1. Article purpose[edit source]
The purpose of this article is to explain how the TAMP backup registers are used by STM32MPU Embedded Software.
2. Overview[edit source]
The STM32MP15 embeds 32 backup registers of 32 bits. A programmable border allows to split those backup registers into a secure and a non-secure group.
By default, the ROM code defines the 10 first backup registers as secure, but this secure/non-secure border can be changed later on from the secure context.
3. Backup registers usage[edit source]
This paragraph explains the default backup registers usage by the ROM code and STM32MPU Embedded Software distribution. Then, the next chapter shows the backup register mapping used to fulfill those needs.
3.1. Boot counter feature[edit source]
The BOOT_COUNTER is used by U-Boot to detect boot failures between its execution and before the complete Linux application initialization : it is incremented by U-Boot and reset by the application so, if U-Boot reads a non null value after a reset, this means that something went wrong at boot time...
3.2. Boot mode selection feature[edit source]
The BOOT_MODE register is used to propagate boot mode information from one component to the next boot stage, on cold boot or after a reset:
- The ROM code executes a serial boot if BOOT_MODE[7:0] is equal to 0xFF, as stated in the ROM code boot device selection strategy. In that case, the backup register is reset by the ROM code before proceeding with the serial boot mode. Other values are ignored by the ROM code.
- TF-A gets the selected boot device from the ROM code context in SYSRAM and writes it into BOOT_MODE[15:8] for U-Boot[1].
- U-Boot uses the BOOT_MODE register to get TF-A and Linux kernel (as explained in the next bullet) information[1] in order to select the wished boot mode ("NORMAL", "STM32PROG", ...) and build the appropriate boot command (for the selected "boot_device").
- The Linux kernel can force a reboot-mode writing into the BOOT_MODE register. This writing is done via the "reboot" Linux command, that is configured via the compatible "syscon-reboot-mode" in the device tree [2].
3.3. DDR and CPU wake up management feature[edit source]
The MAGIC NUMBER and BRANCH_ADDRESS registers allow to control the DDR initialization and the Arm® Cortex®-A7 CPU cores behaviors on system transitions:
- On cold boot, the ROM code sets the MAGIC NUMBER register to 0x0. When the FSBL TF-A BL2 reads a value different from 0xCA7FACE0 in MAGIC NUMBER, it performs a complete DDR initialization before jumping to the SSBL (U-Boot).
- Before entering in Standby with DDR in self-refresh low power mode, the PSCI framework writes the return address where the Arm® Cortex®-A7 core 0 should branch to on wake up into BRANCH_ADDRESS register and it sets the MAGIC NUMBER register to 0xCA7FACE0.
- On wakeup from Standby when the FSBL read the value 0xCA7FACE0 from the MAGIC NUMBER register, it has to perform a partial DDR initialization to exit Self-Refresh, before branching the Arm® Cortex®-A7 core 0 non-secure execution back to the address given by the BRANCH_ADDRESS register.
- On startup, the Linux® kernel starts to run on the Arm® Cortex®-A7 core 0 and it uses the PSCI framework to write the address where the core 1 has to jump in BRANCH_ADDRESS register and to set MAGIC NUMBER register to 0xCA7FACE1. Those values are then interpreted by the ROM code, as explained in secondary core boot paragraph.
3.4. Cortex-M4 wake up feature[edit source]
- by the ROM code during wakeup from Standby low power mode to recover the Cortex®-M4 firmware integrity check value and compare it to the one computed on RETRAM before starting the Cortex®-M4 again.
Notice: the ROM code knows if Cortex®-A7 and/or Cortex®-M4 have to be restarted after Standby thanks to RCC_MP_BOOTCR register, so the backup registers are not used here.
3.5. At runtime[edit source]
- Non secure backup registers
- own the boot counter and should be reset by the application after a successful startup.
- are used to store Cortex®-M4 retention firmware integrity check value before going to Standby mode, if the Cortex®-M4 needs to be started on wakeup from Standby mode by the ROM code.
- Secure backup registers
- are used by secure services to store:
4. Memory mapping[edit source]
The table below shows the backup register mapping used by STM32MPU Embedded Software.
The TAMP backup register base address is 0x5C00A100, corresponding to TAMP_BKP0R.
| TAMP register | Security | ROM / software register name | Comment |
|---|---|---|---|
| TAMP_BKP31R | Non-secure | M4_WAKEUP_AREA_HASH | This register can be used to store a SHA-256 value computed on M4_WAKEUP_AREA_LENGTH bytes in RETRAM starting from M4_WAKEUP_AREA_START, before entering in low power Standby mode. This allows the ROM code to perform an integrity check on wakeup before starting the coprocessor. |
| TAMP_BKP30R | Non-secure | ||
| TAMP_BKP29R | Non-secure | ||
| TAMP_BKP28R | Non-secure | ||
| TAMP_BKP27R | Non-secure | ||
| TAMP_BKP26R | Non-secure | ||
| TAMP_BKP25R | Non-secure | ||
| TAMP_BKP24R | Non-secure | ||
| TAMP_BKP23R | Non-secure | M4_WAKEUP_AREA_LENGTH | Amount of bytes hashed in RETRAM to compute the integrity check value |
| TAMP_BKP22R | Non-secure | M4_WAKEUP_AREA_START | Start address in RETRAM from where the integrity check value has to be computed |
| TAMP_BKP21R | Non-secure | BOOT_COUNTER | See Boot counter feature |
| TAMP_BKP20R | Non-secure | BOOT_MODE | See Boot mode selection feature |
| TAMP_BKP19R | Non-secure | (Reserved for future use) | |
| TAMP_BKP18R | Non-secure | CORTEX_M_STATE | Cortex-M state (written by Cortex-M / read by Cortex-A) |
| TAMP_BKP17R | Non-secure | COPRO_RSC_TBL_ADDRESS | Coprocessor resource table base address |
| TAMP_BKP16R | Non-secure | (Reserved for future use) | |
| TAMP_BKP15R | Non-secure | (Reserved for future use) | |
| TAMP_BKP14R | Non-secure | (Reserved for future use) | |
| TAMP_BKP13R | Non-secure | (Reserved for future use) | |
| TAMP_BKP12R | Non-secure | (Reserved for future use) | |
| TAMP_BKP11R | Non-secure | (Reserved for future use) | |
| TAMP_BKP10R | Non-secure | (Reserved for future use) | |
| TAMP_BKP9R | Secure | (Reserved for future use) | |
| TAMP_BKP8R | Secure | (Reserved for future use) | |
| TAMP_BKP7R | Secure | (Reserved for future use) | |
| TAMP_BKP6R | Secure | (Reserved for future use) | |
| TAMP_BKP5R | Secure | BRANCH_ADDRESS[1] | See DDR and CPU wake up management feature |
| TAMP_BKP4R | Secure | MAGIC_NUMBER[1] | See DDR and CPU wake up management feature |
| TAMP_BKP3R | Secure | M4_SECURITY_PERIMETER_EXTI3 | Value of AEIC TZENR3 |
| TAMP_BKP2R | Secure | M4_SECURITY_PERIMETER_EXTI2 | Value of AEIC TZENR2 |
| TAMP_BKP1R | Secure | M4_SECURITY_PERIMETER_EXTI1 | Value of AEIC TZENR1 |
| TAMP_BKP0R | Secure | WAKEUP_SEC | Wakeup parameters |
5. References[edit source]
Arm® is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere. 