aarch64 execute IRQ from EL1 in EL3

Question

Is it possible to execute an IRQ in EL3 (secure monitor) if IRQ was fired in EL1 context? E.g. I have entered EL1 via spsr_el3 (el1h selected) and after that setup a vector table with vbar_el1. Now, some IRQs I want to execute in EL3 mode. How can I do that?

Answer 1

What you want is called "Physical IRQ Routing", and is controlled via scr_el3. From the manual:

IRQ, bit [1]

        Physical IRQ Routing.

        0b0     When executing at Exception levels below EL3, physical IRQ
                interrupts are not taken to EL3.
                When executing at EL3, physical IRQ interrupts are not taken.

        0b1     When executing at any Exception level, physical IRQ interrupts
                are taken to EL3. 

If you only want to handle some IRQs at EL3 and leave others to EL1, then you can simply handle that in the EL3 exception vector by setting:

• spsr_el1 to spsr_el3.
• elr_el1 to elr_el3.
• elr_el3 to vbar_el1 plus one of 0x80/0x280/0x480/0x680 depending on the state bits in spsr_el3.
• spsr_el3 = (spsr_el3 & ~0xf00fff) | 0x3c5. If your architecture has PAN support, you'll also have to check spsr_el1 for the SPAN field, and if that's zero, OR 0x400000 into spsr_el3.