NXP’s Hardware Abstraction Layer (HAL) is based on the MCUXpresso SDK drivers.  To learn more, see the blog Zephyr Software Code Reuse with NXP MCUXpresso SDK.  Most Zephyr users want to use the Zephyr driver APIs in their application for portability.  But if a Zephyr driver is not supported on a platform, or if there is no Zephyr driver for a hardware peripheral, another option is to use the MCUXpresso SDK driver directly in the application.  This article provides details, using the PUF driver as an example on the LPC55S69. NXP had a major update to the MCUXpresso SDK in v24.12 that restructured the SDK.  This new HAL was added in Zephyr after the Zephyr v4.1 release, in this Pull Request.  This article focuses on using drivers in this latest HAL.  For older versions of Zephyr, or if using an older SOC that is not supported in this latest HAL, see this older post.   HAL drivers with Zephyr support are included in an app using devicetree and Kconfig.  To include other drivers not managed by Zephyr, simply add a line in the application's CMakeLists.txt file enabling that driver.  The first line shown below instructs Cmake to include the PUF driver by setting the variable  CONFIG_MCUX_COMPONENT_driver.puf .  Note: be sure to set these variables before the find_package(Zephyr ...) line. set(CONFIG_MCUX_COMPONENT_driver.puf ON) find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})   With the driver included in the build, the driver APIs can be used in the application.  This is a simple app using a PUF driver API: #include <fsl_puf.h> int main(void) { puf_config_t conf; PUF_GetDefaultConfig(&conf); return 0; }   To find the name of the Cmake variable to use for a driver, look in the mcuxsdk-core repo.   This is the Kconfig file for the PUF driver, and it defines the Kconfig symbol named MCUX_HAS_COMPONENT_driver.puf.  Add the CONFIG_ prefix to get the final symbol name CONFIG_MCUX_HAS_COMPONENT_driver.puf .

The Zephyr SDK is a set of build tools for building Zephyr applications. It includes GCC and CMake, and each Zephyr release is tied to a specific Zephyr SDK version. This version is noted in the SDK_VERSION file in the Zephyr repository. Using the recommended Zephyr SDK version is important—mismatched versions can cause build errors. For example, Zephyr v4.1 specifies Zephyr SDK v0.17.0. If you use Zephyr SDK v0.17.2 (meant for Zephyr v4.2) with Zephyr v4.1, you’ll encounter build errors. If you need to build apps for Zephyr v4.1, install Zephyr SDK v0.17.0. You can install multiple Zephyr SDK versions and switch between them at build time (see instructions below). Full vs. Minimal Install Full Install: Includes all toolchains for every supported SoC architecture. Recommended for beginners but requires more disk space and download time. Minimal Install: Lets you choose only the toolchains you need. Saves space and time. For Minimal install, run the setup.cmd script to select which tools to install.  On NXP boards, select: Register Zephyr SDK CMake package Install host tools aarch64-zephyr-elf (64-bit ARM) arm-zephyr-eabi (32-bit ARM, including NXP MCUs) optional  xtensa-nxp… (Cadence Tensilica DSP cores) Installing Zephyr SDK These steps cover installing the Zephyr SDK using the MCUXpresso Installer, West from CLI, or manual download. Installing with MCUXpresso Installer The MCUXpresso Installer started supporting packs for Zephyr with Zephyr v4.2.  Each pack installs the matching Zephyr SDK version (e.g., v4.2 pack installs SDK v0.17.2).  This option Installs a minimal set of tools for NXP development.   The MCUXpresso Installer does not support older Zephyr SDK versions. For v0.17.1 or earlier, use West or manual install. Installing with West CLI Zephyr Project added Zephyr SDK installation to West. For CLI, Activate your Python Virtual Environment, then run: west sdk install --version 0.17.0   If --version is omitted, West uses the version in the SDK_VERSION file of the Zephyr repo. By default, installs the Full package. For minimal, add -i . Installing by Manual Download Download the Zephyr SDK from the https://github.com/zephyrproject-rtos/sdk-ng/releases. Choose Full or Minimal for your host OS. Extract to your user folder (default location for West and MCUXpresso): Windows: C:\Users\<username>\zephyr-sdk-0.17.0 Ubuntu: /home/<username>/zephyr-sdk-0.17.0 Selecting Zephyr SDK Version Multiple Zephyr SDK versions can coexist. West uses the latest by default, but you can override it: VS Code: When importing examples, select the Zephyr SDK version in the wizard. CLI: Set the environment variable ZEPHYR_SDK_INSTALL_DIR  before building.  This command sets that variable in Ubuntu: export ZEPHYR_SDK_INSTALL_DIR="/home/<username>/zephyr-sdk-0.17.0" Or in Windows: set ZEPHYR_SDK_INSTALL_DIR= C:\Users\<username>\ zephyr-sdk-0.17.0   Return to Zephyr Knowledge Hub    

