The HCR_EL2 characteristics are:
Provides configuration controls for virtualization, including defining whether various operations are trapped to EL2.
AArch64 System register HCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HCR[31:0] .
AArch64 System register HCR_EL2 bits [63:32] are architecturally mapped to AArch32 System register HCR2[31:0] .
If EL2 is not implemented, this register is RES0 from EL3.
The bits in this register behave as if they are 0 for all purposes other than direct reads of the register if EL2 is not enabled in the current Security state.
RW fields in this register reset to architecturally UNKNOWN values.
HCR_EL2 is a 64-bit register.
The HCR_EL2 bit assignments are:
63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32 |
RES0 | TTLBOS | TTLBIS | EnSCXT | TOCU | RES0 | TICAB | TID4 | RES0 | MIOCNCE | TEA | TERR | TLOR | E2H | ID | CD | ||||||||||||||||
RW | TRVM | HCD | TDZ | TGE | TVM | TTLB | TPU | TPCP | TSW | TACR | TIDCP | TSC | TID3 | TID2 | TID1 | TID0 | TWE | TWI | DC | BSU | FB | VSE | VI | VF | AMO | IMO | FMO | PTW | SWIO | VM | |
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
Reserved, RES0.
Trap TLB maintenance instructions that operate on the Outer Shareable domain. Traps execution of those TLB maintenance instructions at EL1 using AArch64 to EL2 when EL2 is enabled in the current Security state. This applies to the following instructions:
TLBI VMALLE1OS, TLBI VAE1OS, TLBI ASIDE1OS,TLBI VAAE1OS, TLBI VALE1OS, TLBI VAALE1OS,TLBI RVAE1OS, TLBI RVAAE1OS,TLBI RVALE1OS, and TLBI RVAALE1OS.
TTLBOS | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions are trapped to EL2. |
If ARMv8.2-EVT is not implemented, this field is RES0.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Trap TLB maintenance instructions that operate on the Inner Shareable domain. Traps execution of those TLB maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state. This applies to the following instructions:
TTLBIS | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions are trapped to EL2. |
If ARMv8.2-EVT is not implemented, this field is RES0.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Enable Access to the SCXTNUM_EL1 and SCXTNUM_EL0 registers. The defined values are:
EnSCXT | Meaning |
---|---|
0b0 |
When (HCR_EL2.TGE==0 or HCR_EL2.E2H==0) and EL2 is enabled in the current Security state , EL1 and EL0 access to SCXTNUM_EL0 and EL1 access to SCXTNUM_EL1 is disabled by this mechanism, causing an exception to EL2, and the values of these registers to be treated as 0. When ((HCR_EL2.TGE==1 and HCR_EL2.E2H==1) and EL2 is enabled in the current Security state , EL0 access to SCXTNUM_EL0 is disabled by this mechanism, causing an exception to EL2, and the value of this register to be treated as 0. |
0b1 |
This control does not cause accesses to SCXTNUM_EL0 or SCXTNUM_EL1 to be trapped. |
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit has no effect on execution at EL0.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of those cache maintenance instructions at EL1 or EL0 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state. This applies to the following instructions:
An exception generated because an instruction is UNDEFINED at EL0 is higher priority than this trap to EL2. In addition:
TOCU | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions are trapped to EL2. |
If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean by VA to the Point of Unification instruction can be trapped when the value of this control is 1.
If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Reserved, RES0.
Trap ICIALLUIS/IC IALLUIS cache maintenance instructions. Traps execution of those cache maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state. This applies to the following instructions:
TICAB | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 execution of the specified instructions is trapped to EL2. |
If ARMv8.2-EVT is not implemented, this field is RES0.
If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Trap ID group 4. Traps the following register accesses to EL2, when EL2 is enabled in the current Security state:
AArch64:
AArch32:
TID4 | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
The specified EL1 and EL0 accesses to ID group 4 registers are trapped to EL2. |
If ARMv8.2-EVT is not implemented, this field is RES0.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Reserved, RES0.
Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the EL1&0 translation regimes.
MIOCNCE | Meaning |
---|---|
0b0 |
For the EL1&0 translation regimes, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there must be no loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute. |
0b1 |
For the EL1&0 translation regimes, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there might be a loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute. |
For more information see 'Mismatched memory attributes' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section B2 (The AArch64 Application Level Memory Model).
This field can be implemented as RAZ/WI.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Route synchronous External abort exceptions to EL2. If the RAS Extension is implemented, the possible values of this bit are:
TEA | Meaning |
---|---|
0b0 |
This control does not cause exceptions to be routed from EL0 and EL1 to EL2. |
0b1 |
Route synchronous External abort exceptions from EL0 and EL1 to EL2, when EL2 is enabled in the current Security state, if not routed to EL3. |
When the RAS Extension is not implemented, this field is RES0.
This field resets to an architecturally UNKNOWN value.
Trap Error record accesses. Trap accesses to the RAS error registers from EL1 to EL2 as follows:
TERR | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Accesses to the specified registers from EL1 generate a Trap exception to EL2, when EL2 is enabled in the current Security state. |
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Trap LOR registers. Traps accesses to the LORSA_EL1, LOREA_EL1, LORN_EL1, LORC_EL1, and LORID_EL1 registers from EL1 to EL2, when EL2 is enabled in the current Security state.
TLOR | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 accesses to the LOR registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
EL2 Host. Enables a configuration where a Host Operating System is running in EL2, and the Host Operating System's applications are running in EL0.
E2H | Meaning |
---|---|
0b0 |
The facilities to support a Host Operating System at EL2 are disabled. |
0b1 |
The facilities to support a Host Operating System at EL2 are enabled. |
For information on the behavior of this bit see Behavior of HCR_EL2.E2H.
This bit is permitted to be cached in a TLB.
This field resets to an architecturally UNKNOWN value.
Reserved, RES0.
Stage 2 Instruction access cacheability disable. For the EL1&0 translation regime, when EL2 is enabled in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable.
ID | Meaning |
---|---|
0b0 |
This control has no effect on stage 2 of the EL1&0 translation regime. |
0b1 |
Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable. |
This bit has no effect on the EL2, EL2&0, or EL3 translation regimes.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Stage 2 Data access cacheability disable. For the EL1&0 translation regime, when EL2 is enabled in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable.
CD | Meaning |
---|---|
0b0 |
This control has no effect on stage 2 of the EL1&0 translation regime for data accesses and translation table walks. |
0b1 |
Forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable. |
This bit has no effect on the EL2, EL2&0, or EL3 translation regimes.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Execution state control for lower Exception levels:
RW | Meaning |
---|---|
0b0 |
Lower levels are all AArch32. |
0b1 |
The Execution state for EL1 is AArch64. The Execution state for EL0 is determined by the current value of PSTATE.nRW when executing at EL0. |
If AArch32 state is not supported by the implementation at EL1, then this bit is RAO/WI.
In an implementation that includes EL3, when EL2 is not enabled in Secure state, the PE behaves as if this bit has the same value as the SCR_EL3.RW bit for all purposes other than a direct read or write access of HCR_EL2.
The RW bit is permitted to be cached in a TLB.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 1 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap Reads of Virtual Memory controls. Traps EL1 reads of the virtual memory control registers to EL2, when EL2 is enabled in the current Security state, from both Execution states as follows:
If EL1 is using AArch64 state, the following registers are trapped to EL2 and reported using EC syndrome value 0x18.
If EL1 is using AArch32 state, accesses using MRC to the following registers are trapped to EL2 and reported using EC syndrome value 0x03, accesses using MRRC are trapped to EL2 and reported using EC syndrome value 0x04:
TRVM | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 read accesses to the specified Virtual Memory controls are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
EL2 provides a second stage of address translation, that a hypervisor can use to remap the address map defined by a Guest OS. In addition, a hypervisor can trap attempts by a Guest OS to write to the registers that control the memory system. A hypervisor might use this trap as part of its virtualization of memory management.
