TCR_EL1

This is a collection of Intel®’ IA32® Software Developer's Manuals (URL of the day) and AMD' AMD64 Architecture Programmer's Manual together with the related specifications, application notes, white papers, and change logs. The collection aims to keep all available revisions. It was originally created by Michal Necasek, see OS/2 Museum.

If you have a public document, related to the IA32® specifications and missing from the collection, please mail it to me. The content of this URL and all sub-ULRs is available for convenient bulk download by rsync x86docs password "" (empty).

TCR_EL1, Translation Control Register (EL1)

Purpose

Configuration

AArch64 System register TCR_EL1 bits [31:0] are architecturally mapped to AArch32 System register TTBCR[31:0].

AArch64 System register TCR_EL1 bits [63:32] are architecturally mapped to AArch32 System register TTBCR2[31:0].

This register is present only when FEAT_AA64 is implemented. Otherwise, direct accesses to TCR_EL1 are UNDEFINED.

Attributes

Field descriptions

Bits [63:62]

MTX1, bit [61]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Extended memory tag checking.

This field controls address generation and Canonical tagging when EL0 and EL1 are using AArch64 where the data address would be translated by tables pointed to by TTBR1_EL1.

This control has an effect regardless of whether stage 1 of the EL1&0 translation regime is enabled or not.

MTX1	Meaning
0b0	Canonical tagging is disabled. This control has no effect on address generation.
0b1	Canonical tagging is enabled. Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply: Bits[59:56] are treated as 0b1111 when checking if the address is out of range. If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field. A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

MTX1

Meaning

0b0

Canonical tagging is disabled.

This control has no effect on address generation.

0b1

Canonical tagging is enabled.

Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:

Bits[59:56] are treated as 0b1111 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

For more information see Logical address tagging and Memory region tagging types.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.MTX1 == '1'.

Otherwise:

MTX0, bit [60]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Extended memory tag checking.

This field controls address generation and Canonical tagging when EL0 and EL1 are using AArch64 where the data address would be translated by tables pointed to by TTBR0_EL1.

This control has an effect regardless of whether stage 1 of the EL1&0 translation regime is enabled or not.

MTX0	Meaning
0b0	Canonical tagging is disabled. This control has no effect on address generation.
0b1	Canonical tagging is enabled. Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply: Bits[59:56] are treated as 0b0000 when checking if the address is out of range. If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field. A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

MTX0

Meaning

0b0

Canonical tagging is disabled.

This control has no effect on address generation.

0b1

Canonical tagging is enabled.

Bits[59:56] of a 64-bit VA hold a Logical Address Tag, and all of the following apply:

Bits[59:56] are treated as 0b0000 when checking if the address is out of range.
If FEAT_PAuth is implemented, bits[59:56] are not part of the PAC field.
A Canonical Tag Check operation is performed on Tag Checked memory accesses to a Canonically Tagged memory location.

For more information see Logical address tagging and Memory region tagging types.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.MTX0 == '1'.

Otherwise:

DS, bit [59]
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR2_EL1.D128 == '0'):

This field affects:

Whether a 52-bit output address can be described by the translation tables of the 4KB or 16KB translation granules.
The minimum value of TCR_EL1.{T0SZ,T1SZ}.
How and where shareability for Block and Page descriptors are encoded.

DS	Meaning
0b0	Bits[49:48] of translation descriptors are RES0. Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware. The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault. Output address[51:48] is 0b0000.
0b1	Bits[49:48] of translation descriptors hold output address[49:48]. Bits[9:8] of Translation table descriptors hold output address[51:50]. The shareability information of Block and Page descriptors for cacheable locations is determined by: TCR_EL1.SH0 if the VA is translated using tables pointed to by TTBR0_EL1. TCR_EL1.SH1 if the VA is translated using tables pointed to by TTBR1_EL1. The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault. All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes. Bits[5:2] of TTBR0_EL1 or TTBR1_EL1 are used to hold bits[51:48] of the output address in all cases. Note As FEAT_LVA must be implemented if TCR_EL1.DS == 1, the minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12, as determined by that extension. For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00. Note This forces alignment of the ranges used by the TLBI range instructions.

