I am new to using Jetson Xavier module. Running the linux revision R35.3.1. I burned the fuses following the developer guide. I burned the PBK, SBK, KEK1, KEK2 fuses and now i am unable to read the fuses back via ./odmfuseread.sh and the module is not booting up.
How did i generate PBK hash programmed to the fuse:
For an RSA key, you can also use tegrakeyhash program to generate PublicKeyHash value:
./tegrakeyhash --pkc <pkc.pem> --chip <chip_id>
sudo ./odmfuseread.sh -i 0x19 jetson-agx-xavier-devkit
Error: Either PKC or SBK key is not provided for SBK+PKC protected target board.
sudo ./odmfuseread.sh -i 0x19 -k ./bootloader/rsa3k.pubkey -S SBK.xml jetson-agx-xavier-devkit
Error: ECID read failed.
The target board must be attached in RCM mode.
sudo ./odmfuseread.sh -i 0x19 -k ./bootloader/rsa3k.pem -S SBK.xml jetson-agx-xavier-devkit
This does better but errors out with return code 3. Please check the log.txt file attached for details.
How do we generate SBK key? I have stored the hexadecimal values that i burned to the fuse per the developer guide in SBK.xml above.
What is the file that is needed for -k option prviate.pem file for RSA?
I have saved my RSA privatekey.pem file and all other values programmed in the fuses via ./odmfuse, is my board bricked?
I did see some similar topic to report the same issue by running odmfuseread.sh to check the fuse values.
anyways, could you please check the fuse values on the target, you may go to /sys/devices/platform/tegra-fuse/ for examination.
you may use Hardware Security Module (HSM) to generate a truly random number for an SBK key.
or, creating a text files to specify the keys by yourself. note, the SBK key file is stored in big-endian hexadecimal format.
is this device ever flashed before? odmfuse is the script file to burn the fuse, flash is the script to flash bootloader binaries, and also rootfs image to the target. you’ll need those to boot-up the target.
note, you may use private key to burn the fuse.
There were two problems on my end and at least 1 has been solved. So i am going to close this thread.
Issue 1: Jetson Xavier did not boot up after programming fuses (stuck in forced-recovery).
Solution: I found some old threads which state that “production bit” needs to be enabled which worked for me.
(I am surprised that the user guide does not mention this till date)
Issue 2: Jetson odmfuseread.sh doesnt work.
No solution: but i am going to let it pass as the Jetson is up and running and i can read status of the fuses via /sys/devices/platform/tegra-fuse/on boot-up from the target.