This field resets to an architecturally UNKNOWN value.
HVC instruction disable. Disables EL1 execution of HVC instructions, from both Execution states, when EL2 is enabled in the current Security state, reported using EC syndrome value 0x00.
HCD | Meaning |
---|---|
0b0 |
HVC instruction execution is enabled at EL2 and EL1. |
0b1 |
HVC instructions are UNDEFINED at EL2 and EL1. Any resulting exception is taken to the Exception level at which the HVC instruction is executed. |
HVC instructions are always UNDEFINED at EL0.
This bit is only implemented if EL3 is not implemented. Otherwise, it is RES0.
This field resets to an architecturally UNKNOWN value.
Trap DC ZVA instructions. Traps EL0 and EL1 execution of DC ZVA instructions to EL2, when EL2 is enabled in the current Security state, from AArch64 state only, reported using EC syndrome value 0x18.
TDZ | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
In AArch64 state, any attempt to execute an instruction this trap applies to at EL1, or at EL0 when the instruction is not UNDEFINED at EL0, is trapped to EL2 when EL2 is enabled in the current Security state. Reading the DCZID_EL0 returns a value that indicates that the instructions this trap applies to are not supported. |
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap General Exceptions, from EL0.
TGE | Meaning |
---|---|
0b0 |
This control has no effect on execution at EL0. |
0b1 |
When EL2 is not enabled in the current Security state, this control has no effect on execution at EL0. When EL2 is enabled in the current Security state, in all cases:
In addition, when EL2 is enabled in the current Security state, if:
For further information on the behavior of this bit when E2H is 1, see Behavior of HCR_EL2.E2H. |
HCR_EL2.TGE must not be cached in a TLB.
This field resets to an architecturally UNKNOWN value.
Trap Virtual Memory controls. Traps EL1 writes to the virtual memory control registers to EL2, when EL2 is enabled in the current Security state, from both Execution states as follows:
If EL1 is using AArch64 state, the following registers are trapped to EL2 and reported using EC syndrome value 0x18:
If EL1 is using AArch32 state, accesses using MCR to the following registers are trapped to EL2 and reported using EC syndrome value 0x03, accesses using MCRR are trapped to EL2 and reported using EC syndrome value 0x04:
TVM | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 write accesses to the specified EL1 virtual memory control registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap TLB maintenance instructions. Traps EL1 execution of TLB maintenance instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states. This applies to the following instructions:
TTLB | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 execution of the specified TLB maintenance instructions are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of those cache maintenance instructions at EL1 or EL0 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state as follows:
An exception generated because an instruction is UNDEFINED at EL0 is higher priority than this trap to EL2. In addition:
TPU | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state. |
If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean by VA to the Point of Unification instruction can be trapped when the value of this control is 1.
If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap data or unified cache maintenance instructions that operate to the Point of Coherency or Persistence. Traps execution of those cache maintenance instructions at EL1 or EL0 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state as follows:
If ARMv8.2-DCCVADP is implemented, this trap also applies to DC CVADP.
TPCP | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state. |
If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.
If HCR_EL2.{E2H, TGE} is set to {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap data or unified cache maintenance instructions that operate to the Point of Coherency. Traps execution of those cache maintenance instructions at EL1 or EL0 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state as follows:
TPC | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state. |
If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap data or unified cache maintenance instructions that operate by Set/Way. Traps execution of those cache maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state as follows:
An exception generated because an instruction is UNDEFINED at EL0 is higher priority than this trap to EL2, and these instructions are always UNDEFINED at EL0.
TSW | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap Auxiliary Control Registers. Traps EL1 accesses to the Auxiliary Control Registers to EL2, when EL2 is enabled in the current Security state, from both Execution states as follows:
TACR | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 accesses to the specified registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
ACTLR_EL1, ACTLR, and ACTLR2 are not accessible at EL0.
