Everything works fine, when using test or noburn options, however, when we try to burn the keys to the device, the SBK key is not burned.
Instead, the device is burned in PKC mode, and the SBK key is all zeros.
We are using the following versions:
Jetpack 4.6.4
L4T 32.7.4
Following log lines are look suspicious (full logs below):
it looks you’re using an incorrect commands.
FYI, -c options to specify board authentication types, it should be NS (No authentication) since you’re performing fuse burning to non-fuse target.
BTW,
if you have target already fused with PKC. you cannot perform odmfuse.sh again to add SBK keys by setting authentication type as SBKPKC.
anyways,
may I know what’s the actual fuse status of your target?
Hi @JerryChang,
I an attempting to burn to a non-fuse target. I’ve also tried without the -c or --auth which should default to ns as far as I understood but then I see the same behavior where the sbk is omitted and a zero key is assumed.
I am fully aware, that the SBK cannot be added, I already have 3 devices that are in PKC mode the testify to that :).
Thanks
Hi I am still stuck and will appreciate any help.
We have looked into the odmfuse.sh script to try to figure out what is going on.
We are down to our last devices and need to be sure we are doing the right thing before we can move to test on physical device.
The -c option is obsolete and has no affect.
Tried the --auth PKCSBK and does not seem to have affect when in online or hybrid mode.
I followed the code as much as I could, I see the SBK key being written to bootloader/odmfuse_pkc.xml in the “SecureBootKey” tag but then I see that it is not used and the key is not passed to the tegrasign_v3.py
This command sudo BOARDID="3636" FAB="100" ./odmfuse.sh --test --noburn --auth SBKPKC --disable-jtag -i 0x18 -p -k /home/shai/rsa_priv.pem -S /home/shai/sbk.txkit-tx2-nx-5-nx-devk seems to work and I see many references to the sbk and that tegrasign_v3.py is call with the --key
may I know what’s the current device’s fuse state?
this “–auth” option is only needed in offline mode.
it’s indicating the current fuse status of the board. there’re three options need to enabled all together for the offline approach,
such as… (a) board info, (b) --noburn, (c) --auth.
this offline approach will generate a fuse blob (i.e. fuseblob.tbz2),
after process complete, developers could share this file to the factory floor for actual burning the boards.
Hi Jerry,
The devices I worked with are devices with nothing burned on them. Basically, those devices were not used before.
I’d be glad to understand why online mode is not working. I run in offline mode to compare the results. I does look different but still I hesitant to use the blob generated given the problems we have with online mode.
Thanks!
this looks like incorrect commands, or… it’s sending incorrect commands to fuse script.
may I know what’s your host machine’s environment? for instance, is it a desktop with native ubuntu OS?
uname -a
Linux jig8 5.4.0-150-generic #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
The board we are using is a propriatary board. We are able to flash the device and burn the fuses to PKC mode. So the hardware should be ok.
Also tried with Gunstix board with same results
Thanks
here’s an explanation to ignore these two messages. Assuming zero filled SBK key Warning: pub_key.key is not found
as you can see, it’s calling tegrasign_v3.py, for example, tegrasign_v3.py --key None .. --pubkeyhash pub_key.key
because it’s command with a None key, --key None and, pub_key.key were passed in as zero by default.
had you try running odmfuseread for checking fuse variables?
Hi Again,
Yes, I ran odmfuseread and as expected the sbk is zeroed out.
My question is, why the code is assuming zero filled SBK in the first place? I am providing an SBK file which is not all zeros, it should use it instead.
The sbk file I’m providing looks like this:
0x12345678 0x9abcdef0 0xfedcba98 0x76543210
As far as I understood from the documentation, the SBK should be 4 32 bit random numbers (words), is that the case?
What am I missing? why we are not able to burn the SBK we configure?
the ODM production fuse is a global lock of all the manufacturing fuses.
please refer to Jetson TX2 NX Fuse Specification for checking [ODM Production Fuse].
Hi JerryChang,
I am not sure how this reference should help. Odmfuseread of a burned device clearly states that the device security is set to PKB and the SBK contains all zeros.
don’t it be your 2nd trial for burning fuse to the same target?
am I understand correctly that it’s your 1st approach to burn PKC with -p option enabled,
after that, you’ve 2nd approach to burn the target with SBKPKC without success.
My understanding is that since I provide both -k, -S and -p, it should burn everything in one go.
Is that the correct command? Am I missing any steps?
Thank
Hi,
Thanks for the response.
Can you help locate bootloader/fusecmd.sh I don’t have it on my disk where do I get it from?
I am running the command:
BOARDID=3636 FAB=100 ./odmfuse.sh --noburn -c SBKPKC --disable-jtag -i 0x18 -p -k /.../rsa_priv.pem -S /.../sbk.txt jetson-xavier-nx-devkit-tx2-nx
``
I get the following:
The option -c is obsolete now.
If you’re running this script with boards connected, “-c” is not needed.
If you’re running this script without boards connected(offline mode),
use “–auth” to indicate the authentication type of the board instead.