Reflash secureboot failed

Hello

We have a problem with rolling any firmware. We installed secure-boot by find using these commands (with a pre-generated RSA key):

Rootfs firmware: sudo ./apply_binaries.sh.

Generating bootloader sudo ./odmfuse.sh --noburn -i 0x19 -c PKC -p -k rsa.pem jetson-xavier.

Now it does not turn on due to, I suppose, problems with the kernel (after installing SDK components via SDK manager, they accidentally installed linux4t or another kernel along with the header). After rebooting, it immediately enters force recovery mode

And then the firmware: sudo ./flash.sh -u rsa.pem jetson-xavier mmcblk0p1.

Any action, even an attempt to completely overwrite the image, does not help. We would be able to fully format because the device itself is important. There are no and never will be access keys( because we by accident deleted them ), so, unfortunately, we won’t be able to specify the key as a parameter when using the flash.sh script

hello ristle,

your platform did not fused while you assign --no-burn options to the fuse script,
i.e. $ sudo ./odmfuse.sh --noburn -i 0x19 -c PKC -p -k rsa.pem jetson-xavier.

Thank you, my miss. Then I try to flash the output say “Could not read boot information”. And then it fails

hello ristle,

could you please gather the detail logs for reference,
thanks

Error is on the image below

hello ristle,

may I know had your device fused before?
please put your Jetson AGX Xavier into forced-recovery mode and running the script to fuse the board.
thanks

Hello, JerryChang

Yes, the device was flashed twice and worked at all times. Then we flashed one of our scripts, which worked on a non-secure boot rootfs system, system install something related with Linux-4t-headers and other kernels’ components. After this, we can not do something with the device.

Thanks

hello ristle,

may I know what’s difference of your script file?

BTW,
since there’s error reported about reading board information,
you may also look into flash configuration file, i.e. p2771-0000.conf.common,
there’s process_board_version() function to parse board information. you may add those board version to your flash commands.
thanks

Hello JerryChang,

I’m using 32.4.3 version
I was talking about some additional software, for example, ros-melodic-realsense2, and e.t.c.
There are some photos

And new generated RSA key:
sudo ./odmfuse.sh --noburn -c PKC -i 0x19 -p -k rsa.pem jetson-xavier

hello ristle,

could you please also refer to Topic 123506, please check you’ll need to modify odmfuse.sh to make it works.
thanks

Hello, JerryChang

I have tried solutions from Topic 123506 and some addition from there like these. Also I tried the version from 32.3.1. A mistake is the same.
Here some new issue then I tried to do these steps on 32.4.3:

cd rootfs && sudo tar xvf ../../SamplerootFileSystem...
cd .. && sudo ./apply_binaries.sh
sudo BOARDID=2888 FAB=400 BOARDSKU=0004 BOARDREV=K.0  ./odomfuse-chaned.sh --noburn -i 0x19 -c PKC -p -k ./rsa.pem  jetson-xavier

Here screenshot of this fail. jetson was in recovery mode

hello ristle,

just for confirmation, did you also download the r32.4.3 secure boot tools to your local host for enabling secure boot?
thanks

Yes, i downloaded it

Also I want to mention these issue with r32.4.3 when i trying to flash jetson agx xavier


image
I can attach log of these and do ls:

hello ristle,

may I know all your steps in details.
we had verified the fuse process; could you please also refer to the steps in Topic 117585.
thanks

hi,
If you have execute the steps:

$ sudo BOARDID=2888 FAB=400 BOARDSKU=0004 BOARDREV=K.0 ./odmfuse.sh --noburn -j -i 0x19 -c PKC -p -k rsa_priv.pem jetson-xavier
$ sudo tar xpf fuseblob.tbz2
$ cd bootloader
$ cat odmfuse_pkc.xml // check if required fuses are included
$ sudo ./fusecmd.sh

The Xavier should have PKC(only PKC, not PKC + SBK) enabled. And you need to flash it like:

$ sudo BOARDID=2888 FAB=400 BOARDSKU=0004 BOARDREV=K.0 ./flash.sh --no-flash -u rsa_priv.pem jetson-xavier mmcblk0p1
$ cd bootloader
$ sudo bash ./flashcmd.txt

Please ensure you configure BOARDID/FAB/BOARDSKU/BOARDREV correctly.

Hello

I tried DaneLLL’s steps but it didn’t help. The issue still the same ( BootRom Communication failed ). I checked board Id and also tried this:

BOARDID=2888 FAB=400 BOARDSKU=0001 BOARDREV=H.0

They provided documentation in a section of burning SBK and PKC.
In the following step, I got an error

$ sudo ./fusecmd.sh

Thanks

Hi,
The Xavier is fused and potected so you cannot execute fusecmd.sh again. Please try to flash it by executing:

No way to do a factory reset or remove system image if I lost rsa_priv.pem?

Thanks

hello ristle,

if you haven’t perform odmfuse script to fuse your Xavier platform, you may generate another private key to fuse the board,