ARM Cortex-M33: Secure SVC Handler Return to Non-Secure Thread Mode Issue

Secure SVC Handler Failing to Return to Non-Secure Thread Mode

The ARM Cortex-M33 processor, with its TrustZone security extension, allows for the separation of Secure and Non-Secure states, enabling secure execution environments. A critical aspect of this architecture is the ability to transition between Secure and Non-Secure states, particularly when returning from a Secure SVC (Supervisor Call) handler to a Non-Secure Thread Mode. However, this transition can sometimes fail, leading to an INVPC (Invalid PC Load) Usage Fault. This issue is often encountered when the Secure SVC handler attempts to return to Non-Secure Thread Mode using an incorrect EXC_RETURN value or an inappropriate branch instruction.

The EXC_RETURN value is a critical component in the ARM Cortex-M33 architecture, as it dictates the state to which the processor will return after an exception. In the context of Secure and Non-Secure states, the EXC_RETURN value must be carefully constructed to ensure a smooth transition. Specifically, when returning from a Secure SVC handler to Non-Secure Thread Mode, the EXC_RETURN value should be 0xFFFFFFBC, indicating a return to Non-Secure state using the Process Stack Pointer (PSP) in Thread Mode.

The issue arises when the Secure SVC handler attempts to return to Non-Secure Thread Mode but encounters an INVPC Usage Fault. This fault indicates that the processor attempted to load an invalid Program Counter (PC) value, which can occur if the EXC_RETURN value is incorrect or if the branch instruction used to return is inappropriate. The fault can also be triggered if the Secure SVC handler is not properly configured to handle the transition between Secure and Non-Secure states.

Incorrect EXC_RETURN Value and Branch Instruction Misuse

The primary cause of the INVPC Usage Fault when returning from a Secure SVC handler to Non-Secure Thread Mode is the incorrect use of the EXC_RETURN value or the branch instruction. The EXC_RETURN value must be precisely constructed to ensure a successful transition. In the case of returning to Non-Secure Thread Mode, the EXC_RETURN value should be 0xFFFFFFBC, which indicates a return to Non-Secure state using the PSP in Thread Mode. If this value is not correctly set, the processor may attempt to load an invalid PC value, resulting in an INVPC Usage Fault.

Another potential cause is the misuse of the branch instruction at the end of the Secure SVC handler. The ARM Cortex-M33 architecture provides specific branch instructions for transitioning between Secure and Non-Secure states, such as BXNS (Branch and Exchange Non-Secure). The BXNS instruction is designed to handle the transition from Secure to Non-Secure state by ensuring that the processor correctly updates the PC and the execution state. If a standard BX instruction is used instead of BXNS, the processor may not properly handle the transition, leading to an INVPC Usage Fault.

Additionally, the Secure SVC handler must ensure that the stack pointer (SP) is correctly configured before attempting to return to Non-Secure Thread Mode. The SP must point to the correct stack (either the Main Stack Pointer (MSP) or the Process Stack Pointer (PSP)) depending on the execution context. If the SP is not correctly configured, the processor may attempt to load an invalid PC value from the stack, resulting in an INVPC Usage Fault.

Proper Configuration of EXC_RETURN and Use of BXNS Instruction

To resolve the INVPC Usage Fault when returning from a Secure SVC handler to Non-Secure Thread Mode, it is essential to ensure that the EXC_RETURN value is correctly constructed and that the appropriate branch instruction is used. The following steps outline the necessary configuration and troubleshooting process:

1. Constructing the Correct EXC_RETURN Value: The EXC_RETURN value must be set to 0xFFFFFFBC to indicate a return to Non-Secure state using the PSP in Thread Mode. This value should be loaded into a register (e.g., R0) before branching back to Non-Secure state. The Secure SVC handler should ensure that this value is correctly constructed and passed to the branch instruction.

2. Using the BXNS Instruction: The Secure SVC handler must use the BXNS instruction to return to Non-Secure state. The BXNS instruction ensures that the processor correctly updates the PC and the execution state during the transition. The Secure SVC handler should load the EXC_RETURN value into a register (e.g., R0) and then use the BXNS instruction to branch to the address specified in the register.

3. Configuring the Stack Pointer: Before returning to Non-Secure Thread Mode, the Secure SVC handler must ensure that the SP is correctly configured. If the return is to Thread Mode using the PSP, the SP should point to the PSP. If the return is to Handler Mode using the MSP, the SP should point to the MSP. The Secure SVC handler should verify that the SP is correctly configured before attempting to return.

4. Handling Secure and Non-Secure State Transitions: The Secure SVC handler must be aware of the current execution state (Secure or Non-Secure) and handle the transition appropriately. The handler should ensure that any necessary context switching is performed before returning to Non-Secure state. This includes saving and restoring any registers that may be modified during the Secure SVC handler execution.

5. Debugging and Verification: If the INVPC Usage Fault persists, it is essential to debug the Secure SVC handler to verify that the EXC_RETURN value is correctly constructed and that the BXNS instruction is used. The debugger can be used to inspect the values of the registers and the stack before and after the branch instruction. Additionally, the processor’s exception handling mechanism should be examined to ensure that the transition between Secure and Non-Secure states is correctly handled.

By following these steps, the Secure SVC handler can be properly configured to return to Non-Secure Thread Mode without encountering an INVPC Usage Fault. The correct construction of the EXC_RETURN value, the use of the BXNS instruction, and the proper configuration of the stack pointer are critical to ensuring a successful transition between Secure and Non-Secure states in the ARM Cortex-M33 architecture.