This article details using MCUboot's RAM Loading feature with Zephyr on an NXP i.MX RT microcontroller.  MCUboot is a popular open-source bootloader that easily integrates with Zephyr applications.  Using the RAM Load feature, the bootloader will find a valid image in flash, copy it to RAM, and jump to the app in RAM.  Therefore, the Zephyr app must be built to execute from the RAM region, but write the image to flash. These steps leverage Zephyr's Sysbuild system, which simplifies managing multiple images like this MCUboot bootloader and the application.  There are two examples provided that load the blinky sample to RAM: one loading to external SDRAM, and one loading to internal DTCM. Recommended Reading This article delves into the use of MCUboot, Sysbuild, memory maps, and RAM loading. If these topics are new to you, we recommend reviewing the following resources to build a solid foundation before exploring the details within this document. Sysbuild with MCUboot AN12437 i.MX RT Series Performance Optimization AN13970 RT Series Memory Relocation in Zephyr SW/HW Requirements Zephyr is very portable and these steps will help on other hardware platforms with simple tweaks.  But these steps were tested with the following: Zephyr v4.2 Zephyr SDK v0.17.2 MIMXRT1060-EVKC board using the default QSPI external flash.  The Zephyr build target is  mimxrt1060_evk@C//qspi . RT1060 Memory Map  The table below details the memory maps used in these examples.  Starting with the RT1060 default memory map in Zephyr v4.2, this is the address map if no changes are made, and RAM Loading is not used.  The partition map in the QSPI flash are common for MCUboot and the app, since all images must be stored in separate address ranges.  And this partition map is not changed in these examples.   zephyr,flash  and  zephyr,sram  are devicetree chosen nodes, and tell the linker where to place code/data in the memory map.   zephyr,flash  includes the executable code and read-only data, which are typically placed in flash, but these examples place in RAM.   zephyr,sram  is where the linker places writable data like the .data and .bss sections.  These examples modify the  zephyr,sram  location, and keep  zephyr,sram  of MCUboot and the app in different address ranges to avoid contention during the RAM loading. Region v4.2 Default SDRAM example DTCM example blinky zephyr,flash (code and rodata) slot0_partition 0x6002_0000 SDRAM 0x8000_0000 DTCM 0x2000_0000 blinky zephyr,sram (rwdata) SDRAM 0x8000_0000 SDRAM 0x8000_0000 DTCM 0x2000_0000 MCUboot zephyr,sram (rwdata) SDRAM 0x8000_0000 DTCM 0x2000_0000 SDRAM 0x8000_0000 FlexSPI QSPI flash (non-volatile boot mem) 0x6000_0000     boot_partition (for bootloader) 0x6000_0000     slot0_partition (for app image) 0x6002_0000     slot1_partition (for app image) 0x6032_0000       RAM Loading to SDRAM The attached ramload_sdram.patch applied to the Zephyr v4.2 repo will modify the blinky sample to be loaded to SDRAM by MCUboot. Note that NXP's i.MX RT development boards that include external SDRAM, like the MIMXRT1060-EVK, use SDRAM for the default  zephyr,sram  node.  The SDRAM is enabled and configured by the ROM bootloader before that bootloader boots any application, including the MCUboot secondary bootloader.  This configuration enables a Zephyr app to access the SDRAM immediately after booting.  The ROM bootloader is configured to do this by the DCD stored in flash with the boot image, see Memory details with Zephyr for more details.  Therefore, when MCUboot is used with SDRAM, the DCD is required in the MCUboot image. The sections below detail the changes made to MCUboot, the blinky sample, and to both domains using Sysbuild.  All these files are located in the repo folder samples/basic/blinky. Sysbuild changes for both domains The file sysbuild.conf is added to the app to configure Sysbuild for MCUboot.  This also enables the RAM Load feature used in building both MCUboot and the app. SB_CONFIG_BOOTLOADER_MCUBOOT=y SB_CONFIG_MCUBOOT_MODE_RAM_LOAD=y   MCUboot changes The file sysbuild/mcuboot.conf configures the MCUboot domain.  MCUboot will load the image stored in the slot partition to this address, which is the base address for SDRAM.  The RAM_SIZE is used during the copy, and should be scaled as needed. CONFIG_BOOT_IMAGE_EXECUTABLE_RAM_START=0x80000000 CONFIG_BOOT_IMAGE_EXECUTABLE_RAM_SIZE=131072 The file sysbuild/mcuboot.overlay modifies the devicetree for this bootloader.  Since MCUboot will load the app to SDRAM, the  zephyr,sram  node is moved to DTCM to avoid overwriting any MCUboot data.  The  zephyr,code-partition  node tells the linker to place the MCUboot bootloader code in the   boot_partition  in the flash. / {     chosen {         zephyr,sram = &dtcm; zephyr,code-partition = &boot_partition; }; };   Application changes The file boards/mimxrt1060_evk_mimxrt1062_qspi_C.overlay modifies the devicetree for this app, and places the executable code in SDRAM, to be loaded by MCUboot. / { chosen { zephyr,flash = &sdram0; }; };   The file boards/mimxrt1060_evk_mimxrt1062_qspi_C.conf adjusts the address used when programming the blinky signed image binary to flash.  Since the  zephyr,flash  node is placed in SDRAM, normally the "west flash" command would try to program the binary to 0x8000_0000, the base address of the SDRAM.  This Kconfig selects the address of the  slot0_partition  to store the blinky image in flash. CONFIG_FLASH_BASE_ADDRESS=0x60020000   Build and flash These steps use the Command Line Interface (CLI) to build and flash.  Another option is to use VS Code with NXP's MCUXpresso extension, see Zephyr app with MCUboot in VS Code. This build command uses Sysbuild to build both images for MCUboot and the blinky app.  This creates the folder ramload_blinky with all the generated files for both domains, which is used to flash the board. west build -b mimxrt1060_evk@C//qspi samples/basic/blinky -d ../../ramload_blinky --sysbuild --pristine This flash command uses Sysbuild to flash both images to the board, first the MCUboot image, then the signed blinky app image.  This example specifies using the JLink debug probe, or LinkServer is another option. west -v flash -d ../../ramload_blinky/ -r jlink   Console output from SDRAM Connect a terminal to the debug console.  After flashing, the LED will blink and the RT1060 will boot and print like this: *** Booting MCUboot v2.1.0-rc1-389-g4eba8087fa60 *** *** Using Zephyr OS build v4.2.0 *** I: Starting bootloader I: Primary slot: version=0.0.0+0 I: Image 0 Secondary slot: Image not found I: Image 0 RAM loading to 0x80000000 is succeeded. I: Image 0 loaded from the primary slot I: Bootloader chainload address offset: 0x80000000 I: Image version: v0.0.0 I: Jumping to the first image slot *** Booting Zephyr OS build v4.2.0 *** LED state: OFF LED state: ON   RAM Loading to DTCM The attached ramload_dtcm.patch modifies the repo to load the blinky sample to DTCM.  The patch is very similar to the SDRAM patch detailed above.  The same build and flash steps are used for this patch.  The console output is also very similar, but shows the difference in the load address: *** Booting MCUboot v2.1.0-rc1-389-g4eba8087fa60 *** *** Using Zephyr OS build v4.2.0 *** I: Starting bootloader I: Primary slot: version=0.0.0+0 I: Image 0 Secondary slot: Image not found I: Image 0 RAM loading to 0x20000000 is succeeded. I: Image 0 loaded from the primary slot I: Bootloader chainload address offset: 0x20000000 I: Image version: v0.0.0 I: Jumping to the first image slot *** Booting Zephyr OS build v4.2.0 *** LED state: OFF LED state: ON   Notes Working on this, I ran into some issues using other memory map options.  It seems there are some limitations with the imgtool settings with  CONFIG_MCUBOOT_BOOTLOADER_MODE_RAM_LOAD=y  .  The Zephyr code base seems to make some assumptions about where in RAM the image will be loaded.  For example, when using RAM Load, the imgtool utility must be called with the argument  --load-addr  and the address in RAM, which configures the boot header when signing the application image.  But this Cmake file assumes the load address is the base of the  zephyr,sram  node.  For that reason, the examples provided here place the  zephyr,sram  and  zephyr,flash  nodes for blinky in the same RAM.  Separating these nodes to different RAMs caused issues for me.  If more flexibility is required, one potential option is to modify the app's Cmake file using the needed imgtool settings to generate the needed signed binary for RAM Load.  Imgtool can also be called manually if needed.

Zephyr includes the open-source MCUboot bootloader as a module, and makes it easy to use as a bootloader for Zephyr applications.  A Zephyr app can be easily built to load with MCUboot.  Zephyr uses a tool called Sysbuild that also enables building the MCUboot bootloader and Zephyr app with the same build command.  To use Sysbuild with CLI, see Building a sample with MCUboot and Sysbuild.  A more advanced use-case is  MCUboot RAM Loading with Zephyr. This guide uses NXP's MCUXpresso extension for VS Code to build a sample app with MCUboot.  To get started with VS Code, see the Zephyr Knowledge Hub.  Basic knowledge of using VS Code to import and build applications is required before following these steps. To get started, import the Zephyr application into VS Code.  This example uses the hello_world sample: To enable Sysbuild for this project, start in the Projects view, right-click on the project, click the Configure menu, and click "Set Sysbuild".   A pop-up appears in the center of the top of the VS Code window.  Select the Enable option. To learn more, see Configuring Sysbuild in VS Code.   We also want to configure the app to build for MCUboot by setting the Cmake variable SB_CONFIG_BOOTLOADER_MCUBOOT=y.  To configure Cmake variables, Expand the project, and expand the Build Configurations.  Select the build configuration to edit, and click the pencil icon on the right.  Here we are editing the default "debug" configuration for the hello_world project.   In the field CMake Extra Args, add SB_CONFIG_BOOTLOADER_MCUBOOT="y" .  To learn more, see Cmake Variables in VS Code.   To build the project, right-click the project and select Pristine Build.  This builds two images: one for MCUboot, and another for the app hello_world. Debugging the app will not program the MCUboot image to the flash.  But we can flash either image to the board using VS Code.  In the Projects view, right-click the project and select Flash the Selected Target.   In the pop-up at the top of the window, select the zephyr.hex file in Domain: mcuboot.  VS Code will flash that zephyr.hex file to the board.   Now you we can debug or flash the app.  When the board boots, it prints similar to below.  This shows MCUboot boots first, finds the app image in slot0, and jumps to the hello_world app. *** Using Zephyr OS build v4.1.0-2827-gb0bf73a18c3c *** I: Starting bootloader I: Image index: 0, Swap type: none I: Bootloader chainload address offset: 0x14000 I: Image version: v0.0.0 I: Jumping to the first image slot *** Booting Zephyr OS build v4.1.0-2827-gb0bf73a18c3c *** Hello World! frdm_mcxn947/mcxn947/cpu0  

