STM32MP13 OTP mapping

Applicable for

STM32MP13x lines

---

1. Memory mapping

The table below gives an overview of the BSEC OTP memory mapping with useful information in the context of this article/page reading.
OTP words 0 to 31 are called lower OTP and words 32 to 95 are called upper OTP.
Further information for the words and fields that are not explicitly described here can be found in the reference manual.

OTP word	Bit field (size)	Name	Description
0	31-7 (25 bits)	reserved
	5, 3 (2 bits)	is closed	Expand b5,b3 = 0,0: device is in open state, authentication is optional. b5,b3 = 1,1: device is in close state, authentication is mandatory. Warning These 'is_closed' bits must never be programmed to 1 on product without secure boot option available: this is indicated in the security field of the chip part number.
	6, 4, 2-0 (5 bits)	reserved
1-2	-	-	See the reference manual
3	31-30 (2 bits)	HSE value	Expand 0b00: HSE is autodetected. 0b01: HSE is 24 MHz. 0b10: HSE is 25 MHz. 0b11: HSE is 26 MHz.
	29-27 (3 bits)	primary boot source	Expand 0: No primary boot source is defined. 1: FMC NAND 2: QSPI NOR 3: e•MMC™ 4: SD card 5: QSPI NAND
	26-24 (3 bits)	secondary boot source	Expand 0: No primary boot source is defined. 1: FMC NAND 2: QSPI NOR 3: e•MMC™ 4: SD card 5: QSPI NAND
	23-16 (8 bits)	boot source disable	If it is different from zero, each bit disables a boot source. Expand 0b00000001: disable FMC NAND boot source 0b00000010: disable QSPI NOR boot source 0b00000100: disable e•MMC™ boot source 0b00001000: disable SD boot source 0b00010000: disable UART boot source 0b00100000: disable USB boot source 0b01000000: disable QSPI NAND boot source
	15 (1 bit)	data cache disabling	Expand 0: data cache is used by the ROM code. 1: data cache is not used by the ROM code.
	14-7 (8 bits)	UART instances boot source disabling	If different from zero then each bit disables an UART instance Expand 0b00000001: reserved 0b00000010: reserved 0b00000100: disable USART3 0b00001000: disable UART4 0b00010000: disable UART5 0b00100000: disable UART6 0b01000000: disable UART7 0b10000000: disable USART8 0b11111111: all UART instances are enabled.
	6 (1 bit)	USB DP pullup disabling	Expand 0: USB DP pull-up is set. 1: USB DP pull-up is not set.
	5 (1 bit)	PLL disabling	Expand 0: PLLs for CPU and AXI are enable on cold boot. 1: PLLs for CPU and AXI are not enable on cold boot.
	4-3 (2 bits)	SD card memory interface	Expand 0: SDMMC1 with default AFMux 1: SDMMC1 with non default AFmux defined in OTP 2: SDMMC2 with AFmux defined in OTP
	2-1 (2 bits)	e•MMC™ memory interface	Expand 0: SDMMC2 with default AFMux 1: SDMMC1 with AFmux defined in OTP 2: SDMMC2 with non default AFmux defined in OTP
	0 (1 bit)	QSPI non default AFmux	Expand 0: QSPI uses default AFMux. 1: QSPI uses AFmux defined in OTP.
4	31-0 (32 bits)	monotonic counter	This is an anti rollback monotonic counter. On closed devices, the ROM code checks if it is less or equal to the one stored in the loaded image header. Expand 0b1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 32. 0b01xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: monotonic counter value is 31. 0b... 0b00000000000000000000000000000001: monotonic counter value is 1. 0b00000000000000000000000000000000: monotonic counter value is 0.
5	31-28 (4 bits)	AFmux configuration - port1[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	27-24 (4 bits)	AFmux configuration - pin1[3:0]	Pin id
	23-20 (4 bits)	AFmux configuration - afmux1[3:0]	AFmux value
	19-16 (4 bits)	AFmux configuration - mode1[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
	15-12 (4 bits)	AFmux configuration - port0[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	11-8 (4 bits)	AFmux configuration - pin0[3:0]	Pin id
	7-4 (4 bits)	AFmux configuration - afmux0[3:0]	AFmux value
	3-0 (4 bits)	AFmux configuration - mode0[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
