secure_faults_s#
SECURE VULNERABILITY NOTE: There is a vulnerability that can affect TrustZone applications that also use floating point unit (CVE-2021-35465). The TrustZone examples delivered here do not use floating point, and so they aren’t affected. However, if TrustZone and FPU are used together, the used compiler should be checked for inbuilt workaround. If workaround is not available yet, then the actions described in CVE-2021-35465 should be applied manually.
Actual compilers status for this vulnerability: MCUX IDE v11.5.0 – fix not available yet GNU Arm Embedded Toolchain 10.3-2021.07 - fix not available yet EWARM v9.20.1 – already fixed ARM MDK v5.35 – check for new Arm compiler v6.17
Overview#
The Secure Faults demo application demonstrates handling of different secure faults. This application is based on application Hello World. In addition, user can invoke different secure faults by setting testCaseNumber variable (see source code). The following faults can be invoked:
TEST 0: No any secure fault TEST 1: Invalid transition from secure to normal world TEST 2: Invalid entry point from normal to secure world TEST 3: Invalid data access from normal world, example 1 TEST 4: Invalid input parameters in entry function TEST 5: Invalid data access from normal world, example 2
Supported Boards#
EVK-MIMXRT595
Hardware requirements
Micro USB cable
EVK-MIMXRT595 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for EVK-MIMXRT595” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the secure_faults demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
Change testCaseNumber value in secure_faults_s(in secure_faults_s.c “main” function) project to trigger different secure error. The available testCaseNumber values are defined in veneer_table.h as macro, #define FAULT_NONE 0 #define FAULT_INV_S_TO_NS_TRANS 1 #define FAULT_INV_S_ENTRY 2 #define FAULT_INV_NS_DATA_ACCESS 3 #define FAULT_INV_INPUT_PARAMS 4 #define FAULT_INV_NS_DATA2_ACCESS 5 In case some secure error is raised, the information about error will be printed in the terminal window.
With testCaseNumber = FAULT_INV_S_TO_NS_TRANS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Entering HardFault interrupt!
SAU->SFSR:INVTRAN fault: Invalid transition from secure to normal world.
With testCaseNumber = FAULT_INV_S_ENTRY, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:INVEP fault: Invalid entry point to secure world.
With testCaseNumber = FAULT_INV_NS_DATA_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:AUVIOL fault: SAU violation. Access to secure memory from normal world.
Address that caused SAU violation is 0x30000000.
With testCaseNumber = FAULT_INV_INPUT_PARAMS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Input data error: String is not located in normal world!
With testCaseNumber = FAULT_INV_NS_DATA2_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SCB->BFSR:PRECISERR fault: Precise data access error.
Address that caused secure bus violation is 0x330000.
Additional AHB secure controller error information:
Secure error at AHB layer 9.
Address that caused secure violation is 0x20330000.
Secure error caused by bus master number 0.
Security level of master 1.
Secure error happened during read data access.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
EVK-MIMXRT685
Hardware requirements
Micro USB cable
EVK-MIMXRT685 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J5) on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for EVK-MIMXRT685” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the secure_faults demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
Change testCaseNumber value in secure_faults_s project to triger different secure error. The available testCaseNumber values are defined in veneer_table.h as macro, #define FAULT_NONE 0 #define FAULT_INV_S_TO_NS_TRANS 1 #define FAULT_INV_S_ENTRY 2 #define FAULT_INV_NS_DATA_ACCESS 3 #define FAULT_INV_INPUT_PARAMS 4 #define FAULT_INV_NS_DATA2_ACCESS 5 In case some secure error is raised, the information about error will be printed in the terminal window.
With testCaseNumber = FAULT_INV_S_TO_NS_TRANS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Entering HardFault interrupt!
SAU->SFSR:INVTRAN fault: Invalid transition from secure to normal world.
With testCaseNumber = FAULT_INV_S_ENTRY, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:INVEP fault: Invalid entry point to secure world.
