hello_world_s#
SECURE VULNERABILITY NOTE: There is a vulnerability that can affect TrustZone applications that also use floating point unit (CVE-2021-35465). The TrustZone examples delivered here do not use floating point, and so they aren’t affected. However, if TrustZone and FPU are used together, the used compiler should be checked for inbuilt workaround. If workaround is not available yet, then the actions described in CVE-2021-35465 should be applied manually.
Actual compilers status for this vulnerability: MCUX IDE v11.5.0 - fix not available yet GNU Arm Embedded Toolchain 10.3-2021.07 - fix not available yet EWARM v9.20.1 - already fixed ARM MDK v5.35 - check for new Arm compiler v6.17
Overview#
The Hello World demo application provides a sanity check for the new SDK build environments and board bring up. This demo application also utilizes TrustZone, so it demonstrates following techniques for TrustZone applications development:
Application separation between secure and non-secure part
TrustZone environment configuration
Exporting secure function to non-secure world
Calling non-secure function from secure world
Creating veneer table
Configuring IAR, MDK, GCC and MCUX environments for TrustZone based projects
Supported Boards#
EVK9-MIMX8ULP
Hardware requirements
Micro USB cable
MIMX8ULP-EVK/EVK9 board
J-Link Debug Probe
5V power supply
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect 5V power supply and J-Link Debug Probe to the board, switch SW10 to power on the board.
Connect a micro USB cable between the host PC and the J17 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for EVK-MIMX8ULP and EVK9-MIMX8ULP.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Create a directory named ‘tz_bin’ in your work direcory.
Build {app}_s and copy sdk2.0-app.bin into ‘tz_bin’ then rename it as sdk2.0-app_s.bin.
Build {app}_ns and copy sdk2.0-app.bin into ‘tz_bin’ then rename it as sdk2.0-app_ns.bin.
Enter the ‘tz_bin’ directory and execute ‘dd’ command to combin the two files. dd if=sdk2.0-app_ns.bin of=sdk2.0-app_s.bin bs=1 count=
ls -l ./sdk2.0-app_ns.bin|awk '{print $5}'seek=843776Rename sdk2.0-app_s.bin as m33_image.bin, and copy it into imx-mkimage
Build the corresponding flash.bin
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, TRDC and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
EVK-MIMX8ULP
Hardware requirements
Micro USB cable
MIMX8ULP-EVK/EVK9 board
J-Link Debug Probe
5V power supply
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect 5V power supply and J-Link Debug Probe to the board, switch SW10 to power on the board.
Connect a micro USB cable between the host PC and the J17 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for EVK-MIMX8ULP and EVK9-MIMX8ULP.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Create a directory named ‘tz_bin’ in your work direcory.
Build {app}_s and copy sdk2.0-app.bin into ‘tz_bin’ then rename it as sdk2.0-app_s.bin.
Build {app}_ns and copy sdk2.0-app.bin into ‘tz_bin’ then rename it as sdk2.0-app_ns.bin.
Enter the ‘tz_bin’ directory and execute ‘dd’ command to combin the two files. dd if=sdk2.0-app_ns.bin of=sdk2.0-app_s.bin bs=1 count=
ls -l ./sdk2.0-app_ns.bin|awk '{print $5}'seek=843776Rename sdk2.0-app_s.bin as m33_image.bin, and copy it into imx-mkimage
Build the corresponding flash.bin
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, TRDC and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
MIMXRT1180-EVK
Hardware requirements
Mini/micro USB cable
MIMXRT1180-EVK board
Personal Computer
Note
The example is set up for TCM and FlexSPI targets. The provided .mex project file for the TEE Config tool is valid only for the TCM configuration. For FlexSPI, manual changes were applied to the generated source file; note the differences between tzm_config.c and the TEE tool source code output.
Board settings
No special settings are required.
