How do I handle Non-secure Group 1 interrupts when a core runs at Secure EL1?

Posted 2021-03-04 pengdonglin137

原文：

https://developer.arm.com/docs/321493627/10/how-do-i-handle-non-secure-group-1-interrupts-when-a-core-runs-at-secure-el1

 

How do I handle Non-secure Group 1 interrupts when a core runs at Secure EL1?

Information in this article applies to:

• ARMv8-A
• GIC-600 Generic Interrupt Controller
• GIC-500 Generic Interrupt Controller
• GIC-400 Generic Interrupt Controller

Problem/Question

How do I handle Non-secure Group 1 interrupts when a core runs at Secure EL1?

Scenario

N/A

Answer

Background

In a GICv3 system with two Security states, an interrupt can be configured as one of the following groups:

• Group 0

• Secure Group 1

• Non-secure Group 1

 

The following table shows you that each group of interrupts uses a different interrupt signal when the core runs at a different Exception level:

Current Exception level	Group 0	Secure Group 1	Non-secure Group 1
Secure EL1 Secure EL0	FIQ	IRQ	FIQ
Non-secure EL2 Non-secure EL1 Non-secure EL0	FIQ	FIQ	IRQ
EL3	FIQ	FIQ	FIQ

 

In a GICv2 system that implements the Generic Interrupt Controller (GIC) Security Extensions:

• Group 0 interrupts are Secure interrupts, and they are signaled as FIQs.

• Group 1 interrupts are Non-secure interrupts, and they are signaled as IRQs.

 

In conclusion, Non-secure Group 1 interrupts are handled as follows:

• In the GICv3 system:

  • Non-secure Group 1 interrupts are signaled as FIQs when the core is in Secure EL1.

  • Non-secure Group1 interrupts are signaled as IRQs when the core is in Non-secure state.

• In the GICv2 system:

  • Non-secure Group1 interrupts are signaled as IRQs when the core is in Secure EL1.

  • Non-secure Group1 interrupts are signaled as IRQs when the core is in Non-secure state.

 

The GICv3 and GICv2 use different signals to assert the Non-secure Group 1 interrupt when the core is in Secure EL1.

Handling Non-Secure Group 1 interrupts

When a core runs at Secure EL1, the core handles one of the following calls from the Non-secure world:

• Fast call

• Yielding call

Fast call

For Fast call, the PSTATE.IRQ and FIQ bits should be set. Therefore, no interrupt can be handled during a Fast call.

Yielding call

The target Exception level of an interrupt is configured through the FIQ and IRQ bits in SCR_EL3.

• When SCR_EL3.FIQ is set to 1, FIQs are routed to EL3.

• When SCR_EL3.IRQ is set to 1, IRQs are routed to EL3.

 

EL3 configures SCR_EL3 FIQ or IRQ bits to a target Exception level value before the core exits from EL3.

 

When the core switches to Secure EL1 from EL3, EL3 can configure SCR_EL3 with the following values:

• SCR_EL3.FIQ = 0 (SCR_EL3.IRQ = 0 in GICv2).

• SCR_EL3.FIQ = 1 (SCR_EL3.IRQ = 1 in GICv2).

 

An example of using the GICv3 is given below for two scenarios:

• Scenario 1: SCR_EL3.FIQ = 0

• Scenario 2: SCR_EL3.FIQ = 1

Scenario 1: SCR_EL3.FIQ = 0

The process to handle the Non-secure Group 1 interrupt is as follows:

1. The GIC signals a Non-secure Group 1 interrupt as an FIQ (IRQ in GICv2).

2. The Secure EL1 exception vector handles the FIQ first.
   
   The Secure EL1 reads the interrupt ID as a special Interrupt Identifier (INTID), which indicates that the pending interrupt does not belong to the current Security state.

3. Secure EL1 sends an SMC to EL3, as shown in the following figure.
   
   The Secure EL1 might perform context saving before sending the SMC to EL3, depending on the usage.

   

    

4. EL3 receives the SMC call from Secure EL1, prepares the Non-secure context, and configures the SCR_EL3.IRQ to 0 before switching to Non-secure world, as shown in the following figure:

   

    

5. When the core switches to Non-secure world, the interrupt re-asserts as an IRQ, and the Non-secure world exception vector handles the interrupt.

6. After the interrupt handling is complete, the Non-secure world invokes an SMC to EL3 to instruct the Secure EL1 to continue execution.

Scenario 2: SCR_EL3.FIQ = 1

The process to handle the Non-secure Group 1 interrupt is as follows:

1. The GIC signals a Non-secure Group 1 interrupt as an FIQ (IRQ in GICv2) and the FIQ is routed to EL3, as shown in the following figure.

2. The EL3 exception vector handles the FIQ first.
   
   The EL3 read the interrupt ID as a special INTID, which indicates that the pending interrupt belongs to Non-secure Group 1.

3. The EL3 prepares the Non-secure context and configures the SCR_EL3.IRQ with 0 before switching to the Non-secure world.
   
   In this case, Secure EL1 has no chance to save any context.

   

    

4. When the core switches to Non-secure world, the interrupt re-asserts as IRQ, and the Non-secure world exception vector handles the interrupt.

5. After the interrupt handling is complete, the Non-secure world invokes an SMC to EL3 to instruct Secure EL1 to continue, as shown in the following figure:

 

End