Meaning

0b0

Bits[49:48] of translation descriptors are RES0.

Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware.

The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 16. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.

Output address[51:48] is 0b0000.

0b1

Bits[49:48] of translation descriptors hold output address[49:48].

Bits[9:8] of Translation table descriptors hold output address[51:50].

The shareability information of Block and Page descriptors for cacheable locations is determined by:

TCR_EL1.SH0 if the VA is translated using tables pointed to by TTBR0_EL1.
TCR_EL1.SH1 if the VA is translated using tables pointed to by TTBR1_EL1.

The minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12. Any memory access using a smaller value generates a stage 1 level 0 translation table fault.

All calculations of the stage 1 base address are modified for tables of fewer than 8 entries so that the table is aligned to 64 bytes.

Bits[5:2] of TTBR0_EL1 or TTBR1_EL1 are used to hold bits[51:48] of the output address in all cases.

Note

As FEAT_LVA must be implemented if TCR_EL1.DS == 1, the minimum value of the TCR_EL1.{T0SZ, T1SZ} fields is 12, as determined by that extension.

For the TLBI Range instructions affecting VA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0b0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 0b00.

Note

This forces alignment of the ranges used by the TLBI range instructions.

This field is RES0 for a 64KB translation granule.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.DS == '1'.

Otherwise:

TCMA1, bit [58]
When FEAT_MTE2 is implemented:

Controls the generation of Unchecked accesses at EL1, and at EL0 if the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, when address[59:55] = 0b11111.

TCMA1	Meaning
0b0	This control has no effect on the generation of Unchecked accesses at EL1 or EL0.
0b1	All accesses at EL1 and EL0 are Unchecked.

Note

Software may change this control bit on a context switch.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TCMA1 == '1'.

Otherwise:

TCMA0, bit [57]
When FEAT_MTE2 is implemented:

Controls the generation of Unchecked accesses at EL1, and at EL0 if the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, when address[59:55] = 0b00000.

TCMA0	Meaning
0b0	This control has no effect on the generation of Unchecked accesses at EL1 or EL0.
0b1	All accesses at EL1 and EL0 are Unchecked.

Note

Software may change this control bit on a context switch.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TCMA0 == '1'.

Otherwise:

E0PD1, bit [56]
When FEAT_E0PD is implemented:

Faulting control for unprivileged access to any address translated by TTBR1_EL1.

E0PD1	Meaning
0b0	Unprivileged access to any address translated by TTBR1_EL1 will not generate a fault by this mechanism.
0b1	Unprivileged access to any address translated by TTBR1_EL1 will generate a level 0 Translation fault.

Level 0 Translation faults generated as a result of this field are not counted as TLB misses for performance monitoring. The fault should take the same time to generate, whether the address is present in the TLB or not, to mitigate attacks that use fault timing.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.E0PD1 == '1'.

Otherwise:

E0PD0, bit [55]
When FEAT_E0PD is implemented:

Faulting control for unprivileged access to any address translated by TTBR0_EL1.

E0PD0	Meaning
0b0	Unprivileged access to any address translated by TTBR0_EL1 will not generate a fault by this mechanism.
0b1	Unprivileged access to any address translated by TTBR0_EL1 will generate a level 0 Translation fault.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.E0PD0 == '1'.

Otherwise:

NFD1, bit [54]
When FEAT_SVE is implemented:

Non-Fault translation timing Disable when using TTBR1_EL1.

Controls how a TLB miss is reported in response to a non-fault unprivileged access for a virtual address that is translated using TTBR1_EL1.

If SVE is implemented, the affected access types include:

All accesses due to an SVE non-fault contiguous load instruction.
Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.

