Add stm32wba65i_dk1 board and TF-M support on stm32wba65i_dk and nucleo_wba65ri

boards/st/nucleo_wba65ri/Kconfig.defconfig

@@ -10,4 +10,16 @@ config SPI_STM32_INTERRUPT
 	default y
 	depends on SPI
 
+if BUILD_WITH_TFM
+
+# Not defining LIBC malloc arena has the effect of declaring all available RAM
+# as available for malloc.
+# This currently conflicts with TF-M MPU setting, resulting in a hard fault.
+# Define a specific size to avoid this situation.
+
+config COMMON_LIBC_MALLOC_ARENA_SIZE
+	default 2048
+
+endif # BUILD_WITH_TFM
+
 endif # BOARD_NUCLEO_WBA65RI

boards/st/nucleo_wba65ri/board.cmake

@@ -1,6 +1,31 @@
 # SPDX-License-Identifier: Apache-2.0
 
-board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
+if(CONFIG_BUILD_WITH_TFM)
+  set(FLASH_BASE_ADDRESS_S 0x0C000000)
+
+  # Flash merged TF-M + Zephyr binary
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+
+  if (CONFIG_HAS_FLASH_LOAD_OFFSET)
+    MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
+  else()
+    set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
+  endif()
+
+  # System entry point is TF-M vector, located 1kByte after tfm_fmw_partition in DTS
+  get_target_property(TFM_FWM_NODE_NAME devicetree_target "DT_NODELABEL|slot0_secure_partition")
+  string(REGEX REPLACE ".*@([^@]+)$" "\\1" TFM_FWM_OFFSET "${TFM_FWM_NODE_NAME}")
+  if(NOT TFM_FWM_OFFSET)
+    message(FATAL_ERROR "Could not find TF-M firmware offset from node label slot0_secure_partition")
+  endif()
+  math(EXPR TFM_FWM_BOOT_ADDR "0x${TFM_FWM_OFFSET}+${FLASH_BASE_ADDRESS_S}+0x400")
+
+  board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw"
+    "--erase" "--start-address=${TFM_FWM_BOOT_ADDR}"
+  )
+else()
+  board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
+endif()
 
 include(${ZEPHYR_BASE}/boards/common/stm32cubeprogrammer.board.cmake)
 include(${ZEPHYR_BASE}/boards/common/openocd-stm32.board.cmake)

boards/st/nucleo_wba65ri/board.yml

@@ -4,3 +4,5 @@ board:
   vendor: st
   socs:
     - name: stm32wba65xx
+      variants:
+        - name: ns

boards/st/nucleo_wba65ri/doc/nucleo_wba65ri.rst

@@ -152,6 +152,45 @@ Supported Features
 
 .. zephyr:board-supported-hw::
 
+Zephyr board options
+====================
+
+Zephyr supports building both Secure and Non-Secure firmware for
+Nucleo WBA65RI board.
+
+The BOARD options are summarized below:
+
++---------------------------------+------------------------------------------+
+| BOARD                           | Description                              |
++=================================+==========================================+
+| stm32wba65i_dk1                 | For building TrustZone Disabled firmware |
++---------------------------------+------------------------------------------+
+| stm32wba65i_dk1/stm32wba65xx/ns | For building Non-Secure firmware         |
++---------------------------------+------------------------------------------+
+
+Here are the instructions to build Zephyr with a non-secure configuration,
+using :zephyr:code-sample:`tfm_ipc` sample:
+
+   .. code-block:: console
+
+      $ west build -b nucleo_wba65ri/stm32wba65xx/ns samples/tfm_integration/tfm_ipc/
+
+Once done, before flashing, you need to first run a generated script that
+will set platform Option Bytes config and erase internal flash (among others,
+Option Bit TZEN will be set).
+
+   .. code-block:: bash
+
+      $ ./build/tfm/api_ns/regression.sh
+      $ west flash
+
+Please note that, after having programmed the board for a TrustZone enabled system
+(e.g. with ``./build/tfm/api_ns/regression.sh``), the SoC TZEN Option Byte is enabled
+and you will need to operate specific sequence to disable this TZEN Option Byte
+configuration to get your board back in normal state for booting with a TrustZone
+disabled system (e.g. without TF-M support).
+You can use STM32CubeProgrammer_ to disable the SoC TZEN Option Byte config.
+
 Connections and IOs
 ===================
 

