STM32H5F4 Support for OEMuRoT

[RJJ]

Hello ST Team,

I am evaluating the secure boot and secure firmware update solutions for the STM32H5 family and plan to implement OEMuRoT  on an STM32H5F4 device.

While reviewing the wiki article OEMiRoT OEMuRoT for STM32H5, I noticed that the STM32H5F4xx is not listed as a supported device family.

Security:OEMiRoT OEMuRoT for STM32H5 - stm32mcu

I would like clarification on the following points:

1. Is STM32H5F4xx intentionally excluded from OEMuRoT support?
2. Are there any hardware or security-feature limitations in STM32H5F4 that prevent OEMuRoT implementation?
3. My target device is STM32H5F4, and I am planning a secure firmware update architecture based on Root of Trust and authenticated firmware updates.

   Any guidance or roadmap information would be appreciated. 
   Thank you, 

           RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

This is very probably a mistake. STM32H5F4 is same as STM32H5F5 but without USB HS.

This means that anything running on STM32H5F5 not using this USB HS will also run on STM32H5F4.

Best regards

Jocelyn

[RJJ]

Hi ​@Jocelyn RICARD  ,

Thanks, understood. Since STM32H5F4 and STM32H5F5 are architecturally identical except for the USB HS peripheral, I agree that any OEMuRoT implementation that does not rely on USB HS should theoretically run on STM32H5F4 as well.

However, in another ST Community discussion (STM32H5-SMAK support for STM32H5F4 | Community), it was mentioned that the H5F4 derivative is not currently supported by Secure Manager. then Could you help clarify the reason for this?

Is the limitation due to:

• A technical dependency within Secure ManagerManager?
• Validation and qualification status only?
• Or simply that H5F4 support has not yet been officially enabled in the package?

Understanding whether this is a true hardware limitation or an official support/validation limitation would help us assess the feasibility of using Secure Manager on STM32H5F4.

 

Regards,

RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

here you were referring to Secure Manager solution that is independent for OEMiROT/OEMuROT.

The Secure Manager is certified on a specific HW platform. Even if the differences are small, certification has a cost as well as Secure Manager maintenance. It was decided to address only STM32H5F5.

Best regards

Jocelyn