# QFPROM fuses

Source: [https://docs.qualcomm.com/doc/80-70015-11/topic/appendix-fuse-configurations.html](https://docs.qualcomm.com/doc/80-70015-11/topic/appendix-fuse-configurations.html)

The QFPROM fuse values and details are captured in the following table, which can be
        blown to enable secure boot.

| Fuse name | Start address | Bit number | Fuse blow value | Description |
| --- | --- | --- | --- | --- |
| **Read permissions** | **Read permissions** | **Read permissions** | **Read permissions** | **Read permissions** |
| Secondary Key derivation Key Read disable | 7801A8 | 24 | 1 | After provisioning the SKDK, blow this bit to secure the secondary<br>                            key from being read back. A secure path hardware exists from SKDK to the<br>                            crypto engine. |
| **Write permissions** | **Write permissions** | **Write permissions** | **Write permissions** | **Write permissions** |
| Read permissions write disable | 7801B0 | 6 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| FEC enables write disable | 7801B0 | 8 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| OEM configuration write disable | 7801B0 | 9 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| Public key hash 0 write disable | 7801B0 | 17 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| OEM secure boot write disable | 7801B0 | 23 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| Secondary key derivation key write disable | 7801B0 | 24 | 1 | Blow this bit after the region has been provisioned to disable<br>                            further QFPROM changes to this region. |
| **FEC enable** | **FEC enable** | **FEC enable** | **FEC enable** | **FEC enable** |
| OEM secure boot FEC enable | 7801B8 | 23 | 1 | To enable FEC for OEM secure boot region, blow this bit. Ensure that<br>                            the complete region is provisioned before FEC is enabled. |
| Secondary key derivation key FEC enable | 7801B8 | 24 | 1 | To enable FEC for the secondary KDF key, blow this bit. Ensure that<br>                            the complete region is provisioned before FEC is enabled. |
| **OEM Config** | **OEM Config** | **OEM Config** | **OEM Config** | **OEM Config** |
| `WDOG_EN` | 7801C0 | 14 | 1 | Prevents the `WDOG_DISABLE` GPIO from disabling WDOG,<br>                            freeing up the GPIO and preventing potential abuse by an<br>                            attacker. |
| `SHARED_QSEE_SPIDEN_DISABLE` | 7801C0 | 30 | 1 | A shared Qualcomm TEE secure invasive debug disable bucket. A<br>                            corresponding Qualcomm fuse can override this OEM‑controlled<br>                            fuse. |
| `SHARED_QSEE_SPNIDEN_DISABLE` | 7801C0 | 31 | 1 | A shared Qualcomm TEE secure non-invasive debug disable bucket. A<br>                            corresponding Qualcomm fuse can override this OEM‑controlled<br>                            fuse. |
| `SHARED_MSS_DBGEN_DISABLE` | 7801C4 | 32 | 1 | A shared MSS invasive debug disable bucket. A corresponding Qualcomm<br>                            fuse can override this OEM‑controlled fuse. |
| `SHARED_MSS_NIDEN_DISABLE` | 7801C4 | 33 | 1 | A shared MSS non-invasive debug disable bucket. A corresponding<br>                            Qualcomm fuse can override this OEM-controlled fuse. |
| `SHARED_CP_DBGEN_DISABLE` | 7801C4 | 34 | 1 | A shared CP invasive debug disable bucket. A corresponding Qualcomm<br>                            fuse can override this OEM‑controlled fuse. |
| `SHARED_CP_NIDEN_DISABLE` | 7801C4 | 35 | 1 | A shared CP non-invasive debug disable bucket. A corresponding<br>                            Qualcomm fuse can override this OEM-controlled fuse. |
| `SHARED_NS_DBGEN_DISABLE` | 7801C4 | 36 | 1 | A shared CP non-invasive debug disable bucket. A corresponding<br>                            Qualcomm fuse can override this OEM‑controlled fuse. |
| `SHARED_NS_NIDEN_DISABLE` | 7801C4 | 37 | 1 | A shared CP non-invasive debug disable bucket. A corresponding<br>                            Qualcomm fuse can override this OEM‑controlled fuse. |
| `APPS_DBGEN_DISABLE` | 7801C4 | 38 | 1 | Blow this bit for a secure solution. This configuration disables the<br>                            application processor global invasive debug capabilities (JTAG and<br>                            monitor mode). The `OVERRIDE` registers can override this<br>                            configuration. |
| `APPS_NIDEN_DISABLE` | 7801C4 | 39 | 1 | Blow this bit for a secure solution. This configuration disables the<br>                            application processor global non-invasive debug capabilities (trace and<br>                            performance monitoring). This configuration can be overridden with the<br>                                `OVERRIDE` registers. |
| `SHARED_MISC_DEBUG_DISABLE` | 7801C4 | 40 | 1 | A shared miscellaneous debug disable bucket. A corresponding Qualcomm<br>                            fuse can override this OEM-controlled fuse. |
| `EKU_ENFORCEMENT_EN` | 7801C8 | 30 | 1 | To enable enforcement of the EKU field in the certificate, blow this<br>                            device. |
| `OEM_HW_ID[0:15]` | 7801CC | [32:47] | 0 | Represents the OEM hardware ID. Bits 15:0. |
| `OEM_PRODUCT_ID[0:15]` | 7801CC | [48:63] | 0 | Represents the OEM product ID. Bits 15:0. |
| `ANTI_ROLLBACK_FEATURE_EN[0]` | 7801D4 | 32 | 1 | <ul class="ul" id="appendix-fuse-configurations__ul_ckt_k2d_s1c"><br>                                <li class="li">Bit 0 - <code class="ph codeph">BOOT_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 1 - <code class="ph codeph">TZAPPS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 2 -<code class="ph codeph"> PILSUBSYS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 3 - <code class="ph codeph">MSA_ANTI_ROLLBACK_EN</code></li><br><br>                            </ul> |
