You copied the Doc URL to your clipboard.

SCTLR_EL2, System Control Register (EL2)

The SCTLR_EL2 characteristics are:

Purpose

Provides top level control of the system, including its memory system, at EL2.

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, these controls apply also to execution at EL0.

Configuration

AArch64 System register SCTLR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HSCTLR[31:0] .

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

Some or all RW fields of this register have defined reset values. These apply only if the PE resets into EL2 using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN values.

Attributes

SCTLR_EL2 is a 64-bit register.

Field descriptions

The SCTLR_EL2 bit assignments are:

When HCR_EL2.E2H != 0b1 or HCR_EL2.TGE != 0b1:

This format applies in all Armv8.0 implementations, and from Armv8.1 when the Effective value of HCR_EL2.{E2H, TGE} != {1, 1}.

Bits [63:45]

Reserved, RES0.

DSSBS, bit [44]

When ARMv8.0-SSBS is implemented:

Default PSTATE.SSBS value on Exception Entry.

DSSBSMeaning
0b0

PSTATE.SSBS is set to 0 on an exception to EL2.

0b1

PSTATE.SSBS is set to 1 on an exception to EL2.

In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value.


Otherwise:

Reserved, RES0.

ATA, bit [43]

When ARMv8.5-MemTag is implemented:

Allocation Tag Access. When SCR_EL3.ATA=1, controls EL2 access to Allocation Tags.

When access to Allocation Tags is prevented:

  • Instructions which Load or Store data are Unchecked.

  • Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI.

  • Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used to generate the Logical Address Tag as 0.

  • Cache maintenance instructions which invalidate Allocation Tags from caches behave as the equivalent Clean and Invalidate operation on Allocation Tags.

ATAMeaning
0b0

Access to Allocation Tags is prevented.

0b1

Access to Allocation Tags is not prevented.

This bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bit [42]

Reserved, RES0.

TCF, bits [41:40]

When ARMv8.5-MemTag is implemented:

Tack Check Fail in EL2. Controls the effect of tag check fails due to Loads and Stores in EL2.

TCFMeaning
0b00

Tag check fails have no effect on the PE.

0b01

Tag check fails causes a synchronous exception.

0b10

Tag check fails are asynchronously accumulated.

The value 0b11 is reserved.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bits [39:38]

Reserved, RES0.

ITFSB, bit [37]

When ARMv8.5-MemTag is implemented:

When synchronous exceptions are not being generated by Tag Check fails which are generated for Loads and Stores in EL0, EL1 or EL2, controls the auto-synchronisaton of Tag Check fails into TFSRE0_EL1, TFSR_EL1 and TFSR_EL2.

ITFSBMeaning
0b0

Tag check fails are not synchronized on entry to EL2.

0b1

Tag check fails are synchronized on entry to EL2.


Otherwise:

Reserved, RES0.

BT, bit [36]

When ARMv8.5-BTI is implemented:

PAC Branch Type compatibility at EL2.

BTMeaning
0b0

When the PE is executing at EL2, PACIASP and PACIBSP are compatible with PSTATE.BTYPE == 0b11.

0b1

When the PE is executing at EL2, PACIASP and PACIBSP are not compatible with PSTATE.BTYPE == 0b11.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bits [35:32]

Reserved, RES0.

EnIA, bit [31]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnIAMeaning
0b0

Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is not enabled.

0b1

Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is enabled.

Note

This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

EnIB, bit [30]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnIBMeaning
0b0

Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not enabled.

0b1

Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is enabled.

Note

This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bits [29:28]

Reserved, RES1.

EnDA, bit [27]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APDAKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnDAMeaning
0b0

Pointer authentication (using the APDAKey_EL1 key) of data addresses is not enabled.

0b1

Pointer authentication (using the APDAKey_EL1 key) of data addresses is enabled.

Note

This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bit [26]

Reserved, RES0.

EE, bit [25]

Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime.

The possible values of this bit are:

EEMeaning
0b0

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime are little-endian.

0b1

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL1&0 translation regime are big-endian.

If an implementation does not provide Big-endian support at Exception Levels higher than EL0, this bit is RES0.

If an implementation does not provide Little-endian support at Exception Levels higher than EL0, this bit is RES1.

The EE bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value.

Bit [24]

Reserved, RES0.

