wolfBoot/zephyr/patches/0004-stm32h5-ns-board-support.patch

diff --git a/boards/st/nucleo_h563zi/Kconfig.defconfig b/boards/st/nucleo_h563zi/Kconfig.defconfig
index e14e20d30a4..824a007d004 100644
--- a/boards/st/nucleo_h563zi/Kconfig.defconfig
+++ b/boards/st/nucleo_h563zi/Kconfig.defconfig
@@ -8,4 +8,7 @@ if BOARD_NUCLEO_H563ZI
 configdefault NET_L2_ETHERNET
 	default y
 
+config BUILD_OUTPUT_ADJUST_LMA
+	default "0x400" if TRUSTED_EXECUTION_NONSECURE
+
 endif # BOARD_NUCLEO_H563ZI
diff --git a/boards/st/nucleo_h563zi/board.yml b/boards/st/nucleo_h563zi/board.yml
index fec89e6d37b..b0814b9397b 100644
--- a/boards/st/nucleo_h563zi/board.yml
+++ b/boards/st/nucleo_h563zi/board.yml
@@ -4,3 +4,5 @@ board:
   vendor: st
   socs:
     - name: stm32h563xx
+      variants:
+        - name: ns
diff --git a/boards/st/stm32h573i_dk/Kconfig.defconfig b/boards/st/stm32h573i_dk/Kconfig.defconfig
index b24ccf7f106..f0a1fbfea3f 100644
--- a/boards/st/stm32h573i_dk/Kconfig.defconfig
+++ b/boards/st/stm32h573i_dk/Kconfig.defconfig
@@ -13,6 +13,9 @@ configdefault NET_L2_ETHERNET
 configdefault SDMMC_STM32_CLOCK_CHECK
 	default n
 
+config BUILD_OUTPUT_ADJUST_LMA
+	default "0x400" if TRUSTED_EXECUTION_NONSECURE
+
 if DISPLAY
 
 choice ST7789V_PIXEL_FORMAT
diff --git a/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts b/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts
index 46357c2e2d5..66583781c3c 100644
--- a/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts
+++ b/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns.dts
@@ -16,12 +16,13 @@
 		zephyr,flash = &flash0;
 		zephyr,flash-controller = &flash;
 		zephyr,code-partition = &slot0_ns_partition;
+		zephyr,sram = &sram3;
 	};
 };
 
-/* Last 64kB of SRAM1 are owned by TF-M */
+/* Use SRAM3 for non-secure, keep SRAM1/2 secure */
 &sram1 {
-	reg = <0x20000000 DT_SIZE_K(256 - 64)>;
+	status = "disabled";
 };
 
 /* SRAM2 is owned by TF-M */
@@ -29,6 +30,10 @@
 	status = "disabled";
 };
 
+&sram3 {
+	reg = <0x20050000 DT_SIZE_K(256)>;
+};
+
 &flash0 {
 	partitions {
 		compatible = "fixed-partitions";
diff --git a/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig b/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig
index ecccf647305..0d19316aaf5 100644
--- a/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig
+++ b/boards/st/stm32h573i_dk/stm32h573i_dk_stm32h573xx_ns_defconfig
@@ -22,3 +22,7 @@ CONFIG_GPIO=y
 CONFIG_TRUSTED_EXECUTION_NONSECURE=y
 CONFIG_RUNTIME_NMI=y
 CONFIG_TFM_MCUBOOT_SIGNATURE_TYPE="RSA-3072"
+
+# Use SRAM3 as non-secure RAM (aligned with wolfBoot TZ layout)
+CONFIG_SRAM_BASE_ADDRESS=0x20050000
+CONFIG_SRAM_SIZE=256
diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts
new file mode 100644
index 00000000000..db6964e7659
--- /dev/null
+++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.dts
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026 wolfSSL Inc.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+#include "nucleo_h563zi-common.dtsi"
+
+/ {
+	model = "STMicroelectronics STM32H563ZI-NUCLEO board (Non-Secure)";
+	compatible = "st,stm32h563zi-nucleo";
+
+	chosen {
+		zephyr,console = &usart3;
+		zephyr,shell-uart = &usart3;
+		zephyr,sram = &sram3;
+		zephyr,flash = &flash0;
+		zephyr,code-partition = &slot0_ns_partition;
+		zephyr,canbus = &fdcan1;
+	};
+
+	aliases {
+		led0 = &green_led_1;
+		led1 = &yellow_led_1;
+		sw0 = &user_button;
+		watchdog0 = &iwdg;
+		pwm-led0 = &pwm_led_1;
+		volt-sensor0 = &vref;
+		volt-sensor1 = &vbat;
+	};
+};
+
+/* Use SRAM3 for non-secure, keep SRAM1/2 secure */
+&sram1 {
+	status = "disabled";
+};
+
+&sram2 {
+	status = "disabled";
+};
+
+&sram3 {
+	reg = <0x20050000 DT_SIZE_K(256)>;
+};
+
+&flash0 {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		/* Layout inspired by wolfBoot STM32H5 TZ PSA config */
+		boot_partition: partition@0 {
+			label = "wolfboot";
+			reg = <0x00000000 DT_SIZE_K(64)>;
+		};
+
+		slot0_partition: partition@10000 {
+			label = "image-0";
+			reg = <0x00010000 DT_SIZE_K(320)>;
+		};
+
+		slot0_ns_partition: partition@60000 {
+			label = "image-0-nonsecure";
+			reg = <0x00060000 DT_SIZE_K(640)>;
+		};
+
+		slot1_partition: partition@100000 {
+			label = "image-1";
+			reg = <0x00100000 DT_SIZE_K(320)>;
+		};
+
+		slot1_ns_partition: partition@150000 {
+			label = "image-1-nonsecure";
+			reg = <0x00150000 DT_SIZE_K(640)>;
+		};
+
+		storage_partition: partition@1f0000 {
+			label = "storage";
+			reg = <0x001f0000 DT_SIZE_K(64)>;
+		};
+	};
+};
diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml
new file mode 100644
index 00000000000..27a5200fd18
--- /dev/null
+++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns.yaml
@@ -0,0 +1,9 @@
+identifier: nucleo_h563zi/stm32h563xx/ns
+name: ST Nucleo H563ZI non-secure
+type: mcu
+arch: arm
+toolchain:
+  - zephyr
+ram: 192
+flash: 639 # size in kB of 1 app slot minus wolfBoot header size (1KB)
+vendor: st
diff --git a/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig
new file mode 100644
index 00000000000..4fd9c2bbdcf
--- /dev/null
+++ b/boards/st/nucleo_h563zi/nucleo_h563zi_stm32h563xx_ns_defconfig
@@ -0,0 +1,29 @@
+# Copyright (c) 2026 wolfSSL Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+
+# Enable HW stack protection
+CONFIG_HW_STACK_PROTECTION=y
+
+# Enable UART driver
+CONFIG_SERIAL=y
+
+# Enable console
+CONFIG_CONSOLE=y
+CONFIG_UART_CONSOLE=y
+
+# Enable GPIO
+CONFIG_GPIO=y
+
+# Enable TZ non-secure configuration
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+CONFIG_RUNTIME_NMI=y
+
+# Do not build TF-M by default for this /ns variant
+CONFIG_BUILD_WITH_TFM=n
+
+# Use SRAM3 as non-secure RAM (aligned with wolfBoot TZ layout)
+CONFIG_SRAM_BASE_ADDRESS=0x20050000
+CONFIG_SRAM_SIZE=256