Fixed zephyr patches to include missing files

zephyr/README.md

@@ -29,11 +29,7 @@ From the Zephyr base (`zephyrproject/zephyr`), apply the patches in order:
 ```sh
 cd /path/to/your/workspace/zephyrproject/zephyr
 
-git apply /path/to/your/workspace/wolfboot/zephyr/patches/0001-wolfboot-tee-driver.patch
-git apply /path/to/your/workspace/wolfboot/zephyr/patches/0002-wolfboot-tee-dt-binding.patch
-git apply /path/to/your/workspace/wolfboot/zephyr/patches/0003-wolfboot-sample.patch
-git apply /path/to/your/workspace/wolfboot/zephyr/patches/0004-stm32h5-ns-board-support.patch
-git apply /path/to/your/workspace/wolfboot/zephyr/patches/0005-wolfboot-psa-kconfig.patch
+git apply /path/to/your/workspace/wolfboot/zephyr/patches/*.patch
 ```
 
 These patches add:

zephyr/patches/0001-wolfboot-tee-driver.patch

@@ -2,7 +2,9 @@ diff --git a/drivers/tee/CMakeLists.txt b/drivers/tee/CMakeLists.txt
 index aaf8924b096..15ca3a06782 100644
 --- a/drivers/tee/CMakeLists.txt
 +++ b/drivers/tee/CMakeLists.txt
-@@ -3,4 +3,5 @@
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: Apache-2.0
+ 
  add_subdirectory_ifdef(CONFIG_OPTEE optee)
 +add_subdirectory_ifdef(CONFIG_WOLFBOOT_TEE wolfboot)
  
@@ -19,3 +21,358 @@ index dd5acce4e00..24447494d01 100644
 +source "drivers/tee/wolfboot/Kconfig"
  
  endif # TEE
+diff --git a/drivers/tee/wolfboot/CMakeLists.txt b/drivers/tee/wolfboot/CMakeLists.txt
+new file mode 100644
+index 00000000000..812499ea603
+--- /dev/null
++++ b/drivers/tee/wolfboot/CMakeLists.txt
+@@ -0,0 +1,9 @@
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++
++zephyr_library()
++zephyr_library_sources_ifdef(CONFIG_WOLFBOOT_TEE wolfboot.c)
++
++if(CONFIG_WOLFBOOT_TEE)
++  set_target_properties(zephyr_property_target PROPERTIES SIGNING_SCRIPT
++    ${CMAKE_CURRENT_LIST_DIR}/wolfboot_sign.cmake)
++endif()
+diff --git a/drivers/tee/wolfboot/Kconfig b/drivers/tee/wolfboot/Kconfig
+new file mode 100644
+index 00000000000..d32faaf8e9b
+--- /dev/null
++++ b/drivers/tee/wolfboot/Kconfig
+@@ -0,0 +1,9 @@
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++
++config WOLFBOOT_TEE
++	bool "wolfBoot TEE driver"
++	depends on TEE
++	select PSA_CRYPTO_CLIENT
++	select WOLFBOOT
++	help
++	  Enable the wolfBoot TEE driver and PSA CMSE glue.
+diff --git a/drivers/tee/wolfboot/wolfboot.c b/drivers/tee/wolfboot/wolfboot.c
+new file mode 100644
+index 00000000000..ae69692422c
+--- /dev/null
++++ b/drivers/tee/wolfboot/wolfboot.c
+@@ -0,0 +1,41 @@
++/* SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial */
++
++#include <errno.h>
++#include <zephyr/device.h>
++#include <zephyr/drivers/tee.h>
++
++#define DT_DRV_COMPAT wolfboot_tee
++
++#define TEE_IMPL_ID_WOLFBOOT 0x57424F4F /* "WBOO" */
++
++static int wolfboot_get_version(const struct device *dev, struct tee_version_info *info)
++{
++	ARG_UNUSED(dev);
++
++	if (!info) {
++		return -EINVAL;
++	}
++
++	info->impl_id = TEE_IMPL_ID_WOLFBOOT;
++	info->impl_caps = 0;
++	info->gen_caps = TEE_GEN_CAP_GP;
++
++	return 0;
++}
++
++static const struct tee_driver_api wolfboot_tee_api = {
++	.get_version = wolfboot_get_version,
++};
++
++static int wolfboot_tee_init(const struct device *dev)
++{
++	ARG_UNUSED(dev);
++	return 0;
++}
++
++#define WOLFBOOT_TEE_INIT(inst)                                               \
++	DEVICE_DT_INST_DEFINE(inst, wolfboot_tee_init, NULL, NULL, NULL,      \
++			      POST_KERNEL, CONFIG_KERNEL_INIT_PRIORITY_DEVICE, \
++			      &wolfboot_tee_api);
++
++DT_INST_FOREACH_STATUS_OKAY(WOLFBOOT_TEE_INIT)
+diff --git a/drivers/tee/wolfboot/wolfboot_config.py b/drivers/tee/wolfboot/wolfboot_config.py
+new file mode 100644
+index 00000000000..b5110089d78
+--- /dev/null
++++ b/drivers/tee/wolfboot/wolfboot_config.py
+@@ -0,0 +1,69 @@
++#!/usr/bin/env python3
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++
++"""Import select values from a wolfBoot .config file."""
