Deprecate one EL3 interrupt routing model with EL3 exception handling

When ARM Trusted Firmware is built with EL3_EXCEPTION_HANDLING=1,
EL3 interrupts (INTR_TYPE_EL3) will always preempt both Non-secure and
secure execution.

The interrupt management framework currently treats EL3 interrupt
routing as valid. For the above reason, this patch makes them invalid
when EL3_EXCEPTION_HANDLING is in effect.

Change-Id: I95bca8f5dc8df8eb0ff6f305cfba098611522a39
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

diff --git a/docs/interrupt-framework-design.rst b/docs/interrupt-framework-design.rst
index 940bc24f051fdfeaa6c875e8cb140f9695dbb99d..d5654870b9fda2b1d99c2feefded2ba68590d36b 100644 (file)
--- a/docs/interrupt-framework-design.rst
+++ b/docs/interrupt-framework-design.rst
@@ -151,6 +151,10 @@ EL3 interrupts
    in Secure-EL1/Secure-EL0 is in control of how its execution is preempted
    by EL3 interrupt and can handover the interrupt to EL3 for handling.
 
+   However, when ``EL3_EXCEPTION_HANDLING`` is ``1``, this routing model is
+   invalid as EL3 interrupts are unconditionally routed to EL3, and EL3
+   interrupts will always preempt Secure EL1/EL0 execution.
+
 #. **CSS=0, TEL3=1**. Interrupt is routed to EL3 when execution is in
    Secure-EL1/Secure-EL0. This is a valid routing model as secure software
    in EL3 can handle the interrupt.

diff --git a/include/bl31/interrupt_mgmt.h b/include/bl31/interrupt_mgmt.h
index cccad3add1c4132814b2315ff797290e1bd180f4..d41edd0991fcc8a0eac4ebfae82a312a982098a4 100644 (file)
--- a/include/bl31/interrupt_mgmt.h
+++ b/include/bl31/interrupt_mgmt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -80,9 +80,19 @@
                                         ((x) == INTR_NS_VALID_RM1 ? 0 :\
                                          -EINVAL))
 
+#if EL3_EXCEPTION_HANDLING
+/*
+ * With EL3 exception handling, EL3 interrupts are always routed to EL3 from
+ * both Secure and Non-secure, and therefore INTR_EL3_VALID_RM1 is the only
+ * valid routing model.
+ */
+#define validate_el3_interrupt_rm(x)   ((x) == INTR_EL3_VALID_RM1 ? 0 : \
+                                        -EINVAL)
+#else
 #define validate_el3_interrupt_rm(x)   ((x) == INTR_EL3_VALID_RM0 ? 0 : \
                                         ((x) == INTR_EL3_VALID_RM1 ? 0 :\
                                          -EINVAL))
+#endif
 
 /*******************************************************************************
  * Macros to set the 'flags' parameter passed to an interrupt type handler. Only