boards: st: stm32h573i_dk: Add TF-M non-secure app support #100114

tpambor · 2025-11-26T16:38:33Z

Add support for building Trusted Firmware-M (TF-M) non-secure applications for the STM32H573I-DK board.

tpambor · 2025-11-26T20:23:58Z

Currently, fails to build with Zephyr SDK used in main due to a internal compiler error, zephyrproject-rtos/sdk-ng#558. This is fixed starting GCC 13.

dsseng

Thanks, could you please consider these minor documentation fixups?

dsseng · 2025-11-27T13:49:07Z

boards/st/stm32h573i_dk/doc/index.rst

+| stm32h573i_dk                           | For building Trust Zone Disabled firmware for internal flash |
+-----------------------------------------+--------------------------------------------------------------+
+| stm32h573i_dk/stm32h573xx/ext_flash_app | For building Trust Zone Disabled firmware for external flash |


TrustZone is spelled without a space

Suggested change

| stm32h573i_dk | For building Trust Zone Disabled firmware for internal flash |

+-----------------------------------------+--------------------------------------------------------------+

| stm32h573i_dk/stm32h573xx/ext_flash_app | For building Trust Zone Disabled firmware for external flash |

| stm32h573i_dk | For building firmware without TrustZone for internal flash |

+-----------------------------------------+--------------------------------------------------------------+

| stm32h573i_dk/stm32h573xx/ext_flash_app | For building firmware without TrustZone for external flash |

with TrustZone disabled more accurate than without TrustZone

dsseng · 2025-11-27T13:50:01Z

boards/st/stm32h573i_dk/doc/index.rst

+Please note that, after having run a TFM sample on the board, you will need to
+run ``./build/tfm/api_ns/regression.sh`` once more to clean up the board from secure
+options and get back the platform back to a "normal" state and be able to run
+usual, non-TFM, binaries.


Suggested change

usual, non-TFM, binaries.

usual, Secure binaries without TF-M.

Actually, as mentioned below, TZEN Option Byte is not reset by this script hence images not embedding TF-M won't be able to run.

etienne-lms

Many CI build test failures (if not all) are due to a GCC 11/GCC 12 issue triggered in STM32 HAL for this SoC. It's been addressed for STM32U5 in TF-M [1] first then solve in the STM32U5 HAL. The equivalent fix for STM32WBA65 was merged in TF-M [2] and should be addressed in the next release of STM32WBA65 HAL.

I see the issue needs to be addressed in TF-M also for STM32H573. It should be adressed in that SoC next HAL release but until then (and TF-M syncs on), it would need to be addressed in TF-M too, on the model of [1] and [2]. Do you want to post a change in TF-M mainline?

[1] TrustedFirmware-M/trusted-firmware-m@578a6f4
[2] TrustedFirmware-M/trusted-firmware-m@ec61e69

etienne-lms · 2025-11-27T15:10:52Z

boards/st/stm32h573i_dk/doc/index.rst

+   .. code-block:: bash
+
+      $ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/


Suggested change

.. code-block:: bash

$ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/

.. zephyr-app-commands::

:zephyr-app: samples/tfm_integration/tfm_ipc

:board: stm32h573i_dk/stm32h573xx/ns

:goals: build

etienne-lms · 2025-11-27T15:11:39Z

boards/st/stm32h573i_dk/doc/index.rst

+      $ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/
+
+Once done, before flashing, you need to first run a generated script that
+will set platform option bytes config and erase platform (among others,


Suggested change

will set platform option bytes config and erase platform (among others,

will set platform Option Bytes config and erase platform (among others,

etienne-lms · 2025-11-27T15:33:09Z

boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts

+		/* Keep in sync with partitions from flash_layout.h in TF-M */
+		/* Scratch area                          0000_0000 - 0000_C000 ( 48k) */
+		/* MCUboot (anti-rollback counter)       0000_C000 - 0001_0000 ( 16k) */
+		/* MCUboot                               0001_0000 - 0002_8000 (160k) */


Suggested change

/* MCUboot 0001_0000 - 0002_8000 (160k) */

/* MCUboot (BL2) 0001_0000 - 0002_8000 (96k) */

Alternatively, to be synced with the partition layout below the mentions 160kB for boot_partition partition:

* MCUBoot data (scratch area/counters) 0000_0000 - 0000_C000 ( 48k) * MCUboot (BL2) and related resources 0001_0000 - 0002_8000 (160k)

