TCR_EL3

This register is present only when EL3 is implemented. Otherwise, direct accesses to TCR_EL3 are UNDEFINED.

Attributes

Field descriptions

Bits [63:44]

DisCH0, bit [43]
When FEAT_D128 is implemented and TCR_EL3.D128 == 1:

Disable the Contiguous bit for the Start Table.

DisCH0	Meaning
0b0	The Contiguous bit of Block or Page descriptors of the Start Table is not affected by this field.
0b1	The Contiguous bit of Block or Page descriptors of the Start Table is treated as 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HAFT, bit [42]
When FEAT_HAFT is implemented:

Hardware managed Access Flag for Table descriptors.

Enables the Hardware managed Access Flag for Table descriptors.

HAFT	Meaning
0b0	Hardware managed Access Flag for Table descriptors is disabled.
0b1	Hardware managed Access Flag for Table descriptors is enabled.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

PTTWI, bit [41]
When FEAT_THE is implemented:

Permit Translation table walk Incoherence.

Permits RCWS instructions to generate writes that have the Reduced Coherence property.

PTTWI	Meaning
0b0	Write accesses generated by RCWS at EL3 do not have the Reduced Coherence property.
0b1	Write accesses generated by RCWS at EL3 have the Reduced Coherence property.

This bit is permitted to be implemented as a read-only bit with a fixed value of 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [40:39]

D128, bit [38]
When FEAT_D128 is implemented:

Enables VMSAv9-128 translation system.

D128	Meaning
0b0	Translation system follows VMSA-64 translation process.
0b1	Translation system follows VMSAv9-128 translation process.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

AIE, bit [37]
When FEAT_AIE is implemented:

Enable Attribute Indexing Extension.

AIE	Meaning
0b0	Attribute Indexing Extension Disabled.
0b1	Attribute Indexing Extension Enabled.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

POE, bit [36]
When FEAT_S1POE is implemented:

Enables Permission Overlay for EL3 accesses.

POE	Meaning
0b0	Permission overlay disabled for EL3 access in stage 1 of EL3 translation regime..
0b1	Permission overlay enabled for EL3 access in stage 1 of EL3 translation regime.

This bit is not permitted to be cached in a TLB.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

PIE, bit [35]
When FEAT_S1PIE is implemented:

Enables usage of Indirect Permission Scheme.

PIE	Meaning
0b0	Direct permission model.
0b1	Indirect permission model.

This field is RES1 when TCR_EL3.D128 is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

PnCH, bit [34]
When FEAT_THE is implemented:

Protected attribute enable. Indicates use of bit[52] of the stage 1 translation table entry for translations using TTBR0_EL3.

PnCH	Meaning
0b0	For translations using TTBR0_EL3, bit[52] of each stage 1 translation table entry does not indicate protected attribute.
0b1	For translations using TTBR0_EL3, bit[52] of each stage 1 translation table entry indicates protected attribute.

This field is RES1 when TCR_EL3.D128 is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

MTX, bit [33]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Extended memory tag checking.

This field controls address generation and tag checking when EL3 is using AArch64 where the data address would be translated by tables pointed to by TTBR0_EL3.

This control has an effect regardless of whether stage 1 of the EL3 translation regime is enabled or not.

MTX	Meaning
0b0	This control has no effect on the PE.
0b1	Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply: Bits[59:56] are treated as 0b0000 when checking if the address is out of range. If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field. A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

MTX

Meaning

0b0

This control has no effect on the PE.

0b1

Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:

Bits[59:56] are treated as 0b0000 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

DS, bit [32]
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR_EL3.D128 == 0):

This field affects whether a 52-bit output address can be described by the translation tables of the 4KB or 16KB translation granules.

DS	Meaning
0b0	Bits[49:48] of translation descriptors are RES0. Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware. The minimum value of TCR_EL3.T0SZ is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault. Output address[51:48] is 0b0000.
0b1	Bits[49:48] of translation descriptors hold output address[49:48]. Bits[9:8] of table translation descriptors hold output address[51:50]. The shareability information of Block and Page descriptors for cacheable locations is determined by TCR_EL3.SH0. The minimum value of TCR_EL3.T0SZ is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault. All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes. Bits[5:2] of TTBR0_EL3 are used to hold bits[51:48] of the output address in all cases. Note As FEAT_LVA must be implemented if TCR_EL3.DS == 1, the minimum value of the TCR_EL3.T0SZ field is 12, as determined by that extension. For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00. Note This forces alignment of the ranges used by the TLBI range instructions.

Meaning

0b0

Bits[49:48] of translation descriptors are RES0.

Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware.

The minimum value of TCR_EL3.T0SZ is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.

Output address[51:48] is 0b0000.

0b1

Bits[49:48] of translation descriptors hold output address[49:48].

Bits[9:8] of table translation descriptors hold output address[51:50].

