(old) | htmldiff from- | (new)

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# TCR_EL2, Translation Control Register (EL2)

The TCR_EL2 characteristics are:

## Purpose

The control register for stage 1 of the EL2, or EL2&0, translation regime:

- When the Effective value of HCR_EL2.E2H is 0, this register controls stage 1 of the EL2 translation regime, that supports a single VA range, translated using TTBR0_EL2.
- When the value of HCR_EL2.E2H is 1, this register controls stage 1 of the EL2&0 translation regime, that supports both:
  - A lower VA range, translated using TTBR0_EL2.
  - A higher VA range, translated using TTBR1_EL2.

## Configuration

AArch64 System register TCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HTCR[31:0] .

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

TCR_EL2 is a 64-bit register.

## Field descriptions

The TCR_EL2 bit assignments are:

### When HCR_EL2.E2H == 0:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES1 | TCMA | TBID | HWU62 | HWU61 | HWU60 | HWU59 | HPD | RES1 | HD | HA | TBI | RES0 | PS | TG0 | SH0 | ORGN0 | IRGN0 | RES0 | T0SZ
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

Any of the bits in TCR_EL2, other than the A1 bit and the EPDx bits when they have the value 1, are permitted to be cached in a TLB.

#### Bits [63:32]

Reserved, RES0.

#### Bit [31]

Reserved, RES1.

#### TCMA, bit [30]
When ARMv8.5-MemTag is implemented:

Controls the generation of Unchecked accesses at EL2 when address [59:56] = 0b0000.

TCMA | Meaning
--- | ---
0b0 | This control has no effect on the generation of Unchecked accesses.
0b1 | All accesses are Unchecked.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBID, bit [29]
When ARMv8.3-PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

TBID | Meaning
--- | ---
0b0 | TCR_EL2.TBI applies to Instruction and Data accesses.
0b1 | TCR_EL2.TBI applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR0_EL2.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU62, bit [28]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry.

HWU62 | Meaning
--- | ---
0b0 | Bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU61, bit [27]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry.

HWU61 | Meaning
--- | ---
0b0 | Bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU60, bit [26]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry.

HWU60 | Meaning
--- | ---
0b0 | Bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU59, bit [25]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry.

HWU59 | Meaning
--- | ---
0b0 | Bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HPD, bit [24]
When ARMv8.1-HPD is implemented:

Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR0_EL2.

HPD | Meaning
--- | ---
0b0 | Hierarchical permissions are enabled.
0b1 | Hierarchical permissions are disabled. Note In this case bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor attributes are required to be ignored by the PE, and are no longer reserved, allowing them to be used by software.

When disabled, the permissions are treated as if the bits are zero.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [23]

Reserved, RES1.

#### HD, bit [22]
When ARMv8.1-TTHM is implemented:

Hardware management of dirty state in stage 1 translations from EL2.

HD | Meaning
--- | ---
0b0 | Stage 1 hardware management of dirty state disabled.
0b1 | Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HA, bit [21]
When ARMv8.1-TTHM is implemented:

Hardware Access flag update in stage 1 translations from EL2.

HA | Meaning
--- | ---
0b0 | Stage 1 Access flag update disabled.
0b1 | Stage 1 Access flag update enabled.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBI, bit [20]

Top Byte ignored - indicates whether the top byte of an address is used for address match for the TTBR0_EL2 region, or ignored and used for tagged addresses.

TBI | Meaning
--- | ---
0b0 | Top Byte used in the address calculation.
0b1 | Top Byte ignored in the address calculation.

This affects addresses generated in EL2 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL2. It has an effect whether the EL2, or EL2&0, translation regime is enabled or not.

If ARMv8.3-PAuth is implemented and TCR_EL2.TBID is 1, then this field only applies to Data accesses.

If the value of TBI is 1, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:

- A branch or procedure return within EL2.
- An exception taken to EL2.
- An exception return to EL2.

This field resets to an architecturally UNKNOWN value.

#### Bit [19]

Reserved, RES0.

#### PS, bits [18:16]

Physical Address Size.