If you have any questions or issues related to these resources, please Ask a new question, and the NXP support team can address it there. One of the popular reasons developers choose Zephyr is the large offering of drivers and peripheral support.  The best place to look for the latest drivers and features supported on a hardware platform, is on the board’s documentation page.  For example, this Supported Features table lists the latest support for the FRDM-MCXN947 board.  Here are the links to these pages for all the boards with Zephyr support. NXP’s Hardware Abstraction Layer (HAL) is based on the MCUXpresso SDK drivers.  To learn more, see the blog Zephyr Software Code Reuse with NXP MCUXpresso SDK.  Most users want to use the Zephyr driver APIs in their application for portability.  But if a Zephyr driver is not supported on a platform, or if there is no Zephyr driver for a hardware peripheral, another option is Using MCUXpresso SDK drivers in Zephyr app. Peripheral Clocks: Most peripheral clocks are enabled in SOC or board source files, see Clock Configuration in Zephyr.  One common issue Zephyr users have when enabling or adding a peripheral instance on their board, is that instance is not clocked properly.  Below are some helpful resources for specific peripherals and drivers: Accelerators and Coprocessors PowerQuad Appnote AN13970 Running Zephyr RTOS on Cadence Tensilica HiFi 4 DSP Analog to Digital Converter (ADC) Zephyr sample die_temp_polling to measure temperature Displays Most displays are enabled in Zephyr as shields, which are add-on hardware modules.  See Zephyr’s list of shields. Typically a board page will document a display shield it has been tested with.  For example, the FRDM-MCXN947 board page includes the LCD_PAR_S035 display shield. The shield page gives instructions how to include that shield in the build, and add to the application.  For example, see the LCD_PAR_S035 shield page.  If building with VS Code, see the CMake wiki.  Zephyr has a couple samples that use displays, including the display driver sample and the LVGL demo. Direct Memory Access (DMA) When using a DMA, be aware of cache coherency, and make sure buffers accessed by DMA are not in cacheable memory.  This includes when using other drivers that use DMA, like I2S, SPI, UART, etc..  A good reference for placing buffers in non-cacheable memory is the spi_loopback test. Inter-Integrated Circuit (I2C) The Zephyr repo has a couple I2C sample applications, but because these depend on I2C targets in hardware, these samples are enabled on a small number of boards.  Here is a list of other I2C references: i2c_target_api test – this is the primary test NXP uses to test I2C on the supported boards.  This is a loopback test using two I2C peripherals.  One is configured as a controller, and the other as a target which emulates an EEPROM.  For this test to pass, usually the I2C signals must be shorted to connect the two I2Cs.  For the list of supported boards, see the testcase.yaml. Sensor samples – many NXP evaluation boards include sensors on the I2C bus.  Depending on the board, there may be some sensor sample apps.  For example, the accelerometer trigger and accelerometer polling samples are supported on many NXP boards.  For the list of supported boards, see the accel_trig/boards folder or the accel_polling sample.yaml. I2c_shell – this is not a sample app, but a shell feature that is easy to add to an app.  If there is no driver or example available to communicate with an I2C target, this feature can be helpful to test out the communication.  Through the shell, I2C controllers can scan for targets and send read/write commands to them.  Golioth shared this great blog on i2c_shell with all the details.  Inter-Integrated Circuit Sound (I2S) The I2S drivers are tested using Zephyr’s i2s_speed test.  That is a loopback test, and some boards require changes to connect the signals for the test to pass, see the readme. Networking includes Ethernet MIMXRT1170-EVK Zephyr Network Performance Zephyr networking stack on i.MX RT1170 Cortex-M4 secondary core Serial Peripheral Interface (SPI) The SPI driver is tested with Zephyr’s spi_loopback test.  This test is also a good reference for the options to place DMA buffers in non-cacheable memory, see DMA above. With Zephyr’s SPI driver, the SPI Controller can drive the chip select signal using the hardware peripheral or by software in the driver using a GPIO.  To learn more, see Hardware chip select vs GPIO.  There are some simple SPI examples showing this, see the LPSPI hardware chip select example, and the LPSPI GPIO chip select example. The SPI timing parameters can be configured in devicetree, see the LPSPI timing parameter example. Universal Serial Bus (USB) USB Host As of 12/19/2025: USB Host support in Zephyr is very limited, and there is on-going work to enable more.  This tracker ticket details the current status and plans for USB Host support.   USB Device is supported, and Zephyr provides several sample applications Networking IP over USB CDC NCM   Return to Zephyr Knowledge Hub

Introduction Standard Trusted Firmware‑M (TF‑M) targets in Zephyr, including RW61x‑based platforms, assume the presence of BL2 (MCUboot) as the second-stage bootloader. BL2 is responsible for image authentication, upgrade handling, and flash layout enforcement. However, many NXP devices provide a ROM‑based secure boot / dual‑boot mechanism capable of authenticating firmware and directly transferring control to a secure image. In such cases, BL2 is redundant and can be disabled to reduce boot time and flash usage. This article describes how to disable BL2 in TF‑M and configure Zephyr to boot directly from ROM into the TF‑M Secure image, followed by the Non‑Secure application.   Typical TF‑M Boot Flow (With BL2) The default Zephyr TF‑M boot chain is: BootROM → BL2 (MCUboot) → TF‑M Secure → Non‑Secure application BL2: Owns the flash layout (primary/secondary slots) Performs image authentication Manages firmware upgrades Example with samples/tfm_integration/config_build   Target Boot Flow (ROM Boot, No BL2) When using the ROM bootloader: BootROM → TF‑M Secure → Non‑Secure application In this scenario: ROM performs authentication and version checks TF‑M Secure becomes the first executable stage No firmware swapping or secondary slots are required Example with samples/tfm_integration/config_build   Disable BL2 in TF‑M Kconfig Changes Disable BL2 explicitly in the project configurations and update the base address: CONFIG_TFM_BL2=n CONFIG_FLASH_BASE_ADDRESS=0x80A0000   This removes MCUboot from the build and prevents generation of BL2 artifacts.   Secure Image Entry Requirements When BL2 is removed, the ROM must jump directly to the TF‑M Secure vector table. Ensure that: The Secure image is linked at the ROM‑expected address The Secure vector table is valid The Secure reset handler init No BL2 handoff logic is required.   Non‑Secure Image Considerations The TF‑M Secure image will transfer control after initialization. Built as a direct‑boot Zephyr application No MCUboot headers Linked at the Non‑Secure offset defined in the partition layout   Dual Boot Enablement (ROM‑Managed A/B Images) On RW61x‑class devices, the ROM expects the Secure image to start at offset 0x1000 within a bootable slot, with the Non‑Secure image located at offset 0xA0000 . Each boot slot therefore contains a complete Secure + Non‑Secure pair at fixed offsets. The ROM authenticates the slot, jumps to the Secure offset, and TF‑M later transfers control to the Non‑Secure image. BootROM ├─ Authenticate Slot 0 → Secure@+0x1000 → Non‑Secure@+0xA0000 └─ Authenticate Slot 1 → Secure@+0x1000 → Non‑Secure@+0xA0000 No BL2 or runtime image swapping is involved.     Example Flash Layout (Corrected) Slot 0 Slot 0 Base : 0x08000000 Secure Image (0) : 0x08001000  Non‑Secure Image 0 : 0x080A0000    Slot 1 Slot 1 Base : 0x08200000 Secure Image (1) : 0x08201000  Non‑Secure Image 1 : 0x082A0000   Each slot is independently bootable and contains no shared state with the other slot.     ROM Boot Expectations For each slot, the ROM expects: Slot authentication data (signature / manifest) A valid Secure vector table at slot_base + 0x1000 A valid Secure reset handler The ROM never jumps to Non‑Secure directly.     Using the SEC tool to enable dual boot  First we'll create two images one for slot 0 and one for slot 1. The difference will be noted in the text of the non-secure image.  1. Build Zephyr Images (Slot‑A and Slot‑B) For each slot, build: TF‑M Secure image (linked at +0x1000 ) Zephyr Non‑Secure image (linked at +0xA0000 ) Slot 0, I modified the non-secure image to print a quick message identifying the slot it was programmed in.  Slot 1, I modified the non-secure image to print a quick message identifying the slot it was programmed in.  Using the SEC tool, we will use the "Merge Tool" to merge the secure and non-secure binaries with the appropriate offset. 2. Merge Secure + Non‑Secure Images ROM expects one contiguous image per slot, not two independent binaries. In SEC Tool: Open Merge Tool Select: Secure binary(without boot header) → offset 0x1000 Non‑Secure binary → offset 0xA0000 Output a single merged image * If you are using the kconfig options as described above, the FCB will be attached to the secure binary, therefore please ensure that your offset for secure binary considers the FCB location which is offset 0x400 Do this for both slot images. In this example I created merged_imaged_slot_0 and merged_image_slot_1.   3. Assigning Version Metadata Dual‑boot selection is driven entirely by ROM metadata. For each merged image: Set Image Version Example: Slot A version: 1 Slot B version: 2 ROM rules are typically: Boot highest valid version Use fallback slot if authentication fails   Select the merged image for the slot you would like to program first. Select the version that will be used with that slot.    Next, open "Dual Image Boot"   For Slot 0, select "Image 0" and select the offset you would like to use for the slot division. For Slot 1, select "Image 1".   4. Program Slot 0 (Initial Boot) Program Slot 0 only Reset device Expected behavior: ROM authenticates Slot 0 ROM jumps to slot 0 + 0x1000 TF‑M Secure initializes Non‑Secure app runs ✅ Confirms your Secure → Non‑Secure chain works without BL2   5. Program Slot 1 (Upgrade Test) Program Slot 1 Update slot metadata (version > Slot 0) Reset device Expected behavior: ROM selects Slot 1 Slot 1 Secure executes Slot 1 Non‑Secure message appears   Common Mistakes to Avoid Merging images at wrong offsets ( 0x0 instead of 0x1000 ) Forgetting to bump the version for Slot B Leaving MCUboot headers enabled Assuming TF‑M controls slot selection   Conclusion Disabling BL2 in TF‑M and booting directly from ROM is a valid, efficient, and production‑ready configuration when the device ROM already provides secure boot and dual‑boot services. In this architecture, the ROM is the authority for authentication, version selection, and rollback, while TF‑M Secure becomes the first executable firmware stage. When combined with ROM‑managed A/B dual boot, this approach provides: Independent, fully self‑contained Slot A and Slot B images Deterministic boot behavior based on ROM policy (version or fallback) Secure rollback without runtime image swapping No dependency on MCUboot or BL2 infrastructure The key requirements for success are: Explicitly disable BL2 in TF‑M Link the Secure image at the ROM‑required offset ( +0x1000 ) Link the Non‑Secure application at the fixed Non‑Secure offset ( +0xA0000 ) Merge Secure and Non‑Secure binaries into a single slot image Use the SEC tool to: Assign image versions Enable dual‑boot policy Authenticate and sign each slot image In this model, TF‑M and Zephyr are slot‑agnostic: they do not manage upgrades, slot selection, or rollback. All boot decisions are made before execution begins, by the ROM, based on SEC‑provided metadata. This design reduces boot time, simplifies flash layouts, removes firmware‑swap complexity, and aligns well with high‑reliability production systems where firmware updates are performed out‑of‑band and enforced by ROM‑level security.

