Skip to content

Commit 51131b4

Browse files
tpambortpambor
committed
boards: st: stm32h573i_dk: Add TF-M non-secure app support
Add support for building Trusted Firmware-M (TF-M) non-secure applications for the STM32H573I-DK board. Signed-off-by: Tim Pambor <[email protected]>
1 parent ad867a1 commit 51131b4

File tree

14 files changed

+202
-0
lines changed

14 files changed

+202
-0
lines changed

‎boards/st/stm32h573i_dk/board.cmake‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
11
# SPDX-License-Identifier: Apache-2.0
2+
if(CONFIG_BUILD_WITH_TFM)
3+
set(FLASH_BASE_ADDRESS_S 0x0C000000)
4+
5+
# Flash merged TF-M + Zephyr binary
6+
set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
7+
8+
if(CONFIG_HAS_FLASH_LOAD_OFFSET)
9+
MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
10+
else()
11+
set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
12+
endif()
13+
endif()
214

315
# keep first
416
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")

‎boards/st/stm32h573i_dk/board.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ board:
66
- name: stm32h573xx
77
variants:
88
- name: ext_flash_app
9+
- name: ns

‎boards/st/stm32h573i_dk/doc/index.rst‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,47 @@ Supported Features
149149

150150
.. zephyr:board-supported-hw::
151151
152+
Zephyr board options
153+
====================
154+
155+
The STM32H573 is an SoC with Cortex-M33 architecture. Zephyr provides support
156+
for building for both Secure and Non-Secure firmware.
157+
158+
The BOARD options are summarized below:
159+
160+
+-----------------------------------------+--------------------------------------------------------------+
161+
| BOARD | Description |
162+
+=========================================+==============================================================+
163+
| stm32h573i_dk | For building Trust Zone Disabled firmware for internal flash |
164+
+-----------------------------------------+--------------------------------------------------------------+
165+
| stm32h573i_dk/stm32h573xx/ext_flash_app | For building Trust Zone Disabled firmware for external flash |
166+
+-----------------------------------------+--------------------------------------------------------------+
167+
| stm32h573i_dk/stm32h573xx/ns | For building Non-Secure firmware for internal flash |
168+
+-----------------------------------------+--------------------------------------------------------------+
169+
170+
Here are the instructions to build Zephyr with a non-secure configuration,
171+
using :zephyr:code-sample:`tfm_ipc` sample:
172+
173+
.. code-block:: bash
174+
175+
$ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/
176+
177+
Once done, before flashing, you need to first run a generated script that
178+
will set platform option bytes config and erase platform (among others,
179+
option bit TZEN will be set).
180+
181+
.. code-block:: bash
182+
183+
$ ./build/tfm/api_ns/regression.sh
184+
$ west flash
185+
186+
Please note that, after having run a TFM sample on the board, you will need to
187+
run ``./build/tfm/api_ns/regression.sh`` once more to clean up the board from secure
188+
options and get back the platform back to a "normal" state and be able to run
189+
usual, non-TFM, binaries.
190+
Also note that, even then, TZEN will remain set, and you will need to use
191+
STM32CubeProgrammer_ to disable it fully, if required.
192+
152193
Connections and IOs
153194
===================
154195

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
/*
2+
* Copyright (c) 2023 STMicroelectronics
3+
* Copyright (c) 2025 CodeWrights GmbH
4+
*
5+
* SPDX-License-Identifier: Apache-2.0
6+
*/
7+
8+
/dts-v1/;
9+
#include "stm32h573i_dk-common.dtsi"
10+
11+
/ {
12+
model = "STMicroelectronics STM32H573I DISCOVERY KIT board";
13+
compatible = "st,stm32h573i-dk";
14+
15+
chosen {
16+
zephyr,flash = &flash0;
17+
zephyr,flash-controller = &flash;
18+
zephyr,code-partition = &slot0_ns_partition;
19+
};
20+
};
21+
22+
&flash0 {
23+
partitions {
24+
compatible = "fixed-partitions";
25+
#address-cells = <1>;
26+
#size-cells = <1>;
27+
28+
/* Keep in sync with partitions from flash_layout.h in TF-M */
29+
/* Scratch area 0000_0000 - 0000_C000 ( 48k) */
30+
/* MCUboot (anti-rollback counter) 0000_C000 - 0001_0000 ( 16k) */
31+
/* MCUboot 0001_0000 - 0002_8000 (160k) */
32+
/* MCUboot (OTP / non-volatile counters) 0002_8000 - 0002_C000 ( 16k) */
33+
/* MCUboot (non-volatile counters) 0002_C000 - 0003_0000 ( 16k) */
34+
/* Secure storage 0003_0000 - 0003_4000 ( 16k) */
35+
/* Internal trusted storage 0003_4000 - 0003_8000 ( 16k) */
36+
/* Slot 0 Secure Partition 0003_8000 - 0008_8000 (320k) */
37+
/* Slot 0 Non-Secure Partition 0008_8000 - 0011_8000 (576k) */
38+
/* Slot 1 Secure Partition 0011_8000 - 0016_8000 (320k) */
39+
/* Slot 1 Non-Secure Partition 0016_8000 - 001F_8000 (576k) */
40+
/* Storage Partition 001F_8000 - 0020_0000 ( 32k) */
41+
42+
boot_partition: partition@10000 {
43+
label = "mcuboot";
44+
reg = <0x00010000 DT_SIZE_K(160)>;
45+
};
46+
47+
slot0_partition: partition@38000 {
48+
label = "image-0";
49+
reg = <0x00038000 DT_SIZE_K(320)>;
50+
};
51+
52+
slot0_ns_partition: partition@88000 {
53+
label = "image-0-nonsecure";
54+
reg = <0x00088000 DT_SIZE_K(576)>;
55+
};
56+
57+
slot1_partition: partition@118000 {
58+
label = "image-1";
59+
reg = <0x00118000 DT_SIZE_K(320)>;
60+
};
61+
62+
slot1_ns_partition: partition@168000 {
63+
label = "image-1-nonsecure";
64+
reg = <0x00168000 DT_SIZE_K(576)>;
65+
};
66+
67+
storage_partition: partition@1f8000 {
68+
label = "storage";
69+
reg = <0x001f8000 DT_SIZE_K(32)>;
70+
};
71+
};
72+
};
73+
74+
&ext_flash {
75+
partitions {
76+
compatible = "fixed-partitions";
77+
#address-cells = <1>;
78+
#size-cells = <1>;
79+
80+
partition@0 {
81+
label = "nor";
82+
reg = <0x00000000 DT_SIZE_M(64)>;
83+
};
84+
};
85+
};