++
++from __future__ import annotations
++
++import argparse
++import re
++from pathlib import Path
++
++
++_CONFIG_RE = re.compile(r"^([A-Za-z0-9_]+)\??=\s*(.+)$")
++
++
++def _parse_value(raw: str) -> int:
++    val = raw.strip()
++    if val.lower().startswith("0x"):
++        return int(val, 16)
++    return int(val, 10)
++
++
++def parse_config(path: Path) -> dict[str, str]:
++    data: dict[str, str] = {}
++    for line in path.read_text(encoding="utf-8").splitlines():
++        line = line.strip()
++        if not line or line.startswith("#"):
++            continue
++        match = _CONFIG_RE.match(line)
++        if not match:
++            continue
++        key, value = match.group(1), match.group(2)
++        data[key] = value.strip()
++    return data
++
++
++def emit_conf(path: Path, header_size: int) -> None:
++    content = f"CONFIG_ROM_START_OFFSET=0x{header_size:x}\n"
++    path.write_text(content, encoding="utf-8")
++
++
++def main() -> int:
++    parser = argparse.ArgumentParser()
++    parser.add_argument("--config", required=True, type=Path)
++    parser.add_argument("--emit-conf", type=Path)
++    parser.add_argument("--print-header-size", action="store_true")
++    args = parser.parse_args()
++
++    cfg_path: Path = args.config
++    if not cfg_path.exists():
++        raise SystemExit(f"wolfBoot config not found: {cfg_path}")
++
++    cfg = parse_config(cfg_path)
++    if "IMAGE_HEADER_SIZE" not in cfg:
++        raise SystemExit("IMAGE_HEADER_SIZE not found in wolfBoot config")
++
++    header_size = _parse_value(cfg["IMAGE_HEADER_SIZE"])
++
++    if args.emit_conf:
++        emit_conf(args.emit_conf, header_size)
++
++    if args.print_header_size:
++        print(header_size)
++
++    return 0
++
++
++if __name__ == "__main__":
++    raise SystemExit(main())
+diff --git a/drivers/tee/wolfboot/wolfboot_sign.cmake b/drivers/tee/wolfboot/wolfboot_sign.cmake
+new file mode 100644
+index 00000000000..c5f0017cbea
+--- /dev/null
++++ b/drivers/tee/wolfboot/wolfboot_sign.cmake
+@@ -0,0 +1,164 @@
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++
++function(wolfboot_parse_version version_string out_var)
++  if(version_string STREQUAL "")
++    set(${out_var} 0 PARENT_SCOPE)
++    return()
++  endif()
++
++  string(REGEX MATCH "^([0-9]+)\\.([0-9]+)\\.([0-9]+)" _match "${version_string}")
++  if(NOT _match STREQUAL "")
++    string(REGEX REPLACE "^([0-9]+)\\.([0-9]+)\\.([0-9]+).*" "\\1;\\2;\\3" _parts "${version_string}")
++    list(GET _parts 0 _maj)
++    list(GET _parts 1 _min)
++    list(GET _parts 2 _pat)
++    math(EXPR _ver "${_maj} * 10000 + ${_min} * 100 + ${_pat}")
++    set(${out_var} ${_ver} PARENT_SCOPE)
++    return()
++  endif()
++
++  set(${out_var} 0 PARENT_SCOPE)
++endfunction()
++
++function(zephyr_wolfboot_tasks)
++  if(NOT DEFINED WOLFBOOT_MODULE_DIR AND DEFINED ZEPHYR_WOLFBOOT_MODULE_DIR)
++    set(WOLFBOOT_MODULE_DIR ${ZEPHYR_WOLFBOOT_MODULE_DIR})
++  endif()
++
++  if(NOT CONFIG_BUILD_OUTPUT_BIN)
++    message(FATAL_ERROR "Can't sign images for wolfBoot: CONFIG_BUILD_OUTPUT_BIN is required.")
++  endif()
++
++  set(keyfile "${CONFIG_WOLFBOOT_SIGNATURE_KEY_FILE}")
++  if("${keyfile}" STREQUAL "")
++    set(keyfile "${CONFIG_MCUBOOT_SIGNATURE_KEY_FILE}")
++  endif()
++
++  if("${keyfile}" STREQUAL "")
++    message(WARNING "No signing key configured; wolfBoot signing skipped.")
