SysReg_v83A_xml-00bet4 (old)htmldiff from-SysReg_v83A_xml-00bet4(new) SysReg_v83A_xml-00bet5

HCR_EL2, Hypervisor Configuration Register

The HCR_EL2 characteristics are:

Purpose

Provides configuration controls for virtualization, including defining whether various Non-secure operations are trapped to EL2.

This register is part of the Virtualization registers functional group.

Configuration

AArch64 System register HCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HCR.

AArch64 System register HCR_EL2 bits [63:32] are architecturally mapped to AArch32 System register HCR2.

If EL2 is not implemented, this register is RES0 from EL3.

RW fields in this register reset to architecturally UNKNOWN values.

Attributes

HCR_EL2 is a 64-bit register.

Field descriptions

The HCR_EL2 bit assignments are:

6362616059585756555453525150494847464544434241403938373635343332
0000000000000000000ATNV1NVAPIAPK0MIOCNCETEATERRTLORE2HIDCD
RWTRVMHCDTDZTGETVMTTLBTPUTPCPTSWTACRTIDCPTSCTID3TID2TID1TID0TWETWIDCBSUFBVSEVIVFAMOIMOFMOPTWSWIOVM
313029282726252423222120191817161514131211109876543210

Bits [63:45]

Reserved, RES0.

AT, bit [44]
In ARMv8.3:

Present only if ARMv8.3-NV is implemented.

Address Translation. Non-secure EL1 execution of following address translation instructions is trapped to EL2:

AT S1E0R, AT S1E0W, AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP

ATMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 execution of the specified instructions is trapped to EL2.

If ARMv8.3-NV is not implemented, this field is RES0.


In ARMv8.2, ARMv8.1 and ARMv8.0:

Reserved, RES0.

NV1, bit [43]
In ARMv8.3:

Present only if ARMv8.3-NV is implemented.

Nested virtualization. Non-secure EL1 accesses to registers VBAR_EL1, ELR_EL1, SPSR_EL1 are trapped to EL2.

NV1Meaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 accesses to the specified registers are trapped to EL2.

If HCR_EL2.NV is 1 and HCR_EL2.NV1 is 0 then the following effects also apply:

If the bits HCR_EL2.NV and HCR_EL2.NV1 are both set to 1 then following effects also apply:

This bit is permitted to be cached in a TLB.

If ARMv8.3-NV is not implemented, this field is RES0.


In ARMv8.2, ARMv8.1 and ARMv8.0:

Reserved, RES0.

NV, bit [42]
In ARMv8.3:

Present only if ARMv8.3-NV is implemented.

Nested virtualization. Non-secure EL1 accesses to the special purpose or system registers or the execution of the EL1 or EL2 translation regime address translation and TLB maintenance instructions, are trapped to EL2.

NVMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 accesses to the specified registers or the execution of the specified instructions are trapped to EL2. Non-secure EL1 read accesses to the CurrentEL register return a value of 0x2.

The system or special purpose registers for which accesses are trapped are as follows:

The priority of the trap to EL2 as a result of the above accesses is higher than any other resulting exception.

The following special purpose registers are trapped: SPSR_irq, SPSR_abt, SPSR_und, SPSR_fiq, SP_EL1.

The instructions for which the execution is trapped are as follows:

This bit is permitted to be cached in a TLB.

Note

Nested virtualization is supported for a Guest Hypervisor using any of below:

If ARMv8.3-NV is not implemented, this field is RES0.


In ARMv8.2, ARMv8.1 and ARMv8.0:

Reserved, RES0.

API, bit [41]
In ARMv8.3:

Present only if ARMv8.3-TPAuth is implemented.

Controls the use of instructions related to Pointer Authentication:

Defined values are:

APIMeaning
0

Use of instructions related to Pointer Authentication in Non-secure EL0 when HCR_EL2.TGE==0 || HCR_EL2.E2H==0, or in Non-secure EL1 when the instructions are enabled for the Non-secure EL1 translation regime, is trapped to EL2. If HCR_EL2.NV is 1, the HCR_EL2.NV trap takes precedence over the HCR_EL2.API trap for the ERETAA and ERETAB instructions.

