TFM and hardfault with NonSecure application

[romain2]

Hi,

We are currently using an stm32l5 in our product and experimenting with a stm32L562E-dk and with the official TFM (https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git master branch on the latest commit at this date.) The TFM is unmodified.

We are building the test-app and followed the documentation : https://tf-m-user-guide.trustedfirmware.org/platform/ext/target/stm/stm32l562e_dk/readme.html. The test-app is running well.

The issues arises when we want to modify the test-app :

lib/ext/tfm_test_repo-src/app/main_ns.c

Accessing registers such as SCB, NVIC will trigger an Hardfault. (So impossible to call HAL_Init and impossible to build a real application to interract with the TFM).

For example adding in the application :

volatile uint32_t scb = SCB->AIRCR;
LOG_MSG("Non-Secure system starting...\r\n");

Will trigger an hardfault (busfault excalated to hardfault) on the register access

After a long investigation, we don't see an explanation as the current protection (MPU, IDAU, SAU, GTZC) shouldn't have an influence and our application and shouldn't trigger this behavior.

While still in the TFM before booting the NonSecure app, they are no problems to access the SCB registers (SCB and SCB_NS).

Do you have any hint or explanation ?

Thank you,

Regards,

Romain

[Bubbles]

Hi @romain2​ ,

what is the configured RDP level?

BR,

J

[romain2]

Hi @JHOUD​ ,

Thank you for your quick answer (and sorry for my delay, Christmas holydays have come and gone !).

The RDP Level is 0 (0xAA) (this is the one configured by default on the TFM ST implementation), value confirmed after reading RDP value using STM32CubeProgrammer once the program has been flashed and run.

Even if the RDP would have been at a higher value it's not clear to me how it would have an impact on the behavior we are experiencing ?

Do you have the same behavior on the TFM official ST port or have you managed to access the same type of register from the basic NS application (SCB or NVIC) ?

Thank you,

Regards,

Romain

[Bubbles]

Hi Romain,

it should not matter whether you are in loader or an application, what matters is if the execution is in secure or non-secure context. Looking at figure 4 in the RM for example the SCB-NS is on different address in secure and non-secure context. Did you consider that?

Anyway if you download the STM32CubeL5 introduction package, there is a TF-M port included, masked as SBSFU. You can also use that as reference of implementation.

Kind regards,

J

[romain2]

Hi Jhoud,

Yes I have considered the banking of the SCB register when in executing in S or NS application.

I have already played with the STM32CubeL5 introduction package but now we want to be on the latest TFM release and unfortunately, on the stm32L5 port of the official TFM repository we still have the previously mentioned issues.

We also have purchased a stm32u5 development kit. On this chip, we have no problems with the official tfm port and we can build our non-secure application interracting with the tfm, none of the issues mentioned with the stm32l5 arises.

Investigating the differences between the two tfm ports (u5 and l5), it seems that there are big differences, but no clue of what is going wrong with the l5 port.

Is the stm32l5 porting still in active development on the official tfm repository ?

Regards,

Romain

[ZKRAC.1]

Hi @romain2​,

You have mentioned above that you have built your own non-secure application and you could interact with TFM on STM32U5, I'm using STM32U585, I have followed the documentation to get the complete installation of TFM on stm32u585, but it's not clear how I can add my non-application and interacting with TFM.

I hope you can explain it to me.

Thank you.

Regards.

ZK.