++    return()
++  endif()
++
++  if(NOT IS_ABSOLUTE "${keyfile}")
++    if(EXISTS "${APPLICATION_CONFIG_DIR}/${keyfile}")
++      set(keyfile "${APPLICATION_CONFIG_DIR}/${keyfile}")
++    elseif(DEFINED WEST_TOPDIR AND EXISTS "${WEST_TOPDIR}/${keyfile}")
++      set(keyfile "${WEST_TOPDIR}/${keyfile}")
++    elseif(DEFINED WOLFBOOT_MODULE_DIR AND EXISTS "${WOLFBOOT_MODULE_DIR}/${keyfile}")
++      set(keyfile "${WOLFBOOT_MODULE_DIR}/${keyfile}")
++    endif()
++  endif()
++
++  if(NOT EXISTS "${keyfile}")
++    message(FATAL_ERROR "Can't sign images for wolfBoot: can't find key ${keyfile}")
++  endif()
++  set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${keyfile})
++
++  if("${CONFIG_WOLFBOOT_SIGN_TOOL}" STREQUAL "")
++    if(DEFINED WOLFBOOT_MODULE_DIR)
++      set(sign_tool "${WOLFBOOT_MODULE_DIR}/tools/keytools/sign")
++    else()
++      message(FATAL_ERROR "Can't sign images for wolfBoot: WOLFBOOT_MODULE_DIR not set.")
++    endif()
++  else()
++    set(sign_tool "${CONFIG_WOLFBOOT_SIGN_TOOL}")
++  endif()
++
++  if(NOT IS_ABSOLUTE "${sign_tool}")
++    if(DEFINED WOLFBOOT_MODULE_DIR AND EXISTS "${WOLFBOOT_MODULE_DIR}/${sign_tool}")
++      set(sign_tool "${WOLFBOOT_MODULE_DIR}/${sign_tool}")
++    elseif(DEFINED WEST_TOPDIR AND EXISTS "${WEST_TOPDIR}/${sign_tool}")
++      set(sign_tool "${WEST_TOPDIR}/${sign_tool}")
++    endif()
++  endif()
++
++  if(NOT EXISTS "${sign_tool}")
++    message(FATAL_ERROR "Can't sign images for wolfBoot: can't find sign tool ${sign_tool}")
++  endif()
++
++  set(wolfboot_header_size "")
++  if(DEFINED WOLFBOOT_MODULE_DIR)
++    set(wolfboot_config "${WOLFBOOT_MODULE_DIR}/.config")
++    if(EXISTS "${wolfboot_config}")
++      set(wolfboot_cfg_tool
++          "${CMAKE_CURRENT_LIST_DIR}/wolfboot_config.py")
++      execute_process(
++        COMMAND ${PYTHON_EXECUTABLE} ${wolfboot_cfg_tool}
++                --config ${wolfboot_config}
++                --emit-conf ${ZEPHYR_BINARY_DIR}/wolfboot.conf
++                --print-header-size
++        OUTPUT_VARIABLE wolfboot_header_size
++        OUTPUT_STRIP_TRAILING_WHITESPACE
++        RESULT_VARIABLE wolfboot_cfg_result
++      )
++      if(NOT wolfboot_cfg_result EQUAL 0)
++        message(FATAL_ERROR "Failed to parse wolfBoot config at ${wolfboot_config}")
++      endif()
++      set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
++                   ${wolfboot_config})
++      set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
++                   ${wolfboot_cfg_tool})
++    else()
++      message(WARNING "wolfBoot config not found at ${wolfboot_config}; using Zephyr defaults.")
++    endif()
++  endif()
++
++  set(ver_int "${CONFIG_WOLFBOOT_SIGN_VERSION}")
++  if("${ver_int}" STREQUAL "1" AND NOT "${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION}" STREQUAL "")
++    wolfboot_parse_version("${CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION}" ver_int)
++    if(ver_int EQUAL 0)
++      set(ver_int "${CONFIG_WOLFBOOT_SIGN_VERSION}")
++    endif()
++  endif()
++
++  set(output ${ZEPHYR_BINARY_DIR}/${KERNEL_NAME})
++  set(signed_bin ${output}.signed.bin)
++  set(signed_hex ${output}.signed.hex)
++  set(payload_bin ${output}.payload.bin)
++  set(sign_input ${output}.bin)
++  set(signed_base ${output})
++  set(sign_input ${output}.bin)
++
++  set(sign_args "--${CONFIG_WOLFBOOT_SIGN_ALG}" "--${CONFIG_WOLFBOOT_SIGN_HASH}")
++
++  set(sign_env_cmd ${CMAKE_COMMAND} -E env)
++  if(NOT "${wolfboot_header_size}" STREQUAL "")
++    list(APPEND sign_env_cmd IMAGE_HEADER_SIZE=${wolfboot_header_size})
++  endif()
++
++  if(DEFINED CONFIG_ROM_START_OFFSET AND NOT "${CONFIG_ROM_START_OFFSET}" STREQUAL "0")
++    set(strip_tool "${CMAKE_CURRENT_LIST_DIR}/wolfboot_strip.py")
++    set(sign_input ${payload_bin})
++    set(signed_base ${output}.payload)
++    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
++                 COMMAND ${PYTHON_EXECUTABLE} ${strip_tool}
++                         --input ${output}.bin