1

This control does not cause any instructions to be trapped.

Note

If ARMv8.3-TPAuth is implemented but EL2 is not implemented, the system behaves as if this bit is 1.

If ARMv8.3-TPAuth is not implemented, this field is RES0.


In ARMv8.2, ARMv8.1 and ARMv8.0:

Reserved, RES0.

APK, bit [40]
In ARMv8.3:

Present only if ARMv8.3-TPAuth is implemented.

Trap registers holding "key" values for Pointer Authentication. Traps accesses to the following registers from Non-secure EL1 to EL2:

Defined values are:

APKMeaning
0

Access to the registers holding "key" values for pointer authentication from non-secure EL1 are trapped to EL2.

1

This control does not cause any instructions to be trapped.

Note

If ARMv8.3-TPAuth is implemented but EL2 is not implemented, the system behaves as if this bit is 1.

If ARMv8.3-TPAuth is not implemented, this field is RES0.


In ARMv8.2, ARMv8.1 and ARMv8.0:

Reserved, RES0.

Bit [39]

Reserved, RES0.

MIOCNCE, bit [38]

Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the Non-secure EL1&0 translation regime.

MIOCNCEMeaning
0

For the Non-secure EL1&0 translation regime, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there must be no loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute.

1

For the Non-secure EL1&0 translation regime, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there might be a loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute.

For more information see 'Mismatched memory attributes' in the ARMv8 ARM, section B2 (The AArch64 Application Level Memory Model).

This field can be implemented as RAZ/WI.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.

TEA, bit [37]

Route synchronous External abort exceptions to EL2. If the RAS Extension is implemented, the possible values of this bit are:

TEAMeaning
0

Does not route synchronous External abort exceptions from Non-secure EL0 and EL1 to EL2.

1

Route synchronous External abort exceptions from Non-secure EL0 and EL1 to EL2, if not routed to EL3.

This bit resets to zero on a Warm reset into AArch32 state.

When the RAS Extension is not implemented, this field is RES0.

TERR, bit [36]

Trap Error record accesses. If the RAS Extension is implemented, the possible values of this bit are:

TERRMeaning
0

Does not trap accesses to error record registers from Non-secure EL1 to EL2.

1

Accesses to the ER* registers from Non-secure EL1 generate a Trap exception to EL2.

This bit resets to zero on a Warm reset into AArch32 state.

When the RAS Extension is not implemented, this field is RES0.

TLOR, bit [35]
In ARMv8.3, ARMv8.2 and ARMv8.1:

Trap LOR registers. Traps accesses to the LORSA_EL1, LOREA_EL1, LORN_EL1, LORC_EL1, and LORID_EL1 registers from Non-secure EL1 to EL2.

TLORMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 accesses to the LOR registers are trapped to EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.


In ARMv8.0:

Reserved, RES0.

E2H, bit [34]
In ARMv8.3, ARMv8.2 and ARMv8.1:

EL2 Host. Enables a configuration where a Host Operating System is running in EL2, and the Host Operating System's applications are running in EL0.

E2HMeaning
0

EL2 is running a hypervisor.

1

EL2 is running a Host Operating System.

For information on the behavior of this bit see Behavior of HCR_EL2.E2H.

This bit is permitted to be cached in a TLB.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.


In ARMv8.0:

Reserved, RES0.

ID, bit [33]

Stage 2 Instruction access cacheability disable. For the Non-secure EL1&0 translation regime, when HCR_EL2.VM==1, this control forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable.

IDMeaning
0

This control has no effect on stage 2 of the Non-secure EL1&0 translation regime.

1

For the Non-secure EL1&0 translation regime, forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

This bit has no effect on the EL2, EL2&0, or EL3 translation regimes.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.

CD, bit [32]

Stage 2 Data access cacheability disable. For the Non-secure EL1&0 translation regime, when HCR_EL2.VM==1, this control forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable.

CDMeaning
0

This control has no effect on stage 2 of the Non-secure EL1&0 translation regime for data accesses and translation table walks.

1

For the Non-secure EL1&0 translation regime, forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

This bit has no effect on the EL2, EL2&0, or EL3 translation regimes.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.

