Skip to content

Commit 91eab6c

Browse files
etienne-lmsetienne-lms
committed
boards: st: stm32wba65i_dk1: Add ns variant for TF-M support
Add variant ns to stm32wba65i_dk1 board to embed TF-M in the SoC secure world. The flash layout is synced with the layout defined in Zephyr TF-M integration of platform STM32WBA65I. Successfully tested against a few samples and test samples: - samples/tfm_integration/psa_crypto - samples/tfm_integration/psa_protected_storage - samples/tfm_integration/tfm_ipc - samples/tfm_integration/tfm_regression_test - samples/tfm_integration/tfm_secure_partition - tests/subsys/secure_storage/psa/crypto - tests/subsys/secure_storage/psa/its (with CONFIG_TFM_ITS_MAX_ASSET_SIZE_OVERRIDE=y and CONFIG_TFM_ITS_MAX_ASSET_SIZE=256) The platforms do not yet support samples/tfm_integration/tfm_psa_test. Signed-off-by: Etienne Carriere <[email protected]>
1 parent 7af19aa commit 91eab6c

File tree

7 files changed

+175
-1
lines changed

7 files changed

+175
-1
lines changed

‎boards/st/stm32wba65i_dk1/Kconfig.defconfig

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,16 @@ config SPI_STM32_INTERRUPT
1010
default y
1111
depends on SPI
1212

13+
if BUILD_WITH_TFM
14+
15+
# Not defining LIBC malloc arena has the effect of declaring all available RAM
16+
# as available for malloc.
17+
# This currently conflicts with TF-M MPU setting, resulting in a hard fault.
18+
# Define a specific size to avoid this situation.
19+
20+
config COMMON_LIBC_MALLOC_ARENA_SIZE
21+
default 2048
22+
23+
endif # BUILD_WITH_TFM
24+
1325
endif # BOARD_STM32WBA65I_DK1

‎boards/st/stm32wba65i_dk1/board.cmake

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,32 @@
11
# Copyright (c) 2025 STMicroelectronics
22
# SPDX-License-Identifier: Apache-2.0
33

4-
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
4+
if(CONFIG_BUILD_WITH_TFM)
5+
set(FLASH_BASE_ADDRESS_S 0x0C000000)
6+
7+
# Flash merged TF-M + Zephyr binary
8+
set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
9+
10+
if (CONFIG_HAS_FLASH_LOAD_OFFSET)
11+
MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
12+
else()
13+
set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
14+
endif()
15+
16+
# System entry point is TF-M vector, located 1kByte after tfm_fmw_partition in DTS
17+
get_target_property(TFM_FWM_NODE_NAME devicetree_target "DT_NODELABEL|slot0_secure_partition")
18+
string(REGEX REPLACE ".*@([^@]+)$" "\\1" TFM_FWM_OFFSET "${TFM_FWM_NODE_NAME}")
19+
if(NOT TFM_FWM_OFFSET)
20+
message(FATAL_ERROR "Could not find TF-M firmware offset from node label slot0_secure_partition")
21+
endif()
22+
math(EXPR TFM_FWM_BOOT_ADDR "0x${TFM_FWM_OFFSET}+${FLASH_BASE_ADDRESS_S}+0x400")
23+
24+
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw"
25+
"--erase" "--start-address=${TFM_FWM_BOOT_ADDR}"
26+
)
27+
else()
28+
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
29+
endif()
530

631
include(${ZEPHYR_BASE}/boards/common/stm32cubeprogrammer.board.cmake)
732
include(${ZEPHYR_BASE}/boards/common/openocd.board.cmake)

‎boards/st/stm32wba65i_dk1/board.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ board:
44
vendor: st
55
socs:
66
- name: stm32wba65xx
7+
variants:
8+
- name: ns

‎boards/st/stm32wba65i_dk1/doc/index.rst

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,45 @@ Supported Features
153153