++                         --output ${payload_bin}
++                         --strip ${CONFIG_ROM_START_OFFSET})
++    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
++                 ${strip_tool})
++  endif()
++
++  set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
++               COMMAND ${sign_env_cmd} ${sign_tool} ${sign_args}
++                       ${sign_input} ${keyfile} ${ver_int}
++               COMMAND ${CMAKE_COMMAND} -E copy
++                       ${signed_base}_v${ver_int}_signed.bin ${signed_bin})
++
++  if(CONFIG_BUILD_OUTPUT_BIN)
++    set(BYPRODUCT_KERNEL_SIGNED_BIN_NAME "${signed_bin}"
++        CACHE FILEPATH "Signed kernel bin file" FORCE)
++    set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts ${signed_bin})
++  endif()
++
++  if(CONFIG_BUILD_OUTPUT_HEX)
++    set(BYPRODUCT_KERNEL_SIGNED_HEX_NAME "${signed_hex}"
++        CACHE FILEPATH "Signed kernel hex file" FORCE)
++    set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
++                 COMMAND ${CMAKE_OBJCOPY} -I binary -O ihex
++                         ${signed_bin} ${signed_hex})
++    set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts ${signed_hex})
++  endif()
++endfunction()
++
++zephyr_wolfboot_tasks()
+diff --git a/drivers/tee/wolfboot/wolfboot_strip.py b/drivers/tee/wolfboot/wolfboot_strip.py
+new file mode 100644
+index 00000000000..6411412767c
+--- /dev/null
++++ b/drivers/tee/wolfboot/wolfboot_strip.py
+@@ -0,0 +1,27 @@
++#!/usr/bin/env python3
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++
++"""Strip a fixed number of bytes from the start of a binary image."""
++
++from __future__ import annotations
++
++import argparse
++from pathlib import Path
++
++
++def main() -> int:
++    parser = argparse.ArgumentParser()
++    parser.add_argument("--input", required=True, type=Path)
++    parser.add_argument("--output", required=True, type=Path)
++    parser.add_argument("--strip", required=True, type=lambda x: int(x, 0))
++    args = parser.parse_args()
++
++    data = args.input.read_bytes()
++    if args.strip < 0 or args.strip > len(data):
++        raise SystemExit(f"strip size {args.strip} exceeds input size {len(data)}")
++    args.output.write_bytes(data[args.strip:])
++    return 0
++
++
++if __name__ == "__main__":
++    raise SystemExit(main())

zephyr/patches/0002-wolfboot-tee-dt-binding.patch

@@ -1,16 +1,8 @@
 diff --git a/dts/bindings/vendor-prefixes.txt b/dts/bindings/vendor-prefixes.txt
-index a81e9000b8a..c36bbcd36e5 100644
+index 7e7d27b5331..c36bbcd36e5 100644
 --- a/dts/bindings/vendor-prefixes.txt
 +++ b/dts/bindings/vendor-prefixes.txt
-@@ -166,7 +166,6 @@ csq	Shenzen Chuangsiqi Technology Co.,Ltd.
- ct	CTHINGS.CO
- cubietech	Cubietech, Ltd.
- cypress	Cypress Semiconductor Corporation
--cytron	Cytron Technologies
- cznic	CZ.NIC, z.s.p.o.
- dallas	Maxim Integrated Products (formerly Dallas Semiconductor)
- dataimage	DataImage, Inc.
-@@ -770,6 +769,7 @@ wits	Shenzhen Merrii Technology Co., Ltd. (WITS)
+@@ -769,6 +769,7 @@ wits	Shenzhen Merrii Technology Co., Ltd. (WITS)
  witte	Witte Technology
  wiznet	WIZnet Co., Ltd.
  wlf	Wolfson Microelectronics

zephyr/patches/0003-wolfboot-sample.patch

@@ -1,3 +1,39 @@
+diff --git a/samples/wolfboot_integration/psa_crypto/app.overlay b/samples/wolfboot_integration/psa_crypto/app.overlay
+new file mode 100644
+index 00000000000..1329dd33c4d
+--- /dev/null
++++ b/samples/wolfboot_integration/psa_crypto/app.overlay
+@@ -0,0 +1,10 @@
++/*
++ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ */
++
++/ {
++	wolfboot_tee: wolfboot_tee {
++		compatible = "wolfssl,tee";
++		status = "okay";
++	};
++};
+diff --git a/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf b/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf
+new file mode 100644
+index 00000000000..85ae2978c4c
+--- /dev/null
++++ b/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++#
++# Board-specific wolfBoot settings can be added here if needed.
