14 Implementation Defined Attribution Unit (IDAU)

Important: The IDAU peripheral is only present on PIC32CM LS00/LS60.
The Cortex-M23 provides two ways for handling the transactions from the different hosts (core, debugger, and so on):
  • The Secure Attribution Unit (SAU): not present on PIC32CM LS00/LS60.
  • The Implementation Defined Attribution Unit (IDAU): chosen for PIC32CM LS00/LS60.

The SAU is a Memory Protection Unit (MPU) like hardware embedded in the core. The role of the SAU is to manage all the Secure and Non-Secure transactions coming from the core and the debugger. However, using the SAU implies that the security configuration must be propagated somewhere else in the MCU architecture for security awareness.

The IDAU is a hardware unit external to the core, which is used to indicate to the processor if a particular memory region is Secure (S), Non-Secure Callable (NSC), or Non-Secure (NS). It can also mark a memory region to be exempted from security checking. The Cortex-M23 checks each access (fetch or data) in the IDAU, which returns the privilege information about that specific address. If the access is not permitted, the CPU enters a HardFault exception.

Table 14-1. IDAU Memory Attribution Definition
AttributeDescription
Non-SecureMemory can be accessed in Secure or Non-Secure state.
SecureMemory can only be accessed in Secure state. It cannot be called from Non-Secure state.
Non-Secure callable

Memory can only be accessed in Secure state, but can be called from Non-Secure state.

ExemptNo attribution check will be done, and the operation will take place on the bus

The following table provides the PIC32CM LS00/LS60 memory space security attributions:

Table 14-2. PIC32CM LS00/LS60 Memory Space Security Attributions (IDAU.CTRL.ENABLE == 1) (1)
Memory regionAttribute
Secure Flash (BOOT region)Secure
Non-Secure Callable Flash (BOOT region)Non-secure callable
Secure Flash (APPLICATION region)Secure
Non-Secure Callable Flash (APPLICATION region)Non-secure callable
Non-Secure Flash (APPLICATION region)Non-secure
Secure Data FlashSecure
Non-Secure Data FlashNon-secure
NVM Rows

Exempt - eXecute Never

Secure (R/W access)

Non-Secure (Discarded for BOCOR, Read-only for the others)

Boot ROMSecure

Execute-only for CRYA functions

Secure SRAMSecure
Non-Secure SRAMNon-secure
PeripheralsExempt - eXecute Never
IOBUSExempt - eXecute Never
Others (Reserved, Undefined...)Secure
Note:
  1. Exempt property relates only to the IDAU: Peripherals, IOBUS as well as NVM rows security is directly done at the peripheral level.
Table 14-3. PIC32CM LS00/LS60 Memory Space Security Attributions (IDAU.CTRL.ENABLE == 0)
Memory regionAttribute
Boot ROMSecure

Execute-only for CRYA functions

OthersExempt
In addition, the IDAU propagates all the security configurations to:
  • The memory controllers: Flash, Data Flash and SRAM embedded memories can be split in sub-regions, which are reserved either for the Secure or for the Non-Secure application.
  • The peripheral controllers using the Peripherals Access Controller (PAC) which can allocate each peripheral either to the Secure or to the Non-Secure application, with the exception of the IDAU and DSU which have a fixed security attribute:
Important:
  1. The IDAU peripheral is always Secured.
  2. The DSU peripheral is always Non-Secured.
  3. The PAC and NVMCTRL peripherals are always Secured if BOCOR.SECCFGLOCK = 1 after exiting Boot ROM.

Software can check the privilege state of a memory location by using the Cortex-M23 Test Target instructions: TT, TTT, TTA, and TTAT.

The memory location is referenced using the Cortex-M23 IREGION bit field, which specifies the IDAU region number (Refer to the ARMv8-M Architecture Reference Manual for more information).

Table 14-4. PIC32CM LS00/LS60 IDAU Region Number for TT, TTT, TTA and TTAT Cortex-M23 Instructions (IDAU.CTRL.ENABLE == 1)
Memory RegionIDAU Region Number for TTx Instructions (IREGION bits)
Secure Flash (BOOT region)0x01
Non-Secure Callable Flash (BOOT region)0x02
Secure Flash (APPLICATION region)0x03
Non-Secure Callable Flash (APPLICATION region)0x04
Non-Secure Flash (APPLICATION region)0x05
Secure Data Flash0x06
Non-Secure Data Flash0x07
NVM User Rows0x00 (invalid)
Boot ROM0x08
Secure SRAM0x09
Non-Secure SRAM0x0A
Peripherals0x00 (invalid)
IOBUS0x00 (invalid)
Others (Reserved, Undefined...)0x00 (invalid)
Table 14-5. PIC32CM LS00/LS60 IDAU Region Number for TT, TTT, TTA and TTAT Cortex-M23 Instructions (IDAU.CTRL.ENABLE == 0)
Memory RegionIDAU Region Number for TTx Instructions (IREGION bits)
Boot ROM0x08
Others0x00 (invalid)