RW, bit [31]

Execution state control for lower Exception levels:

RWMeaning
0

Lower levels are all AArch32.

1

The Execution state for EL1 is AArch64. The Execution state for EL0 is determined by the current value of PSTATE.nRW when executing at EL0.

If all lower Exception levels cannot use AArch32 then this bit is RAO/WI.

In an implementation that includes EL3, when SCR_EL3.NS==0, the PE behaves as if this bit has the same value as the SCR_EL3.RW bit for all purposes other than a direct read or write access of HCR_EL2.

The RW bit is permitted to be cached in a TLB.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 1 for all purposes other than a direct read of the value of this bit.

TRVM, bit [30]

Trap Reads of Virtual Memory controls. Traps Non-secure EL1 reads of the virtual memory control registers to EL2, from both Execution states. The registers for which read accesses are trapped are as follows:

Non-secure EL1 using AArch64: SCTLR_EL1, TTBR0_EL1, TTBR1_EL1, TCR_EL1, ESR_EL1, FAR_EL1, AFSR0_EL1, AFSR1_EL1, MAIR_EL1, AMAIR_EL1, CONTEXTIDR_EL1.

Non-secure EL1 using AArch32: SCTLR, TTBR0, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR, NMRR, MAIR0, MAIR1, AMAIR0, AMAIR1, CONTEXTIDR.

TRVMMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 read accesses to the specified Virtual Memory controls are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

HCD, bit [29]

HVC instruction disable. Disables Non-secure state execution of HVC instructions, from both Execution states.

HCDMeaning
0

HVC instruction execution is enabled at EL2 and Non-secure EL1.

1

HVC instructions are UNDEFINED at EL2 and Non-secure EL1. Any resulting exception is taken to the Exception level at which the HVC instruction is executed.

Note

HVC instructions are always UNDEFINED at EL0.

This bit is only implemented if EL3 is not implemented. Otherwise, it is RES0.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TDZ, bit [28]

Trap DC ZVA instructions. Traps Non-secure EL0 and EL1 execution of DC ZVA instructions to EL2, from AArch64 state only.

TDZMeaning
0

This control does not cause any instructions to be trapped.

1

In AArch64 state, any attempt to execute a DC ZVA instruction at Non-secure EL1, or at Non-secure EL0 when the instruction is not UNDEFINED at EL0, is trapped to EL2.

Reading the DCZID_EL0 returns a value that indicates that DC ZVA instructions are not supported.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TGE, bit [27]

Trap General Exceptions, from Non-secure EL0.

TGEMeaning
0

This control has no effect on execution at EL0.

1

When the value of SCR_EL3.NS is 0, this control has no effect on execution at EL0.

When the value of SCR_EL3.NS is 1, in all cases:

  • All exceptions that would be routed to EL1 are routed to EL2.
  • The SCTLR_EL1.M field, or the SCTLR.M field if EL1 is using AArch32, is treated as being 0 for all purposes other than returning the result of a direct read of SCTLR_EL1 or SCTLR.
  • All virtual interrupts are disabled.
  • Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are disabled.
  • An exception return to EL1 is treated as an illegal exception return.

When the value of SCR_EL3.NS is 1 and the value of HCR_EL2.E2H is 0, additionally:

  • The HCR_EL2.{FMO, IMO, AMO} fields are treated as being 1 for all purposes other than a direct read or write access of HCR_EL2.
  • The MDCR_EL2.{TDRA,TDOSA,TDA, TDE} fields are treated as being 1 for all purposes other than returning the result of a direct read of MDCR_EL2.

For information on the behavior of this bit when E2H is 1, see Behavior of HCR_EL2.E2H.

HCR_EL2.TGE must not be cached in a TLB.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

TVM, bit [26]

Trap Virtual Memory controls. Traps Non-secure EL1 writes to the virtual memory control registers to EL2, from both Execution states. The registers for which write accesses are trapped are as follows:

Non-secure EL1 using AArch64: SCTLR_EL1, TTBR0_EL1, TTBR1_EL1, TCR_EL1, ESR_EL1, FAR_EL1, AFSR0_EL1, AFSR1_EL1, MAIR_EL1, AMAIR_EL1, CONTEXTIDR_EL1.