+diff --git a/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay b/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay
+new file mode 100644
+index 00000000000..f1cc3115fe8
+--- /dev/null
++++ b/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay
+@@ -0,0 +1,5 @@
++/*
++ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ */
++
++/* Board-specific wolfBoot overrides can be added here if needed. */
 diff --git a/samples/wolfboot_integration/psa_crypto/CMakeLists.txt b/samples/wolfboot_integration/psa_crypto/CMakeLists.txt
 new file mode 100644
 index 00000000000..41f26064a0b
@@ -142,6 +178,76 @@ index 00000000000..c9035821c22
 +endchoice
 +
 +source "Kconfig.zephyr"
+diff --git a/samples/wolfboot_integration/psa_crypto/prj.conf b/samples/wolfboot_integration/psa_crypto/prj.conf
+new file mode 100644
+index 00000000000..93bab465806
+--- /dev/null
++++ b/samples/wolfboot_integration/psa_crypto/prj.conf
+@@ -0,0 +1,64 @@
++CONFIG_LOG=y
++CONFIG_LOG_RUNTIME_FILTERING=y
++CONFIG_LOG_BUFFER_SIZE=2048
++CONFIG_LOG_PROCESS_TRIGGER_THRESHOLD=0
++CONFIG_LOG_DEFAULT_LEVEL=3
++CONFIG_NO_OPTIMIZATIONS=y
++CONFIG_BUILD_OUTPUT_BIN=y
++CONFIG_FPU=n
++
++
++#CONFIG_SHELL=n
++#CONFIG_SHELL_HISTORY=y
++#CONFIG_SHELL_VT100_COLORS=y
++#CONFIG_SHELL_CMDS=n
++#CONFIG_PSA_SHELL=y
++
++CONFIG_TEE=y
++CONFIG_WOLFBOOT_TEE=y
++CONFIG_BUILD_WITH_TFM=n
++CONFIG_PSA_CRYPTO_PROVIDER_CUSTOM=y
++
++# The Zephyr CMSIS emulation assumes that ticks are ms, currently
++CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000
++
++CONFIG_MAIN_STACK_SIZE=8192
++CONFIG_HEAP_MEM_POOL_SIZE=4096
++
++# Mbed TLS
++CONFIG_MBEDTLS=y
++CONFIG_MBEDTLS_BUILTIN=y
++CONFIG_MBEDTLS_ENABLE_HEAP=y
++CONFIG_MBEDTLS_HEAP_SIZE=32768
++CONFIG_MBEDTLS_USER_CONFIG_ENABLE=y
++CONFIG_MBEDTLS_USER_CONFIG_FILE="config_mbedtls.h"
++CONFIG_MBEDTLS_USE_PSA_CRYPTO=y
++
++# Added because build was failing
++# Needed for PK + PSA and CSR/write paths
++CONFIG_MBEDTLS_ASN1_PARSE_C=y
++
++CONFIG_PSA_CRYPTO=y
++CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y
++CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
++CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
++CONFIG_PSA_WANT_ECC_SECP_R1_256=y
++CONFIG_PSA_WANT_ALG_ECDSA=y
++CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=n
++CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=n
++CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=n
++CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=n
++CONFIG_PSA_WANT_ALG_RSA_PSS=y
++CONFIG_PSA_WANT_ALG_SHA_256=y
++CONFIG_MBEDTLS_PK_WRITE_C=y
++CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
++
++# JSON
++CONFIG_JSON_LIBRARY=y
++
++CONFIG_WOLFBOOT_SIGN_ALG="ecc256"
++CONFIG_WOLFBOOT_SIGN_HASH="sha256"
++CONFIG_WOLFBOOT_SIGN_VERSION=1
++CONFIG_WOLFBOOT_SIGNATURE_KEY_FILE="wolfboot_signing_private_key.der"
++
++CONFIG_REQUIRES_FULL_LIBC=y
 diff --git a/samples/wolfboot_integration/psa_crypto/README.rst b/samples/wolfboot_integration/psa_crypto/README.rst
 new file mode 100644
 index 00000000000..684430b717a
@@ -221,112 +327,6 @@ index 00000000000..684430b717a
 +``CONFIG_WOLFBOOT_SIGNATURE_KEY_FILE`` (or reuse
 +``CONFIG_MCUBOOT_SIGNATURE_KEY_FILE``) and set algorithm/hash via
 +``CONFIG_WOLFBOOT_SIGN_ALG`` and ``CONFIG_WOLFBOOT_SIGN_HASH``.
-diff --git a/samples/wolfboot_integration/psa_crypto/app.overlay b/samples/wolfboot_integration/psa_crypto/app.overlay
-new file mode 100644
-index 00000000000..1329dd33c4d
---- /dev/null
-+++ b/samples/wolfboot_integration/psa_crypto/app.overlay
-@@ -0,0 +1,10 @@
-+/*
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
-+ */
-+
-+/ {
-+	wolfboot_tee: wolfboot_tee {
-+		compatible = "wolfssl,tee";
-+		status = "okay";
-+	};
-+};
-diff --git a/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf b/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf
-new file mode 100644
-index 00000000000..85ae2978c4c
---- /dev/null
-+++ b/samples/wolfboot_integration/psa_crypto/boards/max32657evkit_max32657_ns.conf
-@@ -0,0 +1,3 @@
-+# SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
-+#
-+# Board-specific wolfBoot settings can be added here if needed.
