Set the QFPROM fuses

Qualcomm fuse programmable read only memory (QFPROM) fuses store cryptographic keys that authenticate software images during the secure boot process. This ensures that only authorized software can run on the device. QFPROM uses a fusing mechanism to program registers by blowing fuses, thereby storing permanent data This is a one-time operation that can’t be undone. The following table captures the QFPROM fuse values and details for QCS5430, QCS6490, Qualcomm Dragonwing^™ IQ-9075, Qualcomm Dragonwing^™ IQ-9100, Qualcomm Dragonwing^™ IQ-8275, Qualcomm Dragonwing^™ IQ-8300, and Qualcomm Dragonwing^™ IQ-615. Secure boot is enabled when the respective fuses are blown.

Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
Read permissions
Secondary Key derivation Key Read disable	7801A8	24	1	After provisioning the SKDK, blow this bit to secure the secondary key from being read back. A secure path hardware exists from SKDK to the crypto engine.
Write permissions
Read permissions write disable	7801B0	6	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enables write disable	7801B0	8	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM configuration write disable	7801B0	9	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Public key hash 0 write disable	7801B0	17	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM secure boot write disable	7801B0	23	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Secondary key derivation key write disable	7801B0	24	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enable
OEM secure boot FEC enable	7801B8	23	1	To enable FEC for OEM secure boot region, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
Secondary key derivation key FEC enable	7801B8	24	1	To enable FEC for the secondary KDF key, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
OEM Config
`WDOG_EN`	7801C0	14	1	Prevents the `WDOG_DISABLE` GPIO from disabling WDOG, freeing up the GPIO and preventing potential abuse by an attacker.
`SHARED_QSEE_SPIDEN_DISABLE`	7801C0	30	1	A shared Qualcomm TEE secure invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_QSEE_SPNIDEN_DISABLE`	7801C0	31	1	A shared Qualcomm TEE secure non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_DBGEN_DISABLE`	7801C4	32	1	A shared MSS invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_NIDEN_DISABLE`	7801C4	33	1	A shared MSS non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_CP_DBGEN_DISABLE`	7801C4	34	1	A shared CP invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_CP_NIDEN_DISABLE`	7801C4	35	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_NS_DBGEN_DISABLE`	7801C4	36	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_NS_NIDEN_DISABLE`	7801C4	37	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`APPS_DBGEN_DISABLE`	7801C4	38	1	Blow this bit for a secure solution. This configuration disables the application processor global invasive debug capabilities (JTAG and monitor mode). The `OVERRIDE` registers can override this configuration.
`APPS_NIDEN_DISABLE`	7801C4	39	1	Blow this bit for a secure solution. This configuration disables the application processor global non-invasive debug capabilities (trace and performance monitoring). This configuration can be overridden with the `OVERRIDE` registers.
`SHARED_MISC_DEBUG_DISABLE`	7801C4	40	1	A shared miscellaneous debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`EKU_ENFORCEMENT_EN`	7801C8	30	1	To enable enforcement of the EKU field in the certificate, blow this device.
`OEM_HW_ID[0:15]`	7801CC	[47:32]	0	Represents the OEM hardware ID. Bits 15:0.
`OEM_PRODUCT_ID[0:15]`	7801CC	[63:48]	0	Represents the OEM product ID. Bits 15:0.
`ANTI_ROLLBACK_FEATURE_EN[0]`	7801D4	32	1	Represents the BOOT_ANTI_ROLLBACK_EN fuse
`ANTI_ROLLBACK_FEATURE_EN[1]`	7801D4	33	1	Represents the TZAPPS_ANTI_ROLLBACK_EN fuse
`ANTI_ROLLBACK_FEATURE_EN[2]`	7801D4	34	1	Represents the PILSUBSYS_ANTI_ROLLBACK_EN fuse
`ANTI_ROLLBACK_FEATURE_EN[3]`	7801D4	35	1	Represents the MSA_ANTI_ROLLBACK_EN fuse
PK hash
`PK hash 0[383:0]`	780248	[383:0]		The OEM-specific root certificate PK hash value.
OEM secure boot
`OEM_SECURE_BOOT1_PK_HASH_IN_FUSE`	780728	4	1	When this bit is ‘1’, use the value stored in OEM_PK_HASH for the root certificate hash.
`OEM_SECURE_BOOT1_AUTH_EN`	780728	5	1	To enable secure boot for apps and other peripheral images, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 1.
`OEM_SECURE_BOOT2_PK_HASH_IN_FUSE`	780728	12	1	For boot configuration 2: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. If this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT2_AUTH_EN`	780728	13	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot.
`OEM_SECURE_BOOT3_PK_HASH_IN_FUSE`	780728	20	1	For boot configuration 3: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. When this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT3_AUTH_EN`	780728	21	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 3.
Sec key derivation key
`Sec Key derivation Key[255:0]`	780738	[255:0]		This 256‑bit value is used as the secondary key derivation input, which is used to generate the secondary key for the crypto engine. When running in an insecure mode (no secure boot or Debug enabled), the SKDK is fed into the key derivation function to generate a unique non‑secure secondary key for use by the crypto engine. When running in a secure mode (secure boot and debug disabled), the SKDK is fed directly to the crypto engine as the secondary key. After the SKDK value has been correctly programmed, the SKDK Read Disable must be blown to permanently protect the SKDK value. The software reads the SKDK value from the QFPROM before this correction is made. The SBL fuse blow API can automatically generate a random number for use as the SKDK, ensuring that the SKDK value is never available outside of the device.

Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
Read permissions
Secondary Key derivation Key Read disable	780190	31	1	After provisioning the SKDK, blow this bit to secure the secondary key from being read back. A secure path hardware exists from SKDK to the crypto engine.
Write permissions
Read permissions write disable	780198	5	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enables write disable	780198	7	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM configuration write disable	780198	8	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Public key hash 0 write disable	780198	24	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM secure boot write disable	780198	30	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Secondary key derivation key write disable	780198	31	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enable
OEM secure boot FEC enable	7801A0	30	1	To enable FEC for OEM secure boot region, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
Secondary key derivation key FEC enable	7801A0	31	1	To enable FEC for the secondary KDF key, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
OEM Config
`WDOG_EN`	7801A8	14	1	Prevents the `WDOG_DISABLE` GPIO from disabling WDOG, freeing up the GPIO and preventing potential abuse by an attacker.
`SHARED_QSEE_SPIDEN_DISABLE`	7801A8	30	1	A shared Qualcomm TEE secure invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_QSEE_SPNIDEN_DISABLE`	7801A8	31	1	A shared Qualcomm TEE secure non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_DBGEN_DISABLE`	7801AC	32	1	A shared MSS invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_NIDEN_DISABLE`	7801AC	33	1	A shared MSS non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_CP_DBGEN_DISABLE`	7801AC	34	1	A shared CP invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_CP_NIDEN_DISABLE`	7801AC	35	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_NS_DBGEN_DISABLE`	7801AC	36	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_NS_NIDEN_DISABLE`	7801AC	37	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`APPS_DBGEN_DISABLE`	7801AC	38	1	Blow this bit for a secure solution. This configuration disables the application processor global invasive debug capabilities (JTAG and monitor mode). The `OVERRIDE` registers can override this configuration.
`APPS_NIDEN_DISABLE`	7801AC	39	1	Blow this bit for a secure solution. This configuration disables the application processor global non-invasive debug capabilities (trace and performance monitoring). This configuration can be overridden with the `OVERRIDE` registers.
`SHARED_MISC_DEBUG_DISABLE`	7801AC	40	1	A shared miscellaneous debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`EKU_ENFORCEMENT_EN`	7801B0	30	1	To enable enforcement of the EKU field in the certificate, blow this device.
`OEM_HW_ID[0:15]`	7801B4	[47:32]	0	Represents the OEM hardware ID. Bits 15:0.
`OEM_PRODUCT_ID[0:15]`	7801B4	[63:48]	0	Represents the OEM product ID. Bits 15:0.
`ANTI_ROLLBACK_FEATURE_EN[0]`	7801BC	32	1

Bit 0 - BOOT_ANTI_ROLLBACK_EN

Bit 1 - TZAPPS_ANTI_ROLLBACK_EN

Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN

Bit 3 - MSA_ANTI_ROLLBACK_EN

`ANTI_ROLLBACK_FEATURE_EN[1]`	7801BC	33	1
`ANTI_ROLLBACK_FEATURE_EN[2]`	7801BC	34	1
`ANTI_ROLLBACK_FEATURE_EN[3]`	7801BC	35	1
PK hash
`PK hash 0[383:0]`	7802A0	[383:0]		The OEM-specific root certificate PK hash value.
OEM secure boot
`OEM_SECURE_BOOT1_PK_HASH_IN_FUSE`	780D78	4	1	When this bit is ‘1’, use the value stored in OEM_PK_HASH for the root certificate hash.
`OEM_SECURE_BOOT1_AUTH_EN`	780D78	5	1	To enable secure boot for apps and other peripheral images, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 1.
`OEM_SECURE_BOOT2_PK_HASH_IN_FUSE`	780D78	12	1	For boot configuration 2: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. If this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT2_AUTH_EN`	780D78	13	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot.
`OEM_SECURE_BOOT3_PK_HASH_IN_FUSE`	780D78	20	1	For boot configuration 3: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. When this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT3_AUTH_EN`	780D78	21	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 3.
Sec key derivation key
`Sec Key derivation Key[255:0]`	780D88	[255:0]		This 256‑bit value is used as the secondary key derivation input, which is used to generate the secondary key for the crypto engine. When running in an insecure mode (no secure boot or Debug enabled), the SKDK is fed into the key derivation function to generate a unique non‑secure secondary key for use by the crypto engine. When running in a secure mode (secure boot and debug disabled), the SKDK is fed directly to the crypto engine as the secondary key. After the SKDK value has been correctly programmed, the SKDK Read Disable must be blown to permanently protect the SKDK value. The software reads the SKDK value from the QFPROM before this correction is made. The SBL fuse blow API can automatically generate a random number for use as the SKDK, ensuring that the SKDK value is never available outside of the device.

Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
Read permissions
Secondary Key derivation Key Read disable	780190	31	1	After provisioning the SKDK, blow this bit to secure the secondary key from being read back. A secure path hardware exists from SKDK to the crypto engine.
Write permissions
Read permissions write disable	780198	5	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enables write disable	780198	7	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM configuration write disable	780198	8	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Public key hash 0 write disable	780198	24	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM secure boot write disable	780198	30	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Secondary key derivation key write disable	780198	31	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enable
OEM secure boot FEC enable	7801A0	30	1	To enable FEC for OEM secure boot region, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
Secondary key derivation key FEC enable	7801A0	31	1	To enable FEC for the secondary KDF key, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
OEM Config
`WDOG_EN`	7801A8	14	1	Prevents the `WDOG_DISABLE` GPIO from disabling WDOG, freeing up the GPIO and preventing potential abuse by an attacker.
`SHARED_QSEE_SPIDEN_DISABLE`	7801A8	30	1	A shared Qualcomm TEE secure invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_QSEE_SPNIDEN_DISABLE`	7801A8	31	1	A shared Qualcomm TEE secure non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_DBGEN_DISABLE`	7801AC	32	1	A shared MSS invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_MSS_NIDEN_DISABLE`	7801AC	33	1	A shared MSS non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_CP_DBGEN_DISABLE`	7801AC	34	1	A shared CP invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_CP_NIDEN_DISABLE`	7801AC	35	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SHARED_NS_DBGEN_DISABLE`	7801AC	36	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`SHARED_NS_NIDEN_DISABLE`	7801AC	37	1	A shared CP non-invasive debug disable bucket. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`APPS_DBGEN_DISABLE`	7801AC	38	1	Blow this bit for a secure solution. This configuration disables the application processor global invasive debug capabilities (JTAG and monitor mode). The `OVERRIDE` registers can override this configuration.
`APPS_NIDEN_DISABLE`	7801AC	39	1	Blow this bit for a secure solution. This configuration disables the application processor global non-invasive debug capabilities (trace and performance monitoring). This configuration can be overridden with the `OVERRIDE` registers.
`SHARED_MISC_DEBUG_DISABLE`	7801AC	40	1	A shared miscellaneous debug disable bucket. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`EKU_ENFORCEMENT_EN`	7801B0	30	1	To enable enforcement of the EKU field in the certificate, blow this device.
`OEM_HW_ID[0:15]`	7801B4	[47:32]	0	Represents the OEM hardware ID. Bits 15:0.
`OEM_PRODUCT_ID[0:15]`	7801B4	[63:48]	0	Represents the OEM product ID. Bits 15:0.
`ANTI_ROLLBACK_FEATURE_EN[0]`	7801BC	32	1

