[aidangarske]

• Adds config/examples/stm32l5-tz-wolftrust.config so wolfBoot can verify and hand off to a Secure application on the
  STM32L5.
• With WOLFBOOT_SECURE_APP, SRAM, flash and peripherals stay Secure; the application assigns Non-secure resources itself.
• Derives the PSA lifecycle from the RDP and TZEN option bytes (hal/stm32l5_lifecycle.h) instead of a fixed value; RDP level
  1 reports Non-PSA RoT debug.
• Keeps the PLL running at handoff; it was turned off before, which left the Secure application on the wrong clock (found on
  a real STM32L562E-DK).
• Disables bootloader self-update in the secure application config and fixes the option byte names and signing header size.
• Fixes an unused variable that broke STM32L5 DEBUG_UART builds.
• Adds an STM32L5 handoff job to the TrustZone emulator tests and documents the flow in docs/secure_app_handoff.md.

[Copilot]

🟡 Changes recommended

The Secure payload computes USART3_BRR using 64 MHz despite receiving a 110 MHz peripheral clock, producing about 198 kbaud instead of 115200 and breaking hardware UART output and update reception.

1 open issue

• Fix Secure USART3 baud divisor for the 110 MHz APB1 clock · New

What changed in this PR

Adds STM32L5 support for handing off from wolfBoot to a verified Secure runtime such as wolfTrust, which then manages Non-secure resources.

Changes:

• Adds a Secure-application configuration and memory layout, preserves Secure attribution, and keeps the PLL running at handoff.
• Derives the PSA lifecycle from option bytes and fixes the DEBUG_UART unused-variable warning.
• Adds build, lifecycle, and emulator coverage, plus provisioning and handoff documentation.

File	Description
tools/​unit-tests/​unit-secure-handoff.c	Tests STM32L5 lifecycle mapping and invalid inputs.
test-app/​emu-test-apps/​test.sh	Enables handoff checks and Secure linker-template selection.
test-app/​emu-test-apps/​stm32l552/​uart.c	Adds Secure peripheral aliases.
test-app/​emu-test-apps/​stm32l552/​target-secure-app.ld.in	Places the test payload in Secure flash and SRAM.
test-app/​emu-test-apps/​stm32l552/​Makefile	Configures Secure payload compilation.
test-app/​emu-test-apps/​common/​emu_update.c	Checks that no Non-secure SAU windows remain open.
test-app/​emu-test-apps/​common/​emu_hal.c	Adds Secure STM32L5 flash operations.
Makefile	Builds only wolfBoot for the new configuration.
hal/​uart/​uart_drv_stm32l5.c	Removes an unused variable and marks the unused parameter.
hal/​stm32l5.c	Adds lifecycle reporting, Secure-alias erase support, and handoff behavior.
hal/​stm32l5-secure-app.ld	Separates bootloader RAM from application and handoff memory.
hal/​stm32l5_lifecycle.h	Maps RDP and TZEN option bytes to PSA lifecycle values.
hal/​stm32_tz.c	Preserves Secure SRAM and omits Non-secure SAU windows.
docs/​Targets.md	Documents layout, provisioning, signing, and flashing.
docs/​secure_app_handoff.md	Describes STM32L5 handoff behavior and coverage.
config/​examples/​stm32l5-tz-wolftrust.config	Adds the wolfTrust configuration with self-update disabled.
arch.mk	Selects the Secure-application linker script.
.github/​workflows/​trustzone-emulator-tests.yml	Adds Secure boot, update, and rollback emulator testing.
.github/​workflows/​test-configs.yml	Adds build coverage for the new configuration.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #987

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/test-configs.yml, .github/workflows/trustzone-emulator-tests.yml, Makefile, arch.mk, config/examples/stm32l5-tz-wolftrust.config, docs/Targets.md, docs/secure_app_handoff.md, hal/stm32l5-secure-app.ld, hal/stm32l5_lifecycle.h, test-app/emu-test-apps/stm32l552/Makefile, test-app/emu-test-apps/stm32l552/target-secure-app.ld.in, test-app/emu-test-apps/test.sh
Coverage: 7 of 7 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[dgarske]

Tested on an STM32L562E-DK and in m33mu: boot, update and rollback all pass, and the handoff record and lifecycle are correct. Requesting changes for one security issue and a few simplifications. The "empty" NSC is not empty: libwolfboot.c still builds the six wolfBoot_nsc_* entry points for any TZEN build, their veneers land in the NSC region, and SAU region 0 is still NSC at the jump, so a secure app that opens a Non-secure world without clearing region 0 exposes write/erase/trigger/success, and wolfBoot_nsc_success() defeats rollback. Please exclude the NSC API for WOLFBOOT_SECURE_APP builds, skip --cmse-implib when WOLFCRYPT_TZ is off, and drop the NSC region, the SAU region 0 setup and the unused 16 KB RAM_HEAP from stm32l5-secure-app.ld; this also removes the 0xFF padding from wolfboot.bin. Also use WOLFBOOT_RESTORE_CLOCK?=0 in the config instead of the new hal_prepare_boot() condition (identical code), and drop the secure-app MPCBB writes in hal_gtzc_init(), since the registers already read all-Secure after reset on silicon. Details are in the review notes I sent separately.

[dgarske]

Every first-pass finding is fixed. Boot, update and rollback pass on STM32L562E-DK silicon and in m33mu. Every TrustZone config that isn't a secure app builds to a byte-identical wolfboot.bin. Nothing blocks merge; there are two nits and two optional follow-ups below.