-diff --git a/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay b/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay
-new file mode 100644
-index 00000000000..f1cc3115fe8
---- /dev/null
-+++ b/samples/wolfboot_integration/psa_crypto/boards/nrf9160dk_nrf9160_ns.overlay
-@@ -0,0 +1,5 @@
-+/*
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
-+ */
-+
-+/* Board-specific wolfBoot overrides can be added here if needed. */
-diff --git a/samples/wolfboot_integration/psa_crypto/prj.conf b/samples/wolfboot_integration/psa_crypto/prj.conf
-new file mode 100644
-index 00000000000..93bab465806
---- /dev/null
-+++ b/samples/wolfboot_integration/psa_crypto/prj.conf
-@@ -0,0 +1,64 @@
-+CONFIG_LOG=y
-+CONFIG_LOG_RUNTIME_FILTERING=y
-+CONFIG_LOG_BUFFER_SIZE=2048
-+CONFIG_LOG_PROCESS_TRIGGER_THRESHOLD=0
-+CONFIG_LOG_DEFAULT_LEVEL=3
-+CONFIG_NO_OPTIMIZATIONS=y
-+CONFIG_BUILD_OUTPUT_BIN=y
-+CONFIG_FPU=n
-+
-+
-+#CONFIG_SHELL=n
-+#CONFIG_SHELL_HISTORY=y
-+#CONFIG_SHELL_VT100_COLORS=y
-+#CONFIG_SHELL_CMDS=n
-+#CONFIG_PSA_SHELL=y
-+
-+CONFIG_TEE=y
-+CONFIG_WOLFBOOT_TEE=y
-+CONFIG_BUILD_WITH_TFM=n
-+CONFIG_PSA_CRYPTO_PROVIDER_CUSTOM=y
-+
-+# The Zephyr CMSIS emulation assumes that ticks are ms, currently
-+CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000
-+
-+CONFIG_MAIN_STACK_SIZE=8192
-+CONFIG_HEAP_MEM_POOL_SIZE=4096
-+
-+# Mbed TLS
-+CONFIG_MBEDTLS=y
-+CONFIG_MBEDTLS_BUILTIN=y
-+CONFIG_MBEDTLS_ENABLE_HEAP=y
-+CONFIG_MBEDTLS_HEAP_SIZE=32768
-+CONFIG_MBEDTLS_USER_CONFIG_ENABLE=y
-+CONFIG_MBEDTLS_USER_CONFIG_FILE="config_mbedtls.h"
-+CONFIG_MBEDTLS_USE_PSA_CRYPTO=y
-+
-+# Added because build was failing
-+# Needed for PK + PSA and CSR/write paths
-+CONFIG_MBEDTLS_ASN1_PARSE_C=y
-+
-+CONFIG_PSA_CRYPTO=y
-+CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY=y
-+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
-+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
-+CONFIG_PSA_WANT_ECC_SECP_R1_256=y
-+CONFIG_PSA_WANT_ALG_ECDSA=y
-+CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=n
-+CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=n
-+CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT=n
-+CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=n
-+CONFIG_PSA_WANT_ALG_RSA_PSS=y
-+CONFIG_PSA_WANT_ALG_SHA_256=y
-+CONFIG_MBEDTLS_PK_WRITE_C=y
-+CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=n
-+
-+# JSON
-+CONFIG_JSON_LIBRARY=y
-+
-+CONFIG_WOLFBOOT_SIGN_ALG="ecc256"
-+CONFIG_WOLFBOOT_SIGN_HASH="sha256"
-+CONFIG_WOLFBOOT_SIGN_VERSION=1
-+CONFIG_WOLFBOOT_SIGNATURE_KEY_FILE="wolfboot_signing_private_key.der"
-+
-+CONFIG_REQUIRES_FULL_LIBC=y
 diff --git a/samples/wolfboot_integration/psa_crypto/sample.yaml b/samples/wolfboot_integration/psa_crypto/sample.yaml
 new file mode 100644
 index 00000000000..874fa555f80
@@ -393,14 +393,14 @@ index 00000000000..17f1abfe7e5
 +#define MCUBOOT_LOG_LEVEL 0
 diff --git a/samples/wolfboot_integration/psa_crypto/src/configs/config_tfm.h b/samples/wolfboot_integration/psa_crypto/src/configs/config_tfm.h
 new file mode 100644
-index 00000000000..bdeb030a8e2
+index 00000000000..38b24d6e78c
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/configs/config_tfm.h
 @@ -0,0 +1,10 @@
 +/*
 + * Copyright (c) 2024 Nordic Semiconductor
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +/* In TF-M the default value of CRYPTO_ENGINE_BUF_SIZE is 0x2080.
