Skip to content

Commit b1f593d

Browse files
etienne-lmsetienne-lms
committed
boards: st: stm32wba65i_dk1: Add 'ns' variant for TF-M support
Add variant ns to stm32wba65i_dk1 board to embed TF-M in the SoC secure world. The flash layout is synced with the layout defined in Zephyr TF-M integration of platform STM32WBA65I. Successfully tested against a few samples and test samples: - samples/tfm_integration/psa_crypto - samples/tfm_integration/psa_protected_storage - samples/tfm_integration/tfm_ipc - samples/tfm_integration/tfm_regression_test - samples/tfm_integration/tfm_secure_partition - tests/subsys/secure_storage/psa/crypto - tests/subsys/secure_storage/psa/its (with CONFIG_TFM_ITS_MAX_ASSET_SIZE_OVERRIDE=y and CONFIG_TFM_ITS_MAX_ASSET_SIZE=256) Support for PSA Arch Tests (samples/tfm_integration/tfm_psa_test) is not yet merged but is in under review [1]. Link: ARM-software/psa-arch-tests#406 [1] Signed-off-by: Etienne Carriere <[email protected]>
1 parent 9fbdf1c commit b1f593d

File tree

6 files changed

+163
-1
lines changed

6 files changed

+163
-1
lines changed

‎boards/st/stm32wba65i_dk1/board.cmake‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,29 @@
11
# Copyright (c) 2025 STMicroelectronics
22
# SPDX-License-Identifier: Apache-2.0
33

4-
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
4+
if(CONFIG_BUILD_WITH_TFM)
5+
set(FLASH_BASE_ADDRESS_S 0x0C000000)
6+
7+
# Flash merged TF-M + Zephyr binary
8+
set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
9+
10+
if(CONFIG_HAS_FLASH_LOAD_OFFSET)
11+
MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
12+
else()
13+
set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
14+
endif()
15+
16+
# System entry point is TF-M vector, located 1kByte after tfm_fmw_partition in DTS
17+
dt_nodelabel(tfm_partition_path NODELABEL slot0_secure_partition REQUIRED)
18+
dt_reg_addr(tfm_partition_offset PATH ${tfm_partition_path} REQUIRED)
19+
math(EXPR tfm_fwm_boot_address "${tfm_partition_offset}+${FLASH_BASE_ADDRESS_S}+0x400")
20+
21+
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw"
22+
"--erase" "--start-address=${tfm_fwm_boot_address}"
23+
)
24+
else()
25+
board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
26+
endif()
527

628
include(${ZEPHYR_BASE}/boards/common/stm32cubeprogrammer.board.cmake)
729
include(${ZEPHYR_BASE}/boards/common/openocd-stm32.board.cmake)

‎boards/st/stm32wba65i_dk1/board.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ board:
44
vendor: st
55
socs:
66
- name: stm32wba65xx
7+
variants:
8+
- name: ns

‎boards/st/stm32wba65i_dk1/doc/index.rst‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,48 @@ Supported Features
151151

152152
.. zephyr:board-supported-hw::
153153
154+
Zephyr board options
155+
====================
156+
157+
Zephyr supports building both Secure and Non-Secure firmware for
158+
STM32WBA65I-DK1 board where TF-M is the embedded Secure firmware
159+
and Zephyr the Non-Secure firmware.
160+
161+
The BOARD options are summarized below:
162+
163+
+---------------------------------+------------------------------------------+
164+
| BOARD | Description |
165+
+=================================+==========================================+
166+
| stm32wba65i_dk1 | For building TrustZone Disabled firmware |
167+
+---------------------------------+------------------------------------------+
168+
| stm32wba65i_dk1/stm32wba65xx/ns | For building Non-Secure firmware |
169+
+---------------------------------+------------------------------------------+
170+
171+
Here are the instructions to build Zephyr with a non-secure configuration,
172+
using :zephyr:code-sample:`tfm_ipc` sample:
173+
174+
.. zephyr-app-commands::
175+
:zephyr-app: samples/tfm_integration/tfm_ipc
176+
:board: stm32wba65i_dk1/stm32wba65xx/ns
177+
:goals: build
178+
179+
Once done, before flashing, you need to first run a generated script that
180+
will set platform Option Bytes config and erase internal flash (among others,
181+
Option Bit TZEN will be set).
182+
183+
.. code-block:: bash
184+
185+
$ ./build/tfm/api_ns/regression.sh
186+
$ west flash
187+
188+
Please note that, after having programmed the board for a TrustZone enabled system
189+
(e.g. with ``./build/tfm/api_ns/regression.sh``), the SoC TZEN Option Byte is enabled
190+
and you will need to operate specific sequence to disable this TZEN Option Byte
191+
configuration to get your board back in normal state for booting with a TrustZone
192+
disabled system (e.g. without TF-M support).
193+
You can use STM32CubeProgrammer_ to disable the SoC TZEN Option Byte config. Refer
194+
to `How to disable STM32WBA65 TZEN Option Byte`_.
195+
154196
Connections and IOs
155197
===================
156198