PS | Meaning
--- | ---
0b000 | 32 bits, 4GB.
0b001 | 36 bits, 64GB.
0b010 | 40 bits, 1TB.
0b011 | 42 bits, 4TB.
0b100 | 44 bits, 16TB.
0b101 | 48 bits, 256TB.
0b110 | 52 bits, 4PB.

Other values are reserved.

The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not rely on this property as the behavior of the reserved values might change in a future revision of the architecture.

The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size is 64KB.

In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated as 0b110, then bits[51:48] of every translation table base address for the stage of translation controlled by TCR_EL2 are 0b0000.

This field resets to an architecturally UNKNOWN value.

#### TG0, bits [15:14]

Granule size for the TTBR0_EL2.

TG0 | Meaning
--- | ---
0b00 | 4KB.
0b01 | 64KB.
0b10 | 16KB.

Other values are reserved.

If the value is programmed to either a reserved value, or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

This field resets to an architecturally UNKNOWN value.

#### SH0, bits [13:12]

Shareability attribute for memory associated with translation table walks using TTBR0_EL2.

SH0 | Meaning
--- | ---
0b00 | Non-shareable.
0b10 | Outer Shareable.
0b11 | Inner Shareable.

Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in AArch64 System registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

This field resets to an architecturally UNKNOWN value.

#### ORGN0, bits [11:10]

Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL2.

ORGN0 | Meaning
--- | ---
0b00 | Normal memory, Outer Non-cacheable.
0b01 | Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

#### IRGN0, bits [9:8]

Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL2.

IRGN0 | Meaning
--- | ---
0b00 | Normal memory, Inner Non-cacheable.
0b01 | Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

#### Bits [7:6]

Reserved, RES0.

#### T0SZ, bits [5:0]

The size offset of the memory region addressed by TTBR0_EL2. The region size is 2(64-T0SZ) bytes.

The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

This field resets to an architecturally UNKNOWN value.

### When HCR_EL2.E2H == 1:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0 | TCMA1 | TCMA0 | E0PD1 | E0PD0 | NFD1 | NFD0 | TBID1 | TBID0 | HWU162 | HWU161 | HWU160 | HWU159 | HWU062 | HWU061 | HWU060 | HWU059 | HPD1 | HPD0 | HD | HA | TBI1 | TBI0 | AS | RES0 | IPS
TG1 | SH1 | ORGN1 | IRGN1 | EPD1 | A1 | T1SZ | TG0 | SH0 | ORGN0 | IRGN0 | EPD0 | RES0 | T0SZ
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

This view of the register is only valid from Armv8.1 when HCR_EL2.E2H is 1.

Any of the bits in TCR_EL2 are permitted to be cached in a TLB.

#### Bits [63:59]

Reserved, RES0.

#### TCMA1, bit [58]
When ARMv8.5-MemTag is implemented:

Controls the generation of Unchecked accesses at EL2, and at EL0 if HCR_EL2.TGE=1, when address[59:55] = 0b11111.

TCMA1 | Meaning
--- | ---
0b0 | This control has no effect on the generation of Unchecked accesses at EL2 or EL0.
0b1 | All accesses are Unchecked.

Note

Software may change this control bit on a context switch.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TCMA0, bit [57]
When ARMv8.5-MemTag is implemented:

Controls the generation of Unchecked accesses at EL2, and at EL0 if HCR_EL2.TGE=1, when address[59:55] = 0b00000.

TCMA0 | Meaning
--- | ---
0b0 | This control has no effect on the generation of Unchecked accesses at EL2 or EL0.
0b1 | All accesses are Unchecked.

Note

Software may change this control bit on a context switch.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### E0PD1, bit [56]
When ARMv8.5-E0PD is implemented:

Faulting control for EL0 access to any address translated by TTBR1_EL2.

E0PD1 | Meaning
--- | ---
0b0 | EL0 access to any address translated by TTBR1_EL2 will not generate a fault by this mechanism.
0b1 | EL0 access to any address translated by TTBR1_EL2 will generate a level 0 translation fault

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### E0PD0, bit [55]
When ARMv8.5-E0PD is implemented:

Faulting control for EL0 access to any address translated by TTBR0_EL2.

