STM32L476 OTP area security policy question

[Venkatesh-8559]

Hello,
I am working with the STM32L476 and would like some clarification regarding the One-Time Programmable (OTP) area.
From the reference manual, I understand that STM32L4 devices provide 1 KB of user OTP memory (128 double words). I would like to better understand the following:
What exactly is stored in the OTP area?

Is the OTP region purely user-programmable, or does ST also store factory calibration or security-related data in this region?

Is OTP used internally by the MCU for enforcing Flash security mechanisms such as RDP, WRP, or PCROP, or is it strictly for user data?

How is OTP protected ?

I am trying to understand the architectural role of OTP in relation to Flash protection and secure boot mechanisms.
Thank you.

[mƎALLEm]

Hello @Venkatesh-8559 and welcome to the ST community,

The OTP area in STM32L476 is a dedicated, user-accessible section of flash for storing immutable data.
It is not used by ST for factory data. Once programmed, OTP data cannot be changed or erased, but it can be read. OTP area can't be read when RDP (Readout Protection) is activated according to the reference manual:

But I need to check internally if that is a typo or not! I will get you back for the right answer. (I'm referring to this thread). internal ticket for follow-up: 227713

Hope that answers your question.

[Venkatesh-8559]

hello @mƎALLEm , OTP area can't be read when RDP (Readout Protection) is activated  is only when booting is from RAM/boot from loader/ or if a debug is detected . but if booting is from flash then we can read OTP area even if RDP is Activated right ??

[mƎALLEm]

Of course it could be read from the application from the flash otherwise it doesn't have sense.

But need to confirm if the table states the correct policy. I have a doubt the OPT can't be protected by RDP level 1.

I'm waiting a confirmation from an internal expert.

[mƎALLEm · Accepted solution]

Hello,

Getting back to you regarding this question.

In fact the RDP1 prevents the OTP reading unless the device correctly boots from internal flash. It's not possible to read it out using debug interface. But it remains accessible to user code whatever RDP is set.

PS: which is not the case of G0 products (the thread I have referred above)

Hope that answers your question

[Venkatesh-8559]

hello @mƎALLEm ,

Thank you for your clarity and one more thing, i need one more clarification on STM32 option byte programming.

When we write new values to FLASH_OPTR and other option registers:

Where are these FLASH option registers physically located?
Are they inside the FLASH peripheral ? When OPTSTRT is set, does the CPU erase/program the option byte pages, or does the FLASH controller hardware automatically erase the option byte Flash area and program it using the values in the FLASH option registers?

I want to clearly understand how the values are getting placed among Option byte Flash memory, FLASH option registers when i changed in stm32CubeProgrammer ? 

[mƎALLEm]

Hello,

In this community: new question = new thread/post.

Thank you for your understanding.