SPU — System protection unit

The SPU provides the register interface to configure and enforce the access privileges per peripheral, and where applicable, individual features of the peripheral such as GPIO pins, DPPI channels, etc.

Any accesses to a peripheral or a peripheral feature are validated against the SPU configuration for the security attributes.

Security attributes of a peripheral normally applies to all registers of the peripheral. However, some peripherals have split security to individual features within the peripheral, such as individual pins or DPPI channels. For these split feature peripherals, access is granted on a per-bit or per-register level. Unless mentioned otherwise, the term peripheral is used in the remainder of this section to refer to both a peripheral and an individual peripheral feature.

See Address format for information on extracting the Peripheral slave index from a peripheral address.

        #define SPU_CORTEX_ADDRESS_REGION    (0x50000000)

        uint32_t perip_addr = NRF_SAADC_S_BASE;


        uint32_t apb_bus_number = (perip_addr & 0x00FC0000);
        uint32_t apb_slave_index = (perip_addr & 0x0003F000) >> 12;

        // Get the address to the SPU instance
        NRF_SPU_Type *p_spu = (NRF_SPU_Type*)(SPU_CORTEX_ADDRESS_REGION |
        apb_bus_number);

        // Configure PERIPH[n].PERM.SECATTR to secure for SAADC
        p_spu->PERIPH[apb_slave_index].PERM =
        (p_spu->PERIPH[apb_slave_index].PERM &
        ~SPU_PERIPH_PERM_SECATTR_Msk) |
        (SPU_PERIPH_PERM_SECATTR_Secure <<
        SPU_PERIPH_PERM_SECATTR_Pos)
      

See Instantiation to find the value of SLAVE_BITS for each SPU instance.

SPU supports secure and non-secure accesses based on TrustZone. On each access to a peripheral address, the security state of the master initiating the transaction is verified against the SPU security attribute configuration of the peripheral. The following figure shows a simplified view of the SPU registers controlling several internal modules.

An access error on peripherals managed by an SPU result in the PERIPHACCERR event on the SPU.

Peripheral access control depends on the security attributes.

Peripheral security attributes are defined in the Peripheral Instantiation table as one of the following:

Always Secure (HF S)

Access to the peripheral is always restricted to secure code.

Always Non-secure (HF NS)

Access to the peripheral is always allowed from both secure and non-secure code.

User selectable (US)

The security attribute can be configured for secure or non-secure access.

The full list of peripherals and their corresponding security attributes can be found in the Instantiation table in Memory section. For each peripheral with ID n, the register PERIPH[n].PERM.SECUREMAPPING will show whether the security attribute for this peripheral is user selectable or not.

The security attribute can be configured using the register PERIPH[n].PERM.SECATTR, if user selectable.

The DMA security attribute is determined as follows:

Secure code can access both secure peripherals and non-secure peripherals.

The DMA Privilege attribute is determined as follows:

Peripherals with split security allow more detailed configuration.

When peripherals have split security, then the security of each feature in the peripheral can be configured individually using register FEATURE.

Each SPU instance can have different numbers of features. See the instantiation table for an overview of features supported by the split security peripherals.

Peripherals that have non-secure security mapping have their address starting with 0x4XXX_XXXX. Peripherals that have secure security mapping have their address starting with 0x5XXX_XXXX.

Peripherals with a user-selectable security mapping are available at an address starting with:

• 0x4XXX_XXXX, if the peripheral security attribute is set to non-secure
• 0x5XXX_XXXX, if the peripheral security attribute is set to secure

Peripherals with a split security mapping are available at an address starting with:

• 0x4XXX_XXXX for non-secure access and 0x5XXX_XXXX for secure access, if the peripheral security attribute is set to non-secure
  • Secure registers in the 0x4XXX_XXXX range are not visible for secure or non-secure code, and an attempt to access such a register will generate a peripheral access error, and result in write-ignore, read as zero behavior.
  • Secure code can access both non-secure and secure registers in the 0x5XXX_XXXX range
• 0x5XXX_XXXX, if the peripheral security attribute is set to secure

Peripherals containing a DMA master can be configured so the security attribute of the DMA transfers is different from the security attribute of the peripheral itself. This allows a secure peripheral to do non-secure data transfers to or from the system memories.

Then it is possible to select the security attribute of the DMA transfers using the field DMASEC (PERIPH[n].PERM.DMASEC == Secure and PERIPH[n].PERM.DMASEC == NonSecure) in PERIPH[n].PERM.

The SPU generates a peripheral access error event once access violation is detected.

Access to the features can be restricted. A feature can be declared as secure so that only secure peripherals can access it.

The security attribute of a feature is configured by using corresponding SPU's feature register. When the secure attribute is set for a feature, only secure peripherals and code will be able to access that feature. For example, register FEATURE.GRTC.CC[n] is used to configure security for the capture-and-compare functionality of the GRTC peripheral. When the secure attribute is set, only secure code can access and use the corresponding capture-and-compare registers, tasks, and events.

See the SPU configuration to find the features supported by each SPU instance.