STM32MP13 OTP mapping

Applicable for

STM32MP13x lines

---

1. Memory mapping

The table below gives an overview of the BSEC OTP memory mapping with useful information in the context of this Wiki reading.
OTP words 0 to 31 are called lower OTP and words 32 to 95 are called upper OTP.
Further information for the words and fields that are not explicitly described here can be found in the reference manual.

OTP word	Bit field (size)	Name	Description
0	31-7 (25 bits)	reserved
	5, 3 (2 bits)	is closed	b5,b3 = 0,0: device is in open state, authentication is optional. b5,b3 = 1,1: device is in close state, authentication is mandatory. Warning These 'is_closed' bits must never be programmed to 1 on product without secure boot option available: this is indicated in the security field of the chip part number.
	6, 4, 2-0 (5 bits)	reserved
1-2	-	-	See the reference manual
3	31-30 (2 bits)	HSE value	0b00: HSE is autodetected 0b01: HSE is 24 MHz 0b10: HSE is 25 MHz 0b11: HSE is 26 MHz
	29-27 (3 bits)	primary boot source	0: No primary boot source is defined 1: FMC NAND 2: QSPI NOR 3: e•MMC™ 4: SD card 5: QSPI NAND
	26-24 (3 bits)	secondary boot source	0: No primary boot source is defined 1: FMC NAND 2: QSPI NOR 3: e•MMC™ 4: SD card 5: QSPI NAND
	23-16 (8 bits)	boot source disable	If different from zero each bit disables a boot source 0b00000001: disable FMC NAND boot source 0b00000010: disable QSPI NOR boot source 0b00000100: disable e•MMC™ boot source 0b00001000: disable SD boot source 0b00010000: disable UART boot source 0b00100000: disable USB boot source 0b01000000: disable QSPI NAND boot source
	15 (1 bit)	data cache disabling	0: data cache is used by the ROM code 1: data cache is not used by the ROM code
	14-7 (8 bits)	UART instances disabling	If different from zero then each bit disables an UART instance 0b00000001: reserved 0b00000010: reserved 0b00000100: disable USART3 0b00001000: disable UART4 0b00010000: disable UART5 0b00100000: disable UART6 0b01000000: disable UART7 0b10000000: disable USART8 0b11111111: all UART instances are enabled
	6 (1 bit)	USB DP pullup disabling	0: USB DP pull-up is set 1: USB DP pull-up is not set
	5 (1 bit)	PLL disabling	0: PLLs for CPU and AXI are enable on cold boot 1: PLLs for CPU and AXI are not enable on cold boot
	4-3 (2 bits)	SD card memory interface	0: SDMMC1 with default AFMux 1: SDMMC1 with non default AFmux defined in OTP 2: SDMMC2 with AFmux defined in OTP
	2-1 (2 bits)	e•MMC™ memory interface	0: SDMMC2 with default AFMux 1: SDMMC1 with AFmux defined in OTP 2: SDMMC2 with non default AFmux defined in OTP
	0 (1 bit)	QSPI non default AFmux	0: QSPI uses default AFMux 1: QSPI uses AFmux defined in OTP
4	31-0 (32 bits)	monotonic counter	This is an anti rollback monotonic counter : on closed devices, the ROM code checks that it is less or equal to the one stored in the loaded image header. 0b1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 32 0b01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 31 0b... 0b00000000000000000000000000000001: monotonic counter value is 1 0b00000000000000000000000000000000: monotonic counter value is 0
5-7	31-28 (4 bits)	AFmux configuration - port1[3:0]	Bank id 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: Bank J 11: Bank K 12: Bank Z 13: not applicable 14: not applicable 0b1111: Invalid configuration
	27-24 (4 bits)	AFmux configuration - pin1[3:0]	Pin id
	23-20 (4 bits)	AFmux configuration - afmux1[3:0]	AFmux value
	19-16 (4 bits)	AFmux configuration - mode1[3:0]	Pin mode 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
	15-12 (4 bits)	AFmux configuration - port0[3:0]	Bank id 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: Bank J 11: Bank K 12: Bank Z 13: not applicable 14: not applicable 0b1111: Invalid configuration
	11-8 (4 bits)	AFmux configuration - pin0[3:0]	Pin id
	7-4 (4 bits)	AFmux configuration - afmux0[3:0]	AFmux value
	3-0 (4 bits)	AFmux configuration - mode0[3:0]	Pin mode 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
8	31-0 (32 bits)	reserved
9	31 (1 bit)	nand param stored in otp	FMC NAND parameters storage flag 0b0: NAND parameters are not stored here in OTP and are available via an ‘ONFI’ compliant get parameter command 0b1: NAND parameters are stored here in OTP Notes: serial NAND parameters must always be stored in OTP. This bit is useless for serial NAND. there are two NAND parameters banks. The value of NAND configuration distribution determines the bank to be used.
	30-29 (2 bits)	nand page size[1:0]	FMC or serial NAND page size 0: page size is 2 Kbytes 1: page size is 4 Kbytes 2: page size is 8 Kbytes 3: reserved Note: this parameter is part of NAND parameters bank1.
