccK7JdPg9ne4v4alT
9IkxZggeRydktFEbp+y2IaheXnNu7WhNxmi4qFVQnFYPoHRMX+p4PVExl3pTb6NJ
g7gfyDq4oWho67hVC73X9r2Z62uzjMgFouReUVQc8vo8AZ7g7isCAwEAAQKCAYAb
t+RqQO7vWUZ4Zd2vmlOehdj3vueyLZrOQa84F0p4LCCWRY3gZnYKBOGEERkHSvPv
zfVkS4+RrozLcL+vk4QWpcXsqtgr9AJ2k7WCZDH4iOui2PEMG+cwmL/YDRdpTgNI
GJeZ2BdVKj0tpDVLjJKiG9k9NAkAlEQLlgiCA0WtVxzlWl7KUOvuYxWYMvuWe2Ii
tVxoFojk/D6ng2zpeOCZwrBS/KN86yheEHiXXOWrb0iw+VLuGYAyqclP9YH18r0w
lile4UIGp+w0EHWrX6VYxopZSZBQk2XXfoUCtvnbB40FmAmrECpc8WdkIa50JWuY
UorHyBftd7BzZoBE144FiSUaVJ2cB6R7NQtjEFiaqyeS6DCmTmdxUhNEjybU3QX8
yz51/QJm9r3ZpHjfqvEWXjR8GNWL9yVXkUoGloa4qx8gKhyh5sQGsA3hElUiTTBT
Wx9lKSI1j6a/r/dBinSARfRqV95k7BRrNaMgIsvzUnGMdYOdy/GReOjGYhmnPGkC
gcEA+jBl1f0+fjJFKdmuE7MlBLtlX2NHSdfke/GN/MB2kRHqN8cRb5EA2PQgNqxP
GVzKqPiLwUyPIzqrrfgvvj+p47LnnFwefZaZPkYDvpB8RMg2MmkeH4ogd0lilW0t
tXjN5VaEHDb3ori3uAVakr147rt0IeUmK7p6B0xjXVWSFzV9817A/kXJXGt78Jvd
9rsGbK5blkdWavDvUkA5KeLxNi1qzeCrfmB2trpN2EeMs7vJU0/OyUC1lf4gzet1
B+kfAoHBAPYpcMCD6D4iB9BKKwoUIucLb7OY576OcXLFmkfypszdxD1lIRiv1AL8
OWvklGIT2HFNxyrozJv5zwYRc3RMk4Q2V26NCDDuh0z6LKqNaKL9ys4alrY01YI3
l9S4OWbyoOw2wNg5WcB74FbuYoUrd2AeVbaCOG/0dJdZ1+AHT2sdu4YQS2kJ5LIt
6swM9EqmDl8LuulOMfz6GUGFPEGtngnYa9jwphYVyfNudzkDthvF2GPFB28tL9q2
zIDOHmk9dQKBwFMGBIVCiJ5wKCt/JRk8dahgV3+T/nAuyI+o1Slu5Om3PDZORSb0
w4c7XAVIoOcVt9riv93hfg5+xcHxfkZv8fyxvdJRb3zVoPzdVxjB8bsRhYqs/2YP
/D4ZiDF2DZkPAaR9VVHXm83P5oeWnzvazGrMofkthcE1HJGXc9HhN52kDqvYYcr/
dZbJxFNQJhRec/9UzOfNvIu4cHKnBVE1Ej6cS7kOOVqywDJbGMIQ3Ew4oNKYxVJb
uuaPcmtjG28ImQKBwF5i62nV6jIQyGA0YCZgLDXdK7p4kbt+UL/KRur5fr2k9v73
jOYzXR676aSWI9Mret2PDiRE2VehRKE2Bcf9KL8UOxgXmaFxhI2ei4vl5s5AdAft
KAa7YXaprF0TOmdf9xY7tFv0OZbVqOKMS1h2nzJKz2DIs60x1ZbHC0BKbUhMQUAZ
dWDUO02az6HoAa+x1mbZT5Tvt7khiJeX58/jK2rpAglP1M85EZN2st44rxYdGWi/
/qbBc8zwNJ/a6Mw/lQKBwHHwA4tcVtjY5jZ4zYRyvxrKtfCCzl99zlG5JKGvw4yy
wcGoN0NhS5CNYPu3dxCl3L5BSAPsKpQrdcgkyw//dO50rp3g9tPbma3A6GCGhShS
WKymIEUjrXuSQ6Z5NqINT3QeFJujxx9vhGaloWdYxkLOFtfVDsRmy4VDoeDYtCkG
BJsQaSn2T4wn4WKFgMEqaIlw+BpG7KGzcmxb/fL3A/vANm1jU26Ds8/ivZc+kKLU
FLVc+4OoLvakXVY/ha3Zzw==
-----END PRIVATE KEY-----
HERE
chmod 400 pkc_rsa_3k.pem