| `ANTI_ROLLBACK_FEATURE_EN[1]` | 7801D4 | 33 | 1 | <ul class="ul" id="appendix-fuse-configurations__ul_ckt_k2d_s1c"><br>                                <li class="li">Bit 0 - <code class="ph codeph">BOOT_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 1 - <code class="ph codeph">TZAPPS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 2 -<code class="ph codeph"> PILSUBSYS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 3 - <code class="ph codeph">MSA_ANTI_ROLLBACK_EN</code></li><br><br>                            </ul> |
| `ANTI_ROLLBACK_FEATURE_EN[2]` | 7801D4 | 34 | 1 | <ul class="ul" id="appendix-fuse-configurations__ul_ckt_k2d_s1c"><br>                                <li class="li">Bit 0 - <code class="ph codeph">BOOT_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 1 - <code class="ph codeph">TZAPPS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 2 -<code class="ph codeph"> PILSUBSYS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 3 - <code class="ph codeph">MSA_ANTI_ROLLBACK_EN</code></li><br><br>                            </ul> |
| `ANTI_ROLLBACK_FEATURE_EN[3]` | 7801D4 | 35 | 1 | <ul class="ul" id="appendix-fuse-configurations__ul_ckt_k2d_s1c"><br>                                <li class="li">Bit 0 - <code class="ph codeph">BOOT_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 1 - <code class="ph codeph">TZAPPS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 2 -<code class="ph codeph"> PILSUBSYS_ANTI_ROLLBACK_EN</code></li><br><br>                                <li class="li"> Bit 3 - <code class="ph codeph">MSA_ANTI_ROLLBACK_EN</code></li><br><br>                            </ul> |
| **PK hash** | **PK hash** | **PK hash** | **PK hash** | **PK hash** |
| `PK hash 0[0:383]` | 780248 | [0:383] | - | The OEM-specific root certificate PK hash value. |
| **OEM secure boot** | **OEM secure boot** | **OEM secure boot** | **OEM secure boot** | **OEM secure boot** |
| `OEM_SECURE_BOOT1_PK_HASH_IN_FUSE` | 780728 | 4 | 1 | When this bit is ‘1’, use the value stored in OEM\_PK\_HASH for the<br>                            root certificate hash. |
| `OEM_SECURE_BOOT1_AUTH_EN` | 780728 | 5 | 1 | To enable secure boot for apps and other peripheral images, blow this<br>                            bit. When this bit is ‘1’, it enables authentication for any code that<br>                            references secure boot configuration 1. |
| `OEM_SECURE_BOOT2_PK_HASH_IN_FUSE` | 780728 | 12 | 1 | For boot configuration 2: <br>If this bit is ‘0’, use the internal ROM<br>                                hash index and<br>                                    `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the<br>                                root certificate hash.<br><br><br>If this bit is ‘1’, use the value<br>                                stored in `OEM_PK_HASH` for the root certificate<br>                                hash. |
| `OEM_SECURE_BOOT2_AUTH_EN` | 780728 | 13 | 1 | To enable the secure boot, blow this bit.  When this bit is ‘1’, it<br>                            enables authentication for any code that references secure boot. |
| `OEM_SECURE_BOOT3_PK_HASH_IN_FUSE` | 780728 | 20 | 1 | For boot configuration 3: <br>If this bit is ‘0’, use the internal ROM<br>                                hash index and<br>                                    `OEM_SECURE_BOOT1_ROM_PK_HASH_IDX[3:0]` for the<br>                                root certificate hash.<br><br><br>When this bit is ‘1’, use the value<br>                                stored in `OEM_PK_HASH` for the root certificate<br>                                hash. |
| `OEM_SECURE_BOOT3_AUTH_EN` | 780728 | 21 | 1 | To enable the secure boot, blow this bit. When this bit is ‘1’, it<br>                            enables authentication for any code that references secure boot<br>                            configuration 3. |
| **Sec key derivation key** | **Sec key derivation key** | **Sec key derivation key** | **Sec key derivation key** | **Sec key derivation key** |
| `Sec Key derivation Key[0:255]` | 780738 | [0:255] |  | This 256‑bit value is used as the secondary key derivation input,<br>                                which is used to generate the secondary key for the crypto engine.<br>                                When running in an insecure mode (no secure boot or Debug enabled),<br>                                the SKDK is fed into the key derivation function to generate a<br>                                unique non‑secure secondary key for use by the crypto<br>                                engine.<br><br><br>                            <br>When running in a secure mode (secure boot and debug disabled), the<br>                                SKDK is fed directly to the crypto engine as the secondary key.<br><br><br>                            <br>After the SKDK value has been correctly programmed, the SKDK Read<br>                                Disable must be blown to permanently protect the SKDK value. The<br>                                software reads the SKDK value from the QFPROM before this correction<br>                                is made.<br><br><br>                            <br>The SBL fuse blow API can automatically generate a random number for<br>                                use as the SKDK, ensuring that the SKDK value is never available<br>                                outside of the device. |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |

**Parent Topic:** [Enable secure boot](https://docs.qualcomm.com/doc/80-70015-11/topic/enable-secure-boot.html)

Last Published: Oct 14, 2024

[Previous Topic
Enable secure boot](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/enable-secure-boot.md) [Next Topic
Generate local (insecure) root key and certificate](https://docs.qualcomm.com/bundle/publicresource/80-70015-11/topics/generate-local-insecure-root-key-and-certificates.md)