TCR_EL1
Translation Control Register (EL1)
when FEAT_AA64 is implemented
TTBCR
Architectural
AArch32
31
0
31
0
31
0
31
0
TTBCR2
Architectural
AArch32
63
32
31
0
63
32
31
0
The control register for stage 1 of the EL1&0 translation regime.
Memory
TCR_EL1 is a 64-bit register.
Any of the bits in TCR_EL1, other than the EPDx bits when they have the value 1, and the A1 bit are permitted to be cached in a TLB.
63
62
63:62
Reserved, RES0.
MTX1
61
61
0
Extended memory tag checking.
This field controls address generation and Canonical tagging when EL0 and EL1 are using AArch64 where the data address would be translated by tables pointed to by TTBR1_EL1.
This control has an effect regardless of whether stage 1 of the EL1&0 translation regime is enabled or not.
For more information see Logical address tagging and Memory region tagging types.
0b0
Canonical tagging is disabled.
This control has no effect on address generation.
0b1
Canonical tagging is enabled.
Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:
Bits[59:56] are treated as 0b1111 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.MTX1 == '1'
RO
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented
61
61
61
Reserved, RES0.
Otherwise
MTX0
60
60
0
Extended memory tag checking.
This field controls address generation and Canonical tagging when EL0 and EL1 are using AArch64 where the data address would be translated by tables pointed to by TTBR0_EL1.
This control has an effect regardless of whether stage 1 of the EL1&0 translation regime is enabled or not.
For more information see Logical address tagging and Memory region tagging types.
0b0
Canonical tagging is disabled.
This control has no effect on address generation.
0b1
Canonical tagging is enabled.
Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:
Bits[59:56] are treated as 0b0000 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.MTX0 == '1'
RO
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented
60
60
60
Reserved, RES0.
Otherwise
DS
59
59
0
This field affects:
Whether a 52-bit output address can be described by the translation tables of the 4KB or 16KB translation granules.
The minimum value of TCR_EL1.{T0SZ,T1SZ}.
How and where shareability for Block and Page descriptors are encoded.
This field is RES0 for a 64KB translation granule.
0b0
Bits[49:48] of translation descriptors are RES0.
Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware.
The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.
Output address[51:48] is 0b0000.
0b1
Bits[49:48] of translation descriptors hold output address[49:48].
Bits[9:8] of Translation table descriptors hold output address[51:50].
The shareability information of Block and Page descriptors for cacheable locations is determined by:
TCR_EL1.SH0 if the VA is translated using tables pointed to by TTBR0_EL1.
TCR_EL1.SH1 if the VA is translated using tables pointed to by TTBR1_EL1.
The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.
All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes.
Bits[5:2] of TTBR0_EL1 or TTBR1_EL1 are used to hold bits[51:48] of the output address in all cases.
As FEAT_LVA must be implemented if TCR_EL1.DS == 1, the minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12, as determined by that extension.For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00.
This forces alignment of the ranges used by the TLBI range instructions.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.DS == '1'
RO
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR2_EL1.D128 == '0')
DS
59
59
0
The Effective value of this bit is 0.
RES0
Otherwise
TCMA1
58
58
0
Controls the generation of Unchecked accesses at EL1, and at EL0 if the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, when address[59:55] = 0b11111.
Software may change this control bit on a context switch.
0b0
This control has no effect on the generation of Unchecked accesses at EL1 or EL0.
0b1
All accesses at EL1 and EL0 are Unchecked.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TCMA1 == '1'
RO
When FEAT_MTE2 is implemented
58
58
58
Reserved, RES0.
Otherwise
TCMA0
57
57
0
Controls the generation of Unchecked accesses at EL1, and at EL0 if the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, when address[59:55] = 0b00000.
Software may change this control bit on a context switch.
0b0
This control has no effect on the generation of Unchecked accesses at EL1 or EL0.
0b1
All accesses at EL1 and EL0 are Unchecked.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TCMA0 == '1'
RO
When FEAT_MTE2 is implemented
57
57
57
Reserved, RES0.
Otherwise
E0PD1
56
56
0
Faulting control for unprivileged access to any address translated by TTBR1_EL1.
Level 0 Translation faults generated as a result of this field are not counted as TLB misses for performance monitoring. The fault should take the same time to generate, whether the address is present in the TLB or not, to mitigate attacks that use fault timing.
