Hi, After some extra testing I realized there was an issue with the way we were clearing registers when returning from a cmse_nonsecure_entry function for ARMv8-M.Baseline. This patch fixes that and changes the testcase to catch the issue. The problem was I was always using LR to clear the registers, however, due to the way the Thumb-1 backend works, we can't guarantee LR will contain the address to which we will be returning at the time of clearing. Instead we use r0 to clear r1-r3 and IP. If the function does not use r0 to return a value, we clear r0 with 0 before using it to clear everything else. As for LR, we move the value of the register used to return into it prior to returning. This satisfies the requirements of not leaking secure information since all registers hold either: - values to return - 0 - return address No changes to ChangeLog. Cheers, Andre