NFD1	Meaning
0b0	Does not affect the handling of a TLB miss on accesses translated using TTBR1_EL1.
0b1	A TLB miss on a virtual address that is translated using TTBR1_EL1 due to the specified access types causes the access to fail without taking an exception. The amount of time that the failure takes to be handled should not predictively leak whether it was caused by a TLB miss or a Permission fault, to mitigate attacks that use fault timing.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.NFD1 == '1'.

Otherwise:

NFD0, bit [53]
When FEAT_SVE is implemented:

Non-Fault translation timing Disable when using TTBR0_EL1.

Controls how a TLB miss is reported in response to a non-fault unprivileged access for a virtual address that is translated using TTBR0_EL1.

If SVE is implemented, the affected access types include:

All accesses due to an SVE non-fault contiguous load instruction.
Accesses due to an SVE first-fault gather load instruction that are not for the First active element. Accesses due to an SVE first-fault contiguous load instruction are not affected.
Accesses due to prefetch instructions might be affected, but the effect is not architecturally visible.

NFD0	Meaning
0b0	Does not affect the handling of a TLB miss on accesses translated using TTBR0_EL1.
0b1	A TLB miss on a virtual address that is translated using TTBR0_EL1 due to the specified access types causes the access to fail without taking an exception. The amount of time that the failure takes to be handled should not predictively leak whether it was caused by a TLB miss or a Permission fault, to mitigate attacks that use fault timing.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.NFD0 == '1'.

Otherwise:

TBID1, bit [52]
When FEAT_PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.

For more information, see 'Address tagging'.

TBID1	Meaning
0b0	TCR_EL1.TBI1 applies to Instruction and Data accesses.
0b1	TCR_EL1.TBI1 applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR1_EL1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TBID1 == '1'.

Otherwise:

TBID0, bit [51]
When FEAT_PAuth is implemented:

Controls the use of the top byte of instruction addresses for address matching.

For the purpose of this field, all cache maintenance and address translation instructions that perform address translation are treated as data accesses.

For more information, see 'Address tagging'.

TBID0	Meaning
0b0	TCR_EL1.TBI0 applies to Instruction and Data accesses.
0b1	TCR_EL1.TBI0 applies to Data accesses only.

This affects addresses where the address would be translated by tables pointed to by TTBR0_EL1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TBID0 == '1'.

Otherwise:

HWU162, bit [50]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.

HWU162	Meaning
0b0	For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU162 == '1'.

Otherwise:

HWU161, bit [49]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.

HWU161	Meaning
0b0	For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU161 == '1'.

Otherwise:

HWU160, bit [48]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.

HWU160	Meaning
0b0	For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU160 == '1'.

Otherwise:

HWU159, bit [47]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR1_EL1.

HWU159	Meaning
0b0	For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD1 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU159 == '1'.

Otherwise:

HWU062, bit [46]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU062	Meaning
0b0	For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR0_EL1, bit[62] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU062 == '1'.

Otherwise:

HWU061, bit [45]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU061	Meaning
0b0	For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR0_EL1, bit[61] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU061 == '1'.

Otherwise:

HWU060, bit [44]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU060	Meaning
0b0	For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR0_EL1, bit[60] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU060 == '1'.

Otherwise:

HWU059, bit [43]
When FEAT_HPDS2 is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 translation table Block or Page entry for translations using TTBR0_EL1.

HWU059	Meaning
0b0	For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1	For translations using TTBR0_EL1, bit[59] of each stage 1 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL1.HPD0 is 1.

The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.HWU059 == '1'.

Otherwise:

HPD1, bit [42]
When FEAT_HPDS is implemented:

HPD1	Meaning
0b0	Hierarchical permissions are enabled.
0b1	Hierarchical permissions are disabled.

Otherwise:

HPD0, bit [41]
When FEAT_HPDS is implemented:

HPD0	Meaning
0b0	Hierarchical permissions are enabled.
0b1	Hierarchical permissions are disabled.

Otherwise:

HD, bit [40]
When FEAT_HAFDBS is implemented:

HD	Meaning
0b0	Stage 1 hardware management of dirty state disabled.
0b1	Stage 1 hardware management of dirty state enabled.

