TCR_EL3
Translation Control Register (EL3)
when EL3 is implemented and FEAT_AA64 is implemented
The control register for stage 1 of the EL3 translation regime.
Memory
TCR_EL3 is a 64-bit register.
Unless stated otherwise, any of the bits in TCR_EL3 are permitted to be cached in a TLB.
63
44
63:44
Reserved, RES0.
DisCH0
43
43
0
Disable the Contiguous bit for the Start Table.
0b0
The Contiguous bit of Block or Page descriptors of the Start Table is not affected by this field.
0b1
The Contiguous bit of Block or Page descriptors of the Start Table is treated as 0.
AU
When FEAT_D128 is implemented and TCR_EL3.D128 == '1'
43
43
43
Reserved, RES0.
Otherwise
HAFT
42
42
0
Hardware managed Access Flag for Table descriptors.
Enables the Hardware managed Access Flag for Table descriptors.
0b0
Hardware managed Access Flag for Table descriptors is disabled.
0b1
Hardware managed Access Flag for Table descriptors is enabled.
AU
When FEAT_HAFT is implemented
42
42
42
Reserved, RES0.
Otherwise
PTTWI
41
41
0
Permit Translation table walk Incoherence.
Permits RCWS instructions to generate writes that have the Reduced Coherence property.
This bit is permitted to be implemented as a read-only bit with a fixed value of 0.
0b0
Write accesses generated by RCWS at EL3 do not have the Reduced Coherence property.
0b1
Write accesses generated by RCWS at EL3 have the Reduced Coherence property.
AU
When FEAT_THE is implemented
41
41
41
Reserved, RES0.
Otherwise
40
39
40:39
Reserved, RES0.
D128
38
38
0
Enables VMSAv9-128 translation system.
0b0
Translation system follows VMSAv8-64 translation process.
0b1
Translation system follows VMSAv9-128 translation process.
AU
When FEAT_D128 is implemented
38
38
38
Reserved, RES0.
Otherwise
AIE
37
37
0
Enable Attribute Indexing Extension.
0b0
Attribute Indexing Extension Disabled.
0b1
Attribute Indexing Extension Enabled.
AU
When FEAT_AIE is implemented
37
37
37
Reserved, RES0.
Otherwise
POE
36
36
0
Enables Permission Overlay for EL3 accesses.
This bit is not permitted to be cached in a TLB.
0b0
Permission overlay disabled for EL3 access in stage 1 of EL3 translation regime.
0b1
Permission overlay enabled for EL3 access in stage 1 of EL3 translation regime.
AU
When FEAT_S1POE is implemented
36
36
36
Reserved, RES0.
Otherwise
PIE
35
35
0
Enables usage of Indirect Permission Scheme.
This field is RES1 when TCR_EL3.D128 is 1.
0b0
Direct permission model.
0b1
Indirect permission model.
AU
When FEAT_S1PIE is implemented
35
35
35
Reserved, RES0.
Otherwise
PnCH
34
34
0
Protected attribute enable. Enables use of bit[52] of the stage 1 translation table entries as the Protected bit, for translations using TTBR0_EL3.
If bit[52] is used as the Protected bit, it is not used as the Contiguous bit.
This field is RES0 when TCR_EL3.D128 is 1.
0b0
For translations using TTBR0_EL3, bit[52] of each stage 1 translation table entry is not the Protected bit.
0b1
For translations using TTBR0_EL3, bit[52] of each stage 1 translation table entry is the Protected bit.
AU
When FEAT_THE is implemented
34
34
34
Reserved, RES0.
Otherwise
MTX
33
33
0
Extended memory tag checking.
This field controls address generation and Canonical tagging when EL3 is using AArch64 where the data address would be translated by tables pointed to by TTBR0_EL3.
This control has an effect regardless of whether stage 1 of the EL3 translation regime is enabled or not.
For more information see Logical address tagging and Memory region tagging types.
0b0
Canonical tagging is disabled.
This control has no effect on address generation.
0b1
Canonical tagging is enabled.
Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:
Bits[59:56] are treated as 0b0000 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.