6	31-28 (4 bits)	AFmux configuration - port3[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	27-24 (4 bits)	AFmux configuration - pin3[3:0]	Pin id
	23-20 (4 bits)	AFmux configuration - afmux3[3:0]	AFmux value
	19-16 (4 bits)	AFmux configuration - mode3[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
	15-12 (4 bits)	AFmux configuration - port2[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	11-8 (4 bits)	AFmux configuration - pin2[3:0]	Pin id
	7-4 (4 bits)	AFmux configuration - afmux2[3:0]	AFmux value
	3-0 (4 bits)	AFmux configuration - mode2[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
7	31-28 (4 bits)	AFmux configuration - port5[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	27-24 (4 bits)	AFmux configuration - pin5[3:0]	Pin id
	23-20 (4 bits)	AFmux configuration - afmux5[3:0]	AFmux value
	19-16 (4 bits)	AFmux configuration - mode5[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
	15-12 (4 bits)	AFmux configuration - port4[3:0]	Bank id Expand 0: unused 1: Bank A 2: Bank B 3: Bank C 4: Bank D 5: Bank E 6: Bank F 7: Bank G 8: Bank H 9: Bank I 10: not applicable 11: not applicable 12: not applicable 13: not applicable 14: not applicable 0b1111: Invalid configuration
	11-8 (4 bits)	AFmux configuration - pin4[3:0]	Pin id
	7-4 (4 bits)	AFmux configuration - afmux4[3:0]	AFmux value
	3-0 (4 bits)	AFmux configuration - mode4[3:0]	Pin mode Expand 0: AF; No Pull; Low Speed 1: AF; No Pull; Medium Speed 2: AF; No Pull; High Speed 3: AF; Pull Up; Low Speed 4: AF; Pull Up; Medium Speed 5: AF; Pull Up; High Speed 6: AF; Pull Down; Low Speed 7: AF; Pull Down; Medium Speed 8: AF; Pull Down; High Speed 9: GPIO Output High 10: GPIO Output Low 11: GPIO Input 12: GPIO open drain; No pull 13: GPIO open drain; Pull Up 14: GPIO open drain; Pull Down 15: GPIO analog mode
8	31-0 (32 bits)	reserved
9	31 (1 bit)	nand param stored in otp	FMC NAND parameters storage flag Expand 0b0: NAND parameters are not stored here in OTP and are available via an ‘ONFI’ compliant get parameter command. 0b1: NAND parameters are stored here in OTP. Notes: serial NAND parameters must always be stored in OTP. This bit is useless for serial NAND. there are two NAND parameters banks. The value of NAND configuration distribution determines the bank to be used.
	30-29 (2 bits)	nand page size[1:0]	FMC or serial NAND page size Expand 0: page size is 2 Kbytes. 1: page size is 4 Kbytes. 2: page size is 8 Kbytes. 3: reserved Note: this parameter is part of NAND parameters bank1.
	28-27 (2 bits)	nand block size[1:0]	FMC or serial NAND block size Expand 0: block size is 64 pages. 1: block size is 128 pages. 2: block size is 256 pages. 3: reserved Note: this parameter is part of NAND parameters bank1.
	26-19 (8 bits)	nand block nb[7:0]	FMC or serial NAND number of blocks in unit of 256 blocks (nb blocks = N * 256)
	18 (1 bit)	fmc nand width	FMC NAND width Expand 0: FMC NAND is 8 bits. 1: FMC NAND is 16 bits. Note: this parameter is part of NAND parameters bank1.
	17-15 (3 bits)	fmc ecc bit nb[2:0]	FMC NAND number of ECC bits Expand 0: no setting. In case of ONFI NAND, this means ‘use value defined in parameter table’. 1: 1 bit ECC per 512 bytes, Hamming code 2: 4 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 3: 8 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 4: on-die ECC Note: this parameter is part of NAND parameters bank1.
	14 (1 bit)	spinand needs plane select	Serial NAND needs plane select. Expand 0: serial NAND plane select is not needed. 1: serial NAND plane select is needed. Note: this parameter is part of NAND parameters bank1.
	13-8 (6 bits)	reserved
	7 (1 bit)	FSBL decryption priority	Expand 0: use CRYP to prioritize speed. 1: use SAES to prioritize security.
	6 (1 bit)	SSP success	Expand 0: SSP is either not started or not finished. 1: SSP is finished.
	5 (1 bit)	SSP request	Expand 0: SSP has never been requested. 1: SSP has been requested.
