Vectored interrupt control within a system having a secure domain and a non-secure domain

• US 7,117,284 B2
• Filed: 11/17/2003
• Issued: 10/03/2006
• Est. Priority Date: 11/18/2002
• Status: Active Grant

• Current Assignee: Arm Ltd. (United Kingdom) (SoftBank Group Corp.)
• Original Assignee: Arm Ltd. (United Kingdom) (SoftBank Group Corp.)
• Inventors: Orion, Luc, Chaussade, Nicolas, Mansell, David Hennah, Watt, Simon Charles, Belnet, Lionel, Brochier, Stephane Eric Sebastien, Dornan, Christopher Bentley, Callan, Jonathan Sean
• Primary Examiner(s): Myers, Paul R.
• Application Number:
  US10/714,562
• Publication Number:
  US 20050160210A1
• Time in Patent Office: 1,051 Days
• Field of Search: 710260-269
• US Class Current: 710/261
• CPC Class Codes: G06F 9/4812 by interrupt, e.g. masked

Abstract

A data processing apparatus is operable in a plurality of modes and in either a secure domain or a non-secure domain. When operating in a secure mode within the secure domain a program has access to secure data which is not accessible when the processor is operating in a non-secure mode. A vectored interrupt controller is provided to generate an exception handler address in response to an occurrence of an except condition. The vectored interrupt controller is programmable with parameters specifying for each exception condition whether an exception handler in the secure or the non-secure domain should be triggered and an exception handler address for use if the exception occurs when in the appropriate domain. The vectored interrupt controller also includes a parameter specifying a domain switching exception handler address for use if the exception condition occurs when the processor is not in the appropriate domain.

Claims

1. Apparatus for processing data, said apparatus comprising:

a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain or a non-secure domain, said plurality of modes including;

at least one secure mode being a mode in said secure domain; and

at least one non-secure mode being a mode in said non-secure domain;

wherein when said processor is executing a program in a secure mode said program has access to secure data which is not accessible when said processor is operating in a non-secure mode; and

a vectored interrupt controller operable to generate an exception handler address for supply to said processor in response to occurrence of an exception condition in accordance with programmable parameters specifying;

for each of a plurality of exception conditions, a domain value indicating whether said exception condition should trigger an exception handler in said secure domain or said non-secure domain;

for each of said plurality of exception conditions, an exception handler address for use if said exception condition occurs when said processor is operating in that one of said secure domain and said non-secure domain indicated by said domain value; and

at least one domain switching exception handler address shared between said plurality of exception conditions for use if said exception condition occurs when said processor is not operating in that one of said secure domain and said non-secure domain indicated by said domain value.

2. Apparatus as claimed in claim 1, wherein said programmable parameters include:

a first domain switching exception handler address for use if said exception condition occurs when said processor is operating in said secure domain and domain value indicates that said exception condition should trigger an exception handler in said non-secure domain; and

a second domain switching exception handler address for use if said exception condition occurs when said processor is operating in said non-secure domain and domain value indicates that said exception condition should trigger an exception handler in said secure domain.

3. Apparatus as claimed in claim 1, wherein said processor is also operable in a monitor mode and any switching between a secure mode and a non-secure mode is performed via said monitor mode.

4. Apparatus as claimed in claim 3, wherein said at least one domain switching exception handler address serves to trigger execution of a domain switching exception handler which switches between said non-secure domain and said secure domain via said monitor mode.

5. Apparatus as claimed in claim 1, wherein said processor includes a secure status flag indicating of whether said processor is operating in said secure domain or said non-secure domain, said vectored interrupt controller being supplied with a secure status signal indicating a value of said secure status flag.

11. A computer program product having a computer program operable to control a data processing apparatus in accordance with a method as claimed in claim 5.

6. A method of processing data, said method comprising the steps of:

executing a program with a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain or a non-secure domain, said plurality of modes including;

at least one secure mode being a mode in said secure domain; and

at least one non-secure mode being a mode in said non-secure domain;

wherein when said processor is executing a program in a secure mode said program has access to secure data which is not accessible when said processor is operating in a non-secure mode; and

generating with a vectored interrupt controller an exception handler address for supply to said processor in response to occurrence of an exception condition in accordance with programmable parameters specifying;

for each of a plurality of exception conditions, a domain value indicating whether said exception condition should trigger an exception handler in said secure domain or said non-secure domain;

for each of said plurality of exception conditions, an exception handler address for use if said exception condition occurs when said processor is operating in that one of said secure domain and said non-secure domain indicated by said domain value; and

at least one domain switching exception handler address shared between said plurality of exception conditions for use if said exception condition occurs when said processor is not operating in that one of said secure domain and said non-secure domain indicated by said domain value.

7. A method as claimed in claim 6, wherein said programmable parameters include:

a first domain switching exception handler address for use if said exception condition occurs when said processor is operating in said secure domain and domain value indicates that said exception condition should trigger an exception handler in said non-secure domain; and

a second domain switching exception handler address for use if said exception condition occurs when said processor is operating in said non-secure domain and domain value indicates that said exception condition should trigger an exception handler in said secure domain.

8. A method as claimed in claim 6, wherein said processor is also operable in a monitor mode and any switching between a secure mode and a non-secure mode is performed via said monitor mode.

9. A method as claimed in claim 8, wherein said at least one domain switching exception handler address serves to trigger execution of a domain switching exception handler which switches between said non-secure domain and said secure domain via said monitor mode.

10. A method as claimed in claim 6, wherein said processor includes a secure status flag indicating of whether said processor is operating in said secure domain or said non-secure domain, said vectored interrupt controller being supplied with a secure status signal indicating a value of said secure status flag.