Non-secure EL1 using AArch32: SCTLR, TTBR0, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR, NMRR, MAIR0, MAIR1, AMAIR0, AMAIR1, CONTEXTIDR.

TVMMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 write accesses to the specified EL1 virtual memory control registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TTLB, bit [25]

Trap TLB maintenance instructions. Traps Non-secure EL1 execution of TLB maintenance instructions to EL2, from both Execution states. This applies to the following instructions:

TTLBMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 execution of the specified TLB maintenance instructions are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TPU, bit [24]

Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of those cache maintenance instructions at Non-secure EL1 or EL0 using AArch64, and at Non-secure EL1 using AArch32, to EL2. This applies to the following instructions:

Note

An exception generated because an instruction is UNDEFINED at EL0 is higher priority than this trap to EL2. In addition:

TPUMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure execution of the specified instructions is trapped to EL2.

If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean by VA to the point of unification instruction can be trapped when the value of this control is 1.

If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED whether the execution of any instruction cache invalidate to the point of unification instruction can be trapped when the value of this control is 1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TPCP, bit [23]
In ARMv8.3 and ARMv8.2:

Trap data or unified cache maintenance instructions that operate to the Point of Coherency or Persistence. Traps execution of those cache maintenance instructions at Non-secure EL1 or EL0 using AArch64, and at Non-secure EL1 using AArch32, to EL2. This applies to the following instructions:

Note
TPCPMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure execution of the specified instructions is trapped to EL2.

If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

If HCR_EL2.{E2H, TGE} is set to {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.


In ARMv8.1 and ARMv8.0:

Trap data or unified cache maintenance instructions that operate to the Point of Coherency. Traps execution of those cache maintenance instructions at Non-secure EL1 or EL0 using AArch64, and at Non-secure EL1 using AArch32, to EL2. This applies to the following instructions:

Note
TPCMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure execution of the specified instructions is trapped to EL2.

If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TSW, bit [22]

Trap data or unified cache maintenance instructions that operate by Set/Way. Traps execution of those cache maintenance instructions at Non-secure EL1 using AArch64, and at Non-secure EL1 using AArch32, to EL2. This applies to the following instructions:

Note

An exception generated because an instruction is UNDEFINED at EL0 is higher priority than this trap to EL2, and these instructions are always UNDEFINED at EL0.

TSWMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure execution of the specified instructions is trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TACR, bit [21]

Trap Auxiliary Control Registers. Traps Non-secure EL1 accesses to the Auxiliary Control Registers to EL2, from both Execution states. This applies to the following register accesses:

TACRMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 accesses to the specified registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TIDCP, bit [20]

Trap IMPLEMENTATION DEFINED functionality. Traps Non-secure EL1 accesses to the encodings reserved for IMPLEMENTATION DEFINED functionality to EL2. This applies to the following register accesses:

AArch64: The following reserved encoding spaces:

AArch32: MCR and MRC instructions accessing the following encodings:

When the value of HCR_EL2.TIDCP is 1, it is IMPLEMENTATION DEFINED whether any of this functionality accessed from Non-secure EL0 is trapped to EL2. If it is not, then it is UNDEFINED, and any attempt to access it from Non-secure EL0 generates an exception that is taken to EL1.

TIDCPMeaning
0

This control does not cause any instructions to be trapped.

1

Non-secure EL1 accesses to or execution of the specified encodings reserved for IMPLEMENTATION DEFINED functionality are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

TSC, bit [19]

Trap SMC instructions. Traps Non-secure EL1 execution of SMC instructions to EL2, from both Execution states.

TSCMeaning
0

This control does not cause any instructions to be trapped.

1

If EL3 is implemented, then any attempt to execute an SMC instruction at Non-secure EL1 using AArch64 or Non-secure EL1 using AArch32 is trapped to EL2, regardless of the value of SCR_EL3.SMD.

If EL3 is not implemented, ARMv8.3-NV is implemented, and HCR_EL2.NV is 1, then any attempt to execute an SMC instruction at Non-secure EL1 using AArch64 is trapped to EL2.

In AArch32 state, the ARMv8-A architecture permits, but does not require, this trap to apply to conditional SMC instructions that fail their condition code check, in the same way as with traps on other conditional instructions.