154154
.. zephyr:board-supported-hw::
155155
156+
Zephyr board options
157+
====================
158+
159+
STM32WBA65I-DK1 board integrates an SoC with Cortex-M33 architecture. Zephyr
160+
provides support for building for both Secure and Non-Secure firmware.
161+
162+
The BOARD options are summarized below:
163+
164+
+---------------------------------+------------------------------------------+
165+
| BOARD | Description |
166+
+=================================+==========================================+
167+
| stm32wba65i_dk1 | For building TrustZone Disabled firmware |
168+
+---------------------------------+------------------------------------------+
169+
| stm32wba65i_dk1/stm32wba65xx/ns | For building Non-Secure firmware |
170+
+---------------------------------+------------------------------------------+
171+
172+
Here are the instructions to build Zephyr with a non-secure configuration,
173+
using :zephyr:code-sample:`tfm_ipc` sample:
174+
175+
.. code-block:: console
176+
177+
$ west build -b stm32wba65i_dk1/stm32wba65xx/ns samples/tfm_integration/tfm_ipc/
178+
179+
Once done, before flashing, you need to first run a generated script that
180+
will set platform option bytes config and erase platform (among others,
181+
option bit TZEN will be set).
182+
183+
.. code-block:: bash
184+
185+
$ ./build/tfm/api_ns/regression.sh
186+
$ west flash
187+
188+
Please note that, after having programmed the board for a TrustZone enabled system
189+
(e.g. with ``./build/tfm/api_ns/regression.sh``), the SoC TZEN option byte is enabled
190+
and you will need to operate specific sequence to disable this TZEN Option Byte
191+
configuration to get your board back in normal state for booting with a TrustZone
192+
disabled system (e.g. without TF-M support).
193+
You can still use STM32CubeProgrammer_ to disable the SoC TZEN Option Byte config.
194+
156195
Connections and IOs
157196
===================
158197

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns.dts

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/*
2+
* Copyright (c) 2025 STMicroelectronics
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
7+
/dts-v1/;
8+
#include "stm32wba65i_dk1.dts"
9+
10+
/ {
11+
chosen {
12+
zephyr,code-partition = &slot0_ns_partition;
13+
};
14+
};
15+
16+
17+
&flash0 {
18+
/delete-node/ partitions;
19+
20+
partitions {
21+
compatible = "fixed-partitions";
22+
#address-cells = <1>;
23+
#size-cells = <1>;
24+
25+
boot_partition: partition@0 {
26+
label = "bootstage";
27+
reg = <0 DT_SIZE_K(144)>;
28+
};
29+
30+
slot0_secure_partition: partition@24000 {
31+
label = "image-secure";
32+
reg = <0x24000 DT_SIZE_K(384)>;
33+
};
34+
35+
slot0_ns_partition: partition@84000 {
36+
label = "image-non-secure";
37+
reg = <0x84000 DT_SIZE_K(384)>;
38+
};
39+
40+
storage_partition: partition@e4000 {
41+
label = "storage";
42+
reg = <0xe4000 (DT_SIZE_K(112) + DT_SIZE_M(1))>;
43+
};
44+
};
45+
};

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
identifier: stm32wba65i_dk1/stm32wba65xx/ns
2+
name: ST STM32WBA65I Discovery kit with TF-M and non-secure
3+
type: mcu
4+
arch: arm
5+
toolchain:
6+
- zephyr
7+
- gnuarmemb
8+
supported:
9+
- gpio
10+
- adc
11+
- rng
12+
- arduino_gpio
13+
- arduino_i2c
14+
- arduino_spi
15+
ram: 512
16+
flash: 2048
17+
vendor: st

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns_defconfig

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright (c) 2025 STMicroelectronics
3+
4+
# enable uart driver
5+
CONFIG_SERIAL=y
6+
7+
# enable GPIO
8+
CONFIG_GPIO=y
9+
10+
# console
11+
CONFIG_CONSOLE=y
12+
CONFIG_UART_CONSOLE=y
13+
14+
# Enable MPU
15+
CONFIG_ARM_MPU=y
16+
17+
# Enable HW stack protection
18+
CONFIG_HW_STACK_PROTECTION=y
19+
20+
# Enable the internal SMPS regulator
21+
CONFIG_POWER_SUPPLY_DIRECT_SMPS=y
22+
23+
# Enable ADC for joystick
24+
CONFIG_ADC=y
25+
26+
# TF-M expects Zephyr includes a 1kB header
27+
CONFIG_ROM_START_OFFSET=0x400
28+
29+
# Enable TZ non-secure configuration
30+
CONFIG_ARM_TRUSTZONE_M=y
31+
CONFIG_RUNTIME_NMI=y
32+
CONFIG_TRUSTED_EXECUTION_NONSECURE=y
33+
CONFIG_BUILD_WITH_TFM=y
34+
CONFIG_TFM_BL2=n

0 commit comments

Comments
 (0)