diff --git a/cmd/probe/src/lib.rs b/cmd/probe/src/lib.rs
index 5dfb05e5c..2fb842aa1 100644
--- a/cmd/probe/src/lib.rs
+++ b/cmd/probe/src/lib.rs
@@ -406,7 +406,51 @@ fn probecmd(context: &mut humility::ExecutionContext) -> Result<()> {
             );
         }
     }
+
     if part.has_tz() {
+        // Temporarily force banked register accesses to Secure versions
+        let mut dscsr = DSCSR::read(core)?;
+        dscsr.set_sbrsel(true);
+        dscsr.set_sbrselen(true);
+        dscsr.write(core)?;
+
+        let sau_type = SAU_TYPE::read(core)?;
+        print("SAU_TYPE", format!("0x{:x}", sau_type.0));
+
+        if sau_type.sregion() > 0 {
+            let sau_ctrl = SAU_CTRL::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                "SAU_CTRL",
+                format!("{:x}", sau_ctrl.0)
+            );
+        }
+
+        for rnr in 0..sau_type.sregion() {
+            let mut sau_rnr = SAU_RNR(0);
+            sau_rnr.set_region(rnr);
+            sau_rnr.write(core)?;
+
+            let sau_rbar = SAU_RBAR::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                format!("SAU_RBAR{}", rnr),
+                format!("{:x}", sau_rbar.0)
+            );
+
+            let sau_rlar = SAU_RLAR::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                format!("SAU_RLAR{}", rnr),
+                format!("{:x}", sau_rlar.0)
+            );
+        }
+
+        // Switch back to using current security domain versions of banked
+        // registers
+        dscsr.set_sbrselen(false);
+        dscsr.write(core)?;
+
         let sfsr = SFSR::read(core)?;
         if sfsr.has_fault() {
             humility::msg!(
@@ -422,6 +466,157 @@ fn probecmd(context: &mut humility::ExecutionContext) -> Result<()> {
         }
     }
 
+    if part.has_tz() {
+        // Temporarily force banked register accesses to Secure versions
+        let mut dscsr = DSCSR::read(core)?;
+        dscsr.set_sbrsel(true);
+        dscsr.set_sbrselen(true);
+        dscsr.write(core)?;
+
+        {
+            let mpu_type = MPU_TYPE::read(core)?;
+            print("MPU_S_TYPE", format!("0x{:x}", mpu_type.0));
+
+            if mpu_type.dregion() > 0 {
+                let mpu_ctrl = MPU_CTRL::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_S_CTRL",
+                    format!("{:x}", mpu_ctrl.0)
+                );
+
+                let mpu_mair0 = MPU_MAIR0::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_S_MAIR0",
+                    format!("{:x}", mpu_mair0.0)
+                );
+
+                let mpu_mair1 = MPU_MAIR1::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_S_MAIR1",
+                    format!("{:x}", mpu_mair1.0)
+                );
+            }
+
+            for rnr in 0..mpu_type.dregion() {
+                let mut mpu_rnr = MPU_RNR(0);
+                mpu_rnr.set_region(rnr);
+                mpu_rnr.write(core)?;
+
+                let mpu_rbar = MPU_RBAR::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    format!("MPU_S_RBAR{}", rnr),
+                    format!("{:x}", mpu_rbar.0)
+                );
+
+                let mpu_rlar = MPU_RLAR::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    format!("MPU_S_RLAR{}", rnr),
+                    format!("{:x}", mpu_rlar.0)
+                );
+            }
+        }
+
+        // Now switch to the Non-Secure versions
+        dscsr.set_sbrsel(false);
+        dscsr.write(core)?;
+
+        {
+            let mpu_type = MPU_TYPE::read(core)?;
+            print("MPU_NS_TYPE", format!("0x{:x}", mpu_type.0));
+
+            if mpu_type.dregion() > 0 {
+                let mpu_ctrl = MPU_CTRL::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_S_CTRL",
+                    format!("{:x}", mpu_ctrl.0)
+                );
+
+                let mpu_mair0 = MPU_MAIR0::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_NS_MAIR0",
+                    format!("{:x}", mpu_mair0.0)
+                );
+
+                let mpu_mair1 = MPU_MAIR1::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    "MPU_NS_MAIR1",
+                    format!("{:x}", mpu_mair1.0)
+                );
+            }
+
+            for rnr in 0..mpu_type.dregion() {
+                let mut mpu_rnr = MPU_RNR(0);
+                mpu_rnr.set_region(rnr);
+                mpu_rnr.write(core)?;
+
+                let mpu_rbar = MPU_RBAR::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    format!("MPU_NS_RBAR{}", rnr),
+                    format!("{:x}", mpu_rbar.0)
+                );
+
+                let mpu_rlar = MPU_RLAR::read(core)?;
+                humility::msg!(
+                    "{:>12} => 0x{:8}",
+                    format!("MPU_NS_RLAR{}", rnr),
+                    format!("{:x}", mpu_rlar.0)
+                );
+            }
+        }
+
+        // Finally, switch back to current security domain versions
+        dscsr.set_sbrselen(false);
+        dscsr.write(core)?;
+    } else {
+        let mpu_type = MPU_TYPE::read(core)?;
+        print("MPU_TYPE", format!("0x{:x}", mpu_type.0));
+
+        if mpu_type.dregion() > 0 {
+            let mpu_mair0 = MPU_MAIR0::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                "MPU_MAIR0",
+                format!("{:x}", mpu_mair0.0)
+            );
+
+            let mpu_mair1 = MPU_MAIR1::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                "MPU_MAIR1",
+                format!("{:x}", mpu_mair1.0)
+            );
+        }
+
+        for rnr in 0..mpu_type.dregion() {
+            let mut mpu_rnr = MPU_RNR(0);
+            mpu_rnr.set_region(rnr);
+            mpu_rnr.write(core)?;
+
+            let mpu_rbar = MPU_RBAR::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                format!("MPU_RBAR{}", rnr),
+                format!("{:x}", mpu_rbar.0)
+            );
+
+            let mpu_rlar = MPU_RLAR::read(core)?;
+            humility::msg!(
+                "{:>12} => 0x{:8}",
+                format!("MPU_RLAR{}", rnr),
+                format!("{:x}", mpu_rlar.0)
+            );
+        }
+    }
+
     if !dhcsr.halted() {
         core.run()?;
     }
diff --git a/humility-arch-cortex/src/debug.rs b/humility-arch-cortex/src/debug.rs
index fb0567a53..fe0b19c63 100644
--- a/humility-arch-cortex/src/debug.rs
+++ b/humility-arch-cortex/src/debug.rs
@@ -428,6 +428,16 @@ register!(DHCSR, 0xe000_edf0,
     pub halted, _: 17;
 );
 