Recently some Windows users started reporting issues installing the Zephyr SDK, required for building Zephyr applications.  Users first ran into this issue using NXP's MCUXpresso Installer, but had the same issue trying to manually install the Zephyr SDK. The root cause is that setup.cmd and these other tools use wget to download the individual toolchain packages.  And apparently recent changes in Windows or security settings interpret this wget download as unsecure, and wget is blocked. Context The Zephyr SDK is a package of multiple toolchains that support all the hardware platforms and CPU architectures available in Zephyr.  The binary bundle releases for download are available in two options: Minimal and Full.  For example, these bundles can be downloaded here for v0.17.4, currently the latest release. The Full bundle is a large download and includes all the toolchains and other tools in that download package.  The Minimal bundle is much smaller and does not contain any toolchains and allows users to choose the toolchains to download and install.  Minimal has an extra step after download to run the setup script and the user selects the tools to download.  In Windows, this script is setup.cmd. If installing the Minimal bundle and wget downloads are blocked for setup.cmd, then the Zephyr SDK install fails.  MCUXpresso Installer v25.12 and other install options use the Minimal bundle, and can be blocked by this issue. Workaround NXP is working on improving the MCUXpresso Installer to address this issue.  But in the meantime, downloading and installing the Full bundle avoids using wget and avoids this issue.   Download the Full bundle, here for v0.17.4, and extract the bundle in your user folder.  After extracting, the full Windows path will be  C:\Users\<username>\zephyr-sdk-0.17.4 .  West and other build tools will find this folder during the build.  The Zephyr SDK can also be installed elsewhere using an environment variable, see the Zephyr SDK documentation.  After extracting, run the setup.cmd to finish setup.  But with the Full install, setup.cmd will not need to download with wget. Be aware, this article was written when v0.17.4 was the latest release of the Zephyr SDK.  Check here for the latest release. Return to Zephyr Knowledge Hub

Anyone can Contribute to Zephyr, but all contributions must comply with the Coding Style Guidelines.  This list includes some resources for contributing: Configuring VS Code editor for Zephyr coding style guidelines To contribute, propose changes by submitting a Pull Request (PR), see Contributor Expectations (more to come) Return to Zephyr Knowledge Hub

Anyone can Contribute to Zephyr, but all contributions must comply with the Coding Style Guidelines.  The editor in Visual Studio Code can be configured to help with these style guidelines.  This article details how to configure the editor. In VS Code, go to File→Preferences→Settings (or use CTRL + , to open them directly). Note that these setting changes can also be restricted to the Zephyr workspace by switching the Settings tab selection from "User" to "Workspace" if desired. The following settings help with Zephyr's style guidelines: Editor: Tab Size: set to 8 Editor: Insert Spaces: turn off Files: Trim Final Newlines: turn on Files: Trim Trailing Whitespace: turn on C_Cpp: Dim Inactive Regions: turn off Return to Zephyr Knowledge Hub

This attachment includes the presentation content and hands-on lab guides for this session, used at trainings including the NXP Technology Days.  The labs are also available at this MCUXpresso documentation lab. Return to Zephyr Knowledge Hub

Introduction Trusted Firmware-M (TF-M) divides memory into secure and non-secure regions. This guide explains how to add a custom non-secure flash region for data import purposes. This is useful for testing or extending TF-M functionality on platforms like FRDM-RW612. This guide is using el2go_import_blob on frdmrw612//ns as a base example. You may use any TFM based example.  Imported as a freestanding application using VSCode.  The initial two steps add a macro in order to easily add a #ifdef statement in the code in case you'd like to toggle the region on/off. TFM does not use the traditional Zephyr kConfig, so it is necessary to follow the steps to ensure the macro is defined correctly. If you want to add the region without the #if statement, skip steps 1-2. Make sure to remove #ifdef TFM_CUSTOM_DATA_IMPORT_REGION #endif from steps 3-5. 1. Enable the Feature via Configuration File: el2go_import_blob/Kconfig config TFM_CUSTOM_DATA_IMPORT_REGION bool "Enable custom flash area for testing" help Validate non-secure region in flash. File: el2go_import_blob/prj.conf CONFIG_TFM_CUSTOM_DATA_IMPORT_REGION=y 2. Update Build System to Pass the Flag File: el2go_import_blob/CMakeLists.txt Append the CMake option: if(CONFIG_TFM_CUSTOM_DATA_IMPORT_REGION) set_property(TARGET zephyr_property_target APPEND PROPERTY TFM_CMAKE_OPTIONS -DUSE_TFM_CUSTOM_DATA_IMPORT_REGION=ON ) endif() File: platform/ext/target/nxp/frdmrw612/config.cmake Add the flag: set(USE_TFM_CUSTOM_DATA_IMPORT_REGION OFF CACHE BOOL "") File: platform/ext/target/nxp/frdmrw612/CMakeLists.txt Add compile definition: if (USE_TFM_CUSTOM_DATA_IMPORT_REGION) set(TFM_CUSTOM_DATA_IMPORT_REGION_COMPILE_DEFINITION "TFM_CUSTOM_DATA_IMPORT_REGION") endif() target_compile_definitions(psa_interface INTERFACE ${TFM_CUSTOM_DATA_IMPORT_REGION_COMPILE_DEFINITION} ) 3. Define the Flash Region File: platform/ext/target/nxp/frdmrw612/partition/flash_layout.h Define address and size: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION #define TFM_CUSTOM_NS_REGION_ADDR (0x08500000) #define TFM_CUSTOM_NS_REGION_SIZE (0x00001000) // 4KB #endif File: platform/ext/target/nxp/frdmrw612/partition/region_defs.h Map the region: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION #define CUSTOM_NS_DATA_REGION_START (TFM_CUSTOM_NS_REGION_ADDR) #define CUSTOM_NS_DATA_REGION_SIZE (TFM_CUSTOM_NS_REGION_SIZE) #endif 4. Update Linker Script File: platform/ext/target/nxp/common/gcc/tfm_common_s.ld Add region base declaration: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION Load$$LR$$LR_CUSTOM_DATA_IMPORT_REGION$$Base = CUSTOM_NS_DATA_REGION_START; #endif   5. Declare and Initialize Region in Code File: platform/ext/target/nxp/common/target_cfg_common.h Add to memory region struct: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION uint32_t custom_ns_data_region_base; uint32_t custom_ns_data_region_limit; #endif File: platform/ext/target/nxp/common/tfm_hal_platform.c Initialize region limits: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION REGION_DECLARE(Load$$LR$$, LR_CUSTOM_DATA_IMPORT_REGION, $$Base); #endif // TFM_CUSTOM_DATA_IMPORT_REGION #ifdef TFM_CUSTOM_DATA_IMPORT_REGION .custom_ns_data_region_base = (uint32_t)&REGION_NAME(Load$$LR$$, LR_CUSTOM_DATA_IMPORT_REGION, $$Base), .custom_ns_data_region_limit = (uint32_t)&REGION_NAME(Load$$LR$$, LR_CUSTOM_DATA_IMPORT_REGION, $$Base) + CUSTOM_NS_DATA_REGION_SIZE - 1, #endif // TFM_CUSTOM_DATA_IMPORT_REGION File: platform/ext/target/nxp/common/tfm_hal_isolation.c Configure SAU: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION SECURE_WRITE_REGISTER(&(SAU->RNR), 7U); SAU->RBAR = (memory_regions.custom_ns_data_region_base & SAU_RBAR_BADDR_Msk); SAU->RLAR = (memory_regions.custom_ns_data_region_limit & SAU_RLAR_LADDR_Msk) | SAU_RLAR_ENABLE_Msk; #endif File: platform/ext/target/nxp/frdmrw612/target_cfg.c Configure MPC: #ifdef TFM_CUSTOM_DATA_IMPORT_REGION enable_mem_rule_for_partition(memory_regions.custom_ns_data_region_base, memory_regions.custom_ns_data_region_limit); #endif 6. Update Device Tree Overlay File: zephyr/samples/el2go_import_blob/frdm_rw612_rw612_ns.overlay Add partition: custom_ns_data: partition@500000 { label = "custom_ns_data"; reg = <0x500000 0x1000>; };     Let's test the region by erasing, writing and reading.   1. Enable the Zephyr flash File: el2go_import_blob/prj.conf   CONFIG_FLASH=y   2. Add some test code to the main source file of the project.  #include <zephyr/drivers/flash.h> const struct device *flash_dev = DEVICE_DT_GET(DT_CHOSEN(zephyr_flash_controller)); static int test_flash_region(void) { uint32_t offset = 0x500000; uint32_t test_data = 0xDEADBEEF; uint32_t read_data; // 1. Erase flash (required before write) flash_erase(flash_dev, offset, 4096); // 2. Write data flash_write(flash_dev, offset, &test_data, sizeof(test_data)); // 3. Read data (this can use memcpy function) memcpy(&read_data, (void *)0x08500000, sizeof(read_data)); if (read_data == test_data) { LOG("✓ Flash test passed with memcpy: 0x%08x\n", read_data); } else { LOG("✗ Flash test failed\n"); } //Flash read operation will have fix to correctly calculate address next release /*flash_read(flash_dev, offset, &read_data, sizeof(read_data)); if (read_data == test_data) { LOG("✓ Flash test passed with flash_read: 0x%08x\n", read_data); } else { LOG("✗ Flash test failed\n"); } */ return 0; }   3. Call the  test_flash_region() function from the main() .  