E0PD0 | Meaning
--- | ---
0b0 | EL0 access to any address translated by TTBR0_EL2 will not generate a fault by this mechanism.
0b1 | EL0 access to any address translated by TTBR0_EL2 will generate a level 0 translation fault

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### NFD1, bit [54]
When SVE is implemented or TME is implemented:

Non-fault translation table walk disable for stage 1 translations using TTBR1_EL2.

This bit controls whether to perform a stage 1 translation table walk in response to a non-fault access from EL0 for a virtual address that is translated using TTBR1_EL2.

If SVE is implemented, the affected access types include:

- All accesses due to an SVE non-fault contiguous load instruction.
- Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
- Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.

See 'The Scalable Vector Extension (SVE)', in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile for more information.

If TME is implemented, the affected access types include all accesses generated by a load or store instruction in Transactional state.

Defined values are:

NFD1 | Meaning
--- | ---
0b0 | Does not disable stage 1 translation table walks using TTBR1_EL2.
0b1 | A TLB miss on a virtual address that is translated using TTBR1_EL2 due to the specified access types causes the access to fail without taking an exception. No stage 1 translation table walk is performed.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### NFD0, bit [53]
When SVE is implemented or TME is implemented:

Non-fault translation table walk disable for stage 1 translations using TTBR0_EL2.

This bit controls whether to perform a stage 1 translation table walk in response to a non-fault access from EL0 for a virtual address that is translated using TTBR0_EL2.

If SVE is implemented, the affected access types include:

- All accesses due to an SVE non-fault contiguous load instruction.
- Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
- Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.

See 'The Scalable Vector Extension (SVE)', in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile for more information.

If TME is implemented, the affected access types include all accesses generated by a load or store instruction in Transactional state.

Defined values are:

NFD0 | Meaning
--- | ---
0b0 | Does not disable stage 1 translation table walks using TTBR0_EL2.
0b1 | A TLB miss on a virtual address that is translated using TTBR0_EL2 due to the specified access types causes the access to fail without taking an exception. No stage 1 translation table walk is performed.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBID1, bit [52]
When ARMv8.3-PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

TBID1 | Meaning
--- | ---
0b0 | TCR_EL2.TBI1 applies to Instruction and Data accesses.
0b1 | TCR_EL2.TBI1 applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR1_EL2.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBID0, bit [51]
When ARMv8.3-PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

TBID0 | Meaning
--- | ---
0b0 | TCR_EL2.TBI0 applies to Instruction and Data accesses.
0b1 | TCR_EL2.TBI0 applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR0_EL2.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU162, bit [50]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL2.

HWU162 | Meaning
--- | ---
0b0 | For translations using TTBR1_EL2, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR1_EL2, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU161, bit [49]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL2.

HWU161 | Meaning
--- | ---
0b0 | For translations using TTBR1_EL2, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR1_EL2, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU160, bit [48]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL2.

HWU160 | Meaning
--- | ---
0b0 | For translations using TTBR1_EL2, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR1_EL2, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU159, bit [47]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL2.

HWU159 | Meaning
--- | ---
0b0 | For translations using TTBR1_EL2, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR1_EL2, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU062, bit [46]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU062 | Meaning
--- | ---
0b0 | For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU061, bit [45]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU061 | Meaning
--- | ---
0b0 | For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU060, bit [44]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU060 | Meaning
--- | ---
0b0 | For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU059, bit [43]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU059 | Meaning
--- | ---
0b0 | For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HPD1, bit [42]
When ARMv8.1-HPD is implemented:

Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR1_EL2.

HPD1 | Meaning
--- | ---
0b0 | Hierarchical permissions are enabled.
0b1 | Hierarchical permissions are disabled.

When disabled, the permissions are treated as if the bits are zero.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HPD0, bit [41]
When ARMv8.1-HPD is implemented:

Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR0_EL2.

HPD0 | Meaning
--- | ---
0b0 | Hierarchical permissions are enabled.
0b1 | Hierarchical permissions are disabled.

When disabled, the permissions are treated as if the bits are zero.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HD, bit [40]
When ARMv8.1-TTHM is implemented:

Hardware management of dirty state in stage 1 translations from EL2.