boards/st/nucleo_wba65ri/nucleo_wba65ri_stm32wba65xx_ns.dts

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2025 STMicroelectronics
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+#include "nucleo_wba65ri.dts"
+
+/ {
+	chosen {
+		zephyr,code-partition = &slot0_ns_partition;
+	};
+};
+
+
+&flash0 {
+	/delete-node/ partitions;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		boot_partition: partition@0 {
+			label = "bootstage";
+			reg = <0 DT_SIZE_K(48)>;
+		};
+
+		slot0_secure_partition: partition@c000 {
+			label = "image-secure";
+			reg = <0xc000 DT_SIZE_K(256)>;
+		};
+
+		slot0_ns_partition: partition@4c000 {
+			label = "image-non-secure";
+			reg = <0x4c000 DT_SIZE_K(512)>;
+		};
+
+		storage_partition: partition@cc000 {
+			label = "storage";
+			reg = <0xcc000 (DT_SIZE_M(1) - DT_SIZE_K(208))>;
+		};
+	};
+};

boards/st/nucleo_wba65ri/nucleo_wba65ri_stm32wba65xx_ns.yaml

@@ -0,0 +1,19 @@
+identifier: nucleo_wba65ri/stm32wba65xx/ns
+name: ST STM32WBA65I Discovery kit with TF-M and non-secure firmware
+type: mcu
+arch: arm
+toolchain:
+  - zephyr
+  - gnuarmemb
+supported:
+  - gpio
+  - i2c
+  - spi
+  - adc
+  - rng
+  - arduino_gpio
+  - arduino_i2c
+  - arduino_spi
+ram: 512
+flash: 2048
+vendor: st

boards/st/nucleo_wba65ri/nucleo_wba65ri_stm32wba65xx_ns_defconfig

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2025 STMicroelectronics
+
+# Enable UART driver
+CONFIG_SERIAL=y
+
+# Enable GPIO
+CONFIG_GPIO=y
+
+# Console
+CONFIG_CONSOLE=y
+CONFIG_UART_CONSOLE=y
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+
+# Enable HW stack protection
+CONFIG_HW_STACK_PROTECTION=y
+
+# Enable the internal SMPS regulator
+CONFIG_POWER_SUPPLY_DIRECT_SMPS=y
+
+# Enable TZ non-secure configuration
+CONFIG_ARM_TRUSTZONE_M=y
+CONFIG_RUNTIME_NMI=y
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+CONFIG_BUILD_WITH_TFM=y
+CONFIG_TFM_BL2=n

boards/st/stm32wba65i_dk1/Kconfig.defconfig

@@ -0,0 +1,25 @@
+# STM32WBA65I Discovery kit board configuration
+
+# Copyright (c) 2025 STMicroelectronics
+
+# SPDX-License-Identifier: Apache-2.0
+
+if BOARD_STM32WBA65I_DK1
+
+config SPI_STM32_INTERRUPT
+	default y
+	depends on SPI
+
+if BUILD_WITH_TFM
+
+# Not defining LIBC malloc arena has the effect of declaring all available RAM
+# as available for malloc.
+# This currently conflicts with TF-M MPU setting, resulting in a hard fault.
+# Define a specific size to avoid this situation.
+
+config COMMON_LIBC_MALLOC_ARENA_SIZE
+	default 2048
+
+endif # BUILD_WITH_TFM
+
+endif # BOARD_STM32WBA65I_DK1

boards/st/stm32wba65i_dk1/Kconfig.stm32wba65i_dk1

@@ -0,0 +1,5 @@
+# Copyright (c) 2025 STMicroelectronics
+# SPDX-License-Identifier: Apache-2.0
+
+config BOARD_STM32WBA65I_DK1
+	select SOC_STM32WBA65XX

