Arch: Implement fault handlers to not return
Ensures secure HardFault, secure MemManage, BusFault and SecureFault
handlers are all explicitly implemented in arch code to not return.
These faults may indicate that Secure state has been corrupted, so
Non-secure should be prevented from executing after one is raised.
Never returning from the handlers is the simplest way to achieve this,
so this is the current solution.
These handlers override the default platform handlers with the weak
attribute, which are implemented as infinite loops anyway, so the
behaviour is unchanged but the intent is made explicit.
Change-Id: I7b91a652f222d307e1608c4d59594f3710a6687a
Signed-off-by: Jamie Fox <jamie.fox@arm.com>
diff --git a/secure_fw/spm/cmsis_func/arch.c b/secure_fw/spm/cmsis_func/arch.c
index 9ec1dd4..a44e5fc 100644
--- a/secure_fw/spm/cmsis_func/arch.c
+++ b/secure_fw/spm/cmsis_func/arch.c
@@ -342,3 +342,43 @@
);
}
#endif
+
+__attribute__((naked)) void HardFault_Handler(void)
+{
+ /* A HardFault may indicate corruption of secure state, so it is essential
+ * that Non-secure code does not regain control after one is raised.
+ * Returning from this exception could allow a pending NS exception to be
+ * taken, so the current solution is not to return.
+ */
+ __ASM volatile("b .");
+}
+
+__attribute__((naked)) void MemManage_Handler(void)
+{
+ /* A MemManage fault may indicate corruption of secure state, so it is
+ * essential that Non-secure code does not regain control after one is
+ * raised. Returning from this exception could allow a pending NS exception
+ * to be taken, so the current solution is not to return.
+ */
+ __ASM volatile("b .");
+}
+
+__attribute__((naked)) void BusFault_Handler(void)
+{
+ /* A BusFault may indicate corruption of secure state, so it is essential
+ * that Non-secure code does not regain control after one is raised.
+ * Returning from this exception could allow a pending NS exception to be
+ * taken, so the current solution is not to return.
+ */
+ __ASM volatile("b .");
+}
+
+__attribute__((naked)) void SecureFault_Handler(void)
+{
+ /* A SecureFault may indicate corruption of secure state, so it is essential
+ * that Non-secure code does not regain control after one is raised.
+ * Returning from this exception could allow a pending NS exception to be
+ * taken, so the current solution is not to return.
+ */
+ __ASM volatile("b .");
+}