boards: st: nucleo_u5a5zj_q: Introduce TF-M support

boards/st/nucleo_u5a5zj_q/Kconfig.defconfig

@@ -0,0 +1,24 @@
+# Copyright (c) 2025
+# SPDX-License-Identifier: Apache-2.0
+
+if BOARD_NUCLEO_U5A5ZJ_Q
+
+config TFM_BOARD
+	default "${ZEPHYR_BASE}/boards/st/nucleo_u5a5zj_q/tfm"
+
+if BUILD_WITH_TFM
+
+config USE_DT_CODE_PARTITION
+	default y if TRUSTED_EXECUTION_NONSECURE
+
+config TFM_INITIAL_ATTESTATION_KEY
+	default y
+
+# Disabled to show how to define custom keys,
+#  see nucleo_u5a5zj_q_stm32u5a5xx_ns_defconfig
+config TFM_DUMMY_PROVISIONING
+	default n
+
+endif # BUILD_WITH_TFM
+
+endif # BOARD_NUCLEO_U5A5ZJ_Q

boards/st/nucleo_u5a5zj_q/Kconfig.nucleo_u5a5zj_q

@@ -1,4 +1,4 @@
-# Copyright (c) 2023 STMicroelectronics
+# Copyright (c) 2025 STMicroelectronics
 # SPDX-License-Identifier: Apache-2.0
 
 config BOARD_NUCLEO_U5A5ZJ_Q

boards/st/nucleo_u5a5zj_q/board.cmake

@@ -1,3 +1,18 @@
+# SPDX-License-Identifier: Apache-2.0
+
+if(CONFIG_BUILD_WITH_TFM)
+  set(TFM_FLASH_BASE_ADDRESS 0x0C000000)
+
+  # Flash merged TF-M + Zephyr binary
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+
+  if (CONFIG_HAS_FLASH_LOAD_OFFSET)
+    MATH(EXPR TFM_HEX_BASE_ADDRESS_NS "${TFM_FLASH_BASE_ADDRESS}+${CONFIG_FLASH_LOAD_OFFSET}")
+  else()
+    set(TFM_HEX_BASE_ADDRESS_NS ${TFM_TFM_FLASH_BASE_ADDRESS})
+  endif()
+endif()
+
 # keep first
 board_runner_args(stm32cubeprogrammer "--port=swd" "--reset-mode=hw")
 

boards/st/nucleo_u5a5zj_q/board.yml

@@ -4,3 +4,5 @@ board:
   vendor: st
   socs:
     - name: stm32u5a5xx
+      variants:
+        - name: ns

boards/st/nucleo_u5a5zj_q/nucleo_u5a5zj_q-common.dtsi

@@ -171,10 +171,6 @@
 	status = "okay";
 };
 
-&rng {
-	status = "okay";
-};
-
 &fdcan1 {
 	clocks = <&rcc STM32_CLOCK(APB1_2, 9)>,
 		 <&rcc STM32_SRC_PLL1_Q FDCAN1_SEL(1)>;
@@ -196,3 +192,17 @@
 &vbat4 {
 	status = "okay";
 };
+
+&gpdma1 {
+	status = "okay";
+};
+
+zephyr_udc0: &usbotg_hs {
+	pinctrl-0 = <&usb_otg_hs_dm_pa11 &usb_otg_hs_dp_pa12>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&otghs_phy {
+	clock-reference = "SYSCFG_OTG_HS_PHY_CLK_16MHz";
+};

boards/st/nucleo_u5a5zj_q/nucleo_u5a5zj_q.dts

@@ -21,6 +21,7 @@
 		zephyr,flash = &flash0;
 		zephyr,canbus = &fdcan1;
 		zephyr,code-partition = &slot0_partition;
+		zephyr,entropy = &rng;
 	};
 
 	aliases {
@@ -74,16 +75,6 @@
 	status = "okay";
 };
 