	28-27 (2 bits)	nand block size[1:0]	FMC or serial NAND block size 0: block size is 64 pages 1: block size is 128 pages 2: block size is 256 pages 3: reserved Note: this parameter is part of NAND parameters bank1.
	26-19 (8 bits)	nand block nb[7:0]	FMC or serial NAND number of blocks in unit of 256 blocks (nb blocks = N * 256)
	18 (1 bit)	fmc nand width	FMC NAND width 0: FMC NAND is 8 bits 1: FMC NAND is 16 bits Note: this parameter is part of NAND parameters bank1.
	17-15 (3 bits)	fmc ecc bit nb[2:0]	FMC NAND number of ECC bits 0: no setting. In case of ONFI NAND, this means ‘use value defined in parameter table’ 1: 1 bit ECC per 512 bytes, Hamming code 2: 4 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 3: 8 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 4: on-die ECC Note: this parameter is part of NAND parameters bank1.
	14 (1 bit)	spinand needs plane select	Serial NAND needs plane select 0: serial NAND plane select not needed 1: serial NAND plane select needed Note: this parameter is part of NAND parameters bank1.
	13-8 (6 bits)	reserved
	7 (1 bit)	FSBL decryption priority	0: use CRYP to priorise speed 1: use SAES to priorise security
	6 (1 bit)	SSP success	0: SSP is either not started or not finished 1: SSP is finished
	5 (1 bit)	SSP request	0: SSP has never been requested 1: SSP has been requested
	4 (1 bit)	eMMC 128KB boot partition support	0: BootROM does not support eMMC with 128KBytes boot partition 1: BootROM supports eMMC with 128KBytes boot partition
	3 (1 bit)	disable ddr power optim	Disable DDR PLL switch off sequence 0: DDR DLL switch off sequence enabled 1: DDR DLL switch off sequence disabled
	2 (1 bit)	disable HSE bypass detection	0: HSE bypass detection enabled 1: HSE bypass detection disabled
	1 (1 bit)	disable HSE frequency autodetection	0: HSE frequency autodetection enabled 1: HSE frequency autodetection disabled
	0 (1 bit)	disable ROM code traces	0: ROM code traces enabled 1: ROM code traces disabled
10	31-18 (14 bits)	reserved
	17-16 (2 bits)	nand page size[1:0]	NAND parameters bank2 : FMC or serial NAND page size 0: page size is 2 Kbytes 1: page size is 4 Kbytes 2: page size is 8 Kbytes 3: reserved
	15-14 (2 bits)	nand block size[1:0]	NAND parameters bank2 : FMC or serial NAND block size 0: block size is 64 pages 1: block size is 128 pages 2: block size is 256 pages 3: reserved
	13-6 (8 bits)	nand block nb[7:0]	NAND parameters bank2 : FMC or serial NAND number of blocks in unit of 256 blocks (nb blocks = N * 256)
	5 (1 bit)	fmc nand width	NAND parameters bank2 : FMC NAND width 0: FMC NAND is 8 bits 1: FMC NAND is 16 bits
	4-2 (3 bits)	fmc ecc bit nb[2:0]	NAND parameters bank2 : FMC NAND number of ECC bits 0: no setting. In case of ONFI NAND, this means ‘use value defined in parameter table’ 1: 1 bit ECC per 512 bytes, Hamming code 2: 4 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 3: 8 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 4: on-die ECC
	1 (1 bit)	spinand needs plane select	NAND parameters bank2 : serial NAND needs plane select 0: serial NAND plane select not needed 1: serial NAND plane select needed
	0 (1 bit)	NAND configuration distribution	Distribution of NAND parameters bank1 and bank2. 0: FMC NAND configuration in bank2 / serial NAND configuration in bank1 1: FMC NAND configuration in bank1 / serial NAND configuration in bank2
11-21	-	-	See the reference manual
22	31-8 (24 bits)	reserved
	7-0 (8 bits)	signing key id monotonic counter	This is an key revocation monotonic counter used by the ROM to checks that it is less or equal to the active signing key id stored in the loaded image header. 0b1xxxxxxx: monotonic counter value is 8 0b01xxxxxx: monotonic counter value is 7 0b... 0b00000001: monotonic counter value is 1 0b00000000: monotonic counter value is 0
23	-	-	See the reference manual
24	31-0 (32 bits)	PKHTH[31:0]	The Public Key Hashes Table Hash (PKHTH) is the SHA256 hash of the 8 SHA256 hashes of the 8 ECDSA public keys usable for the Secure boot
25	31-0 (32 bits)	PKHTH[63:32]
26	31-0 (32 bits)	PKHTH[95:64]
27	31-0 (32 bits)	PKHTH[128:96]
28	31-0 (32 bits)	PKHTH[159:128]
29	31-0 (32 bits)	PKHTH[191:160]
30	31-0 (32 bits)	PKHTH[223:192]
31	31-0 (32 bits)	PKHTH[255:224]
32-55	-	-	See the reference manual
56	31-0 (32 bits)	rma unlock passwd	Password required for RMA unlock request
57	31-0	mac1[47:16]	ETH MAC addresses for STMicroelectronics boards
58	15-0	mac1[15:0]
	31-16	mac2[47:32]
59	31-0	mac2[31:0]
60-91	-	-	See the reference manual
92	31-0 (32 bits)	EDMK[31:0]	The Encryption Decryption Master Key (EDMK) is used in combination with the derivation constant stored in the header file to derive the FSBL decryption key.
93	31-0 (32 bits)	EDMK[63:32]
94	31-0 (32 bits)	EDMK[95:64]
95	31-0 (32 bits)	EDMK[128:96]