With testCaseNumber = FAULT_INV_NS_DATA_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:AUVIOL fault: SAU violation. Access to secure memory from normal world.
Address that caused SAU violation is 0x30000000.
With testCaseNumber = FAULT_INV_INPUT_PARAMS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Input data error: String is not located in normal world!
With testCaseNumber = FAULT_INV_NS_DATA2_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SCB->BFSR:PRECISERR fault: Precise data access error.
Address that caused secure bus violation is 0x130000.
Additional AHB secure controller error information:
Secure error at AHB layer 7.
Address that caused secure violation is 0x20130000.
Secure error caused by bus master number 0.
Security level of master 1.
Secure error happened during read data access.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN236
Hardware requirements
Type-C USB cable
FRDM-MCXN236 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J10) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN947
Hardware requirements
Type-C USB cable
FRDM-MCXN947 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J17) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
FRDM-MCXN947T
Hardware requirements
Type-C USB cable
FRDM-MCXN947T board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a type-c USB cable between the PC host and the MCU-Link USB port (J17) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S06
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S16
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
The jumper setting: Default jumpers configuration does not work, you will need to add JP20 and JP21 (JP22 optional for ADC use)
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S36
Hardware requirements
Mini/micro USB cable
LPCXpresso55s36 board
Personal Computer
Board settings
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J1) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
LPCXpresso55S69
Hardware requirements
Mini/micro USB cable
LPCXpresso55s69 board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (P6) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCX-N5XX-EVK
Hardware requirements
Mini/micro USB cable
MCX-N5XX-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MCX-N9XX-EVK
Hardware requirements
Mini/micro USB cable
MCX-N9XX-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Note: MCUXpresso IDE project default debug console is semihost
Connect a micro USB cable between the PC host and the MCU-Link USB port (J5) on the board
Open a serial terminal with the following settings (See Appendix A in Getting started guide for description how to determine serial port number):
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board For IAR environment go to project options/Debugger/Images. Open file dialog for first extra image. Select file hello_world_ns.out and click on open button. Now you have absolute path in the path box. The flash loader requires absolute path to this file.
Either press the reset button on your board or launch the debugger in your IDE to begin running the demo.
Running the demo
The log below shows the output of the hello world demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
In case some secure error is raised, the information about error will be printed in the terminal window.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
As first compile secure project since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.
MIMXRT685-AUD-EVK
Hardware requirements
Micro USB cable
MIMXRT685-AUD-EVK board
Personal Computer
Board settings
No special settings are required.
Prepare the Demo
Connect a micro USB cable between the PC host and the CMSIS DAP USB port (J5) on the board
Open a serial terminal with the following settings:
115200 baud rate
8 data bits
No parity
One stop bit
No flow control
Use secure project to download the program to target board. Please refer to “TrustZone application debugging” below for details.
Launch the debugger in your IDE to begin running the demo. Note: Refering to the “Getting started with MCUXpresso SDK for MIMXRT685-AUD-EVK” documentation for more information on how to build and run the TrustZone examples in various IDEs.
Running the demo
The log below shows the output of the secure_faults demo in the terminal window:
Hello from secure world!
Entering normal world.
Welcome in normal world!
This is a text printed from normal world!
Comparing two string as a callback to normal world
String 1: Test1
String 2: Test2
Both strings are not equal!
Change testCaseNumber value in secure_faults_s project to triger different secure error. The available testCaseNumber values are defined in veneer_table.h as macro, #define FAULT_NONE 0 #define FAULT_INV_S_TO_NS_TRANS 1 #define FAULT_INV_S_ENTRY 2 #define FAULT_INV_NS_DATA_ACCESS 3 #define FAULT_INV_INPUT_PARAMS 4 #define FAULT_INV_NS_DATA2_ACCESS 5 In case some secure error is raised, the information about error will be printed in the terminal window.
With testCaseNumber = FAULT_INV_S_TO_NS_TRANS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Entering HardFault interrupt!
