AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# SCTLR_EL3, System Control Register (EL3)

The SCTLR_EL3 characteristics are:

## Purpose

Provides top level control of the system, including its memory system, at EL3.

## Configuration

This register is present only when EL3 is implemented. Otherwise, direct accesses to SCTLR_EL3 are UNDEFINED.

## Attributes

SCTLR_EL3 is a 64-bit register.

## Field descriptions

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | SPINTMASK | NMI | RES0 | TCSO | RES0 | TME | RES0 | TMT | RES0 | DSSBS | ATA | RES0 | TCF | RES0 | ITFSB | BT | RES0
EnIA | EnIB | RES1 | EnDA | RES0 | EE | RES0 | RES1 | EIS | IESB | RES0 | WXN | RES1 | RES0 | RES1 | RES0 | EnDB | I | EOS | RES0 | nAA | RES1 | SA | C | A | M

#### Bit [63]

Reserved, RES0.

#### SPINTMASK, bit [62]
When FEAT_NMI is implemented:

SP Interrupt Mask enable. When SCTLR_EL3.NMI is 1, controls whether PSTATE.SP acts as an interrupt mask, and controls the value of PSTATE.ALLINT on taking an exception to EL3.

SPINTMASK | Meaning
--- | ---
0b0 | Does not cause PSTATE.SP to mask interrupts. PSTATE.ALLINT is set to 1 on taking an exception to EL3.
0b1 | When PSTATE.SP is 1 and execution is at EL3, an IRQ or FIQ interrupt that is targeted to EL3 is masked regardless of any denotion of Superpriority. PSTATE.ALLINT is set to 0 on taking an exception to EL3.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### NMI, bit [61]
When FEAT_NMI is implemented:

Non-maskable Interrupt enable.

NMI | Meaning
--- | ---
0b0 | This control does not affect interrupt masking behavior.
0b1 | This control enables all of the following: The use of the PSTATE.ALLINT interrupt mask. IRQ and FIQ interrupts to have Superpriority as an additional attribute. PSTATE.SP to be used as an interrupt mask.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### Bit [60]

Reserved, RES0.

#### TCSO, bit [59]
When FEAT_MTE_STORE_ONLY is implemented:

Tag Checking Store Only.

TCSO | Meaning
--- | ---
0b0 | This field has no effect on Tag checking.
0b1 | Load instructions executed in EL3 are Tag Unchecked.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [58:54]

Reserved, RES0.

#### TME, bit [53]
When FEAT_TME is implemented:

Enables the Transactional Memory Extension at EL3.

TME | Meaning
--- | ---
0b0 | Any attempt to execute a TSTART instruction at EL3 is trapped, unless HCR_EL2.TME or SCR_EL3.TME causes TSTART instructions to be UNDEFINED at EL3.
0b1 | This control does not cause any TSTART instruction to be trapped.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [52]

Reserved, RES0.

#### TMT, bit [51]
When FEAT_TME is implemented:

Forces a trivial implementation of the Transactional Memory Extension at EL3.

TMT | Meaning
--- | ---
0b0 | This control does not cause any TSTART instruction to fail.
0b1 | When the TSTART instruction is executed at EL3, the transaction fails with a TRIVIAL failure cause.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [50:45]

Reserved, RES0.

#### DSSBS, bit [44]
When FEAT_SSBS is implemented:

Default PSTATE.SSBS value on Exception Entry.

DSSBS | Meaning
--- | ---
0b0 | PSTATE.SSBS is set to 0 on an exception to EL3.
0b1 | PSTATE.SSBS is set to 1 on an exception to EL3.

The reset behavior of this field is:

- On a Warm reset, this field resets to an IMPLEMENTATION DEFINED value.

####
Otherwise:

Reserved, RES0.

#### ATA, bit [43]
When FEAT_MTE2 is implemented:

Allocation Tag Access in EL3.

Controls access to Allocation Tags and Tag Check operations in EL3.

ATA | Meaning
--- | ---
0b0 | Access to Allocation Tags is prevented at EL3. Memory accesses at EL3 are not subject to a Tag Check operation.
0b1 | This control does not prevent access to Allocation Tags at EL3. Tag Checked memory accesses at EL3 are subject to a Tag Check operation. The Tag Check operation depends on the type of tag at the memory being accessed: For Allocation Tagged memory, an Allocation Tag Check operation. If FEAT_MTE_CANONICAL_TAGS is implemented, for Canonically Tagged memory, a Canonical Tag Check operation.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [42]

Reserved, RES0.

#### TCF, bits [41:40]
When FEAT_MTE2 is implemented:

Tag Check Fault in EL3. Controls the effect of Tag Check Faults due to Loads and Stores in EL3.

TCF | Meaning | Applies when
--- | --- | ---
0b00 | Tag Check Faults have no effect on the PE.
0b01 | Tag Check Faults cause a synchronous exception.
0b10 | Tag Check Faults are asynchronously accumulated.
0b11 | Tag Check Faults cause a synchronous exception on reads, and are asynchronously accumulated on writes. | When FEAT_MTE3 is implemented

If FEAT_MTE3 is not implemented, the value 0b11 is reserved.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [39:38]

Reserved, RES0.

