Struct SAU

Source

pub struct SAU { /* private fields */ }

Expand description

Security Attribution Unit

Implementations§

Source §

impl SAU

Source

pub fn region_numbers(&self) -> u8

Get the number of implemented SAU regions.

Source

pub fn disable_allns(&mut self)

Disable the SAU and mark all memory Non-Secure (ALLNS mode).

Sets CTRL.ALLNS = 1, CTRL.ENABLE = 0. When the SAU is disabled with ALLNS set, the entire address space is treated as Non-Secure (subject to any IDAU overrides). Use this when running entirely in Non-Secure mode with no security boundary enforcement.

To re-enable security boundaries, call init or enable after programming regions.

Source

pub fn init(&mut self, regions: &[SauRegion]) -> Result<(), SauError>

Program SAU regions and enable the SAU.

This is a convenience wrapper around set_region + enable:

Disables the SAU temporarily.
Programs all regions from regions.
Re-enables the SAU.

Memory not covered by any enabled region is treated as Secure once the SAU is enabled.

To also enable the SecureFault exception so TrustZone violations surface as a dedicated fault rather than escalating to HardFault, call scb.enable(cortex_m::peripheral::scb::Exception::SecureFault) after this.

§Errors

Returns SauError::TooManyRegions if regions.len() exceeds the number of regions implemented in hardware (see region_numbers. Returns other SauError variants if any region descriptor has a misaligned base or limit address.

On error the SAU is left disabled (in the state set at step 1 above).

Source

pub fn enable(&mut self)

Enable the SAU.

Source

pub fn set_region( &mut self, region_number: u8, region: SauRegion, ) -> Result<(), SauError>

Set a SAU region to a region number. SAU regions must be 32 bytes aligned and their sizes must be a multiple of 32 bytes. It means that the 5 least significant bits of the base address of a SAU region must be set to zero and the 5 least significant bits of the limit address must be set to one. The region number must be valid. This function is executed under a critical section to prevent having inconsistent results.

Source

pub fn get_region(&mut self, region_number: u8) -> Result<SauRegion, SauError>

Get a region from the SAU. The region number must be valid. This function is executed under a critical section to prevent having inconsistent results.

Source §