TrustZone support in nRF Connect SDK Bare Metal v2.0.1 with the S145 SoftDevice

[Julio Cabrera]

Hello,

I'm evaluating the nRF Connect SDK Bare Metal v2.0.0 for an application that requires separation between Secure and Non-secure code. We are evaluating to use the nRF54L15 or the nRF54LM20A. I would appreciate clarification on the following points:

1. Can TrustZone be configured and used with nRF Connect SDK Bare Metal v2.0.1?

2. If so, what limitations does the Bare Metal implementation have compared with the full nRF Connect SDK using Zephyr and Trusted Firmware-M (TF-M)?

3. Can the S145 SoftDevice run entirely in the Non-secure region while the application uses TrustZone?

If there are any relevant examples, documentation, or supported configurations, please share them.

Thank you.

2.16.1.2

2.16.1.2

2.16.1.2

2.16.1.2

2.16.1.2

[Amanda Hsieh]

Hi, 

nRF Connect SDK Bare Metal doesn't have configurations for TrustZone. Please use nRF Connect SDK for TrustZone (TF-M). 

Regards,
Amanda H.

[Julio Cabrera]

Hi Amanda,

Thank you for the clarification.

Could you please explain what specifically prevents TrustZone from being used with nRF Connect SDK Bare Metal v2.0.1? Is TrustZone technically incompatible with the SDK, or is it simply unsupported because the SDK does not currently provide the required API, start up code, memory partitioning, and security configuration?

Would it be possible for an application to configure TrustZone manually, or are there other limitations that would prevent this?

Also, does Nordic plan to add TrustZone support to a future release of nRF Connect SDK Bare Metal?

Regards,
Julio

2.16.1.2

[Amanda Hsieh]

The current SoftDevice hex is built for S, so running it in TrustZone NS is not possible. It's not possible for users to add TrustZone.

[Julio Cabrera]

Hi Amanda,

Thank you for the clarification.

Since users cannot add TrustZone to the current nRF Connect SDK Bare Metal configuration, could you please clarify whether the Arm Cortex-M33 Memory Protection Unit (MPU) is supported?

Specifically:

1. Can an nRF Connect SDK Bare Metal application configure and use the MPU to protect Flash and RAM regions?

2. Does the SDK provide any APIs, configuration options, or examples for this?

3. Can the MPU also restrict access to memory-mapped peripheral registers from unprivileged application code? If not, which hardware mechanism should be used to protect peripherals without TrustZone?

4. Does the S145 SoftDevice use or reserve any MPU regions, or impose other restrictions on the application’s MPU configuration?

Regards,
Julio

2.16.1.2

[Amanda Hsieh]

Please be aware that the nRF Connect SDK Bare Metal option is for simple Bluetooth LE applications on the nRF54L Series. Although the hardware meets the requirements for TrustZone, the NCS BM doesn't provide APIs, configuration options, or examples to support TrustZone. There is no TrustZone support in current releases of NCS BM, and there is no plan to add supported of TrustZone.

Please use nRF Connect SDK for TrustZone (TF-M).