Cannot Set DMA to Secure (CCRx SECM)

[MBand.3]

I'm attempting to configure peripherals in STM32CubeMX, but I'm getting error_handler calls from my DMA configuration for ADC1.

All the necessary peripherals (DMA1 channel1, ADC1) are configured as secure in CubeMX, but when HAL_ADC_MspInit attempts to set the SECM bit for hdma_adc1, the write fails. I am running only a secure image (i.e., no non-secure image is loaded). In IAR, "TrustZone" is enabled, and set to "Secure" mode.

On boot, I call the following, in order:

    HAL_Init();

    SystemClock_Config();

    MX_GTZC_S_Init();

    MX_ICACHE_Init();

    MX_DMA_Init();

    MX_GPIO_Init();

    MX_ADC1_Init();

The Error Handler is hit when attempting to set hdma_adc1's source point, which is secure.

[MBand.3]

If anyone finds this question in the future and is struggling with the same thing, I've found the answer:

It turns out that just telling IAR that the project is "secure" doesn't enable TrustZone. If TZ isn't enabled, secure peripherals don't seem to exist.

You can check the TZEN bit in FLASH_OPTR. If TZEN=1, then TrustZone is enabled. If not, you get to turn it on:

 HAL_FLASH_Unlock();
 HAL_FLASH_OB_Unlock();
 HAL_FLASHEx_OBGetConfig(&flash_ob);
 flash_ob.OptionType = OPTIONBYTE_USER;
 flash_ob.USERType = OB_USER_TZEN;
 flash_ob.USERConfig = OB_TZEN_ENABLE;
 HAL_FLASHEx_OBProgram(&flash_ob);
 HAL_FLASH_OB_Launch();
 HAL_FLASH_OB_Lock();
 HAL_FLASH_Lock();