If EL3 is not implemented, and HCR_EL2.NV is 0, this bit is RES0.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TID3, bit [18]

Trap ID group 3. Traps Non-secure EL1 reads of the following registers to EL2:

AArch64: ID_PFR0_EL1, ID_PFR1_EL1, ID_DFR0_EL1, ID_AFR0_EL1, ID_MMFR0_EL1, ID_MMFR1_EL1, ID_MMFR2_EL1, ID_MMFR3_EL1, ID_ISAR0_EL1, ID_ISAR1_EL1, ID_ISAR2_EL1, ID_ISAR3_EL1, ID_ISAR4_EL1, ID_ISAR5_EL1, MVFR0_EL1, MVFR1_EL1, MVFR2_EL1, ID_AA64PFR0_EL1, ID_AA64PFR1_EL1, ID_AA64DFR0_EL1, ID_AA64DFR1_EL1, ID_AA64ISAR0_EL1, ID_AA64ISAR1_EL1, ID_AA64MMFR0_EL1, ID_AA64MMFR1_EL1, ID_AA64MMFR2_EL1, ID_AA64AFR0_EL1, ID_AA64AFR1_EL1, ID_AA64ZFR0_EL1 (where SVE is implemented), and ID_MMFR4_EL1, except that if ID_MMFR4_EL1 is implemented as RAZ/WI then it is IMPLEMENTATION DEFINED whether accesses to ID_MMFR4_EL1 are trapped.

It is IMPLEMENTATION DEFINED whether this field traps MRS accesses to encodings in the following range that are not already mentioned in this field description:

AArch32: ID_PFR0, ID_PFR1, ID_DFR0, ID_AFR0, ID_MMFR0, ID_MMFR1, ID_MMFR2, ID_MMFR3, ID_ISAR0, ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, ID_ISAR5, MVFR0, MVFR1, MVFR2, and ID_MMFR4, except that if ID_MMFR4 is implemented as RAZ/WI then it is IMPLEMENTATION DEFINED whether accesses to ID_MMFR4 are trapped.

MRC access to any of the following encodings are also trapped:

It is IMPLEMENTATION DEFINED whether this bit traps MRC accesses to the following encodings:

TID3Meaning
0

This control does not cause any instructions to be trapped.

1

The specified Non-secure EL1 read accesses to ID group 3 registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TID2, bit [17]

Trap ID group 2. Traps the following register accesses to EL2:

AArch64:

AArch32:

TID2Meaning
0

This control does not cause any instructions to be trapped.

1

The specified Non-secure EL1 and EL0 accesses to ID group 2 registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TID1, bit [16]

Trap ID group 1. Traps Non-secure EL1 reads of the following registers are trapped to EL2:

AArch64: REVIDR_EL1, AIDR_EL1.

AArch32: TCMTR, TLBTR, REVIDR, AIDR.

TID1Meaning
0

This control does not cause any instructions to be trapped.

1

The specified Non-secure EL1 read accesses to ID group 1 registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

TID0, bit [15]

Trap ID group 0. Traps the following register accesses to EL2:

AArch64: None.

AArch32:

Note
TID0Meaning
0

This control does not cause any instructions to be trapped.

1

The specified Non-secure EL1 read accesses to ID group 0 registers are trapped to EL2.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

In an AArch64-only implementation, this bit is RES0.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TWE, bit [14]

Traps Non-secure EL0 and EL1 execution of WFE instructions to EL2, from both Execution states.

TWEMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFE instruction at Non-secure EL0 or EL1 is trapped to EL2, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWE or SCTLR_EL1.nTWE.

In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

Note

Since a WFE can complete at any time, even without a Wakeup event, the traps on WFE are not guaranteed to be taken, even if the WFE is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

TWI, bit [13]

Traps Non-secure EL0 and EL1 execution of WFI instructions to EL2, from both Execution states.

TWIMeaning
0

This control does not cause any instructions to be trapped.

1

Any attempt to execute a WFI instruction at Non-secure EL0 or EL1 is trapped to EL2, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWI or SCTLR_EL1.nTWI.