+register!(DSCSR, 0xe000ee08,
+    #[derive(Copy, Clone)]
+    pub struct DSCSR(u32);
+    impl Debug;
+    pub cdskey, set_cdskey: 17;
+    pub cds, set_cds: 16;
+    pub sbrsel, set_sbrsel: 1;
+    pub sbrselen, set_sbrselen: 0;
+);
+
 register!(DEMCR, 0xe000_edfc,
     #[derive(Copy, Clone)]
     pub struct DEMCR(u32);
@@ -481,6 +491,120 @@ register!(MVFR0, 0xe000_ef40,
     pub simd_registers, _: 3, 0;
 );
 
+register!(MPU_TYPE, 0xe000ed90,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_TYPE(u32);
+    impl Debug;
+    pub dregion, _: 15, 8;
+    pub separate, _: 0;
+);
+
+register!(MPU_RNR, 0xe000ed98,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_RNR(u32);
+    impl Debug;
+    pub region, set_region: 7, 0;
+);
+
+register!(MPU_CTRL, 0xe000ed94,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_CTRL(u32);
+    impl Debug;
+    pub privdefena, _: 2;
+    pub hfnmiena, _: 1;
+    pub enable, _: 0;
+);
+
+register!(MPU_MAIR0, 0xe000edc0,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_MAIR0(u32);
+    impl Debug;
+    pub attr3, _: 31, 24;
+    pub attr2, _: 23, 16;
+    pub attr1, _: 15, 8;
+    pub attr0, _: 7, 0;
+);
+
+register!(MPU_MAIR1, 0xe000edc4,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_MAIR1(u32);
+    impl Debug;
+    pub attr7, _: 31, 24;
+    pub attr6, _: 23, 16;
+    pub attr5, _: 15, 8;
+    pub attr4, _: 7, 0;
+);
+
+register!(MPU_RBAR, 0xe000ed9c,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_RBAR(u32);
+    impl Debug;
+    pub base, _: 31, 5;
+    pub sh, _: 4, 3;
+    pub ap, _: 2, 1;
+    pub xn, _: 0;
+);
+
+register!(MPU_RLAR, 0xe000eda0,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct MPU_RLAR(u32);
+    impl Debug;
+    pub limit, _: 31, 5;
+    pub pxn, _: 4;
+    pub attr_index, _: 3, 1;
+    pub en, _: 0;
+);
+
+register!(SAU_TYPE, 0xe000edd4,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct SAU_TYPE(u32);
+    impl Debug;
+    pub sregion, _: 7, 0;
+);
+
+register!(SAU_RNR, 0xe000edd8,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct SAU_RNR(u32);
+    impl Debug;
+    pub region, set_region: 7, 0;
+);
+
+register!(SAU_CTRL, 0xe000edd0,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct SAU_CTRL(u32);
+    impl Debug;
+    pub allns, _: 1;
+    pub enable, _: 0;
+);
+
+register!(SAU_RBAR, 0xe000eddc,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct SAU_RBAR(u32);
+    impl Debug;
+    pub baddr, _: 31, 5;
+);
+
+register!(SAU_RLAR, 0xe000ede0,
+    #[derive(Copy, Clone)]
+    #[allow(non_camel_case_types)]
+    pub struct SAU_RLAR(u32);
+    impl Debug;
+    pub laddr, _: 31, 5;
+    pub nsc, _: 1;
+    pub enable, _: 0;
+);
+
 register!(STM32F4_DBGMCU_IDCODE, 0xe004_2000,
     #[derive(Copy, Clone)]
     #[allow(non_camel_case_types)]