Reading FUSE_PK_H1 and FUSE_PK_H2 from Linux

Robotics & Edge Computing Jetson & Embedded Systems Jetson AGX Orin
1

Hi,

In jetpack 5.1.2 there is this sysfs entry for FUSE_PUBLIC_KEY:

	FUSE_BURN_DATA(public_key, 0xbc, 21, 512, 0x64, false, true),

What should we add to be able to read FUSE_PK_H1 and FUSE_PK_H2 the same way? Or do we need to use /sys/bus/nvmem/devices/fuse/nvmem?

3

hello sarah.newman,

may I know the actual use-case for reading those? is it for examination?
you may check /sys/devices/platform/tegra-fuse for fuse variables.
note, as long as SecurityMode has burned, you will get 0xffff… when reading fuses. that is expected for security concern.

4

On Jetson AGX with SecurityMode set, only sensitive fuses like encryption keys were kek2 and secure_boot_key were 0xfff…, the other fuses were readable. Are you saying that’s different for AGX Orin?

What I am asking about is there are entries for some but not all of the fuses in /sys/devices/platform/tegra-fuse and I am asking how to add entries for some of the missing fuses.

5

had you try odmfuseread.sh for reading fuse values.

6

Thank you for the suggestion. My understanding is odmfuseread.sh reads the values via USB and is therefore not a replacement for reading the fuses on-device.

7

I found nv_fuse_read.sh in nvidia-l4t-tools_35.4.1-20230801124926_arm64.deb which we don’t normally fully install. That does use /sys/bus/nvmem/devices/fuse/nvmem.

I had to change it to work on our systems since it uses some shell functionality we don’t have available, but it solves the immediate issue.

My reading of the orin fuse specification is only the security sensitive fuses should be read as 0xff… IE

FUSE_KEYS_SBK_0
FUSE_KEYS_SBK_0_TAG
FUSE_KEYS_FKDD_SK_0
FUSE_KEYS_FKDD_SK_0_TAG
FUSE_KEYS_FKDD_AK_0
FUSE_KEYS_FKDD_AK_0_TAG
FUSE_KEYS_OEM_FUSE_IV_0
FUSE_KEYS_OEM_FUSE_IV_0_TAG
FUSE_KEYS_OEM_EK_0
FUSE_KEYS_OEM_EK_0_TAG
FUSE_KEYS_KDK0_0
FUSE_KEYS_KDK0_0_TAG
FUSE_KEYS_OEM_K1_0
FUSE_KEYS_OEM_K1_0_TAG
FUSE_KEYS_OEM_K2_0
FUSE_KEYS_OEM_K2_0_TAG
FUSE_KEYS_PSC_STATIC_OEM

And this does not include FUSE_PK_H1 or FUSE_PK_H2.

1 Like
8

don’t it support reading PK_H1 fuses in the target board.? i.e. /usr/sbin/nv_fuse_read.sh pk_h1

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.