SAU->SFSR:INVTRAN fault: Invalid transition from secure to normal world.
With testCaseNumber = FAULT_INV_S_ENTRY, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:INVEP fault: Invalid entry point to secure world.
With testCaseNumber = FAULT_INV_NS_DATA_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SAU->SFSR:AUVIOL fault: SAU violation. Access to secure memory from normal world.
Address that caused SAU violation is 0x30000000.
With testCaseNumber = FAULT_INV_INPUT_PARAMS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Input data error: String is not located in normal world!
With testCaseNumber = FAULT_INV_NS_DATA2_ACCESS, the below log will be shown in the terminal:
Hello from secure world!
Entering normal world.
Welcome in normal world!
Entering HardFault interrupt!
SCB->BFSR:PRECISERR fault: Precise data access error.
Address that caused secure bus violation is 0x130000.
Additional AHB secure controller error information:
Secure error at AHB layer 7.
Address that caused secure violation is 0x20130000.
Secure error caused by bus master number 0.
Security level of master 1.
Secure error happened during read data access.
TrustZone Application Development in SDK
Every TrustZone based application consists of two independent parts - secure part/project and non-secure part/project.
The secure project is stored in <application_name><application_name>_s directory. The non-secure project is stored in <application_name><application_name>_ns directory.
The secure projects always contains TrustZone configuration and it is executed after device RESET. The secure project usually ends by jump to non-secure application/project. If IDE allows the two projects in single workspace, the user can also find the project with <application_name>. This project contains both secure and non-secure projects in one workspace (Keil MDK, IAR) and it allows to user easy transition from one to another project.
Project Structure
The all TrustZone files related to TrustZone are located in trustzone virtual directory. The files are:
tzm_config.c
tzm_config.h
veneer_table.c
veneer_table.h
File tzm_config.c, tzm_config.h
This file is used by secure project only. It contains one function BOARD_InitTrustZone(), which configures complete TrustZone environment. It includes SAU, MPU’s, AHB secure controller and some TrustZone related registers from System Control Block. This function is called from SystemInitHook() function, it means during system initialization.
File veneer_table.c, veneer_table.h
This file defines all secure functions (secure entry functions) exported to normal world. This file is located in secure project only. While header file is used by both secure and non-secure projects. The secure entry functions usually contain validation of all input parameters in order to avoid any data leak from secure world.
The files veneer_table.h and <application_name>_s_import_lib.o or <application_name>_s_CMSE_lib.o create the connection between secure and non-secure projects. The library file is generated by linker during compilation of secure project and it is linked to the non-secure project as any other library.
TrustZone application compilation
Please compile secure project firstly since CMSE library is needed for compilation of non-secure project. After successful compilation of secure project, compile non-secure project.
TrustZone application debugging
Download both output file into device memory
Start execution of secure project since secure project is going to be executed after device RESET.
If IDE (Keil MDK, IAR) allows to manage download both output files as single download, the secure project is configured to download both secure and non-secure output files so debugging can be fully managed from secure project.
For IAR, please don’t choose Use flash loader option when download ram target output files.
If want to download secure and non-secure binary file into QSPI flash, should the following rules: Flash target: 1. secure binary download into 0x8000400 address. 2. non-secure binary download into 0x8100000 address. RAM target: 1. secure binary download into 0x8000400 address for IAR, download into 0x80000000 for other toolchains. 2. non-secure binary download into 0x8041000 address.
Device header file and secure/non-secure access to the peripherals
Both secure and non-secure project uses identical device header file. The access to secure and non-secure aliases for all peripherals is managed using compiler macro __ARM_FEATURE_CMSE.
For secure project using <PERIPH_BASE> means access through secure alias (address bit A28=1), using <PERIPH_BASE>_NS means access through non-secure alias(address bit A28=0) For non-secure project using <PERIPH_BASE> means access through non-secure alias (address bit A28=0). The non-secure project doesn’t have access to secure memory or peripherals regions so the secure access is not defined.