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
identifier: stm32h573i_dk/stm32h573xx/ns
2+
name: ST STM32H573I Discovery Kit non-secure
3+
type: mcu
4+
arch: arm
5+
toolchain:
6+
- zephyr
7+
ram: 256
8+
flash: 2048
9+
supported:
10+
- arduino_gpio
11+
- arduino_i2c
12+
- arduino_serial
13+
- arduino_spi
14+
- gpio
15+
- uart
16+
- watchdog
17+
- entropy
18+
- dma
19+
- adc
20+
- dac
21+
- netif:eth
22+
- pwm
23+
- counter
24+
- spi
25+
- octospi
26+
- can
27+
- i2c
28+
- rtc
29+
- usbd
30+
vendor: st

‎boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (c) 2023 STMicroelectronics
2+
# Copyright (c) 2025 CodeWrights GmbH
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
# Enable MPU
6+
CONFIG_ARM_MPU=y
7+
8+
# Enable HW stack protection
9+
CONFIG_HW_STACK_PROTECTION=y
10+
11+
# Enable UART driver
12+
CONFIG_SERIAL=y
13+
14+
# Enable console
15+
CONFIG_CONSOLE=y
16+
CONFIG_UART_CONSOLE=y
17+
18+
# Enable GPIO
19+
CONFIG_GPIO=y
20+
21+
# Enable TZ non-secure configuration
22+
CONFIG_TRUSTED_EXECUTION_NONSECURE=y
23+
CONFIG_RUNTIME_NMI=y
24+
CONFIG_TFM_MCUBOOT_SIGNATURE_TYPE="RSA-3072"

‎modules/trusted-firmware-m/Kconfig.tfm‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ config TFM_BOARD
2424
default "nxp/lpcxpresso55s69" if BOARD_LPCXPRESSO55S69_LPC55S69_CPU0_NS
2525
default "stm/b_u585i_iot02a" if BOARD_B_U585I_IOT02A
2626
default "stm/nucleo_l552ze_q" if BOARD_NUCLEO_L552ZE_Q
27+
default "stm/stm32h573i_dk" if BOARD_STM32H573I_DK
2728
default "stm/stm32l562e_dk" if BOARD_STM32L562E_DK
2829
default "stm/stm32wba65i_dk" if BOARD_NUCLEO_WBA65RI || BOARD_STM32WBA65I_DK1
2930
default "$(ZEPHYR_BASE)/modules/trusted-firmware-m/nordic/nrf9160" if SOC_NRF9160

‎samples/tfm_integration/config_build/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ tests:
2828
- mcuboot
2929
platform_allow:
3030
# Platform fails no_bl2
31+
- stm32h573i_dk/stm32h573xx/ns
3132
- stm32l562e_dk/stm32l562xx/ns
3233
extra_configs:
3334
- CONFIG_TFM_MCUBOOT_IMAGE_NUMBER=1

‎samples/tfm_integration/psa_crypto/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ tests:
2121
- stm32l562e_dk/stm32l562xx/ns
2222
- bl5340_dvk/nrf5340/cpuapp/ns
2323
- max32657evkit/max32657/ns
24+
- stm32h573i_dk/stm32h573xx/ns
2425
integration_platforms:
2526
- mps2/an521/cpu0/ns
2627
harness: console

‎samples/tfm_integration/psa_protected_storage/sample.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ common:
1111
- bl5340_dvk/nrf5340/cpuapp/ns
1212
- lpcxpresso55s69/lpc55s69/cpu0/ns
1313
- max32657evkit/max32657/ns
14+
- stm32h573i_dk/stm32h573xx/ns
1415
integration_platforms:
1516
- mps2/an521/cpu0/ns
1617
harness: console

0 commit comments

Comments
 (0)