Bit [23]

Reserved, RES1.

EIS, bit [22]

When ARMv8.5-CSEH is implemented:

Exception entry is a context synchronization event. The defined values are:

EISMeaning
0b0

The taking of an exception to EL2 is not a context synchronization event.

0b1

The taking of an exception to EL2 is a context synchronization event.

If SCTLR_EL2.EIS is set to 0b0:

  • Indirect writes to ESR_EL2, FAR_EL2, SPSR_EL2, ELR_EL2, HPFAR_EL2 are synchronized on exception entry to EL2, so that a direct read of the register after exception entry sees the indirectly written value caused by the exception entry.
  • Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
  • Exception Catch debug events are synchronous debug events.
  • DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL2.EIS:

  • Changes to the PSTATE information on entry to EL2.
  • Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
  • Exit from Debug state.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

IESB, bit [21]

When ARMv8.2-IESB is implemented:

Implicit Error Synchronization event enable.

IESBMeaning
0b0

Disabled.

0b1

An implicit error synchronization event is added:

  • At each exception taken to EL2.
  • Before the operational pseudocode of each ERET instruction executed at EL2.

When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL2 and before each DRPS instruction executed at EL2, in addition to the other cases where it is added.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bit [20]

Reserved, RES0.

WXN, bit [19]

Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit can force all memory regions that are writable to be treated as XN:

WXNMeaning
0b0

This control has no effect on memory access permissions.

0b1

Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for accesses from software executing at EL2.

This bit applies only when SCTLR_EL2.M bit is set.

The WXN bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

Bit [18]

Reserved, RES1.

Bit [17]

Reserved, RES0.

Bit [16]

Reserved, RES1.

Bits [15:14]

Reserved, RES0.

EnDB, bit [13]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnDBMeaning
0b0

Pointer authentication (using the APDBKey_EL1 key) of data addresses is not enabled.

0b1

Pointer authentication (using the APDBKey_EL1 key) of data addresses is enabled.

Note

This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

I, bit [12]

Instruction access Cacheability control, for accesses at EL2:

IMeaning
0b0

All instruction access to Normal memory from EL2 are Non-cacheable for all levels of instruction and unified cache.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or EL2&0 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable memory.

0b1

This control has no effect on the Cacheability of instruction access to Normal memory from EL2.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or EL2&0 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.

This bit has no effect on the EL1&0 or EL3 translation regimes.

In a system where the PE resets into EL2, this field resets to 0.

EOS, bit [11]

When ARMv8.5-CSEH is implemented:

Exception exit is a context synchronization Event.

EOSMeaning
0b0

An exception return from EL2 is not a context synchronization event.

0b1

An exception return from EL2 is a context synchronization event.

If SCTLR_EL2.EOS is set to 0b0:

  • Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
  • Exception Catch debug events are synchronous debug events.
  • DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL2.EOS:

  • The indirect write of the PSTATE and PC values from SPSR_EL2 and ELR_EL2 on exception return is synchronized.
  • Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
  • Exit from Debug state.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

Bits [10:7]

Reserved, RES0.

nAA, bit [6]

When ARMv8.4-LSE is implemented:

Non-aligned access. This bit controls generation of Alignment faults at EL2 under certain conditions.

nAAMeaning
0b0

LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and STLURH generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 bytes for accesses.

0b1

This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 bytes.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bits [5:4]

Reserved, RES1.

SA, bit [3]

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

C, bit [2]

Cacheability control, for data accesses.

CMeaning
0b0

All data access to Normal memory from EL2, and all Normal memory accesses to the EL2 translation tables, are Non-cacheable for all levels of data and unified cache.

0b1

This control has no effect on the Cacheability of:

  • Data access to Normal memory from EL2.

  • Normal memory accesses to the EL2 translation tables.

This bit has no effect on the EL1&0 or EL3 translation regimes.

In a system where the PE resets into EL2, this field resets to 0.

A, bit [1]

Alignment check enable. This is the enable bit for Alignment fault checking at EL2:

AMeaning
0b0

Alignment fault checking disabled when executing at EL2.

Instructions that load or store one or more registers, other than load/store exclusive and load-acquire/store-release, do not check that the address being accessed is aligned to the size of the data element(s) being accessed.

0b1

Alignment fault checking enabled when executing at EL2.

All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.

Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless of the value of the A bit.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

M, bit [0]

MMU enable for EL2 stage 1 address translation. Possible values of this bit are:

MMeaning
0b0

EL2 stage 1 address translation disabled.

See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory.

0b1

EL2 stage 1 address translation enabled.

In a system where the PE resets into EL2, this field resets to 0.

When HCR_EL2.E2H == 0b1 and HCR_EL2.TGE == 0b1:
6362616059585756555453525150494847464544434241403938373635343332
RES0TWEDELTWEDEnDSSBSATAATA0TCFTCF0ITFSBBT1BT0RES0
EnIAEnIBLSMAOEnTLSMDEnDAUCIEEE0ESPANEISIESBTSCXTWXNnTWERES0nTWIUCTDZEEnDBIEOSEnRCTXRES0SEDITDnAACP15BENSA0SACAM
313029282726252423222120191817161514131211109876543210
313029282726252423222120191817161514131211109876543210

This format applies only from Armv8.1 when EL2 is enabled in the current Security state and HCR_EL2.{E2H, TGE} == {1, 1}.

Bits [63:50]

Reserved, RES0.

TWEDEL, bits [49:46]

When ARMv8.6-TWED is implemented:

TWE Delay. A 4-bit unsigned number that, when SCTLR_EL2.TWEDEn is 1, encodes the minimum delay in taking a trap of WFE caused by SCTLR_EL2.nTWE as 2^(TWEDEL + 8) cycles.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

TWEDEn, bit [45]

When ARMv8.6-TWED is implemented:

TWE Delay Enable. Enables a configurable delayed trap of the WFE instruction caused by SCTLR_EL2.nTWE.

TWEDEnMeaning
0b0

The delay for taking a WFE trap is IMPLEMENTATION DEFINED.

0b1

The delay for taking a WFE trap is at least the number of cycles defined in SCTLR_EL2.TWEDEL.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

DSSBS, bit [44]

When ARMv8.0-SSBS is implemented:

Default PSTATE.SSBS value on Exception Entry.

DSSBSMeaning
0b0

PSTATE.SSBS is set to 0 on an exception to EL2.

0b1

PSTATE.SSBS is set to 1 on an exception to EL2.

In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value.


Otherwise:

Reserved, RES0.

ATA, bit [43]

When ARMv8.5-MemTag is implemented:

Allocation Tag Access in EL2. When SCR_EL3.ATA=1, controls EL2 access to Allocation Tags.

When access to Allocation Tags is prevented:

  • Instructions which Load or Store data are Unchecked.

  • Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI.

  • Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used to generate the Logical Address Tag as 0.

  • Cache maintenance instructions which invalidate Allocation Tags from caches behave as the equivalent Clean and Invalidate operation on Allocation Tags.

ATAMeaning
0b0

Access to Allocation Tags is prevented.

0b1

Access to Allocation Tags is not prevented.

This bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

ATA0, bit [42]

When ARMv8.5-MemTag is implemented:

Allocation Tag Access in EL0. When SCR_EL3.ATA=1, controls EL0 access to Allocation Tags.

When access to Allocation Tags is prevented:

  • Instructions which Load or Store data are Unchecked.

  • Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI.

  • Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used to generate the Logical Address Tag as 0.

  • Cache maintenance instructions which invalidate Allocation Tags from caches behave as the equivalent Clean and Invalidate operation on Allocation Tags.

ATA0Meaning
0b0

Access to Allocation Tags is prevented.

0b1

Access to Allocation Tags is not prevented.

This field is permitted to be cached in a TLB.

Note

Software may change this control bit on a context switch.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

TCF, bits [41:40]

When ARMv8.5-MemTag is implemented:

Tag Check Fail in EL2. Controls the effect of tag check fails due to Loads and Stores in EL2.

TCFMeaning
0b00

Tag check fails have no effect on the PE.

0b01

Tag check fails causes a synchronous exception.

0b10

Tag check fails are asynchronously accumulated.

The value 0b11 is reserved.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

TCF0, bits [39:38]

When ARMv8.5-MemTag is implemented:

Tag Check Fail in EL0. Controls the effect of tag check fails due to Loads and Stores in EL0.

TCF0Meaning
0b00

Tag check fails have no effect on the PE.

0b01

Tag check fails causes a synchronous exception.