	4 (1 bit)	eMMC 128KB boot partition support	Expand 0: BootROM does not support eMMC with 128KBytes boot partition. 1: BootROM supports eMMC with 128KBytes boot partition.
	3 (1 bit)	disable ddr power optim	Disable DDR PLL switch off sequence Expand 0: DDR DLL switch off sequence is enabled. 1: DDR DLL switch off sequence is disabled.
	2 (1 bit)	disable HSE bypass detection	Expand 0: HSE bypass detection is enabled. 1: HSE bypass detection is disabled.
	1 (1 bit)	disable HSE frequency autodetection	Expand 0: HSE frequency autodetection is enabled. 1: HSE frequency autodetection is disabled.
	0 (1 bit)	disable ROM code traces	Expand 0: ROM code traces is enabled. 1: ROM code traces is disabled.
10	31-21 (11 bits)	reserved
	20-18 (3 bits)	rng hctr value	RNG HCTR value Expand 0:default RNG value, RNG_HTCR not modified. 1: 0xA2B3 (unsigned long) 2: 0xAA74 (unsigned long) 3: 0xA6BA (unsigned long) 4: 0x9AAE (unsigned long) 5: 0x72AC (unsigned long) 6: 0xAAC7 (unsigned long) Other values: default RNG value, RNG_HTCR not modified.
	17-16 (2 bits)	nand page size[1:0]	NAND parameters bank2 : FMC or serial NAND page size Expand 0: page size is 2 Kbytes. 1: page size is 4 Kbytes. 2: page size is 8 Kbytes. 3: reserved
	15-14 (2 bits)	nand block size[1:0]	NAND parameters bank2 : FMC or serial NAND block size Expand 0: block size is 64 pages. 1: block size is 128 pages. 2: block size is 256 pages. 3: reserved
	13-6 (8 bits)	nand block nb[7:0]	NAND parameters bank2 : FMC or serial NAND number of blocks in unit of 256 blocks (nb blocks = N * 256)
	5 (1 bit)	fmc nand width	NAND parameters bank2 : FMC NAND width Expand 0: FMC NAND is 8 bits. 1: FMC NAND is 16 bits.
	4-2 (3 bits)	fmc ecc bit nb[2:0]	NAND parameters bank2 : FMC NAND number of ECC bits Expand 0: no setting. In case of ONFI NAND, this means ‘use value defined in parameter table’. 1: 1 bit ECC per 512 bytes, Hamming code 2: 4 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 3: 8 bits ECC per 512 bytes of data, BCH (Bose, Chaudhuri and Hocquenghem) code 4: on-die ECC
	1 (1 bit)	spinand needs plane select	NAND parameters bank2 : serial NAND needs plane select. Expand 0: serial NAND plane select is not needed. 1: serial NAND plane select is needed.
	0 (1 bit)	NAND configuration distribution	Distribution of NAND parameters bank1 and bank2. Expand 0: FMC NAND configuration in bank2 / serial NAND configuration in bank1 1: FMC NAND configuration in bank1 / serial NAND configuration in bank2
11-21	-	-	See the reference manual.
22	31-8 (24 bits)	reserved
	7-0 (8 bits)	signing key id monotonic counter	This is a key revocation monotonic counter used by the ROM to check if it is less or equal to the active signing key id stored in the loaded image header. Expand 0b1xxxxxxx: monotonic counter value is 8 0b01xxxxxx: monotonic counter value is 7 0b... 0b00000001: monotonic counter value is 1 0b00000000: monotonic counter value is 0
23	-	-	See the reference manual.
24	31-0 (32 bits)	PKHTH1	The Public Key Hashes Table Hash (PKHTH) is the SHA256 hash of the 8 SHA256 hashes of the 8 ECDSA public keys usable for the secure boot. If hash = 01 02 03 04 05 06 07 08… then PKHTH1 = 0x01020304, PKHTH2 = 0x05060708, etc,…
25	31-0 (32 bits)	PKHTH2
26	31-0 (32 bits)	PKHTH3
27	31-0 (32 bits)	PKHTH4
28	31-0 (32 bits)	PKHTH5
29	31-0 (32 bits)	PKHTH6
30	31-0 (32 bits)	PKHTH7
31	31-0 (32 bits)	PKHTH8
32-55	-	-	See the reference manual.
56	31-0 (32 bits)	rma unlock passwd	A password is required for RMA unlock request.
57	31-0	mac1[4 first octets]	ETH MAC addresses for STMicroelectronics boards, list of octets
58	15-0	mac1[2 last octets]
	31-16	mac2[2 first octets]
59	31-0	mac2[4 last octets]
60-91	-	-	See the reference manual.
92	31-0 (32 bits)	EDMK[31:0]	The Encryption Decryption Master Key (EDMK) is used in combination with the derivation constant stored in the header file to derive the FSBL decryption key. This key must use Format 1.
93	31-0 (32 bits)	EDMK[63:32]
94	31-0 (32 bits)	EDMK[95:64]
95	31-0 (32 bits)	EDMK[128:96]