HD | Meaning
--- | ---
0b0 | Stage 1 hardware management of dirty state disabled.
0b1 | Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HA, bit [39]
When ARMv8.1-TTHM is implemented:

Hardware Access flag update in stage 1 translations from EL2.

HA | Meaning
--- | ---
0b0 | Stage 1 Access flag update disabled.
0b1 | Stage 1 Access flag update enabled.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBI1, bit [38]
From Armv8.1:

Top Byte ignored - indicates whether the top byte of an address is used for address match for the TTBR1_EL2 region, or ignored and used for tagged addresses. Defined values are:

TBI1 | Meaning
--- | ---
0b0 | Top Byte used in the address calculation.
0b1 | Top Byte ignored in the address calculation.

This affects addresses generated in EL0 and EL2 using AArch64 where the address would be translated by tables pointed to by TTBR1_EL2. It has an effect whether the EL2, or EL2&0, translation regime is enabled or not.

If ARMv8.3-PAuth is implemented and TCR_EL2.TBID1 is 1, then this field only applies to Data accesses.

If the value of TBI1 is 1 and bit [55] of the target address to be stored to the PC is 1, then bits[63:56] of that target address are also set to 1 before the address is stored in the PC, in the following cases:

- A branch or procedure return within EL0 or EL1.
- An exception taken to EL1.
- An exception return to EL0 or EL1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TBI0, bit [37]
When ARMv8.1-VHE is implemented:

Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the TTBR0_EL2 region, or ignored and used for tagged addresses. Defined values are:

TBI0 | Meaning
--- | ---
0b0 | Top Byte used in the address calculation.
0b1 | Top Byte ignored in the address calculation.

This affects addresses generated in EL0 and EL2 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL2. It has an effect whether the EL2, or EL2&0, translation regime is enabled or not.

If ARMv8.3-PAuth is implemented and TCR_EL2.TBID0 is 1, then this field only applies to Data accesses.

If the value of TBI0 is 1 and bit [55] of the target address to be stored to the PC is 0, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:

- A branch or procedure return within EL0 or EL1.
- An exception taken to EL1.
- An exception return to EL0 or EL1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### AS, bit [36]

ASID Size. Defined values are:

AS | Meaning
--- | ---
0b0 | 8 bit - the upper 8 bits of TTBR0_EL2 and TTBR1_EL2 are ignored by hardware for every purpose except reading back the register, and are treated as if they are all zeros for when used for allocation and matching entries in the TLB.
0b1 | 16 bit - the upper 16 bits of TTBR0_EL2 and TTBR1_EL2 are used for allocation and matching in the TLB.

If the implementation has only 8 bits of ASID, this field is RES0.

This field resets to an architecturally UNKNOWN value.

#### Bit [35]

Reserved, RES0.

#### IPS, bits [34:32]

Intermediate Physical Address Size.

IPS | Meaning | Applies when
--- | --- | ---
0b000 | 32 bits, 4GB.
0b001 | 36 bits, 64GB.
0b010 | 40 bits, 1TB.
0b011 | 42 bits, 4TB.
0b100 | 44 bits, 16TB.
0b101 | 48 bits, 256TB.
0b110 | 52 bits, 4PB. | When ARMv8.2-LPA is implemented

Other values are reserved.

The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not rely on this property as the behavior of the reserved values might change in a future revision of the architecture.

The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size is 64KB.

In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated as 0b110, then bits[51:48] of every translation table base address for the stage of translation controlled by TCR_EL2 are 0b0000.

This field resets to an architecturally UNKNOWN value.

#### TG1, bits [31:30]
From Armv8.1:

Granule size for the TTBR1_EL2.

TG1 | Meaning
--- | ---
0b01 | 16KB.
0b10 | 4KB.
0b11 | 64KB.

Other values are reserved.

If the value is programmed to either a reserved value, or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### SH1, bits [29:28]
From Armv8.1:

Shareability attribute for memory associated with translation table walks using TTBR1_EL2. Defined values are:

SH1 | Meaning
--- | ---
0b00 | Non-shareable.
0b10 | Outer Shareable.
0b11 | Inner Shareable.

Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in AArch64 System registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### ORGN1, bits [27:26]
From Armv8.1:

Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL2.