0b0
Unprivileged access to any address translated by TTBR1_EL1 will not generate a fault by this mechanism.
0b1
Unprivileged access to any address translated by TTBR1_EL1 will generate a level 0 Translation fault.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.E0PD1 == '1'
RO
When FEAT_E0PD is implemented
56
56
56
Reserved, RES0.
Otherwise
E0PD0
55
55
0
Faulting control for unprivileged access to any address translated by TTBR0_EL1.
Level 0 Translation faults generated as a result of this field are not counted as TLB misses for performance monitoring. The fault should take the same time to generate, whether the address is present in the TLB or not, to mitigate attacks that use fault timing.
0b0
Unprivileged access to any address translated by TTBR0_EL1 will not generate a fault by this mechanism.
0b1
Unprivileged access to any address translated by TTBR0_EL1 will generate a level 0 Translation fault.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.E0PD0 == '1'
RO
When FEAT_E0PD is implemented
55
55
55
Reserved, RES0.
Otherwise
NFD1
54
54
0
Non-Fault translation timing Disable when using TTBR1_EL1.
Controls how a TLB miss is reported in response to a non-fault unprivileged access for a virtual address that is translated using TTBR1_EL1.
If SVE is implemented, the affected access types include:
All accesses due to an SVE non-fault contiguous load instruction.
Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.
0b0
Does not affect the handling of a TLB miss on accesses translated using TTBR1_EL1.
0b1
A TLB miss on a virtual address that is translated using TTBR1_EL1 due to the specified access types causes the access to fail without taking an exception. The amount of time that the failure takes to be handled should not predictively leak whether it was caused by a TLB miss or a Permission fault, to mitigate attacks that use fault timing.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.NFD1 == '1'
RO
When FEAT_SVE is implemented
54
54
54
Reserved, RES0.
Otherwise
NFD0
53
53
0
Non-Fault translation timing Disable when using TTBR0_EL1.
Controls how a TLB miss is reported in response to a non-fault unprivileged access for a virtual address that is translated using TTBR0_EL1.
If SVE is implemented, the affected access types include:
All accesses due to an SVE non-fault contiguous load instruction.
Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.
0b0
Does not affect the handling of a TLB miss on accesses translated using TTBR0_EL1.
0b1
A TLB miss on a virtual address that is translated using TTBR0_EL1 due to the specified access types causes the access to fail without taking an exception. The amount of time that the failure takes to be handled should not predictively leak whether it was caused by a TLB miss or a Permission fault, to mitigate attacks that use fault timing.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.NFD0 == '1'
RO
When FEAT_SVE is implemented
53
53
53
Reserved, RES0.
Otherwise
TBID1
52
52
0
Controls the use of the top byte of instruction addresses for address matching.
For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.
For more information, see 'Address tagging'.
This affects addresses where the address would be translated by tables pointed to by TTBR1_EL1.
0b0
TCR_EL1.TBI1 applies to Instruction and Data accesses.
0b1
TCR_EL1.TBI1 applies to Data accesses only.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TBID1 == '1'
RO
When FEAT_PAuth is implemented
52
52
52
Reserved, RES0.
Otherwise
TBID0
51
51
0
Controls the use of the top byte of instruction addresses for address matching.
For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.
For more information, see 'Address tagging'.
This affects addresses where the address would be translated by tables pointed to by TTBR0_EL1.
0b0
TCR_EL1.TBI0 applies to Instruction and Data accesses.
0b1
TCR_EL1.TBI0 applies to Data accesses only.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TBID0 == '1'
RO
When FEAT_PAuth is implemented
51
51
51
Reserved, RES0.
Otherwise
HWU162
50
50
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.
0b0
For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU162 == '1'
RO
When FEAT_HPDS2 is implemented
50
50
50
Reserved, RES0.
Otherwise
HWU161
49
49
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.
0b0
For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU161 == '1'
RO
When FEAT_HPDS2 is implemented
49
49
49
Reserved, RES0.
Otherwise
HWU160
48
48
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.
0b0
For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU160 == '1'
RO
When FEAT_HPDS2 is implemented
48
48
48
Reserved, RES0.
Otherwise
HWU159
47
47
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.
0b0
For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU159 == '1'
RO
When FEAT_HPDS2 is implemented
47
47
47
Reserved, RES0.