@@ -409,21 +409,21 @@ index 00000000000..bdeb030a8e2
 +#define CRYPTO_ENGINE_BUF_SIZE 0x2400
 diff --git a/samples/wolfboot_integration/psa_crypto/src/main.c b/samples/wolfboot_integration/psa_crypto/src/main.c
 new file mode 100644
-index 00000000000..9c995e42ee2
+index 00000000000..1fd0888d8ce
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/main.c
 @@ -0,0 +1,50 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <zephyr/kernel.h>
 +#include <zephyr/logging/log_ctrl.h>
 +#include <zephyr/logging/log.h>
 +
-+#include "arm_tee_ns_interface.h"
++#include "tfm_ns_interface.h"
 +#include "psa_attestation.h"
 +#include "psa_crypto.h"
 +#include "util_app_cfg.h"
@@ -465,14 +465,14 @@ index 00000000000..9c995e42ee2
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/psa_attestation.c b/samples/wolfboot_integration/psa_crypto/src/psa_attestation.c
 new file mode 100644
-index 00000000000..3112259cb20
+index 00000000000..0bc40ded4ec
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/psa_attestation.c
 @@ -0,0 +1,144 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <zephyr/kernel.h>
@@ -615,14 +615,14 @@ index 00000000000..3112259cb20
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/psa_attestation.h b/samples/wolfboot_integration/psa_crypto/src/psa_attestation.h
 new file mode 100644
-index 00000000000..2df88cb0c00
+index 00000000000..1164dda8ad4
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/psa_attestation.h
 @@ -0,0 +1,65 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <stdarg.h>
@@ -686,14 +686,14 @@ index 00000000000..2df88cb0c00
 +#endif
 diff --git a/samples/wolfboot_integration/psa_crypto/src/psa_crypto.c b/samples/wolfboot_integration/psa_crypto/src/psa_crypto.c
 new file mode 100644
-index 00000000000..f3d43d1e0c0
+index 00000000000..6a934c1c15e
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/psa_crypto.c
 @@ -0,0 +1,871 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <stdio.h>
@@ -1563,14 +1563,14 @@ index 00000000000..f3d43d1e0c0
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/psa_crypto.h b/samples/wolfboot_integration/psa_crypto/src/psa_crypto.h
 new file mode 100644
-index 00000000000..aa7ebcab464
+index 00000000000..1998e9ceec1
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/psa_crypto.h
 @@ -0,0 +1,34 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <zephyr/kernel.h>
@@ -1603,14 +1603,14 @@ index 00000000000..aa7ebcab464
 +#endif
 diff --git a/samples/wolfboot_integration/psa_crypto/src/shell.c b/samples/wolfboot_integration/psa_crypto/src/shell.c
 new file mode 100644
-index 00000000000..0a56cc5c39c
+index 00000000000..62b39451abe
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/shell.c
 @@ -0,0 +1,40 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <stdlib.h>
@@ -1649,14 +1649,14 @@ index 00000000000..0a56cc5c39c
 +#endif
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.c b/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.c
 new file mode 100644
-index 00000000000..70e016a7313
+index 00000000000..fdec12f9aaa
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.c
 @@ -0,0 +1,76 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <string.h>
@@ -1731,14 +1731,14 @@ index 00000000000..70e016a7313
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.h b/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.h
 new file mode 100644
-index 00000000000..34d34db1780
+index 00000000000..2b3e312b264
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_app_cfg.h
 @@ -0,0 +1,63 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <zephyr/kernel.h>
@@ -1800,14 +1800,14 @@ index 00000000000..34d34db1780
 +#endif
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_app_log.c b/samples/wolfboot_integration/psa_crypto/src/util_app_log.c
 new file mode 100644
-index 00000000000..0f18cd29d41
+index 00000000000..52f766c81cc
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_app_log.c
 @@ -0,0 +1,110 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +#include <zephyr/kernel.h>
 +#include <zephyr/logging/log_ctrl.h>
@@ -1916,14 +1916,14 @@ index 00000000000..0f18cd29d41
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_app_log.h b/samples/wolfboot_integration/psa_crypto/src/util_app_log.h
 new file mode 100644
-index 00000000000..43fb97529cf
+index 00000000000..af935163e08
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_app_log.h
 @@ -0,0 +1,35 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <stdarg.h>
