SCR_EL3, Secure Configuration Register

The SCR_EL3 characteristics are:

Purpose

Defines the configuration of the current Security state. It specifies:

This register is part of the Security registers functional group.

Configuration

AArch64 System register SCR_EL3 can be mapped to AArch32 System register SCR, but this is not architecturally mandated.

RW fields in this register reset to architecturally UNKNOWN values.

Attributes

SCR_EL3 is a 32-bit register.

Field descriptions

The SCR_EL3 bit assignments are:

313029282726252423222120191817161514131211109876543210
0000000000000000TERRTLORTWETWISTRWSIFHCESMD011EAFIQIRQNS

Bits [31:16]

Reserved, RES0.

TERR, bit [15]

Trap Error record accesses. If the RAS Extension is implemented, the possible values of this bit are:

TERRMeaning
0

Does not trap accesses to record registers from EL1 and EL2 to EL3.

1

Accesses to the ER* registers from EL1 and EL2 generate a Trap exception to EL3.

This bit resets to 0 on Warm reset.

When the RAS Extension is not implemented, this field is RES0.

TLOR, bit [14]
In ARMv8.2 and ARMv8.1:

Trap LOR registers. Traps accesses to the LORSA_EL1, LOREA_EL1, LORN_EL1, LORC_EL1, and LORID_EL1 registers from EL1 and EL2 to EL3, unless the access has been trapped to EL2.

TLORMeaning
0

This control does not cause any instructions to be trapped.

1

EL1 and EL2 accesses to the LOR registers that are not UNDEFINED are trapped to EL3, unless it is trapped HCR_EL2.TLOR.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.


In ARMv8.0:

Reserved, RES0.

TWE, bit [13]

Traps EL2, EL1, and EL0 execution of WFE instructions to EL3, from both Security states and both Execution states.

TWEMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFE instruction at any Exception level lower than EL3 is trapped to EL3, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWE, HCR.TWE, SCTLR_EL1.nTWE, SCTLR_EL2.nTWE, or HCR_EL2.TWE.

In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

TWI, bit [12]

Traps EL2, EL1, and EL0 execution of WFI instructions to EL3, from both Security states and both Execution states.

TWIMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFI instruction at any Exception level lower than EL3 is trapped to EL3, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWI, HCR.TWI, SCTLR_EL1.nTWI, SCTLR_EL2.nTWI, or HCR_EL2.TWI.

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

ST, bit [11]

Traps Secure EL1 accesses to the Counter-timer Physical Secure timer registers to EL3, from AArch64 state only.

STMeaning
0

Secure EL1 using AArch64 accesses to the CNTPS_TVAL_EL1, CNTPS_CTL_EL1, and CNTPS_CVAL_EL1 are trapped to EL3.

1

This control does not cause any instructions to be trapped.

RW, bit [10]

Execution state control for lower Exception levels.

RWMeaning
0

Lower levels are all AArch32.

1

The next lower level is AArch64.

If EL2 is present:

  • EL2 is AArch64.
  • EL2 controls EL1 and EL0 behaviors.

If EL2 is not present:

  • EL1 is AArch64.
  • EL0 is determined by the Execution state described in the current process state when executing at EL0.

If all lower Exception levels cannot use AArch32 then this bit is RAO/WI.

This bit is permitted to be cached in a TLB.

SIF, bit [9]

Secure instruction fetch. When the PE is in Secure state, this bit disables instruction fetch from Non-secure memory. The possible values for this bit are:

SIFMeaning
0

Secure state instruction fetches from Non-secure memory are permitted.

1

Secure state instruction fetches from Non-secure memory are not permitted.

This bit is permitted to be cached in a TLB.

HCE, bit [8]

Hypervisor Call instruction enable. Enables HVC instructions at EL3, EL2, and Non-secure EL1, in both Execution states.

HCEMeaning
0

HVC instructions are UNDEFINED at EL3, EL2, and Non-secure EL1, and any resulting exception is taken from the current Exception level to the current Exception level.

1

HVC instructions are enabled at EL1 and above.

Note

HVC instructions are always UNDEFINED at EL0.

If EL2 is not implemented, this bit is RES0.

SMD, bit [7]

Secure Monitor Call disable. Disables SMC instructions at EL1 and above, from both Security states and both Execution states.

SMDMeaning
0

SMC instructions are enabled at EL1 and above.

1

SMC instructions are UNDEFINED at EL1 and above.

Note

SMC instructions are always UNDEFINED at EL0.

Bit [6]

Reserved, RES0.

Bits [5:4]

Reserved, RES1.

EA, bit [3]

External Abort and SError Interrupt Routing.

EAMeaning
0

When executing at Exception levels below EL3, External Aborts and SError Interrupts are not taken to EL3.

In addition, when executing at EL3:

  • SError Interrupts are not taken.
  • External Aborts are taken to EL3.
1

When executing at any Exception level, External Aborts and SError Interrupts are taken to EL3.

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1 (The AArch64 System Level Programmers' Model).

FIQ, bit [2]

Physical FIQ Routing.

FIQMeaning
0

When executing at Exception levels below EL3, physical FIQ interrupts are not taken to EL3.

When executing at EL3, physical FIQ interrupts are not taken.

1

When executing at any Exception level, physical FIQ interrupts are taken to EL3.

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1.

IRQ, bit [1]

Physical IRQ Routing.

IRQMeaning
0

When executing at Exception levels below EL3, physical IRQ interrupts are not taken to EL3.

When executing at EL3, physical IRQ interrupts are not taken.

1

When executing at any Exception level, physical IRQ interrupts are taken to EL3.

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1.

NS, bit [0]

Non-secure bit.

NSMeaning
0

Indicates that EL0 and EL1 are in Secure state, and so memory accesses from those Exception levels can access Secure memory.

When executing at EL3:

1

Indicates that EL0 and EL1 are in Non-secure state, and so memory accesses from those Exception levels cannot access Secure memory.

Note

EL2 is not supported in the Secure state. When SCR_EL3.NS==0, it is not possible to enter EL2, and the EL2 state has no effect on execution. See 'Virtualization' in the ARMv8 ARM, section D1.5.

Accessing the SCR_EL3

This register can be read using MRS with the following syntax:

MRS <Xt>, <systemreg>

This register can be written using MSR (register) with the following syntax:

MSR <systemreg>, <Xt>

This syntax uses the following encoding in the System instruction encoding space:

<systemreg> op0op1CRnCRmop2
SCR_EL31111000010001000

Accessibility

The register is accessible as follows:

Control Accessibility
E2HTGENSEL0EL1EL2EL3
xx0 - - n/a RW
001 - - - RW
011 - n/a - RW
101 - - - RW
111 - n/a - RW

This table applies to all instructions that can access this register.




18/04/2017 17:00

Copyright © 2010-2017 ARM Limited or its affiliates. All rights reserved. This document is Confidential.