Skip to content

OTP Fuse Configuration on i.MX

Irreversible Operation

Writing to the OTP fuse registers is irreversible and can brick your device. Please always double-check and verify what you are doing.

Fuse Register Documentation

See these tables for common fuse settings used by KED:

Please also consult the "Processor Reference Manual" for further information on the interpretation of the register values.

Examples for Accessing OTPs in U-Boot on i.MX6UL/ULL

The OTP register map of the i.MX6UL/ULL starts with address 0x400 and consists of 32 bit fuse registers. They are organized in banks of eight registers each.

Example: To access the lower part of the MAC_ADDR fuse bits at address 0x620 (according to fusemap in the Processor Reference Manual) you need to use bank (0x620 - 0x400) / 0x80 = 4 and register ((0x640 - 0x400) / 0x10) % 4 = 2.

Reading Register 0x450 (OCOTP_CFG4)

=> fuse read 0 5
Reading bank 0:

Word 0x00000005: 49002040

Reading Register 0x460 (OCOTP_CFG5)

=> fuse read 0 6
Reading bank 0:

Word 0x00000006:  00000010

Configuring Boot from SD card and SPI NOR

=> fuse prog 0 5 0x49002040
Programming bank 0 word 0x00000005 to 0x49002040...
Warning: Programming fuses is an irreversible operation!
         This may brick your system.
         Use this command only if you are sure of what you are doing!

Really perform this fuse programming? <y/N>
y

Examples for Accessing OTPs in U-Boot on i.MX8MM

The i.MX8MM OTP register map starts, as on the i.MX6UL/ULL at address 0x400 and also consists of 32-bit fuse registers. However, they are organised in banks of four registers each.

Example: To access the lower part of the MAC_ADDR fuse bits at address 0x640 (according to fusemap in the Processor Reference Manual) you need to use bank (0x640 - 0x400) / 0x40 = 9 and register ((0x640 - 0x400) / 0x10) % 4 = 0.

Reading Register 0x470 (OCOTP_BOOT_CFG0)

=> fuse read 1 3
Reading bank 1:

Word 0x00000003: 08000000

Reading Register 0x480 (OCOTP_BOOT_CFG1)

=> fuse read 2 0
Reading bank 2:

Word 0x00000000: 01000010

Configuring Boot from eMMC

=> fuse prog 1 3 0x18002020
Programming bank 1 word 0x00000003 to 0x18002020...
Warning: Programming fuses is an irreversible operation!
         This may brick your system.
         Use this command only if you are sure of what you are doing!

Really perform this fuse programming? <y/N>
y

Examples for Accessing OTPs in U-Boot on i.MX93

The OTP access on i.MX93 works differently compared to the i.MX6 and i.MX8 platforms. Internally there are two ways to access the fuse registers:

  1. Via the FSB (Fuse Status Block) Registers (read-only)
  2. Via the ELE (Edgelock Secure Enclave) Firmware

U-Boot uses the second interface (ELE) to provide access via the fuse command.

The OTP register map of the i.MX93 consists of 32 bit fuse registers. They are organized in banks of eight registers each.

Reading Register OCOTP_BOOT_CFG0

=> fuse read 3 0
Reading bank 3:

Word 0x00000000: 20120002

Reading Register OCOTP_BOOT_CFG1

=> fuse read 3 1
Reading bank 3:

Word 0x00000001: 00000001

Configuring Boot from eMMC (with Fastboot and Ack enabled)

=> fuse prog 3 0 0x20120002
Programming bank 3 word 0x00000000 to 0x20120002...
Warning: Programming fuses is an irreversible operation!
         This may brick your system.
         Use this command only if you are sure of what you are doing!

Really perform this fuse programming? <y/N>
y
=> fuse prog 3 1 0x00000001
Programming bank 3 word 0x00000001 to 0x00000001...
Warning: Programming fuses is an irreversible operation!
         This may brick your system.
         Use this command only if you are sure of what you are doing!

Really perform this fuse programming? <y/N>
y

Accessing OTPs in Linux using crucible

The content of the OTP fuses is usually exposed as NVMEM device by the Linux kernel. Instead of accessing the raw NVMEM device, you can use the crucible tool as a more convenient way of reading and writing the OTP fuses.