Here are some resources to learn more about Zephyr: Taking you through all the Zephyr environment setup steps with MCUXpresso for VS Code and the MCUXpresso Installer, this NXP Getting Started with Zephyr beginner's tutorial will take you through to building and running your first Zephyr application.  This step-by-step lab guide (from NXP Tech Day trainings) starts with "Hello, World" then walks you through helpful tutorials on Kconfig, Device Tree and debug methods:  Hands-On Workshop: Developing with Zephyr™ OS in Visual Studio Code This tutorial shows the power of the portability that Zephyr brings. Simple steps are shown to port an LVGL demo from FRDM-MCXN947 to the FRDM-RW612:  NXP Zephyr display portability demo Looking for more? Visit the Training section of our Zephyr landing page to find NXP webinars and online training - just click the “Training” tab at top of the page Return to Zephyr Knowledge Hub

This simple demo shows the portability of Zephyr with LVGL by running the same application on different hardware platforms.  Leveraging Zephyr's Hardware Abstraction Layer (HAL), applications can be written without hardware dependencies in the source code.  And without changing source, the same app can be built for different hardware. The demo steps use the following hardware and tools, but can easily run on other hardware with displays using the same general steps: FRDM-MCXN947 board FRDM-RW612 board LCD-PAR-S035 display shield NXP's MCUXpresso extension for VS Code The attached presentation gives a brief overview of Zephyr and the HAL portability.  This video shows all the steps to build the example, prepare the hardware, and program the boards. Return to Zephyr Knowledge Hub

GUI Guider is a user-friendly graphical user interface development tool from NXP that enables the rapid development of high quality displays with the open-source LVGL graphics library.  GUI Guider can also export projects using Zephyr.  The document GUIGuider_User_Manual installed with GUI Guider has a section working with Zephyr, and provides steps using Command Line Interface (CLI).  This article is an example using NXP's MCUXpresso extension for VS Code to import the generated project, build and download to a board. Requirements The steps in this article are based on these requirements: Software: GUI Guider v1.10.0-GA Zephyr v4.0.0 - the GUI Guider release notes say support is based on "Zephyr v4.0 support for LVGL v8.3.10" Zephyr SDK v0.17.0 - the Zephyr SDK version tested with Zephyr v4.0.0 MCUXpresso extension for VS Code v25.9.49 Hardware:   MIMXRT595-EVK evaluation board for the i.MX RT500 G1120B0MIPI display shield  Zephyr Pre-Requisites This GUI Guider release requires an older version of Zephyr v4.0.0.  If the Zephyr repo is already imported in VS Code, the MCUXpresso extension can checkout the required version. Click the MCUXpresso extension, right-click the Zephyr repo to update, and click "Update Repository or Index"   A pop-up appears in the lower right corner.  Click the Custom button to select the release tag    A pull-down appears at the top center.  Select the v4.0.0 release tag.  This will take some time for the extension to checkout this version, and run "west update" to sync all the module repositories.    If the Zephyr repo needs to be imported for the first time, the v4.0.0 version can be selected during the import.  Use the Quickstart Panel in the extension to "Import Repository".  For more help getting started with the MCUXpresso extension and importing Zephyr, see the NXP Zephyr Knowledge Hub. Repository: Zephyr Revision: select v4.0.0   Create and Export GUI Guider project Open GUI Guider and start a new project.  Select LVGL8.3.10 because the GUI Guider release notes say this is the LVGL version supported with Zephyr v4.0.0.   Select the board MIMXRT595-EVK Select the application SmartWatch Create the project   Generate the C code for the project:    Export the code for Zephyr:   Exporting the project into the Zephyr repository is the easiest option to import that project into VS Code.  In this example, the Zephyr workspace was setup in C:\z\zephyrproject.  The project folder name we will export is gui_guider_demo, and place in the samples folder Then the full path for this exported project is C:\z\zephyrproject\zephyr\samples\gui_guider_demo Import GUI Guider project into VS Code Back in VS Code, in the MCUXpresso extension, refresh the repository to find the newly generated sample project:   In the Quickstart Panel, "Import Example from Repository" with these settings: Repository: your Zephyr v4.0.0 workspace Board: mimxrt595_evk//cm33 Template: search "gui", and select the exported gui_guider_demo App type: Repository application Zephyr SDK: since this is an older Zephyr release, be sure to use the older Zephyr SDK v0.17.0, otherwise the app may not build   After importing, we also need to add the display shield to the project.  This is done by adding a Cmake variable, see the MCUXpresso Cmake wiki for more details.  In the gui_guider_demo project, click the Edit button for the debug build configuration.   Add the shield name to the CMake Extra arguments using this line, and click the Save button: SHIELD="g1120b0mipi"    Apply GUI Guider patches GUI Guider includes git patches in the exported project, and GUIGuider_User_Manual provides steps for apply these patches to the Zephyr and LVGL repositories.  Applying these patches uses CLI, and this article leverages a CLI feature in the MCUXpresso extension. Right-click the gui_guider_demo project, and select "Open in Integrated Terminal".  This opens the CLI terminal in the project folder, and activates the Python virtual environment.   Enter these CLI commands to apply the patches: cd ../.. git apply samples\gui_guider_demo\patches\0001-zephyr-Add-build-support-for-new-lvgl-widgets-develo.patch cd ..\modules\lib\gui\lvgl git apply ..\..\..\..\zephyr\samples\gui_guider_demo\patches\0001-lvgl-Add-new-widgets-developed-by-NXP.patch   Update Kconfig settings  Some of the Kconfig settings in the exported project do not work for this board and application, and the sizes must be increased.  The sizes used here come from the LVGL demo in the Zephyr repo from the file samples/modules/lvgl/demos/prj.conf.  For an introduction to Kconfig, see the NXP Zephyr Lab MCXN947 Kconfig. In the exported gui_guider_demo project, open the project file prj.conf.   Update the first two Kconfig settings with these sizes: CONFIG_LV_Z_MEM_POOL_SIZE=49152 CONFIG_MAIN_STACK_SIZE=4096 Build and flash the project  The project is now ready to build.  Right-click the project and do a Pristine Build   When the build completes, click the debug icon to program the image to flash.  The app is a very large image and will take some time to program.   Now the LVGL application generated by GUI Guider runs on the target board. Return to Zephyr Knowledge Hub

