STM32 TrustZone improvements (when tested with wolfIP)

[dgarske]

No description provided.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates STM32H5 TrustZone configuration to better support running a non-secure wolfIP application by loosening GPIO and RAM security/privilege settings where needed.

Changes:

• Clear GPIO secure-configuration (SECCFGR) for additional ports used by the non-secure app and enable GPIOG clocking.
• Rework GTZC MPCBB configuration: keep SRAM1 secure while making SRAM2/SRAM3 non-secure and unprivileged.
• Expand the SAU non-secure RAM region to include SRAM2 in addition to SRAM3.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
hal/stm32h5.c	Clears GPIO SECCFGR across ports used by wolfIP NS app and enables GPIOG clock to allow NS GPIO configuration.
hal/stm32_tz.c	Adjusts GTZC MPCBB and SAU configuration so SRAM2+SRAM3 are NS/unpriv, while SRAM1 remains secure for wolfBoot.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[danielinux]

I'm OK about setting all GPIO banks to non-secure for the purpose of the test application. The non-privilege Copilot "medium" comments make sense to me, I'd keep non-secure+privileged SRAM2 and SRAM3 as default for the OS to decide boundaries later. Please check again and consider Copilot's "medium" comment in stm32_tz.c line 234 to 243