1.1. Key storage in OTP

Keys are represented as a string of byte to be stored in consecutive OTP words.

For example a 64-bit key (0xAABBCCDDEEFF5566) is stored into two consecutive OTP words KEY0 and KEY1.

A key is stored in OTP words using one of the following formats

• Format 1 KEY0 = 0xAABBCCDD, KEY1 = 0xEEFF5566

• Format 2 KEY0 = 0xDDCCBBAA, KEY1 = 0x6655FFEE

• Format 3 KEY0 = 0xEEFF5566, KEY1 = 0xAABBCCDD

One time programmed

High speed external oscillator (STM32 clock source)

Multimedia card

SD memory card (https://www.sdcard.org)

Secure digital

Universal asynchronous receiver/transmitter

Read only memory

Central processing unit

GPIO alternate function

General-purpose input/output (A realization of open ended transmission between devices on an embedded level. These pins available on a processor can be programmed to be used to either accept input or provide output to external devices depending on user desires and applications requirements.)

Open NAND flash interface (The ONFI working group, acronym for Open NAND flash interface, was founded in 2005. The group’s mission consists in creating a common industry standard for NAND Flash interfaces, to simplify integration of NAND Flash memory into consumer electronics (CE) devices and computing platforms. ST is one of the co-founder companies together with Hynix, Intel, Micron, Phison and Sony.)

Error correction capability or Elliptic curve cryptography, meaning depends on context

First stage boot loader

Cryptographic processor

Secure secret provisioning

Former spelling for e•MMC ('e' in italic)

Doubledata rate (memory domain)

Random number generator

Public key hash table hash, used for secure boot - NEW

Elliptic curve digital signature algorithm

Return material analysis

Encryption decryption master key, used for secure boot - NEW