Otherwise
HWU062
46
46
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.
0b0
For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU062 == '1'
RO
When FEAT_HPDS2 is implemented
46
46
46
Reserved, RES0.
Otherwise
HWU061
45
45
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.
0b0
For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU061 == '1'
RO
When FEAT_HPDS2 is implemented
45
45
45
Reserved, RES0.
Otherwise
HWU060
44
44
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.
0b0
For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU060 == '1'
RO
When FEAT_HPDS2 is implemented
44
44
44
Reserved, RES0.
Otherwise
HWU059
43
43
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.
The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.
0b0
For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HWU059 == '1'
RO
When FEAT_HPDS2 is implemented
43
43
43
Reserved, RES0.
Otherwise
HPD1
42
42
0
Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR1_EL1.
When disabled, the permissions are treated as if the bits are zero.
0b0
Hierarchical permissions are enabled.
0b1
Hierarchical permissions are disabled.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HPD1 == '1'
RO
When FEAT_HPDS is implemented
42
42
42
Reserved, RES0.
Otherwise
HPD0
41
41
0
Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR0_EL1.
When disabled, the permissions are treated as if the bits are zero.
0b0
Hierarchical permissions are enabled.
0b1
Hierarchical permissions are disabled.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HPD0 == '1'
RO
When FEAT_HPDS is implemented
41
41
41
Reserved, RES0.
Otherwise
HD
40
40
0
Hardware management of dirty state in stage 1 translations from EL0 and EL1.
When the Effective value of TCR_EL1.HA is 0, this field behaves as 0 for all purposes other than a direct read of the value of this field.
0b0
Stage 1 hardware management of dirty state disabled.
0b1
Stage 1 hardware management of dirty state enabled.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HD == '1'
RO
When FEAT_HAFDBS is implemented
40
40
40
Reserved, RES0.
Otherwise
HA
39
39
0
Hardware Access flag update in stage 1 translations from EL0 and EL1.
0b0
Stage 1 Access flag update disabled.
0b1
Stage 1 Access flag update enabled.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.HA == '1'
RO
When FEAT_HAF is implemented
39
39
39
Reserved, RES0.
Otherwise
TBI1
38
38
38
Top Byte ignored. Indicates whether the top byte of an address is used for address match for the TTBR1_EL1 region, or ignored and used for tagged addresses.
This affects addresses generated at EL0 and EL1 using AArch64 where the address would be translated by tables pointed to by TTBR1_EL1. It has an effect whether the EL1&0 translation regime is enabled or not.
If FEAT_PAuth is implemented and TCR_EL1.TBID1 is 1, then this field only applies to Data accesses.
Otherwise, if the value of TBI1 is 1 and bit [55] of the target address to be stored to the PC is 1, then bits[63:56] of that target address are also set to 1 before the address is stored in the PC, in the following cases:
A branch or procedure return within EL1 or EL0.
An exception taken to EL1.
An exception return to EL1 or EL0.
0b0
Top Byte used in the address calculation.
0b1
Top Byte ignored in the address calculation.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TBI1 == '1'
RO
TBI0
37
37
37
Top Byte ignored. Indicates whether the top byte of an address is used for address match for the TTBR0_EL1 region, or ignored and used for tagged addresses.
This affects addresses generated at EL0 and EL1 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL1. It has an effect whether the EL1&0 translation regime is enabled or not.
If FEAT_PAuth is implemented and TCR_EL1.TBID0 is 1, then this field only applies to Data accesses.
Otherwise, if the value of TBI0 is 1 and bit [55] of the target address to be stored to the PC is 0, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:
A branch or procedure return within EL1 or EL0.
An exception taken to EL1.
An exception return to EL1 or EL0.
0b0
Top Byte used in the address calculation.
0b1
Top Byte ignored in the address calculation.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TBI0 == '1'
RO
AS
36
36
36
ASID Size.
If the implementation has only 8 bits of ASID, this field is RES0.
0b0
8 bit - the upper 8 bits of TTBR0_EL1 and TTBR1_EL1 are ignored by hardware for every purpose except reading back the register, and are treated as if they are all zeros for when used for allocation and matching entries in the TLB.
0b1
16 bit - the upper 16 bits of TTBR0_EL1 and TTBR1_EL1 are used for allocation and matching in the TLB.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.AS == '1'
RO
35
35
35
Reserved, RES0.