Bit 0 - BOOT_ANTI_ROLLBACK_EN

Bit 1 - TZAPPS_ANTI_ROLLBACK_EN

Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN

Bit 3 - MSA_ANTI_ROLLBACK_EN

`ANTI_ROLLBACK_FEATURE_EN[1]`	7801BC	33	1
`ANTI_ROLLBACK_FEATURE_EN[2]`	7801BC	34	1
`ANTI_ROLLBACK_FEATURE_EN[3]`	7801BC	35	1
PK hash
`PK hash 0[383:0]`	7802A0	[383:0]		The OEM-specific root certificate PK hash value.
OEM secure boot
`OEM_SECURE_BOOT1_PK_HASH_IN_FUSE`	780DA8	4	1	When this bit is ‘1’, use the value stored in OEM_PK_HASH for the root certificate hash.
`OEM_SECURE_BOOT1_AUTH_EN`	780DA8	5	1	To enable secure boot for apps and other peripheral images, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 1.
`OEM_SECURE_BOOT2_PK_HASH_IN_FUSE`	780DA8	12	1	For boot configuration 2: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. If this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT2_AUTH_EN`	780DA8	13	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot.
`OEM_SECURE_BOOT3_PK_HASH_IN_FUSE`	780DA8	20	1	For boot configuration 3: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. When this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT3_AUTH_EN`	780DA8	21	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 3.
Sec key derivation key
`Sec Key derivation Key[255:0]`	780DB8	[255:0]		This 256‑bit value is used as the secondary key derivation input, which is used to generate the secondary key for the crypto engine. When running in an insecure mode (no secure boot or Debug enabled), the SKDK is fed into the key derivation function to generate a unique non‑secure secondary key for use by the crypto engine. When running in a secure mode (secure boot and debug disabled), the SKDK is fed directly to the crypto engine as the secondary key. After the SKDK value has been correctly programmed, the SKDK Read Disable must be blown to permanently protect the SKDK value. The software reads the SKDK value from the QFPROM before this correction is made. The SBL fuse blow API can automatically generate a random number for use as the SKDK, ensuring that the SKDK value is never available outside of the device.

Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
Read permissions
Secondary Key derivation Key Read disable	780150	22	1	After provisioning the SKDK, blow this bit to secure the secondary key from being read back. A secure path hardware exists from SKDK to the crypto engine.
Write permissions
Read permissions write disable	780158	3	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enables write disable	780158	5	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM configuration write disable	780158	10	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Public key hash 0 write disable	780158	12	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
OEM secure boot write disable	780158	20	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
Secondary key derivation key write disable	7801B0	22	1	Blow this bit after the region has been provisioned to disable further QFPROM changes to this region.
FEC enable
OEM secure boot FEC enable	780160	20	1	To enable FEC for OEM secure boot region, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
Secondary key derivation key FEC enable	780160	22	1	To enable FEC for the secondary KDF key, blow this bit. Ensure that the complete region is provisioned before FEC is enabled.
OEM Config
`WDOG_EN`	780188	14	1	Prevents the `WDOG_DISABLE` GPIO from disabling WDOG, freeing up the GPIO and preventing potential abuse by an attacker.
`APPS_APB_DFD_DISABLE`	780188	30	1	When blown will disable Qualcomm® Kryo™ B Scandump using APB bus. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`DCC_DEBUG_DISABLE`	780188	31	1	When blown will be used to disable DCC IP in hardware. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`DEBUG_BUS_DISABLE`	78018C	32	1	When blown will be used to disable debug bus from appearing on GPIOs. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`AOSS_AOP_DFD_DISABLE`	78018C	33	1	When blown will disable the scan dump of RPMh. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`EUD_DISABLE`	78018C	34	1	When blown will disable EUD. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`DAP_DEVICEEN_DISABLE`	78018C	35	1	When blown will disable the external debugger access to APB-AP port of QDSS DAP. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`APPS_DBGEN_DISABLE`	78018C	36	1	When blown will disable the non-secure invasive debug facilities of APPS (including the APPS processor) subsystem. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`DAP_DBGEN_DISABLE`	78018C	37	1	When blown will block the NS=1 transactions from both AXI-AP port of DAP, and ETR, of QDSS subsystem. It also prevents the STM block of QDSS to generate any back pressure on the bus it receives the event traces. A corresponding Qualcomm fuse can override this OEM‑controlled fuse.
`LPASS_TURING_DBGEN_DISABLE`	780188	38	1	When blown will disable the invasive debug facilities of LPASS as well as Turing. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`WCSS_DBGEN_DISABLE`	78018C	39	1	When blown will disable the non-secure invasive debug facilities of WCSS subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`AOSS_AOP_DBGEN_DISABLE`	78018C	40	1	When blown will disable the non-secure invasive debug facilities of AOSS AOP. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`CAM_ICP_DBGEN_DISABLE`	78018C	41	1	When blown will disable the non-secure invasive debug facilities of camera A5. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SSC_DBGEN_DISABLE`	78018C	42	1	When blown will disable the non-secure invasive debug facilities of Snapdragon sensor core subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`VENUS_0_DBGEN_DISABLE`	78018C	44	1	When blown will disable the non-secure invasive debug facilities of ARM9 processor in spectra subsytem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`A5x_ISDB_DBGEN_DISABLE`	78018C	45	1	When blown will disable the non-secure invaisive debug facility of ISDB block of A5X subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`MSS_DBGEN_DISABLE`	78018C	46	1	When blown will disable the modem-secure invasive debug facilities of Modem subsystem (including Q6 processor). It also blocks the MSA = 1 transactions from AXI-AP port of QDSS DAP. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`APPS_NIDEN_DISABLE`	78018C	47	1	When blown will disable the non-secure non-invasive debug facilities of APPS (including APPS processor) subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`DAP_NIDEN_DISABLE`	78018C	48	1	When blown will instruct QDSS STM to drop the non-secure event traces. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`LPASS_TURING_NIDEN_DISABLE`	78018C	49	1	When blown will disable the non-secure non-invasive debug facilities of LPASS as well as Turing. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`WCSS_NIDEN_DISABLE`	78018C	50	1	When blown will disable the non-secure non-invasive debug facilities of WCSS subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`AOSS_AOP_NIDEN_DISABLE`	78018C	51	1	When blown will disable the non-secure non-invasive debug facilities of AOSS AOP. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`CAM_ICP_NIDEN_DISABLE`	78018C	52	1	When blown will disable the non-secure non-invasive debug facilities of Camera A5. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`SSC_NIDEN_DISABLE`	78018C	53	1	When blown will disable the non-secure non-invasive debug facilities of Snapdragon sensor core (including Q6 processor) subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`MSS_NIDEN_DISABLE`	78018C	54	1	When blown will disable the modem secure non-invasive debug facilities of MSS (including Q6 processor) subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`APPS_SPNIDEN_DISABLE`	78018C	55	1	When blown will disable the secure non-invasive debug facilities of APPS (including APPS processor) subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`DAP_SPNIDEN_DISABLE`	78018C	56	1	When blown will instruct QDSS STM to drop the secure event traces. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`APPS_SPIDEN_DISABLE`	78018C	60	1	When blown will disable the secure invasive debug facilities of APPS (including APPS processor) subsystem. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`DAP_SPIDEN_DISABLE`	78018C	61	1	When blown will block the NS = 0 transactions from both AXI-AP port of DAP, and ETR, of QDSS subsystem. It also prevents the STM block of QDSS to generate any backpressure on the bus it receives the event traces. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`LLCC_DSRW_DISABLE`	78018C	63	1	When blown will disable the secure invasive debug facilities of LLCC’s DSRW. A corresponding Qualcomm fuse can override this OEM-controlled fuse.
`EKU_ENFORCEMENT_EN`	780190	30	0	To enable enforcement of the EKU field in the certificate, blow this device.
`OEM_HW_ID[0:15]`	780194	[47:32]	0	Represents the OEM hardware ID. Bits 15:0.
`OEM_PRODUCT_ID[0:15]`	780194	[63:48]	0	Represents the OEM product ID. Bits 15:0.
`ANTI_ROLLBACK_FEATURE_EN[0]`	78019C	32	1

Bit 0 - BOOT_ANTI_ROLLBACK_EN

Bit 1 - TZAPPS_ANTI_ROLLBACK_EN

Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN

Bit 3 - MSA_ANTI_ROLLBACK_EN

`ANTI_ROLLBACK_FEATURE_EN[1]`	78019C	33	1
`ANTI_ROLLBACK_FEATURE_EN[2]`	78019C	34	1
`ANTI_ROLLBACK_FEATURE_EN[3]`	78019C	35	1
PK hash
`PK hash 0[383:0]`	7801C8	[383:0]		The OEM-specific root certificate PK hash value.
OEM secure boot
`OEM_SECURE_BOOT1_PK_HASH_IN_FUSE`	780360	4	1	When this bit is ‘1’, use the value stored in OEM_PK_HASH for the root certificate hash.
`OEM_SECURE_BOOT1_AUTH_EN`	780360	5	1	To enable secure boot for apps and other peripheral images, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 1.
`OEM_SECURE_BOOT2_PK_HASH_IN_FUSE`	780360	12	1	For boot configuration 2: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. If this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT2_AUTH_EN`	780360	13	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot.
`OEM_SECURE_BOOT3_PK_HASH_IN_FUSE`	780360	20	1	For boot configuration 3: If this bit is ‘0’, use the internal ROM hash index and `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the root certificate hash. When this bit is ‘1’, use the value stored in `OEM_PK_HASH` for the root certificate hash.
`OEM_SECURE_BOOT3_AUTH_EN`	780360	21	1	To enable the secure boot, blow this bit. When this bit is ‘1’, it enables authentication for any code that references secure boot configuration 3.
Sec key derivation key
`Sec Key derivation Key[255:0]`	780398	[255:0]		This 256‑bit value is used as the secondary key derivation input, which is used to generate the secondary key for the crypto engine. When running in an insecure mode (no secure boot or Debug enabled), the SKDK is fed into the key derivation function to generate a unique non‑secure secondary key for use by the crypto engine. When running in a secure mode (secure boot and debug disabled), the SKDK is fed directly to the crypto engine as the secondary key. After the SKDK value has been correctly programmed, the SKDK Read Disable must be blown to permanently protect the SKDK value. The software reads the SKDK value from the QFPROM before this correction is made. The SBL fuse blow API can automatically generate a random number for use as the SKDK, ensuring that the SKDK value is never available outside of the device.