If you have any questions or issues, please Ask a new question, and the NXP support team can address it there. This article is an example using Zephyr's Networking stack over USB on the MCXN microcontroller family.  Although similar steps should also work on other boards with USB support.  This article provides 2 examples and patches: Single network interface over USB NCM Two network interfaces in same app: USB NCM plus Ethernet USB Background Zephyr added a new USB Device stack which was called USB Next during development. After the Zephyr v4.2 release, this USB Next stack is the default stack and is recommended for new applications.  The original USB stack has been deprecated, see the USB doc.  The latest stack is included using the Kconfig CONFIG_USB_DEVICE_STACK_NEXT. Networking support over USB is supported.  According to USB device next follow-up, the USB maintainer wrote "The support for networking functions RNDIS and CDC EEM is not available in the new stack. Instead, the CDC NCM and CDC ECM implementations should be used."  And the USB samples page says "USB CDC ECM and USB CDC NCM implementations are covered by the networking samples zperf: Network Traffic Generator or HTTP Server". To enable networking over USB, these samples include overlay files like usbd_cdc_ncm.overlay and overlay-usbd.conf . This article builds the HTTP Server sample with USB CDC NCM for the MCXN products. Example: USB NCM only The http_server sample using a single network interface through USB. Requirements The requirements to use the ncm_mcxn.patch and follow these steps include: After the Zephyr v4.2 release and before v4.3 was released, the default USB stack was changed and these samples were updated.  This patch was based on commit 67f2464 The patch supports the following MCXN boards: FRDM-MCXN947 - the board referenced in the steps below MCX-N9XX-EVK MCX-N5XX-EVK - at the time this article was published, the support for this board was not yet merged in the Zephyr repo.  There was an open Pull Request adding the MCX-N5XX-EVK board used to test this board Steps for http_server sample By default, the http_server runs over Ethernet on these boards.  The attached patch adds overlays for these boards to that sample to run over USB.  Build the sample with CLI using the command below for the FRDM-MCXN947 board.  The MCUXpresso extension for VS Code can also be used to build these samples west build -b frdm_mcxn947//cpu0 samples/net/sockets/http_server/ --pristine   Attach both USB Type-C cables to the FRDM-MCXN947.  Flash the http_server app to the board and run. The USB port J11 will enumerate in the host computer as a network adapter.  Assign that adapter a fixed IP address of 192.0.2.2.  Open a web browser and browse to 192.0.2.1.  The browser will show a web page served from the FRDM-MCXN947 board. This is the console output printed to the terminal after the web client browses from the server: *** Booting Zephyr OS build v4.2.0-3840-g62212512547a *** [00:00:00.001,000] <inf> net_config: Initializing network [00:00:00.001,000] <inf> net_config: IPv4 address: 192.0.2.1 [00:00:00.101,000] <inf> net_config: IPv6 address: 2001:db8::1 [00:00:00.101,000] <inf> net_config: IPv6 address: 2001:db8::1 [00:00:00.614,000] <inf> cdc_ncm: Enabled cdc_ncm_0 [00:00:00.615,000] <inf> cdc_ncm: New configuration, interface 1 alternate 1 [00:00:00.617,000] <inf> cdc_ncm: New configuration, interface 1 alternate 0 [00:00:00.617,000] <err> usbd_core: UDC error event [00:00:00.617,000] <err> usbd_core: UDC error event [00:00:00.638,000] <inf> cdc_ncm: New configuration, interface 1 alternate 1 [00:00:00.738,000] <inf> cdc_ncm: Speed change submitted [00:00:00.739,000] <inf> cdc_ncm: Speed change sent [00:00:00.740,000] <inf> cdc_ncm: Connected status submitted [00:00:00.747,000] <inf> cdc_ncm: Connection status sent [00:00:00.840,000] <inf> cdc_ncm: Connected status done [00:04:52.217,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler1 [00:04:53.216,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler1 [00:04:53.641,000] <inf> net_http_server_sample: Accepted websocket connection s [00:04:53.884,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler1 [00:04:54.883,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler1 uart:~$   Example: USB NCM plus Ethernet Similar to the example above, but this example leaves the Ethernet device enabled, and modifies the http_server source to enable both networking interfaces. Requirements The requirements to use the ncm_plus_ethernet.patch and follow these steps include: Like the example above, this patch was based on commit 67f2464 The patch supports the FRDM-MCXN947 board Connect the board to the host computer as described in the previous example.  In addition, connect an Ethernet cable to J16 on the board to the host computer. Networking setup This example configures 2 network interfaces in the http_server example, both with static IPv4 addresses.  The host computer will also connect through two network interfaces: one through USB and one using Ethernet.  Using Ubuntu as the host, I found I had to set the two interfaces on separate subnets for Ubuntu to communicate with both interfaces.  This is the setup used to test this example using all static IP addresses: USB NCM interface: http_server eth1 interface with address 192.0.3.1 host computer enx00005e005301 interface with address 192.0.3.2 Ethernet interface: http_server eth0 interface with address 192.0.2.1 host computer wired Ethernet interface with address 192.0.2.2 Steps for http_server sample Build the sample with CLI using the command below for the FRDM-MCXN947 board.  The MCUXpresso extension for VS Code can also be used to build these samples west build -b frdm_mcxn947//cpu0 samples/net/sockets/http_server/ --pristine   Open a web browser and browse to 192.0.2.1.  The browser will show a web page served from the Ethernet interface of the FRDM-MCXN947 board.  Open a second tab or browser, and browse to 192.0.3.1 for the USB interface.  Both web pages are updated using the two interfaces. This is the console output printed to the terminal after the web client browses from the server: [00:00:00.050,000] <inf> phy_mii: PHY (0) ID 7C121 [00:00:00.051,000] <inf> eth_nxp_enet_qos_mac: Link is down *** Booting Zephyr OS build v4.2.0-3649-g4006a48b4040 *** [00:00:00.052,000] <inf> net_config: Initializing network [00:00:00.052,000] <inf> net_config: Waiting interface 1 (0x30002190) to be up... [00:00:00.530,000] <inf> cdc_ncm: Enabled cdc_ncm_0 [00:00:00.531,000] <inf> cdc_ncm: New configuration, interface 1 alternate 1 [00:00:00.533,000] <inf> cdc_ncm: New configuration, interface 1 alternate 0 [00:00:00.533,000] <err> usbd_core: UDC error event [00:00:00.533,000] <err> usbd_core: UDC error event [00:00:00.554,000] <inf> cdc_ncm: New configuration, interface 1 alternate 1 [00:00:00.654,000] <inf> cdc_ncm: Speed change submitted [00:00:00.657,000] <inf> cdc_ncm: Speed change sent [00:00:00.658,000] <inf> cdc_ncm: Connected status submitted [00:00:00.665,000] <inf> cdc_ncm: Connection status sent [00:00:00.758,000] <inf> cdc_ncm: Connected status done [00:00:02.152,000] <inf> phy_mii: PHY (0) Link speed 100 Mb, full duplex [00:00:02.152,000] <inf> eth_nxp_enet_qos_mac: Link is up [00:00:02.153,000] <inf> net_config: Interface 1 (0x30002190) coming up [00:00:02.153,000] <inf> net_config: IPv4 address: 192.0.2.1 [00:00:02.253,000] <inf> net_config: IPv6 address: 2001:db8::1 [00:00:02.253,000] <inf> net_config: IPv6 address: 2001:db8::1 [00:00:06.548,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler status 1 [00:00:07.650,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler status 1 [00:00:07.652,000] <inf> net_http_server_sample: Accepted websocket connection for net stats [00:00:08.581,000] <dbg> net_http_server_sample: uptime_handler: Uptime handler status 1   The http_server includes the shell with some networking commands.  Enter the command "help" in the debug console to learn more.  This is the output from the shell command "net iface": uart:~$ net iface Hostname: zephyr Default interface: 1 Interface eth0 (0x30002190) (Ethernet) [1] =================================== Link addr : AE:9A:22:0C:E0:F3 MTU : 1500 Flags : AUTO_START,IPv4,IPv6 Device : ethernet (0x10037d08) Status : oper=UP, admin=UP, carrier=ON Ethernet capabilities supported: 10 Mbits 100 Mbits Ethernet PHY device: ethernet-phy@0 (0x10037cc0) Ethernet link speed: 100 Mbits full-duplex IPv6 unicast addresses (max 3): fe80::ac9a:22ff:fe0c:e0f3 autoconf preferred infinite 2001:db8::1 manual preferred infinite IPv6 multicast addresses (max 4): ff02::1 ff02::1:ff0c:e0f3 ff02::1:ff00:1 IPv6 prefixes (max 2): <none> IPv6 hop limit : 64 IPv6 base reachable time : 30000 IPv6 reachable time : 23045 IPv6 retransmit timer : 0 IPv4 unicast addresses (max 1): 192.0.2.1/255.255.255.0 manual preferred infinite IPv4 multicast addresses (max 2): 224.0.0.1 IPv4 gateway : 192.0.2.2 Interface eth1 (0x300022b0) (Ethernet) [2] =================================== Link addr : 02:00:00:F1:34:7C MTU : 1500 Flags : AUTO_START,IPv4,IPv6 Device : cdc_ncm_eth0 (0x10037ce4) Status : oper=UP, admin=UP, carrier=ON Ethernet capabilities supported: 10 Mbits Ethernet PHY device: <none> (0) IPv6 unicast addresses (max 3): fe80::ff:fef1:347c autoconf preferred infinite IPv6 multicast addresses (max 4): ff02::1 ff02::1:fff1:347c IPv6 prefixes (max 2): <none> IPv6 hop limit : 64 IPv6 base reachable time : 30000 IPv6 reachable time : 36584 IPv6 retransmit timer : 0 IPv4 unicast addresses (max 1): 192.0.3.1/255.255.255.0 manual preferred infinite IPv4 multicast addresses (max 2): 224.0.0.1 IPv4 gateway : 0.0.0.0 Return to Zephyr Knowledge Hub

If you have any questions or issues, please Ask a new question, and the NXP support team can address it there. Long term, NXP hopes clocks will be enabled and configured using the Clock Management Subsystem, but this is not adopted yet.  For now, most clocks at the SOC level are configured by source code in the startup code.  Newer boards configure these clocks in the board.c file.  For example, frdm_mcxn947_init() enables these clocks for FRDM-MCXN947 board.  Clock configuration is specific to the board and the application.  For a custom board, it is expected the board owner will review all the clock configuration in these files, and configure as needed for that board.   Some older SOCs enable the clocks in soc.c.  For example, clock_init() enables these clocks for the i.MX RT10xx SOCs.  When clock_init() is included in the SOC file, it is declared as weak so it can be overridden without needing to modify soc.c.  Custom boards can add a custom clock_init() in their board files to override this function. Peripheral Clocks NXP has a large portfolio of boards supported for different SOCs with many peripheral options and multiple instance of peripherals.  Many of these instances cannot easily be tested when Zephyr support is added for a board.  Most peripheral clocks are enabled in clock_init() in soc.c or board source files discussed above.  One common issue Zephyr users have when enabling or adding a peripheral instance on their board, is that instance is not clocked properly.  Typically enabling the peripheral clock is simple once this is known.   Return to Zephyr Knowledge Hub

