Add NUCLEO-N657X0-Q Zephyr hardware platform

Add the Zephyr host wrapper, board overlay, OpenOCD tooling, and benchmark integration needed to run ML-KEM tests and component benchmarks on the NUCLEO-N657X0-Q target.

Keep QEMU and existing baremetal CI coverage unchanged; the NUCLEO functional-test CI job is intentionally left out of this squash.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>

Author: bremoran

.github/actionlint.yaml

@@ -12,3 +12,4 @@ self-hosted-runner:
     - pqcp-x64
     # RISE RISC-V runner
     - ubuntu-24.04-riscv
+    - self-hosted-nucleo-n657x0

.github/workflows/bench.yml

@@ -36,6 +36,8 @@ jobs:
           ldflags: "-flto"
           bench_extra_args: ""
           nix_shell: bench
+          extra_makefile: ""
+          zephyr_target: ""
         - system: rpi5
           name: Arm Cortex-A76 (Raspberry Pi 5) benchmarks
           bench_pmu: PERF
@@ -45,6 +47,8 @@ jobs:
           bench_extra_args: ""
           nix_shell: bench
           cross_prefix: ""
+          extra_makefile: ""
+          zephyr_target: ""
         - system: a55
           name: Arm Cortex-A55 (Snapdragon 888) benchmarks
           bench_pmu: PERF
@@ -53,6 +57,8 @@ jobs:
           ldflags: "-flto -static"
           bench_extra_args: -w exec-on-a55
           nix_shell: bench
+          extra_makefile: ""
+          zephyr_target: ""
         - system: bpi
           name: SpacemiT K1 8 (Banana Pi F3) benchmarks
           bench_pmu: PERF
@@ -62,6 +68,8 @@ jobs:
           bench_extra_args: -w exec-on-bpi
           cross_prefix: riscv64-unknown-linux-gnu-
           nix_shell: cross-riscv64
+          extra_makefile: ""
+          zephyr_target: ""
         - system: m1-mac-mini
           name: Mac Mini (M1, 2020) benchmarks
           bench_pmu: MAC
@@ -70,6 +78,8 @@ jobs:
           ldflags: "-flto"
           bench_extra_args: "-r"
           nix_shell: bench
+          extra_makefile: ""
+          zephyr_target: ""
         - system: pqcp-ppc64
           name:  ppc64le (POWER10) benchmarks
           bench_pmu: PERF
@@ -79,11 +89,27 @@ jobs:
           bench_extra_args: "-r"
           nix_shell: ''
           cross_prefix: ""
+          extra_makefile: ""
+          zephyr_target: ""
+        - system: nucleo-n657x0
+          name: Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks
+          bench_pmu: NO
+          archflags: ""
+          cflags: ""
+          ldflags: ""
+          bench_extra_args: ""
+          nix_shell: zephyr
+          cross_prefix: ""
+          extra_makefile: test/zephyr/platform.mk
+          zephyr_target: nucleo-n657x0-q
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork && (github.event.label.name == 'benchmark' || github.ref == 'refs/heads/main')
     runs-on: self-hosted-${{ matrix.target.system }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/bench
+        env:
+          EXTRA_MAKEFILE: ${{ matrix.target.extra_makefile }}
+          ZEPHYR_TARGET: ${{ matrix.target.zephyr_target }}
         with:
           name: ${{ matrix.target.name }}
           cflags: ${{ matrix.target.cflags }}

.github/workflows/zephyr.yml

@@ -53,5 +53,5 @@ jobs:
           ZEPHYR_TARGET: ${{ matrix.target.board }}
         run: |
           opt=${{ matrix.target.opt == 'all' && 'opt' || 'no_opt' }}
-          nix develop .#zephyr --command ./scripts/tests bench --no-auto -c PMU --opt=$opt
-          nix develop .#zephyr --command ./scripts/tests bench --no-auto --components -c PMU --opt=$opt
+          nix develop .#zephyr --command ./scripts/tests bench --no-auto -c NO --opt=$opt
+          nix develop .#zephyr --command ./scripts/tests bench --no-auto --components -c NO --opt=$opt

flake.nix

@@ -57,6 +57,7 @@
             export HOLLIGHT_LOAD_PATH="$IMPORTS_DIR:$S2N_BIGNUM_DIR''${HOLLIGHT_LOAD_PATH:+:$HOLLIGHT_LOAD_PATH}"
             export HOLDIR="$HOLLIGHT_DIR"
           '';
+
         in
         {
           _module.args.pkgs = import inputs.nixpkgs {
@@ -94,6 +95,19 @@
               } ++ holLightToolchain;
           }).overrideAttrs (old: { shellHook = holLightShellHook; });
 