Fuse region	Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
READ_PERMISSIONS	SECONDARY_KEY_DERIVATION_KEY_READ_DISABLE	0x01b401a0	23	1	Recommendation is to provide —fuse-secondary-key-derivation-key-read-disable. Blow this bit after the SKDK has been provisioned to secure the secondary key from being read back. A secure path hardware exists from SKDK to the crypto engine.
WRITE_PERMISSIONS	READ_PERMISSIONS_WRITE_DISABLE	0x01b401a8	6	1	Recommendation is to provide —fuse-read-permissions-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	WRITE_PERMISSIONS_WRITE_DISABLE	0x01b401a8	7	1	Recommendation is to provide —fuse-write-permissions-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	FEC_ENABLES_WRITE_DISABLE	0x01b401a8	8	1	Recommendation is to provide —fuse-fec-enables-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	OEM_CONFIGURATION_WRITE_DISABLE	0x01b401a8	9	1	Recommendation is to provide —fuse-oem-configuration-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	PUBLIC_KEY_HASH_0_WRITE_DISABLE	0x01b401a8	15	1	Recommendation is to provide —fuse-public-key-hash-0-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SECURE_BOOT_WRITE_DISABLE	0x01b401a8	22	1	Recommendation is to provide —fuse-oem-secure-boot-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned. Once blown no further changes possible to QFPROM fuses via sec.elf.
WRITE_PERMISSIONS	SECONDARY_KEY_DERIVATION_KEY_WRITE_DISABLE	0x01b401a8	23	1	Recommendation is to provide —fuse-secondary-key-derivation-key-write-disable. Disables further QFPROM changes to the this region. Blow this bit after the region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_27_WRITE_DISABLE	0x01b401a8	27		Allows QFPROM changes to this region, if Fuse Blow Value = 0. Disables further QFPROM changes to this region, if Fuse Blow Value = 1. Blow this bit after this region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_28_WRITE_DISABLE	0x01b401a8	28		Allows QFPROM changes to this region, if Fuse Blow Value = 0. Disables further QFPROM changes to this region, if Fuse Blow Value = 1. Blow this bit after this region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_29_WRITE_DISABLE	0x01b401a8	29		Allows QFPROM changes to this region, if Fuse Blow Value = 0. Disables further QFPROM changes to this region, if Fuse Blow Value = 1. Blow this bit after this region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_30_WRITE_DISABLE	0x01b401a8	30		Allows QFPROM changes to this region, if Fuse Blow Value = 0. Disables further QFPROM changes to this region, if Fuse Blow Value = 1. Blow this bit after this region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_31_WRITE_DISABLE	0x01b401a8	31		Allows QFPROM changes to this region, if Fuse Blow Value = 0. Disables further QFPROM changes to this region, if Fuse Blow Value = 1. Blow this bit after this region has been completely provisioned.
FEC_ENABLES	OEM_IMAGE_ENCRYPTION_KEY_FEC_ENABLE	0x01b401b0	21	0	Recommendation is to not provide —fuse-oem-image-encryption-key-fec-enable. This fuse is used to enable the Forward Error Correction for this region (if applicable). Ensure that complete region is provisioned before FEC is enabled.
FEC_ENABLES	OEM_SECURE_BOOT_FEC_ENABLE	0x01b401b0	22	1	Recommendation is to provide —fuse-oem-secure-boot-fec-enable. This fuse is used to enable the Forward Error Correction for this region (if applicable). Ensure that complete region is provisioned before FEC is enabled.
FEC_ENABLES	SECONDARY_KEY_DERIVATION_KEY_FEC_ENABLE	0x01b401b0	23	1	Recommendation is to provide —fuse-secondary-key-derivation-key-fec-enable. This fuse is used to enable the Forward Error Correction for this region (if applicable). Ensure that complete region is provisioned before FEC is enabled.
FEC_ENABLES	IMAGE_ENCRYPTION_KEY_1_FEC_ENABLE	0x01b401b0	25	0	Recommendation is to not provide —fuse-image-encryption-key-1-fec-enable. This fuse is used to enable the Forward Error Correction for this region (if applicable). Ensure that complete region is provisioned before FEC is enabled.
OEM_CONFIG	E_DLOAD_DISABLE	0x01b401b8	0		SW only use for Boot. Disable the removable SD and then USB downloader in Apps PBL error handler, as well as the method to force download during code boot via magic cookies in IMEM.
OEM_CONFIG	ENUM_TIMEOUT	0x01b401b8	1		SW only use for Boot. BOOT ROM must support USB enumeration timeout. Timeout applies to both enumeration for FLCB (fast low current boot) and USB download mode. If USB is not enumerated within time (90 seconds), quit USB enumeration If USB suspend or disconnected after enumeration, start timer again.
OEM_CONFIG	FORCE_DLOAD_DISABLE	0x01b401b8	2		SW only use for Boot. To disable method to force boot from USB via GPIO or magic number in RAM.
OEM_CONFIG	FORCE_USB_BOOT_DISABLE	0x01b401b8	3		SW only use for Boot. To disable method to force boot from USB via GPIO or magic number in RAM.
OEM_CONFIG	SDCC_ADMA_DISABLE	0x01b401b8	4		SW only use for Boot ; To disable the ADMA mode of SDCC.
OEM_CONFIG	FAST_BOOT	0x01b401b8	[9:5]		These fuses are used by boot code to specify which device has priority to be booted from. 0x0: Boot_option_0 “eMMC -> SD -> USB” 0x1: Boot_option_1 “SD -> eMMC -> USB” 0x2: Boot_option_2 “USB boot only” 0x3: Boot_option_3 “NAND -> USB” 0x4: Boot_option_4 “eMMC -> SD -> USB”.
OEM_CONFIG	SW_FUSE_PROG_DISABLE	0x01b401b8	12		This fuse disables the ability to write fuses through the software interface.
OEM_CONFIG	PBL_FDL_TIMEOUT_RESET_FEATURE_ENABLE	0x01b401b8	13		Fuse bit to reset device if PBL enters into EDL mode unintentionally.
OEM_CONFIG	WDOG_EN	0x01b401b8	14	1	Recommendation is to provide —fuse-wdog-en. Combined with GPIO Wdog disable (connects to MPM). Prevents the Watch Dog from being disabled by the GPIO.
OEM_CONFIG	PBL_LOG_DISABLE	0x01b401b8	15		SW only use for Boot. Control logging mechanism in Boot ROM (If blown, Logging is disabled & mandated for external parts).
OEM_CONFIG	PBL_USB_TYPE_C_DISABLE	0x01b401b8	16		0: QMP PHY receives CC_OUT (0 – SS Lane1 or 1 – SS Lane2) 1: QMP PHY receives 0 due to PORT SELECT MUX’s default value 0 – selects SS Lane1.
OEM_CONFIG	ROOT_CERT_TOTAL_NUM	0x01b401b8	[18:17]		Defines the number of additional root certificates used to sign images containing multiple root certificates (MRC). For example, specify a value of 0x1 if images are signed with 2 root certificates and specify a value of 0x3 if images are signed with 4 root certificates. Allowed values are 0x1, 0x2, and 0x3. Do not blow if images are signed with a single root certificate.
OEM_CONFIG	IMAGE_ENCRYPTION_ENABLE	0x01b401b8	19		This bit when blown, is used to indicate that the QC and OEM Encryption key regions will be used to store the image encryption root keys. When this bit is unblown, these regions will not be used.Note that this bit only ‘enables’ the image encryption feature, and is NOT an encryption enforcement bit. With image encryption enabled, the chip can boot with either encrypted or plaintext images (the image has meta-data to indicate if the image is encrypted or not).
OEM_CONFIG	SW_ROT_USE_SERIAL_NUM	0x01b401b8	21	0	Recommendation is to not provide —fuse-sw-rot-use-serial-num. If this bit is ‘1’ then the unique device serial number is required in the authentication of code for boot configuration.
OEM_CONFIG	USB_SS_DISABLE	0x01b401b8	22		Used to disable USB SS enumeration during Boot.
OEM_CONFIG	DEBUG_DISABLE_IN_ROM	0x01b401b8	25		This fuse is used to disable X509 OU Field Parsing. For now only disabling of Crash dump OU Field is done.
OEM_CONFIG	DEBUG_POLICY_DISABLE	0x01b401b8	28	0	Recommendation is to not provide —fuse-debug-policy-disable. Debug Policy is bypassed when this bit is 1. Debug Policy provides a means to re-enable debug capabilities under OEM-specified selectable conditions.
OEM_CONFIG	ALL_DEBUG_DISABLE	0x01b401b8	29	0	Recommendation is to not provide —fuse-all-debug-disable. This fuse permanently disables all debug of the chip. This should only be blown once the OEM is done with their development and testing. No RMAs are possible after this fuse is blown.
