topic Re: TrustZone Secure Setting and __ARM_FEATURE_CMSE in MCX Microcontrollers

TrustZone Secure Setting and __ARM_FEATURE_CMSE

mortontd — Wed, 24 Jul 2024 20:04:59 GMT

Hello All MCX'ers,

This is a first time for me using an M33 MCU with TrustZone and I am trying to understand the security and build settings - mainly related to the __ARM_FEATURE_CMSE macro.

Here is what I understand:

If I build with TrustZone set to 'None', __ARM_FEATURE_CMSE is set to 1. But, by default the MCU should run everything in Secure mode out of RESET(?).

If I build with TrustZone set to 'Non-secure', __ARM_FEATURE_CMSE is still 1. The MCU should run in non-secure mode (?).

If I build with TrustZone set to 'Secure', __ARM_FEATURE_CMSE is 3. The MCU should run in secure mode. .

So, I am not understanding the 'None' mode or the __ARM_FEATURE_CMSE macro, because shouldn't 'None' and 'Secure' both result in __ARM_FEATURE_CMSE equal to 3?

I appreciate any clarification the forum can provide, Thanks!

Todd

Re: TrustZone Secure Setting and __ARM_FEATURE_CMSE

xiangjun_rong — Tue, 30 Jul 2024 05:37:32 GMT

Hi,

As you know that the TrustZone is a feature of cortex-M33 core, so the ARM defines the macro __ARM_FEATURE_CMSE.

Pls refer to the link:

It define the bit meaning of the __ARM_FEATURE_CMSE compiler macro.

Hope it can help you

XiangJun rong

Re: TrustZone Secure Setting and __ARM_FEATURE_CMSE

mortontd — Tue, 30 Jul 2024 20:52:48 GMT

Thank you Xiangjun for the response and reference.

I do understand the part covered by the reference you linked so I should be more specific with my question...

First, my goal is to create an app on the N947 that does not use TrustZone. I want it to be like writing an app for the Cortex-m4, etc.

So my first thought was that I should set TrustZone to None in MCUXpresso. This causes __ARM_FEATURE_CMSE to be 1, and only adds the -mcpu=cortex-m33 compiler option. However the app appears to be running in secure mode so I get hard faults.

If I set TrustZone to Secure in MCUXpresso it sets __ARM_FEATURE_CMSE to be 3 and it works.

So what is the intention of the None setting? Is it supposed to be running in non-secure mode? Doesn't it run in secure mode out of reset? This is where I am confused.

Also, another thing that makes this hard to work with is that MCUXpresso does not expand the __ARM_FEATURE_CMSE macro correctly. If I hover, it will always expand to 1, and the greyed out areas of preprocessor if's are not correct. I tested this by setting a global to the value of the macro and it is 3 in Secure mode, even though the macro expands to 1, and the code in the greyed out areas does execute.

Thanks again,

-Todd

Re: TrustZone Secure Setting and __ARM_FEATURE_CMSE

xiangjun_rong — Wed, 31 Jul 2024 05:44:30 GMT

Hi,

After Reset, the MCXN947 is in security mode in default, so __ARM_FEATURE_CMSE should be 3.

Hope it can help you

XiangJun Rong

Re: TrustZone Secure Setting and __ARM_FEATURE_CMSE

mortontd — Sat, 10 Aug 2024 17:12:08 GMT

XiangJun,

Thank you for your response.

I believe the rest of the issues are with the MCUXpresso IDE so I will ask in that forum.

-Todd