The Auxiliary Control Registers are IMPLEMENTATION DEFINED registers that might implement global control bits for the PE.
This field resets to an architecturally UNKNOWN value.
Trap IMPLEMENTATION DEFINED functionality. Traps EL1 accesses to the encodings reserved for IMPLEMENTATION DEFINED functionality to EL2, when EL2 is enabled in the current Security state as follows:
When the value of HCR_EL2.TIDCP is 1, it is IMPLEMENTATION DEFINED whether any of this functionality accessed from EL0 is trapped to EL2. If it is not, then it is UNDEFINED, and any attempt to access it from EL0 generates an exception that is taken to EL1.
TIDCP | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
EL1 accesses to or execution of the specified encodings reserved for IMPLEMENTATION DEFINED functionality are trapped to EL2, when EL2 is enabled in the current Security state. |
An implementation can also include IMPLEMENTATION DEFINED registers that provide additional controls, to give finer-grained control of the trapping of IMPLEMENTATION DEFINED features.
Arm expects the trapping of EL0 accesses to these functions to EL2 to be unusual, and used only when the hypervisor is virtualizing EL0 operation. Arm strongly recommends that unless the hypervisor must virtualize EL0 operation, an EL0 access to any of these functions is UNDEFINED, as it would be if the implementation did not include EL2. The PE then takes any resulting exception to EL1.
The trapping of accesses to these registers from EL1 is higher priority than an exception resulting from the register access being UNDEFINED.
This field resets to an architecturally UNKNOWN value.
Trap SMC instructions. Traps EL1 execution of SMC instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states.
If execution is in AArch64 state the trap is reported using EC syndrome value 0x17 and if execution is in AArch32 state, the trap is reported using EC syndrome value 0x13.
HCR_EL2.TSC traps execution of the SMC instruction. It is not a routing control for the SMC exception. Trap exceptions and SMC exceptions have different preferred return addresses.
TSC | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
If EL3 is implemented, then any attempt to execute an SMC instruction at EL1 using AArch64 or EL1 using AArch32 is trapped to EL2, when EL2 is enabled in the current Security state, regardless of the value of SCR_EL3.SMD. If EL3 is not implemented, ARMv8.3-NV is implemented, and HCR_EL2.NV is 1, then any attempt to execute an SMC instruction at EL1 using AArch64 is trapped to EL2, when EL2 is enabled in the current Security state. If EL3 is not implemented, and either ARMv8.3-NV is not implemented or HCR_EL2.NV is 0, then it is IMPLEMENTATION DEFINED whether:
|
In AArch32 state, the Armv8-A architecture permits, but does not require, this trap to apply to conditional SMC instructions that fail their condition code check, in the same way as with traps on other conditional instructions.
SMC instructions are UNDEFINED at EL0.
If EL3 is not implemented and HCR_EL2.NV is 0, it is IMPLEMENTATION DEFINED whether this bit is:
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap ID group 3. Traps EL1 reads of group 3 ID registers to EL2, when EL2 is enabled in the current Security state, as follows:
In AArch64 state, reads of the following registers are trapped to EL2, reported using EC syndrome value 0x18:
ID_PFR0_EL1, ID_PFR1_EL1, ID_DFR0_EL1, ID_AFR0_EL1, ID_MMFR0_EL1, ID_MMFR1_EL1, ID_MMFR2_EL1, ID_MMFR3_EL1, ID_ISAR0_EL1, ID_ISAR1_EL1, ID_ISAR2_EL1, ID_ISAR3_EL1, ID_ISAR4_EL1, ID_ISAR5_EL1, ID_ISAR6_EL1, MVFR0_EL1, MVFR1_EL1, MVFR2_EL1.
