STM32H733: Is SFI supported for internal flash and external flash (SFIx / OTFDEC)?

[Zainulabedeen]

Hello ST Community,

I am evaluating the security features of the STM32H733 (Cortex-M7) for a project that uses:

• A custom bootloader stored in internal flash
• The main application stored and executed from external QSPI/Octo-SPI flash

I have the following questions regarding Secure Firmware Install (SFI):

1. Is SFI for internal flash officially supported on the STM32H733? (I saw it was added in AN4992 Rev 8, but I would like official confirmation.)
2. Is SFI for external flash (SFIx) supported on the STM32H733? Specifically, can the secure bootloader (RSS) decrypt and program the external application image securely during manufacturing, or is only the "host-side encryption + internal firmware configures OTFDEC" method available?
3. If external SFIx is not supported, what is the recommended secure manufacturing flow for a design with main code in external flash?

[Jocelyn RICARD]

Hello ​@Zainulabedeen ,

the SFI is no more supported on this H7 series.

I don’t know actual reason but both H7 implementing OTFDEC have been removed from the supported devices.

So, only STM32H75x are supported

This is mentioned in the errata sheet but without any detail.

Best regards

Jocelyn

 

[Zainulabedeen]

​@Jocelyn RICARD can you kindly guide me where in the errata sheet is it mentioned ?

Thanks.

[Jocelyn RICARD]

Hi ​@Zainulabedeen ,

Not sure why you need such assistance, you cannot access this errata?

Here is the errata:

STM32H72xx/73xx device errata - Errata sheet

This is chapter 2.2.3

Best regards

Jocelyn