OEM_CONFIG	SHARED_QSEE_SPIDEN_DISABLE	0x01b401b8	30	1	Recommendation is to provide —fuse-shared-qsee-spiden-disable. Shared QSEE Secure Invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_QSEE_SPNIDEN_DISABLE	0x01b401b8	31	1	Recommendation is to provide —fuse-shared-qsee-spniden-disable. Shared QSEE Secure Non-invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_MSS_DBGEN_DISABLE	0x01b401b8	32	1	Recommendation is to provide —fuse-shared-mss-dbgen-disable. Shared MSS Invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_MSS_NIDEN_DISABLE	0x01b401b8	33	1	Recommendation is to provide —fuse-shared-mss-niden-disable. Shared MSS Non-invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_CP_DBGEN_DISABLE	0x01b401b8	34	1	Recommendation is to provide —fuse-shared-cp-dbgen-disable. Shared CP Invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_CP_NIDEN_DISABLE	0x01b401b8	35	1	Recommendation is to provide —fuse-shared-cp-niden-disable. Shared CP Non-invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_NS_DBGEN_DISABLE	0x01b401b8	36	1	Recommendation is to provide —fuse-shared-ns-dbgen-disable. Shared CP Invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_NS_NIDEN_DISABLE	0x01b401b8	37	1	Recommendation is to provide —fuse-shared-ns-niden-disable. Shared CP Non-invasive Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	APPS_DBGEN_DISABLE	0x01b401b8	38	1	Recommendation is to provide —fuse-apps-dbgen-disable. When blown will disable the non-secure invasive debug facilities of APPS (including APPS processor) subsystem. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	APPS_NIDEN_DISABLE	0x01b401b8	39	1	Recommendation is to provide —fuse-apps-niden-disable. When blown will disable the non-secure non-invasive debug facilities of APPS (including APPS processor) subsystem. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_MISC_DEBUG_DISABLE	0x01b401b8	40	1	Recommendation is to provide —fuse-shared-misc-debug-disable. Shared Misc Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	SHARED_MISC1_DEBUG_DISABLE	0x01b401b8	41	0	Recommendation is to not provide —fuse-shared-misc1-debug-disable. Shared Misc1 Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse. Assigned to EUD disable in Nicobar.
OEM_CONFIG	SHARED_MISC2_DEBUG_DISABLE	0x01b401b8	42	0	Recommendation is to not provide —fuse-shared-misc2-debug-disable. Shared Misc2 Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	MCU_NIDEN_DISABLE	0x01b401b8	43	1	Recommendation is to provide —fuse-mcu-niden-disable. when blown MCU niden Debug Disable. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	EPSS_DBGEN_DISABLE	0x01b401b8	44	1	Recommendation is to provide —fuse-epss-dbgen-disable. When blown will disable the non-secure invasive debug facilities of EPSS (including EPSS processor) subsystem. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	EPSS_NIDEN_DISABLE	0x01b401b8	45	1	Recommendation is to provide —fuse-epss-niden-disable. When blown will disable the non-secure non-invasive debug facilities of EPSS (including EPSS processor) subsystem. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	DDR_APD_DFD_DISABLE	0x01b401b8	48	1	Recommendation is to provide —fuse-ddr-apd-dfd-disable. when blown DDR APD DFD Debug Disable. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	MCU_DBGEN_DISABLE	0x01b401b8	50	1	Recommendation is to provide —fuse-mcu-dbgen-disable. when blown MCU Dbgen Debug Disable bucket. This OEM controlled fuse can be overridden by the corresponding QC fuse.
OEM_CONFIG	TZ_SW_CRYPTO_FIPS_ENABLE	0x01b401c0	4		Enable FIPS mode for TZ software crypto. Disable by default and blow to enable.
OEM_CONFIG	SPARE_REG27_SECURE	0x01b401c0	10		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SPARE_REG28_SECURE	0x01b401c0	11		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SPARE_REG29_SECURE	0x01b401c0	12		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SPARE_REG30_SECURE	0x01b401c0	13		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SPARE_REG31_SECURE	0x01b401c0	14		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled. * This region is reserved for DOLBY and will be blown by QC.
OEM_CONFIG	QCWES_LICENSED_FEATURE_INDICATOR	0x01b401c0	[23:15]		Used for fuse config based Qc-WES license sync.
OEM_CONFIG	EKU_ENFORCEMENT_EN	0x01b401c0	30	1	Recommendation is to provide —fuse-eku-enforcement-en. When this fuse is blown will enable enforcement of the EKU field in the certificate.
OEM_CONFIG	DISABLE_RSA	0x01b401c0	31		When this bit is 0 and signed image type is SHA384 + RSA/ECC is 0 => RSA OPERATION When this bit is 0 and signed image type is SHA384 + RSA/ECC IS 1=> ECC OPERATION USING PKA IP When this bit is 1 and signed image type is SHA384 + RSA/ECC is 0 => Error When this bit is 1 and signed image type is SHA384 + RSA/ECC IS 1=> ECC OPERATION USING PKA IP.
OEM_CONFIG	OEM_HW_ID	0x01b401c0	[47:32]	OEM_VALUE	Recommended value is —fuse-oem-hw-id=0x0. The OEM hardware ID. Bits 15:0. This is a unique 16-bit value assigned by Qualcomm to every OEM.
OEM_CONFIG	OEM_PRODUCT_ID	0x01b401c0	[63:48]		The OEM product ID. Bits 15:0.
OEM_CONFIG	PERIPH_PID	0x01b401c8	[15:0]		Bits 15:0 of the PID.
OEM_CONFIG	PERIPH_VID	0x01b401c8	[31:16]		Bits 15:0 of the VID.
OEM_CONFIG	ANTI_ROLLBACK_FEATURE_EN	0x01b401c8	[39:32]	0xf	Recommended value is —fuse-anti-rollback-feature-en=0xf. Bit 0 - BOOT_ANTI_ROLLBACK_EN Bit 1 - TZAPPS_ANTI_ROLLBACK_EN Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN Bit 3 - MSA_ANTI_ROLLBACK_EN Bit 4 - Reserved Bit 5 - Reserved Bit 6 - Reserved Bit 7 - Reserved.
OEM_CONFIG	QCWES_LICENSED_FEATURE_INDICATOR	0x01b401c8	[63:41]		Used for fuse config based Qc-WES license sync.
PK_HASH_0	PK_HASH_0	0x01b40228	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
PK_HASH_0	PK_HASH_0	0x01b40230	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
PK_HASH_0	PK_HASH_0	0x01b40238	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
PK_HASH_0	PK_HASH_0	0x01b40240	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
PK_HASH_0	PK_HASH_0	0x01b40248	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
PK_HASH_0	PK_HASH_0	0x01b40250	[63:0]	OEM_VALUE	Hash of OEM Root cert(s).
OEM_IMAGE_ENCRYPTION_KEY	OEM_IMAGE_ENCRYPTION_KEY	0x01b40440	[55:0]		This is the 128-bit encryption key used by UIE to decrypt images when UIE Key Select is set to 0.
OEM_IMAGE_ENCRYPTION_KEY	OEM_IMAGE_ENCRYPTION_KEY	0x01b40448	[55:0]
OEM_IMAGE_ENCRYPTION_KEY	OEM_IMAGE_ENCRYPTION_KEY	0x01b40450	[15:0]
OEM_SECURE_BOOT	OEM_SECURE_BOOT1_PK_HASH_IN_FUSE	0x01b40458	4	1	Recommendation is to provide —fuse-oem-secure-boot1-pk-hash-in-fuse. For boot configuration : - If this bit is ‘0’ use the shared OEM root in ROM for the root certificate hash. When using this root all signed images must be bound to OEM ID, and the same OEM ID must be blown in fuses. - If this bit is ‘1’ use the value stored in MRC_HASH for the root certificate hash.
OEM_SECURE_BOOT	OEM_SECURE_BOOT1_AUTH_EN	0x01b40458	5	1	Recommendation is to provide —fuse-oem-secure-boot1-auth-en. Blow this bit to enable secure boot for apps and other peripheral images. When this bit is ‘1’; enables authentication for any code that references secure boot configuration.
OEM_SECURE_BOOT	OEM_SECURE_BOOT1_USE_SERIAL_NUM	0x01b40458	6	0	Recommendation is to not provide —fuse-oem-secure-boot1-use-serial-num. If this bit is ‘1’ then the unique device serial number is required in the authentication of code for boot configuration.
OEM_SECURE_BOOT	OEM_SECURE_BOOT2_PK_HASH_IN_FUSE	0x01b40458	12	1	Recommendation is to provide —fuse-oem-secure-boot2-pk-hash-in-fuse. Boot segment for MBA image.
OEM_SECURE_BOOT	OEM_SECURE_BOOT2_AUTH_EN	0x01b40458	13	1	Recommendation is to provide —fuse-oem-secure-boot2-auth-en. Boot segment for MBA image.
OEM_SECURE_BOOT	OEM_SECURE_BOOT2_USE_SERIAL_NUM	0x01b40458	14	0	Recommendation is to not provide —fuse-oem-secure-boot2-use-serial-num. Boot segment for MBA image.
OEM_SECURE_BOOT	OEM_SECURE_BOOT3_PK_HASH_IN_FUSE	0x01b40458	20	1	Recommendation is to provide —fuse-oem-secure-boot3-pk-hash-in-fuse. Boot segment for Modem image.
OEM_SECURE_BOOT	OEM_SECURE_BOOT3_AUTH_EN	0x01b40458	21	1	Recommendation is to provide —fuse-oem-secure-boot3-auth-en. Boot segment for Modem image.
OEM_SECURE_BOOT	OEM_SECURE_BOOT3_USE_SERIAL_NUM	0x01b40458	22	0	Recommendation is to not provide —fuse-oem-secure-boot3-use-serial-num. Boot segment for Modem image.
SEC_KEY_DERIVATION_KEY	SEC_KEY_DERIVATION_KEY	0x01b40468	[55:0]		This 256-bit value is used as the secondary key derivation input; used to generate the secondary key used by the crypto engine. When running insecure (no secure boot; or Debug enabled) then SKDK is fed into the key derivation function to generate a unique “non-secure” secondary key for use by the crypto engine. When running secure (secure boot; and debug disabled); then SKDK is fed directly to the crypto engine as the secondary key.After the SKDK value has been correctly programmed; the SKDK Read Disable should be blown to permanently protect the SKDK value. Prior to this; the SKDK value can be read from the QFPROM by software. The TZ fuse blow API is capable of automatically generating a random number for use as the SKDK so that the SKDK value is never available outside of the device.
SEC_KEY_DERIVATION_KEY	SEC_KEY_DERIVATION_KEY	0x01b40470	[55:0]
SEC_KEY_DERIVATION_KEY	SEC_KEY_DERIVATION_KEY	0x01b40478	[55:0]
SEC_KEY_DERIVATION_KEY	SEC_KEY_DERIVATION_KEY	0x01b40480	[55:0]
SEC_KEY_DERIVATION_KEY	SEC_KEY_DERIVATION_KEY	0x01b40488	[31:0]
IMAGE_ENCRYPTION_KEY_1	IMAGE_ENCRYPTION_KEY_1	0x01b40650	[55:0]		This is the 128-bit encryption key used by UIE to decrypt images when UIE Key Select is set to 1.
IMAGE_ENCRYPTION_KEY_1	IMAGE_ENCRYPTION_KEY_1	0x01b40658	[55:0]
IMAGE_ENCRYPTION_KEY_1	IMAGE_ENCRYPTION_KEY_1	0x01b40660	[15:0]