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

Note

Since a WFI can complete at any time, even without a Wakeup event, the traps on WFI are not guaranteed to be taken, even if the WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

DC, bit [12]

Default Cacheability.

DCMeaning
0

This control has no effect on the Non-secure EL1&0 translation regime.

1

In Non-secure state:

  • When EL1 is using AArch64, the PE behaves as if the value of the SCTLR_EL1.M field is 0 for all purposes other than returning the value of a direct read of SCTLR_EL1.
  • When EL1 is using AArch32, the PE behaves as if the value of the SCTLR.M field is 0 for all purposes other than returning the value of a direct read of SCTLR.
  • The PE behaves as if the value of the HCR_EL2.VM field is 1 for all purposes other than returning the value of a direct read of HCR_EL2.
  • The memory type produced by stage 1 of the EL1&0 translation regime is Normal Non-Shareable, Inner Write-Back Read-Allocate Write-Allocate, Outer Write-Back Read-Allocate Write-Allocate.

This field has no effect on the EL2, EL2&0, and EL3 translation regimes.

This field is permitted to be cached in a TLB.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this field.

BSU, bits [11:10]

Barrier Shareability upgrade. This field determines the minimum shareability domain that is applied to any barrier instruction executed from Non-secure EL1 or Non-secure EL0:

BSUMeaning
00

No effect

01

Inner Shareable

10

Outer Shareable

11

Full system

This value is combined with the specified level of the barrier held in its instruction, using the same principles as combining the shareability attributes from two stages of address translation.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0b00 for all purposes other than a direct read of the value of this bit.

FB, bit [9]

Force broadcast. Causes the following instructions to be broadcast within the Inner Shareable domain when executed from Non-secure EL1:

AArch32: BPIALL, TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID, ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, ICIALLU, TLBIMVAL, TLBIMVAAL.

AArch64: TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI VAALE1, IC IALLU.

FBMeaning
0

This field has no effect on the operation of the specified instructions.

1

When one of the specified instruction is executed at Non-secure EL1, the instruction is broadcast within the Inner Shareable shareability domain.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

VSE, bit [8]

Virtual SError interrupt.

VSEMeaning
0

This mechanism is not making a virtual SError interrupt pending.

1

A virtual SError interrupt is pending because of this mechanism.

The virtual SError interrupt is only enabled when the value of HCR_EL2.{TGE, AMO} is {0, 1}.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

VI, bit [7]

Virtual IRQ Interrupt.

VIMeaning
0

This mechanism is not making a virtual IRQ pending.

1

A virtual IRQ is pending because of this mechanism.

The virtual IRQ is enabled only when the value of HCR_EL2.{TGE, IMO} is {0, 1}.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

VF, bit [6]

Virtual FIQ Interrupt.

VFMeaning
0

This mechanism is not making a virtual FIQ pending.

1

A virtual FIQ is pending because of this mechanism.

The virtual FIQ is enabled only when the value of HCR_EL2.{TGE, FMO} is {0, 1}.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

AMO, bit [5]

Physical SError interrupt routing.

AMOMeaning
0

When executing at Non-secure Exception levels below EL2, physical SError interrupts are not taken to EL2.

When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using AArch64, physical SError interrupts are not taken unless they are routed to EL3 by the SCR_EL3.EA bit.

Virtual SError interrupts are disabled.

1

When executing at any Exception level in Non-secure state:

  • Physical SError interrupts are taken to EL2 unless they are routed to EL3.
  • If HCR_EL2.TGE==0 then virtual SError interrupts are enabled in the Non-secure state.

If the value of HCR_EL2.TGE is 1:

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1 (The AArch64 System Level Programmers' Model).

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

IMO, bit [4]

Physical IRQ Routing.

IMOMeaning
0

When executing at Non-secure Exception levels below EL2, physical IRQ interrupts are not taken to EL2.

When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using AArch64, physical IRQ interrupts are not taken unless they are routed to EL3 by the SCR_EL3.IRQ bit.

Virtual IRQ interrupts are disabled.

1

When executing at any Exception level in Non-secure state:

  • Physical IRQ interrupts are taken to EL2 unless they are routed to EL3.
  • If HCR_EL2.TGE==0 then Virtual IRQ interrupts are enabled in Non-secure state.