Prepare the Demo
Connect a USB cable between the host PC and the OpenSDA USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the program to the target board.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
EVK-MIMXRT595
Hardware requirements
Micro USB cable
EVK-MIMXRT595 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for EVK-MIMXRT595” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should apply the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
EVK-MIMXRT685
Hardware requirements
Micro USB cable
EVK-MIMXRT685 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J5) on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for EVK-MIMXRT685” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should apply the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN236
Hardware requirements
Type-C USB cable
FRDM-MCXN236 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J10) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN947
Hardware requirements
Type-C USB cable
FRDM-MCXN947 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J17) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN947T
Hardware requirements
Type-C USB cable
FRDM-MCXN947T board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J17) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXW71
Hardware requirements
Type-C USB cable
FRDM-MCXW71 Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCX-W71-EVK
Hardware requirements
Type-C USB cable
MCX-W71-EVK Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
KW45B41Z-EVK
Hardware requirements
Mini/micro USB cable
KW45B41Z-EVK Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
KW45B41Z-LOC
Hardware requirements
Mini/micro USB cable
KW45B41Z-LOC Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J3) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
KW47-EVK
Hardware requirements
Type-C USB cable
KW47-EVK Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S06
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S16
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
The jumper setting: Default jumpers configuration does not work, you will need to add JP20 and JP21 (JP22 optional for ADC use)
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S36
Hardware requirements
Mini/micro USB cable
LPCXpresso55s36 board
Personal Computer
Board settings
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S69
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCIMX93AUTO-EVK
Hardware requirements
USB Type-C cable
MCIMX93AUTO-EVK board
J-Link Debug Probe
12V~20V power supply
Personal Computer
Board settings
Note
Please run the application in Low Power boot mode (without Linux BSP). The IP module resource of the application is also used by Linux BSP. Or, run with Single Boot mode by changing Linux BSP to avoid resource conflict.
Prepare the Demo
Connect 12V~20V power supply and J-Link Debug Probe to the board, switch SW2 to power on the board.
Connect a USB Type-C cable between the host PC and the J26 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for MCIMX93AUTO-EVK.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Build secure binary and non-secure binary. For example (if west build is used), west build -p -b mcimx93autoevk examples/trustzone_examples/hello_world_s -Dcore_id=cm33 -d hello_world_s west build -p -b mcimx93autoevk examples/trustzone_examples/hello_world_ns -Dcore_id=cm33 -d hello_world_ns
Create m33_image.bin dd if=hello_world_ns/hello_world_ns_cm33.bin of=hello_world_s/hello_world_s_cm33.bin bs=1 count=
ls -l hello_world_ns/hello_world_ns_cm33.bin | awk '{print $5}'seek=65536 Rename hello_world_s/hello_world_s_cm33.bin to m33_image.binCopy m33_image.bin into imx-mkimage to make low power boot flash.bin.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
MCIMX93-EVK
Hardware requirements
USB Type-C cable
MCIMX93-EVK board
J-Link Debug Probe
12V~20V power supply
Personal Computer
Board settings
Note
Please run the application in Low Power boot mode (without Linux BSP). The IP module resource of the application is also used by Linux BSP. Or, run with Single Boot mode by changing Linux BSP to avoid resource conflict.
Prepare the Demo
Connect 12V~20V power supply and J-Link Debug Probe to the board, switch SW301 to power on the board.
Connect a USB Type-C cable between the host PC and the J1401 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for MCIMX93-EVK.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Build secure binary and non-secure binary. For example (if west build is used), west build -p -b mcimx93evk examples/trustzone_examples/hello_world_s -Dcore_id=cm33 -d hello_world_s west build -p -b mcimx93evk examples/trustzone_examples/hello_world_ns -Dcore_id=cm33 -d hello_world_ns
Create m33_image.bin dd if=hello_world_ns/hello_world_ns_cm33.bin of=hello_world_s/hello_world_s_cm33.bin bs=1 count=
ls -l hello_world_ns/hello_world_ns_cm33.bin | awk '{print $5}'seek=65536 Rename hello_world_s/hello_world_s_cm33.bin to m33_image.binCopy m33_image.bin into imx-mkimage to make low power boot flash.bin.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
MCIMX93W-EVK
Hardware requirements
USB Type-C cable
MCIMX93W-EVK board
J-Link Debug Probe
12V~20V power supply
Personal Computer
Board settings
Note
Please run the application in Low Power boot mode (without Linux BSP). The IP module resource of the application is also used by Linux BSP. Or, run with Single Boot mode by changing Linux BSP to avoid resource conflict.
Prepare the Demo
Connect 12V~20V power supply and J-Link Debug Probe to the board, switch SW301 to power on the board.
