hi, experts:
正在学习ARMv8 manual.
关于Aarch64/Aarch32，有几个问题：
假定一个ARMv8 SOC实现了4个EL：EL0 / EL1 / EL2 / EL3
1. Secure State下：从EL3 Aarch64切换到Secure下的EL1 Aarch64
Target EL是EL1
SPSR_EL3[3:2] ：defined target EL
那么target EL1的execution state是由SPSR_EL3[4]确定的吗？
根据ARMv8 manual:
SPSR_EL3[4] : Register width that the exception was taken from, 并不是 exception was taken to啊？
有一些Doc讲：
EL1的execution state，应该由HCR_EL2.RW来确定，对吗？
2. 如果从Secure state EL3 Aarch64切换到Non-Secure EL1 Aarch64
仍然用SPSR_EL3吗？
best wishes,
Hi Martin,
Thanks for the quick reponse. I am still a little confused...
When the system is switching from 64 to another 64, the current SPSR_EL can define the number of of the next new EL down. This is well described in ARMv8 manual.
When the system is switching from 64 to 32, the current SPSR_EL can define the mode(SVC, IRQ etc) of the forthcoming 32bit state. This is also well described in ARMv8 manual.
What I am not sure is: for the 2nd case above, if we switch from AArch64-EL3 to 32 bit mode, and SCR.EL3.RW = 0 and SCR_EL3.NS = 0, then will the new AArch32 mode run in EL1 or EL2?
Thanks.
Which EL you went into would depend on what value you had in SPSR_EL3 when you performed the ERET. So for example, if you had "0x13" in the bottom 5 bits, you would return to Secure SVC mode (S.EL1). Or, if you used "0x10" you would return to Secure User mode (S.EL0).
There is _no_ EL2 in Secure state (SCR_EL3.NS=0). If you had the bit pattern for Hyp mode (0x1A) it would trigger an illegal exception return exception.
EDIT: Forgot the all important "no" in the last line.
Thank you Martin, I think I get the answer now.
BR.