Otherwise:

HA, bit [39]
When FEAT_HAF is implemented:

HA	Meaning
0b0	Stage 1 Access flag update disabled.
0b1	Stage 1 Access flag update enabled.

Otherwise:

TBI1, bit [38]

Top Byte ignored. Indicates whether the top byte of an address is used for address match for the TTBR1_EL1 region, or ignored and used for tagged addresses.

TBI1	Meaning
0b0	Top Byte used in the address calculation.
0b1	Top Byte ignored in the address calculation.

This affects addresses generated at EL0 and EL1 using AArch64 where the address would be translated by tables pointed to by TTBR1_EL1. It has an effect whether the EL1&0 translation regime is enabled or not.

If FEAT_PAuth is implemented and TCR_EL1.TBID1 is 1, then this field only applies to Data accesses.

Otherwise, if the value of TBI1 is 1 and bit [55] of the target address to be stored to the PC is 1, then bits[63:56] of that target address are also set to 1 before the address is stored in the PC, in the following cases:

A branch or procedure return within EL1 or EL0.
An exception taken to EL1.
An exception return to EL1 or EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TBI1 == '1'.

TBI0, bit [37]

Top Byte ignored. Indicates whether the top byte of an address is used for address match for the TTBR0_EL1 region, or ignored and used for tagged addresses.

TBI0	Meaning
0b0	Top Byte used in the address calculation.
0b1	Top Byte ignored in the address calculation.

This affects addresses generated at EL0 and EL1 using AArch64 where the address would be translated by tables pointed to by TTBR0_EL1. It has an effect whether the EL1&0 translation regime is enabled or not.

If FEAT_PAuth is implemented and TCR_EL1.TBID0 is 1, then this field only applies to Data accesses.

Otherwise, if the value of TBI0 is 1 and bit [55] of the target address to be stored to the PC is 0, then bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the following cases:

A branch or procedure return within EL1 or EL0.
An exception taken to EL1.
An exception return to EL1 or EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TBI0 == '1'.

AS, bit [36]

ASID Size.

AS	Meaning
0b0	8 bit - the upper 8 bits of TTBR0_EL1 and TTBR1_EL1 are ignored by hardware for every purpose except reading back the register, and are treated as if they are all zeros for when used for allocation and matching entries in the TLB.
0b1	16 bit - the upper 16 bits of TTBR0_EL1 and TTBR1_EL1 are used for allocation and matching in the TLB.

If the implementation has only 8 bits of ASID, this field is RES0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.AS == '1'.

Bit [35]

IPS, bits [34:32]

Intermediate Physical Address Size.

IPS	Meaning
0b000	32 bits, 4GB.
0b001	36 bits, 64GB.
0b010	40 bits, 1TB.
0b011	42 bits, 4TB.
0b100	44 bits, 16TB.
0b101	48 bits, 256TB.
0b110	52 bits, 4PB.
0b111	56 bits, 64PB.

The values 0b110 and 0b111 represent different output address sizes depending on implementation choices and translation configuration.

The following table captures the output address size represented by the value 0b110:

Descriptor Format	ID_AA64MMFR0_EL1.PARange	Translation Granule	DS¹	Represented OA size
Any	0b0101	Any	Any	48 bits, 256TB
VMSAv8-64	0b011x	4KB or 16KB	0	48 bits, 256TB
VMSAv8-64	0b011x	4KB or 16KB	1	52 bits, 4PB
VMSAv8-64	0b011x	64KB	N/A	52 bits, 4PB
VMSAv9-128	0b011x	Any	N/A	52 bits, 4PB

¹ This column represents the value of TCR_EL1.DS.

The following table captures the output address size represented by the value 0b111:

Descriptor Format	ID_AA64MMFR0_EL1.PARange	Translation Granule	Represented OA size
Any	0b0110	Any	OA size represented by0b110
VMSAv8-64	0b0111	Any	OA size represented by0b110
VMSAv9-128	0b0111	Any	56 bits, 64PB

If 52-bit PA is supported, and the translation table descriptors cannot express an OA larger than 48-bits, then bits[51:48] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL1.

