SCTLR_EL2, System Control Register (EL2)

The SCTLR_EL2 characteristics are:

Purpose

Provides top level control of the system, including its memory system, at EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, these controls apply also to execution at Non-secure EL0.

This register is part of:

Configuration

AArch64 System register SCTLR_EL2 is architecturally mapped to AArch32 System register HSCTLR.

If EL2 is not implemented, this register is RES0 from EL3.

Some or all RW fields of this register have defined reset values. These apply only if the PE resets into EL2 using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN values.

Attributes

SCTLR_EL2 is a 32-bit register.

Field descriptions

The SCTLR_EL2 bit assignments are:

When HCR_EL2.{E2H, TGE} != {1, 1}:

313029282726252423222120191817161514131211109876543210
001100EE01100WXN101000I10000011SACAM

This format applies in all ARMv8.0 implementations, and from ARMv8.1 in Secure state.

Bits [31:30]

Reserved, RES0.

Bits [29:28]

Reserved, RES1.

Bits [27:26]

Reserved, RES0.

EE, bit [25]

Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime.

The possible values of this bit are:

EEMeaning
0

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime are little-endian.

1

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime are big-endian.

If an implementation does not provide Big-endian support at Exception Levels higher than EL0, this bit is RES0.

If an implementation does not provide Little-endian support at Exception Levels higher than EL0, this bit is RES1.

The EE bit is permitted to be cached in a TLB.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to an IMPLEMENTATION DEFINED value.

Bit [24]

Reserved, RES0.

Bits [23:22]

Reserved, RES1.

Bits [21:20]

Reserved, RES0.

WXN, bit [19]

Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit can force all memory regions that are writable to be treated as XN. The possible values of this bit are:

WXNMeaning
0

This control has no effect on memory access permissions.

1

Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for accesses from software executing at EL2.

The WXN bit is permitted to be cached in a TLB.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

Bit [18]

Reserved, RES1.

Bit [17]

Reserved, RES0.

Bit [16]

Reserved, RES1.

Bits [15:13]

Reserved, RES0.

I, bit [12]

Instruction access Cacheability control, for accesses at EL2:

IMeaning
0

All instruction access to Normal memory from EL2 are Non-cacheable for all levels of instruction and unified cache.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or EL2&0 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable memory.

1

This control has no effect on the Cacheability of instruction access to Normal memory from EL2.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or EL2&0 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.

This bit has no effect on the EL1&0 or EL3 translation regimes.

When this register has an architecturally-defined reset value, this field resets to 0.

Bit [11]

Reserved, RES1.

Bits [10:6]

Reserved, RES0.

Bits [5:4]

Reserved, RES1.

SA, bit [3]

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the ARMv8 ARM, section D1 (The AArch64 System Level Programmers' Model).

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

C, bit [2]

Cacheability control, for data accesses.

CMeaning
0

All data access to Normal memory from EL2, and all Normal memory accesses to the EL2 translation tables, are Non-cacheable for all levels of data and unified cache.

1

This control has no effect on the Cacheability of:

  • Data access to Normal memory from EL2.
  • Normal memory accesses to the EL2 translation tables.

This bit has no effect on the EL1&0 or EL3 translation regimes.

When this register has an architecturally-defined reset value, this field resets to 0.

A, bit [1]

Alignment check enable. This is the enable bit for Alignment fault checking at EL2:

AMeaning
0

Alignment fault checking disabled when executing at EL2.

Instructions that load or store one or more registers, other than load/store exclusive and load-acquire/store-release, do not check that the address being accessed is aligned to the size of the data element(s) being accessed.

1

Alignment fault checking enabled when executing at EL2.

All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.

Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless of the value of the A bit.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

M, bit [0]

MMU enable for EL2 stage 1 address translation. Possible values of this bit are:

MMeaning
0

EL2 stage 1 address translation disabled.

See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory.

1

EL2 stage 1 address translation enabled.

When this register has an architecturally-defined reset value, this field resets to 0.