0b10

Tag check fails are asynchronously accumulated.

The value 0b11 is reserved.

Note

Software may change this control bit on a context switch.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

ITFSB, bit [37]

When ARMv8.5-MemTag is implemented:

When synchronous exceptions are not being generated by Tag Check fails which are generated for Loads and Stores in EL0, EL1 or EL2, controls the auto-synchronizaton of Tag Check fails into TFSRE0_EL1, TFSR_EL1 and TFSR_EL2.

ITFSBMeaning
0b0

Tag check fails are not synchronized on entry to EL2.

0b1

Tag check fails are synchronized on entry to EL2.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

BT1, bit [36]

When ARMv8.5-BTI is implemented:

PAC Branch Type compatibility at EL2.

BT1Meaning
0b0

When the PE is executing at EL2, PACIASP and PACIBSP are compatible with PSTATE.BTYPE == 0b11.

0b1

When the PE is executing at EL2, PACIASP and PACIBSP are not compatible with PSTATE.BTYPE == 0b11.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

BT0, bit [35]

When ARMv8.5-BTI is implemented:

PAC Branch Type compatibility at EL0.

BT0Meaning
0b0

When the PE is executing at EL0, PACIASP and PACIBSP are compatible with PSTATE.BTYPE == 0b11.

0b1

When the PE is executing at EL0, PACIASP and PACIBSP are not compatible with PSTATE.BTYPE == 0b11.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bits [34:32]

Reserved, RES0.

EnIA, bit [31]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnIAMeaning
0b0

Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is not enabled.

0b1

Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is enabled.

Note

This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

EnIB, bit [30]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnIBMeaning
0b0

Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not enabled.

0b1

Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is enabled.

Note

This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

LSMAOE, bit [29]

When ARMv8.2-LSMAOC is implemented:

Load Multiple and Store Multiple Atomicity and Ordering Enable.

LSMAOEMeaning
0b0

For all memory accesses at EL0, A32 and T32 Load Multiple and Store Multiple can have an interrupt taken during the sequence memory accesses, and the memory accesses are not required to be ordered.

0b1

The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple at EL0 is as defined for Armv8.0.

This bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

nTLSMD, bit [28]

When ARMv8.2-LSMAOC is implemented:

No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE memory.

nTLSMDMeaning
0b0

All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL0 that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and generate a stage 1 Alignment fault.

0b1

All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL0 that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.

This bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

EnDA, bit [27]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APDAKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnDAMeaning
0b0

Pointer authentication (using the APDAKey_EL1 key) of data addresses is not enabled.

0b1

Pointer authentication (using the APDAKey_EL1 key) of data addresses is enabled.

Note

This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

UCI, bit [26]

Traps EL0 execution of cache maintenance instructions to EL2, from AArch64 state only. This applies to DC CVAU, DC CIVAC, DC CVAC, DC CVAP, and IC IVAU.

If ARMv8.2-DCCVADP is implemented, this trap also applies to DC CVADP.

If ARMv8.5-MemTag is implemented, this trap also applies to DC CIGVAC, DC CIGDVAC, DC CGVAC, DC CGDVAC, DC CGVAP, and DC CGDVAP.

If ARMv8.2-DCCVADP and ARMv8.5-MemTag are implemented, this trap also applies to DC CGVADP and DC CGDVADP.

UCIMeaning
0b0

Any attempt to execute an instruction that this trap applies to at EL0 using AArch64 is trapped to EL2.

0b1

This control does not cause any instructions to be trapped.

If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.

If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean by VA to the Point of Unification instruction can be trapped when the value of this control is 1.

If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED whether the execution of any instruction cache invalidate by VA to the Point of Unification instruction can be trapped when the value of this control is 1.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

EE, bit [25]

Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime.

The possible values of this bit are:

EEMeaning
0b0

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime are little-endian.

0b1

Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation regime, and stage 2 translation table walks in the EL2&0 translation regime are big-endian.

If an implementation does not provide Big-endian support at Exception Levels higher than EL0, this bit is RES0.

If an implementation does not provide Little-endian support at Exception Levels higher than EL0, this bit is RES1.

The EE bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value.

E0E, bit [24]

Endianness of data accesses at EL0.

E0EMeaning
0b0

Explicit data accesses at EL0 are little-endian.

