Exclusive Secure World Control of Non-Secure MPU in ARM Cortex-M33

Secure World Control of Non-Secure MPU in ARM Cortex-M33

The ARM Cortex-M33 processor, part of the ARMv8-M architecture, introduces a robust security model through its TrustZone technology. This model divides the system into Secure and Non-Secure worlds, each with its own Memory Protection Unit (MPU). The Non-Secure MPU (NS-MPU) is typically accessible from both worlds, but there are scenarios where exclusive control of the NS-MPU by the Secure World is required. This ensures that the Non-Secure World cannot modify MPU settings, which could otherwise compromise system security or stability.

The NS-MPU is responsible for defining memory access permissions for the Non-Secure World. By default, the Non-Secure World can configure its own MPU, but this can be problematic in systems where the Secure World needs to enforce strict memory access policies. For example, in safety-critical applications or systems with sensitive data, allowing the Non-Secure World to modify MPU settings could lead to unauthorized access or system crashes.

To achieve exclusive Secure World control over the NS-MPU, the Cortex-M33 provides mechanisms to restrict Non-Secure access to the NS-MPU registers. This involves configuring specific hardware registers and leveraging the TrustZone security extensions. The goal is to ensure that only the Secure World can modify the NS-MPU settings, while the Non-Secure World can only use the predefined memory regions without altering their permissions.

Locking Non-Secure MPU Access via Secure World Configuration

The primary method to restrict Non-Secure access to the NS-MPU involves configuring hardware registers that control MPU access permissions. On the Cortex-M33, this is typically achieved through the following steps:

1. Unprivileged Mode Enforcement: By default, the Cortex-M33 allows privileged software in the Non-Secure World to access the NS-MPU registers. To prevent this, the Secure World can enforce unprivileged mode for the Non-Secure application. This ensures that the Non-Secure software runs without the privileges required to modify the MPU settings. The Secure World can configure the Non-Secure state during initialization or runtime by setting the CONTROL.nPRIV bit in the Non-Secure context.

2. LOCKNSMPU Register Configuration: Some microcontroller implementations, such as the STM32U5 family, provide a dedicated register called LOCKNSMPU (Lock Non-Secure MPU). This register allows the Secure World to disable write access to the NS-MPU registers from the Non-Secure World. When LOCKNSMPU is set, any attempt by the Non-Secure World to modify the NS-MPU registers will result in a fault. This provides a hardware-enforced mechanism to ensure exclusive Secure World control over the NS-MPU.

3. Alias Address Usage: The Cortex-M33 provides alias addresses for the NS-MPU registers that are accessible only from the Secure World. By using these alias addresses, the Secure World can configure the NS-MPU without exposing the actual register addresses to the Non-Secure World. This prevents the Non-Secure software from directly accessing or modifying the NS-MPU settings.

4. Memory Protection Unit Configuration: The Secure World can configure the NS-MPU to define memory regions and access permissions for the Non-Secure World. This includes setting up regions for code, data, and peripherals, as well as defining access permissions such as read-only, write-only, or no access. Once configured, the Secure World can lock the NS-MPU settings to prevent further modifications from the Non-Secure World.

Implementing Secure World-Only NS-MPU Control

To implement exclusive Secure World control over the NS-MPU, follow these detailed steps:

1. Initialize the Secure World Environment: Begin by setting up the Secure World environment, including the Secure MPU and any necessary exception handlers. Ensure that the Secure World has full control over the system resources and can configure the NS-MPU as needed.

2. Configure the Non-Secure State: During system initialization, configure the Non-Secure state to run in unprivileged mode. This can be done by setting the CONTROL.nPRIV bit in the Non-Secure context. This ensures that the Non-Secure application cannot access privileged instructions or registers, including the NS-MPU.

3. Set the LOCKNSMPU Register: If your microcontroller implementation supports the LOCKNSMPU register, configure it to disable write access to the NS-MPU registers from the Non-Secure World. This step is critical to enforce hardware-level restrictions on NS-MPU modifications.

4. Use Alias Addresses for NS-MPU Configuration: Access the NS-MPU registers using the Secure World alias addresses. Configure the NS-MPU to define memory regions and access permissions for the Non-Secure World. Ensure that the configuration aligns with the system’s security and functional requirements.

5. Lock the NS-MPU Settings: Once the NS-MPU is configured, lock the settings to prevent further modifications. This can be done by setting the appropriate bits in the MPU control registers or using hardware-specific mechanisms such as the LOCKNSMPU register.

6. Test and Validate the Configuration: After implementing the above steps, thoroughly test the system to ensure that the Non-Secure World cannot modify the NS-MPU settings. Verify that the memory access permissions are enforced as expected and that the system operates securely and reliably.

7. Handle Faults and Exceptions: Implement fault handlers in the Secure World to detect and respond to any unauthorized attempts to access or modify the NS-MPU registers. This includes handling bus faults, memory management faults, and other exceptions that may occur due to restricted access.

By following these steps, you can achieve exclusive Secure World control over the NS-MPU in the ARM Cortex-M33, ensuring that the Non-Secure World operates within the defined memory access constraints. This approach enhances system security and stability, particularly in applications where strict memory protection is required.

Summary of Key Concepts

This guide provides a comprehensive approach to achieving exclusive Secure World control over the NS-MPU in the ARM Cortex-M33. By leveraging hardware features and TrustZone technology, you can enforce strict memory access policies and enhance the security of your embedded system.