The shareability information of Block and Page descriptors for cacheable locations is determined by TCR_EL3.SH0.

The minimum value of TCR_EL3.T0SZ is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.

All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes.

Bits[5:2] of TTBR0_EL3 are used to hold bits[51:48] of the output address in all cases.

Note

As FEAT_LVA must be implemented if TCR_EL3.DS == 1, the minimum value of the TCR_EL3.T0SZ field is 12, as determined by that extension.

For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00.

Note

This forces alignment of the ranges used by the TLBI range instructions.

This field is RES0 for a 64KB translation granule.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

The Effective value of this bit is 0b0.

Access to this field is RES0 .

Bit [31]

TCMA, bit [30]
When FEAT_MTE2 is implemented:

Controls the generation of Unchecked accesses at EL3 when address [59:56] = 0b0000.

TCMA	Meaning
0b0	This control has no effect on the generation of Unchecked accesses.
0b1	All accesses are Unchecked.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

TBID, bit [29]
When FEAT_PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

TBID	Meaning
0b0	TCR_EL3.TBI applies to Instruction and Data accesses.
0b1	TCR_EL3.TBI applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR0_EL3.

For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HWU62, bit [28]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry.

HWU62	Meaning
0b0	Bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HWU61, bit [27]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry.

HWU61	Meaning
0b0	Bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	Bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HWU60, bit [26]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry.

HWU60	Meaning
0b0	Bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HWU59, bit [25]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry.

HWU59	Meaning
0b0	Bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.

The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HPD, bit [24]
When FEAT_HPDS is implemented:

Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR0_EL3.

HPD	Meaning
0b0	Hierarchical permissions are enabled.
0b1	Hierarchical permissions are disabled. Note In this case, bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor attributes are required to be ignored by the PE, and are no longer reserved, allowing them to be used by software.

When disabled, the permissions are treated as if the bits are zero.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bit [23]

HD, bit [22]
When FEAT_HAFDBS is implemented:

Hardware management of dirty state in stage 1 translations from EL3.

HD	Meaning
0b0	Stage 1 hardware management of dirty state disabled.
0b1	Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

HA, bit [21]
When FEAT_HAFDBS is implemented:

Hardware Access flag update in stage 1 translations from EL3.

HA	Meaning
0b0	Stage 1 Access flag update disabled.
0b1	Stage 1 Access flag update enabled.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

TBI, bit [20]

Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the TTBR0_EL3 region, or ignored and used for tagged addresses.

TBI	Meaning
0b0	Top Byte used in the address calculation.
0b1	Top Byte ignored in the address calculation.

This affects addresses generated in EL3 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL3. It has an effect whether the EL3 translation regime is enabled or not.

If FEAT_PAuth is implemented and TCR_EL3.TBID is 1, then this field only applies to Data accesses.

Otherwise, if the value of TBI is 1, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:

A branch or procedure return within EL3.
A exception taken to EL3.
An exception return to EL3.

For more information, see 'Address tagging'.

Note

This control detrmines the scope of address tagging. It never causes an exception to be generated.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Bit [19]

PS, bits [18:16]

Physical Address Size.

PS	Meaning	Applies when
0b000	32 bits, 4GB.
0b001	36 bits, 64GB.
0b010	40 bits, 1TB.
0b011	42 bits, 4TB.
0b100	44 bits, 16TB.
0b101	48 bits, 256TB.
0b110	52 bits, 4PB.
0b111	56 bits, 64PB.	When FEAT_D128 is implemented

The value 0b110 represents the following output address sizes:

For the 64KB translation granule size, if FEAT_LPA is implemented, the value 0b110 represents 52 bits.
For the 4KB and 16KB translation granule sizes, if FEAT_LPA is implemented and the Effective value of TCR_EL3.DS is 0b1, then the value 0b110 represents 52 bits.
Otherwise, the value 0b110 behaves as the 0b101 value and represents 48 bits.

If the value of ID_AA64MMFR0_EL1.PARange is 0b0111, and the value of this field is not 0b111 or a value treated as 0b111, then bits[55:52] of every translation table base address are 0b0000 for the stage of translation controlled by TCR_EL3.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

TG0, bits [15:14]

Granule size for the TTBR0_EL3.

TG0	Meaning
0b00	4KB.
0b01	64KB.
0b10	16KB.

Other values are reserved.

If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

SH0, bits [13:12]

Shareability attribute for memory associated with translation table walks using TTBR0_EL3.

SH0	Meaning
0b00	Non-shareable.
0b10	Outer Shareable.
0b11	Inner Shareable.

Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

ORGN0, bits [11:10]

Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL3.

ORGN0	Meaning
0b00	Normal memory, Outer Non-cacheable.
0b01	Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

IRGN0, bits [9:8]

Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL3.