boards/st/stm32wba65i_dk1/arduino_r3_connector.dtsi

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2025 STMicroelectronics
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/ {
+	arduino_header: connector {
+		compatible = "arduino-header-r3";
+		#gpio-cells = <2>;
+		gpio-map-mask = <0xffffffff 0xffffffc0>;
+		gpio-map-pass-thru = <0 0x3f>;
+		gpio-map = <0 0 &gpioa 4 0>,	/* A0 */
+			   <1 0 &gpioa 6 0>,	/* A1 */
+			   <2 0 &gpioa 2 0>,	/* A2 */
+			   <3 0 &gpioa 1 0>,	/* A3 */
+			   <4 0 &gpioa 5 0>,	/* A4 */
+			   <5 0 &gpioa 0 0>,	/* A5 */
+			   <6 0 &gpioa 11 0>,	/* D0 */
+			   <7 0 &gpioa 12 0>,	/* D1 */
+			   <8 0 &gpioe 0 0>,	/* D2 */
+			   <9 0 &gpiob 13 0>,	/* D3 */
+			   <10 0 &gpioa 3 0>,	/* D4 */
+			   <11 0 &gpiob 14 0>,	/* D5 */
+			   <12 0 &gpiob 0 0>,	/* D6 */
+			   <13 0 &gpiod 14 0>,	/* D7 */
+			   <14 0 &gpioa 10 0>,	/* D8 */
+			   <15 0 &gpiob 11 0>,	/* D9 */
+			   <16 0 &gpiob 9 0>,	/* D10 */
+			   <17 0 &gpioc 3 0>,	/* D11 */
+			   <18 0 &gpioa 9 0>,	/* D12 */
+			   <19 0 &gpiob 10 0>,	/* D13 */
+			   <20 0 &gpiob 1 0>,	/* D14 */
+			   <21 0 &gpiob 2 0>;	/* D15 */
+	};
+};
+
+arduino_i2c: &i2c1 {};
+arduino_spi: &spi1 {};

boards/st/stm32wba65i_dk1/board.cmake

@@ -0,0 +1,32 @@
+# Copyright (c) 2025 STMicroelectronics
+# SPDX-License-Identifier: Apache-2.0
+
+if(CONFIG_BUILD_WITH_TFM)
+  set(FLASH_BASE_ADDRESS_S 0x0C000000)
+
+  # Flash merged TF-M + Zephyr binary
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+
+  if (CONFIG_HAS_FLASH_LOAD_OFFSET)
+    MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${FLASH_BASE_ADDRESS_S}+${CONFIG_FLASH_LOAD_OFFSET}")
+  else()
+    set(TFM_HEX_BASE_ADDRESS_NS ${TFM_FLASH_BASE_ADDRESS_S})
+  endif()
+
+  # System entry point is TF-M vector, located 1kByte after tfm_fmw_partition in DTS
+  get_target_property(TFM_FWM_NODE_NAME devicetree_target "DT_NODELABEL|slot0_secure_partition")
+  string(REGEX REPLACE ".*@([^@]+)$" "\\1" TFM_FWM_OFFSET "${TFM_FWM_NODE_NAME}")
+  if(NOT TFM_FWM_OFFSET)
+    message(FATAL_ERROR "Could not find TF-M firmware offset from node label slot0_secure_partition")
+  endif()
+  math(EXPR TFM_FWM_BOOT_ADDR "0x${TFM_FWM_OFFSET}+${FLASH_BASE_ADDRESS_S}+0x400")
+
+  board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw"
+    "--erase" "--start-address=${TFM_FWM_BOOT_ADDR}"
+  )
+else()
+  board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
+endif()
+
+include(${ZEPHYR_BASE}/boards/common/stm32cubeprogrammer.board.cmake)
+include(${ZEPHYR_BASE}/boards/common/openocd.board.cmake)

boards/st/stm32wba65i_dk1/board.yml

@@ -0,0 +1,8 @@
+board:
+  name: stm32wba65i_dk1
+  full_name: STM32WBA65I Discovery kit
+  vendor: st
+  socs:
+    - name: stm32wba65xx
+      variants:
+        - name: ns