Raspberry Pi 1B Secure Configuration Register

Question

Now I make low level bare-metal tool for RPi. And I need to get Secure Configuration Register value. I wrote the following instruction mrc p15, 0, r0, c1, c1, 0 to get it. But CPU goes into Undefined Exception Mode and CPSR value is 0x600001DB .

Instruction of reading SCR value is the first instruction being executed by CPU.

I'd read ARM1176JZF-S TRM r0p7 several times but I've not found any restriction on using SCR reading instruction except being CPU in the Secure Privileged Mode but according to TRM this CPU starts from Secure Privileged Mode . If to be more concrete the initial mode is Secure Supervisor Mode .

I use the following command to execute code with QEMU qemu-system-arm -cpu arm1176 -M versatilepb -m 256 -nographic -kernel start.elf -s -S -monitor stdio

I can't understand what I overlooked?

Answer 1

QEMU's versatilepb board does not support TrustZone: it creates a CPU with that feature disabled.

Other QEMU board models do support TZ, if you want to play with it: for instance vexpress-a9, vexpress-a15 and raspi2; also "virt", if you pass -machine secure=on on the QEMU command line.