FSKP prebuilt blob is not burning any fuses

Robotics & Edge Computing Jetson Systems Jetson Orin NX
1

Hi! I’m currently trying to create an FSKP blob to burn the fuses on a Jetson Orin NX board. I created the prebuild package using the following command:

./fskp_fuseburn.py --board-spec orinnx-board-spec.txt -f fuse.xml -b -i 62 --key-exp fskp.ak.bin fskp_ek.bin --fskpcfg fskp_conf.txt -g out -c 0x23 -B p3768-0000-p3767-0000-a0.conf

The version of the FSKP partner tool is R36.4.0

When I try to run this prebuilt image in the RCM boot mode using
sudo ./fskp_fuseburn.py --board-spec ./orinnx-board-spec.txt -P out -s -b -c 0x23 -B p3768-0000-p3767-0000-a0.conf

The board is booting up and according to the serial logs, the FSKP image is loaded. However instead of the usual output from the FSKP tool, the system is rebooting without having any fuses flashed. On the console, the fskp_fuseburn tool signals, that the . This is the output on the serial console:

[0020.805] I> Loading FSKP
[0020.808] I> Slot: 0
[0020.810] I> Binary[12] block-201326592 (partition size: 0x70000)
[0020.816] I> Binary name: FSKP
[0020.819] I> Size of crypto header is 8192
[0020.822] I> Size of crypto header is 8192
[0020.827] I> BCH of FSKP read from storage
[0020.830] I> BCH address is : 0x8007e000
[0020.834] I> FSKP header integrity check is success
[0020.839] I> Binary magic in BCH component 0 is FSKP
[0020.844] I> component binary type is 12
[0020.848] I> Size of crypto header is 8192
[0020.858] I> FSKP binary is read from storage
[0020.863] I> FSKP binary integrity check is success
[0020.868] I> Binary FSKP loaded successfully at 0x80000000 (0x5e620)
[0020.874] I> Task: Map CCPLEX SHARED carveout
[0020.878] I> Task: Prepare MB2 params
[0020.882] I> Task: Dram ecc test
[0020.885] I> Task: Misc NV security settings
[0020.890] I> NVDEC sticky bits programming done
[0020.894] I> Successfully powergated NVDEC
[0020.898] I> Task: Disable/Reload WDT
[0020.901] I> Task: Program misc carveouts
[0020.905] I> Program IPC carveouts
[0020.909] I> Task: Disable SCPM/POD reset
[0020.913] I> SLCG Global override status := 0x0
[0020.917] I> MB1: MSS reconfig completed
=== Reboot occurs here ===
[0000.064] I> MB1 (version: 1.4.0.7-t234-54845784-56c609fa)
[0000.069] I> t234-A01-1-Silicon (0x12347) Prod
[0000.074] I> Boot-mode : Coldboot
[0000.077] I> Entry timestamp: 0x00000000
[0000.081] I> last_boot_error: 0x0
[0000.084] I> BR-BCT: preprod_dev_sign: 0
[0000.088] I> rst_source: 0x17, rst_level: 0x1
[0000.092] I> Task: SE error check
[0000.095] I> Task: Bootchain select WAR set
[0000.099] I> Task: Enable SLCG

What could cause this behaviour?

Thanks, Ben

4

hello bcarrick,

please double check your fuse configuration file, fuse.xml.

as you can see of Jetson Orin Series Modules Fuse Update Field Services Bulletin.
the fuse value for boot_security_info was burned (by manufacturing) to 0x1E0.
for instance,
you must do bitwise logically OR with the desired value with 0x1E0 in fuse programming flow.

besides..
please setup a serial console to gather the complete UART logs, we’ll need to check the bootloader logs for details.

5

Thank you for your answer!

I attached the serial output of the attempt to run the fskp blob until the reboot of the device

fskp-blob-fail.txt (14.9 KB)

In the boot_security_info, I already took the preset value 0x1E0 into account. Since the binaries are signed with an 521 bit ECDA key, SBK is enabled and the ODM keys are used, the boot_security_info is set to 0x3EB

However, the system doesn’t seem to even get to that point. It reboots right at the point where the FSKP applet should have been executed.

6

hello bcarrick,

right, it seems system has rebooted before the fuse-burning executed.
is this Orin NX ever fused before?

7

No, the device has never been fused.

For some more context: I created an FSKP blob about a year ago, that works. For new devices, I need to set an additional fuse now, that is why I created this new FSKP blob. I’m using the exact same setup as I did with the old, working blob.

Edit: One thing that could have changed between then and now is the python installation. Can you tell me what python version the R36.4.0 FSKP scripts are supposed to run with? Currently I’m using Python 3.10.12

8

I solved the issue. The problem was, that I had a typo in the filename of the ak key. The tool didn’t tell me that the file does not exist and did not correctly sign/encrypt the blob. With the correct filename the blob is now working as expected