NSC veneers when TZEN=1; WOLFCRYPT_TZ_PKCS11 on the NXP MCX N

[mattia-moffa]

Various TrustZone improvements:

• Enable NSC veneers when TZEN=1, not only when WOLFCRYPT_TZ=1
• Rename NSC veneers object from wc_secure_calls.o to wolfboot_tz_nsc.o, since it's no longer just for wolfCrypt calls
• Implement hal_trng_* for NXP MCXN
• Add a new mcxn-wolfcrypt-tz.config with WOLFCRYPT_TZ=1 and WOLFCRYPT_TZ_PKCS11=1
• Generate a random number in the MCXN app using wolfCrypt via NSC, similarly to the stm32h5 app
• Repartition mcxn-tz.config

[Copilot]

Pull request overview

This PR improves TrustZone (TZEN) integration by always generating/linking CMSE NSC veneers when TZEN=1 (not only when WOLFCRYPT_TZ=1), renames the generated import library object accordingly, and extends/updates target support (notably adding Nordic nRF54L15 and improving NXP MCXN TRNG support).

Changes:

• Generate and consume CMSE import library when TZEN=1, and rename the veneers/import object from wc_secure_calls.o to wolfboot_tz_nsc.o.
• Update test applications/Zephyr integration to link the renamed import object and use NSC APIs based on TZEN.
• Add Nordic nRF54L15 support (HAL, SPI driver, linker scripts, configs, docs, CI) and implement MCXN hal_trng_* using ELS.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
zephyr/README.md	Updates Zephyr docs to reference wolfboot_tz_nsc.o.
zephyr/CMakeLists.txt	Links Zephyr module against renamed CMSE import object.
test-app/emu-test-apps/stm32u585/Makefile	Updates emu test app to link wolfboot_tz_nsc.o.
test-app/emu-test-apps/stm32l552/Makefile	Updates emu test app to link wolfboot_tz_nsc.o.
test-app/emu-test-apps/stm32h563/Makefile	Updates emu test app to link wolfboot_tz_nsc.o.
test-app/emu-test-apps/nrf5340/Makefile	Updates emu test app to link wolfboot_tz_nsc.o.
test-app/emu-test-apps/mcxw71/Makefile	Updates emu test app to link wolfboot_tz_nsc.o.
test-app/emu-test-apps/common/emu_update.c	Switches emu update flow to use NSC APIs when TZEN.
test-app/app_stm32h5.c	Switches STM32H5 test-app NSC usage gating to TZEN.
test-app/app_nrf54l.c	Adds a bare-metal test app for the new nRF54L target.
test-app/app_mcxn.c	Adds wolfCrypt RNG demo call and uses NSC APIs when TZEN.
test-app/Makefile	Links wolfboot_tz_nsc.o for TZ builds; adjusts RNG object selection and linker script selection for nRF54L.
test-app/CMakeLists.txt	Always links CMSE import library when TZEN; refines TrustZone test-app linking logic.
test-app/ARM-nrf54l-ns.ld	Adds non-secure test-app linker script for nRF54L TZ builds.
src/libwolfboot.c	Exposes wolfBoot NSC veneer entrypoints when __WOLFBOOT && TZEN.
include/wolfboot/wolfboot.h	Exposes NSC API prototypes to apps when TZEN.
include/spi_drv.h	Adds SPI driver include for nRF54L.
hal/spi/spi_drv_nrf54l.h	Adds nRF54L SPI pinmux definitions for SPI flash usage.
hal/spi/spi_drv_nrf54l.c	Adds nRF54L SPIM-based SPI backend implementation.
hal/nrf54l.ld	Adds nRF54L secure/TZ linker script with keyvault + NSC regions.
hal/nrf54l.h	Adds nRF54L register definitions and TZ-secure/non-secure addressing helpers.
hal/nrf54l.c	Adds nRF54L HAL (clocks, flash, UART, TZ setup, TRNG).
hal/nrf54l-ns.ld	Adds nRF54L non-TZ linker script variant.
hal/mcxn.c	Implements MCXN TRNG via ELS RND_REQ DMA instead of stubbed entropy.
docs/Targets.md	Documents the new Nordic nRF54L15 target and its memory layouts/build steps.
docs/API.md	Clarifies NSC API availability when TZEN=1.
config/examples/nrf54l15.config	Adds nRF54L15 non-TZ example configuration.
config/examples/nrf54l15-wolfcrypt-tz.config	Adds nRF54L15 TZ + wolfCrypt + PKCS11 example configuration.
config/examples/mcxn-wolfcrypt-tz.config	Adds MCXN TZ + wolfCrypt + PKCS11 example configuration.
config/examples/mcxn-tz.config	Repartitions MCXN TZ config and enables debug UART.
cmake/wolfboot.cmake	Updates CMake build to treat wolfboot_tz_nsc.o as the TZ import byproduct.
arch.mk	Generates CMSE import library for any TZEN=1 build; adds nRF54L linker-script selection.
Makefile	Cleans wolfboot_tz_nsc.o instead of wc_secure_calls.o.
CMakeLists.txt	Adds nrf54l target; generates CMSE import library for any TZEN=1 build.
.github/workflows/test-configs.yml	Adds CI build coverage for the two nRF54L15 example configs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.