AU
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented
33
33
33
Reserved, RES0.
Otherwise
DS
32
32
0
This field affects:
Whether a 52-bit output address can be described by the translation tables of the 4KB or 16KB translation granules.
The minimum value of TCR_EL3.T0SZ.
How and where shareability for Block and Page descriptors are encoded.
This field is RES0 for a 64KB translation granule.
0b0
Bits[49:48] of translation descriptors are RES0.
Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware.
The minimum value of TCR_EL3.T0SZ is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.
Output address[51:48] is 0b0000.
0b1
Bits[49:48] of translation descriptors hold output address[49:48].
Bits[9:8] of table translation descriptors hold output address[51:50].
The shareability information of Block and Page descriptors for cacheable locations is determined by TCR_EL3.SH0.
The minimum value of TCR_EL3.T0SZ is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.
All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes.
Bits[5:2] of TTBR0_EL3 are used to hold bits[51:48] of the output address in all cases.
As FEAT_LVA must be implemented if TCR_EL3.DS == 1, the minimum value of the TCR_EL3.T0SZ field is 12, as determined by that extension.For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00.
This forces alignment of the ranges used by the TLBI range instructions.
AU
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR_EL3.D128 == '0')
DS
32
32
0
The Effective value of this bit is 0.
RES0
Otherwise
31
31
31
Reserved, RES1.
TCMA
30
30
0
Controls the generation of Unchecked accesses at EL3 when address [59:56] = 0b0000.
0b0
This control has no effect on the generation of Unchecked accesses.
0b1
All accesses are Unchecked.
AU
When FEAT_MTE2 is implemented
30
30
30
Reserved, RES0.
Otherwise
TBID
29
29
0
Controls the use of the top byte of instruction addresses for address matching.
This affects addresses where the address would be translated by tables pointed to by TTBR0_EL3.
For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.
0b0
TCR_EL3.TBI applies to Instruction and Data accesses.
0b1
TCR_EL3.TBI applies to Data accesses only.
AU
When FEAT_PAuth is implemented
29
29
29
Reserved, RES0.
Otherwise
HWU62
28
28
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry.
The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.
0b0
Bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.
AU
When FEAT_HPDS2 is implemented
28
28
28
Reserved, RES0.
Otherwise
HWU61
27
27
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry.
The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.
0b0
Bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.
AU
When FEAT_HPDS2 is implemented
27
27
27
Reserved, RES0.
Otherwise
HWU60
26
26
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry.
The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.
0b0
Bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.
AU
When FEAT_HPDS2 is implemented
26
26
26
Reserved, RES0.
Otherwise
HWU59
25
25
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry.
The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0.
0b0
Bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1.
AU
When FEAT_HPDS2 is implemented
25
25
25
Reserved, RES0.
Otherwise
HPD
24
24
0
Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, and UXNTable, except NSTable, in the translation tables pointed to by TTBR0_EL3.
When disabled, the permissions are treated as if the bits are zero.
0b0
Hierarchical permissions are enabled.
0b1
Hierarchical permissions are disabled.
In this case, bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor attributes are required to be ignored by the PE, and are no longer reserved, allowing them to be used by software.
AU
When FEAT_HPDS is implemented
24
24
24
Reserved, RES0.
Otherwise
23
23
23
Reserved, RES1.
HD
22
22
0
Hardware management of dirty state in stage 1 translations from EL3.
When the Effective value of TCR_EL3.HA is 0, this field behaves as 0 for all purposes other than a direct read of the value of this field.
0b0
Stage 1 hardware management of dirty state disabled.
0b1
Stage 1 hardware management of dirty state enabled.
AU
When FEAT_HAFDBS is implemented
22
22
22
Reserved, RES0.
Otherwise
HA
21
21
0
Hardware Access flag update in stage 1 translations from EL3.
0b0
Stage 1 Access flag update disabled.
0b1
Stage 1 Access flag update enabled.
AU
When FEAT_HAF is implemented
21
21
21
Reserved, RES0.
Otherwise
TBI
20
20
20
Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the TTBR0_EL3 region, or ignored and used for tagged addresses.
