STM32MP15 OTP mapping

Revision as of 10:15, 1 December 2021 by Registered User (→‎Memory mapping)
Applicable for STM32MP15x lines


1. Memory mapping[edit source]

The table below gives an overview of the BSEC OTP memory mapping with useful information in the context of this Wiki reading.
OTP words 0 to 31 are called lower OTP and words 32 to 95 are called upper OTP.
Further information for the words and fields that are not explicitly described here can be found in the reference manual.

OTP word Bit field (size) Name Description
0 31-7 (25 bits) reserved
6 (1 bit) is_closed
  • 0: device is in open state, authentication is optional.
  • 1: device is in close state, authentication is mandatory.
Warning white.png Warning
The 'is_closed' bit must never be programmed to 1 on product without secure boot option available: this is indicated in the security field of the chip part number.
5-0 (6 bits) reserved
1-2 See the reference manual
3 31-30 (2 bits) HSE value
  • 0b00: HSE is autodetected
  • 0b01: HSE is 24 MHz
  • 0b10: HSE is 25 MHz
  • 0b11: HSE is 26 MHz
29-27 (3 bits) primary boot source
  • 0: No primary boot source is defined
  • 1: FMC NAND
  • 2: QSPI NOR
  • 3: eMMC
  • 4: SD card
  • 5: QSPI NAND
26-24 (3 bits) secondary boot source
  • 0: No primary boot source is defined
  • 1: FMC NAND
  • 2: QSPI NOR
  • 3: eMMC
  • 4: SD card
  • 5: QSPI NAND
23-16 (8 bits) boot source disable If different from zero each bit disables a boot source
  • 0b00000001: disable FMC NAND boot source
  • 0b00000010: disable QSPI NOR boot source
  • 0b00000100: disable eMMC™ boot source
  • 0b00001000: disable SD boot source
  • 0b00010000: disable UART boot source
  • 0b00100000: disable USB boot source
  • 0b01000000: disable QSPI NAND boot source
15 (1 bit) data cache disabling
  • 0: data cache is used by the ROM code
  • 1: data cache is not used by the ROM code
14-7 (8 bits) UART instances disabling If different from zero then each bit disables an UART instance:
  • 0b00000001: reserved
  • 0b00000010: disable USART2
  • 0b00000100: disable USART3
  • 0b00001000: disable UART4
  • 0b00010000: disable UART5
  • 0b00100000: disable UART6
  • 0b01000000: disable UART7
  • 0b10000000: disable USART8
  • 0b11111111: all UART instances are enabled
6 (1 bit) USB DP pullup disabling
  • 0: USB DP pull-up is set
  • 1: USB DP pull-up is not set
5 (1 bit) PLL disabling
  • 0: PLLs for CPU and AXI are enable on cold boot
  • 1: PLLs for CPU and AXI are not enable on cold boot
4-3 (2 bits) SD card memory interface
  • 0: SDMMC1 with default AFMux
  • 1: SDMMC1 with non default AFmux defined in OTP
  • 2: SDMMC2
2-1 (2 bits) eMMC™ memory interface
  • 0: SDMMC2 with default AFMux
  • 1: SDMMC1
  • 2: SDMMC2 with non default AFmux defined in OTP
0 (1 bit) QSPI non default AFmux
  • 0: QSPI uses default AFMux
  • 1: QSPI uses AFmux defined in OTP
4 31-0 (32 bits) monotonic counter This is an anti rollback monotonic counter. On closed devices, the ROM code checks that it is less or equal to the one stored in the loaded image header.
  • 0b1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 32
  • 0b01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 31
  • 0b...
  • 0b00000000000000000000000000000001: monotonic counter value is 1
  • 0b00000000000000000000000000000000: monotonic counter value is 0

1.1. OTP WORD 5 to 7 - AFmux configuration[edit source]

These three words contains AFmux settings that the ROM code applies in case of secure boot, after having applied the default AFmux settings of selected boot interfaces.

