SCR, Secure Configuration Register

The SCR characteristics are:

Purpose

When EL3 is implemented and can use AArch32, defines the configuration of the current Security state. It specifies:

This register is part of the Security registers functional group.

Configuration

This register is only accessible in Secure state.

AArch32 System register SCR can be mapped to AArch64 System register SCR_EL3, but this is not architecturally mandated.

Some or all RW fields of this register have defined reset values. These apply whenever the register is accessible. This means they apply when the PE resets into EL3 using AArch32.

Attributes

SCR is a 32-bit register.

Field descriptions

The SCR bit assignments are:

313029282726252423222120191817161514131211109876543210
0000000000000000TERR0TWETWI00SIFHCESCDnETAWFWEAFIQIRQNS

Bits [31:16]

Reserved, RES0.

TERR, bit [15]

Trap Error record accesses. If the RAS Extension is implemented, the possible values of this bit are:

TERRMeaning
0

Does not trap accesses to record registers from EL1 and EL2 to EL3.

1

Accesses to the ER* registers from EL1 and EL2 generate a Trap exception to EL3.

This bit resets to 0 on Warm reset.

When the RAS Extension is not implemented, this field is RES0.

Bit [14]

Reserved, RES0.

TWE, bit [13]

Traps WFE instructions to Monitor mode.

TWEMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFE instruction in any mode other than Monitor mode is trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter a low-power state and the attempted execution does not generate an exception that is taken to EL1 or EL2 by SCTLR.nTWE or HCR.TWE.

Any exception that is taken to EL1 or to EL2 has priority over this trap.

The attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When this register has an architecturally-defined reset value, this field resets to 0.

TWI, bit [12]

Traps WFI instructions to Monitor mode.

TWIMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFI instruction in any mode other than Monitor mode is trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter a low-power state and the attempted execution does not generate an exception that is taken to EL1 or EL2 by SCTLR.nTWI or HCR.TWI.

Any exception that is taken to EL1 or to EL2 has priority over this trap.

The attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When this register has an architecturally-defined reset value, this field resets to 0.

Bits [11:10]

Reserved, RES0.

SIF, bit [9]

Secure instruction fetch. When the PE is in Secure state, this bit disables instruction fetch from Non-secure memory. The possible values for this bit are:

SIFMeaning
0

Secure state instruction fetches from Non-secure memory are permitted.

1

Secure state instruction fetches from Non-secure memory are not permitted.

This bit is permitted to be cached in a TLB.

When this register has an architecturally-defined reset value, this field resets to 0.

HCE, bit [8]

Hypervisor Call instruction enable. Enables EL2 and Non-secure EL1 execution of HVC instructions.

HCEMeaning
0

HVC instructions are:

  • UNDEFINED at Non-secure EL1. The Undefined Instruction exception is taken from PL1 to PL1.
  • UNPREDICTABLE at EL2. Behavior is one of the following:
    • The instruction is UNDEFINED.
    • The instruction executes as a NOP.
1

HVC instructions are enabled at EL2 and Non-secure EL1.

Note

HVC instructions are always UNDEFINED at EL0 and in Secure state.

If EL2 is not implemented, this bit is RES0 and HVC is UNDEFINED.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to 0.

SCD, bit [7]

Secure Monitor Call disable. Disables SMC instructions.

SCDMeaning
0

SMC instructions are enabled.

1

In Non-secure state, SMC instructions are UNDEFINED. The Undefined Instruction exception is taken from the current Exception level to the current Exception level.

In Secure state, behavior is one of the following:

  • The instruction is UNDEFINED.
  • The instruction executes as a NOP.
Note

SMC instructions are always UNDEFINED at PL0.

When this register has an architecturally-defined reset value, this field resets to 0.

nET, bit [6]

Not Early Termination. This bit disables early termination. The possible values of this bit are:

nETMeaning
0

Early termination permitted. Execution time of data operations can depend on the data values.

1

Disable early termination. The number of cycles required for data operations is forced to be independent of the data values.

This IMPLEMENTATION DEFINED mechanism can disable data dependent timing optimizations from multiplies and data operations. It can provide system support against information leakage that might be exploited by timing correlation types of attack.

On implementations that do not support early termination or do not support disabling early termination, this bit is RES0.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to 0.

