RASPIOTP(7)

💖 NAME 💖

okay so bestie, this is raspiotp — the RASPIOTP(7) page from the Miscellaneous Information Manual — and it is literally all about the Raspberry Pi OTP register bits. 🎀

✨ DESCRIPTION ✨

All the SoCs used by the Raspberry Pi range have an inbuilt One-Time Programmable (OTP) memory block. It is 66 32-bit values long, although only a few locations have factory-programmed data. The vcgencmd(1) utility can be used to display the contents of the OTP like so:

$ vcgencmd otp_dump

🔥 OTP REGISTERS 🔥

This list contains the publicly available information on the registers. If a register or bit is not defined here, then it is not public. periodt. 💅

• 17 — bootmode register
  • Bit 1 — sets the oscillator frequency to 19.2MHz
  • Bit 3 — enables pull ups on the SDIO pins
  • Bit 19 — enables GPIO bootmode
  • Bit 20 — sets the bank to check for GPIO bootmode
  • Bit 21 — enables booting from SD card
  • Bit 22 — sets the bank to boot from
  • Bit 28 — enables USB device booting
  • Bit 29 — enables USB host booting (ethernet and mass storage)
• 18 — copy of bootmode register
• 28 — serial number
• 29 — ~(serial number)
• 30 — revision code; raspirev(7)
• 36-43 — customer OTP values (see INDUSTRIAL USE below)
• 45 — MPG2 decode key
• 46 — WVC1 decode key
• 64-65 — MAC address; if set, system will use this in preference to the automatically generated address based on the serial number
• 66 — advanced boot register
  • Bits 0-6 — GPIO for ETH_CLK output pin
  • Bit 7 — enables ETH_CLK output
  • Bits 8-14 — GPIO for LAN_RUN output pin
  • Bit 15 — enables LAN_RUN output
  • Bit 24 — extends USB HUB timeout parameter
  • Bit 25 — ETH_CLK frequency: 0=25MHz, 1=24MHz

🏭 INDUSTRIAL USE 🏭

The Raspberry Pi is often used as part of another product. This section describes some extra facilities available to use other capabilities of the Pi. 🫶

🧸 Customer OTP settings 🧸

There are a number of OTP values that can be used. To see a list of all the OTP values, you can use:

$ vcgencmd otp_dump

In register locations 36 to 43 (inclusive), there are eight rows of 32 bits available for the customer (detailed in OTP REGISTERS above).

To program these bits, you will need to use the vcmailbox. This is a Linux driver interface to the firmware which will handle the programming of the rows. To do this, please refer to the documentation at [MAILBOX], and the vcmailbox(1) example application. For example:

$ vcmailbox 0x00010004 8 8 0 0
0x00000020 0x80000000 0x00010004 0x00000008 0x800000008 0xnnnnnnnn
0x00000000 0x00000000

The above uses the GET_BOARD_SERIAL tag (detailed under [MAILBOX]) with a request size of 8 bytes and response size of 8 bytes (sending two integers for the request 0, 0). The response to this will be two integers (0x00000020 and 0x80000000) followed by the tag code, the request length, the response length (with the 31st bit set to indicate that it is a response) then the 64 bit serial number (where the MS 32bits are always 0).

To set the customer OTP values you will need to use the SET_CUSTOMER_OTP (0x38021) tag as follows:

$ vcmailbox 0x00038021 [8+rows*4] [8+rows*4] [start] [rows] [value] ...

• start — the first row to program from 0-7
• rows — number of rows to program
• value — each value to program

So, to program OTP customer rows 4, 5, and 6 to 0x11111111, 0x22222222, 0x33333333 respectively, you would use:

$ vcmailbox 0x00038021 20 20 4 3 0x11111111 0x22222222 0x33333333

This will then program rows 40, 41, and 42. To read the values back, you can use:

$ vcmailbox 0x00030021 20 20 4 3 0 0 0
0x0000002c 0x80000000 0x00030021 0x00000014 0x80000014 0x00000000
0x00000003 0x11111111 0x22222222 0x33333333

If you'd like to integrate this functionality into your own code, you should be able to achieve this by using the vcmailbox.c code as an example. 💻✨

🔒 Locking the OTP changes 🔒

It is possible to lock the OTP changes to avoid them being edited again. This can be done using a special argument with the OTP write mailbox:

$ vcmailbox 0x00038021 8 8 0xffffffff 0xaffe0000

Once locked, the customer OTP values can no longer be altered.

Note that this locking operation is irreversible. like, no take-backs, bestie. 😭

🙈 Making customer OTP bits unreadable 🙈

It is possible to prevent the customer OTP bits from being read at all. This can be done using a special argument with the OTP write mailbox:

$ vcmailbox 0x00038021 8 8 0xffffffff 0xaffebabe

This operation is unlikely to be useful for the vast majority of users, and is irreversible.

irreversible fr fr — think before you run it 💀

👀 SEE ALSO 👀

vcgencmd(1), raspirev(7), [SOURCE]

📚 REFERENCES 📚

• [MAILBOX] — https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface
• [SOURCE] — https://www.raspberrypi.org/documentation/hardware/raspberrypi/otpbits.md and https://www.raspberrypi.org/documentation/hardware/industrial/README.md

---

okay bye bestie — this was RASPIOTP(7) from the Miscellaneous Information Manual, footer check: source/version tag RASPIOTP(7), and no date printed on this page, just vibes ✨💖