#### ITFSB, bit [37]
When FEAT_MTE2 is implemented:

When synchronous exceptions are not being generated by Tag Check Faults, this field controls whether on exception entry into EL3, all Tag Check Faults due to instructions executed before exception entry, that are reported asynchronously, are synchronized into TFSRE0_EL1 and TFSR_ELx registers.

ITFSB | Meaning
--- | ---
0b0 | Tag Check Faults are not synchronized on entry to EL3.
0b1 | Tag Check Faults are synchronized on entry to EL3.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### BT, bit [36]
When FEAT_BTI is implemented:

PAC Branch Type compatibility at EL3.

BT | Meaning
--- | ---
0b0 | When the PE is executing at EL3, PACIASP and PACIBSP are compatible with PSTATE.BTYPE == 0b11.
0b1 | When the PE is executing at EL3, PACIASP and PACIBSP are not compatible with PSTATE.BTYPE == 0b11.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [35:32]

Reserved, RES0.

#### EnIA, bit [31]
When FEAT_PAuth is implemented:

Controls enabling of pointer authentication of instruction addresses, using the APIAKey_EL1 key, in the EL3 translation regime.

Possible values of this bit are:

EnIA | Meaning
--- | ---
0b0 | Pointer authentication of instruction addresses, using the APIAKey_EL1 key, is not enabled.
0b1 | Pointer authentication of instruction addresses, using the APIAKey_EL1 key, is enabled.

Note

This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EnIB, bit [30]
When FEAT_PAuth is implemented:

Controls enabling of pointer authentication of instruction addresses, using the APIBKey_EL1 key, in the EL3 translation regime.

Possible values of this bit are:

EnIB | Meaning
--- | ---
0b0 | Pointer authentication of instruction addresses, using the APIBKey_EL1 key, is not enabled.
0b1 | Pointer authentication of instruction addresses, using the APIBKey_EL1 key, is enabled.

Note

This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [29:28]

Reserved, RES1.

#### EnDA, bit [27]
When FEAT_PAuth is implemented:

Controls enabling of pointer authentication of instruction addresses, using the APDAKey_EL1 key, in the EL3 translation regime.

EnDA | Meaning
--- | ---
0b0 | Pointer authentication of data addresses, using the APDAKey_EL1 key, is not enabled.
0b1 | Pointer authentication of data addresses, using the APDAKey_EL1 key, is enabled.

Note

This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [26]

Reserved, RES0.

#### EE, bit [25]

Endianness of data accesses at EL3, and stage 1 translation table walks in the EL3 translation regime.

EE | Meaning
--- | ---
0b0 | Explicit data accesses at EL3, and stage 1 translation table walks in the EL3 translation regime are little-endian.
0b1 | Explicit data accesses at EL3, and stage 1 translation table walks in the EL3 translation regime are big-endian.

If an implementation does not provide Big-endian support at Exception levels higher than EL0, this bit is RES0.

If an implementation does not provide Little-endian support at Exception levels higher than EL0, this bit is RES1.

The EE bit is permitted to be cached in a TLB.

The reset behavior of this field is:

- On a Warm reset, this field resets to an IMPLEMENTATION DEFINED value.

#### Bit [24]

Reserved, RES0.

#### Bit [23]

Reserved, RES1.

#### EIS, bit [22]
When FEAT_ExS is implemented:

Exception Entry is Context Synchronizing.

EIS | Meaning
--- | ---
0b0 | The taking of an exception to EL3 is not a context synchronizing event.
0b1 | The taking of an exception to EL3 is a context synchronizing event.

If SCTLR_EL3.EIS is set to 0b0:

- Indirect writes to ESR_EL3, FAR_EL3, SPSR_EL3, ELR_EL3 are synchronized on exception entry to EL3, so that a direct read of the register after exception entry sees the indirectly written value caused by the exception entry.
- Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
- Exception Catch debug events are synchronous debug events.
- DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL3.EIS:

- Changes to the PSTATE information on entry to EL3.
- Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
- Debug state exit.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES1.

#### IESB, bit [21]
When FEAT_IESB is implemented:

Implicit Error Synchronization event enable.

IESB | Meaning
--- | ---
0b0 | Disabled.
0b1 | An implicit error synchronization event is added: At each exception taken to EL3. Before the operational pseudocode of each ERET instruction executed at EL3.

When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its Effective value might be 0 or 1 regardless of the value of the field and, if implemented, SCR_EL3.NMEA. If the Effective value of the field is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL3 and before each DRPS instruction executed at EL3, in addition to the other cases where it is added.

When FEAT_DoubleFault is implemented, the PE is in Non-debug state, and the Effective value of SCR_EL3.NMEA is 1, this field is ignored and its Effective value is 1.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bit [20]

Reserved, RES0.