A OE recipe for crucible is available in recent versions of meta-oe and as a backport in meta-ked.

Please see the crucible README for further information and examples.

/sys/bus/nvmem/devices/imx-ocotp0/nvmem

Platform Support

For i.MX6 and i.MX8 there are NVMEM drivers available in the mainline kernel and upstream crucible supports these platforms. As of today (05/2025) for i.MX93 the support is incomplete:

  • Mainline Linux currently only has a NVMEM driver which uses FSB read-only access. Fuses can not be written.
  • Our downstream kernel linux-ktn has a NVMEM driver which uses the ELE API and includes write support. This will eventually also be available upstream.
  • Upstream crucible doesn't include i.MX93 support, but our KED fork does. This will eventually be upstreamed as soon as the mainline NVMEM driver is available.

Vendor Fusemap Overlays

We use some custom addons for the SoC fusemap to make access to the following OTP values easier:

  • KED UID for SoM
  • KED UID for Board
  • Second MAC address for USB Ethernet on i.MX8MM

These additions are available as overlays for the SoC fusemap in the crucible repository.

Please see the crucible documentation and the examples below on how to use these overlays.

Examples

Below are some examples for using crucible with different fuses and platforms.

Adjustments for Platforms

Please note that a lot of commands also work on other platforms if you replace the platform-specific arguments accordingly:

  • -m IMX6UL -e big -r 1
  • -m IMX8MM -e big -r 3
  • -m IMX8MP -e big -r 0
  • -m IMX93 -e big -r 5 -n /sys/bus/nvmem/devices/imx_s400_fuse0/nvmem

Reading the KED Unique-ID for the Board

On i.MX8MM using the SoC fusemap only:

crucible -m IMX8MM -e big -r 3 -b 10 read GP2

On i.MX8MM using the Kontron fusemap overlay:

crucible -m IMX8MM -e big -r 3 -b 10 -i /etc/crucible/fusemaps/kontron/KED-OSM-SL-BL-IMX8MM.yaml read KED_UID_BOARD

On i.MX93 using the Kontron fusemap overlay:

crucible -m IMX93 -e big -r 5 -b 10 -i /etc/crucible/fusemaps/kontron/OSM-BL-IMX93.yaml -n /sys/bus/nvmem/devices/imx_s400_fuse0/nvmem read KED_UID_BOARD

Writing the KED Unique-ID for the Board on i.MX8MM

On i.MX8MM using the SoC fusemap only:

crucible -m IMX8MM -e big -r 3 -b 10 blow GP2 123456789

On i.MX8MM using the Kontron fusemap overlay:

crucible -m IMX8MM -e big -r 3 -b 10 -i /etc/crucible/fusemaps/kontron/KED-OSM-SL-BL-IMX8MM.yaml blow KED_UID_BOARD 123456789

On i.MX93 using the Kontron fusemap overlay:

crucible -m IMX93 -e big -r 5 -b 10 -i /etc/crucible/fusemaps/kontron/OSM-BL-IMX93.yaml -n /sys/bus/nvmem/devices/imx_s400_fuse0/nvmem blow KED_UID_BOARD 123456789

Writing a MAC Address for Ethernet 1 on i.MX6UL/i.MX8MM

crucible -m IMX6UL -r 3 -b 16 -e big blow MAC1_ADDR 0x112233445566

crucible -m IMX8MM -r 3 -b 16 -e big blow MAC_ADDR 0x112233445566

Writing a MAC Address for Ethernet 2 on i.MX6UL/i.MX8MM

crucible -m IMX6UL -r 3 -b 16 -e big blow MAC2_ADDR 0x112233445566

Fusemap Overlay Required for i.MX8MM

The BL i.MX8MM has a secondary USB NIC. The MAC address is stored in the OTP fuses and parsed by the bootloader. Officially there is no space for a second MAC address in the i.MX8MM OTP fusemap. In reality the same space that is used by other SoCs (like i.MX8MP) can be used to store an additional address. To use this space with crucible the KED-specific overlay needs to be used.

crucible -m IMX8MM -e big -r 3 -b 16 -i /etc/crucible/fusemaps/kontron/KED-OSM-SL-BL-IMX8MM.yaml blow MAC_1_ADDR 0x112233445566