ID_AA64PFR0_EL1, ID_AA64PFR1_EL1, ID_AA64DFR0_EL1, ID_AA64DFR1_EL1, ID_AA64ISAR0_EL1, ID_AA64ISAR1_EL1, ID_AA64MMFR0_EL1, ID_AA64MMFR1_EL1, ID_AA64MMFR2_EL1, ID_AA64AFR0_EL1, ID_AA64AFR1_EL1, ID_AA64ZFR0_EL1 (where SVE is implemented), and ID_MMFR4_EL1
In AArch64 state, ID_MMFR4_EL1 and ID_MMFR5_EL1 are trapped to EL2, unless implemented as RAZ, when it is IMPLEMENTATION DEFINED whether accesses to ID_MMFR4_EL1 or ID_MMFR5_EL1 are trapped to EL2, reported using EC syndrome value 0x18.
In AArch64 state, ID_AA64MMFR2_EL1 and ID_ISAR6_EL1 are trapped to EL2, unless implemented as RAZ, when it is IMPLEMENTATION DEFINED whether accesses to ID_AA64MMFR2_EL1 or ID_ISAR6_EL1 are trapped to EL2, reported using EC syndrome value 0x18.
In AArch64 state, ID_AA64ZFR0_EL1 is trapped to EL2, unless implemented as RAZ then it is IMPLEMENTATION DEFINED whether accesses to ID_AA64ZFR0_EL1 are trapped to EL2, reported using EC syndrome value 0x18.
In AArch64 state, it is IMPLEMENTATION DEFINED whether this field traps MRS accesses to encodings in the following range that are not already mentioned in this field description, reported using EC syndrome value 0x18:
In AArch32 state, MRC access to the following registers are trapped to EL2, reported using EC syndrome value 0x03:
In AArch32 state, VMRS access to MVFR0, MVFR1, and MVFR2, reported using EC syndrome value 0x08.
In AArch32 state, ID_MMFR4 and ID_MMFR5 are trapped to EL2, unless implemented as RAZ, when it is IMPLEMENTATION DEFINED whether accesses to ID_MMFR4 or ID_MMFR5 are trapped to EL2, reported using EC syndrome value 0x03.
In AArch32 state, ID_ISAR6 is trapped to EL2, unless implemented as RAZ, when it is IMPLEMENTATION DEFINED whether accesses to ID_ISAR6 are trapped to EL2, reported using EC syndrome value 0x03.
In AArch32 state, it is IMPLEMENTATION DEFINED whether this bit traps MRC accesses to encodings that are not already mentioned, with coproc==p15, opc1 == 0, CRn == c0, CRm == {c2-c7}, opc2 == {0-7}.
TID3 | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
The specified EL1 read accesses to ID group 3 registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap ID group 2. Traps the following register accesses to EL2, when EL2 is enabled in the current Security state, as follows:
TID2 | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
The specified EL1 and EL0 accesses to ID group 2 registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Trap ID group 1. Traps EL1 reads of the following registers to EL2, when EL2 is enabled in the current Security state as follows:
In AArch64 state, accesses of REVIDR_EL1, AIDR_EL1, reported using EC syndrome value 0x18.
In AArch32 state, accesses of TCMTR, TLBTR, REVIDR, AIDR, reported using EC syndrome value 0x03.
TID1 | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
The specified EL1 read accesses to ID group 1 registers are trapped to EL2, when EL2 is enabled in the current Security state. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Trap ID group 0. Traps the following register accesses to EL2:
TID0 | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
The specified EL1 read accesses to ID group 0 registers are trapped to EL2, when EL2 is enabled in the current Security state. |
In an AArch64 only implementation, this bit is RES0.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Traps EL0 and EL1 execution of WFE instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states, reported using EC syndrome value 0x01.
TWE | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Any attempt to execute a WFE instruction at EL0 or EL1 is trapped to EL2, when EL2 is enabled in the current Security state, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWE or SCTLR_EL1.nTWE. |
In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the instruction passes its condition code check.
