Skip to content

Commit 4f3a8d1

Browse files
tpambortpambor
committed
boards: st: stm32h573i_dk: Add TF-M non-secure app support
Add support for building Trusted Firmware-M (TF-M) non-secure applications for the STM32H573I-DK board. Signed-off-by: Tim Pambor <[email protected]>
1 parent 1a49b41 commit 4f3a8d1

File tree

14 files changed

+189
-1
lines changed

14 files changed

+189
-1
lines changed

‎boards/st/stm32h573i_dk/board.cmake‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
11
# SPDX-License-Identifier: Apache-2.0
2+
if(CONFIG_BUILD_WITH_TFM)
3+
set(FLASH_BASE_ADDRESS_S 0x0C000000)
4+
5+
# Flash merged TF-M + Zephyr binary
6+
set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
7+
8+
if(CONFIG_HAS_FLASH_LOAD_OFFSET)
9+
MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
10+
else()
11+
set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
12+
endif()
13+
endif()
214

315
# keep first
416
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")

‎boards/st/stm32h573i_dk/board.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ board:
66
- name: stm32h573xx
77
variants:
88
- name: ext_flash_app
9+
- name: ns

‎boards/st/stm32h573i_dk/doc/index.rst‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,45 @@ Supported Features
149149

150150
.. zephyr:board-supported-hw::
151151
152+
Zephyr board options
153+
====================
154+
155+
The STM32H573 is an SoC with Cortex-M33 architecture. Zephyr provides support
156+
for building for both Secure and Non-Secure firmware.
157+
158+
The BOARD options are summarized below:
159+
160+
+-----------------------------------------+------------------------------------------------------------------+
161+
| BOARD | Description |
162+
+=========================================+==================================================================+
163+
| stm32h573i_dk | For building firmware with TrustZone disabled for internal flash |
164+
+-----------------------------------------+------------------------------------------------------------------+
165+
| stm32h573i_dk/stm32h573xx/ext_flash_app | For building firmware with TrustZone disabled for external flash |
166+
+-----------------------------------------+------------------------------------------------------------------+
167+
| stm32h573i_dk/stm32h573xx/ns | For building Non-Secure firmware for internal flash |
168+
+-----------------------------------------+------------------------------------------------------------------+
169+
170+
Here are the instructions to build Zephyr with a non-secure configuration,
171+
using :zephyr:code-sample:`tfm_ipc` sample:
172+
173+
.. zephyr-app-commands::
174+
:zephyr-app: samples/tfm_integration/tfm_ipc
175+
:board: stm32h573i_dk/stm32h573xx/ns
176+
:goals: build
177+
178+
Once done, before flashing, you need to first run a generated script that
179+
will set platform Option Bytes config and erase platform (among others,
180+
option bit TZEN will be set).
181+
182+
.. code-block:: bash
183+
184+
$ ./build/tfm/api_ns/regression.sh
185+
$ west flash
186+
187+
Please note that, after having run a TF-M sample on the board, you will need to
188+
use STM32CubeProgrammer_ to return the board to a non-secure state and be able to
189+
run usual, non-secure binaries without TF-M.
190+
152191
Connections and IOs
153192
===================
154193

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/*
2+
* Copyright (c) 2023 STMicroelectronics
3+
* Copyright (c) 2025 CodeWrights GmbH
4+
*
5+
* SPDX-License-Identifier: Apache-2.0
6+
*/
7+
8+
/dts-v1/;
9+
#include "stm32h573i_dk-common.dtsi"
10+
11+
/ {
12+
model = "STMicroelectronics STM32H573I DISCOVERY KIT board";
13+
compatible = "st,stm32h573i-dk";
14+
15+
chosen {
16+
zephyr,flash = &flash0;
17+
zephyr,flash-controller = &flash;
18+
zephyr,code-partition = &slot0_ns_partition;
19+
};
20+
};
21+
22+
/* Last 64kB of SRAM1 are owned by TF-M */
23+
&sram1 {
24+
reg = <0x20000000 DT_SIZE_K(256 - 64)>;
25+
};
26+
27+
/* SRAM2 is owned by TF-M */
28+
&sram2 {
29+
status = "disabled";
30+
};
31+
32+
&flash0 {
33+
partitions {
34+
compatible = "fixed-partitions";
35+
#address-cells = <1>;
36+
#size-cells = <1>;
37+
38+
/* Keep in sync with partitions from flash_layout.h in TF-M
39+
* MCUboot (scratch area) 0000_0000 - 0000_C000 ( 48k)
40+
* MCUboot (anti-rollback counter) 0000_C000 - 0001_0000 ( 16k)
41+
* MCUboot (BL2) 0001_0000 - 0002_8000 ( 96k)
42+
* MCUboot (OTP / non-volatile counters) 0002_8000 - 0002_C000 ( 16k)
43+
* MCUboot (non-volatile counters) 0002_C000 - 0003_0000 ( 16k)
44+
* Secure storage 0003_0000 - 0003_4000 ( 16k)
45+
* Internal trusted storage 0003_4000 - 0003_8000 ( 16k)
46+
* Slot 0 Secure Partition 0003_8000 - 0008_8000 (320k)
47+
* Slot 0 Non-Secure Partition 0008_8000 - 0011_8000 (576k)
48+
* Slot 1 Secure Partition 0011_8000 - 0016_8000 (320k)
49+
* Slot 1 Non-Secure Partition 0016_8000 - 001F_8000 (576k)
50+
* Storage Partition 001F_8000 - 0020_0000 ( 32k)
51+
*/
52+
53+
boot_partition: partition@0 {
54+
label = "mcuboot";
55+
reg = <0x00000000 DT_SIZE_K(192)>;
56+
};
57+
58+
slot0_partition: partition@38000 {
59+
label = "image-0";
60+
reg = <0x00038000 DT_SIZE_K(320)>;
61+
};
62+
63+
slot0_ns_partition: partition@88000 {
64+
label = "image-0-nonsecure";
65+
reg = <0x00088000 DT_SIZE_K(576)>;
66+
};
67+
68+
slot1_partition: partition@118000 {
69+
label = "image-1";
70+
reg = <0x00118000 DT_SIZE_K(320)>;
71+
};
72+
73+
slot1_ns_partition: partition@168000 {
74+
label = "image-1-nonsecure";
75+
reg = <0x00168000 DT_SIZE_K(576)>;
76+
};
77+
78+
storage_partition: partition@1f8000 {
79+
label = "storage";
80+
reg = <0x001f8000 DT_SIZE_K(32)>;
81+
};
82+
};
83+
};
84+
85+
&ext_flash {
86+
partitions {
87+
compatible = "fixed-partitions";
88+
#address-cells = <1>;
89+
#size-cells = <1>;
90+
91+
partition@0 {
92+
label = "nor";
93+
reg = <0x00000000 DT_SIZE_M(64)>;
94+
};
95+
};
96+
};