Fuse region	Fuse name	Start address (in hexadecimal)	Bit number	Description
MRC	OEM_ROOT_CERT_ACTIVATION_LIST_0	0x221c0080	17	Activate root0 cert.
MRC	OEM_ROOT_CERT_ACTIVATION_LIST_1	0x221c0080	18	Activate root1 cert.
MRC	OEM_ROOT_CERT_ACTIVATION_LIST_2	0x221c0080	19	Activate root2 cert.
MRC	OEM_ROOT_CERT_ACTIVATION_LIST_3	0x221c0080	20	Activate root3 cert.
MRC	OEM_ROOT_CERT_REVOCATION_LIST_0	0x221c0080	21	Revoke root0 cert.
MRC	OEM_ROOT_CERT_REVOCATION_LIST_1	0x221c0080	22	Revoke root1 cert.
MRC	OEM_ROOT_CERT_REVOCATION_LIST_2	0x221c0080	23	Revoke root2 cert.
MRC	OEM_ROOT_CERT_REVOCATION_LIST_3	0x221c0080	24	Revoke root3 cert.
OEM_SECURITY_POLICY	DISALLOW_SOC_DEBUG	0x221c0090	0	Recommendation is to not provide —fuse-disallow-soc-debug. DisallowSOCDEBUG ‘1’ - Disallow unlocking of debug interfaces for the entire SoC (i.e. no SoC debug possible permanently). Requires Activate_Security_Policy fuse set to ‘1’ to take effect. Not recommended. No RMA /JTAG access possible. ‘0’ - debugging is available.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_SOC_DEBUG	0x221c0090	1	Recommendation is to provide —fuse-enforce-oem-authz-on-soc-debug. EnforceOemAuthzOnSoCDebug ‘1’ - Enforce OEM authorization of Debug Policy Requests. When set, OEM must counter-sign Qualcomm debug policies and TME must verify both signatures (Qualcomm and OEM). Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Do not enforce OEM counter-signing.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_FUSE_OVERRIDES	0x221c0090	4	Recommendation is to provide —fuse-enforce-oem-authz-on-fuse-overrides. EnforceOemAuthzOnFuseOverrides ‘1’ - Fuse overwrite request requires an OEM signature. Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Fuse overwrite request does not require an OEM signature.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_ROM_PATCH	0x221c0090	5	Recommendation is to provide —fuse-enforce-oem-authz-on-rom-patch. EnforceOemAuthzOnROMPatch ‘1’ - Updates to TME/SoC ROM (RoT) requires OEM signature. Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Updates to TME/SoC ROM (RoT) do not require OEM signature.
OEM_SECURITY_POLICY	ACTIVATE_SECURITY_POLICY	0x221c0090	11	Recommendation is to provide —fuse-activate-security-policy. ActivateSecurityPolicy Set to ‘1’ for OEMSecurityPolicy bits 0,1,4,5 to take effect.
OEM_SECURITY_POLICY	OEM_DEVICE_LCS	0x221c0090	[17:16]	Recommended value is —fuse-oem-device-lcs=0x3. OEM_DEVICE_LCS (OEM Device Life cycle state) 01 => OEM_DEV_LCSID 00,1X => OEM_PROD_LCSID.
OEM_SECURITY_POLICY	AUTH_EN	0x221c0090	33	Recommendation is to provide —fuse-auth-en. Blow this bit to enable secure boot for apps and other peripheral images. When this bit is ‘1’; enables authentication for any code that references secure boot configuration.
OEM_SECURITY_POLICY	PK_HASH_IN_FUSE	0x221c0090	34	Recommendation is to provide —fuse-pk-hash-in-fuse. For boot configuration : - If this bit is ‘0’ use the internal ROM hash index and OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0] for the root certificate hash. - If this bit is ‘1’ use the value stored in OEM_PK_HASH for the root certificate hash.
OEM_SECURITY_POLICY	USE_SERIAL_NUM	0x221c0090	35	Recommendation is to not provide —fuse-use-serial-num. If this bit is ‘1’ then the unique device serial number is required in the authentication of code for boot configuration.
OEM_SECURITY_POLICY	ROM_PK_HASH_IDX	0x221c0090	[39:36]	Recommended value is —fuse-rom-pk-hash-idx=0x0. If PK_HASH_IN_FUSE = ‘0’; this value selects which root certificate hash to use from the ROM table.
WRITE_PERMISSIONS	MRC_WRITE_DISABLE	0x221c0188	3	Recommendation is to not provide —fuse-mrc-write-disable. This bit determines the write permission setting for this region.
WRITE_PERMISSIONS	OEM_SECURITY_POLICY_WRITE_DISABLE	0x221c0188	5	Recommendation is to provide —fuse-oem-security-policy-write-disable. Disables further QFPROM changes to OEM SECURITY POLICY region. Blow this bit after the OEM SECURITY POLICY region has been completely provisioned.
WRITE_PERMISSIONS	WRITE_PERMISSIONS_WRITE_DISABLE	0x221c0188	7	Recommendation is to provide —fuse-write-permissions-write-disable. Disables further QFPROM changes to WRITE PERMISSIONS region. Blow this bit only if no further changes to Write Permissions are needed.
WRITE_PERMISSIONS	READ_PERMISSIONS_WRITE_DISABLE	0x221c0188	8	Recommendation is to provide —fuse-read-permissions-write-disable. Disables further QFPROM changes to READ PERMISSIONS region. Blow this bit after the READ PERMISSIONS region has been completely provisioned.
WRITE_PERMISSIONS	FUSE_REDUNDANCY_ENABLE_WRITE_DISABLE	0x221c0188	9	Recommendation is to provide —fuse-fuse-redundancy-enable-write-disable. Disables further QFPROM changes to FUSE REDUNDANCY ENABLE region. Blow this bit after the FUSE REDUNDANCY ENABLE region has been completely provisioned.
WRITE_PERMISSIONS	DEBUG_DISABLE_WRITE_DISABLE	0x221c0188	10	Recommendation is to provide —fuse-debug-disable-write-disable. Disables further QFPROM changes to DEBUG DISABLE region. Blow this bit after the DEBUG DISABLE region has been completely provisioned.
WRITE_PERMISSIONS	OEM_CONFIG_WRITE_DISABLE	0x221c0188	12	Recommendation is to provide —fuse-oem-config-write-disable. Disables further QFPROM changes to OEM CONFIG region. Blow this bit after the OEM CONFIG region has been completely provisioned.
WRITE_PERMISSIONS	ANTI_ROLLBACK_WRITE_DISABLE	0x221c0188	16	Recommendation is to not provide —fuse-anti-rollback-write-disable. Disables further QFPROM changes to ANTI ROLLBACK region. OEMs may need to leave this unblown for OTA updates to Anti-rollback region.
WRITE_PERMISSIONS	MRC_HASH_WRITE_DISABLE	0x221c0188	24	Recommendation is to provide —fuse-mrc-hash-write-disable. Disables further QFPROM changes to MRC HASH region. Blow this bit after the MRC HASH region has been completely provisioned.
WRITE_PERMISSIONS	OEM_PRODUCT_SEED_WRITE_DISABLE	0x221c0188	25	Recommendation is to provide —fuse-oem-product-seed-write-disable. Disables further QFPROM changes to OEM PRODUCT SEED region. Blow this bit after the OEM PRODUCT SEED region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_0_WRITE_DISABLE	0x221c0188	31	Disables further QFPROM changes to OEM SPARE 0 region. Blow this bit after the OEM SPARE 0 region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_1_WRITE_DISABLE	0x221c0188	32	Disables further QFPROM changes to OEM SPARE 1 region. Blow this bit after the OEM SPARE 1 region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_2_WRITE_DISABLE	0x221c0188	33	Reserved.
WRITE_PERMISSIONS	OEM_SPARE_3_WRITE_DISABLE	0x221c0188	34	Reserved.
READ_PERMISSIONS	OEM_PRODUCT_SEED_READ_DISABLE	0x221c0190	25	Recommendation is to provide —fuse-oem-product-seed-read-disable. Blow this bit after the OEM Product Seed region has been completely provisioned.
FUSE_REDUNDANCY_ENABLE	MRC_HASH_FEC_ENABLE	0x221c0198	24	Recommendation is to provide —fuse-mrc-hash-fec-enable. Blow to enable FEC for MRC Hash region. Ensure that complete region is provisioned before FEC is enabled.
FUSE_REDUNDANCY_ENABLE	OEM_PRODUCT_SEED_FEC_ENABLE	0x221c0198	25	Recommendation is to provide —fuse-oem-product-seed-fec-enable. Blow to enable FEC for OEM Product Seed region. Ensure that complete region is provisioned before FEC is enabled.
DEBUG_DISABLE	SHRM_DBGEN_DISABLE	0x221c01a0	6	Recommendation is to provide —fuse-shrm-dbgen-disable. SHRM Invasive debug disable.
DEBUG_DISABLE	CPUCP_DBGEN_DISABLE	0x221c01a0	8	Recommendation is to provide —fuse-cpucp-dbgen-disable. CPU Content Protection Invasive debug disable.
DEBUG_DISABLE	CPUCP_NIDEN_DISABLE	0x221c01a0	9	Recommendation is to provide —fuse-cpucp-niden-disable. CPU Content Protection Non-Invasive debug disable.
DEBUG_DISABLE	QSEE_DBGEN_DISABLE	0x221c01a0	12	Recommendation is to provide —fuse-qsee-dbgen-disable. QSEE Invasive debug disable.
DEBUG_DISABLE	QSEE_NIDEN_DISABLE	0x221c01a0	13	Recommendation is to provide —fuse-qsee-niden-disable. QSEE Non-Invasive debug disable.
DEBUG_DISABLE	SMMU_PCIE_APB_SDC_DISABLE	0x221c01a0	19	Recommendation is to provide —fuse-smmu-pcie-apb-sdc-disable. Fuse To enable or disable the APB based scan dump for TCU and TBUs.
DEBUG_DISABLE	APPS_DBGEN_DISABLE	0x221c01a0	32	Recommendation is to provide —fuse-apps-dbgen-disable. Apps Invasive debug disable.
DEBUG_DISABLE	APPS_NIDEN_DISABLE	0x221c01a0	33	Recommendation is to provide —fuse-apps-niden-disable. Apps Non-Invasive debug disable.
DEBUG_DISABLE	TITAN_DBGEN_DISABLE	0x221c01a0	38	Recommendation is to provide —fuse-titan-dbgen-disable. Titan Invasive debug disable.
DEBUG_DISABLE	TITAN_NIDEN_DISABLE	0x221c01a0	39	Recommendation is to provide —fuse-titan-niden-disable. Titan Non-Invasive debug disable.
DEBUG_DISABLE	LPASS_DBGEN_DISABLE	0x221c01a0	40	Recommendation is to provide —fuse-lpass-dbgen-disable. LPASS Invasive debug disable.
DEBUG_DISABLE	LPASS_NIDEN_DISABLE	0x221c01a0	41	Recommendation is to provide —fuse-lpass-niden-disable. LPASS Non-Invasive debug disable.
DEBUG_DISABLE	TURING_DBGEN_DISABLE	0x221c01a0	42	Recommendation is to provide —fuse-turing-dbgen-disable. Turing Invasive debug disable.
DEBUG_DISABLE	TURING_NIDEN_DISABLE	0x221c01a0	43	Recommendation is to provide —fuse-turing-niden-disable. Turing Non-Invasive debug disable.
DEBUG_DISABLE	IRIS_DBGEN_DISABLE	0x221c01a0	44	Recommendation is to provide —fuse-iris-dbgen-disable. IRIS Invasive debug disable.
DEBUG_DISABLE	IRIS_NIDEN_DISABLE	0x221c01a0	45	Recommendation is to provide —fuse-iris-niden-disable. IRIS Non-Invasive debug disable.
DEBUG_DISABLE	MDSS_DBGEN_DISABLE	0x221c01a0	46	Recommendation is to provide —fuse-mdss-dbgen-disable. MDSS Invasive debug disable.
DEBUG_DISABLE	MDSS_NIDEN_DISABLE	0x221c01a0	47	Recommendation is to provide —fuse-mdss-niden-disable. MDSS Non-Invasive debug disable.
DEBUG_DISABLE	DDRSS_DBGEN_DISABLE	0x221c01a0	48	Recommendation is to provide —fuse-ddrss-dbgen-disable. DDRSS Invasive debug disable.
DEBUG_DISABLE	DDRSS_NIDEN_DISABLE	0x221c01a0	49	Recommendation is to provide —fuse-ddrss-niden-disable. DDRSS Non-Invasive debug disable.
DEBUG_DISABLE	GPU_DBGEN_DISABLE	0x221c01a0	50	Recommendation is to provide —fuse-gpu-dbgen-disable. GPU Invasive debug disable.
DEBUG_DISABLE	GPU_NIDEN_DISABLE	0x221c01a0	51	Recommendation is to provide —fuse-gpu-niden-disable. GPU Non-Invasive debug disable.
DEBUG_DISABLE	DAP_DBGEN_DISABLE	0x221c01a0	52	Recommendation is to provide —fuse-dap-dbgen-disable. DAP Invasive debug disable.
DEBUG_DISABLE	DAP_NIDEN_DISABLE	0x221c01a0	53	Recommendation is to provide —fuse-dap-niden-disable. DAP Non-Invasive debug disable.
DEBUG_DISABLE	APPS_SCANDUMP_DISABLE	0x221c01a0	54	Recommendation is to provide —fuse-apps-scandump-disable. Apps Scan Dump disable.
DEBUG_DISABLE	DDRSS_SCANDUMP_DISABLE	0x221c01a0	55	Recommendation is to provide —fuse-ddrss-scandump-disable. DDRSS Scan Dump disable.
DEBUG_DISABLE	DEBUGBUS_DISABLE	0x221c01a0	56	Recommendation is to provide —fuse-debugbus-disable. Debug bus disable.
DEBUG_DISABLE	DCC_DISABLE	0x221c01a0	57	Recommendation is to provide —fuse-dcc-disable. DCC disable.
DEBUG_DISABLE	SMMU_SCANDUMP_DISABLE	0x221c01a0	59	Recommendation is to provide —fuse-smmu-scandump-disable. SMMU Scan Dump disable.
OEM_CONFIG	E_DLOAD_DISABLE	0x221c01b8	0	OEM Optional. Disables emergency download via removable SD and/or USB downloader in Apps PBL error handler.