Since a WFE can complete at any time, even without a Wakeup event, the traps on WFE are not guaranteed to be taken, even if the WFE is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
For more information about when WFE instructions can cause the PE to enter a low-power state, see 'Wait for Event mechanism and Send event'.
This field resets to an architecturally UNKNOWN value.
Traps EL0 and EL1 execution of WFI instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states, reported using EC syndrome value 0x01.
TWI | Meaning |
---|---|
0b0 |
This control does not cause any instructions to be trapped. |
0b1 |
Any attempt to execute a WFI instruction at EL0 or EL1 is trapped to EL2, when EL2 is enabled in the current Security state, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWI or SCTLR_EL1.nTWI. |
In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the instruction passes its condition code check.
Since a WFI can complete at any time, even without a Wakeup event, the traps on WFI are not guaranteed to be taken, even if the WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
For more information about when WFI instructions can cause the PE to enter a low-power state, see 'Wait for Interrupt'.
This field resets to an architecturally UNKNOWN value.
Default Cacheability.
DC | Meaning |
---|---|
0b0 |
This control has no effect on the EL1&0 translation regime. |
0b1 |
In both Security states:
|
This field has no effect on the EL2, EL2&0, and EL3 translation regimes.
This field is permitted to be cached in a TLB.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this field.
This field resets to an architecturally UNKNOWN value.
Barrier Shareability upgrade. This field determines the minimum shareability domain that is applied to any barrier instruction executed from EL1 or EL0:
BSU | Meaning |
---|---|
0b00 |
No effect. |
0b01 |
Inner Shareable. |
0b10 |
Outer Shareable. |
0b11 |
Full system. |
This value is combined with the specified level of the barrier held in its instruction, using the same principles as combining the shareability attributes from two stages of address translation.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0b00 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Force broadcast. Causes the following instructions to be broadcast within the Inner Shareable domain when executed from EL1:
AArch32: BPIALL, TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID, ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, ICIALLU, TLBIMVAL, TLBIMVAAL.
AArch64: TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI VAALE1, IC IALLU.
FB | Meaning |
---|---|
0b0 |
This field has no effect on the operation of the specified instructions. |
0b1 |
When one of the specified instruction is executed at EL1, the instruction is broadcast within the Inner Shareable shareability domain. |
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Virtual SError interrupt.
VSE | Meaning |
---|---|
0b0 |
This mechanism is not making a virtual SError interrupt pending. |
0b1 |
A virtual SError interrupt is pending because of this mechanism. |
The virtual SError interrupt is only enabled when the value of HCR_EL2.{TGE, AMO} is {0, 1}.
This field resets to an architecturally UNKNOWN value.
Virtual IRQ Interrupt.
VI | Meaning |
---|---|
0b0 |
This mechanism is not making a virtual IRQ pending. |
0b1 |
A virtual IRQ is pending because of this mechanism. |
The virtual IRQ is enabled only when the value of HCR_EL2.{TGE, IMO} is {0, 1}.
This field resets to an architecturally UNKNOWN value.
Virtual FIQ Interrupt.
VF | Meaning |
---|---|
0b0 |
This mechanism is not making a virtual FIQ pending. |
0b1 |
A virtual FIQ is pending because of this mechanism. |
The virtual FIQ is enabled only when the value of HCR_EL2.{TGE, FMO} is {0, 1}.
This field resets to an architecturally UNKNOWN value.
Physical SError interrupt routing.
AMO | Meaning |
---|---|
0b0 |
When executing at Exception levels below EL2, and EL2 is enabled in the current Security state: |
0b1 |
When executing at any Exception level, and EL2 is enabled in the current Security state:
|
If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1:
For more information, see 'Asynchronous exception routing' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
This field resets to an architecturally UNKNOWN value.
Physical IRQ Routing.
IMO | Meaning |
---|---|
0b0 |
When executing at Exception levels below EL2, and EL2 is enabled in the current Security state: |
0b1 |
When executing at any Exception level, and EL2 is enabled in the current Security state:
|
If EL2 is enabled in the current Security state, and the value of HCR_EL2.TGE is 1:
For more information, see 'Asynchronous exception routing' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
This field resets to an architecturally UNKNOWN value.
