I am currently developing a small OS on my Raspberry Pi, that I install by replacing the kernel.img file on the /boot partition of my SD card. By the time my code is run, the CPU is already in Normal Mode, so I can't have access to the Secure world / Trustzone area.

Is it possible to modify the boot process of the Raspberry to be able to start executing my code in Secure mode ?

Best, V.

1 Answer 1


This StackOverflow answer says that the processor starts out in secure mode:

... since TrustZone-capable processors start executing in Secure state on power-on, if the boot loader does nothing to change the security state, all software will run as Secure (removing any security benefits). No, the TrustZone environment is explicitly intended to run alongside your OS, not to be directly integrated into it. For some platforms, the Linux kernel performs Secure Monitor Calls to request Secure world to change certain system configuration options.

Are you seeing something different, in other words are you seeing that the processor is not starting out in secure mode, from the ARM1176JZF-S™ Technical Reference Manual the NS bit (Non-secure) determines whether the processor is in secure mode (NS=0).

The Non-secure (NS) bit determines if the program execution is in the Secure or Non-secure world. The NS bit is in the Secure Configuration Register (SCR) in coprocessor CP15, see c1, Secure Configuration Register on page 3-52. All the modes of the core, except the Secure Monitor, can operate in either the Secure or Non-secure worlds, so there are both Secure and Non-secure User modes and Secure and Non-secure privileged modes, see Operating modes on page 2-17 and Registers on page 2-18.

What are you using for the basis of your custom OS?

  • Thank you. As for my first attempt with IRQ, I got the meaning of the NS bit backwards: I was booting in Secure mode... sorry for the stupid mistake !
    – Vinz
    Apr 7, 2014 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.