-&gpdma1 {
+&rng {
 	status = "okay";
 };
-
-zephyr_udc0: &usbotg_hs {
-	pinctrl-0 = <&usb_otg_hs_dm_pa11 &usb_otg_hs_dp_pa12>;
-	pinctrl-names = "default";
-	status = "okay";
-};
-
-&otghs_phy {
-	clock-reference = "SYSCFG_OTG_HS_PHY_CLK_16MHz";
-};

boards/st/nucleo_u5a5zj_q/nucleo_u5a5zj_q_stm32u5a5xx_ns.dts

@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2025 Leica Geosystems AG
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+#include "nucleo_u5a5zj_q-common.dtsi"
+
+/ {
+	model = "STMicroelectronics STM32U5A5ZJ-NUCLEO-Q board";
+	compatible = "st,stm32u5a5zj-nucleo-q";
+
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	chosen {
+		zephyr,console = &usart1;
+		zephyr,shell-uart = &usart1;
+		zephyr,sram = &sram0;
+		zephyr,flash = &flash0;
+		zephyr,code-partition = &slot0_ns_partition;
+		zephyr,entropy = &psa_rng;
+	};
+
+	aliases {
+		led0 = &blue_led_1;
+		sw0 = &user_button;
+	};
+
+	/* SRAM3 + SRAM5 (832 kiB + 832kiB)*/
+	/delete-node/ memory@20000000;
+	sram0: memory@200d0000 {
+		compatible = "mmio-sram";
+		reg = <0x200d0000 DT_SIZE_K(1664)>;
+	};
+
+	psa_rng: psa-rng {
+		compatible = "zephyr,psa-crypto-rng";
+		status = "okay";
+	};
+};
+
+&flash0 {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		/*
+		 * Following flash partition is compatible with requirements
+		 * given in TFM configuration given for current board.
+		 * It might require adjustment depending on evolutions on TFM.
+		 */
+		 boot_partition: partition@0 {
+			label = "mcuboot";
+			reg = <0x00000000 DT_SIZE_K(384)>;
+			read-only;
+		};
+
+		/* Secure image primary slot */
+		slot0_partition: partition@60000 {
+			label = "image-0";
+			reg = <0x00060000 DT_SIZE_K(512)>;
+		};
+
+		/* Non-secure image primary slot */
+		slot0_ns_partition: partition@e0000 {
+			label = "image-0-nonsecure";
+			reg = <0x000e0000 DT_SIZE_K(1280)>;
+		};
+
+		/* Secure image secondary slot */
+		slot1_partition: partition@220000 {
+			label = "image-1";
+			reg = <0x00220000 DT_SIZE_K(512)>;
+		};
+
+		/* Non-secure image secondary slot */
+		slot1_ns_partition: partition@2a0000 {
+			label = "image-1-nonsecure";
+			reg = <0x002a0000 DT_SIZE_K(1280)>;
+		};
+
+		/* Applicative Non Volatile Storage */
+		storage_partition: partition@3e0000 {
+			label = "storage";
+			reg = <0x003e0000 DT_SIZE_K(128)>;
+		};
+	};
+};
+
+&usart1 {
+	pinctrl-0 = <&usart1_tx_pa9 &usart1_rx_pa10>;
+	pinctrl-names = "default";
+	current-speed = <115200>;
+	status = "okay";
+};

boards/st/nucleo_u5a5zj_q/nucleo_u5a5zj_q_stm32u5a5xx_ns.yaml

@@ -0,0 +1,27 @@
+#
+# Copyright (c) 2025 Leica Geosystems AG
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+identifier: nucleo_u5a5zj_q/stm32u5a5xx/ns
+name: ST Nucleo U5A5ZJ Q
+type: mcu
+arch: arm
+toolchain:
+  - zephyr
+supported:
+  - backup_sram
+  - can
+  - dac
+  - dma
+  - gpio
+  - i2c
+  - rtc
+  - spi
+  - trusted-firmware-m
+  - usart
+  - usbd
+  - watchdog
+ram: 1664
+flash: 1280