If the value of HCR_EL2.TGE is 1:

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

FMO, bit [3]

Physical FIQ Routing.

FMOMeaning
0

When executing at Non-secure Exception levels below EL2, physical FIQ interrupts are not taken to EL2.

When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using AArch64, physical FIQ interrupts are not taken unless they are routed to EL3 by the SCR_EL3.FIQ bit.

Virtual FIQ interrupts are disabled.

1

When executing at any Exception level in Non-secure state:

  • Physical FIQ interrupts are taken to EL2 unless they are routed to EL3.
  • If HCR_EL2.TGE==0 then Virtual FIQ interrupts are enabled in Non-secure state.

If the value of HCR_EL2.TGE is 1:

For more information, see 'Asynchronous exception routing' in the ARMv8 ARM, section D1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

PTW, bit [2]

Protected Table Walk. In the Non-secure EL1&0 translation regime, a translation table access made as part of a stage 1 translation table walk is subject to a stage 2 translation. The combining of the memory type attributes from the two stages of translation means the access might be made to a type of Device memory. If this occurs then the value of this bit determines the behavior:

PTWMeaning
0

The translation table walk occurs as if it is to Normal Non-cacheable memory. This means it can be made speculatively.

1

The memory access generates a stage 2 Permission fault.

This field is permitted to be cached in a TLB.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

SWIO, bit [1]

Set/Way Invalidation Override. Causes Non-secure EL1 execution of the data cache invalidate by set/way instructions to perform a data cache clean and invalidate by set/way:

SWIOMeaning
0

This control has no effect on the operation of data cache invalidate by set/way instructions.

1

Data cache invalidate by set/way instructions perform a data cache clean and invalidate by set/way.

When the value of this bit is 1:

AArch32: DCISW performs the same invalidation as a DCCISW instruction.

AArch64: DC ISW performs the same invalidation as a DC CISW instruction.

This bit can be implemented as RES1.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.

VM, bit [0]

Virtualization enable. Enables stage 2 address translation for the Non-secure EL1&0 translation regime. Possible values of this bit are:

VMMeaning
0

Non-secure EL1&0 stage 2 address translation disabled.

1

Non-secure EL1&0 stage 2 address translation enabled.

When the value of this bit is 1, data cache invalidate instructions executed at Non-secure EL1 perform a data cache clean and invalidate. For the invalidate by set/way instruction this behavior applies regardless of the value of the HCR_EL2.SWIO bit.

This bit is permitted to be cached in a TLB.

In an implementation that includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves as if this field is 0 for all purposes other than a direct read or write access of HCR_EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.

Accessing the HCR_EL2

This register can be read using MRS with the following syntax:

MRS <Xt>, <systemreg>

This register can be written using MSR (register) with the following syntax:

MSR <systemreg>, <Xt>

This syntax uses the following encoding in the System instruction encoding space:

<systemreg> op0op1CRnCRmop2
HCR_EL21110000010001000

Accessibility

The register is accessible as follows:

Control Accessibility
E2HTGENSEL0EL1EL2EL3
xx0 - - n/a RW
001 - - RWRW
011 - n/a RWRW
101 - - RWRW
111 - n/a RWRW

This table applies to all instructions that can access this register.

Traps and enables

For a description of the prioritization of any generated exceptions, see section D1.13.2 (Synchronous exception prioritization) in the ARM® Architecture Reference Manual, ARMv8, for ARMv8-A architecture profile. Subject to the prioritization rules, the following traps and enables are applicable when accessing this register.

When EL2 is implemented and is using AArch64 and SCR_EL3.NS==1 && HCR_EL2.E2H==0 :

When EL2 is implemented and is using AArch64 and SCR_EL3.NS==1 && HCR_EL2.E2H==1 && HCR_EL2.TGE==0 :




28/0907/2017 0816:2440

Copyright © 2010-2017 ARM Limited or its affiliates. All rights reserved. This document is Non-Confidential.

SysReg_v83A_xml-00bet4 (old)htmldiff from-SysReg_v83A_xml-00bet4(new) SysReg_v83A_xml-00bet5