0b1

Explicit data accesses at EL0 are big-endian.

If an implementation only supports Little-endian accesses at EL0 then this bit is RES0. This option is not permitted when SCTLR_EL1.EE is RES1.

If an implementation only supports Big-endian accesses at EL0 then this bit is RES1. This option is not permitted when SCTLR_EL1.EE is RES0.

This bit has no effect on the endianness of LDTR, LDTRH, LDTRSH, LDTRSW, STTR, and STTRH instructions executed at EL1.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

SPAN, bit [23]

Set Privileged Access Never, on taking an exception to EL2.

SPANMeaning
0b0

PSTATE.PAN is set to 1 on taking an exception to EL2.

0b1

The value of PSTATE.PAN is left unchanged on taking an exception to EL2.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

EIS, bit [22]

When ARMv8.5-CSEH is implemented:

Exception Entry is a context synchronization event.

EISMeaning
0b0

The taking of an exception to EL2 is not a context synchronization event.

0b1

The taking of an exception to EL2 is a context synchronization event.

If SCTLR_EL2.EIS is set to 0b0:

  • Indirect writes to ESR_EL2, FAR_EL2, SPSR_EL2, ELR_EL2, HPFAR_EL2 are synchronized on exception entry to EL2, so that a direct read of the register after exception entry sees the indirectly written value caused by the exception entry.
  • Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
  • Exception Catch debug events are synchronous debug events.
  • DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL2.EIS:

  • Changes to the PSTATE information on entry to EL2.
  • Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
  • Exit from Debug state.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

IESB, bit [21]

When ARMv8.2-IESB is implemented:

Implicit Error Synchronization event Enable.

IESBMeaning
0b0

Disabled.

0b1

An implicit error synchronization event is added:

  • After each exception taken to EL2.
  • Before the operational pseudocode of each ERET instruction executed at EL2.

When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL2 and before each DRPS instruction executed at EL2, in addition to the other cases where it is added.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

TSCXT, bit [20]

When ARMv8.0-CSV2 is implemented:

Trap EL0 Access to the SCXTNUM_EL0 register, when EL0 is using AArch64.

TSCXTMeaning
0b0

EL0 access to SCXTNUM_EL0 is not disabled by this mechanism.

0b1

EL0 access to SCXTNUM_EL0 is disabled, causing an exception to EL2, and the SCXTNUM_EL0 value is treated at 0.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

WXN, bit [19]

Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit can force all memory regions that are writable to be treated as XN. The possible values of this bit are:

WXNMeaning
0b0

This control has no effect on memory access permissions.

0b1

Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for accesses from software executing at EL2.

This bit applies only when SCTLR_EL2.M bit is set.

The WXN bit is permitted to be cached in a TLB.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

nTWE, bit [18]

Traps EL0 execution of WFE instructions to EL2, from both Execution states.

nTWEMeaning
0b0

Any attempt to execute a WFE instruction at EL0 is trapped to EL2, if the instruction would otherwise have caused the PE to enter a low-power state.

0b1

This control does not cause any instructions to be trapped.

In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

Bit [17]

Reserved, RES0.

nTWI, bit [16]

Traps EL0 execution of WFI instructions to EL2, from both Execution states.

nTWIMeaning
0b0

Any attempt to execute a WFI instruction at EL0 is trapped EL2, if the instruction would otherwise have caused the PE to enter a low-power state.

0b1

This control does not cause any instructions to be trapped.

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.

Note

Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

UCT, bit [15]

Traps EL0 accesses to the CTR_EL0 to EL2, from AArch64 state only.

UCTMeaning
0b0

Accesses to the CTR_EL0 from EL0 using AArch64 are trapped to EL2.

0b1

This control does not cause any instructions to be trapped.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

DZE, bit [14]

Traps EL0 execution of DC ZVA instructions to EL2, from AArch64 state only.

If ARMv8.5-MemTag is implemented, this trap also applies to DC GVA and DC GZVA.

DZEMeaning
0b0

Any attempt to execute an instruction that this trap applies to at EL0 using AArch64 is trapped to EL2. Reading DCZID_EL0.DZP from EL0 returns 1, indicating that the instructions that this trap applies to are not supported.

0b1

This control does not cause any instructions to be trapped.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

EnDB, bit [13]

When ARMv8.3-PAuth is implemented:

Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses in the EL2&0 translation regime.