ORGN1 | Meaning
--- | ---
0b00 | Normal memory, Outer Non-cacheable.
0b01 | Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### IRGN1, bits [25:24]
From Armv8.1:

Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL2.

IRGN1 | Meaning
--- | ---
0b00 | Normal memory, Inner Non-cacheable.
0b01 | Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EPD1, bit [23]
From Armv8.1:

Translation table walk disable for translations using TTBR1_EL2. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR1_EL2. The encoding of this bit is:

EPD1 | Meaning
--- | ---
0b0 | Perform translation table walks using TTBR1_EL2.
0b1 | A TLB miss on an address that is translated using TTBR1_EL2 generates a Translation fault. No translation table walk is performed.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### A1, bit [22]

Selects whether TTBR0_EL2 or TTBR1_EL2 defines the ASID. The encoding of this bit is:

A1 | Meaning
--- | ---
0b0 | TTBR0_EL2.ASID defines the ASID.
0b1 | TTBR1_EL2.ASID defines the ASID.

This field resets to an architecturally UNKNOWN value.

#### T1SZ, bits [21:16]
From Armv8.1:

The size offset of the memory region addressed by TTBR1_EL2. The region size is 2(64-T1SZ) bytes.

The maximum and minimum possible values for T1SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TG0, bits [15:14]
From Armv8.1:

Granule size for the TTBR0_EL2.

TG0 | Meaning
--- | ---
0b00 | 4KB.
0b01 | 64KB.
0b10 | 16KB.

Other values are reserved.

If the value is programmed to either a reserved value, or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### SH0, bits [13:12]
From Armv8.1:

Shareability attribute for memory associated with translation table walks using TTBR0_EL2.

SH0 | Meaning
--- | ---
0b00 | Non-shareable.
0b10 | Outer Shareable.
0b11 | Inner Shareable.

Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in AArch64 System registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### ORGN0, bits [11:10]
From Armv8.1:

Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL2.

ORGN0 | Meaning
--- | ---
0b00 | Normal memory, Outer Non-cacheable.
0b01 | Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### IRGN0, bits [9:8]
From Armv8.1:

Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL2.

IRGN0 | Meaning
--- | ---
0b00 | Normal memory, Inner Non-cacheable.
0b01 | Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EPD0, bit [7]
From Armv8.1:

Translation table walk disable for translations using TTBR0_EL2. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR0_EL2. The encoding of this bit is:

EPD0 | Meaning
--- | ---
0b0 | Perform translation table walks using TTBR0_EL2.
0b1 | A TLB miss on an address that is translated using TTBR0_EL2 generates a Translation fault. No translation table walk is performed.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [6]

Reserved, RES0.

#### T0SZ, bits [5:0]
From Armv8.1:

The size offset of the memory region addressed by TTBR0_EL2. The region size is 2(64-T0SZ) bytes.

The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

## Accessing the TCR_EL2

Any of the bits in TCR_EL2, other than the A1 bit and the EPDx bits when they have the value 1, are permitted to be cached in a TLB.

When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic TCR_EL2 or TCR_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic.

Accesses to this register use the following encodings:

#### MRS <Xt>, TCR_EL2

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0010 | 0b0000 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then return TCR_EL2; elsif PSTATE.EL == EL3 then return TCR_EL2;

#### MSR TCR_EL2, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0010 | 0b0000 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then TCR_EL2 = X[t]; elsif PSTATE.EL == EL3 then TCR_EL2 = X[t];

#### MRS <Xt>, TCR_EL1

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then return NVMem[0x120]; else return TCR_EL1; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then return TCR_EL2; else return TCR_EL1; elsif PSTATE.EL == EL3 then return TCR_EL1;

#### MSR TCR_EL1, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then NVMem[0x120] = X[t]; else TCR_EL1 = X[t]; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then TCR_EL2 = X[t]; else TCR_EL1 = X[t]; elsif PSTATE.EL == EL3 then TCR_EL1 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

15 27/04 03/2019 16 21:47 59; 8c23526ba8a13a72aada4137daf3e3977b49036e e5e4db499bf9867a4b93324c4dbac985d3da9376

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.

(old) | htmldiff from- | (new)