When HCR_EL2.{E2H, TGE} == {1, 1}:

313029282726252423222120191817161514131211109876543210
00LSMAOEnTLSMD0UCIEEE0ESPAN1IESB1WXNnTWE0nTWIUCTDZE0I100SEDITD0CP15BENSA0SACAM

This format applies only from ARMv8.1 and only in Non-secure state when HCR_EL2.{E2H, TGE} == {1, 1}.

Bits [31:30]

Reserved, RES0.

LSMAOE, bit [29]
In ARMv8.2:

Load Multiple and Store Multiple Atomicity and Ordering Enable. When the OPTIONAL feature ARMv8.2-LSMAOC is implemented, defined values are:

LSMAOEMeaning
0

For all memory accesses at EL0, A32 and T32 Load Multiple and Store Multiple can have an interrupt taken during the sequence memory accesses, and the memory accesses are not required to be ordered.

1

The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple at EL0 is as defined for ARMv8.0.

This bit is permitted to be cached in a TLB.

If this bit is not implemented, it is RES1.


In ARMv8.1:

Reserved, RES1.

nTLSMD, bit [28]
In ARMv8.2:

No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE memory. When the OPTIONAL feature ARMv8.2-LSMAOC is implemented, defined values are:

nTLSMDMeaning
0

All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL0 that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and generate a stage 1 Alignment fault.

1

All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL0 that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.

This bit is permitted to be cached in a TLB.

If this bit is not implemented, it is RES1.


In ARMv8.1:

Reserved, RES1.

Bit [27]

Reserved, RES0.

UCI, bit [26]

Traps EL0 execution of cache maintenance instructions to EL2, from AArch64 state only.

UCIMeaning
0

Any attempt to execute a DC CVAU, DC CIVAC, DC CVAC, or IC IVAU instruction at EL0 using AArch64 is trapped to EL2.

1

This control does not cause any instructions to be trapped.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

EE, bit [25]

Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime.

The possible values of this bit are:

EEMeaning
0

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime are little-endian.

1

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or El2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime are big-endian.

If an implementation does not provide Big-endian support at Exception Levels higher than EL0, this bit is RES0.

If an implementation does not provide Little-endian support at Exception Levels higher than EL0, this bit is RES1.

The EE bit is permitted to be cached in a TLB.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to an IMPLEMENTATION DEFINED value.

E0E, bit [24]

Endianness of data accesses at EL0.

The possible values of this bit are:

E0EMeaning
0

Explicit data accesses at EL0 are little-endian.

1

Explicit data accesses at EL0 are big-endian.

If an implementation only supports Little-endian accesses at EL0 then this bit is RES0. This option is not permitted when SCTLR_EL1.EE is RES1.

If an implementation only supports Big-endian accesses at EL0 then this bit is RES1. This option is not permitted when SCTLR_EL1.EE is RES0.

This bit has no effect on the endianness of LDTR, LDTRH, LDTRSH, LDTRSW, STTR, and STTRH instructions executed at EL1.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to a value that is architecturally UNKNOWN.

SPAN, bit [23]

Set Privileged Access Never, on taking an exception to EL2.

SPANMeaning
0

PSTATE.PAN is set to 1 on taking an exception to EL2.

1

The value of PSTATE.PAN is left unchanged on taking an exception to EL2.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

Bit [22]

Reserved, RES1.

IESB, bit [21]
In ARMv8.2:

Implicit Error Synchronizaition Barrier enable. Permitted values are:

IESBMeaning
0

Disabled.

1

An implicit ErrorSynchronizationBarrier() call is added:

  • After each exception taken to EL2.
  • Before the operational pseudocode of each ERET instruction executed at EL2.

When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and regardless of the value of the field its effective value might be 0 or 1. If the effective value of the field is 1, then an implicit ErrorSynchronizationBarrier() is added after each DCPSx instruction and before each DRPS instruction, in addition to the other cases where it is added.

This field is part of the required ARMv8.2 implementation of the RAS Extension. See 'The Reliability, Availability, and Serviceability (RAS) Extension' in the ARMv8 ARM, chapter A1 'Introduction to the ARMv8 Architecture'.


In ARMv8.1:

Reserved, RES0.

Bit [20]

Reserved, RES1.

WXN, bit [19]

Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit can force all memory regions that are writable to be treated as XN. The possible values of this bit are:

WXNMeaning
0

This control has no effect on memory access permissions.

1

Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for accesses from software executing at EL2.

The WXN bit is permitted to be cached in a TLB.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

nTWE, bit [18]

Traps EL0 execution of WFE instructions to EL2, from both Execution states.

nTWEMeaning
0

Any attempt to execute a WFE instruction at EL0 is trapped to EL2, if the instruction would otherwise have caused the PE to enter a low-power state.

1

This control does not cause any instructions to be trapped.

In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

Bit [17]

Reserved, RES0.

nTWI, bit [16]

Traps EL0 execution of WFI instructions to EL2, from both Execution states.

nTWIMeaning
0

Any attempt to execute a WFI instruction at EL0 is trapped EL2, if the instruction would otherwise have caused the PE to enter a low-power state.

1

This control does not cause any instructions to be trapped.

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

UCT, bit [15]

Traps EL0 accesses to the CTR_EL0 to EL2, from AArch64 state only.

UCTMeaning
0

Accesses to the CTR_EL0 from EL0 using AArch64 are trapped to EL2.

1

This control does not cause any instructions to be trapped.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

DZE, bit [14]

Traps EL0 execution of DC ZVA instructions to EL2, from AArch64 state only.

DZEMeaning
0

Any attempt to execute a DC ZVA instruction at EL0 using AArch64 is trapped to EL2. Reading DCZID_EL0.DZP from EL0 returns 1, indicating that DC ZVA instructions are not supported.

1

This control does not cause any instructions to be trapped.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

Bit [13]

Reserved, RES0.

I, bit [12]

Instruction access Cacheability control, for accesses at EL2 and EL0:

IMeaning
0

All instruction access to Normal memory from EL2 and EL0 are Non-cacheable for all levels of instruction and unified cache.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable memory.

1

This control has no effect on the Cacheability of instruction access to Normal memory from EL2 and EL0.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.

This bit has no effect on the EL3 translation regimes.

When this register has an architecturally-defined reset value, this field resets to 0.

Bit [11]

Reserved, RES1.

Bits [10:9]

Reserved, RES0.

SED, bit [8]

SETEND instruction disable. Disables SETEND instructions at EL0 using AArch32.

SEDMeaning
0

SETEND instruction execution is enabled at EL0 using AArch32.

1

SETEND instructions are UNDEFINED at EL0 using AArch32.

If the implementation does not support mixed-endian operation at any Exception level, this bit is RES1.

If EL0 cannot use AArch32, this bit is RES1.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to a value that is architecturally UNKNOWN.

ITD, bit [7]

IT Disable. Disables some uses of IT instructions at EL0 using AArch32.

ITDMeaning
0

All IT instruction functionality is enabled at EL0 using AArch32.

1

Any attempt at EL0 using AArch32 to execute any of the following is UNDEFINED:

  • All encodings of the IT instruction with hw1[3:0]!=1000.
  • All encodings of the subsequent instruction with the following values for hw1:
    11xxxxxxxxxxxxxx
    All 32-bit instructions, and the 16-bit instructions B, UDF, SVC, LDM, and STM.
    1011xxxxxxxxxxxx
    All instructions in 'Miscellaneous 16-bit instructions' in the ARMv8 ARM, section F3.2.5.
    10100xxxxxxxxxxx
    ADD Rd, PC, #imm
    01001xxxxxxxxxxx
    LDR Rd, [PC, #imm]
    0100x1xxx1111xxx
    ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; BLX PC.
    010001xx1xxxx111
    ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This pattern also covers UNPREDICTABLE cases with BLX Rn.

These instructions are always UNDEFINED, regardless of whether they would pass or fail the condition code check that applies to them as a result of being in an IT block.

It is IMPLEMENTATION DEFINED whether the IT instruction is treated as:

  • A 16-bit instruction, that can only be followed by another 16-bit instruction.
  • The first half of a 32-bit instruction.

This means that, for the situations that are UNDEFINED, either the second 16-bit instruction or the 32-bit instruction is UNDEFINED.