IRGN0	Meaning
0b00	Normal memory, Inner Non-cacheable.
0b01	Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Bits [7:6]

T0SZ, bits [5:0]

The size offset of the memory region addressed by TTBR0_EL3. The region size is 2^(64-T0SZ) bytes.

The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

Note

For the 4KB translation granule, if FEAT_LPA2 is implemented and this field is less than 16, the translation table walk begins with a level -1 initial lookup.

For the 16KB translation granule, if FEAT_LPA2 is implemented and this field is less than 17, the translation table walk begins with a level 0 initial lookup.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing TCR_EL3

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, TCR_EL3

op0	op1	CRn	CRm	op2
0b11	0b110	0b0010	0b0000	0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then X[t, 64] = TCR_EL3;

MSR TCR_EL3, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b110	0b0010	0b0000	0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then if IsFeatureImplemented(FEAT_FGWTE3) && FGWTE3_EL3.TCR_EL3 == '1' then AArch64.SystemAccessTrap(EL3, 0x18); else TCR_EL3 = X[t, 64];

63	62	61	60	59	58	57	56	55	54	53	52	51	50	49	48	47	46	45	44	43	42	41	40	39	38	37	36	35	34	33	32
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0																				DisCH0	HAFT	PTTWI	RES0		D128	AIE	POE	PIE	PnCH	MTX	DS
RES1	TCMA	TBID	HWU62	HWU61	HWU60	HWU59	HPD	RES1	HD	HA	TBI	RES0	PS			TG0		SH0		ORGN0		IRGN0		RES0		T0SZ

TCR_EL3, Translation Control Register (EL3)

Purpose

Configuration

Attributes

Field descriptions

Bits [63:44]

DisCH0, bit [43]When FEAT_D128 is implemented and TCR_EL3.D128 == 1:

Otherwise:

HAFT, bit [42]When FEAT_HAFT is implemented:

Otherwise:

PTTWI, bit [41]When FEAT_THE is implemented:

Otherwise:

Bits [40:39]

D128, bit [38]When FEAT_D128 is implemented:

Otherwise:

AIE, bit [37]When FEAT_AIE is implemented:

Otherwise:

POE, bit [36]When FEAT_S1POE is implemented:

Otherwise:

PIE, bit [35]When FEAT_S1PIE is implemented:

Otherwise:

PnCH, bit [34]When FEAT_THE is implemented:

Otherwise:

MTX, bit [33]When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Otherwise:

DS, bit [32]When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR_EL3.D128 == 0):

Otherwise:

Bit [31]

TCMA, bit [30]When FEAT_MTE2 is implemented:

Otherwise:

TBID, bit [29]When FEAT_PAuth is implemented:

Otherwise:

HWU62, bit [28]When FEAT_HPDS2 is implemented:

Otherwise:

HWU61, bit [27]When FEAT_HPDS2 is implemented:

Otherwise:

HWU60, bit [26]When FEAT_HPDS2 is implemented:

Otherwise:

HWU59, bit [25]When FEAT_HPDS2 is implemented:

Otherwise:

HPD, bit [24]When FEAT_HPDS is implemented:

Otherwise:

Bit [23]

HD, bit [22]When FEAT_HAFDBS is implemented:

Otherwise:

HA, bit [21]When FEAT_HAFDBS is implemented:

Otherwise:

TBI, bit [20]

Bit [19]

PS, bits [18:16]

TG0, bits [15:14]

SH0, bits [13:12]

ORGN0, bits [11:10]

IRGN0, bits [9:8]

Bits [7:6]

T0SZ, bits [5:0]

Accessing TCR_EL3

MRS <Xt>, TCR_EL3

MSR TCR_EL3, <Xt>

DisCH0, bit [43]
When FEAT_D128 is implemented and TCR_EL3.D128 == 1:

HAFT, bit [42]
When FEAT_HAFT is implemented:

PTTWI, bit [41]
When FEAT_THE is implemented:

D128, bit [38]
When FEAT_D128 is implemented:

AIE, bit [37]
When FEAT_AIE is implemented:

POE, bit [36]
When FEAT_S1POE is implemented:

PIE, bit [35]
When FEAT_S1PIE is implemented:

PnCH, bit [34]
When FEAT_THE is implemented:

MTX, bit [33]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

DS, bit [32]
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR_EL3.D128 == 0):

TCMA, bit [30]
When FEAT_MTE2 is implemented:

TBID, bit [29]
When FEAT_PAuth is implemented:

HWU62, bit [28]
When FEAT_HPDS2 is implemented:

HWU61, bit [27]
When FEAT_HPDS2 is implemented:

HWU60, bit [26]
When FEAT_HPDS2 is implemented:

HWU59, bit [25]
When FEAT_HPDS2 is implemented:

HPD, bit [24]
When FEAT_HPDS is implemented:

HD, bit [22]
When FEAT_HAFDBS is implemented:

HA, bit [21]
When FEAT_HAFDBS is implemented: