1. Memory mapping[edit source]
The table below gives an overview of the BSEC OTP memory mapping with useful information in the context of this Wiki reading.
OTP words 0 to 31 are called lower OTP and words 32 to 95 are called upper OTP.
Further information for the words and fields that are not explicitly described here can be found in the reference manual.
OTP word | Bit field (size) | Name | Description |
---|---|---|---|
0 | 31-7 (25 bits) | reserved | |
6 (1 bit) | is_closed | Close state
| |
5-0 (6 bits) | reserved | ||
1 | |||
2 | |||
3 | |||
4 | |||
5 | |||
6 | |||
7 | |||
8 | |||
9 | |||
10 | |||
11 |
1.1. OTP WORD 0[edit source]
Bit | Name | Size | Value | Description |
---|---|---|---|---|
31-7 | 25 bits | reserved | ||
6 | is_closed | 1 bit | Close state | |
0 | device is in open state, authentication is optional. | |||
1 | device is in close state, authentication is mandatory. | |||
5-0 | 6 bits | reserved |
1.2. OTP WORD 3[edit source]
Bit | Name | Size | Value | Description |
---|---|---|---|---|
31-30 | HSE_value | 2 bits | HSE value | |
0b00 | HSE is autodetected | |||
0b01 | HSE is 24 MHz | |||
0b10 | HSE is 25 MHz | |||
0b11 | HSE is 26 MHz | |||
29-27 | primary_boot_source | 3 bits | Primary boot source | |
If different from zero, identifies primary source used for boot | ||||
0 | No primary boot source is defined | |||
1 | FMC NAND | |||
2 | QSPI NOR | |||
3 | e•MMC™ | |||
4 | SD | |||
5 | QSPI NAND | |||
26-24 | secondary_boot_source | 3 bits | Secondary boot source | |
If different from zero, identifies secondary source used for boot | ||||
0 | No secondary boot source is defined | |||
1 | FMC NAND | |||
2 | QSPI NOR | |||
3 | e•MMC™ | |||
4 | SD | |||
5 | QSPI NAND | |||
23-16 | boot_source_disable | 8 bits | Disable boot source | |
if different from zero each bit disables a boot source | ||||
0b00000001 | disable FMC NAND boot source | |||
0b00000010 | disable QSPI NOR boot source | |||
0b00000100 | disable e•MMC™ boot source | |||
0b00001000 | disable SD boot source | |||
0b00010000 | disable UART boot source | |||
0b00100000 | disable USB boot source | |||
0b01000000 | disable QSPI NAND boot source | |||
15-15 | no_data_cache | 1 bit | Data cache enable enabling | |
If different from zero, data cache is not used by bootrom. | ||||
0 | Data cache is used by bootrom. | |||
1 | Data cache is not used by bootrom. | |||
14-7 | uart_intances_disabled | 8 bits | Uart instances disabled | |
If different from zero each bit disables an UART instance. | ||||
If all disable bits are set to 1 then all UARTs are enabled. | ||||
0b00000001 | reserved | |||
0b00000010 | disable USART2 | |||
0b00000100 | disable USART3 | |||
0b00001000 | disable UART4 | |||
0b00010000 | disable UART5 | |||
0b00100000 | disable UART6 | |||
0b01000000 | disable UART7 | |||
0b10000000 | disable USART8 | |||
6 | no_usb_dp_pullup | 1 bit | USB DP pullup enabling | |
If different from zero, USB DP pull-up is not set | ||||
0 | USB DP pull-up is set | |||
1 | USB DP pull-up is not set | |||
5 | no_cpu_pll | 1 bit | PLL enabling | |
If different from zero, PLL are not enabled | ||||
0 | PLLs for CPU/AXI are enable for cold boot | |||
1 | PLLs for CPU/AXI are not enable for cold boot | |||
4-3 | sd_if_id | 2 bits | SD Memory interface | |
If different from zero, identifies the default instance to be used for memory boot | ||||
0 | Source is default one : SDMMC1 with default AFMux | |||
1 | SDMMC1 (uses non default AFmux defined in OTP) | |||
2 | SDMMC2 | |||
2-1 | emmc_if_id | 2 bits | e•MMC™ Memory interface | |
If different from zero, identifies the default instance to be used for memory boot | ||||
0 | Source is default one : SDMMC2 with default AFMux | |||
1 | SDMMC1 | |||
2 | SDMMC2 (uses non default AFmux defined in OTP) | |||
0 | qspi_not_default_af | 1 bit | QSPI don’t use default AFmux | |
0 | QSPI uses default hard coded AFmux | |||
1 | QSPI uses AFmux defined in OTP |
1.3. OTP WORD 4 - Monotonic counter[edit source]
This is an anti rollback monotonic counter. On closed devices, the ROM code checks that it must be less or equal to the one stored in the image header.
Bit | Name | Size | Value | Description |
---|---|---|---|---|
31-0 | monotonic_val | 32 bits | Monotonic counter value | |
Gives the value of monotonic counter | ||||
0b1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 32 | |||
0b01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 31 | |||
0b001xxxxxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 30 | |||
0b0001xxxxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 29 | |||
0b00001xxxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 28 | |||
0b000001xxxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 27 | |||
0b0000001xxxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 26 | |||
0b00000001xxxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 25 | |||
0b000000001xxxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 24 | |||
0b0000000001xxxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 23 | |||
0b00000000001xxxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 22 | |||
0b000000000001xxxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 21 | |||
0b0000000000001xxxxxxxxxxxxxxxxxxx | Value of monotonic counter is 20 | |||
0b00000000000001xxxxxxxxxxxxxxxxxx | Value of monotonic counter is 19 | |||
0b000000000000001xxxxxxxxxxxxxxxxx | Value of monotonic counter is 18 | |||
0b0000000000000001xxxxxxxxxxxxxxxx | Value of monotonic counter is 17 | |||
0b00000000000000001xxxxxxxxxxxxxxx | Value of monotonic counter is 16 | |||
0b000000000000000001xxxxxxxxxxxxxx | Value of monotonic counter is 15 | |||
0b0000000000000000001xxxxxxxxxxxxx | Value of monotonic counter is 14 | |||
0b00000000000000000001xxxxxxxxxxxx | Value of monotonic counter is 13 | |||
0b000000000000000000001xxxxxxxxxxx | Value of monotonic counter is 12 | |||
0b0000000000000000000001xxxxxxxxxx | Value of monotonic counter is 11 | |||
0b00000000000000000000001xxxxxxxxx | Value of monotonic counter is 10 | |||
0b000000000000000000000001xxxxxxxx | Value of monotonic counter is 9 | |||
0b0000000000000000000000001xxxxxxx | Value of monotonic counter is 8 | |||
0b00000000000000000000000001xxxxxx | Value of monotonic counter is 7 | |||
0b000000000000000000000000001xxxxx | Value of monotonic counter is 6 | |||
0b0000000000000000000000000001xxxx | Value of monotonic counter is 5 | |||
0b00000000000000000000000000001xxx | Value of monotonic counter is 4 | |||
0b000000000000000000000000000001xx | Value of monotonic counter is 3 | |||
0b0000000000000000000000000000001x | Value of monotonic counter is 2 | |||
0b00000000000000000000000000000001 | Value of monotonic counter is 1 | |||
0b00000000000000000000000000000000 | Value of monotonic counter is 0 |
1.4. OTP WORD 5 to 7 - AFmux configuration[edit source]
These three words contains AFmux settings that the ROM code applies in case of secure boot, after having applied the default AFmux settings of selected boot interfaces.
Bit | Field | Size | Value | Description |
---|---|---|---|---|
31-28 | port1[3:0] | 4 bits | Bank id | |
0 | unused | |||
1 | Bank A | |||
2 | Bank B | |||
3 | Bank C | |||
4 | Bank D | |||
5 | Bank E | |||
6 | Bank F | |||
7 | Bank G | |||
8 | Bank H | |||
9 | Bank I | |||
10 | Bank J | |||
11 | Bank K | |||
12 | Bank Z | |||
0b1111 | Invalid configuration | |||
27-24 | pin1[3:0] | 4 bits | 0-15 | Pin Id |
23-20 | afmux1[3:0] | 4 bits | 0-15 | AFmux value |
19-16 | mode1[3:0] | 4 bits | Pin Mode | |
0 | AF ; No Pull ; Low Speed | |||
1 | AF ; No Pull ; Medium Speed | |||
2 | AF ; No Pull ; High Speed | |||
3 | AF ; Pull Up ; Low Speed | |||
4 | AF ; Pull Up ; Medium Speed | |||
5 | AF ; Pull Up ; High Speed | |||
6 | AF ; Pull Down ; Low Speed | |||
7 | AF ; Pull Down ; Medium Speed | |||
8 | AF ; Pull Down ; High Speed | |||
9 | GPIO Output High | |||
10 | GPIO Output Low | |||
11 | GPIO Input | |||
12 | GPIO open drain ; No pull | |||
13 | GPIO open drain ; Pull Up | |||
14 | GPIO open drain ; Pull Down | |||
15 | GPIO analog mode | |||
15-12 | port0[3:0] | 4 bits | Bank id | |
0 | unused | |||
1 | Bank A | |||
2 | Bank B | |||
3 | Bank C | |||
4 | Bank D | |||
5 | Bank E | |||
6 | Bank F | |||
7 | Bank G | |||
8 | Bank H | |||
9 | Bank I | |||
10 | Bank J | |||
11 | Bank K | |||
12 | Bank Z | |||
0b1111 | Invalid configuration | |||
11-8 | pin0[3:0] | 4 bits | 0-15 | Pin Id |
7-4 | afmux0[3:0] | 4 bits | 0-15 | AFmux value |
3-0 | mode0[3:0] | 4 bits | Pin Mode | |
0 | AF ; No Pull ; Low Speed | |||
1 | AF ; No Pull ; Medium Speed | |||
2 | AF ; No Pull ; High Speed | |||
3 | AF ; Pull Up ; Low Speed | |||
4 | AF ; Pull Up ; Medium Speed | |||
5 | AF ; Pull Up ; High Speed | |||
6 | AF ; Pull Down ; Low Speed | |||
7 | AF ; Pull Down ; Medium Speed | |||
8 | AF ; Pull Down ; High Speed | |||
9 | GPIO Output High | |||
10 | GPIO Output Low | |||
11 | GPIO Input | |||
12 | GPIO open drain ; No pull | |||
13 | GPIO open drain ; Pull Up | |||
14 | GPIO open drain ; Pull Down | |||
15 | GPIO analog mode |
1.5. OTP WORD 8[edit source]
Bit | Name | Size | Value | Description |
---|---|---|---|---|
31-10 | 22 bits | reserved | ||
9 | SSP_SUCCESS | 1 bit | SSP is finished | |
0 | SSP is either not started or not finished. | |||
1 | SSP is finished. | |||
8 | SSP_REQ | 1 bit | SSP request | |
0 | SSP has never been requested. | |||
1 | SSP has been requested. | |||
7-0 | 8 bits | reserved |
1.6. OTP WORD 9 - NAND configuration[edit source]
Bit | Name | Size | Value | Description |
---|---|---|---|---|
31-31 | nand_param_stored_in_otp | 1 bit | FMC or serial NAND parameters storage flag | |
0b0 | NAND parameters are not stored here in OTP and are available via an ‘ONFI’ compliant get parameter command. | |||
0b1 | NAND parameters are stored here in OTP | |||
30-29 | nand_page_size[1:0] | 2 bits | FMC or serial NAND page size | |
0 | Page size is 2 Kbytes | |||
1 | Page size is 4 Kbytes | |||
2 | Page size is 8 Kbytes | |||
3 | reserved | |||
28-27 | nand_block_size[1:0] | 2 bits | FMC or serial NAND block size | |
0 | Block size is 64 pages | |||
1 | Block size is 128 pages | |||
2 | Block size is 256 pages | |||
3 | reserved | |||
26-19 | nand_blocks_nb[7:0] | 8 bits | FMC or serial NAND number of blocks | |
N | Number of blocks of NAND in unit of 256 blocks (= N * 256 blocks) | |||
18-18 | fmc_nand_width | 1 bit | FMC NAND width | |
0 | FMC NAND is 8 bits | |||
1 | FMC NAND is 16 bits | |||
17-15 | fmc_ecc_bit_nb[2:0] | 3 bits | FMC NAND number of ECC bits | |
0 | No setting. In case on ONFI NAND, means ‘use value defined in parameter table’ | |||
1 | 1 bit ECC per 512 bytes, Hamming code | |||
2 | 4 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code | |||
3 | 8 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code | |||
4 | on-die ECC | |||
14 | spinand_need_plane_select | 1 bit | serial NAND need plane select | |
0 | serial NAND plane select not needed. | |||
1 | serial NAND plane select needed. | |||
13-4 | reserved | 10 bits | - | - |
3 | disable_ddr_power_optim | 1 bit | Disable DDR PLL switch off sequence | |
0 | DDR DLL switch off sequence enabled | |||
1 | DDR DLL switch off sequence disabled. | |||
2 | disable_hse_bypass_detect | 1 bit | Disable HSE bypass detection | |
0 | HSE bypass detection enabled. | |||
1 | HSE bypass detection disabled. | |||
1 | disable_hse_freq_detect | 1 bit | Disable HSE frequency autodetection | |
0 | HSE frequency autodetection enabled. | |||
1 | HSE frequency autodetection disabled. | |||
0 | disable_traces | 1 bit | Disable traces bit | |
0 | Bootrom trace are enabled. | |||
1 | Bootrom trace are disabled. |
1.7. OTP WORD 24 to 31 - Public Key Hash (PKH)[edit source]
OTP WORD 24 to 31 contain the SHA256 hash of ECDSA public key.
OTP word | Bit | Field | Size | Description |
---|---|---|---|---|
24 | 31-0 | pkh0[31:0] | 32 bits | Public Key Hash[31:0] |
25 | 31-0 | pkh1[31:0] | 32 bits | Public Key Hash[63:32] |
26 | 31-0 | pkh2[31:0] | 32 bits | Public Key Hash[95:64] |
27 | 31-0 | pkh3[31:0] | 32 bits | Public Key Hash[128:96] |
28 | 31-0 | pkh4[31:0] | 32 bits | Public Key Hash[159:128] |
29 | 31-0 | pkh5[31:0] | 32 bits | Public Key Hash[191:160] |
30 | 31-0 | pkh6[31:0] | 32 bits | Public Key Hash[223:192] |
31 | 31-0 | pkh7[31:0] | 32 bits | Public Key Hash[255:224] |
1.8. OTP WORD 56 - RMA password[edit source]
Bit | Name | Size | Description |
---|---|---|---|
31-30 | 2 bits | reserved | |
29-15 | rma_relock_passwd | 15 bits | Password required for RMA ReLock request |
14-0 | rma_passwd | 15 bits | Password required for RMA Unlock request |