Zephyr is enabled on the MIMXRT1170-EVK board and can run on both the primary Cortex-M7 and secondary Cortex-M4 cores.  This example shows how to run an Ethernet networking sample on the M4 core, using the dhcpv4_client sample.  By default for the M4 on this board, the code (.text) and data sections are linked to the Tightly Coupled Memories (TCMs) RAM_L and RAM_U (called sram0 and sram1 in the Zephyr devicetree).  But one of these TCMs is not large enough to place all of the code of a networking sample.  This example moves the M4 code to the internal 512 KB OCRAM1 using a devicetree overlay. This example also leverages Sysbuild and the M4 launcher feature.  Sysbuild builds both images for the M7 and M4.  The M7 boots first from flash, and runs a simple cm4_launcher app.  That app copies the M4 image from flash to RAM (OCRAM1 in this case) and then starts the M4.  This cm4_launcher app simplifies booting and testing apps on the M4. Requirements This example is enabled and tested with the following: MIMXRT1170-EVKB board Zephyr v4.2.0 Zephyr SDK v0.17.2 Connect an Ethernet cable to J32 for the 10/100M PHY DHCP example app Apply the attached patch to the Zephyr repository.  Some details about this patch: The mimxrt1170_evk Kconfig.defconfig is modified to define CONFIG_NET_L2_ETHERNET when building the the M4.  This improvement will be submitted to upstream Zephyr. Adds the sysbuild folder to the dhcp sample with the cm4_launcher to run on the M7 Modifies the M7 devicetree and Kconfig to prevent using resources that are used by the M4. Modifies the M4 linker settings to place the code (.text)  zephyr,flash  node in  ocram1 , and the data  zephyr,sram  node in  sram1  (RAM_U). Build and flash the app with CLI using these commands: west build -b mimxrt1170_evk//cm4 samples/net/dhcpv4_client/ --sysbuild --pristine west flash Reset the board after flashing. To build the app with NXP's MCUXpresso extension for VS Code, see the Sysbuild wiki.  You will also need to flash the cm4_launcher domain to the flash.  This MCUboot article has similar steps to enable sysbuild and flash the other domain. When both images are flashed, the RT1170 will boot and print this to the console: [00:00:00.051,000] <inf> phy_mii: PHY (0) ID 1CC816 [00:00:00.053,000] <inf> eth_nxp_enet_mac: Link is down *** Booting Zephyr OS build v4.2.0-1-g692f19148321 *** [00:00:00.053,000] <inf> net_dhcpv4_client_sample: Run dhcpv4 client [00:00:00.053,000] <inf> net_dhcpv4_client_sample: Start on ethernet: index=1 [00:00:03.153,000] <inf> phy_mii: PHY (0) Link speed 100 Mb, full duplex [00:00:03.153,000] <inf> eth_nxp_enet_mac: Link is up [00:00:03.170,000] <inf> net_dhcpv4: Received: 192.168.86.159 [00:00:03.170,000] <inf> net_dhcpv4_client_sample: Address[1]: 192.168.86.159 [00:00:03.170,000] <inf> net_dhcpv4_client_sample: Subnet[1]: 255.255.255.0 [00:00:03.170,000] <inf> net_dhcpv4_client_sample: Router[1]: 192.168.86.1 [00:00:03.170,000] <inf> net_dhcpv4_client_sample: Lease time[1]: 86400 seconds uart:~$ For more articles, see NXP's Zephyr Knowledge Hub.

If you have any questions or issues related to these resources, please Ask a new question, and the NXP support team can address it there. Most of NXP's contributions to Zephyr occur in the upstream repository at https://github.com/zephyrproject-rtos/zephyr .  Zephyr support is enabled by boards, see the upstream supported boards for the latest list of boards.  Each board has a board document, which includes a Supported Features table of all the features currently supported on that board.  For example, this is the upstream FRDM-MCXN947 board page. NXP also provides a downstream ecosystem called the Zephyr Software Developement Kit (ZSDK).  Some devices/boards have additional support in the NXP ZSDK.  To review the NXP ZSDK support, see the release notes.  To learn more, see Introduction to ZSDK Downstream and ZSDK Getting Started. Connectivity Devices: For Wi-Fi and Bluetooth, the NXP ZSDK includes additional release notes.  This link is for the ZSDK release nxp-v4.1.0, and the bottom of the page links to the document "wireless-soc-features-and-release-notes-zephyr.pdf".  Refer to the latest release tag for the lastest documents.