AW, bit [5]

When the value of SCR.EA is 1 and the value of HCR.AMO is 0, this bit controls whether CPSR.A masks an external abort taken from Non-secure state, and the possible values of this bit are:

AWMeaning
0

External aborts taken from Non-secure state are not masked by CPSR.A, and are taken to EL3.

External aborts taken from Secure state are masked by CPSR.A.

1

External aborts taken from either Security state are masked by CPSR.A. When CPSR.A is 0, the abort is taken to EL3.

When SCR.EA is 0 or HCR.AMO is 1, this bit has no effect.

When this register has an architecturally-defined reset value, this field resets to 0.

FW, bit [4]

When the value of SCR.FIQ is 1 and the value of HCR.FMO is 0, this bit controls whether CPSR.F masks an FIQ interrupt taken from Non-secure state, and the possible values of this bit are:

FWMeaning
0

An FIQ taken from Non-secure state is not masked by CPSR.F, and is taken to EL3.

An FIQ taken from Secure state is masked by CPSR.F.

1

An FIQ taken from either Security state is masked by CPSR.F. When CPSR.F is 0, the FIQ is taken to EL3.

When SCR.FIQ is 0 or HCR.FMO is 1, this bit has no effect.

When this register has an architecturally-defined reset value, this field resets to 0.

EA, bit [3]

External Abort handler. This bit controls which mode takes external aborts. The possible values of this bit are:

EAMeaning
0

External aborts taken to Abort mode.

1

External aborts taken to Monitor mode.

When this register has an architecturally-defined reset value, this field resets to 0.

FIQ, bit [2]

FIQ handler. This bit controls which mode takes FIQ exceptions. The possible values of this bit are:

FIQMeaning
0

FIQs taken to FIQ mode.

1

FIQs taken to Monitor mode.

When this register has an architecturally-defined reset value, this field resets to 0.

IRQ, bit [1]

IRQ handler. This bit controls which mode takes IRQ exceptions. The possible values of this bit are:

IRQMeaning
0

IRQs taken to IRQ mode.

1

IRQs taken to Monitor mode.

When this register has an architecturally-defined reset value, this field resets to 0.

NS, bit [0]

Non-secure bit. Except when the PE is in Monitor mode, this bit determines the Security state of the PE:

NSMeaning
0

PE is in Secure state.

1

PE is in Non-secure state.

If the HCR.TGE bit is set, an attempt to change from a Secure PL1 mode to a Non-secure EL1 mode by changing the SCR.NS bit from 0 to 1 results in the SCR.NS bit remaining as 0.

When this register has an architecturally-defined reset value, this field resets to 0.

Accessing the SCR

This register can be read using MRC with the following syntax:

MRC <syntax>

This register can be written using MCR with the following syntax:

MCR <syntax>

This syntax uses the following encoding in the System instruction encoding space:

<syntax> opc1opc2CRncoprocCRm
p15, 0, <Rt>, c1, c1, 0000000000111110001

Accessibility

The register is accessible as follows:

Control Accessibility
E2HTGENSEL0EL1EL2EL3
xx0 - - n/a RW
x01 - - - RW
x11 - n/a - RW

This table applies to all instructions that can access this register.

If EL3 is implemented and is using AArch64, any read or write to SCR from Secure EL1 using AArch32 is trapped as an exception to EL3.

Traps and enables

For a description of the prioritization of any generated exceptions, see section G1.11.2 (Exception priority order) in the ARM® Architecture Reference Manual, ARMv8, for ARMv8-A architecture profile for exceptions taken to AArch32 state, and section D1.13.2 (Synchronous exception prioritization) for exceptions taken to AArch64 state. Subject to the prioritization rules, the following traps and enables are applicable when accessing this register.

When EL2 is implemented and is using AArch64 and SCR_EL3.NS==1 && HCR_EL2.E2H==0 :

When EL2 is implemented and is using AArch64 and SCR_EL3.NS==1 && HCR_EL2.E2H==1 && HCR_EL2.TGE==0 :

When EL2 is implemented and is using AArch32 and SCR_EL3.NS==1 :




18/04/2017 17:00

Copyright © 2010-2017 ARM Limited or its affiliates. All rights reserved. This document is Confidential.