STM32MP15 OTP mapping

Revision as of 11:54, 1 December 2021 by Registered User (→‎Memory mapping)
Applicable for STM32MP15x lines


1. Memory mapping[edit source]

The table below gives an overview of the BSEC OTP memory mapping with useful information in the context of this Wiki reading.
OTP words 0 to 31 are called lower OTP and words 32 to 95 are called upper OTP.
Further information for the words and fields that are not explicitly described here can be found in the reference manual.

OTP word Bit field (size) Name Description
0 31-7 (25 bits) reserved
6 (1 bit) is closed
  • 0: device is in open state, authentication is optional.
  • 1: device is in close state, authentication is mandatory.
Warning white.png Warning
The 'is_closed' bit must never be programmed to 1 on product without secure boot option available: this is indicated in the security field of the chip part number.
5-0 (6 bits) reserved
1-2 See the reference manual
3 31-30 (2 bits) HSE value
  • 0b00: HSE is autodetected
  • 0b01: HSE is 24 MHz
  • 0b10: HSE is 25 MHz
  • 0b11: HSE is 26 MHz
29-27 (3 bits) primary boot source
  • 0: No primary boot source is defined
  • 1: FMC NAND
  • 2: QSPI NOR
  • 3: eMMC
  • 4: SD card
  • 5: QSPI NAND
26-24 (3 bits) secondary boot source
  • 0: No primary boot source is defined
  • 1: FMC NAND
  • 2: QSPI NOR
  • 3: eMMC
  • 4: SD card
  • 5: QSPI NAND
23-16 (8 bits) boot source disable If different from zero each bit disables a boot source
  • 0b00000001: disable FMC NAND boot source
  • 0b00000010: disable QSPI NOR boot source
  • 0b00000100: disable eMMC™ boot source
  • 0b00001000: disable SD boot source
  • 0b00010000: disable UART boot source
  • 0b00100000: disable USB boot source
  • 0b01000000: disable QSPI NAND boot source
15 (1 bit) data cache disabling
  • 0: data cache is used by the ROM code
  • 1: data cache is not used by the ROM code
14-7 (8 bits) UART instances disabling If different from zero then each bit disables an UART instance
  • 0b00000001: reserved
  • 0b00000010: disable USART2
  • 0b00000100: disable USART3
  • 0b00001000: disable UART4
  • 0b00010000: disable UART5
  • 0b00100000: disable UART6
  • 0b01000000: disable UART7
  • 0b10000000: disable USART8
  • 0b11111111: all UART instances are enabled
6 (1 bit) USB DP pullup disabling
  • 0: USB DP pull-up is set
  • 1: USB DP pull-up is not set
5 (1 bit) PLL disabling
  • 0: PLLs for CPU and AXI are enable on cold boot
  • 1: PLLs for CPU and AXI are not enable on cold boot
4-3 (2 bits) SD card memory interface
  • 0: SDMMC1 with default AFMux
  • 1: SDMMC1 with non default AFmux defined in OTP
  • 2: SDMMC2
2-1 (2 bits) eMMC™ memory interface
  • 0: SDMMC2 with default AFMux
  • 1: SDMMC1
  • 2: SDMMC2 with non default AFmux defined in OTP
0 (1 bit) QSPI non default AFmux
  • 0: QSPI uses default AFMux
  • 1: QSPI uses AFmux defined in OTP
4 31-0 (32 bits) monotonic counter This is an anti rollback monotonic counter : on closed devices, the ROM code checks that it is less or equal to the one stored in the loaded image header.
  • 0b1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 32
  • 0b01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 31
  • 0b...
  • 0b00000000000000000000000000000001: monotonic counter value is 1
  • 0b00000000000000000000000000000000: monotonic counter value is 0
5-7 31-28 (4 bits) AFmux configuration - port1[3:0] Bank id
  • 0: unused
  • 1: Bank A
  • 2: Bank B
  • 3: Bank C
  • 4: Bank D
  • 5: Bank E
  • 6: Bank F
  • 7: Bank G
  • 8: Bank H
  • 9: Bank I
  • 10: Bank J
  • 11: Bank K
  • 12: Bank Z
  • 0b1111: Invalid configuration
27-24 (4 bits) AFmux configuration - pin1[3:0] Pin id
23-20 (4 bits) AFmux configuration - afmux1[3:0] AFmux value
19-16 (4 bits) AFmux configuration - mode1[3:0] Pin mode
  • 0: AF; No Pull; Low Speed
  • 1: AF; No Pull; Medium Speed
  • 2: AF; No Pull; High Speed
  • 3: AF; Pull Up; Low Speed
  • 4: AF; Pull Up; Medium Speed
  • 5: AF; Pull Up; High Speed
  • 6: AF; Pull Down; Low Speed
  • 7: AF; Pull Down; Medium Speed
  • 8: AF; Pull Down; High Speed
  • 9: GPIO Output High
  • 10: GPIO Output Low
  • 11: GPIO Input
  • 12: GPIO open drain; No pull
  • 13: GPIO open drain; Pull Up
  • 14: GPIO open drain; Pull Down
  • 15: GPIO analog mode
15-12 (4 bits) AFmux configuration - port0[3:0] Bank id
  • 0: unused
  • 1: Bank A
  • 2: Bank B
  • 3: Bank C
  • 4: Bank D
  • 5: Bank E
  • 6: Bank F
  • 7: Bank G
  • 8: Bank H
  • 9: Bank I
  • 10: Bank J
  • 11: Bank K
  • 12: Bank Z
  • 0b1111: Invalid configuration
11-8 (4 bits) AFmux configuration - pin0[3:0] Pin id
7-4 (4 bits) AFmux configuration - afmux0[3:0] AFmux value
3-0 (4 bits) AFmux configuration - mode0[3:0] Pin mode
  • 0: AF; No Pull; Low Speed
  • 1: AF; No Pull; Medium Speed
  • 2: AF; No Pull; High Speed
  • 3: AF; Pull Up; Low Speed
  • 4: AF; Pull Up; Medium Speed
  • 5: AF; Pull Up; High Speed
  • 6: AF; Pull Down; Low Speed
  • 7: AF; Pull Down; Medium Speed
  • 8: AF; Pull Down; High Speed
  • 9: GPIO Output High
  • 10: GPIO Output Low
  • 11: GPIO Input
  • 12: GPIO open drain; No pull
  • 13: GPIO open drain; Pull Up
  • 14: GPIO open drain; Pull Down
  • 15: GPIO analog mode
8 31-10 (22 bits) reserved
9 (1 bit) SSP success
  • 0: SSP is either not started or not finished
  • 1: SSP is finished
8 (1 bit) SSP request
  • 0: SSP has never been requested
  • 1: SSP has been requested
7-0 (8 bits) reserved