These steps walk through building the Zephyr TF-M sample with PSA crypto for the FRDM-RW612 board using NXP's downstream Zephyr release.  This uses the v4.0.0 release.  Steps below are provided using CLI or the MCUXpresso extension for VS Code. Before starting, import/clone the downstream ZSDK repo at https://github.com/nxp-zephyr/nxp-zephyr using the release tag nxp-v4.0.0 .  These steps are using the JLink debug probe. Building and Flashing with CLI The TF-M samples use the non-secure (NS) board variant when building.  Build with this command below (this builds with LOTS of warnings): west build -b frdm_rw612//ns samples/tfm_integration/psa_crypto/ --pristine The build generates a file that merges both images into a HEX file named tfm_merged.hex.  The command below programs this HEX file to the board: west flash See below for the console output printed from this demo Reprogramming the flash in ISP mode Once this image is programmed in the flash, it interferes with the JLink debug probe, and reflashing the board will fail.  A simple workaround is to force the MCU in ISP mode at boot.  In ISP mode, the app firmware does not execute, and the JLink can erase and update the flash.   To enter ISP mode on the FRDM-RW612 board, hold down the ISP button SW3.  Then press and release the Reset button SW1.  The MCU is now in ISP mode and can be reflashed. VS Code: Build, Program, and Debug The current release of the MCUXpresso extension for VS Code is the prerelease of v24.11.51.  This release does not yet support out-of-tree boards, and will not provide the option to import the application for the NS board variant.  These steps will import for the default FRDM-RW612 variant, and then modify the VS Code file to use the NS variant. In VS Code, use the MCUXpresso Quickstart panel to Import Example from Repository. Select the board FRDM_RW612, and the template tfm_integration/psa_crypto.   Before building, the project needs to be modified to use the NS board variant.  Open the file CMakePresets.json:   Modify the board name to frdm_rw612//ns for the NS variant.  Save the file.   Build the project in VS Code.  This build has LOTS of warnings. The debugger is not aware that the tfm_merged.hex file is used to program the flash.  This file must first be programmed to the flash before using the debugger.  In the VS Quickstart Panel, launch the Flash Programmer, and select the Segger probe type to use with JLink.  Select the psa_crypto project, the PROGRAM tab, and browse to the tfm_merged.hex file generated in the sample build folder.  Then click Run.  This programs the firmware image to flash.   The app will now boot and run, and print the console output shown in the section below.  To reprogram the flash, see the ISP section above. With the image programmed in flash, VS Code can now debug the application.  Launch the VS Code debugger.  Once connected, you may need to click the Restart button to properly connect and halt at main().     Console output Once the board is programmed, the app will print the following: Booting TF-M v2.1.1 [WRN] This device was provisioned with dummy keys. This device is NOT SECURE [Sec Thread] Secure image initializing! [INF][PS] Encryption alg: 0x5500200 [INF][Crypto] Provision entropy seed... [INF][Crypto] Provision entropy seed... complete. *** Booting Zephyr OS build nxp-v4.0.0 *** [00:18:23.434,135] <inf> app: att: System IAT size is: 367 bytes. [00:18:23.434,145] <inf> app: att: Requesting IAT with 64 byte challenge. [00:18:23.439,264] <inf> app: att: IAT data received: 367 bytes. 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 D2 84 43 A1 01 26 A0 59 01 23 AA 3A 00 01 24 FF ..C..&.Y.#.:..$. 00000010 58 40 00 11 22 33 44 55 66 77 88 99 AA BB CC DD X@.."3DUfw...... 00000020 EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC DD ...."3DUfw...... 00000030 EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC DD ...."3DUfw...... 00000040 EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC DD ...."3DUfw...... 00000050 EE FF 3A 00 01 24 FB 58 20 A0 A1 A2 A3 A4 A5 A6 ..:..$.X ....... 00000060 A7 A8 A9 AA AB AC AD AE AF B0 B1 B2 B3 B4 B5 B6 ................ 00000070 B7 B8 B9 BA BB BC BD BE BF 3A 00 01 25 00 58 21 .........:..%.X! 00000080 01 D1 C4 11 B1 5F 2D F0 38 6A A3 00 6A 74 D6 B4 ....._-.8j..jt.. 00000090 4A EA DE 02 56 0A E8 DB 67 F0 75 2C B4 75 21 F5 J...V...g.u,.u!. 000000A0 A1 3A 00 01 24 FA 58 20 AA AA AA AA AA AA AA AA .:..$.X ........ 000000B0 BB BB BB BB BB BB BB BB CC CC CC CC CC CC CC CC ................ 000000C0 DD DD DD DD DD DD DD DD 3A 00 01 24 F8 3A 3B FF ........:..$.:;. 000000D0 FF FF 3A 00 01 24 F9 19 30 00 3A 00 01 24 FE 01 ..:..$..0.:..$.. 000000E0 3A 00 01 24 F7 71 50 53 41 5F 49 4F 54 5F 50 52 :..$.qPSA_IOT_PR 000000F0 4F 46 49 4C 45 5F 31 3A 00 01 25 01 77 77 77 77 OFILE_1:..%.wwww 00000100 2E 74 72 75 73 74 65 64 66 69 72 6D 77 61 72 65 .trustedfirmware 00000110 2E 6F 72 67 3A 00 01 24 FC 73 30 36 30 34 35 36 .org:..$.s060456 00000120 35 32 37 32 38 32 39 2D 31 30 30 31 30 58 40 7D 5272829-10010X@} 00000130 BF CA 23 43 CA 0F E7 45 53 C9 75 83 F0 EA 33 C8 ..#C...ES.u...3. 00000140 37 B9 35 5F 21 C7 C3 B3 2F 16 7A 91 94 CA 8D 13 7.5_!.../.z..... 00000150 2A 01 84 E7 C6 82 69 97 86 0C 7A 1C BD 98 9F 88 *.....i...z..... 00000160 A9 EA AB 0F DB F9 1D 9D C8 EE 5D D6 77 93 AF ..........].w.. [00:18:23.620,682] <inf> app: Persisting SECP256R1 key as #1 [00:18:23.635,930] <err> app: Already exists [00:18:23.636,006] <err> app: Function: 'crp_gen_key_secp256r1' [00:18:23.636,011] <err> app: Failed to generate key. [00:18:23.653,441] <inf> app: Calculating SHA-256 hash of value 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 50 6C 65 61 73 65 20 68 61 73 68 20 61 6E 64 20 Please hash and 00000010 73 69 67 6E 20 74 68 69 73 20 6D 65 73 73 61 67 sign this messag 00000020 65 2E e. 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 9D 08 E3 E6 DB 1C 12 39 C0 9B 9A 83 84 83 72 7A .......9......rz 00000010 EA 96 9E 1D 13 72 1E 4D 35 75 CC D4 C8 01 41 9C .....r.M5u....A. [00:18:23.702,711] <inf> app: Signing SHA-256 hash 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 15 A3 E4 C2 AF 1B D2 AF 28 31 2C 42 9B A6 41 06 ........(1,B..A. 00000010 13 B4 45 E7 5D A9 A2 1D 2A 82 72 78 A3 B7 57 5A ..E.]...*.rx..WZ 00000020 A5 81 F8 66 76 F0 DB 46 E2 67 2E 55 0A A7 F8 55 ...fv..F.g.U...U 00000030 13 F1 74 1C C9 05 36 AF 97 4B E1 8E 29 8B 86 0A ..t...6..K..)... [00:18:23.749,169] <inf> app: Verifying signature for SHA-256 hash [00:18:23.771,732] <inf> app: Signature verified. [00:18:23.911,110] <inf> app: Destroyed persistent key #1 [00:18:23.917,526] <inf> app: Generating 256 bytes of random data. 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 BB C4 36 83 E4 85 A1 90 C8 F5 43 E1 7D 70 FA 7E ..6.......C.}p.~ 00000010 2F 84 A2 98 F5 9E FB 9B F6 6F B1 FB 1C 4C 49 2D /........o...LI- 00000020 5C A0 24 3C A5 47 87 EA 6F B7 31 AA 07 53 59 89 \.$<.G..o.1..SY. 00000030 6E 7A FF 5B C3 FA B1 33 3D 67 08 F4 36 8F D2 96 nz.[...3=g..6... 00000040 BE 36 C6 36 84 C2 53 54 76 30 92 8F F6 AF 74 5A .6.6..STv0....tZ 00000050 63 4D 8F 64 ED 55 F9 5A 64 DC EF F1 44 69 78 45 cM.d.U.Zd...DixE 00000060 05 A3 70 AD 20 78 59 85 A2 FD 5F 05 08 6D 5A 80 ..p. xY..._..mZ. 00000070 19 16 52 9C EC C1 C8 EC FD 1B 4B 1E 1E 6C 7A 7F ..R.......K..lz. 00000080 D4 83 74 17 BC D5 76 08 D7 55 35 75 5E 07 DE 50 ..t...v..U5u^..P 00000090 11 0E 38 19 79 27 BB 42 B0 32 67 FC FE 18 10 0F ..8.y'.B.2g..... 000000A0 09 55 A3 6A B0 34 22 4C 23 24 DF 14 87 F1 1C 48 .U.j.4"L#$.....H 000000B0 0F 1E 75 A5 B4 C2 B4 D5 68 EB 8A D9 EE 92 FE 0D ..u.....h....... 000000C0 09 FC 1D 39 F1 A0 79 E0 01 BF C0 D7 F5 94 3A 17 ...9..y.......:. 000000D0 8F 83 39 E0 33 BA 82 C3 65 7C C0 D4 82 D5 56 5B ..9.3...e|....V[ 000000E0 44 C9 61 BC 75 58 3D 1D 6F B2 BB EE 2B 8C 97 E2 D.a.uX=.o...+... 000000F0 12 57 EA BF 0A FE 6E AA FF 03 D4 C6 0B 74 12 23 .W....n......t.# [00:18:24.035,192] <inf> app: Initialising PSA crypto [00:18:24.040,673] <inf> app: PSA crypto init completed [00:18:24.046,396] <inf> app: Persisting SECP256R1 key as #1 [00:18:24.193,132] <inf> app: Retrieving public key for key #1 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 04 7B C3 8E 36 E3 11 88 C1 4E 36 4C 9E 37 41 3A .{..6....N6L.7A: 00000010 0B 1A 59 2E 2A AA C4 B6 FD E5 16 62 75 27 C7 49 ..Y.*......bu'.I 00000020 EA FC 9B 7A 06 9D 4A 1A F0 F8 18 C4 6D E1 DC FE ...z..J.....m... 00000030 52 59 EE 55 7F 38 83 CC CF 15 63 2B 16 CA 79 DA RY.U.8....c+..y. 00000040 7B { [00:18:24.245,819] <inf> app: Adding subject name to CSR [00:18:24.251,632] <inf> app: Adding subject name to CSR completed [00:18:24.258,199] <inf> app: Adding EC key to PK container [00:18:24.264,362] <inf> app: Adding EC key to PK container completed [00:18:24.271,223] <inf> app: Create device Certificate Signing Request [00:18:24.296,971] <inf> app: Create device Certificate Signing Request completd [00:18:24.304,898] <inf> app: Certificate Signing Request: -----BEGIN CERTIFICATE REQUEST----- MIHpMIGQAgEAMC4xDzANBgNVBAoMBkxpbmFybzEbMBkGA1UEAwwSRGV2aWNlIENl cnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEe8OONuMRiMFONkye N0E6CxpZLiqqxLb95RZidSfHSer8m3oGnUoa8PgYxG3h3P5SWe5VfziDzM8VYysW ynnae6AAMAoGCCqGSM49BAMCA0gAMEUCIQC9LqdaYIJqBw4Pvqyd5vrYnUmjLFhY LidxcY0g8x4LyAIgLUUnRyBduyCFFUl0RaXHrUbDarPLk35XO5kBnJxDfFQ= -----END CERTIFICATE REQUEST----- [00:18:24.346,162] <inf> app: Encoding CSR as json [00:18:24.351,600] <inf> app: Encoding CSR as json completed [00:18:24.357,605] <inf> app: Certificate Signing Request in JSON: {"CSR":"-----BEGIN CERTIFICATE REQUEST-----\nMIHpMIGQAgEAMC4xDzANBgNVBAoMBkxpbm} [00:18:24.400,811] <inf> app: Done.

Zephyr Project Build and Configuration System Devicetree Zephyr Project Devicetree Webinar: Application Portability Made Easy With Zephyr OS and NXP VS Code Lab Guide: Devicetree and Devicetree Viewer Golioth blog: Zephyr for Hardware Engineers: GPIO Zephyr Project Devicetree HOWTOs Kconfig Zephyr Project Kconfig Webinar: Application Portability Made Easy With Zephyr OS and NXP VS Code Lab Guide: Kconfig and compiler optimizations   Return to Zephyr Knowledge Hub