Bit Field Size Value Description
31-28 port1[3:0] 4 bits Bank id
0 unused
1 Bank A
2 Bank B
3 Bank C
4 Bank D
5 Bank E
6 Bank F
7 Bank G
8 Bank H
9 Bank I
10 Bank J
11 Bank K
12 Bank Z
0b1111 Invalid configuration
27-24 pin1[3:0] 4 bits 0-15 Pin Id
23-20 afmux1[3:0] 4 bits 0-15 AFmux value
19-16 mode1[3:0] 4 bits Pin Mode
0 AF ; No Pull  ; Low Speed
1 AF ; No Pull  ; Medium Speed
2 AF ; No Pull  ; High Speed
3 AF ; Pull Up  ; Low Speed
4 AF ; Pull Up  ; Medium Speed
5 AF ; Pull Up  ; High Speed
6 AF ; Pull Down  ; Low Speed
7 AF ; Pull Down  ; Medium Speed
8 AF ; Pull Down  ; High Speed
9 GPIO Output High
10 GPIO Output Low
11 GPIO Input
12 GPIO open drain ; No pull
13 GPIO open drain ; Pull Up
14 GPIO open drain ; Pull Down
15 GPIO analog mode
15-12 port0[3:0] 4 bits Bank id
0 unused
1 Bank A
2 Bank B
3 Bank C
4 Bank D
5 Bank E
6 Bank F
7 Bank G
8 Bank H
9 Bank I
10 Bank J
11 Bank K
12 Bank Z
0b1111 Invalid configuration
11-8 pin0[3:0] 4 bits 0-15 Pin Id
7-4 afmux0[3:0] 4 bits 0-15 AFmux value
3-0 mode0[3:0] 4 bits Pin Mode
0 AF ; No Pull  ; Low Speed
1 AF ; No Pull  ; Medium Speed
2 AF ; No Pull  ; High Speed
3 AF ; Pull Up  ; Low Speed
4 AF ; Pull Up  ; Medium Speed
5 AF ; Pull Up  ; High Speed
6 AF ; Pull Down  ; Low Speed
7 AF ; Pull Down  ; Medium Speed
8 AF ; Pull Down  ; High Speed
9 GPIO Output High
10 GPIO Output Low
11 GPIO Input
12 GPIO open drain ; No pull
13 GPIO open drain ; Pull Up
14 GPIO open drain ; Pull Down
15 GPIO analog mode

1.2. OTP WORD 8[edit source]

Bit Name Size Value Description
31-10 22 bits reserved
9 SSP_SUCCESS 1 bit SSP is finished
0 SSP is either not started or not finished.
1 SSP is finished.
8 SSP_REQ 1 bit SSP request
0 SSP has never been requested.
1 SSP has been requested.
7-0 8 bits reserved

1.3. OTP WORD 9 - NAND configuration[edit source]

Bit Name Size Value Description
31-31 nand_param_stored_in_otp 1 bit FMC or serial NAND parameters storage flag
0b0 NAND parameters are not stored here in OTP and are available via an ‘ONFI’ compliant get parameter command.
0b1 NAND parameters are stored here in OTP
30-29 nand_page_size[1:0] 2 bits FMC or serial NAND page size
0 Page size is 2 Kbytes
1 Page size is 4 Kbytes
2 Page size is 8 Kbytes
3 reserved
28-27 nand_block_size[1:0] 2 bits FMC or serial NAND block size
0 Block size is 64 pages
1 Block size is 128 pages
2 Block size is 256 pages
3 reserved
26-19 nand_blocks_nb[7:0] 8 bits FMC or serial NAND number of blocks
N Number of blocks of NAND in unit of 256 blocks (= N * 256 blocks)
18-18 fmc_nand_width 1 bit FMC NAND width
0 FMC NAND is 8 bits
1 FMC NAND is 16 bits
17-15 fmc_ecc_bit_nb[2:0] 3 bits FMC NAND number of ECC bits
0 No setting. In case on ONFI NAND, means ‘use value defined in parameter table’
1 1 bit ECC per 512 bytes, Hamming code
2 4 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code
3 8 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code
4 on-die ECC
14 spinand_need_plane_select 1 bit serial NAND need plane select
0 serial NAND plane select not needed.
1 serial NAND plane select needed.
13-4 reserved 10 bits - -
3 disable_ddr_power_optim 1 bit Disable DDR PLL switch off sequence
0 DDR DLL switch off sequence enabled
1 DDR DLL switch off sequence disabled.
2 disable_hse_bypass_detect 1 bit Disable HSE bypass detection
0 HSE bypass detection enabled.
1 HSE bypass detection disabled.
1 disable_hse_freq_detect 1 bit Disable HSE frequency autodetection
0 HSE frequency autodetection enabled.
1 HSE frequency autodetection disabled.
0 disable_traces 1 bit Disable traces bit
0 Bootrom trace are enabled.
1 Bootrom trace are disabled.

1.4. OTP WORD 24 to 31 - Public Key Hash (PKH)[edit source]

OTP WORD 24 to 31 contain the SHA256 hash of ECDSA public key.

OTP word Bit Field Size Description
24 31-0 pkh0[31:0] 32 bits Public Key Hash[31:0]
25 31-0 pkh1[31:0] 32 bits Public Key Hash[63:32]
26 31-0 pkh2[31:0] 32 bits Public Key Hash[95:64]
27 31-0 pkh3[31:0] 32 bits Public Key Hash[128:96]
28 31-0 pkh4[31:0] 32 bits Public Key Hash[159:128]
29 31-0 pkh5[31:0] 32 bits Public Key Hash[191:160]
30 31-0 pkh6[31:0] 32 bits Public Key Hash[223:192]
31 31-0 pkh7[31:0] 32 bits Public Key Hash[255:224]

1.5. OTP WORD 56 - RMA password[edit source]

Bit Name Size Description
31-30 2 bits reserved
29-15 rma_relock_passwd 15 bits Password required for RMA ReLock request
14-0 rma_passwd 15 bits Password required for RMA Unlock request