ARM Cortex-M4 AIRCR Register: BFHFNMINS and PRIS Bit Interaction
The Application Interrupt and Reset Control Register (AIRCR) in the ARM Cortex-M4 processor is a critical register for managing system resets, interrupt priority grouping, and certain system control functionalities. Among its bits, BFHFNMINS (BusFault, HardFault, and NMI Non-Maskable Interrupt Secure) and PRIS (Prioritize Secure Exceptions) play significant roles in defining the behavior of exception handling and system security. However, the ARMv8-M Architecture Reference Manual explicitly states that setting both BFHFNMINS and PRIS to 1 results in an UNPREDICTABLE behavior. This unpredictability arises from the conflicting roles these bits play in the exception handling mechanism, particularly in systems implementing the ARMv8-M security extensions (TrustZone).
BFHFNMINS, when set to 1, configures the BusFault, HardFault, and NMI exceptions to be treated as non-maskable interrupts (NMIs) in the Secure state. This means these exceptions cannot be masked by the PRIMASK or FAULTMASK registers, ensuring they are always serviced, even in critical sections of code. On the other hand, PRIS, when set to 1, prioritizes Secure exceptions over Non-secure exceptions. This prioritization ensures that Secure world exceptions are handled before Non-secure exceptions, which is crucial for maintaining the integrity of the Secure world in a TrustZone-enabled system.
The conflict arises because both bits attempt to influence the exception handling mechanism in ways that are mutually exclusive. Setting BFHFNMINS to 1 ensures that certain exceptions are treated as NMIs in the Secure state, while setting PRIS to 1 prioritizes all Secure exceptions over Non-secure exceptions. When both bits are set to 1, the processor is left in a state where it cannot deterministically decide how to handle exceptions that fall under both categories. This leads to UNPREDICTABLE behavior, as the processor’s exception handling logic cannot resolve the conflicting requirements imposed by these bits.
Memory Barrier Omission and Cache Invalidation Timing
The unpredictability caused by setting both BFHFNMINS and PRIS to 1 can be further exacerbated by the timing of memory barriers and cache invalidation. In a system where both bits are set, the processor may encounter situations where it needs to handle exceptions while also ensuring that memory operations are correctly synchronized between the Secure and Non-secure worlds. Memory barriers, such as Data Synchronization Barriers (DSB) and Data Memory Barriers (DMB), are used to ensure that memory operations are completed in the correct order. However, if these barriers are omitted or incorrectly timed, the processor may end up in a state where it cannot correctly handle exceptions, leading to further unpredictability.
Cache invalidation timing is another critical factor. In a TrustZone-enabled system, the cache must be managed carefully to ensure that Secure and Non-secure data do not interfere with each other. If the cache is not invalidated at the correct time, the processor may end up using stale data, which can lead to incorrect exception handling. This is particularly problematic when both BFHFNMINS and PRIS are set, as the processor may be forced to handle exceptions in a way that is inconsistent with the current state of the cache.
The combination of these factors—memory barrier omission and cache invalidation timing—can lead to a situation where the processor’s exception handling logic is unable to function correctly. This is why the ARMv8-M Architecture Reference Manual explicitly states that setting both BFHFNMINS and PRIS to 1 results in UNPREDICTABLE behavior. The processor’s exception handling logic is not designed to handle the conflicting requirements imposed by these bits, and the resulting behavior cannot be guaranteed.
Implementing Data Synchronization Barriers and Cache Management
To avoid the UNPREDICTABLE behavior caused by setting both BFHFNMINS and PRIS to 1, it is essential to implement proper data synchronization barriers and cache management techniques. These techniques ensure that the processor’s exception handling logic can function correctly, even in complex systems with multiple security domains.
Data Synchronization Barriers (DSB) and Data Memory Barriers (DMB) are critical for ensuring that memory operations are completed in the correct order. In a system where both BFHFNMINS and PRIS are set, it is essential to use these barriers to ensure that the processor’s exception handling logic can function correctly. For example, if a Secure exception is being handled, it is essential to ensure that all memory operations related to that exception are completed before the exception handler is invoked. This can be achieved by inserting a DSB instruction before the exception handler is invoked.
Cache management is another critical aspect of ensuring correct exception handling. In a TrustZone-enabled system, the cache must be managed carefully to ensure that Secure and Non-secure data do not interfere with each other. This can be achieved by invalidating the cache at the correct time, ensuring that the processor is always using the most up-to-date data. For example, if a Secure exception is being handled, it is essential to ensure that the cache is invalidated before the exception handler is invoked. This can be achieved by using the Invalidate Data Cache (IDC) instruction.
In addition to these techniques, it is also essential to carefully manage the priority of exceptions. In a system where both BFHFNMINS and PRIS are set, it is essential to ensure that Secure exceptions are always prioritized over Non-secure exceptions. This can be achieved by carefully configuring the priority of exceptions in the Nested Vectored Interrupt Controller (NVIC). For example, if a Secure exception is being handled, it is essential to ensure that its priority is higher than that of any Non-secure exception. This can be achieved by setting the priority of the Secure exception to a higher value in the NVIC.
By implementing these techniques, it is possible to avoid the UNPREDICTABLE behavior caused by setting both BFHFNMINS and PRIS to 1. These techniques ensure that the processor’s exception handling logic can function correctly, even in complex systems with multiple security domains. However, it is important to note that these techniques are not a substitute for careful system design. In a system where both BFHFNMINS and PRIS are set, it is essential to carefully consider the implications of these settings and ensure that the system is designed to handle the resulting behavior.
In conclusion, the UNPREDICTABLE behavior caused by setting both BFHFNMINS and PRIS to 1 in the ARM Cortex-M4 AIRCR register is a result of the conflicting roles these bits play in the exception handling mechanism. To avoid this behavior, it is essential to implement proper data synchronization barriers and cache management techniques, as well as carefully manage the priority of exceptions. By doing so, it is possible to ensure that the processor’s exception handling logic can function correctly, even in complex systems with multiple security domains.
