OptiStick gen5 secure-boot eFuse test (prd100046)

2026-11-03 · Wilber Zheng · times in UTC

Result: PASS. A PVT OptiStick was fused with the 6-line production pattern in two sessions (stage A, then stage B). The fused unit boots signed firmware (AVB green), re-burns over USB with the signed ROM, factory-resets from golden, and refuses an unsigned loader at the first boot stage. The eFuse read-back matches 03-golden-readback.txt field for field. OTA was not tested.

Setup

Item	Value
Unit	PVT OptiStick (S905X5M), Shenzhen batch. Virgin eFuse before the test; AUDIO_VENDOR_ID unlocked.
Firmware	`optistick-x5m-prd100046-1g-5103dea85-ab-all.img` sha256 `2856f1d59438c61e…` · md5 `2b66d0c6954b65f8…` `rom/prd100046` = `5103dea85`; offline `sb_check` rc 0
Root hash	`abe6fe5de093d678e2161148e9c609fcddb8beab37e1186774bf4826c986188e`. Recomputed from the public keys fetched from KMS; all 6 keys match.
Tool	`amlogic/flash-host/sb-fuse-usb.sh` @ `5103dea85` (sha256 `ce7772e1…`)
Pattern	Stage A `ota-trust/efuse/prod/pattern/stage-a.txt` (`657398aa…`); stage B `pattern.txt` (`64cd069b…`)
Observation	HDMI capture; ssh `localuser` over the USB-debug link for `/proc/cmdline`. No UART.

Results

#	Test	Method	Result
A1	Stage A: write and lock both root hashes	05:54Z, write + read-back	PASS both hashes = abe6fe5d…, lock 01; all other fields 0
A2	Cold boot after stage A	power cycle, read cmdline	PASS `optisigns.sb=open`, `verifiedbootstate=green` (enables still 00, as expected)
B0	Pre-check before stage B	In the u-boot ADNL park: CRC32 of boot0/boot1 vs the pack's bootloader item, plus a negative control; stage B `--dry-run`	PASS boot0 = boot1 = pack; control failed as intended; dry-run would write only the two enables
B1	Stage B: set VENDOR_SIG and SCS_SIG	09:27Z, write + read-back, cable untouched (~10 s)	PASS both enables = 01; nothing else changed
B2	Boot after stage B	script's warm reboot, then a manual cold power cycle	PASS `optisigns.sb=fused`, `verifiedbootstate=green`, `vbmeta.device_state=locked`, slot _a, prd100046
B3	ADNL hardening (H1b)	non-allowlisted `oem` commands, then an allowed eFuse read	PASS `printenv` and `mmc` refused ("OptiSigns H1b: … not allowed when fused"); `efuse_obj get FEAT_ENABLE_DEVICE_SCS_SIG` returns 01
B4	Unsigned loader refused	`adnl reboot romusb` to BootROM DFU [BL1], then `sb-loader-only.sh --expect refuse` with the dbg1429 USB loader (loader-only package, no partition items)	PASS stops at the first stage ("Fail in first sect"); no command sent; unit stays at [BL1]
B5	Signed USB re-burn	from the same [BL1] state, `adnl_burn_pkg` with prd100046	PASS passes BL1 → BL2 → TPL, "burn successful"; boots to a new pairing code (new UUID). Positive control for B4.
B6	Factory reset	button-held recovery menu → Factory Reset	PASS "recovery image verified"; system/boot/vbmeta restored to both slots from golden0, /home wiped; reboots `fused` + `green` with a new pairing code
B7	Full eFuse read-back	final read-back of the stage B run vs `03-golden-readback.txt`	PASS all 18 fields match; DVGK/DVUK lock state only (values never read)
B8	OTA	—	NOT RUN no signed .swu in hand

Screenshots (HDMI capture)

Pairing screen after stage B — B2 — first boot after stage B (09:28Z): prd100046 reaches the pairing screen on the fused chip.

Recovery factory reset screen — B6 — factory reset on the fused unit: "recovery image verified", restoring from golden0.

Pairing screen after factory reset — B6 — after the reset: boots again with a new pairing code (identity wiped).

Limitations

No UART. The B4 refusal is inferred from the outcome: the signed pack passes the same first stage that the unsigned loader fails. The chip's own refusal message was not seen.
OTA not run. The CMS check of the .swu runs in Linux and does not depend on the eFuse. The fuse-dependent part (the new slot passing AVB) was covered indirectly by B6, which rewrote slot B from the same signed images and booted green. An OTA A→B switch on the fused unit is still untested.
Two sessions, not one. Stage A and stage B were written in separate parks with a power cycle between them, as on DUT5. The one-session six-line flow of the check sheet was not exercised.
After the fuse, the ADNL park refuses mmc, so the B0 CRC check of boot0/boot1 is only possible before the fuse. This is expected.

Evidence

Logs, screenshots and helper scripts (42 files) are kept locally under .local/evidence/rk_bake/2026-11-03-stick-efuse-prd100046/; available on request.