Physical FIQ Routing.
FMO | Meaning |
---|---|
0b0 |
When executing at Exception levels below EL2, and EL2 is enabled in the current Security state: |
0b1 |
When executing at any Exception level, and EL2 is enabled in the current Security state:
|
If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1:
For more information, see 'Asynchronous exception routing' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
This field resets to an architecturally UNKNOWN value.
Protected Table Walk. In the EL1&0 translation regime, a translation table access made as part of a stage 1 translation table walk is subject to a stage 2 translation. The combining of the memory type attributes from the two stages of translation means the access might be made to a type of Device memory. If this occurs, then the value of this bit determines the behavior:
PTW | Meaning |
---|---|
0b0 |
The translation table walk occurs as if it is to Normal Non-cacheable memory. This means it can be made speculatively. |
0b1 |
The memory access generates a stage 2 Permission fault. |
This field is permitted to be cached in a TLB.
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Set/Way Invalidation Override. Causes EL1 execution of the data cache invalidate by set/way instructions to perform a data cache clean and invalidate by set/way:
SWIO | Meaning |
---|---|
0b0 |
This control has no effect on the operation of data cache invalidate by set/way instructions. |
0b1 |
Data cache invalidate by set/way instructions perform a data cache clean and invalidate by set/way. |
When the value of this bit is 1:
AArch32: DCISW performs the same invalidation as a DCCISW instruction.
AArch64: DC ISW performs the same invalidation as a DC CISW instruction.
This bit can be implemented as RES1.
When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.
This field resets to an architecturally UNKNOWN value.
Virtualization enable. Enables stage 2 address translation for the EL1&0 translation regime, when EL2 is enabled in the current Security state.
VM | Meaning |
---|---|
0b0 |
EL1&0 stage 2 address translation disabled. |
0b1 |
EL1&0 stage 2 address translation enabled. |
When the value of this bit is 1, data cache invalidate instructions executed at EL1 perform a data cache clean and invalidate. For the invalidate by set/way instruction this behavior applies regardless of the value of the HCR_EL2.SWIO bit.
This bit is permitted to be cached in a TLB.
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
This field resets to an architecturally UNKNOWN value.
Accesses to this register use the following encodings:
op0 | op1 | CRn | CRm | op2 |
---|---|---|---|---|
0b11 | 0b100 | 0b0001 | 0b0001 | 0b000 |
if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then if IsFeatureImplemented("Morello") && !CapIsSystemAccessEnabled() && !Halted() then if TargetELForCapabilityExceptions() == EL2 then AArch64.SystemAccessTrap(EL2, 0x18); else AArch64.SystemAccessTrap(EL3, 0x18); else return HCR_EL2; elsif PSTATE.EL == EL3 then if IsFeatureImplemented("Morello") && !CapIsSystemAccessEnabled() && !Halted() then AArch64.SystemAccessTrap(EL3, 0x18); else return HCR_EL2;
op0 | op1 | CRn | CRm | op2 |
---|---|---|---|---|
0b11 | 0b100 | 0b0001 | 0b0001 | 0b000 |
if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then if IsFeatureImplemented("Morello") && !CapIsSystemAccessEnabled() && !Halted() then if TargetELForCapabilityExceptions() == EL2 then AArch64.SystemAccessTrap(EL2, 0x18); else AArch64.SystemAccessTrap(EL3, 0x18); else HCR_EL2 = X[t]; elsif PSTATE.EL == EL3 then if IsFeatureImplemented("Morello") && !CapIsSystemAccessEnabled() && !Halted() then AArch64.SystemAccessTrap(EL3, 0x18); else HCR_EL2 = X[t];
12/01/2022 09:56; 05a4944b4b04e7ab50def8c126b479d22136f35b
Copyright © 2010-2022 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.