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
identifier: stm32h573i_dk/stm32h573xx/ns
2+
name: ST STM32H573I Discovery Kit non-secure
3+
type: mcu
4+
arch: arm
5+
toolchain:
6+
- zephyr
7+
ram: 192
8+
flash: 575 # size in kB of 1 app slot minus MCUboot header size (1KB)
9+
vendor: st

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (c) 2023 STMicroelectronics
2+
# Copyright (c) 2025 CodeWrights GmbH
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
# Enable MPU
6+
CONFIG_ARM_MPU=y
7+
8+
# Enable HW stack protection
9+
CONFIG_HW_STACK_PROTECTION=y
10+
11+
# Enable UART driver
12+
CONFIG_SERIAL=y
13+
14+
# Enable console
15+
CONFIG_CONSOLE=y
16+
CONFIG_UART_CONSOLE=y
17+
18+
# Enable GPIO
19+
CONFIG_GPIO=y
20+
21+
# Enable TZ non-secure configuration
22+
CONFIG_TRUSTED_EXECUTION_NONSECURE=y
23+
CONFIG_RUNTIME_NMI=y
24+
CONFIG_TFM_MCUBOOT_SIGNATURE_TYPE="RSA-3072"

‎modules/trusted-firmware-m/Kconfig.tfm‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ config TFM_BOARD
2424
default "nxp/lpcxpresso55s69" if BOARD_LPCXPRESSO55S69_LPC55S69_CPU0_NS
2525
default "stm/b_u585i_iot02a" if BOARD_B_U585I_IOT02A
2626
default "stm/nucleo_l552ze_q" if BOARD_NUCLEO_L552ZE_Q
27+
default "stm/stm32h573i_dk" if BOARD_STM32H573I_DK
2728
default "stm/stm32l562e_dk" if BOARD_STM32L562E_DK
2829
default "stm/stm32wba65i_dk" if BOARD_NUCLEO_WBA65RI || BOARD_STM32WBA65I_DK1
2930
default "$(ZEPHYR_BASE)/modules/trusted-firmware-m/nordic/nrf9160" if SOC_NRF9160

‎samples/tfm_integration/config_build/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ tests:
2828
- mcuboot
2929
platform_allow:
3030
# Platform fails no_bl2
31+
- stm32h573i_dk/stm32h573xx/ns
3132
- stm32l562e_dk/stm32l562xx/ns
3233
extra_configs:
3334
- CONFIG_TFM_MCUBOOT_IMAGE_NUMBER=1

‎samples/tfm_integration/psa_crypto/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ tests:
2121
- stm32l562e_dk/stm32l562xx/ns
2222
- bl5340_dvk/nrf5340/cpuapp/ns
2323
- max32657evkit/max32657/ns
24+
- stm32h573i_dk/stm32h573xx/ns
2425
integration_platforms:
2526
- mps2/an521/cpu0/ns
2627
harness: console

‎samples/tfm_integration/psa_protected_storage/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ common:
1111
- bl5340_dvk/nrf5340/cpuapp/ns
1212
- lpcxpresso55s69/lpc55s69/cpu0/ns
1313
- max32657evkit/max32657/ns
14+
- stm32h573i_dk/stm32h573xx/ns
1415
integration_platforms:
1516
- mps2/an521/cpu0/ns
1617
harness: console

0 commit comments

Comments
 (0)