FSKP eFuse Burning Appears Successful but nv_fuse_read.sh Returns All Zeros on Jetson AGX Thor
Problem
I’m using FSKP to burn eFuses on a Jetson AGX Thor (T264 SoC). The FSKP tool reports success from the host side, but after reboot, nv_fuse_read.sh shows all fuse values as zeros — including public_key_hash, boot_security_info, odm_lock, optin_enable, etc. None of the burned values appear to have taken effect.
Environment
- Platform: Jetson AGX Thor (T264 SoC, chip_id = 0x260)
- JetPack version: JetPack 7.x / Jetson Linux r38.4+
- Tool: fskp_fuseburn.py v0.2
Fuse Configuration
<?xml version="1.0"?>
<genericfuse MagicId="0x45535546" version="1.0.0">
<!-- PKC Public Key Hash -->
<fuse name="PublicKeyHash" size="64" value="0x0b8c****4f37b"/>
<!-- SBK Secure Boot Key (Thor requires same value on all three lanes) -->
<fuse name="PscSecureBootKey" size="32" value="0x8735****8f3bb"/>
<fuse name="OespSecureBootKey" size="32" value="0x8735****8f3bb"/>
<fuse name="SbSecureBootKey" size="32" value="0x8735****8f3bb"/>
<!-- OemKdk1: EKB encryption root key -->
<fuse name="PscOemKdk1" size="32" value="0x94a8****5bc2b"/>
<fuse name="OespOemKdk1" size="32" value="0x94a8****5bc2b"/>
<fuse name="SbOemKdk1" size="32" value="0x94a8****5bc2b"/>
<!-- FSI Debug Authentication Disable -->
<fuse name="FsiDebugAuthentication" size="4" value="0x1F"/>
<!-- SwReserved: bit[3]=SkipDevSelStraps=1 -->
<fuse name="SwReserved" size="4" value="0x000008"/>
<!-- BootSecurityInfo: Bit[3] Bit[9] Bit[10] set -->
<fuse name="BootSecurityInfo" size="4" value="0x0608"/>
<!-- SecurityMode not written (non-production mode) -->
</genericfuse>
Step 1: Blob Generation
fskp_fuseburn.py \
-f fuse_config.xml \
-c 0x26 \
-B jetson-agx-thor-devkit.conf \
--board-spec thor-agx-board-spec.txt \
-K -g fskp_blob
Key log output (summarized):
[fskp] FSKP execution started
[fskp] fskp_fuseburn.py script version 0.2
[fskp] FSKP keyslot is skipped
[fskp] Creating t264 fuse blob
[fskp] Perform fuse values check against known debug/development values
[fskp] Generating 14 random string pairs
[fskp] Generating HPPK package
[fskp] Generating BR-BCT / Signing BCT / Updating BCT with signature
[fskp] Generating SBPK package
[fskp] Generating MB1-BCT / MEM-BCT
[fskp] Signing mb1_bct, bct_MEM, mb1_t264_prod, psc_bl1_t264_prod
[fskp] Generating blob for T264, packaging fskp_test.bin
[fskp] Signing all blob components ...
[fskp] Do you want to continue the fuse operations on device (Yes/No) Received 'No'
[fskp] exiting ...
[fskp] FSKP execution successful from the host side.
[fskp] FSKP execution time 0:00:13.569898
Step 2: Fuse Burning
fskp_fuseburn.py \
-c 0x26 \
-B jetson-agx-thor-devkit.conf \
--board-spec thor-agx-board-spec.txt \
-P fskp_blob -b
Key log output:
[fskp] FSKP execution started
[fskp] fskp_fuseburn.py script version 0.2
[fskp] Found NVIDIA device ID 0x7026
[fskp] Getting target details
[fskp] BR_CID: 0x8001****01C0
[fskp] ECID: 0x1783D****01C0
[fskp] Do you want to continue the fuse operations on device (Yes/No) Received 'Yes'
[fskp] Downloading FSKP blob to target
[fskp] WARNING!! Target will automatically reset once burning fuses is complete.
[fskp] Please check BPMP log from the target side to ensure the operation is also successful.
[fskp] FSKP execution successful from the host side.
[fskp] FSKP execution time 0:00:29.144929
Step 3: Post-Reboot Verification — All Zeros
After the device rebooted:
$ sudo nv_fuse_read.sh
odm_lock: 0x00000000
optin_enable: 0x00000000
public_key_hash: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
boot_security_info: 0x00000000
odmid: 0x0000000000000000
BR_CID: 0x1783********0301c0
security_mode: 0x00000000
reserved_odm0~7: 0x00000000
odminfo: 0x00000000
system_fw_field_ratchet0~3: 0x00000000
ecid: 0x8179***********c07
All fuse fields read back as zero. The only non-zero values are BR_CID and ecid, which are factory-preset read-only fuses.
Questions
- Why does FSKP report “execution successful” but the fuses appear unburned (all zeros)?
- Is there a known issue with FSKP on T264/Thor where the blob is generated and downloaded but the actual fuse write does not commit?
- The log says “Please check BPMP log from the target side to ensure the operation is also successful.” — how can I retrieve the BPMP log to verify the target-side result?
- Could the issue be related to the
FSKP keyslot is skippedmessage during blob generation? Does this indicate a problem with the FSKP key provisioning?
Any insights or suggestions would be greatly appreciated. Thank you!