If 56-bit PA is supported, and the translation table descriptors cannot express an OA larger than 52-bits, then bits[55:52] of every translation table base address are treated as 0b0000 for the stage of translation controlled by TCR_EL1.

If the output address size represented by this field is larger than the supported PA size expressed in ID_AA64MMFR0_EL1.PARange, then the output address size is treated as being the same as the supported PA size. Arm strongly recommends that software avoids configuring this field to a value representing an output address size larger than the supported PA size.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.IPS == '1'.

TG1, bits [31:30]

Granule size for the TTBR1_EL1.

TG1	Meaning
0b01	16KB.
0b10	4KB.
0b11	64KB.

Other values are reserved.

If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TG1 == '1'.

SH1, bits [29:28]

ORGN1, bits [27:26]

SH1	Meaning
0b00	Non-shareable.
0b10	Outer Shareable.
0b11	Inner Shareable.

Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL1.

ORGN1	Meaning
0b00	Normal memory, Outer Non-cacheable.
0b01	Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.ORGN1 == '1'.

IRGN1, bits [25:24]

Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL1.

IRGN1	Meaning
0b00	Normal memory, Inner Non-cacheable.
0b01	Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.IRGN1 == '1'.

EPD1, bit [23]

Translation table walk disable for translations using TTBR1_EL1. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR1_EL1. The encoding of this bit is:

EPD1	Meaning
0b0	Perform translation table walks using TTBR1_EL1.
0b1	A TLB miss on an address that is translated using TTBR1_EL1 generates a Translation fault. No translation table walk is performed.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.EPD1 == '1'.

A1, bit [22]

T1SZ, bits [21:16]

A1	Meaning
0b0	TTBR0_EL1.ASID defines the ASID.
0b1	TTBR1_EL1.ASID defines the ASID.

The size offset of the memory region addressed by TTBR1_EL1. The region size is 2^(64-T1SZ) bytes.

The maximum and minimum possible values for T1SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

Note

For the 4KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.

For the 16KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.T1SZ == '1'.

TG0, bits [15:14]

Granule size for the TTBR0_EL1.

TG0	Meaning
0b00	4KB
0b01	64KB
0b10	16KB

Other values are reserved.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.TG0 == '1'.

SH0, bits [13:12]

ORGN0, bits [11:10]

SH0	Meaning
0b00	Non-shareable
0b10	Outer Shareable
0b11	Inner Shareable

Outer cacheability attribute for memory associated with translation table walks using TTBR0_EL1.

ORGN0	Meaning
0b00	Normal memory, Outer Non-cacheable.
0b01	Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.ORGN0 == '1'.

IRGN0, bits [9:8]

Inner cacheability attribute for memory associated with translation table walks using TTBR0_EL1.

IRGN0	Meaning
0b00	Normal memory, Inner Non-cacheable.
0b01	Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10	Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11	Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.IRGN0 == '1'.

EPD0, bit [7]

Translation table walk disable for translations using TTBR0_EL1. This bit controls whether a translation table walk is performed on a TLB miss, for an address that is translated using TTBR0_EL1. The encoding of this bit is:

EPD0	Meaning
0b0	Perform translation table walks using TTBR0_EL1.
0b1	A TLB miss on an address that is translated using TTBR0_EL1 generates a Translation fault. No translation table walk is performed.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.EPD0 == '1'.

Bit [6]

T0SZ, bits [5:0]

The size offset of the memory region addressed by TTBR0_EL1. The region size is 2^(64-T0SZ) bytes.

The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

Note

For the 4KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.

For the 16KB translation granule, if FEAT_LPA2 is implemented, TCR_EL1.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing this field has the following behavior:

Access to this field is RO if all the following are true:
- FEAT_SRMASK is implemented.
- EL1 is the current Exception level.
- IsSystemRegisterMaskingEnabled(EL1).
- TCRMASK_EL1.T0SZ == '1'.

