How to write word 0 in OTP using STM32_Programmer_CLI ?

[sbg29_]

Hi,

I have a SoM based on STM32MP135c (QSMP-1351) and I try to enable the secure boot using STM32_Programmer_CLI (STM32CubeProgrammer v2.22.0)

Here is the flash layout file used before updating OTP:
#opt  Id   Name  Type  Device Offset Binary
-    0x01  fsbl-boot    Binary none  0x0   tf-a-loader.stm32
-    0x03  fip-boot    FIP   none  0x0   fip-loader.bin

I can write PKHTH without any issue:
STM32_Programmer_CLI -c port=usb1 -otp write word=0x18 value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x19 value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1a value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1b value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1c value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1d value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1e value=0x????????
STM32_Programmer_CLI -c port=usb1 -otp write word=0x1f value=0x????????

When I want to lock device, I use the command:
STM32_Programmer_CLI -c port=usb1 -otp write word=0x00 value=0x00000028

But I have the following error:
Warning: Word 0 has the access READ ONLY, it will not be programmed

Here is the status of word 0:
STM32_Programmer_CLI -c port=usb1 -otp displ
---------------------------------------------------------------------------
  ID   |    value  |   status
---------------------------------------------------------------------------
  000   |   0x00000017 | 0x30000000
                 |_[28] Shadow write sticky lock
                 |_[29] Shadow read sticky lock

The syntax to change the status of word 0 is not clear even by reading wiki : https://wiki.st.com/stm32mpu/wiki/STM32CubeProgrammer_OTP_management#Examples_with_STM32Programmer

What is the exact command (or list of commands) to make word 0 writable using CLI ?

Regards,

Sebastien

[Olivier GALLIEN]

Hi ​@sbg29_ 

 

Pay attention that enabling secure boot does not just consist to Write OTP0 ! 

This can even brick you device 

Please refer to sequence in https://wiki.st.com/stm32mpu/wiki/Device_life_cycle#STM32MP2_series 

 

To close the device, write as below the 3 OTP before a reset.

• Write 0xFF in the word 8

• Write 0xFF in the word 18.

• Write 0x100000 in the word 124 to the disabled scan state.

If these bit fields are set with different combinations than the ones listed above, then, at the next reset, the lifecycle state is seen as illegal and the device get BRICKED.

OTP can be fused in any order before reset.

stm32key command is recommended to avoid errors but any other way are possible, see below.

 

Hope it help 

Olivier 

[sbg29_]

Hi ​@Olivier GALLIEN,

Thank you for answer. It helps. I will follow your recommendation by using stm32key command in U-Boot. The SoM is based on STM32MP135c not STM32MP2 series. (OTP mapping is quite different).

Regards,

Sebastien