boards/st/nucleo_u5a5zj_q/nucleo_u5a5zj_q_stm32u5a5xx_ns_defconfig

@@ -0,0 +1,31 @@
+#
+# Copyright (c) 2025 Leica Geosystems AG
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+# enable uart driver
+CONFIG_SERIAL=y
+
+# enable GPIO
+CONFIG_GPIO=y
+
+# console
+CONFIG_CONSOLE=y
+CONFIG_UART_CONSOLE=y
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+
+# Enable HW stack protection
+CONFIG_HW_STACK_PROTECTION=y
+
+# TF-M
+CONFIG_ARM_TRUSTZONE_M=y
+CONFIG_RUNTIME_NMI=y
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+
+# Keys - These are for development purposes only and should be changed.
+CONFIG_TFM_MCUBOOT_SIGNATURE_TYPE="RSA-3072"
+CONFIG_TFM_KEY_FILE_S="${BOARD_DIR}/tfm/keys/rsa-3072-private-s.pem"
+CONFIG_TFM_KEY_FILE_NS="${BOARD_DIR}/tfm/keys/rsa-3072-private-ns.pem"

boards/st/nucleo_u5a5zj_q/tfm/CMakeLists.txt

@@ -0,0 +1,80 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2020, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+#-------------------------------------------------------------------------------
+
+set(NUCLEO_U5A5ZJ_Q_DIR ${CMAKE_CURRENT_LIST_DIR})
+set(STM_COMMON_DIR ${PLATFORM_DIR}/ext/target/stm/common)
+
+include(${STM_COMMON_DIR}/stm32u5xx/CMakeLists.txt)
+
+#========================= Platform defs ===============================#
+
+# Specify the location of platform specific build dependencies.
+target_sources(tfm_s
+    PRIVATE
+        ${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_s.c
+)
+
+# cpuarch.cmake is used to set things that related to the platform that are both
+install(FILES
+    ${TARGET_PLATFORM_PATH}/cpuarch.cmake
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}
+)
+
+install(FILES
+    ${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_ns.c
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}/Device/Source
+)
+
+install(DIRECTORY
+    ${TARGET_PLATFORM_PATH}/ns/
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}
+)
+
+install(DIRECTORY
+    ${TARGET_PLATFORM_PATH}/include
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}
+)
+
+install(FILES
+    ${TARGET_PLATFORM_PATH}/accelerator/crypto_accelerator_config.h
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}/include
+)
+
+install(DIRECTORY
+    ${STM_COMMON_DIR}/hal/accelerator/
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}/include
+    FILES_MATCHING PATTERN "*.h"
+)
+
+install(FILES
+    ${NUCLEO_U5A5ZJ_Q_DIR}/partition/flash_layout.h
+    ${NUCLEO_U5A5ZJ_Q_DIR}/partition/region_defs.h
+    DESTINATION ${INSTALL_PLATFORM_NS_DIR}/partition
+)
+
+if(BL2)
+    target_sources(bl2
+        PRIVATE
+            ${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_bl2.c
+            ${STM_COMMON_DIR}/hal/provision/nvm_init.c
+            ${STM_COMMON_DIR}/hal/provision/nvmcnt_init.c
+            ${NUCLEO_U5A5ZJ_Q_DIR}/keys/otp_provision.c
+    )
+endif()
+#install flash layout for postbuild.sh
+install(FILES
+    ${NUCLEO_U5A5ZJ_Q_DIR}/partition/flash_layout.h
+    ${NUCLEO_U5A5ZJ_Q_DIR}/partition/region_defs.h
+    DESTINATION ${CMAKE_INSTALL_PREFIX}
+)
+set (BL2_FILE_TO_PREPROCESS ${CMAKE_CURRENT_BINARY_DIR}/image_macros_to_preprocess_bl2.c)
+file(WRITE ${BL2_FILE_TO_PREPROCESS} ${BL2_PREPROCESSING})
+
+install(FILES
+    ${BL2_FILE_TO_PREPROCESS}
+    DESTINATION ${CMAKE_INSTALL_PREFIX}
+)