Accessing TCR_EL1

When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL3 using the accessor name TCR_EL1 or TCR_EL12 are not guaranteed to be ordered with respect to accesses using the other accessor name.

If FEAT_SRMASK is implemented, accesses to TCR_EL1 are masked by TCRMASK_EL1.

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, TCR_EL1

op0	op1	CRn	CRm	op2
0b11	0b000	0b0010	0b0000	0b010

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TRVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGRTR_EL2().TCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then X{64}(t) = NVMem(0x120); else X{64}(t) = TCR_EL1(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = TCR_EL2(); else X{64}(t) = TCR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = TCR_EL1(); end;

MSR TCR_EL1, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b000	0b0010	0b0000	0b010

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGWTR_EL2().TCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem(0x120) = X{64}(t); else TCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then TCR_EL2() = X{64}(t); else TCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then TCR_EL1() = X{64}(t); end;

When FEAT_VHE is implemented

MRS <Xt>, TCR_EL12

op0	op1	CRn	CRm	op2
0b11	0b101	0b0010	0b0000	0b010

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then X{64}(t) = NVMem(0x120); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = TCR_EL1(); else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then X{64}(t) = TCR_EL1(); else Undefined(); end; end;

When FEAT_VHE is implemented

MSR TCR_EL12, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b101	0b0010	0b0000	0b010

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then NVMem(0x120) = X{64}(t); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then TCR_EL1() = X{64}(t); else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then TCR_EL1() = X{64}(t); else Undefined(); end; end;

When FEAT_SRMASK is implemented

MRS <Xt>, TCRALIAS_EL1

op0	op1	CRn	CRm	op2
0b11	0b000	0b0010	0b0111	0b110

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TRVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT2) && ((HaveEL(EL3) && SCR_EL3().FGTEn2 == '0') || HFGRTR2_EL2().nTCRALIAS_EL1 == '0') then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then X{64}(t) = NVMem(0x120); else X{64}(t) = TCR_EL1(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = TCR_EL2(); else X{64}(t) = TCR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = TCR_EL1(); end;

When FEAT_SRMASK is implemented

MSR TCRALIAS_EL1, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b000	0b0010	0b0111	0b110

if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT2) && ((HaveEL(EL3) && SCR_EL3().FGTEn2 == '0') || HFGWTR2_EL2().nTCRALIAS_EL1 == '0') then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem(0x120) = X{64}(t); else TCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then TCR_EL2() = X{64}(t); else TCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then TCR_EL1() = X{64}(t); end;

63	62	61	60	59	58	57	56	55	54	53	52	51	50	49	48	47	46	45	44	43	42	41	40	39	38	37	36	35	34	33	32
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0		MTX1	MTX0	DS	TCMA1	TCMA0	E0PD1	E0PD0	NFD1	NFD0	TBID1	TBID0	HWU162	HWU161	HWU160	HWU159	HWU062	HWU061	HWU060	HWU059	HPD1	HPD0	HD	HA	TBI1	TBI0	AS	RES0	IPS
TG1		SH1		ORGN1		IRGN1		EPD1	A1	T1SZ						TG0		SH0		ORGN0		IRGN0		EPD0	RES0	T0SZ

TCR_EL1, Translation Control Register (EL1)

Purpose

Configuration

Attributes

Field descriptions

Bits [63:62]

MTX1, bit [61]When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Otherwise:

MTX0, bit [60]When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

Otherwise:

DS, bit [59]When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR2_EL1.D128 == '0'):

Otherwise:

TCMA1, bit [58]When FEAT_MTE2 is implemented:

Otherwise:

TCMA0, bit [57]When FEAT_MTE2 is implemented:

Otherwise:

E0PD1, bit [56]When FEAT_E0PD is implemented:

Otherwise:

E0PD0, bit [55]When FEAT_E0PD is implemented:

