ARMv8-M TrustZone on Cortex-M33 with LPC55S69

Isolate non-secure user applications from trusted firmware using TrustZone on Cortex-M33, enforce access to sensitive data and hardware blocks, and enable secure boot and secure-to-non-secure calls and callbacks.

Explore how trust zone on cortex-m33 expands execution contexts from two to four by combining privilege and security levels, detailing unprivileged/untrusted, privileged/untrusted, unprivileged/trusted, and privileged/trusted runtimes.

Explain how TrustZone divides Cortex-M33 memory into secure and non-secure regions and enforces access restrictions to isolate trusted firmware from untrusted software.

Explore the ARM Trust-Zone concept that isolates secure software from non-secure apps using hardware regions and a secure interface for safe services.

ARMv8-M implements trust-zone with memory-based switching between secure and non-secure regions, running secure and non-secure code in separate memory areas without an EL3 monitor path.

Distinguish the cpu security state from memory security attribution to understand trustzone on armv8-m. Explore access contexts from their intersection and how secure vs non-secure regions shape access and faults.

Explore how the SAU and IDAU hardware blocks partition memory into regions and assign secure, non-secure, or non-secure callable attributes, including overlap rules and final attribute resolution.

Understand how SAU and IDAU overlap rules govern memory partitioning security on Cortex-M33, with IDAU secure winning, SAU able to raise security, and non-secure callable outranking non-secure.

Explain how the IDAU and SAU hardware modules determine a region's security level and enforce it by combining outputs to allow access or trigger a secure fault.

Explore how ARMv8-M switches from non-secure to secure state using non-secure, non-secure callable, and secure memory regions, the secure gate instruction, and BXNS for secure-to-non-secure returns.

Explain the non-secure to secure transition using a veneer entry in the non-secure callable region, a secure gate instruction, and corresponding secure services on ARMv8-M Cortex-M33.

Explain how ARMv8-M uses BLXNS and BXNS to transition between secure and non-secure states, with preconditions on non-secure destinations, bit 0 rules, magic return values, and bridging gates.

ARMv8-M Cortex-M33 enables secure and non-secure states with two modes—handler and thread—and privileged or unprivileged execution, creating six contexts and banked stack pointers—secure and non-secure main and process stacks.

Explore how ARMv8-M Cortex-M33 switches between thread and handler modes via interrupts, including secure and non-secure states, and how backup and restore mechanisms protect the secure domain during cross-security transitions.

Understand how ARMv8-M cortex-m33 enables secure to non-secure transitions using trustzone, including blxns, secure gate calls, and returning to secure via the function return magic value.

Explain how on armv8-m with trustzone, r0–r12 and r14–r15 are not banked between secure/non-secure states, while r13 is banked, and how secure msp/psp and non-secure msp/psp define four stack pointers.

Cortex-M33 uses special registers like xPSR, primask, faultmask, baspri, and control to manage interrupts. They bank between secure and non-secure states; limit registers prevent stack overflow.

Discover how cortex-m33 uses trustzone to bank hardware blocks like mpu, scb, nvic, and systick into secure and non-secure versions, with address space switching and non-secure context setup.

Explain how Cortex-M33 uses banked security blocks and the security attribution unit to control access between secure and non-secure states, including non-secure address access to the SysTick timer.

Explore how ARM TrustZone uses the CPU security state and memory attributes to separate secure and non-secure domains, with SAU and IDAU guiding access permissions.

Explain how SAU and IDAU determine the security attribution level for the CPU's access address by combining the external IDAU responder results with programmable SAU regions.

Trace the flow of an address from the Idu interface to the Idau responder within the interconnect, showing how predefined, hard coded memory regions assign security attributions.

Explore how IDAU on ARM trustzone uses bit 28 to mark addresses secure or non-secure. A preconfigured IDAU responder returns the security attribution for 32-bit addresses, with possible bit-28 inversion.

Divide the addressing space into slots with IDAU and assign each slot a security attribute, creating secure and non-secure memory regions and optional non-secure callable slots.

Explore two address decoding topologies using bit 28 to distinguish secure versus non-secure peripherals: two separate peripherals and a single dynamically mapped uart, with resource and complexity tradeoffs.

Program the SAU regions with memory-mapped registers to assign security attributes based on start and end addresses, then combine SAU results with IDAU to decide secure or non-secure access.

Explore how the SAU on Cortex-M33 assigns memory regions, matches CPU addresses to 4, 8, or 16 regions, and returns the corresponding security attribution level (secure, non-secure, or non-secure callable).

Learn to program the SAU by defining regions with base and limit addresses, assign security attributes, and enable regions and the SAU using RBAR, RLAR, and RNR.

Explore ARMv8-M's secure and non-secure states, memory regions and security attribution levels enabled by trustzone. See how secure gate and branch instructions manage secure to non-secure transitions and returns.

Learn how the BLXNS instruction triggers a secure-to-non-secure jump by branching with link and exchange to a non-secure context, including the return flow via BX FNC_RETURN.

Explain how BLXNS triggers a secure-to-non-secure transition on ARMv8-M with TrustZone, including destination address checks and secure stack updates that preserve IPSR and enable secure return.

Trigger the switch from non-secure to secure state with the secure gate (sg) instruction, then execute first in non-secure callable memory, enter the secure function, and return via bxns.

Navigate the secure gateway flow using SG and BXNS to transition from non-secure callable, via a veneer to secure software, then return safely to non-secure.

Demonstrates non-secure to secure transitions using the secure gateway instruction and a non-secure region veneers table that maps to secure functions, with bit 0 cleared for BXNS returns.

Explore TT instructions in ARMv8-M TrustZone that abstract SAU, IDAU, and MPU settings to determine security state and access permissions, including secure and non-secure MPU interfaces.

Explore four test target instructions—tt, ttt, tta, ttat—and learn how they enforce security state and access permissions via SAU, IDAU, and non-secure MPU registers across privilege and secure/non-secure modes.

Explain how TT interfaces with SAU and IDAU to reveal security info. State that MPU access requires secure state, and that TTA/TTAT need secure state to access non-secure MPU.

Explain the TT instruction format and encoding, detailing input registers, Rd as the result, and Rn as the base address for access and security checks with SAU, IDAU, and MPU.

Explain how the TT instruction response fields (TT_RESP) report access permissions and security attributes for a target address, including MPU, SAU, and IDAU region numbers and their validity bits.

Use ARM CMSIS macros to invoke TT instructions at the C level, abstracting assembly calls, with four macro sets taking a pointer cast to the target address.

The TT instruction returns a CMSIS return structure encoding MPU and SAU region matches, their valid bits, access permissions, the secure bit, and the IDAU region details in C.

Use the cmse_check_address_range CMSIS macro to verify a memory region's security attributes and access permissions from P to P+Size-1 against specified flags, returning P on a match or NULL otherwise.

Explore how ARMv8-M uses two vector tables and two vector table offset registers to separate secure and non-secure software, ensuring isolated and correct interrupt handling.

Explore how ARMv8-M TrustZone splits exceptions into secure and non-secure vector tables, with banked and non-banked handlers for memory, user, and bus faults, plus the secure fault and hardfault priority.

examine how HardFault is handled on armv8-m cortex-m33, comparing banked and non-banked handlers for secure and non-secure domains, configured by the AIRCR bit in the SCB.

Analyze how ARMv8-M exceptions, especially NMI and BusFault, interact with secure and non-secure vector tables, controlled by a bit that switches between secure and non-secure handlers.

Configure each interrupt line in the NVIC as secure or non-secure via ITNS registers, with per-line bits, secure handlers requiring a secure state while non-secure handlers switch before executing.

Explain how the CPU stacks scratch registers on the secure or non-secure stack during an interrupt, performs context switching, and uses EXC_RETURN to return to the main application.

Describe interrupts and exceptions flow between secure and non-secure software on Cortex-M33. Show how the CPU pushes registers, uses EXC_RETURN, and zeros R0 to R12 to prevent leakage during switching.

Demonstrates the secure to non-secure interrupt flow on Cortex-M33, backing up R0–R12, LR, PC, and xPSR on the secure stack, then returning via EXC_RETURN to restore state.

Explain how the interrupt stack frame differs for non-secure interrupts, with the secure stack saving all registers and adding an integrity signature value (IntSgn) to detect corruption during returns.

Guard the top IntSgn value that encodes the integrity signature to detect corruption when returning from a non-secure interrupt; if corrupted, the secure stack frame may be compromised.

Learn how the ARMv8-M EXC_RETURN encoding guides secure and non-secure interrupt returns, including mode, stack pointer, fpu context, security stack, and default callee register stacking.

Explain fixed versus programmable internal exception priorities on armv8-m trustzone, with reset, nmi, non-secure hardfault fixed at -1; programmable faults are configurable.

Program system handler priorities to control internal exception handling using the three system handler priority registers (1 to 3), each with 8-bit fields that support priorities from 0 to 255.

Learn how the NVIC assigns and re-programs external interrupt priorities on ARMv8-M Cortex-M33, using NVIC_IPRx registers to map 8-bit priorities, where 0 is the highest.

Explains armv8-m trust-zone interrupt priorities on cortex-m33. Shows how a bit splits 0 to 254 range into secure 0 to 127 and non-secure 128 to 254 to favor secure interrupts.

Set up a makefile-based build with Gnuwin32, Cygwin64 tools, and the Keil-MDK toolchain to compile, link, and load the binary onto the Cortex-M33 within a 32 kB size limit.

Create a tools directory and install the GNUWin32 package to obtain the make tool for a makefile based build system. Confirm the GNUWin32 subdirectory contains the make command.

Install Cygwin64 to provide cp, rm, and mkdir for a makefile based project; download and install default tools, configure destination and proxy, and verify the bin directory.

Install the keil-mdk package to obtain the toolchain needed to compile for Armv8-based devices, and download keil-mdk to set up the compiler, cmsis headers, and drivers.

Set up Keil-MDK to add LPC55S69 device specific packages for dual Cortex-M33 with Trust-Zone, using UV4.exe to install NXP package and select the flash algorithm for secure and non-secure spaces.

Demonstrates configuring the LPC55S69 memory layout to separate secure and non-secure regions using bit 28, with IDAU and SAU to define secure attributes and enable non-secure execution of code.

Switch from secure to non-secure and back on Cortex-M33 by loading a secure image into the secure flash segment and a non-secure image into the non-secure flash memory segment.

Explore how to build a secure image for Cortex-M33, configure SAU and IDAU, tag secure vs non-secure memory, and safely jump to non-secure code using cmse APIs.

Explore building a non-secure application for LPC55S69 using a makefile-based workflow with ARMCLANG and Keil-Uvision, including non-secure entry points, a linker script, and dual secure/non-secure image generation.

Build the non-secure project to generate the non-secure elf image and its disassembly, and export the ARM Smydef symbol file with non-secure function addresses for the secure bootloader.

Build the secure image for Cortex-M33 by importing the non-secure Symdef and resolving non-secure symbols at link time, then load the image with the Keil flash loader.

Flash the non-secure and secure images into their respective flash segments, configure the SAU to partition memory, and perform secure to non-secure transitions using non-secure pointers and BLXNS.