I would rather suggest to update the boot_partition to cover all TF-M.BL2 related resources:

boot_partition: partition@0 { label = "mcuboot"; reg = <0 DT_SIZE_K(224)>; };

I adjusted it to 192k, as Secure storage and Internal trusted storage partitions are used by TF-M and not mcuboot/BL2.

etienne-lms · 2025-11-27T15:33:47Z

boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts

+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		/* Keep in sync with partitions from flash_layout.h in TF-M */


Prefer comments like:

/* Keep in sync with partitions from flash_layout.h in TF-M * Scratch area 0000_0000 - 0000_C000 ( 48k) * MCUboot (anti-rollback counter) 0000_C000 - 0001_0000 ( 16k) * (...) */

etienne-lms · 2025-11-27T15:45:41Z

boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.yaml

+  - arduino_gpio
+  - arduino_i2c
+  - arduino_serial
+  - arduino_spi
+  - gpio
+  - uart
+  - watchdog
+  - entropy
+  - dma
+  - adc
+  - dac
+  - netif:eth
+  - pwm
+  - counter
+  - spi
+  - octospi
+  - can
+  - i2c
+  - rtc
+  - usbd


These tags are used by twister to test boards subsystems. It's not intended to be used on the ns variant, there are already tested on the main variant, so prefer remove them from this YAML file.

Maybe adding only the trusted-firmware-m tag here could be useful for covering related tests and samples.

etienne-lms · 2025-11-27T15:50:41Z

boards/st/stm32h573i_dk/doc/index.rst

+Please note that, after having run a TFM sample on the board, you will need to
+run ``./build/tfm/api_ns/regression.sh`` once more to clean up the board from secure
+options and get back the platform back to a "normal" state and be able to run
+usual, non-TFM, binaries.


Actually, as mentioned below, TZEN Option Byte is not reset by this script hence images not embedding TF-M won't be able to run.

etienne-lms · 2025-11-27T15:52:49Z

boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.yaml

+toolchain:
+  - zephyr
+ram: 256
+flash: 2048


Suggested change

flash: 2048

ram: 192

flash: 576

TF-M is assigned the last 64kB of SRAM1, leaving only 192kB to Zephyr non-secure application.
The flash partition for Zephyr is 576kB, as defined in your "ns" variant DTS file.

Right, I also subtracted the 1kB for MCUboot header as in ext_flash_app.

etienne-lms · 2025-11-27T16:06:03Z

boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts

+		zephyr,code-partition = &slot0_ns_partition;
+	};
+};
+


Could you update here the SRAMs nodes since some are assigned to the secure world:

/* Last 64kB of SRAM1 are owned by TF-M */ &sram1 { reg = <0x20000000 DT_SIZE_K(256 - 64)>; }; /* SRAM2 is owned by TF-M */ &sram2 { status = "disabled"; };

etienne-lms · 2025-11-27T16:08:07Z

tests/net/socket/tcp/testcase.yaml

  filter: CONFIG_FULL_LIBC_SUPPORTED
  timeout: 180
+  platform_exclude:
+    - stm32h573i_dk/stm32h573xx/ns  # requires TF-M with BL2


Removing net and socket tags in the "ns" variant board YAML file will prevent from excluding this variant from all tests and samples where it can't be used, as here.

github-actions · 2025-11-28T14:55:56Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
trusted-firmware-m	zephyrproject-rtos/trusted-firmware-m@`c2f9edc` (`main`)	zephyrproject-rtos/trusted-firmware-m#160	zephyrproject-rtos/trusted-firmware-m#160/files

⛔ DNM label due to: 1 project with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

dsseng · 2025-12-02T19:31:28Z

boards/st/stm32h573i_dk/doc/index.rst

+
+Please note that, after having run a TF-M sample on the board, you will need to
+use STM32CubeProgrammer_ to return the board to a non-secure state and be able to
+run usual, non-secure binaries without TF-M.


Actually, binaries without TF-M should run in Secure, unless the SoC bootrom does something very special. @tpambor @etienne-lms please correct me if this SoC does something special and the usual binaries would start in ns by default

Suggested change

run usual, non-secure binaries without TF-M.

run usual binaries without TrustZone and TF-M.

@dsseng Yes, you are right. I will correct this.

dsseng · 2025-12-02T19:32:50Z

boards/st/stm32h573i_dk/doc/index.rst

+-----------------------------------------+------------------------------------------------------------------+
+| stm32h573i_dk/stm32h573xx/ext_flash_app | For building firmware with TrustZone disabled for external flash |
+-----------------------------------------+------------------------------------------------------------------+
+| stm32h573i_dk/stm32h573xx/ns            | For building Non-Secure firmware for internal flash              |


Should the description here maybe suggest it'll be merged with the TF-M as the secure image?

Add support for building Trusted Firmware-M (TF-M) non-secure applications for the STM32H573I-DK board. Signed-off-by: Tim Pambor <[email protected]>

sonarqubecloud · 2025-12-02T20:40:59Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

zephyrbot added platform: STM32 ST Micro STM32 area: TF-M ARM Trusted Firmware-M (TF-M) area: Boards/SoCs area: Samples Samples labels Nov 26, 2025

zephyrbot requested review from FRASTM, GeorgeCGV, JarmouniA, Vge0rge, d3zd3z, djiatsaf-st, etienne-lms, gautierg-st, ithinuel, juickar, mathieuchopstm, nashif, tomi-font, valeriosetti and wearyzen November 26, 2025 16:40

zephyrbot assigned d3zd3z and tomi-font Nov 26, 2025

tpambor force-pushed the tf-m-stm32h573i-dk branch from 933a8b6 to df47604 Compare November 26, 2025 16:43

zephyrbot requested review from erwango and kartben November 26, 2025 16:45

tpambor force-pushed the tf-m-stm32h573i-dk branch from df47604 to 51131b4 Compare November 26, 2025 20:13

zephyrbot added area: Sockets Networking sockets area: Networking area: Tests Issues related to a particular existing or missing test labels Nov 26, 2025

zephyrbot requested review from jukkar and rlubos November 26, 2025 20:15

dsseng reviewed Nov 27, 2025

View reviewed changes

etienne-lms reviewed Nov 27, 2025

View reviewed changes

tpambor force-pushed the tf-m-stm32h573i-dk branch from 51131b4 to f59334b Compare November 28, 2025 14:54

github-actions bot added manifest manifest-trusted-firmware-m DNM (manifest) This PR should not be merged (controlled by action-manifest) labels Nov 28, 2025

tpambor force-pushed the tf-m-stm32h573i-dk branch from f59334b to 1137c8e Compare November 28, 2025 14:58

jukkar removed request for djiatsaf-st, jukkar and mathieuchopstm November 29, 2025 16:16

tpambor force-pushed the tf-m-stm32h573i-dk branch 3 times, most recently from 90d39c1 to 4f3a8d1 Compare December 2, 2025 18:00

tpambor requested review from dsseng and etienne-lms December 2, 2025 18:00

dsseng reviewed Dec 2, 2025

View reviewed changes

boards: st: stm32h573i_dk: Add TF-M non-secure app support

377cff2

Add support for building Trusted Firmware-M (TF-M) non-secure applications for the STM32H573I-DK board. Signed-off-by: Tim Pambor <[email protected]>

tpambor force-pushed the tf-m-stm32h573i-dk branch from 4f3a8d1 to 377cff2 Compare December 2, 2025 20:14

	usual, non-TFM, binaries.
	usual, Secure binaries without TF-M.

		.. code-block:: bash

		$ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/

-   .. code-block:: bash
-      $ west build -b stm32h573i_dk/stm32h573xx/ns samples/tfm_integration/tfm_ipc/
+.. zephyr-app-commands::
+   :zephyr-app: samples/tfm_integration/tfm_ipc
+   :board: stm32h573i_dk/stm32h573xx/ns
+   :goals: build

	will set platform option bytes config and erase platform (among others,
	will set platform Option Bytes config and erase platform (among others,

	/* MCUboot 0001_0000 - 0002_8000 (160k) */
	/* MCUboot (BL2) 0001_0000 - 0002_8000 (96k) */

	run usual, non-secure binaries without TF-M.
	run usual binaries without TrustZone and TF-M.

boards: st: stm32h573i_dk: Add TF-M non-secure app support #100114

Are you sure you want to change the base?

boards: st: stm32h573i_dk: Add TF-M non-secure app support #100114

Conversation

tpambor commented Nov 26, 2025

Uh oh!

tpambor commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dsseng left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

etienne-lms left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

etienne-lms Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tpambor Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Dec 2, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

tpambor commented Nov 26, 2025 •

edited

Loading

etienne-lms Nov 27, 2025 •

edited

Loading

tpambor Dec 2, 2025 •

edited

Loading

github-actions bot commented Nov 28, 2025 •

edited

Loading