IPS
34
32
34:32
Intermediate Physical Address Size.
The values 0b110 and 0b111 represent different output address sizes depending on implementation choices and translation configuration.
The following table captures the output address size represented by the value 0b110:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleDS1Represented OA size
Any0b0101AnyAny48 bits, 256TB
VMSAv8-640b011x4KB or 16KB048 bits, 256TB
VMSAv8-640b011x4KB or 16KB152 bits, 4PB
VMSAv8-640b011x64KBN/A52 bits, 4PB
VMSAv9-1280b011xAnyN/A52 bits, 4PB
1 This column represents the value of TCR_EL1.DS.
The following table captures the output address size represented by the value 0b111:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleRepresented OA size
Any0b0110AnyOA size represented by0b110
VMSAv8-640b0111AnyOA size represented by0b110
VMSAv9-1280b0111Any56 bits, 64PB
If 52-bit PA is supported, and the translation table descriptors cannot express an OA larger than 48-bits, then bits[51:48] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL1.
If 56-bit PA is supported, and the translation table descriptors cannot express an OA larger than 52-bits, then bits[55:52] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL1.
If the output address size represented by this field is larger than the supported PA size expressed in ID_AA64MMFR0_EL1.PARange, then the output address size is treated as being the same as the supported PA size. Arm strongly recommends that software avoids configuring this field to a value representing an output address size larger than the supported PA size.
0b000
32 bits, 4GB.
0b001
36 bits, 64GB.
0b010
40 bits, 1TB.
0b011
42 bits, 4TB.
0b100
44 bits, 16TB.
0b101
48 bits, 256TB.
0b110
52 bits, 4PB.
0b111
56 bits, 64PB.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.IPS == '1'
RO
TG1
31
30
31:30
Granule size for the TTBR1_EL1.
Other values are reserved.
If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.
It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.
0b01
16KB.
0b10
4KB.
0b11
64KB.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TG1 == '1'
RO
SH1
29
28
29:28
Shareability attribute for memory associated with translation table walks using TTBR1_EL1.
Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE.
0b00
Non-shareable.
0b10
Outer Shareable.
0b11
Inner Shareable.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.SH1 == '1'
RO
ORGN1
27
26
27:26
Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL1.
0b00
Normal memory, Outer Non-cacheable.
0b01
Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.ORGN1 == '1'
RO
IRGN1
25
24
25:24
Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL1.
0b00
Normal memory, Inner Non-cacheable.
0b01
Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.IRGN1 == '1'
RO
EPD1
23
23
23
Translation table walk disable for translations using TTBR1_EL1. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR1_EL1. The encoding of this bit is:
0b0
Perform translation table walks using TTBR1_EL1.
0b1
A TLB miss on an address that is translated using TTBR1_EL1 generates a Translation fault. No translation table walk is performed.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.EPD1 == '1'
RO
A1
22
22
22
Selects whether TTBR0_EL1 or TTBR1_EL1 defines the ASID. The encoding of this bit is:
0b0
TTBR0_EL1.ASID defines the ASID.
0b1
TTBR1_EL1.ASID defines the ASID.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.A1 == '1'
RO
T1SZ
21
16
21:16
The size offset of the memory region addressed by TTBR1_EL1. The region size is 2(64-T1SZ) bytes.
The maximum and minimum possible values for T1SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.
For the 4KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.For the 16KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.T1SZ == '1'
RO
TG0
15
14
15:14
Granule size for the TTBR0_EL1.
Other values are reserved.
If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.
It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.
0b00
4KB
0b01
64KB
0b10
16KB
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.TG0 == '1'
RO
SH0
13
12
13:12
Shareability attribute for memory associated with translation table walks using TTBR0_EL1.
Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE.
0b00
Non-shareable
0b10
Outer Shareable
0b11
Inner Shareable
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.SH0 == '1'
RO
ORGN0
11
10
11:10
Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL1.
0b00
Normal memory, Outer Non-cacheable.
0b01
Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.ORGN0 == '1'
RO
IRGN0
9
8
9:8
Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL1.
0b00
Normal memory, Inner Non-cacheable.
0b01
Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.IRGN0 == '1'
RO
EPD0
7
7
7
Translation table walk disable for translations using TTBR0_EL1. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR0_EL1. The encoding of this bit is:
0b0
Perform translation table walks using TTBR0_EL1.
