AArch64 exception level (exception level)

Why are there exception levels

Exception classes can be thought of as groups of patterns in which software operates. Each mode has certain operation rights and access to the registers allowed under the current level. For example, when we are at the lowest level, we only have access to some general-purpose registers x0-x30, and the stack pointer register SP, and str, ldr and other operation commands to load and store to memory, and some other used by some user programs Order.
A user program only has the authority to access its own data, but cannot access or modify the data of other user programs. This method is used to implement the system's authority management. Let every level of power operate under restraint. (We all know that unchecked power is very dangerous)

What is anomaly level

The ARMv8 architecture associates the exception level with the execution authority of the software. A total of 4 exception levels are defined: EL0, EL1, El2, and EL3. The permissions of the 4 exception levels: EL3>EL2>EL1>EL0 The software running at each level is usually As shown below:

1. EL0 is called the unprivileged exception level and is usually used for the execution of user programs. Execution in user space can be called user mode.
2. EL1 is often used in operating systems and can be called administrator mode.
3. EL2 is often used to implement virtualization to manage virtual machines (guest operating systems) as a hypervisor for virtual machines.
4. EL3 is known as a secure monitor (EL0-EL2 are considered to be running in a non-secure state). It has the highest authority and is the only exception level that can switch between safe execution state and non-safe execution state level.

In practical applications, consecutive exception classes are not mandatory. Support for virtualization (EL2) can be dropped and only EL3, EL1 and EL0 implemented. EL3 and EL2 are optional, EL1 and EL0 are required.

Exception level switching

Exception level switching occurs only when the processor throws an exception or returns after an exception.

• When an exception occurs, the exception level can only be switched to a higher level or remain at the same exception level.
• When an exception is returned, the exception level can only be switched to a lower level or remain at the same exception level.

Usually, a series of events will occur after an exception is generated (in the following introduction, ELn represents the current abnormal level n, which can be 0, 1, 2, 3):

1. The address of the current instruction is stored in the ELR_ELn (ELR_EL(n+1)? is not sure yet, needs to be confirmed later) register. (ELR_ELn, Exception link register. Called exception link register)
2. The state of the current processor is saved in the SPSR_ELn register (SPSR_ELn, the Saved Program Status register, called the program status register).
3. Execute the exception handler pointed to by the exception, (I personally think it can be understood as an interrupt handler).
4. Execute the eret instruction to return after the exception handling is completed. The processor state is restored from SPSR_ELn, and the address of processor execution is restored from the ELR_ELn register.

Only a few typical steps are introduced here , and some other registers such as necessary register data stack protection will be saved. After an exception occurs, there will be a corresponding on-site recovery.

Exception occurs

An exception occurs when the process state (processing element PE for short) is abnormal, and the abnormal state at this time is the state of the PE.
The process only runs some illegal instructions (accessing memory out of bounds, dividing by 0) and so on. In addition, special-purpose exceptions can also be generated by the svc instruction. At the same time, the interrupt generated by the hardware is also handled as a special envoy exception.

abnormal return

Usually execute ERET (Exception return) instruction to return. It should be noted that: abnormal return does not necessarily restore the address of the previous program operation and restore the previous processor state. Both SPSR_ELn and ELR_ELn registers are writable by exception handlers.

unusual number of digits

Each exception class can run in 64-bit mode (called AArch64) and 32-bit mode (called AArch32). Support all exception levels to use AArch64, or some exception levels to use AArch32.
Note:

• EL3 abnormal level can only use AArch64 mode
• If an exception level uses AArch64, then its higher level must be AArch64. For example, EL1 uses AArch64 mode, EL2 must be in AArch64 mode, EL0 wants to use AArch64 bit mode, and both EL1 and EL2 will be in AArch64 bit mode.

Switching of digits

Switching between 32-bit mode (AArch32) and 64-bit mode (AArch64) is called "interprocessing". The
switching of bits only occurs when the exception level is switched, that is, when an exception occurs or an exception returns . That is:
when an exception occurs, if the exception level changes, there are two cases for the number of digits: AArch32->AArch64, or remain unchanged.
When an exception is returned, if the exception level changes, the number of digits also has two cases: AArch64->AArch32, or remain unchanged. When the abnormal level is unchanged, the number of digits is unchanged.

Exception classes and corresponding software

Different levels of software (application, system kernel, virtualization layer, security software trust) can run at different exception levels, and can also run in different bit modes.
The execution status of different software is only at the time of restart or exception level switching.
The following figure shows a schematic diagram of the relationship between different security levels and exception levels and software at different levels:

(pictures are from the Internet, intruded and deleted)

Exception level selection

As mentioned above, in practical applications, EL0 and EL1 must exist, and EL2 and EL3 are optional.

• When there is EL3 and there is no EL2: hardware virtualization will not be supported, but it can support the switching of security modes (usually EL3 is considered a secure state, and EL0-2 is a non-secure state)
• When there is EL2 and there is no EL3: support hardware virtualization, but does not support switching of security mode (usually EL2 is used to realize virtualization)
• When neither EL2 nor EL3 is applied: virtualization is not supported. The operation can be in safe mode or non-safe mode, but switching during operation is not supported. Enter different security modes according to certain settings (for example, by modifying the pin state of the board) at startup.

Reference https://medium.com/@om.nara/aarch64-exception-levels-60d3a74280e6