west.yml: Bump tf-m with stm32 patches

This brings many tf-m patches related to stm32 SoCs. It sync stm32 with
the vendor mainline patches and add all the necessary pieces to allow
STM32U5Axxx SoC work with TF-M.

The patch list can be checked in:

 https://github.com/zephyrproject-rtos/trusted-firmware-m/pull/145

In addition, redesign the b_u585i_iot02a flash partitions. The current
b_u585i_iot02a NS flash layout difficult the development of large
applications. Since there is an external NOR memory which is already
supported by tf-m, this proposes a layout reconfiguration which allows
bigger bootloader, S and NS software. With this redesign the overlay
in the tests can be safely removed. This new layout is synced with
TF-M 2.1.1 mainline, see:

https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/41126

The bootloader BL2 now will fetch FOTA content from the external memory.

Signed-off-by: BUDKE Gerson Fernando <gerson.budke@leica-geosystems.com>

boards/st/b_u585i_iot02a/b_u585i_iot02a_stm32u585xx_ns.dts

@@ -34,44 +34,59 @@
 
 		/*
 		 * Following flash partition is compatible with requirements
-		 * given in TFM configuration given for current board.
-		 * It might require adjustment depending on evolutions on TFM.
+		 * given in TF-M configuration given for current board.
+		 *
+		 * It might require adjustment depending on evolutions on TF-M.
 		 */
-
 		boot_partition: partition@0 {
 			label = "mcuboot";
-			reg = <0x00000000 DT_SIZE_K(224)>;
+			reg = <0x00000000 DT_SIZE_K(384)>;
 			read-only;
 		};
 
 		/* Secure image primary slot */
-		slot0_partition: partition@38000 {
+		slot0_partition: partition@60000 {
 			label = "image-0";
-			reg = <0x00038000 DT_SIZE_K(384)>;
+			reg = <0x00060000 DT_SIZE_K(512)>;
 		};
 
 		/* Non-secure image primary slot */
-		slot0_ns_partition: partition@98000 {
+		slot0_ns_partition: partition@e0000 {
 			label = "image-0-nonsecure";
-			reg = <0x00098000 DT_SIZE_K(512)>;
+			reg = <0x000e0000 DT_SIZE_K(1024)>;
 		};
 
-		/* Secure image secondary slot */
-		slot1_partition: partition@118000 {
-			label = "image-1";
-			reg = <0x00118000 DT_SIZE_K(384)>;
-		};
-
-		/* Non-secure image secondary slot */
-		slot1_ns_partition: partition@178000 {
-			label = "image-1-nonsecure";
-			reg = <0x00178000 DT_SIZE_K(512)>;
-		};
-
-		/* Applicative Non Volatile Storage */
-		storage_partition: partition@1f8000 {
+		/* Internal Non Volatile Storage */
+		storage_partition: partition@1e0000 {
 			label = "storage";
-			reg = <0x001f8000 DT_SIZE_K(16)>;
+			reg = <0x001e0000 DT_SIZE_K(128)>;
+		};
+	};
+};
+
+&mx25lm51245 {
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		/*
+		 * The flash partition (0 and 1) are aligned
+		 * with the TF-M flash layout expectation.
+		 */
+		slot1_partition: partition@0 {
+			label = "image-1";
+			reg = <0x00000000 DT_SIZE_K(512)>;
+		};
+
+		slot1_ns_partition: partition@80000 {
+			label = "image-1-nonsecure";
+			reg = <0x00080000 DT_SIZE_K(1024)>;
+		};
+
+		external_partition: partition@180000 {
+			label = "external";
+			reg = <0x00180000 (DT_SIZE_M(64) - DT_SIZE_K(1024) - DT_SIZE_K(512))>;
 		};
 	};
 };

doc/releases/migration-guide-4.3.rst

@@ -41,6 +41,11 @@ Base Libraries
 Boards
 ******
 
+* b_u585i_iot02a/ns: The flash layout was changed to be in sync with the upstream TF-M 2.2.1 board
+  configurations. The new layout expands the flash partitions, moving the secondary ones to the
+  external NOR flash. This change currently prevents upgrade from older Zephyr release images to
+  Zephyr 4.3 release images. More details in the TF-M migration and release notes.
+
 * mimxrt11x0: renamed lpadc1 to lpadc2 and renamed lpadc0 to lpadc1.
 
 * NXP ``frdm_mcxa166`` is renamed to ``frdm_mcxa346``.

tests/drivers/flash/common/boards/b_u585i_iot02a_stm32u585xx_ns.overlay

@@ -1,21 +0,0 @@
-/*
- * Copyright (c) 2022, STMicroelectronics
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-/ {
-	chosen {
-		zephyr,code-partition = &slot0_ns_partition;
-	};
-};
-
-&flash0 {
-	partitions {
-		/delete-node/ slot0_partition;
-		/* Non-secure image primary slot */
-		slot0_ns_partition: partition@98000 {
-			label = "image-0-nonsecure";
-			reg = <0x00098000 DT_SIZE_K(512)>;
-		};
-	};
-};

west.yml

@@ -364,7 +364,7 @@ manifest:
       groups:
         - tee
     - name: trusted-firmware-m
-      revision: cc800268f79779fa674b7085ecf507eb95b83ff9
+      revision: 3e12b0cc27d828d7ec04c4ac62ad45a9a905573e
       path: modules/tee/tf-m/trusted-firmware-m
       groups:
         - tee