+          # arm-none-eabi-gcc + platform files from pqmx
+          packages.m55-an547 = util.m55-an547;
+          packages.avr-toolchain = util.avr-toolchain;
+          packages.openocd = util.openocd;
+          devShells.arm-embedded = util.mkShell {
+            packages = builtins.attrValues
+              {
+                inherit (config.packages) m55-an547;
+                inherit (pkgs) gcc-arm-embedded qemu coreutils python3 git;
+              };
+          };
+
+          devShells.avr = util.mkShell (import ./nix/avr { inherit pkgs; });
           packages.hol_server = util.hol_server.hol_server_start;
           devShells.hol_light = (util.mkShell {
             packages = builtins.attrValues { inherit (config.packages) linters hol_light s2n_bignum hol_server; } ++ holLightToolchain;
@@ -153,6 +167,7 @@
           devShells.zephyr = util.mkShell {
             packages = builtins.attrValues
               {
+                inherit (config.packages) openocd;
                 inherit (util) zephyr;
                 inherit (pkgs) gcc-arm-embedded qemu cmake ninja dtc gperf coreutils git;
               } ++ [ util.zephyrPythonEnv ];

nix/openocd/default.nix

@@ -0,0 +1,21 @@
+# Copyright (c) The mlkem-native project authors
+# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+
+{ fetchFromGitHub
+, openocd
+, autoreconfHook
+}:
+
+openocd.overrideAttrs (old: rec {
+  pname = "openocd";
+  version = "unstable-2026-05-01";
+  nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ autoreconfHook ];
+
+  src = fetchFromGitHub {
+    owner = "openocd-org";
+    repo = "openocd";
+    rev = "4e9b167e1ae5ccb437eb0538440988b3f0ec53cb";
+    fetchSubmodules = true;
+    hash = "sha256-8aYl7JzulPxH6vgSeTKTMIZVH6d55JJlXTBkfgAPTbU=";
+  };
+})

nix/util.nix

@@ -118,6 +118,7 @@ rec {
     intelhex
     colorama
   ]);
+  openocd = pkgs.callPackage ./openocd { };
   avr-toolchain = pkgs.callPackage ./avr { };
 
   # Helper function to build individual cross toolchains

nix/zephyr/default.nix

@@ -9,8 +9,7 @@
 
 # Board-agnostic Zephyr build environment: a pinned Zephyr tree plus the
 # modules needed by the boards we target, exposed via a setup hook so a plain
-# `cmake` build works with no west workspace. CMSIS-6 covers the Cortex-M
-# boards; add further modules here as more boards are wired up.
+# `cmake` build works with no west workspace.
 let
   zephyr = fetchFromGitHub {
     owner = "zephyrproject-rtos";
@@ -26,6 +25,14 @@ let
     rev = "30a859f44ef8ab4dc8f84b03ed586fd16ccf9d74";
     hash = "sha256-nTehISN0pu9gnOZMpGaBQ3DFmNxAqAZPGpvbKfEM35o=";
   };
+
+  # Revision pinned by the Zephyr v4.4.1 manifest (west.yml).
+  hal_stm32 = fetchFromGitHub {
+    owner = "zephyrproject-rtos";
+    repo = "hal_stm32";
+    rev = "fc11896dd39cfca37bf9b4aeaaa2df8861b81875";
+    hash = "sha256-AtNq2yTZsTFMTlWn/Ns0wuEiN4Wv/OTV2vWPRu0SnOE=";
+  };
 in
 stdenvNoCC.mkDerivation {
   pname = "mlkem-native-zephyr";
@@ -37,11 +44,14 @@ stdenvNoCC.mkDerivation {
     mkdir -p $out
     ln -s ${zephyr} $out/zephyr
     ln -s ${cmsis_6} $out/cmsis_6
+    ln -s ${hal_stm32} $out/hal_stm32
   '';
 
   setupHook = writeText "setup-hook.sh" ''
     export ZEPHYR_BASE="$1/zephyr"
-    export ZEPHYR_MODULES="$1/cmsis_6"
+    export ZEPHYR_CMSIS_6_MODULE="$1/cmsis_6"
+    export ZEPHYR_HAL_STM32_MODULE="$1/hal_stm32"
+    export ZEPHYR_MODULES="$1/cmsis_6;$1/hal_stm32"
     export ZEPHYR_TOOLCHAIN_VARIANT=gnuarmemb
     export GNUARMEMB_TOOLCHAIN_PATH=${gcc-arm-embedded}
   '';

scripts/tests

@@ -762,8 +762,11 @@ class Tests:
                     test_type, self.do_opt(), suppress_output=False
                 )
 
-        if resultss is None:
+        # Nothing below should write benchmark output unless the run produced
+        # results and all compile/run steps succeeded.
+        if resultss is None or len(self.failed) > 0:
             self.check_fail()
+            return
 
         # NOTE: There will only be one items in resultss, as we haven't yet decided how to write both opt/no-opt benchmark results
         for k, results in resultss.items():

test/hal/hal.c

@@ -124,8 +124,8 @@ uint64_t get_cyclecounter(void) { return DWT->CYCCNT; }
 #elif defined(ARMCM55)
 /* Cortex-M55: Use dedicated PMU */
 #include <ARMCM55.h>
+#include <pmu_armv8.h>
 #include <system_ARMCM55.h>
-#include "pmu_armv8.h"
 
 void enable_cyclecounter(void)
 {

test/mk/components.mk

@@ -155,6 +155,9 @@ $(call MAKE_OBJS, $(MLKEM1024_DIR), $(EXTRA_SOURCES)): CFLAGS += $(EXTRA_SOURCES
 endif
 else
 $(ALL_BINS): $$(TEST_SRCS) $(LIB_SRCS)
+# Extra per-binary prerequisites a custom-build platform needs (e.g. Zephyr's
+# app inputs and active-target marker, set in test/zephyr/platform.mk).
+$(ALL_BINS): $(CUSTOM_BUILD_DEPS)
 endif
 
 # ABI checker