OEM_CONFIG	ENUM_TIMEOUT	0x221c01b8	1	OEM Optional. BOOT ROM must support USB enumeration timeout. Timeout applies to both enumeration for FLCB (fast low current boot) and USB download mode. If USB is not enumerated within time (90 seconds), quit USB enumeration If USB suspend or disconnected after enumeration, start timer again.
OEM_CONFIG	FORCE_DLOAD_DISABLE	0x221c01b8	2	OEM optional. If FORCE_DLOAD_DISABLE is ‘0’; device goes to download mode if an error occurs very early in XBL1. If FORCE_DLOAD_DISABLE is set to ‘1’; device goes into cold boot if an error occurs very early in XBL1.
OEM_CONFIG	FORCE_USB_BOOT_GPIO_DISABLE	0x221c01b8	3	This fuse is used to control booting from FORCE_USB_BOOT_GPIO. It only controls FORCE_USB_GPIO based boot, FDL cookies are not controlled by this fuse. If fuse value = 0 => PBL honors boot from USB if FORCE_USB_BOOT GPIO is flipped. If the GPIO is set to high, PBL will enter USB FEDL path irrespective of FAST_BOOT option selected. If fuse value = 1 => PBL will not enter USB FEDL mode even if FORCE_USB_GPIO is flipped to 1. Boot from FORCE USB GPIO is disabled.
OEM_CONFIG	SDCC_ADMA_DISABLE	0x221c01b8	4	0 is default ADMA mode enabled 1 - ADMA mode disabled and fallback to FIFO mode.
OEM_CONFIG	FAST_BOOT	0x221c01b8	[9:5]	These fuses are used by boot code to specify which device has priority to be booted from. For SC8380XP, the mapping is as follows: 00000: Default (UFS HS G1 -> SD -> eDL (eDL path- USB only)) 00001: SD -> UFS HS G1 -> eDL (eDL path USB only) 00010: SD -> eDL (eDL path- USB only) 00011: USB -> eDL (eDL path- SD then USB) 00100: QSPI -> eDL (eDL path- SD then USB) 00101: SPI -> eDL (eDL path- SD then USB) 00110: UFS HS G1 -> eDL(eDL path- SD then USB) 00111: UFS HS G1 -> SD -> eDL(eDL path- USB only) Others are reserved.
OEM_CONFIG	SPI_CLK_BOOT_FREQ	0x221c01b8	[11:10]	00: ‘85MHz’ (Default) 01: ‘60MHz’ 10: ‘37.5MHz’ 11: ‘Reserved’.
OEM_CONFIG	PBL_FDL_TIMEOUT_RESET_FEATURE_ENABLE	0x221c01b8	13	Fuse bit to reset device if PBL enters into EDL mode unintentionally. Enable/disable Force download timeout in case device goes into force USB download accidentally. If enabled, device will reboot after timeout if in force USB download mode. If disabled, phone stays in force USB download. 0 => Disabled 1 => Enabled.
OEM_CONFIG	WDOG_EN	0x221c01b8	14	Prevents WDOG_DISABLE GPIO from disabling WDOG. Frees up the GPIO and prevents potential for abuse by attacker. This selects whether GPIO_xx can be used to disable the watchdog timer. If enabled, then GPIO_xx, when high, will disable the watchdog. If disabled, then GPIO_xx will not disable the watchdog. The watchdog can still be disabled via software control. 0 => Disabled 1 => Enabled.
OEM_CONFIG	PBL_LOG_DISABLE	0x221c01b8	15	Used for controlling logging mechanism in PBL. ‘1’ To limit the information collected in PBL logs.
OEM_CONFIG	PBL_USB_TYPE_C_DISABLE	0x221c01b8	16	Disables type-C functionality during PBL. PBL communication/enumeration happens over USB0_SS only. USB1_SS cannot be used.
OEM_CONFIG	ROOT_CERT_TOTAL_NUM	0x221c01b8	[18:17]	Defines the total root cert number supported from the certificate (Upto 4 roots).
OEM_CONFIG	QSPI_DMA_DISABLE	0x221c01b8	19	0 => QSPI DMA is enabled 1 => QSPI DMA is disabled.
OEM_CONFIG	USB_SS_DISABLE	0x221c01b8	22	Used to disable USB SS enumeration during Boot.
OEM_CONFIG	USB_PIPO_DISABLE	0x221c01b8	23	If fuse value = 0 => USB Plug in – Plug out feature is enabled in PBL. With this feature, if user disconnects and reconnects USB cable on the device we will be able to re-enumerate and go back to EDL with max 3 retries/plugins If fuse value = 1 => USB Plug in – Plug out feature is disabled.
OEM_CONFIG	SP_DISABLE	0x221c01b8	27	Disable Secure Processor Unit by the SoC. 0: SPU is enabled. 1: SPU is permanently disabled by SoC.
OEM_CONFIG	DEBUG_POLICY_DISABLE	0x221c01b8	28	Recommendation is to not provide —fuse-debug-policy-disable. Debug Policy is bypassed when this bit is 1. Debug Policy provides a means to re-enable debug capabilities under OEM-specified selectable conditions.
OEM_CONFIG	PBL_FDL_TIMEOUT_RESET_TO_VAL	0x221c01b8	[30:29]	This fuse allows OEMs to have configurable timeout values for FDL timeout reset feature. 00: 05 ms (default) 01: 30 ms 10: 60 ms 11: 120 ms.
OEM_CONFIG	EDL_INDICATOR_ENABLE	0x221c01b8	31	Provides EDL indicator.
OEM_CONFIG	SPU_ENABLEMENT_OPTION	0x221c01c0	[2:1]	Recommended value is —fuse-spu-enablement-option=0x0. Enablement options for the Secure Processing Unit: 00: SPU enablement via SPU API. This is the preferred SPU enablement option, which supports the optional ARI Test Mode. 01: SPU enablement via fuses. Not recommended. Will automatically activate ARI (ARI fuses will be blown on every loss of power), ignore ARI Test Mode, and enforce all SPU security policies. Irreversible operation. 1x: RESERVED.
OEM_CONFIG	SP_FIPS_ENABLE	0x221c01c0	3	Enable/Disable FIPS mode for SPU (blow this fuse for SPU to be FIPS 140-3 level 2 certifiable).
OEM_CONFIG	TZ_SW_CRYPTO_FIPS_ENABLE	0x221c01c0	4	Enable/Disable TZ FIPS certifiable mode. Blow this fuse for TZ SW crypto to be FIPS 140-3 certifiable. Set to ‘1’ to enable TZ FIPS certifiable mode If OEM needs to evaluate FIPS (for performance, security etc), do not enable this fuse. Set OEM devcfg oem_is_fips_enabled_for_test = 1. Note: The fuse value and the specific crypto version are required to claim for FIPS validated module. Once this is enabled through fuse, the device will be placed in FIPS mode and cannot be reverted.
OEM_CONFIG	SP_FIPS_OVERRIDE	0x221c01c0	6	Override SP_FIPS_ENABLE fuse. Non-override by default and blow to override the SP_FIPS_ENABLE fuse to disable the FIPS feature in SPU.
OEM_CONFIG	SPU_IAR_ENABLED	0x221c01c0	10	Enable the activation of Insider Attack Resistance (IAR), a feature of Android’s Keymaster strongbox in SPU. Blowing this fuse is a pre-requisite to enabling IAR through a SPU API.
OEM_CONFIG	SP_ARI_TEST_MODE_FEATURE_ENABLE	0x221c01c0	16	SPU ARI Test Mode is a special feature to assist in development, testing and manufacturing of devices that uses SPU and ARI. In ARI Test Mode, SPU places a limit on the number of fuses ARI uses but SPU NVM is fully functional. If the fuse usage limit is reached, SPU NVM will continue to function but replay protection will not be provided. If this feature is enabled, OEMs must turn off Test Mode using a software API, for any shipping device. This fuse enables this feature 0: DISABLE 1: ENABLE.
OEM_CONFIG	SP_ARI_SUSPENSION_FEATURE_ENABLE	0x221c01c0	17	SPU ARI Suspension allows the temporary suspension of ARI, so no further fuses will be consumed beyond the next Power on Reset (PoR). This fuse enables this feature 0: DISABLE 1: ENABLE.
OEM_CONFIG	SP_APP_ROT_TRANSFER_FEATURE_ENABLED	0x221c01c0	18	Determines the state of SPU OEM double signing delegation feature. If activated, an OEM can initiate a double signing delegation request for the SPU with details of a trusted Root of Trust hashes and UUID’s of applications that they would be allowed to sign. 0: DISABLE 1: ENABLE.
OEM_CONFIG	EKU_ENFORCEMENT_EN	0x221c01c0	30	Recommendation is to provide —fuse-eku-enforcement-en. When this fuse is blown will enable enforcement of the EKU field in the certificate. EKU enforcement is one of the requirements to meet Common Criteria Mobile Device Fundamental Protection Profile (MDFPP).
OEM_CONFIG	DISABLE_RSA	0x221c01c0	31	When this bit is 0 and signed image type is RSA => RSA OPERATION When this bit is 0 and signed image type is ECC => ECC OPERATION When this bit is 1 and signed image type is RSA => Error When this bit is 1 and signed image type is ECC => ECC OPERATION.
OEM_CONFIG	OEM_HW_ID	0x221c01c0	[47:32]	The OEM hardware ID. Bits 15:0. This is a unique 16-bit value assigned by Qualcomm to every OEM.
OEM_CONFIG	OEM_PRODUCT_ID	0x221c01c0	[63:48]	The OEM product ID. Bits 15:0.
OEM_CONFIG	PERIPH_PID	0x221c01c8	[15:0]	Bits 15:0 of the PID.
OEM_CONFIG	PERIPH_VID	0x221c01c8	[31:16]	Bits 15:0 of the VID.
OEM_CONFIG	ANTI_ROLLBACK_FEATURE_EN	0x221c01c8	[35:32]	Recommended value is —fuse-anti-rollback-feature-en=0xf. Bit 0 - BOOT_ANTI_ROLLBACK_EN Bit 1 - TZAPPS_ANTI_ROLLBACK_EN Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN Bit 3 - RESERVED FOR FUTURE USE (Blow this bit).
OEM_CONFIG	END_FACTORY_PROVISIONING	0x221c01d0	0	Recommendation is to provide —fuse-end-factory-provisioning. The End_Factory_Provisioning fuse will be blown by the OEM when it is done with factory provisioning of the device.
OEM_CONFIG	DEBUG_UART_3M_BUADRATE	0x221c01d0	1	Fuse to select different Baud Rate. Fuse Blown - UART baud rate = 3Mbps . Fuse Unblown (Default) - UART baud rate = 115.2 Kbps.
MRC_HASH	MRC_HASH	0x221c0740	[55:0]	Hash of Multiple Root Certificates (up to 4 certificates) OEMs should blow these fuses for Secure Boot enablement.
MRC_HASH	MRC_HASH	0x221c0748	[55:0]
MRC_HASH	MRC_HASH	0x221c0750	[55:0]
MRC_HASH	MRC_HASH	0x221c0758	[55:0]
MRC_HASH	MRC_HASH	0x221c0760	[55:0]
MRC_HASH	MRC_HASH	0x221c0768	[55:0]
MRC_HASH	MRC_HASH	0x221c0770	[55:0]
MRC_HASH	MRC_HASH	0x221c0778	[55:0]
MRC_HASH	MRC_HASH	0x221c0780	[55:0]
MRC_HASH	MRC_HASH	0x221c0788	[7:0]
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c0790	[55:0]	OEM Product Seed is generated by the OEM and written to SoC fuses. The seed value is used by the OEM to derive device provisioning keys that are specific to the OEM product. It is recommended that this value needs to be kept secret, “OEM PRODUCT SEED Write Disable” and “OEM Product Seed Read Disable” fuses should be blown so that this will only be readable by HW for any key derivation operations.
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c0798	[55:0]
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c07a0	[15:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16e8	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16f0	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16f8	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1700	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1708	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1710	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1718	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1720	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1728	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1730	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1738	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1740	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1748	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1750	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1758	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1760	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1768	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1770	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1778	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1780	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1788	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1790	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1798	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17a0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17a8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17b0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17b8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17c0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17c8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17d0	[63:0]