@@ -1957,14 +1957,14 @@ index 00000000000..43fb97529cf
 +#endif
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_sformat.c b/samples/wolfboot_integration/psa_crypto/src/util_sformat.c
 new file mode 100644
-index 00000000000..ab34e86e760
+index 00000000000..bd46aec54fc
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_sformat.c
 @@ -0,0 +1,115 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#include <ctype.h>
@@ -2078,14 +2078,14 @@ index 00000000000..ab34e86e760
 +}
 diff --git a/samples/wolfboot_integration/psa_crypto/src/util_sformat.h b/samples/wolfboot_integration/psa_crypto/src/util_sformat.h
 new file mode 100644
-index 00000000000..014814d6e6d
+index 00000000000..b76d2aa5b91
 --- /dev/null
 +++ b/samples/wolfboot_integration/psa_crypto/src/util_sformat.h
 @@ -0,0 +1,45 @@
 +/*
 + * Copyright (c) 2019,2020 Linaro Limited
 + *
-+ * SPDX-License-Identifier: GPL-3.0 OR LicenceRef-wolfssl.com-Commercial
++ * SPDX-License-Identifier: Apache-2.0
 + */
 +
 +#ifndef _SFORMAT_H_

zephyr/patches/0004-stm32h5-ns-board-support.patch

@@ -77,3 +77,143 @@ index ecccf647305..0d19316aaf5 100644
 +# Use SRAM3 as non-secure RAM (aligned with wolfBoot TZ layout)
 +CONFIG_SRAM_BASE_ADDRESS=0x20050000
 +CONFIG_SRAM_SIZE=256
+diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts
+new file mode 100644
+index 00000000000..db6964e7659
+--- /dev/null
++++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts
+@@ -0,0 +1,84 @@
++/*
++ * Copyright (c) 2026 wolfSSL Inc.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++
++/dts-v1/;
++#include "nucleo_h563zi-common.dtsi"
++
++/ {
++	model = "STMicroelectronics STM32H563ZI-NUCLEO board (Non-Secure)";
++	compatible = "st,stm32h563zi-nucleo";
++
++	chosen {
++		zephyr,console = &usart3;
++		zephyr,shell-uart = &usart3;
++		zephyr,sram = &sram3;
++		zephyr,flash = &flash0;
++		zephyr,code-partition = &slot0_ns_partition;
++		zephyr,canbus = &fdcan1;
++	};
++
++	aliases {
++		led0 = &green_led_1;
++		led1 = &yellow_led_1;
++		sw0 = &user_button;
++		watchdog0 = &iwdg;
++		pwm-led0 = &pwm_led_1;
++		volt-sensor0 = &vref;
++		volt-sensor1 = &vbat;
++	};
++};
++
++/* Use SRAM3 for non-secure, keep SRAM1/2 secure */
++&sram1 {
++	status = "disabled";
++};
++
++&sram2 {
++	status = "disabled";
++};
++
++&sram3 {
++	reg = <0x20050000 DT_SIZE_K(256)>;
++};
++
++&flash0 {
++	partitions {
++		compatible = "fixed-partitions";
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		/* Layout inspired by wolfBoot STM32H5 TZ PSA config */
++		boot_partition: partition@0 {
++			label = "wolfboot";
++			reg = <0x00000000 DT_SIZE_K(64)>;
++		};
++
++		slot0_partition: partition@10000 {
++			label = "image-0";
++			reg = <0x00010000 DT_SIZE_K(320)>;
++		};
++
++		slot0_ns_partition: partition@60000 {
++			label = "image-0-nonsecure";
++			reg = <0x00060000 DT_SIZE_K(640)>;
++		};
++
++		slot1_partition: partition@100000 {
++			label = "image-1";
++			reg = <0x00100000 DT_SIZE_K(320)>;
++		};
++
++		slot1_ns_partition: partition@150000 {
++			label = "image-1-nonsecure";
++			reg = <0x00150000 DT_SIZE_K(640)>;
++		};
++
++		storage_partition: partition@1f0000 {
++			label = "storage";
++			reg = <0x001f0000 DT_SIZE_K(64)>;
++		};
++	};
++};
+diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml
+new file mode 100644
+index 00000000000..27a5200fd18
+--- /dev/null
++++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml
+@@ -0,0 +1,9 @@
++identifier: nucleo_h563zi/stm32h563xx/ns
++name: ST Nucleo H563ZI non-secure
++type: mcu
++arch: arm
++toolchain:
++  - zephyr
++ram: 192
++flash: 639 # size in kB of 1 app slot minus wolfBoot header size (1KB)
++vendor: st
+diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig
+new file mode 100644
+index 00000000000..4fd9c2bbdcf
+--- /dev/null
++++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig
+@@ -0,0 +1,29 @@
++# Copyright (c) 2026 wolfSSL Inc.
++# SPDX-License-Identifier: Apache-2.0
++
++# Enable MPU
++CONFIG_ARM_MPU=y
++
++# Enable HW stack protection
++CONFIG_HW_STACK_PROTECTION=y
++
++# Enable UART driver
++CONFIG_SERIAL=y
++
++# Enable console
++CONFIG_CONSOLE=y
++CONFIG_UART_CONSOLE=y
++
++# Enable GPIO
++CONFIG_GPIO=y
++
++# Enable TZ non-secure configuration
++CONFIG_TRUSTED_EXECUTION_NONSECURE=y
++CONFIG_RUNTIME_NMI=y
++
++# Do not build TF-M by default for this /ns variant
++CONFIG_BUILD_WITH_TFM=n
++
++# Use SRAM3 as non-secure RAM (aligned with wolfBoot TZ layout)
++CONFIG_SRAM_BASE_ADDRESS=0x20050000
++CONFIG_SRAM_SIZE=256