0b1
A TLB miss on an address that is translated using TTBR0_EL1 generates a Translation fault. No translation table walk is performed.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.EPD0 == '1'
RO
6
6
6
Reserved, RES0.
T0SZ
5
0
5:0
The size offset of the memory region addressed by TTBR0_EL1. The region size is 2(64-T0SZ) bytes.
The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.
For the 4KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.For the 16KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.
AU
FEAT_SRMASK is implemented
EL1 is the current Exception level
IsSystemRegisterMaskingEnabled(EL1)
TCRMASK_EL1.T0SZ == '1'
RO
When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL3 using the accessor name TCR_EL1 or TCR_EL12 are not guaranteed to be ordered with respect to accesses using the other accessor name.
If FEAT_SRMASK is implemented, accesses to TCR_EL1 are masked by TCRMASK_EL1.
MRS <Xt>, TCR_EL1
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EL2Enabled() && HCR_EL2().TRVM == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGRTR_EL2().TCR_EL1 == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EffectiveHCR_EL2_NVx() IN {'111'} then
X{64}(t) = NVMem(0x120);
else
X{64}(t) = TCR_EL1();
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
X{64}(t) = TCR_EL2();
else
X{64}(t) = TCR_EL1();
end;
elsif PSTATE.EL == EL3 then
X{64}(t) = TCR_EL1();
end;
MSR TCR_EL1, <Xt>
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EL2Enabled() && HCR_EL2().TVM == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGWTR_EL2().TCR_EL1 == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EffectiveHCR_EL2_NVx() IN {'111'} then
NVMem(0x120) = X{64}(t);
else
TCR_EL1() = X{64}(t);
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
TCR_EL2() = X{64}(t);
else
TCR_EL1() = X{64}(t);
end;
elsif PSTATE.EL == EL3 then
TCR_EL1() = X{64}(t);
end;
MRS <Xt>, TCR_EL12
When FEAT_VHE is implemented
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() == '101' then
X{64}(t) = NVMem(0x120);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
X{64}(t) = TCR_EL1();
else
Undefined();
end;
elsif PSTATE.EL == EL3 then
if ELIsInHost(EL2) then
X{64}(t) = TCR_EL1();
else
Undefined();
end;
end;
MSR TCR_EL12, <Xt>
When FEAT_VHE is implemented
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() == '101' then
NVMem(0x120) = X{64}(t);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
TCR_EL1() = X{64}(t);
else
Undefined();
end;
elsif PSTATE.EL == EL3 then
if ELIsInHost(EL2) then
TCR_EL1() = X{64}(t);
else
Undefined();
end;
end;
MRS <Xt>, TCRALIAS_EL1
When FEAT_SRMASK is implemented
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EL2Enabled() && HCR_EL2().TRVM == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT2) && ((HaveEL(EL3) && SCR_EL3().FGTEn2 == '0') || HFGRTR2_EL2().nTCRALIAS_EL1 == '0') then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EffectiveHCR_EL2_NVx() IN {'111'} then
X{64}(t) = NVMem(0x120);
else
X{64}(t) = TCR_EL1();
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
X{64}(t) = TCR_EL2();
else
X{64}(t) = TCR_EL1();
end;
elsif PSTATE.EL == EL3 then
X{64}(t) = TCR_EL1();
end;
MSR TCRALIAS_EL1, <Xt>
When FEAT_SRMASK is implemented
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EL2Enabled() && HCR_EL2().TVM == '1' then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT2) && ((HaveEL(EL3) && SCR_EL3().FGTEn2 == '0') || HFGWTR2_EL2().nTCRALIAS_EL1 == '0') then
AArch64_SystemAccessTrap(EL2, 0x18);
elsif EffectiveHCR_EL2_NVx() IN {'111'} then
NVMem(0x120) = X{64}(t);
else
TCR_EL1() = X{64}(t);
end;
elsif PSTATE.EL == EL2 then
if ELIsInHost(EL2) then
TCR_EL2() = X{64}(t);
else
TCR_EL1() = X{64}(t);
end;
elsif PSTATE.EL == EL3 then
TCR_EL1() = X{64}(t);
end;
2026-03-26 20:27:25
2026-03_rel