Fuse region	Fuse name	Start address (in hexadecimal)	Bit number	Fuse blow value	Description
OEM_SECURITY_POLICY	DISALLOW_SOC_DEBUG	0x221c0090	0	0	Recommendation is to not provide —fuse-disallow-soc-debug. DisallowSOCDEBUG ‘1’ - Disallow unlocking of debug interfaces for the entire SoC (i.e. no SoC debug possible permanently). Requires Activate_Security_Policy fuse set to ‘1’ to take effect. Not recommended. No RMA /JTAG access possible. ‘0’ - debugging is available.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_SOC_DEBUG	0x221c0090	1	1	Recommendation is to provide —fuse-enforce-oem-authz-on-soc-debug. EnforceOemAuthzOnSoCDebug ‘1’ - Enforce OEM authorization of Debug Policy Requests. When set, OEM must counter-sign Qualcomm debug policies and TME must verify both signatures (Qualcomm and OEM). Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Do not enforce OEM counter-signing.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_FUSE_OVERRIDES	0x221c0090	4	1	Recommendation is to provide —fuse-enforce-oem-authz-on-fuse-overrides. EnforceOemAuthzOnFuseOverrides ‘1’ - Fuse overwrite request requires an OEM signature. Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Fuse overwrite request does not require an OEM signature.
OEM_SECURITY_POLICY	ENFORCE_OEM_AUTHZ_ON_ROM_PATCH	0x221c0090	5	1	Recommendation is to provide —fuse-enforce-oem-authz-on-rom-patch. EnforceOemAuthzOnROMPatch ‘1’ - Updates to TME/SoC ROM (RoT) requires OEM signature. Requires Activate_Security_Policy fuse set to ‘1’ to take effect. ‘0’ - Updates to TME/SoC ROM (RoT) do not require OEM signature.
OEM_SECURITY_POLICY	ACTIVATE_SECURITY_POLICY	0x221c0090	11	1	Recommendation is to provide —fuse-activate-security-policy. ActivateSecurityPolicy Set to ‘1’ for OEMSecurityPolicy bits 0,1,4,5 to take effect.
OEM_SECURITY_POLICY	OEM_DEVICE_LCS	0x221c0090	[17:16]	0x3	Recommended value is —fuse-oem-device-lcs=0x3. OEM_DEVICE_LCS (OEM Device Life cycle state) 01 => OEM_DEV_LCSID 00,1X => OEM_PROD_LCSID.
OEM_SECURITY_POLICY	AUTH_EN	0x221c0090	33	1	Recommendation is to provide —fuse-auth-en. Blow this bit to enable secure boot for apps and other peripheral images. When this bit is ‘1’; enables authentication for any code that references secure boot configuration.
OEM_SECURITY_POLICY	PK_HASH_IN_FUSE	0x221c0090	34	1	Recommendation is to provide —fuse-pk-hash-in-fuse. For boot configuration : - If this bit is ‘0’ use the internal ROM hash index and OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0] for the root certificate hash. - If this bit is ‘1’ use the value stored in OEM_PK_HASH for the root certificate hash.
OEM_SECURITY_POLICY	USE_SERIAL_NUM	0x221c0090	35	0	Recommendation is to not provide —fuse-use-serial-num. If this bit is ‘1’ then the unique device serial number is required in the authentication of code for boot configuration.
OEM_SECURITY_POLICY	ROM_PK_HASH_IDX	0x221c0090	[39:36]	0x0	Recommended value is —fuse-rom-pk-hash-idx=0x0. If PK_HASH_IN_FUSE = ‘0’; this value selects which root certificate hash to use from the ROM table.
WRITE_PERMISSIONS	MRC_WRITE_DISABLE	0x221c0188	3		Recommendation is to not provide —fuse-mrc-write-disable. This bit determines the write permission setting for this region.
WRITE_PERMISSIONS	OEM_SECURITY_POLICY_WRITE_DISABLE	0x221c0188	5	1	Recommendation is to provide —fuse-oem-security-policy-write-disable. Disables further QFPROM changes to OEM SECURITY POLICY region. Blow this bit after the OEM SECURITY POLICY region has been completely provisioned.
WRITE_PERMISSIONS	WRITE_PERMISSIONS_WRITE_DISABLE	0x221c0188	7	1	Recommendation is to provide —fuse-write-permissions-write-disable. Disables further QFPROM changes to WRITE PERMISSIONS region. Blow this bit only if no further changes to Write Permissions are needed.
WRITE_PERMISSIONS	READ_PERMISSIONS_WRITE_DISABLE	0x221c0188	8	1	Recommendation is to provide —fuse-read-permissions-write-disable. Disables further QFPROM changes to READ PERMISSIONS region. Blow this bit after the READ PERMISSIONS region has been completely provisioned.
WRITE_PERMISSIONS	FUSE_REDUNDANCY_ENABLE_WRITE_DISABLE	0x221c0188	9	1	Recommendation is to provide —fuse-fuse-redundancy-enable-write-disable. Disables further QFPROM changes to FUSE REDUNDANCY ENABLE region. Blow this bit after the FUSE REDUNDANCY ENABLE region has been completely provisioned.
WRITE_PERMISSIONS	DEBUG_DISABLE_WRITE_DISABLE	0x221c0188	10	1	Recommendation is to provide —fuse-debug-disable-write-disable. Disables further QFPROM changes to DEBUG DISABLE region. Blow this bit after the DEBUG DISABLE region has been completely provisioned.
WRITE_PERMISSIONS	OEM_CONFIG_WRITE_DISABLE	0x221c0188	12		Recommendation is to provide —fuse-oem-config-write-disable. Disables further QFPROM changes to OEM CONFIG region. Blow this bit after the OEM CONFIG region has been completely provisioned.
WRITE_PERMISSIONS	ANTI_ROLLBACK_WRITE_DISABLE	0x221c0188	16		Recommendation is to not provide —fuse-anti-rollback-write-disable. Disables further QFPROM changes to ANTI ROLLBACK region. OEMs may need to leave this unblown for OTA updates to Anti-rollback region.
WRITE_PERMISSIONS	MRC_HASH_WRITE_DISABLE	0x221c0188	24	1	Recommendation is to provide —fuse-mrc-hash-write-disable. Disables further QFPROM changes to MRC HASH region. Blow this bit after the MRC HASH region has been completely provisioned.
WRITE_PERMISSIONS	OEM_PRODUCT_SEED_WRITE_DISABLE	0x221c0188	25	1	Recommendation is to provide —fuse-oem-product-seed-write-disable. Disables further QFPROM changes to OEM PRODUCT SEED region. Blow this bit after the OEM PRODUCT SEED region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_0_WRITE_DISABLE	0x221c0188	31		Disables further QFPROM changes to OEM SPARE 0 region. Blow this bit after the OEM SPARE 0 region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_1_WRITE_DISABLE	0x221c0188	32		Disables further QFPROM changes to OEM SPARE 1 region. Blow this bit after the OEM SPARE 1 region has been completely provisioned.
WRITE_PERMISSIONS	OEM_SPARE_2_WRITE_DISABLE	0x221c0188	33		Reserved.
WRITE_PERMISSIONS	OEM_SPARE_3_WRITE_DISABLE	0x221c0188	34		Reserved.
READ_PERMISSIONS	OEM_PRODUCT_SEED_READ_DISABLE	0x221c0190	25	1	Recommendation is to provide —fuse-oem-product-seed-read-disable. Blow this bit after the OEM Product Seed region has been completely provisioned.
FUSE_REDUNDANCY_ENABLE	MRC_HASH_FEC_ENABLE	0x221c0198	24	1	Recommendation is to provide —fuse-mrc-hash-fec-enable. Blow to enable FEC for MRC Hash region. Ensure that complete region is provisioned before FEC is enabled.
FUSE_REDUNDANCY_ENABLE	OEM_PRODUCT_SEED_FEC_ENABLE	0x221c0198	25	1	Recommendation is to provide —fuse-oem-product-seed-fec-enable. Blow to enable FEC for OEM Product Seed region. Ensure that complete region is provisioned before FEC is enabled.
DEBUG_DISABLE	SHRM_DBGEN_DISABLE	0x221c01a0	6	1	Recommendation is to provide —fuse-shrm-dbgen-disable. SHRM Invasive debug disable.
DEBUG_DISABLE	CPUCP_DBGEN_DISABLE	0x221c01a0	8	1	Recommendation is to provide —fuse-cpucp-dbgen-disable. CPU Content Protection Invasive debug disable.
DEBUG_DISABLE	CPUCP_NIDEN_DISABLE	0x221c01a0	9	1	Recommendation is to provide —fuse-cpucp-niden-disable. CPU Content Protection Non-Invasive debug disable.
DEBUG_DISABLE	QSEE_DBGEN_DISABLE	0x221c01a0	12	1	Recommendation is to provide —fuse-qsee-dbgen-disable. QSEE Invasive debug disable.
DEBUG_DISABLE	QSEE_NIDEN_DISABLE	0x221c01a0	13	1	Recommendation is to provide —fuse-qsee-niden-disable. QSEE Non-Invasive debug disable.
DEBUG_DISABLE	SMMU_PCIE_APB_SDC_DISABLE	0x221c01a0	19	1	Recommendation is to provide —fuse-smmu-pcie-apb-sdc-disable. Fuse To enable or disable the APB based scan dump for TCU and TBUs.
DEBUG_DISABLE	WPSS_DBGEN_DISABLE	0x221c01a0	21	1	Recommendation is to provide —fuse-wpss-dbgen-disable. WPSS Invasive Debug Disable.
DEBUG_DISABLE	WPSS_NIDEN_DISABLE	0x221c01a0	22	1	Recommendation is to provide —fuse-wpss-niden-disable. WPSS Non-Invasive Debug Disable.
DEBUG_DISABLE	APPS_DBGEN_DISABLE	0x221c01a0	32	1	Recommendation is to provide —fuse-apps-dbgen-disable. Apps Invasive debug disable.
DEBUG_DISABLE	APPS_NIDEN_DISABLE	0x221c01a0	33	1	Recommendation is to provide —fuse-apps-niden-disable. Apps Non-Invasive debug disable.
DEBUG_DISABLE	TITAN_DBGEN_DISABLE	0x221c01a0	38	1	Recommendation is to provide —fuse-titan-dbgen-disable. Titan Invasive debug disable.
DEBUG_DISABLE	TITAN_NIDEN_DISABLE	0x221c01a0	39	1	Recommendation is to provide —fuse-titan-niden-disable. Titan Non-Invasive debug disable.
DEBUG_DISABLE	LPASS_DBGEN_DISABLE	0x221c01a0	40	1	Recommendation is to provide —fuse-lpass-dbgen-disable. LPASS Invasive debug disable.
DEBUG_DISABLE	LPASS_NIDEN_DISABLE	0x221c01a0	41	1	Recommendation is to provide —fuse-lpass-niden-disable. LPASS Non-Invasive debug disable.
DEBUG_DISABLE	TURING_DBGEN_DISABLE	0x221c01a0	42	1	Recommendation is to provide —fuse-turing-dbgen-disable. Turing Invasive debug disable.
DEBUG_DISABLE	TURING_NIDEN_DISABLE	0x221c01a0	43	1	Recommendation is to provide —fuse-turing-niden-disable. Turing Non-Invasive debug disable.
DEBUG_DISABLE	IRIS_DBGEN_DISABLE	0x221c01a0	44	1	Recommendation is to provide —fuse-iris-dbgen-disable. IRIS Invasive debug disable.
DEBUG_DISABLE	IRIS_NIDEN_DISABLE	0x221c01a0	45	1	Recommendation is to provide —fuse-iris-niden-disable. IRIS Non-Invasive debug disable.
DEBUG_DISABLE	MDSS_DBGEN_DISABLE	0x221c01a0	46	1	Recommendation is to provide —fuse-mdss-dbgen-disable. MDSS Invasive debug disable.
DEBUG_DISABLE	MDSS_NIDEN_DISABLE	0x221c01a0	47	1	Recommendation is to provide —fuse-mdss-niden-disable. MDSS Non-Invasive debug disable.
DEBUG_DISABLE	DDRSS_DBGEN_DISABLE	0x221c01a0	48	1	Recommendation is to provide —fuse-ddrss-dbgen-disable. DDRSS Invasive debug disable.
DEBUG_DISABLE	DDRSS_NIDEN_DISABLE	0x221c01a0	49	1	Recommendation is to provide —fuse-ddrss-niden-disable. DDRSS Non-Invasive debug disable.
DEBUG_DISABLE	GPU_DBGEN_DISABLE	0x221c01a0	50	1	Recommendation is to provide —fuse-gpu-dbgen-disable. GPU Invasive debug disable.
DEBUG_DISABLE	GPU_NIDEN_DISABLE	0x221c01a0	51	1	Recommendation is to provide —fuse-gpu-niden-disable. GPU Non-Invasive debug disable.
DEBUG_DISABLE	DAP_DBGEN_DISABLE	0x221c01a0	52	1	Recommendation is to provide —fuse-dap-dbgen-disable. DAP Invasive debug disable.
DEBUG_DISABLE	DAP_NIDEN_DISABLE	0x221c01a0	53	1	Recommendation is to provide —fuse-dap-niden-disable. DAP Non-Invasive debug disable.
DEBUG_DISABLE	APPS_SCANDUMP_DISABLE	0x221c01a0	54	1	Recommendation is to provide —fuse-apps-scandump-disable. Apps Scan Dump disable.
DEBUG_DISABLE	DDRSS_SCANDUMP_DISABLE	0x221c01a0	55	1	Recommendation is to provide —fuse-ddrss-scandump-disable. DDRSS Scan Dump disable.
DEBUG_DISABLE	DEBUGBUS_DISABLE	0x221c01a0	56	1	Recommendation is to provide —fuse-debugbus-disable. Debug bus disable.
DEBUG_DISABLE	DCC_DISABLE	0x221c01a0	57	1	Recommendation is to provide —fuse-dcc-disable. DCC disable.
DEBUG_DISABLE	SMMU_SCANDUMP_DISABLE	0x221c01a0	59	1	Recommendation is to provide —fuse-smmu-scandump-disable. SMMU Scan Dump disable.
OEM_CONFIG	E_DLOAD_DISABLE	0x221c01b8	0		OEM Optional. Disables emergency download via removable SD and/or USB downloader in Apps PBL error handler.
OEM_CONFIG	ENUM_TIMEOUT	0x221c01b8	1		OEM Optional. BOOT ROM must support USB enumeration timeout. Timeout applies to both enumeration for FLCB (fast low current boot) and USB download mode. If USB is not enumerated within time (90 seconds), quit USB enumeration If USB suspend or disconnected after enumeration, start timer again.