1.1. OTP WORD 9 - NAND configuration[edit source]

Bit Name Size Value Description
31-31 nand_param_stored_in_otp 1 bit FMC or serial NAND parameters storage flag
0b0 NAND parameters are not stored here in OTP and are available via an ‘ONFI’ compliant get parameter command.
0b1 NAND parameters are stored here in OTP
30-29 nand_page_size[1:0] 2 bits FMC or serial NAND page size
0 Page size is 2 Kbytes
1 Page size is 4 Kbytes
2 Page size is 8 Kbytes
3 reserved
28-27 nand_block_size[1:0] 2 bits FMC or serial NAND block size
0 Block size is 64 pages
1 Block size is 128 pages
2 Block size is 256 pages
3 reserved
26-19 nand_blocks_nb[7:0] 8 bits FMC or serial NAND number of blocks
N Number of blocks of NAND in unit of 256 blocks (= N * 256 blocks)
18-18 fmc_nand_width 1 bit FMC NAND width
0 FMC NAND is 8 bits
1 FMC NAND is 16 bits
17-15 fmc_ecc_bit_nb[2:0] 3 bits FMC NAND number of ECC bits
0 No setting. In case on ONFI NAND, means ‘use value defined in parameter table’
1 1 bit ECC per 512 bytes, Hamming code
2 4 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code
3 8 bit ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code
4 on-die ECC
14 spinand_need_plane_select 1 bit serial NAND need plane select
0 serial NAND plane select not needed.
1 serial NAND plane select needed.
13-4 reserved 10 bits - -
3 disable_ddr_power_optim 1 bit Disable DDR PLL switch off sequence
0 DDR DLL switch off sequence enabled
1 DDR DLL switch off sequence disabled.
2 disable_hse_bypass_detect 1 bit Disable HSE bypass detection
0 HSE bypass detection enabled.
1 HSE bypass detection disabled.
1 disable_hse_freq_detect 1 bit Disable HSE frequency autodetection
0 HSE frequency autodetection enabled.
1 HSE frequency autodetection disabled.
0 disable_traces 1 bit Disable traces bit
0 Bootrom trace are enabled.
1 Bootrom trace are disabled.

1.2. OTP WORD 24 to 31 - Public Key Hash (PKH)[edit source]

OTP WORD 24 to 31 contain the SHA256 hash of ECDSA public key.

OTP word Bit Field Size Description
24 31-0 pkh0[31:0] 32 bits Public Key Hash[31:0]
25 31-0 pkh1[31:0] 32 bits Public Key Hash[63:32]
26 31-0 pkh2[31:0] 32 bits Public Key Hash[95:64]
27 31-0 pkh3[31:0] 32 bits Public Key Hash[128:96]
28 31-0 pkh4[31:0] 32 bits Public Key Hash[159:128]
29 31-0 pkh5[31:0] 32 bits Public Key Hash[191:160]
30 31-0 pkh6[31:0] 32 bits Public Key Hash[223:192]
31 31-0 pkh7[31:0] 32 bits Public Key Hash[255:224]

1.3. OTP WORD 56 - RMA password[edit source]

Bit Name Size Description
31-30 2 bits reserved
29-15 rma_relock_passwd 15 bits Password required for RMA ReLock request
14-0 rma_passwd 15 bits Password required for RMA Unlock request