cat >fuse.xml
<genericfuse MagicId="0x45535546" version="1.0.0">
    <!-- <fuse name="OdmId" size="8" value="0xFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="OdmInfo" size="4" value="0xFFFFFFFF"/> -->
    <fuse name="ArmJtagDisable" size="4" value="0x1"/>
    <fuse name="Apb2JtagDisable" size="4" value="0x1"/>
    <fuse name="DebugAuthentication" size="4" value="0x1F"/>
    <!-- <fuse name="CcplexDfdAccessDisable" size="4" value="0x1"/> -->
    <!-- <fuse name="ReservedOdm0" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm1" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm2" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm3" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="OdmLock" size="4" value="0xF"/> -->
    <!-- <fuse name="ReservedOdm4" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm5" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm6" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ReservedOdm7" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="SecureProvisionInfo" size="4" value="0x1"/> -->
    <!-- <fuse name="OptInEnable" size="4" value="0x1"/> -->
    <fuse name="SwReserved" size="4" value="0x1"/>
    <!-- <fuse name="BootDevInfo" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="SecuritySwOdm" size="4" value="0xFFFFFFFF"/> -->
    <!-- <fuse name="ZeroizeDis" size="4" value="0xFFFFFFFF"/> -->
    <fuse name="PublicKeyHash" size="64" value="0x4EFDD288C9C5242187498EDD2AFB4C9864753BEA46E8C8D1490DD0EF6253C67DD6EE9D6127D89D4504785BA16D985DF2EF6AC32A73905D2BDFBEB9635884BF33"/>
    <!-- <fuse name="PkcPubkeyHash1" size="64" value="0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="PkcPubkeyHash2" size="64" value="0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="EndorseKey" size="68" value="0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="SecureBootKey" size="32" value="0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="Kdk0" size="32" value="0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"/> -->
    <!-- <fuse name="PscOdmStatic" size="4" value="0xFFFFFFFF"/> -->
    <fuse name="OemK1" size="32" value="0xF8E2CB0D430FBB61A122723FBFE53EC0A3BA4A5ED4D5D0B9CE20B03637992C69"/>
    <fuse name="OemK2" size="32" value="0xA9F42FDBD368989A3B6CA282F172D537C4C2AD7CD21407316F94DDD2BA2BCF17"/>
    <!-- <fuse name="RevokePkH0" size="4" value="0x1"/> -->
    <!-- <fuse name="RevokePkH1" size="4" value="0x1"/> -->
    <fuse name="BootSecurityInfo" size="4" value="0x201"/>
    <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

2.2 Burn fuses

sudo ./odmfuse.sh -X fuse.xml -i 0x23 jetson-agx-orin-devkit

2.3 Flash rootfs

sudo ./flash.sh -u pkc_rsa_3k.pem jetson-agx-orin-devkit mmcblk0p1

3.1 Enter deep sleep

sudo systemctl suspend
fuse_xml+pkc_rsa_3k_pem.zip (3.5 KB)