Interrupt Handling During Secure to Non-Secure World Transition in GICv3/v4
The behavior of interrupt signals during a world switch between Secure and Non-Secure states in ARM architectures using GICv3 or GICv4 is a nuanced topic that requires a deep understanding of the ARM exception model, the Generic Interrupt Controller (GIC) architecture, and the interaction between hardware and software. When a CPU transitions from the Secure world (Trusted Execution Environment, TEE) to the Non-Secure world (Rich Execution Environment, REE), the handling of interrupts, particularly Non-Secure Group 1 interrupts, can lead to confusion. This is especially true when considering the role of the SCR_EL3.FIQ bit, the signaling of interrupts as FIQ or IRQ, and the behavior of the GIC CPU interface during the transition.
In this scenario, the CPU is initially running in the Secure world (S-EL1) when a Non-Secure Group 1 interrupt is generated. Depending on the value of SCR_EL3.FIQ, the interrupt is signaled as either an FIQ or an IRQ. When the CPU transitions to the Non-Secure world, the interrupt signal’s behavior must be carefully analyzed to determine whether the GIC generates an additional interrupt signal or simply reinterprets the existing signal based on the new security state. This issue is critical for ensuring correct interrupt handling and system stability during world switches.
Role of SCR_EL3.FIQ and GIC CPU Interface in Interrupt Signaling
The behavior of interrupt signaling during a world switch is heavily influenced by the configuration of the SCR_EL3.FIQ bit and the GIC CPU interface. The SCR_EL3.FIQ bit determines whether Non-Secure Group 1 interrupts are signaled as FIQs or IRQs when the CPU is in the Secure world. When SCR_EL3.FIQ is set to 0, Non-Secure Group 1 interrupts are signaled as FIQs, and the exception is taken to S-EL1. Conversely, when SCR_EL3.FIQ is set to 1, the same interrupts are signaled as FIQs, but the exception is taken to EL3.
The GIC CPU interface plays a crucial role in this process. In GICv3 and GICv4, the CPU interface is tightly coupled with the processor, allowing it to access the CPU’s current Exception Level (EL) and security state. This coupling enables the GIC CPU interface to dynamically signal interrupts as either FIQs or IRQs based on the CPU’s state. During a world switch, the GIC CPU interface does not generate an additional interrupt signal. Instead, it reinterprets the existing interrupt signal based on the new security state of the CPU. For example, if the CPU transitions from the Secure world to the Non-Secure world, a Non-Secure Group 1 interrupt that was previously signaled as an FIQ in the Secure world will now be recognized as an IRQ in the Non-Secure world.
This behavior is consistent with the ARM architecture’s design principles, where the GIC CPU interface ensures that interrupts are correctly routed and signaled based on the CPU’s current state. However, this dynamic re-signaling can lead to confusion if the system software does not account for the change in interrupt signaling during world switches. Misconfigurations or misunderstandings of this behavior can result in missed interrupts, incorrect exception handling, or system instability.
Ensuring Correct Interrupt Handling During World Switches
To ensure correct interrupt handling during world switches in systems using GICv3 or GICv4, several steps must be taken. First, the system software must correctly configure the SCR_EL3.FIQ bit to align with the desired interrupt handling behavior. If Non-Secure Group 1 interrupts should be handled in the Secure world, SCR_EL3.FIQ should be set to 0, ensuring that these interrupts are signaled as FIQs and handled in S-EL1. If these interrupts should be handled in EL3, SCR_EL3.FIQ should be set to 1.
Second, the system software must account for the dynamic re-signaling of interrupts by the GIC CPU interface during world switches. This includes ensuring that interrupt handlers in both the Secure and Non-Secure worlds are correctly configured to handle interrupts signaled as either FIQs or IRQs, depending on the CPU’s current state. For example, if a Non-Secure Group 1 interrupt is signaled as an FIQ in the Secure world and then re-signaled as an IRQ in the Non-Secure world, the interrupt handler in the Non-Secure world must be capable of handling IRQs.
Third, the system software must ensure that the GIC CPU interface is correctly configured to reflect the CPU’s security state during world switches. This includes updating the GIC’s internal state to reflect the new security state of the CPU, ensuring that interrupts are correctly routed and signaled. Failure to do so can result in incorrect interrupt handling or missed interrupts.
Finally, the system software must implement proper synchronization mechanisms to ensure that interrupts are not lost or mishandled during world switches. This includes using appropriate memory barriers and synchronization primitives to ensure that the CPU’s security state and the GIC’s internal state are correctly updated before and after the world switch. By following these steps, system designers can ensure that interrupts are correctly handled during world switches, maintaining system stability and performance.
In summary, the behavior of interrupt signals during world switches in GICv3/v4 systems is a complex but critical aspect of ARM architecture design. By understanding the role of SCR_EL3.FIQ, the GIC CPU interface, and the dynamic re-signaling of interrupts, system designers can implement robust interrupt handling mechanisms that ensure correct operation during Secure to Non-Secure world transitions. Proper configuration, synchronization, and handling of interrupts are essential for maintaining system stability and performance in these scenarios.
