Special considerations for a system implementing TrustZone for Cortex-M processors

A peripheral configured as non-secure can only subscribe to or publish on non-secure DPPI channels. A peripheral configured as secure can access all DPPI channels. DPPI handles both secure and non-secure accesses, but behaves differently depending on the access type.

• A non-secure peripheral access can only configure and control the DPPI channels defined as non-secure in the SPU.DPPI.PERM[n] register
• A secure peripheral access can control all the DPPI channels, independently of the SPU.DPPI.PERM[n] register

Non-secure access to a DPPI register or bit field controlling a channel marked as secure in a SPU.DPPI[n].PERM register is ignored. Write access has no effect, and read access returns a zero value.

Exceptions are not triggered when non-secure accesses target a register or a bit field controlling a secure channel. For example, if the bit i is set in the SPU.DPPI[0].PERM register (declaring DPPI channel [i] as secure), then the following is true:

• Non-secure write access to registers CHEN, CHENSET, and CHENCLR cannot write bit i of these registers
• Non-secure write access to registers TASK_CHG[j].EN and TASK_CHG[j].DIS is ignored if the channel group j contains at least one channel defined as secure (it can be the channel [i] itself or any channel declared as secure)
• Non-secure read access to registers CHEN, CHENSET, and CHENCLR always read 0 for the bit at position i

For the channel configuration registers (CHG[]), access from non-secure code is only possible if the included channels are all non-secure, whether the channels are enabled or not. If register CHG[g] included one or more secure channels, then the group g is considered as secure, and only secure transfers can read to or write from CHG[g]. A non-secure write access is ignored, and a non-secure read access returns 0.

The DPPI can subscribe to secure and non-secure channels through the SUBSCRIBE_CHG[] registers in order to trigger the task for enabling or disabling channel groups. An event from a secure channel is ignored if the group subscribing to this channel is non-secure. A secure group can subscribe to a non-secure channel or a secure channel.

Channel group

Creating a channel group allows all channels in that group to be simultaneously enabled or disabled. The security attribute for a channel group (secure or non-secure) is defined as follows:

• If all channels (enabled or not) within a group are non-secure, then the group is considered non-secure
• If at least one of the channels (enabled or not) within the group is secure, then the group is considered secure