Otherwise:

NFD1, bit [54]When FEAT_SVE is implemented:

Otherwise:

NFD0, bit [53]When FEAT_SVE is implemented:

Otherwise:

TBID1, bit [52]When FEAT_PAuth is implemented:

Otherwise:

TBID0, bit [51]When FEAT_PAuth is implemented:

Otherwise:

HWU162, bit [50]When FEAT_HPDS2 is implemented:

Otherwise:

HWU161, bit [49]When FEAT_HPDS2 is implemented:

Otherwise:

HWU160, bit [48]When FEAT_HPDS2 is implemented:

Otherwise:

HWU159, bit [47]When FEAT_HPDS2 is implemented:

Otherwise:

HWU062, bit [46]When FEAT_HPDS2 is implemented:

Otherwise:

HWU061, bit [45]When FEAT_HPDS2 is implemented:

Otherwise:

HWU060, bit [44]When FEAT_HPDS2 is implemented:

Otherwise:

HWU059, bit [43]When FEAT_HPDS2 is implemented:

Otherwise:

HPD1, bit [42]When FEAT_HPDS is implemented:

Otherwise:

HPD0, bit [41]When FEAT_HPDS is implemented:

Otherwise:

HD, bit [40]When FEAT_HAFDBS is implemented:

Otherwise:

HA, bit [39]When FEAT_HAF is implemented:

Otherwise:

TBI1, bit [38]

TBI0, bit [37]

AS, bit [36]

Bit [35]

IPS, bits [34:32]

TG1, bits [31:30]

SH1, bits [29:28]

ORGN1, bits [27:26]

IRGN1, bits [25:24]

EPD1, bit [23]

A1, bit [22]

T1SZ, bits [21:16]

TG0, bits [15:14]

SH0, bits [13:12]

ORGN0, bits [11:10]

IRGN0, bits [9:8]

EPD0, bit [7]

Bit [6]

T0SZ, bits [5:0]

Accessing TCR_EL1

MRS <Xt>, TCR_EL1

MSR TCR_EL1, <Xt>

When FEAT_VHE is implemented

MRS <Xt>, TCR_EL12

When FEAT_VHE is implemented

MSR TCR_EL12, <Xt>

When FEAT_SRMASK is implemented

MRS <Xt>, TCRALIAS_EL1

MTX1, bit [61]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

MTX0, bit [60]
When FEAT_MTE_NO_ADDRESS_TAGS is implemented or FEAT_MTE_CANONICAL_TAGS is implemented:

DS, bit [59]
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or TCR2_EL1.D128 == '0'):

TCMA1, bit [58]
When FEAT_MTE2 is implemented:

TCMA0, bit [57]
When FEAT_MTE2 is implemented:

E0PD1, bit [56]
When FEAT_E0PD is implemented:

E0PD0, bit [55]
When FEAT_E0PD is implemented:

NFD1, bit [54]
When FEAT_SVE is implemented:

NFD0, bit [53]
When FEAT_SVE is implemented:

TBID1, bit [52]
When FEAT_PAuth is implemented:

TBID0, bit [51]
When FEAT_PAuth is implemented:

HWU162, bit [50]
When FEAT_HPDS2 is implemented:

HWU161, bit [49]
When FEAT_HPDS2 is implemented:

HWU160, bit [48]
When FEAT_HPDS2 is implemented:

HWU159, bit [47]
When FEAT_HPDS2 is implemented:

HWU062, bit [46]
When FEAT_HPDS2 is implemented:

HWU061, bit [45]
When FEAT_HPDS2 is implemented:

HWU060, bit [44]
When FEAT_HPDS2 is implemented:

HWU059, bit [43]
When FEAT_HPDS2 is implemented:

HPD1, bit [42]
When FEAT_HPDS is implemented:

HPD0, bit [41]
When FEAT_HPDS is implemented:

HD, bit [40]
When FEAT_HAFDBS is implemented:

HA, bit [39]
When FEAT_HAF is implemented: