Investigating ARM Cortex® M33 core with TrustZone® – In-System Programming Tutorial

This week I’m back to the normal ‘Tutorial’ format with a look at the In-System Programming feature in the boot ROM of the LPC55S69. I’ll use the NXP-provided command-line program blhost and interface with the ROM to erase the flash and download simple LED blinky programs.

I used MCUXpresso IDE to build the two blinkies. Both programs are based on the SDK example project lpcxpresso55s69_led_blinky and flash the blue LED on the board. The default program flashes the LED at 1 second, whilst the modified program flashes at 200ms. Changing the frequency is simply a matter of changing the parameter passed into the SysTick_Delay_Ticks() function.

Whenever I am working on a bootloader (and it does not matter if it is flash-, RAM- or ROM-based) I always create a small program that makes a visible action on the target board. It is then very simple to see that the flash was erased and the new image was correctly programmed. Often the interface to the bootloader is command-line based, and so I know that I will have to type the file name of the example into the command. So I make the filename as short as possible – in this Tutorial I use fast.bin and slow.bin.

MCUXpresso IDE has a built-in tool named Binary Utilities, and since in my example I am using blhost with a binary output file, I use the Binary Utilities to create my binary. In the video tutorial I show how to use this tool, but it is really simple:

  • Build the application to create an output ELF file lpcxpresso55s69_led_blinky.axf,
  • Open the Debug group to list the axf file.
  • Right-click on lpcxpresso55s69_led_blinky.axf and use the pop-up menu to run Binary Utilities.
  • At the menu, select your desired format (Create binary) in this tutorial.

Now that we have tow binary files fast.bin and slow.bin, let’s start to look at the ISP mode on the LPC55S69. Remember that this is implemented in the ROM bootloader on the chip, and so we must be able to force the chip into the ROM bootloader. This is very easy with the ISP pin on LPC55S69. It is pad PIO0_5 and of course is provided on the LPC55S69-EVK:

S1 on lpc55s69-evk is labelled ISP and is used to enter ISP mode

The pad PIO0_5 is sampled by the boot ROM after a reset. If the pin is low, then the boot ROM enters ISP mode. Notice that there is an important 2200R pullup on the PCB. If the switch is not pressed at reset (PIO0_5 is high), then the boot ROM will simply run the flash application and our code runs. And so there is a procedure to enter ISP mode:

  • Hold switch ISP S1 depressed
  • Press and hold switch RESET SW4
  • Keeping ISP S1 depressed, release RESET SW4
  • Release ISP S1.

Keeping the ISP S1 switch depressed whilst releasing SW4 makes certain that the ISP / PIO0_5 pad is low at reset.

The boot ROM supports a number of interfaces, and these are defined in the LPC55S69 User Manual. You can see that LPC55S69 supports UART, I2C, SPI and USB. I use the serial port in this Tutorial, with the LPC-Link2 providing a VCOM port to my host computer.

Now that the EVK is in ISP mode, we can start to communicate with the boot ROM using the NXP-provided utility blhost. The video tutorial is running on a Mac, but blhost is provided for Windows, macOS and Linux.

There are a great number of blhost commands, and I refer you to the Kinetis blhost User’s Guide.pdf, but once the board is in ISP mode, I use the following command sequence:

  • blhost -p /Dev/cu.usbmodemXXXXXX,115200 — get-property 1
  • blhost -p /Dev/cu.usbmodemXXXXXX,115200 — erase-flash-all
  • blhost -p /Dev/cu.usbmodemXXXXXX,115200 — write-memory 0x00000000 fast.bin
  • blhost -p /Dev/cu.usbmodemXXXXXX,115200 — reset

The — get-property is a useful command with a large number of parameters. I use it in this example with parameter ‘1’ simply as a way of testing communication with the boot ROM. The other commands are self-explanatory, but the 0x00000000 in the write-memory command is the base address of flash, where I want to program the image. The final ‘reset’ command is used to exit ISP mode and run the downloaded image. In the video tutorial we see the blue LED toggling at 200 ms.

The process to flash a new image – for example slow.bin – is exactly the same, but of course we need to remember to place the LPC55S69 into ISP mode by following the ISP / RESET switch procedure.

As always this tutorial is supported by a video – here – and I think that you can get your board running in ISP mode within 15 minutes. Let me know how you get on.

3 thoughts on “Investigating ARM Cortex® M33 core with TrustZone® – In-System Programming Tutorial

  1. Pingback: ARM Cortex® M33 core programming tutorial #ARM #Programming « Adafruit Industries – Makers, hackers, artists, designers and engineers!

  2. Very helpful, especially for a newbie like me. How would this work on a production board, rather than on the devkit? An embedded device wouldn’t have RESET & ISP buttons.


What do you think?

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.