OEM_CONFIG	FORCE_DLOAD_DISABLE	0x221c01b8	2		OEM optional. If FORCE_DLOAD_DISABLE is ‘0’; device goes to download mode if an error occurs very early in XBL1. If FORCE_DLOAD_DISABLE is set to ‘1’; device goes into cold boot if an error occurs very early in XBL1.
OEM_CONFIG	FORCE_USB_BOOT_GPIO_DISABLE	0x221c01b8	3		This fuse is used to control booting from FORCE_USB_BOOT_GPIO. It only controls FORCE_USB_GPIO based boot, FDL cookies are not controlled by this fuse. If fuse value = 0 => PBL honors boot from USB if FORCE_USB_BOOT GPIO is flipped. If the GPIO is set to high, PBL will enter USB FEDL path irrespective of FAST_BOOT option selected. If fuse value = 1 => PBL will not enter USB FEDL mode even if FORCE_USB_GPIO is flipped to 1. Boot from FORCE USB GPIO is disabled.
OEM_CONFIG	SDCC_ADMA_DISABLE	0x221c01b8	4		0 is default ADMA mode enabled 1 - ADMA mode disabled and fallback to FIFO mode.
OEM_CONFIG	FAST_BOOT	0x221c01b8	[9:5]		These fuses are used by boot code to specify which device has priority to be booted from. For X1P4x100, the mapping is as follows : 0x0 - QSPI+NVMe -> USB (SS/HS) 0x1 - UFS HS G1 -> USB (SS/HS) - Not Supported 0x2 - SPI+NVMe -> USB (SS/HS) 0x3 - QSPI+NVMe -> USB (SS/HS) 0x4 - USB (SS/HS) 0x5 - Dual IO SPI+NVMe -> USB (SS/HS) 0x6 - Dual IO SPI+UFS -> USB (SS/HS) 0x7 - QSPI+UFS -> USB (SS/HS) 0x8 - SPI+UFS -> USB (SS/HS) Others - RESERVED.
OEM_CONFIG	SPI_CLK_BOOT_FREQ	0x221c01b8	[11:10]		00: ‘85MHz’ (Default) 01: ‘60MHz’ 10: ‘37.5MHz’ 11: ‘Reserved’.
OEM_CONFIG	PBL_FDL_TIMEOUT_RESET_FEATURE_ENABLE	0x221c01b8	13		Fuse bit to reset device if PBL enters into EDL mode unintentionally. Enable/disable Force download timeout in case device goes into force USB download accidentally. If enabled, device will reboot after timeout if in force USB download mode. If disabled, phone stays in force USB download. 0 => Disabled 1 => Enabled.
OEM_CONFIG	WDOG_EN	0x221c01b8	14		Prevents WDOG_DISABLE GPIO from disabling WDOG. Frees up the GPIO and prevents potential for abuse by attacker. This selects whether GPIO_xx can be used to disable the watchdog timer. If enabled, then GPIO_xx, when high, will disable the watchdog. If disabled, then GPIO_xx will not disable the watchdog. The watchdog can still be disabled via software control. 0 => Disabled 1 => Enabled.
OEM_CONFIG	PBL_LOG_DISABLE	0x221c01b8	15		Used for controlling logging mechanism in PBL. ‘1’ To limit the information collected in PBL logs.
OEM_CONFIG	PBL_USB_TYPE_C_DISABLE	0x221c01b8	16		Disables type-C functionality during PBL. PBL communication/enumeration happens over USB0_SS only. USB1_SS cannot be used.
OEM_CONFIG	ROOT_CERT_TOTAL_NUM	0x221c01b8	[18:17]		Defines the total root cert number supported from the certificate (Upto 4 roots).
OEM_CONFIG	QSPI_DMA_DISABLE	0x221c01b8	19		0 => QSPI DMA is enabled 1 => QSPI DMA is disabled.
OEM_CONFIG	USB_SS_DISABLE	0x221c01b8	22		Used to disable USB SS enumeration during Boot.
OEM_CONFIG	USB_PIPO_DISABLE	0x221c01b8	23		If fuse value = 0 => USB Plug in – Plug out feature is enabled in PBL. With this feature, if user disconnects and reconnects USB cable on the device we will be able to re-enumerate and go back to EDL with max 3 retries/plugins If fuse value = 1 => USB Plug in – Plug out feature is disabled.
OEM_CONFIG	SP_DISABLE	0x221c01b8	27		Disable Secure Processor Unit by the SoC. 0: SPU is enabled. 1: SPU is permanently disabled by SoC.
OEM_CONFIG	DEBUG_POLICY_DISABLE	0x221c01b8	28	0	Recommendation is to not provide —fuse-debug-policy-disable. Debug Policy is bypassed when this bit is 1. Debug Policy provides a means to re-enable debug capabilities under OEM-specified selectable conditions.
OEM_CONFIG	PBL_FDL_TIMEOUT_RESET_TO_VAL	0x221c01b8	[30:29]		This fuse allows OEMs to have configurable timeout values for FDL timeout reset feature. 00: 05 ms (default) 01: 30 ms 10: 60 ms 11: 120 ms.
OEM_CONFIG	EDL_INDICATOR_ENABLE	0x221c01b8	31		Provides EDL indicator.
OEM_CONFIG	SPU_ENABLEMENT_OPTION	0x221c01c0	[2:1]	0x0	Recommended value is —fuse-spu-enablement-option=0x0. Enablement options for the Secure Processing Unit: 00: SPU enablement via SPU API. This is the preferred SPU enablement option, which supports the optional ARI Test Mode. 01: SPU enablement via fuses. Not recommended. Will automatically activate ARI (ARI fuses will be blown on every loss of power), ignore ARI Test Mode, and enforce all SPU security policies. Irreversible operation. 1x: RESERVED.
OEM_CONFIG	SP_FIPS_ENABLE	0x221c01c0	3		Enable/Disable FIPS mode for SPU (blow this fuse for SPU to be FIPS 140-3 level 2 certifiable).
OEM_CONFIG	TZ_SW_CRYPTO_FIPS_ENABLE	0x221c01c0	4		Enable/Disable TZ FIPS certifiable mode. Blow this fuse for TZ SW crypto to be FIPS 140-3 certifiable. Set to ‘1’ to enable TZ FIPS certifiable mode If OEM needs to evaluate FIPS (for performance, security etc), do not enable this fuse. Set OEM devcfg oem_is_fips_enabled_for_test = 1. Note: The fuse value and the specific crypto version are required to claim for FIPS validated module. Once this is enabled through fuse, the device will be placed in FIPS mode and cannot be reverted.
OEM_CONFIG	SP_FIPS_OVERRIDE	0x221c01c0	6		Override SP_FIPS_ENABLE fuse. Non-override by default and blow to override the SP_FIPS_ENABLE fuse to disable the FIPS feature in SPU.
OEM_CONFIG	SPARE_REG0_SECURE	0x221c01c0	12		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SPARE_REG1_SECURE	0x221c01c0	13		This fuse determines if the corresponding OEM spare region is treated as secure. If blown, it indicates secure, and the region has the properties of a customer private key, and is not readable through SW while debug is enabled.
OEM_CONFIG	SP_ARI_TEST_MODE_FEATURE_ENABLE	0x221c01c0	16		SPU ARI Test Mode is a special feature to assist in development, testing and manufacturing of devices that uses SPU and ARI. In ARI Test Mode, SPU places a limit on the number of fuses ARI uses but SPU NVM is fully functional. If the fuse usage limit is reached, SPU NVM will continue to function but replay protection will not be provided. If this feature is enabled, OEMs must turn off Test Mode using a software API, for any shipping device. This fuse enables this feature 0: DISABLE 1: ENABLE.
OEM_CONFIG	SP_ARI_SUSPENSION_FEATURE_ENABLE	0x221c01c0	17		SPU ARI Suspension allows the temporary suspension of ARI, so no further fuses will be consumed beyond the next Power on Reset (PoR). This fuse enables this feature 0: DISABLE 1: ENABLE.
OEM_CONFIG	SP_APP_ROT_TRANSFER_FEATURE_ENABLED	0x221c01c0	18		Determines the state of SPU OEM double signing delegation feature. If activated, an OEM can initiate a double signing delegation request for the SPU with details of a trusted Root of Trust hashes and UUID’s of applications that they would be allowed to sign. 0: DISABLE 1: ENABLE.
OEM_CONFIG	EKU_ENFORCEMENT_EN	0x221c01c0	30	1	Recommendation is to provide —fuse-eku-enforcement-en. When this fuse is blown will enable enforcement of the EKU field in the certificate. EKU enforcement is one of the requirements to meet Common Criteria Mobile Device Fundamental Protection Profile (MDFPP).
OEM_CONFIG	OEM_HW_ID	0x221c01c0	[47:32]		The OEM hardware ID. Bits 15:0. This is a unique 16-bit value assigned by Qualcomm to every OEM.
OEM_CONFIG	OEM_PRODUCT_ID	0x221c01c0	[63:48]		The OEM product ID. Bits 15:0.
OEM_CONFIG	PERIPH_PID	0x221c01c8	[15:0]		Bits 15:0 of the PID.
OEM_CONFIG	PERIPH_VID	0x221c01c8	[31:16]		Bits 15:0 of the VID.
OEM_CONFIG	ANTI_ROLLBACK_FEATURE_EN	0x221c01c8	[35:32]	0xf	Recommended value is —fuse-anti-rollback-feature-en=0xf. Bit 0 - BOOT_ANTI_ROLLBACK_EN Bit 1 - TZAPPS_ANTI_ROLLBACK_EN Bit 2 - PILSUBSYS_ANTI_ROLLBACK_EN Bit 3 - RESERVED FOR FUTURE USE (Blow this bit).
OEM_CONFIG	END_FACTORY_PROVISIONING	0x221c01d0	0		Recommendation is to provide —fuse-end-factory-provisioning. The End_Factory_Provisioning fuse will be blown by the OEM when it is done with factory provisioning of the device.
OEM_CONFIG	DEBUG_UART_3M_BUADRATE	0x221c01d0	1		Fuse to select different Baud Rate. Fuse Blown - UART baud rate = 3Mbps . Fuse Unblown (Default) - UART baud rate = 115.2 Kbps.
MRC_HASH	MRC_HASH	0x221c0740	[55:0]		Hash of Multiple Root Certificates (up to 4 certificates) OEMs should blow these fuses for Secure Boot enablement.
MRC_HASH	MRC_HASH	0x221c0748	[55:0]
MRC_HASH	MRC_HASH	0x221c0750	[55:0]
MRC_HASH	MRC_HASH	0x221c0758	[55:0]
MRC_HASH	MRC_HASH	0x221c0760	[55:0]
MRC_HASH	MRC_HASH	0x221c0768	[55:0]
MRC_HASH	MRC_HASH	0x221c0770	[55:0]
MRC_HASH	MRC_HASH	0x221c0778	[55:0]
MRC_HASH	MRC_HASH	0x221c0780	[55:0]
MRC_HASH	MRC_HASH	0x221c0788	[7:0]
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c0790	[55:0]		OEM Product Seed is generated by the OEM and written to SoC fuses. The seed value is used by the OEM to derive device provisioning keys that are specific to the OEM product. It is recommended that this value needs to be kept secret, “OEM PRODUCT SEED Write Disable” and “OEM Product Seed Read Disable” fuses should be blown so that this will only be readable by HW for any key derivation operations.
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c0798	[55:0]
OEM_PRODUCT_SEED	OEM_PRODUCT_SEED	0x221c07a0	[15:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16e8	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16f0	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c16f8	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1700	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1708	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1710	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1718	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1720	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1728	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1730	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1738	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1740	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1748	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1750	[63:0]
OEM_SPARE_0	OEM_SPARE_0	0x221c1758	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1760	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1768	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1770	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1778	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1780	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1788	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1790	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c1798	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17a0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17a8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17b0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17b8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17c0	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17c8	[63:0]
OEM_SPARE_1	OEM_SPARE_1	0x221c17d0	[63:0]

Next steps

To ensure the that the cryptographic keys and certificates are generated and managed in a secure and trusted environment, see Generate keys and certificates.
To ensure the authenticity and integrity of software images and to write a complete software image, see Sign and flash the images.

Introduction

Architecture

Key Documents

Technologies

System

Release Notes

Next steps

Introduction

Architecture

Key Documents

Technologies

System

Release Notes

​Next steps

Next steps