WIP: Support for non-secure (NS) binaries #2753

Draft

kilograham wants to merge 39 commits from ns-alpha into develop

kilograham commented

2025-12-08 04:09:35 -06:00

(Migrated from github.com)

This PR is alpha level, and APIs/build process are subject to change:

See the corresponding examples branch: https://github.com/raspberrypi/pico-examples/tree/ns-alpha

This PR allows the user to build separate binaries for the Secure and NonSecure sides of RP2350, and have one call the other. It provides secure call APIs for the NonSecure side to call code on the Secure side, along with CMake functions to configure both binaries to have the same functionality.

This allows for simple use of the Secure/NonSecure split, for example to keep secrets on the Secure side, while running a WiFi/USB stack on the NonSecure side.

The hello_trustzone example is a minimal example showing how to create a Secure/NonSecure binary. It has NonSecure doing stdio_usb, and both sides using their respective timers. It also demonstrates a user secure call, allowing user NonSecure code to talk to Secure code. This produces a single hello_trustzone.uf2 file, which can be loaded onto any device with the trustzone_pt.json programmed. So steps are:
picotool partition create trustzone_pt.json pt.uf2
picotool load pt.uf2
picotool reboot -u
drag & drop hello_trustzone.uf2 onto the device

In addition there is a hello_trustzone_no_flash example for those not using flash - this doesn't require a partition table to load, either load in two parts with picotool:
picotool load hello_trustzone_no_flash_ns.uf2
picotool load hello_trustzone_no_flash_s.uf2 -x
or create a combined UF2 using the code in the new branch (https://github.com/raspberrypi/picotool/tree/uf2-combine), which can just be dragged & dropped (or loaded with picotool as a single UF2):
picotool uf2 combine hello_trustzone_no_flash_s.uf2 hello_trustzone_no_flash_ns.uf2 hello_trustzone_no_flash.uf2
drag & drop hello_trustzone_no_flash.uf2 onto the device

This PR is alpha level, and APIs/build process are subject to change: See the corresponding examples branch: https://github.com/raspberrypi/pico-examples/tree/ns-alpha This PR allows the user to build separate binaries for the Secure and NonSecure sides of RP2350, and have one call the other. It provides secure call APIs for the NonSecure side to call code on the Secure side, along with CMake functions to configure both binaries to have the same functionality. This allows for simple use of the Secure/NonSecure split, for example to keep secrets on the Secure side, while running a WiFi/USB stack on the NonSecure side. The `hello_trustzone` example is a minimal example showing how to create a Secure/NonSecure binary. It has NonSecure doing `stdio_usb`, and both sides using their respective timers. It also demonstrates a user secure call, allowing user NonSecure code to talk to Secure code. This produces a single hello_trustzone.uf2 file, which can be loaded onto any device with the trustzone_pt.json programmed. So steps are: `picotool partition create trustzone_pt.json pt.uf2` `picotool load pt.uf2` `picotool reboot -u` drag & drop hello_trustzone.uf2 onto the device In addition there is a `hello_trustzone_no_flash` example for those not using flash - this doesn't require a partition table to load, either load in two parts with picotool: `picotool load hello_trustzone_no_flash_ns.uf2` `picotool load hello_trustzone_no_flash_s.uf2 -x` or create a combined UF2 using the code in the new branch (https://github.com/raspberrypi/picotool/tree/uf2-combine), which can just be dragged & dropped (or loaded with picotool as a single UF2): `picotool uf2 combine hello_trustzone_no_flash_s.uf2 hello_trustzone_no_flash_ns.uf2 hello_trustzone_no_flash.uf2` drag & drop hello_trustzone_no_flash.uf2 onto the device

👍 1

github-actions[bot] commented

2025-12-08 04:09:44 -06:00

(Migrated from github.com)

Please do not submit against master, use develop instead

Please do not submit against `master`, use `develop` instead

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'ns-alpha:ns-alpha'

git switch 'ns-alpha'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'develop'

git merge --no-ff 'ns-alpha'

git switch 'ns-alpha'

git rebase 'develop'

git switch 'develop'

git merge --ff-only 'ns-alpha'

git switch 'ns-alpha'

git rebase 'develop'

git switch 'develop'

git merge --no-ff 'ns-alpha'

git switch 'develop'

git merge --squash 'ns-alpha'