One time programmed

High speed external oscillator (STM32 clock source)

Multimedia card

SD memory card (https://www.sdcard.org)

Secure digital

Universal asynchronous receiver/transmitter

Read only memory

Central processing unit

GPIO alternate function

General-purpose input/output (A realization of open ended transmission between devices on an embedded level. These pins available on a processor can be programmed to be used to either accept input or provide output to external devices depending on user desires and applications requirements.)

Open NAND flash interface (The ONFI working group, acronym for Open NAND flash interface, was founded in 2005. The group’s mission consists in creating a common industry standard for NAND Flash interfaces, to simplify integration of NAND Flash memory into consumer electronics (CE) devices and computing platforms. ST is one of the co-founder companies together with Hynix, Intel, Micron, Phison and Sony.)

Error correction capability or Elliptic curve cryptography, meaning depends on context

First stage boot loader

Cryptographic processor

Secure secret provisioning

Former spelling for e•MMC ('e' in italic)

Doubledata rate (memory domain)

Public key hash table hash, used for secure boot - NEW

Elliptic curve digital signature algorithm

Return material analysis

Encryption Decryption master key, used for secure boot - NEW

One time programmed

High speed external oscillator (STM32 clock source)

Multimedia card

SD memory card (https://www.sdcard.org)

Secure digital

Universal asynchronous receiver/transmitter

Read only memory

Central processing unit

GPIO alternate function

General-purpose input/output (A realization of open ended transmission between devices on an embedded level. These pins available on a processor can be programmed to be used to either accept input or provide output to external devices depending on user desires and applications requirements.)

Open NAND flash interface (The ONFI working group, acronym for Open NAND flash interface, was founded in 2005. The group’s mission consists in creating a common industry standard for NAND Flash interfaces, to simplify integration of NAND Flash memory into consumer electronics (CE) devices and computing platforms. ST is one of the co-founder companies together with Hynix, Intel, Micron, Phison and Sony.)

Error correction capability or Elliptic curve cryptography, meaning depends on context

First stage boot loader

Cryptographic processor

Secure secret provisioning

Former spelling for e•MMC ('e' in italic)

Doubledata rate (memory domain)

Public key hash table hash, used for secure boot - NEW

Elliptic curve digital signature algorithm

Return material analysis

Encryption Decryption master key, used for secure boot - NEW

Flash memory shortened to gain space in titles, tables and block diagrams

Flash memories combine high density and cost effectiveness of EPROMs with the electrical erasability of EEPROMs. For this reason, the Flash memory market is one of the most exciting areas of the semiconductor industry today and new applications requiring in system reprogramming, such as cellular telephones, automotive engine management systems, hard disk drives, PC BIOS software for Plug & Play, digital TV, set top boxes, fax and other modems, PC cards and multimedia CD-ROMs, offer the prospect of very high volume demand.