For more information, see 'System register control of pointer authentication' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

EnDBMeaning
0b0

Pointer authentication (using the APDBKey_EL1 key) of data addresses is not enabled.

0b1

Pointer authentication (using the APDBKey_EL1 key) of data addresses is enabled.

Note

This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

I, bit [12]

Instruction access Cacheability control, for accesses at EL2 and EL0:

IMeaning
0b0

All instruction access to Normal memory from EL2 and EL0 are Non-cacheable for all levels of instruction and unified cache.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable memory.

0b1

This control has no effect on the Cacheability of instruction access to Normal memory from EL2 and EL0.

If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.

This bit has no effect on the EL3 translation regimes.

In a system where the PE resets into EL2, this field resets to 0.

EOS, bit [11]

When ARMv8.5-CSEH is implemented:

Exception exit is a context synchronization event.

EOSMeaning
0b0

An exception return from EL2 is not a context synchronization event.

0b1

An exception return from EL2 is a context synchronization event.

If SCTLR_EL2.EOS is set to 0b0:

  • Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
  • Exception Catch debug events are synchronous debug events.
  • DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL2.EOS:

  • The indirect write of the PSTATE and PC values from SPSR_EL2 and ELR_EL2 on exception return is synchronized.
  • Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
  • Exit from Debug state.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES1.

EnRCTX, bit [10]

When ARMv8.0-PredInv is implemented:

Enable EL0 Access to the AArch32 CFPRCTX, DVPRCTX and CPPRCTX instructions, and the AArch64 CFP RCTX, DVP RCT and CPP RCTX System instructions.

EnRCTXMeaning
0b0

EL0 access to these instructions is disabled, and these instructions are trapped to EL1.

0b1

EL0 access to these instructions is enabled.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

Bit [9]

Reserved, RES0.

SED, bit [8]

SETEND instruction disable. Disables SETEND instructions at EL0 using AArch32.

SEDMeaning
0b0

SETEND instruction execution is enabled at EL0 using AArch32.

0b1

SETEND instructions are UNDEFINED at EL0 using AArch32.

If the implementation does not support mixed-endian operation at any Exception level, this bit is RES1.

If EL0 cannot use AArch32, this bit is RES1.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

ITD, bit [7]

IT Disable. Disables some uses of IT instructions at EL0 using AArch32.

ITDMeaning
0b0

All IT instruction functionality is enabled at EL0 using AArch32.

0b1

Any attempt at EL0 using AArch32 to execute any of the following is UNDEFINED:

  • All encodings of the IT instruction with hw1[3:0]!=1000.
  • All encodings of the subsequent instruction with the following values for hw1:
    • 0b11xxxxxxxxxxxxxx: All 32-bit instructions, and the 16-bit instructions B, UDF, SVC, LDM, and STM.
    • 0b1011xxxxxxxxxxxx: All instructions in 'Miscellaneous 16-bit instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section F3.2.5.
    • 0b10100xxxxxxxxxxx: ADD Rd, PC, #imm
    • 0b01001xxxxxxxxxxx: LDR Rd, [PC, #imm]
    • 0b0100x1xxx1111xxx: ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; BLX PC.
    • 0b010001xx1xxxx111: ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This pattern also covers UNPREDICTABLE cases with BLX Rn.

These instructions are always UNDEFINED, regardless of whether they would pass or fail the condition code check that applies to them as a result of being in an IT block.

It is IMPLEMENTATION DEFINED whether the IT instruction is treated as:

  • A 16-bit instruction, that can only be followed by another 16-bit instruction.
  • The first half of a 32-bit instruction.

This means that, for the situations that are UNDEFINED, either the second 16-bit instruction or the 32-bit instruction is UNDEFINED.

An implementation might vary dynamically as to whether IT is treated as a 16-bit instruction or the first half of a 32-bit instruction.

If an instruction in an active IT block that would be disabled by this field sets this field to 1 then behavior is CONSTRAINED UNPREDICTABLE. For more information see 'Changes to an ITD control by an instruction in an IT block' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section E1.2.4

If EL0 cannot use AArch32, this bit is RES1.

ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the SCTLR_EL1. If it is not implemented then this bit is RAZ/WI.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

nAA, bit [6]

When ARMv8.4-LSE is implemented:

Non-aligned access. This bit controls generation of Alignment faults at EL2 and EL0 under certain conditions.

nAAMeaning
0b0

LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and STLURH generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 bytes for accesses.

0b1

This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 bytes.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.


Otherwise:

Reserved, RES0.

CP15BEN, bit [5]

System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System instructions in the (coproc==0b1111) encoding space from EL0:

CP15BENMeaning
0b0

EL0 using AArch32: EL0 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is UNDEFINED.

0b1

EL0 using AArch32: EL0 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is enabled.

If EL0 cannot use AArch32, this bit is RES0.

CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in the SCTLR_EL1. If it is not implemented then this bit is RAO/WI.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

SA0, bit [4]

SP Alignment check enable for EL0. When set to 1, if a load or store instruction executed at EL0 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

SA, bit [3]

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

C, bit [2]

Cacheability control, for data accesses.

CMeaning
0b0

All data access to Normal memory from EL2 and EL0, and all Normal memory accesses to the EL2&0 translation tables, are Non-cacheable for all levels of data and unified cache.

0b1

This control has no effect on the Cacheability of:

  • Data access to Normal memory from EL2 and EL0.
  • Normal memory accesses to the EL2&0 translation tables.

This bit has no effect on the EL3 translation regimes.

In a system where the PE resets into EL2, this field resets to 0.

A, bit [1]

Alignment check enable. This is the enable bit for Alignment fault checking at EL2 and EL0.

AMeaning
0b0

Alignment fault checking disabled when executing at EL2 and EL0.

Instructions that load or store one or more registers, other than load/store exclusive and load-acquire/store-release, do not check that the address being accessed is aligned to the size of the data element(s) being accessed.

0b1

Alignment fault checking enabled when executing at EL2 and EL0.

All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.

Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless of the value of the A bit.

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value.

M, bit [0]

MMU enable for EL2&0 stage 1 address translation. Possible values of this bit are:

MMeaning
0b0

EL2&0 stage 1 address translation disabled.

See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory.

0b1

EL2&0 stage 1 address translation enabled.

In a system where the PE resets into EL2, this field resets to 0.

Accessing the SCTLR_EL2

When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic SCTLR_EL2 or SCTLR_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic.

Accesses to this register use the following encodings:

MRS <Xt>, SCTLR_EL2

op0op1CRnCRmop2
0b110b1000b00010b00000b000
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() && HCR_EL2.NV == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    else
        UNDEFINED;
elsif PSTATE.EL == EL2 then
    return SCTLR_EL2;
elsif PSTATE.EL == EL3 then
    return SCTLR_EL2;
              

MSR SCTLR_EL2, <Xt>

op0op1CRnCRmop2
0b110b1000b00010b00000b000
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() && HCR_EL2.NV == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    else
        UNDEFINED;
elsif PSTATE.EL == EL2 then
    SCTLR_EL2 = X[t];
elsif PSTATE.EL == EL3 then
    SCTLR_EL2 = X[t];
              

MRS <Xt>, SCTLR_EL1

op0op1CRnCRmop2
0b110b0000b00010b00000b000
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    elsif EL2Enabled() && !ELUsingAArch32(EL2) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGRTR_EL2.SCTLR_EL1 == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then
        return NVMem[0x110];
    else
        return SCTLR_EL1;
elsif PSTATE.EL == EL2 then
    if HCR_EL2.E2H == '1' then
        return SCTLR_EL2;
    else
        return SCTLR_EL1;
elsif PSTATE.EL == EL3 then
    return SCTLR_EL1;
              

MSR SCTLR_EL1, <Xt>

op0op1CRnCRmop2
0b110b0000b00010b00000b000
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    elsif EL2Enabled() && !ELUsingAArch32(EL2) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGWTR_EL2.SCTLR_EL1 == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then
        NVMem[0x110] = X[t];
    else
        SCTLR_EL1 = X[t];
elsif PSTATE.EL == EL2 then
    if HCR_EL2.E2H == '1' then
        SCTLR_EL2 = X[t];
    else
        SCTLR_EL1 = X[t];
elsif PSTATE.EL == EL3 then
    SCTLR_EL1 = X[t];
              


Was this page helpful? Yes No