@@ -230,3 +272,6 @@ You can debug an application in the usual way using OpenOCD. Here is an example
230272

231273
.. _STM32CubeProgrammer:
232274
https://www.st.com/en/development-tools/stm32cubeprog.html
275+
276+
.. _How to disable STM32WBA65 TZEN Option Byte:
277+
https://wiki.st.com/stm32mcu/wiki/Connectivity:STM32WBA_BLE_%26_TrustZone#How_to_disable_the_TrustZone

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns.dts‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/*
2+
* Copyright (c) 2025 STMicroelectronics
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
7+
/dts-v1/;
8+
#include "stm32wba65i_dk1.dts"
9+
10+
/ {
11+
chosen {
12+
zephyr,code-partition = &slot0_ns_partition;
13+
};
14+
15+
/* SRAM1 (node label sram0) last 64kByte are owned by TF-M */
16+
sram0: memory@20000000 {
17+
reg = <0x20000000 DT_SIZE_K(448 - 64)>;
18+
};
19+
20+
/* SRAM2 (node label sram1) is owned by TF-M */
21+
/delete-node/ memory@20070000;
22+
};
23+
24+
&flash0 {
25+
/delete-node/ partitions;
26+
27+
partitions {
28+
compatible = "fixed-partitions";
29+
#address-cells = <1>;
30+
#size-cells = <1>;
31+
32+
boot_partition: partition@0 {
33+
label = "bootstage";
34+
reg = <0 DT_SIZE_K(48)>;
35+
};
36+
37+
slot0_secure_partition: partition@c000 {
38+
label = "image-secure";
39+
reg = <0xc000 DT_SIZE_K(256)>;
40+
};
41+
42+
slot0_ns_partition: partition@4c000 {
43+
label = "image-non-secure";
44+
reg = <0x4c000 DT_SIZE_K(512)>;
45+
};
46+
47+
storage_partition: partition@cc000 {
48+
label = "storage";
49+
reg = <0xcc000 (DT_SIZE_M(2) - DT_SIZE_K(48 + 256 + 512))>;
50+
};
51+
};
52+
};

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
identifier: stm32wba65i_dk1/stm32wba65xx/ns
2+
name: ST STM32WBA65I Discovery kit with TF-M and non-secure firmware
3+
type: mcu
4+
arch: arm
5+
toolchain:
6+
- zephyr
7+
- gnuarmemb
8+
ram: 384
9+
flash: 512
10+
vendor: st

‎boards/st/stm32wba65i_dk1/stm32wba65i_dk1_stm32wba65xx_ns_defconfig‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright (c) 2025 STMicroelectronics
3+
4+
# Enable UART driver
5+
CONFIG_SERIAL=y
6+
7+
# Enable GPIO
8+
CONFIG_GPIO=y
9+
10+
# Console
11+
CONFIG_CONSOLE=y
12+
CONFIG_UART_CONSOLE=y
13+
14+
# Enable MPU
15+
CONFIG_ARM_MPU=y
16+
17+
# Enable HW stack protection
18+
CONFIG_HW_STACK_PROTECTION=y
19+
20+
# Enable the internal SMPS regulator
21+
CONFIG_POWER_SUPPLY_DIRECT_SMPS=y
22+
23+
# Enable ADC for joystick
24+
CONFIG_ADC=y
25+
26+
# Header offset since TF-M has no BL2 hence Zephyr is not signed
27+
CONFIG_ROM_START_OFFSET=0x400
28+
29+
# Enable TZ non-secure configuration
30+
CONFIG_TRUSTED_EXECUTION_NONSECURE=y
31+
CONFIG_RUNTIME_NMI=y

0 commit comments

Comments
 (0)