An implementation might vary dynamically as to whether IT is treated as a 16-bit instruction or the first half of a 32-bit instruction.

If an instruction in an active IT block that would be disabled by this field sets this field to 1 then behavior is CONSTRAINED UNPREDICTABLE. For more information see 'Changes to an ITD control by an instruction in an IT block' in the ARMv8 ARM, section E1.2.4

If EL0 cannot use AArch32, this bit is RES1.

ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the SCTLR_EL1. If it is not implemented then this bit is RAZ/WI.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to a value that is architecturally UNKNOWN.

Bit [6]

Reserved, RES0.

CP15BEN, bit [5]

System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System instructions in the (coproc==1111) encoding space from EL0:

CP15BENMeaning
0

EL0 using AArch32: EL0 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is UNDEFINED.

1

EL0 using AArch32: EL0 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is enabled.

If EL0 cannot use AArch32, this bit is RES0.

CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in the SCTLR_EL1. If it is not implemented then this bit is RAO/WI.

When this register has an architecturally-defined reset value, if this field is implemented as an RW field, it resets to a value that is architecturally UNKNOWN.

SA0, bit [4]

SP Alignment check enable for EL0. When set to 1, if a load or store instruction executed at EL0 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the ARMv8 ARM, section D1 (The AArch64 System Level Programmers' Model).

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

SA, bit [3]

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the ARMv8 ARM, section D1 (The AArch64 System Level Programmers' Model).

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

C, bit [2]

Cacheability control, for data accesses.

CMeaning
0

All data access to Normal memory from EL2 and EL0, and all Normal memory accesses to the EL2&0 translation tables, are Non-cacheable for all levels of data and unified cache.

1

This control has no effect on the Cacheability of:

  • Data access to Normal memory from EL2 and EL0.
  • Normal memory accesses to the EL2&0 translation tables.

This bit has no effect on the EL3 translation regimes.

When this register has an architecturally-defined reset value, this field resets to 0.

A, bit [1]

Alignment check enable. This is the enable bit for Alignment fault checking at EL2 and EL0:

AMeaning
0

Alignment fault checking disabled when executing at EL2 and EL0.

Instructions that load or store one or more registers, other than load/store exclusive and load-acquire/store-release, do not check that the address being accessed is aligned to the size of the data element(s) being accessed.

1

Alignment fault checking enabled when executing at EL2 and EL0.

All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.

Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless of the value of the A bit.

When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.

M, bit [0]

MMU enable for EL2&0 stage 1 address translation. Possible values of this bit are:

MMeaning
0

EL2&0 stage 1 address translation disabled.

See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory.

1

EL2&1 stage 1 address translation enabled.

When this register has an architecturally-defined reset value, this field resets to 0.

Accessing the SCTLR_EL2

This register can be read using MRS with the following syntax:

MRS <Xt>, <systemreg>

This register can be written using MSR (register) with the following syntax:

MSR <systemreg>, <Xt>

This syntax uses the following encoding in the System instruction encoding space:

<systemreg> op0op1CRnCRmop2
SCTLR_EL21110000010000000
SCTLR_EL11100000010000000

Accessibility

The register is accessible as follows:

<systemreg> Control Accessibility
E2HTGENSEL0EL1EL2EL3
SCTLR_EL2xx0 - - n/a RW
SCTLR_EL2001 - - RWRW
SCTLR_EL2011 - n/a RWRW
SCTLR_EL2101 - - RWRW
SCTLR_EL2111 - n/a RWRW
SCTLR_EL1xx0 - SCTLR_EL1 n/a SCTLR_EL1
SCTLR_EL1001 - SCTLR_EL1 SCTLR_EL1 SCTLR_EL1
SCTLR_EL1011 - n/a SCTLR_EL1 SCTLR_EL1
SCTLR_EL1101 - SCTLR_EL1 RW SCTLR_EL1
SCTLR_EL1111 - n/a RW SCTLR_EL1

When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic SCTLR_EL2 or SCTLR_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic.




02/05/2017 15:43

Copyright © 2010-2017 ARM Limited or its affiliates. All rights reserved. This document is Non-Confidential.