Connect a USB Type-C cable between the host PC and the J1401 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for MCIMX93W-EVK.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Build secure binary and non-secure binary. For example (if west build is used), west build -p -b mcimx93wevk examples/trustzone_examples/hello_world_s -Dcore_id=cm33 -d hello_world_s west build -p -b mcimx93wevk examples/trustzone_examples/hello_world_ns -Dcore_id=cm33 -d hello_world_ns
Create m33_image.bin dd if=hello_world_ns/hello_world_ns_cm33.bin of=hello_world_s/hello_world_s_cm33.bin bs=1 count=
ls -l hello_world_ns/hello_world_ns_cm33.bin | awk '{print $5}'seek=65536 Rename hello_world_s/hello_world_s_cm33.bin to m33_image.binCopy m33_image.bin into imx-mkimage to make low power boot flash.bin.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
MCIMX93-QSB
Hardware requirements
USB Type-C cable
MCIMX93-QSB board
J-Link Debug Probe
12V~20V power supply
Personal Computer
Board settings
Note
Please run the application in Low Power boot mode (without Linux BSP). The IP module resource of the application is also used by Linux BSP. Or, run with Single Boot mode by changing Linux BSP to avoid resource conflict.
Prepare the Demo
Connect 12V~20V power supply and J-Link Debug Probe to the board, switch SW301 to power on the board.
Connect a USB Type-C cable between the host PC and the J1401 USB port on the target board.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the flash.bin to the target board. Reference ‘How to get flash.bin of TrustZone examples’ Reference ‘Getting Started with MCUXpresso SDK for MCIMX93-QSB.pdf’ to make and download flash.bin.
Press the reset button on your board.
How to get flash.bin of TrustZone examples:
Build secure binary and non-secure binary. For example (if west build is used), west build -p -b mcimx93qsb examples/trustzone_examples/hello_world_s -Dcore_id=cm33 -d hello_world_s west build -p -b mcimx93qsb examples/trustzone_examples/hello_world_ns -Dcore_id=cm33 -d hello_world_ns
Create m33_image.bin dd if=hello_world_ns/hello_world_ns_cm33.bin of=hello_world_s/hello_world_s_cm33.bin bs=1 count=
ls -l hello_world_ns/hello_world_ns_cm33.bin | awk '{print $5}'seek=65536 Rename hello_world_s/hello_world_s_cm33.bin to m33_image.binCopy m33_image.bin into imx-mkimage to make low power boot flash.bin.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
MCX-N5XX-EVK
Hardware requirements
Mini/micro USB cable
MCX-N5XX-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCX-N9XX-EVK
Hardware requirements
Mini/micro USB cable
MCX-N9XX-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCX-W72-EVK
Hardware requirements
Type-C USB cable
MCX-W72-EVK Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MIMXRT685-AUD-EVK
Hardware requirements
Micro USB cable
MIMXRT685-AUD-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J5) on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for MIMXRT685-AUD-EVK” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should apply the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
KW47-LOC
Hardware requirements
Type-C USB cable
KW47-LOC Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a USB cable between the host PC and the LOC board J3.
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCXW72-LOC
Hardware requirements
Type-C USB cable
MCXW72-LOC Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a USB cable between the host PC and the LOC board J3.
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXW72
Hardware requirements
Type-C USB cable
FRDM-MCXW72 Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a USB cable between the PC host and the FRDM board J10.
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXW23
Hardware requirements
Type-C USB cable
FRDM-MCXW23 Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a USB cable between the host PC and the FRDM board J10.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the program to the target board.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCXW23-EVK
Hardware requirements
Mini/micro USB cable
MCXW23-EVK Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a USB cable between the host PC and the EVK board J33.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the program to the target board.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-KW43
Hardware requirements
Mini/micro USB cable
FRDM-KW43 Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a USB cable between the host PC and the FRDM board J28.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the program to the target board.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXW70
Hardware requirements
Mini/micro USB cable
FRDM-MCXW70 Board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a USB cable between the host PC and the FRDM board J28.
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Download the program to the target board.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXA577
Hardware requirements
Mini/micro USB cable
FRDM-MCXA577 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXA287
Hardware requirements
Mini/micro USB cable
FRDM-MCXA287 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.