Introduction.
OEMs need to access fuse values during functional tests and product manufacturing as well, they will fix Ethernet MAC addresses, fix boot mode, enable secure boot and more,
There is a tool that is enabled across all i.MX processors, it runs in U-boot and is the command '=> fuse
In this article, you will download a C-written file, using NXP BSP enabled functions to access processor's fuses.
i.MX 9 Series manages fuses through EdgeLock Secure Enclave (ELE), which would make this tool easy to adapt for other processors, this release is focused on i.MX91 and i.MX93.
1. Hardware Setup.
FRDM-i.MX91. Power supply connected to P1, USB type-C debug cable to P16
Ethernet cable connected to network router and P4, for source code copying.
SD/eMMC flashed with Yocto Linux Factory LF_6.12.49, if needed, you can flash it with USB type-C host cable to J31.
image-1.jpg
2. Documentation Setup.
Download reference manual from i.MX 91 Documentation. It contains the attachment i.MX91_Fusemap.xlsx
Screenshot 2026-03-24 151748.png
3. Software Setup.
Download and build process.
user@host:~$ scp fuse_test.c root@:~ root@imx91evk:~# gcc -Wall fuse_test.c -o fuse_testTool features.
- Uses NXP BSP pread and pwrite functions.
- Based on Bank * 8 + Word formula, if you are using fusemap attachment, Word would be defined as Word % 8.
- Defines minimum and maximum bank and word indexes according to i.MX93/i.MX91 fusemap.
- Requires customer to specifically input 4 arguments: fuse_test read|write
.
4. Demonstration.
Read Device Unique ID [31:0] from fuses.
a. Stop at U-boot for UID fuse reference value.
u-boot=> fuse read 1 7
Reading bank 1:
Word 0x00000007: 03fc7ef1
u-boot=> bootb. Run tool for read operation.
root@imx91evk:~# ./fuse_test read 1 7
ret: 0
fd : 3
READ Bank: 1, Word: 7, Offset: 15
SUCCESS: pread operation
resp_len = 4
resp_buf[0] = |f1|
resp_buf[1] = |7e|
resp_buf[2] = |fc|
resp_buf[3] = |3|c. Run tool for write operation.
This article explores a simple writing to OEM General Purpose Fuse 2 GPR2_CFG0, located in bank 47; word 376.
root@imx91evk:~# ./fuse_test read 47 0
ret: 0
fd : 3
READ Bank: 47, Word: 0, Offset: 376
SUCCESS: pread operation
resp_len = 4
resp_buf[0] = |0|
resp_buf[1] = |0|
resp_buf[2] = |0|
resp_buf[3] = |0|This fuse is protected by General Purpose 2 Fuse Lock GPR2_LOCK [2:0] in Packed_FuseIndex 291. Calculate word bits from AN14954 section 3.2 Devices with ELE-AP.
root@imx91evk:~# ./fuse_test read 1 1
ret: 0
fd : 3
READ Bank: 1, Word: 1, Offset: 9
SUCCESS: pread operation
resp_len = 4
resp_buf[0] = |93|
resp_buf[1] = |34|
resp_buf[2] = |0|
resp_buf[3] = |0|This way, GPR2_LOCK [2:0] = 010, it means that it's in Over-ride Protect and you can burn the fuse.
root@imx91evk:~# ./fuse_test write 47 0
ret: 0
fd : 3
READ Bank: 47, Word: 0, Offset: 376
SUCCESS: pread operation
resp_len = 4
resp_buf[0] = |5|
resp_buf[1] = |0|
resp_buf[2] = |0|
resp_buf[3] = |0|
INFO: Fuse previous valueWRITE Bank: 47, Word: 0, Offset: 376
Enter fuse value (e.g. 0xAA1234BB): 0x4A4F5345
You entered: 0x4A4F5345 (1246712645 decimal)
SUCCESS: pwrite operation
INFO: Please reset the device for fuse read confirmation0x4A 0x4F 0x53 0x45 are the uppercase 4 first letters of Joseph.
u-boot=> fuse read 47 0
Reading bank 47:
Word 0x00000000: 4a4f5345Conclusion.
This tool is capable of reading and burning fuses from i.MX 93 and i.MX 91, it's scalable to i.MX 9 series.
iMX95 Latest ELE firmware release, does not support programming SRK values from user space. Required runtime firmware enabling this functionality is planned for next release.
This tool is provided by SW and support teams, as is, they were developed under LF6.12.49. Under the BSD-3 license. Please confirm bank and word, if needed create a support ticket, this post is not responsible incorrect usage.
Tested in FRDM-i.MX91
Written in C
LF-6.12.49