OptiStick 5 (S905X5M / S7D) secure-boot test dbg1479 - keys and changed files
Wilber Zheng, 2026-10-29. CONFIDENTIAL: contains private keys, DVGK and DVUK.

1-original-from-SEI/
  s905x5m-keys/device-keys/      device key set as received (s905x5m template)
  s905x5m-keys/dv_scs_keys_root/ root key set as received (root RSA keys, DVGK, DVUK, AES rootkeys)
  pattern.scs_usbpwd.efuse       eFuse pattern as received (NOT burned)

2-changed-by-wilber/
  device-fip-header.regenerated.bin
      Replaces device-keys/fip/template/s905x5m/trustchain-0/device-fip-header.bin.
      Generated with this SDK:
        gen_scs_root_hash.sh --rootkey-index 0 --key-dir <copy of dv_scs_keys_root> --trust-chain device-vendor
          --project s905x5m --device-soc s7d --template-dir ./soc/templates/s7d --sig-scheme rsa
          --ml-dsa-version draft1 --scs-family s7d --template-layout rsa --fip-header-layout mini --ops create-device-fip
      Reason: the supplied header has different blob-size fields (e.g. 0x0330 vs 0x02c0 at 0x39/0x59/0x81/0xa9/0xd1),
      and this SDK's BL30 failed the size check. The roothash is unchanged.
  u-boot/fw_arb.cfg.original     bl33/v2023/board/amlogic/s7d_bm201/fw_arb.cfg as in the SDK (vers 0x6)
  u-boot/fw_arb.cfg.used         same file with device_scs/tee/ree_vers set to 0x0 (used in the dbg1479 build)
  u-boot/fw_arb.cfg.diff
  pattern.scs_nolock.efuse       made with fip/s7d/bin/efuse-gen.sh (roothash + DVGK + DVUK + vendor-scs, no USB/DIF lock). NOT burned.
  pattern.sig-only.efuse         made with efuse-gen.sh (no DVGK/DVUK). NOT burned, not for use.

Other changes in the dbg1479 build (no file here):
  - bl33/v2023/configs/amlogic/s7d_bm201_defconfig: added CONFIG_AML_SIGNED_UBOOT=y
    (a "#define CONFIG_AML_SIGNED_UBOOT 1" in the board .h had no effect; build.sh reads the defconfig).
  - device-keys copied into bl33/v2023/board/amlogic/s7d_bm201/device-keys/ (with the regenerated header).
  - python2 installed on the build host (fip/s7d/bin/pem_extract_pubkey.py, called from add-device-keys-bl33.sh:107).
  - Yocto DISTRO_FEATURES AVB / scs: NOT enabled. USB-burn stage files: unchanged.
  - No eFuse burned on the test unit.
