GPIO security

The general purpose input/output (GPIO) peripheral is implemented as a split-security peripheral. If marked as non-secure, it can be accessed by both secure and non-secure accesses but will behave differently depending on the access type.

Note: For more information on pin assignment and the corresponding effect of read and write operations of GPIO registers, see Assigning pins between cores, peripherals, or subsystems.

A non-secure peripheral access will only be able to configure and control pins defined as non-secure in the system protection unit (SPU) GPIOPORT.PERM[] register(s).

A non-secure access to a register or a bitfield controlling a pin marked as secure in GPIO.PERM[] register(s) will be ignored. Write access will have no effect and read access will return a zero value.

No exception is triggered when a non-secure access targets a register or bitfield controlling a secure pin. For example, if the bit i is set in the SPU.GPIO.PERM[0] register (declaring Pin P0.i as secure), then

non-secure write accesses to OUT, OUTSET, OUTCLR, DIR, DIRSET, DIRCLR and LATCH registers will not be able to write to bit i of those registers
non-secure write accesses to registers PIN[i].OUT and PIN_CNF[i] will be ignored
non-secure read accesses to registers OUT, OUTSET, OUTCLR, IN, DIR, DIRSET, DIRCLR and LATCH will always read a '0' for the bit at position i
non-secure read accesses to registers PIN[i].OUT, PIN[i].OUT and PIN_CNF[i] will always return 0

The GPIO.DETECTMODE and GPIO.DETECTMODE_SEC registers are handled differently than the other registers mentioned before. When accessed by a secure access, the DETECTMODE_SEC register control the source for the DETECT_SEC signal for the pins marked as secure. When accessed by a non-secure access, the DETECTMODE_SEC is read as zero and write accesses are ignored. The GPIO.DETECTMODE register controls the source for the DETECT_NSEC signal for the pins defined as non-secure.

The DETECT_NSEC signal is routed to the GPIOTE peripheral, allowing generation of events and interrupts from pins marked as non-secure. The DETECT_SEC signal is routed to the GPIOTESEC peripheral, allowing generation of events and interrupts from pins marked as secure. Principle of direct pin access illustrates how the DETECT_NSEC and DETECT_SEC signals are generated from the GPIO PIN[].DETECT signals.

Figure 4. Principle of direct pin access