This affects addresses generated at EL3 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL3. It has an effect whether the EL3 translation regime is enabled or not.
If FEAT_PAuth is implemented and TCR_EL3.TBID is 1, then this field only applies to Data accesses.
Otherwise, if the value of TBI is 1, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:
A branch or procedure return within EL3.
A exception taken to EL3.
An exception return to EL3.
For more information, see 'Address tagging'.
This control detrmines the scope of address tagging. It never causes an exception to be generated.
0b0
Top Byte used in the address calculation.
0b1
Top Byte ignored in the address calculation.
AU
19
19
19
Reserved, RES0.
PS
18
16
18:16
Physical Address Size.
The values 0b110 and 0b111 represent different output address sizes depending on implementation choices and translation configuration.
The following table captures the output address size represented by the value 0b110:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleDS1Represented OA size
Any0b0101AnyAny48 bits, 256TB
VMSAv8-640b011x4KB or 16KB048 bits, 256TB
VMSAv8-640b011x4KB or 16KB152 bits, 4PB
VMSAv8-640b011x64KBN/A52 bits, 4PB
VMSAv9-1280b011xAnyN/A52 bits, 4PB
1 This column represents the value of TCR_EL3.DS.
The following table captures the output address size represented by the value 0b111:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleRepresented OA size
Any0b0110AnyOA size represented by0b110
VMSAv8-640b0111AnyOA size represented by0b110
VMSAv9-1280b0111Any56 bits, 64PB
If 52-bit PA is supported, and the translation table descriptors cannot express an OA larger than 48-bits, then bits[51:48] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL3.
If 56-bit PA is supported, and the translation table descriptors cannot express an OA larger than 52-bits, then bits[55:52] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL3.
If the output address size represented by this field is larger than the supported PA size expressed in ID_AA64MMFR0_EL1.PARange, then the output address size is treated as being the same as the supported PA size. Arm strongly recommends that software avoids configuring this field to a value representing an output address size larger than the supported PA size.
0b000
32 bits, 4GB.
0b001
36 bits, 64GB.
0b010
40 bits, 1TB.
0b011
42 bits, 4TB.
0b100
44 bits, 16TB.
0b101
48 bits, 256TB.
0b110
52 bits, 4PB.
0b111
56 bits, 64PB.
AU
TG0
15
14
15:14
Granule size for the TTBR0_EL3.
Other values are reserved.
If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.
It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.
0b00
4KB.
0b01
64KB.
0b10
16KB.
AU
SH0
13
12
13:12
Shareability attribute for memory associated with translation table walks using TTBR0_EL3.
Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE.
0b00
Non-shareable.
0b10
Outer Shareable.
0b11
Inner Shareable.
AU
ORGN0
11
10
11:10
Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL3.
0b00
Normal memory, Outer Non-cacheable.
0b01
Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
IRGN0
9
8
9:8
Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL3.
0b00
Normal memory, Inner Non-cacheable.
0b01
Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
7
6
7:6
Reserved, RES0.
T0SZ
5
0
5:0
The size offset of the memory region addressed by TTBR0_EL3. The region size is 2(64-T0SZ) bytes.
The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.
For the 4KB translation granule, if FEAT_LPA2 is implemented, TCR_EL3.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.For the 16KB translation granule, if FEAT_LPA2 is implemented, TCR_EL3.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.
AU
MRS <Xt>, TCR_EL3
if !(HaveEL(EL3) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
Undefined();
elsif PSTATE.EL == EL2 then
Undefined();
elsif PSTATE.EL == EL3 then
X{64}(t) = TCR_EL3();
end;
MSR TCR_EL3, <Xt>
if !(HaveEL(EL3) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
Undefined();
elsif PSTATE.EL == EL2 then
Undefined();
elsif PSTATE.EL == EL3 then
if IsFeatureImplemented(FEAT_FGWTE3) && FGWTE3_EL3().TCR_EL3 == '1' then
AArch64_SystemAccessTrap(EL3, 0x18);
else
TCR_EL3() = X{64}(t);
end;
end;
2026-03-26 20:27:25
2026-03_rel