ARM TrustZone-M Secure to Non-Secure State Transition Violation
The core issue revolves around a Secure Fault triggered by an Invalid Transaction (INVTRAN) when attempting to call a Non-Secure (NS) function from a Non-Secure Callable (NSCallable) section in an ARM TrustZone-M implementation. TrustZone-M, a security extension for ARMv8-M architectures, enforces strict isolation between Secure and Non-Secure worlds to ensure robust system security. The NSCallable section is a designated memory region in the Secure world that allows Non-Secure code to invoke specific Secure functions. However, transitioning from Secure to Non-Secure state requires adherence to specific architectural rules, which, if violated, result in a Secure Fault.
In this scenario, the fault occurs when attempting to call a Non-Secure callback function from within the NSCallable section. The Secure Fault Status Register (SFSR) indicates an INVTRAN error, which signifies an invalid state transition. This error is a direct consequence of violating the ARMv8-M architectural requirements for transitioning between Secure and Non-Secure states. Specifically, the fault arises because the transition is attempted without using the appropriate inter-state branch instructions, namely BXNS or BLXNS.
The ARMv8-M architecture mandates that any branch from Secure to Non-Secure code must use these specialized instructions to ensure proper state transition and maintain security integrity. Failure to comply with this requirement results in an INVTRAN fault, as the processor detects an unauthorized attempt to switch states. This mechanism is critical for preventing security breaches, such as unauthorized access to Secure resources or unintended execution of Non-Secure code in a Secure context.
Improper Use of Branch Instructions and State Transition Rules
The primary cause of the INVTRAN fault is the improper use of branch instructions when attempting to transition from Secure to Non-Secure state. In ARMv8-M architectures, the BXNS and BLXNS instructions are specifically designed for inter-state branching. These instructions perform several critical functions during the state transition, including updating the processor’s state, validating the target address, and ensuring that the transition adheres to the security rules defined by the TrustZone-M implementation.
When a standard branch instruction (e.g., BX or BLX) is used instead of BXNS or BLXNS, the processor cannot properly handle the state transition. This results in an INVTRAN fault because the architecture explicitly prohibits such transitions to maintain security boundaries. The fault is triggered as a safeguard to prevent potential security vulnerabilities that could arise from unauthorized state transitions.
Another contributing factor is the potential misconfiguration of the NSCallable section. The NSCallable section must be explicitly defined in the Secure Attribution Unit (SAU) or Implementation Defined Attribution Unit (IDAU) to allow Non-Secure calls to specific Secure functions. If the section is not properly configured, or if the target Non-Secure function is not correctly referenced, the processor may interpret the branch attempt as an invalid transaction.
Additionally, the fault could be exacerbated by incorrect stack handling or register usage during the transition. ARMv8-M architectures require specific stack and register management practices when switching between Secure and Non-Secure states. For example, the processor must ensure that the stack pointer and link register are appropriately updated to reflect the new state. Failure to adhere to these practices can lead to unexpected behavior, including INVTRAN faults.
Implementing Correct Inter-State Branching and Configuration Practices
To resolve the INVTRAN fault, the first step is to ensure that all branches from Secure to Non-Secure code use the BXNS or BLXNS instructions. These instructions are specifically designed for inter-state transitions and include the necessary logic to validate the target address and update the processor state. Replacing any standard branch instructions with BXNS or BLXNS will prevent the INVTRAN fault by ensuring compliance with the ARMv8-M architectural requirements.
The following example demonstrates the correct usage of the BLXNS instruction to call a Non-Secure function from a Secure context:
LDR R0, =NonSecureCallback ; Load the address of the Non-Secure callback function
BLXNS R0 ; Branch with link to Non-Secure state
In this example, the BLXNS instruction performs the inter-state branch, ensuring that the transition is handled correctly and securely.
Next, verify the configuration of the NSCallable section in the SAU or IDAU. The NSCallable section must be explicitly defined to allow Non-Secure calls to specific Secure functions. This involves setting the appropriate memory attributes and permissions in the SAU or IDAU configuration registers. The following table outlines the key configuration parameters for the NSCallable section:
| Parameter | Description |
|---|---|
| Memory Region Base | The starting address of the NSCallable section |
| Memory Region Size | The size of the NSCallable section |
| Secure Attribute | Set to "Non-Secure Callable" to allow Non-Secure calls |
| Execution Permission | Ensure execution is permitted for the Non-Secure world |
Properly configuring these parameters ensures that the NSCallable section is correctly recognized by the processor, allowing valid inter-state transitions.
Additionally, ensure that the stack and registers are correctly managed during the state transition. The processor must update the stack pointer and link register to reflect the new state. This involves saving the Secure context before branching to Non-Secure code and restoring it upon returning to the Secure world. The following steps outline the recommended stack and register management practices:
- Save the Secure context by pushing the necessary registers onto the Secure stack.
- Update the stack pointer to the Non-Secure stack before branching to Non-Secure code.
- Use the BLXNS instruction to branch to the Non-Secure function.
- Upon returning to the Secure world, restore the Secure context by popping the saved registers from the Secure stack.
By following these practices, the processor can maintain the integrity of the Secure and Non-Secure states, preventing INVTRAN faults and ensuring reliable operation.
Finally, consider using the ARM TrustZone-M Security Extension (TZ) APIs provided by the ARM CMSIS (Cortex Microcontroller Software Interface Standard) library. These APIs abstract the low-level details of inter-state transitions, simplifying the implementation and reducing the risk of errors. For example, the TZ_InitContextSystem_S and TZ_LoadContext_S functions can be used to initialize and manage the Secure context during state transitions.
In summary, resolving the INVTRAN fault requires a combination of correct inter-state branching instructions, proper NSCallable section configuration, and careful stack and register management. By adhering to these practices, developers can ensure secure and reliable transitions between Secure and Non-Secure states in ARM TrustZone-M implementations.
