Clarification on Secure Manager External Flash Support

[RJJ]

Hello ST Team,

We are evaluating STM32TRUSTEE-SM (Secure Manager) on STM32H5F4 devices and would like clarification regarding the external flash support architecture.

From the STM32TRUSTEE-SM documentation and wiki pages, we understand that:

Secure Manager provides an External Flash Profile.
An External Flash Driver is referenced as part of the Secure Manager configuration flow.
External firmware and data confidentiality can be enabled through OTFDEC.
OTFDEC-based secure external memory access is described together with the OCTOSPI peripheral.
Secure Manager supports firmware download slots located in external flash memory.

However, we need clarification on the supported external memory architecture and driver model.

Questions

1. External Flash Interface Support restricted to memories connected through the OCTOSPI peripheral, or are other                  external memory interfaces also supported? Specifically, does the External Flash Profile support:

     Octal SPI NOR Flash, Quad SPI NOR Flash, Standard SPI NOR Flash

2. Driver Framework

    The Secure Manager documentation refers to an External Flash Driver.

    Could you please clarify:

    Is source code for the external flash driver provided as part of the Secure Manager package?
    Is there a documented API/interface specification that custom flash drivers must implement?
    Are OEMs expected to develop their own external flash driver when using a flash memory different from the one used in ST      reference projects?
    Are there example drivers available for supported flash devices?

3. Encryption Capabilities

In the documentation related to external flash protection and OTFDEC, we can see references to AES-128 encryption.

Could you please clarify:

Is external firmware/data protection through OTFDEC limited to AES-128 only?
Is AES-256 supported for external flash encryption/decryption?
If AES-256 is not currently supported, are there any planned enhancements or recommended approaches for customers requiring AES-256 protection of external firmware?

4. Documentation Reference
If Secure Manager external flash support is limited to OCTOSPI-managed memories, could you please point us to the relevant documentation section describing this requirement?

Our Use Case We are currently evaluating Secure Manager for a custom STM32H5-based product and need to understand the flexibility of the External Flash Profile before finalizing the hardware architecture and flash memory selection.

Thank you for your support.

RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

as stated in another post, the external flash profile will not be supported on STM32H5F5

By the way the external flash profile related documentation for STM32H573 can be found in the Secure Manager User manual UM3254.

Best regards

Jocelyn

[RJJ]

Hi ​@Jocelyn RICARD,

Thank you for the clarification. 

We are currently in the evaluation stage for our product and are assessing different STM32H5 device options. Although our initial evaluation was focused on the STM32H5F4, we are also considering STM32H573 also.

Since the documentation and references to the External Flash Profile are available for STM32H573 in UM3254 Secure Manager User Manual, we would like to better understand the supported external memory architecture. 

Could you please confirm whether the Secure Manager External Flash Profile is limited to memories connected through the OCTOSPI peripheral only, or if other external memory interfaces are also supported?

The reason for asking is that the current Secure Manager documentation presents the External Flash Profile specifically in the context of STM32H573. Since we are evaluating STM32H5F4 devices and may also consider STM32H573, we would like to understand whether the same architecture and limitations apply across the STM32H5 family. Specifically, we would like to know if the External Flash Profile is restricted to OCTOSPI-connected memories, as this may influence our hardware design choices

Thank you for your support.

Best Regards,

RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

In fact you have more details on this topic in the wiki page “How to use Secure Manager with External Flash profile”

There is actually no restriction on the interface used as the flash driver is your code.

I hope this answers your question

Best regards

Jocelyn

[RJJ]

Hi @Jocelyn RICARD,

Thank you for the clarification

that there is no restriction on the external flash interface since the flash driver is application-specific code.

 

While reviewing the STM32H573 documentation and External Flash Profile material, I noticed that secure firmware installation appears to rely on OTFDEC WITH OCTOSPI.

Based on this, I would like to better understand 

1.If a standard SPI flash is used instead of OCTOSPI, how is encrypted firmware will be decrypt on the fly?

I am attaching the relevant excerpts from the STM32H573 documentation that led to this question.

 

 

Best Regards,

RJ

[Jocelyn RICARD]

Hello ​@RJJ 

could you please point out where you found this information about usage of OTFDEC in external flash profile ?

I’m not aware of the usage of such mechanism in Secure Manager.

I checked internally and confirmed there was no usage of OTFDEC with Secure Manager.

One point to add. Only OSPI interface was actually tested. And you can also find a note in the UM3254 "Only the SPI NOR external flash memory type is supported with the Secure Manager" 

This means there is no insurance that using an external flash connected through FMC would work.

Best regards

Jocelyn

[RJJ]

Hello ​@Jocelyn RICARD  

 

could you please point out where you found this information about usage of OTFDEC in external flash profile ?

 

I believe that SFI is part of Secure Manager, as indicated in the attached screenshot for reference.

[Jocelyn RICARD]

Hello ​@RJJ ,

That’s a good point.

Yes Secure Manager uses SFIx when external profile is selected.

The point it that SFIx can be used or not with OTFDEC.

Secure Manager does not enable usage of OTFDEC through SFIx.

You can check this SFIx configuration in UM2238 chapter 4.2 SFIx Generation

Secure Manager uses the case

“In case OTFDEC settings OFF: Region number, mode, and key address fields are
disabled and set to the disabled value (0xFFFFFFFF).”

Best regards

Jocelyn

[RJJ]

Hi ​@Jocelyn RICARD ,

Thanks for the detailed input. 

I have one additional question regarding the swap procedure. During the swapping process, if the new firmware image encounters an issue is there a mechanism to roll back to old firmware ?

Thanks and Regards,
RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

The installation itself is robust to asynchronous reset.

Besides this, once the new firmware is installed it must validate itself and use firmware update API to confirm it is working fine (FW_APP_FWU_Validation())

So, if new firmware has an issue, it should just reset. At next boot, the SMuROT will detect that the newly installed firmware was not validated and will trigger a rollback to previous valid firmware.

Best regards

Jocelyn