#### WXN, bit [19]

Write permission implies XN (Execute-never). For the EL3 translation regime, this bit can force all memory regions that are writable to be treated as XN.

WXN | Meaning
--- | ---
0b0 | This control has no effect on memory access permissions.
0b1 | Any region that is writable in the EL3 translation regime is forced to XN for accesses from software executing at EL3.

This bit applies only when SCTLR_EL3.M bit is set.

The WXN bit is permitted to be cached in a TLB.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

#### Bit [18]

Reserved, RES1.

#### Bit [17]

Reserved, RES0.

#### Bit [16]

Reserved, RES1.

#### Bits [15:14]

Reserved, RES0.

#### EnDB, bit [13]
When FEAT_PAuth is implemented:

Controls enabling of pointer authentication of instruction addresses, using the APDBKey_EL1 key, in the EL3 translation regime.

EnDB | Meaning
--- | ---
0b0 | Pointer authentication of data addresses, using the APDBKey_EL1 key, is not enabled.
0b1 | Pointer authentication of data addresses, using the APDBKey_EL1 key, is enabled.

Note

This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of these functions are NOP.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### I, bit [12]

Instruction access Cacheability control, for accesses at EL3:

I | Meaning
--- | ---
0b0 | All instruction access to Normal memory from EL3 are Non-cacheable for all levels of instruction and unified cache. If the value of SCTLR_EL3.M is 0, instruction accesses from stage 1 of the EL3 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable memory.
0b1 | This control has no effect on the Cacheability of instruction access to Normal memory from EL3. If the value of SCTLR_EL3.M is 0, instruction accesses from stage 1 of the EL3 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.

This bit has no effect on the EL1&0, EL2, or EL2&0 translation regimes.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to 0.

#### EOS, bit [11]
When FEAT_ExS is implemented:

Exception Exit is Context Synchronizing.

EOS | Meaning
--- | ---
0b0 | An exception return from EL3 is not a context synchronizing event
0b1 | An exception return from EL3 is a context synchronizing event

If SCTLR_EL3.EOS is set to 0b0:

- Memory transactions, including instruction fetches, from an Exception level always use the translation resources associated with that translation regime.
- Exception Catch debug events are synchronous debug events.
- DCPS* and DRPS instructions are context synchronization events.

The following are not affected by the value of SCTLR_EL3.EOS:

- The indirect write of the PSTATE and PC values from SPSR_EL3 and ELR_EL3 on exception return is synchronized.
- If the PE enters Debug state before the first instruction after an Exception return from EL3 to Non-secure state, any pending Halting debug event completes execution.
- The GIC behavior that allocates interrupts to FIQ or IRQ changes simultaneously with leaving the EL3 Exception level.
- Behavior of accessing the banked copies of the stack pointer using the SP register name for loads, stores and data processing instructions.
- Exit from Debug state.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES1.

#### Bits [10:7]

Reserved, RES0.

#### nAA, bit [6]
When FEAT_LSE2 is implemented:

Non-aligned access. This bit controls generation of Alignment faults at EL3 under certain conditions. The following instructions generate an Alignment fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 bytes for access:

- LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAR, LDARH, LDLAR, LDLARH.

- STLLR, STLLRH, STLR, STLRH, STLUR, and STLURH

If FEAT_LRCPC3 is implemented, the following instructions generate an Alignment fault if all bytes being accessed for a single register are not within a single 16-byte quantity, aligned to 16 bytes for access:

- LDIAPP, STILP, the post index versions of LDAPR and the pre index versions of STLR.

- If Advanced SIMD and floating-point instructions are implemented, LDAPUR (SIMD&FP), LDAP1 (SIMD&FP), STLUR (SIMD&FP), and STL1 (SIMD&FP).

nAA | Meaning
--- | ---
0b0 | Unaligned accesses by the specified instructions generate an Alignment fault.
0b1 | Unaligned accesses by the specified instructions do not generate an Alignment fault.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [5:4]

Reserved, RES1.

#### SA, bit [3]

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL3 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see 'SP alignment checking'.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

#### C, bit [2]

Cacheability control, for data accesses.

C | Meaning
--- | ---
0b0 | All data access to Normal memory from EL3, and all Normal memory accesses to the EL3 translation tables, are Non-cacheable for all levels of data and unified cache.
0b1 | This control has no effect on the Cacheability of: Data access to Normal memory from EL3. Normal memory accesses to the EL3 translation tables.

This bit has no effect on the EL1&0, EL2, or EL2&0 translation regimes.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to 0.

#### A, bit [1]

Alignment check enable. This is the enable bit for Alignment fault checking at EL3.

A | Meaning
--- | ---
0b0 | Alignment fault checking is disabled when executing at EL3. Alignment checks on some instructions are not disabled by this control. For more information, see 'Alignment of data accesses'.
0b1 | Alignment fault checking is enabled when executing at EL3. All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value.

#### M, bit [0]

MMU enable for EL3 stage 1 address translation. Possible values of this bit are:

M | Meaning
--- | ---
0b0 | EL3 stage 1 address translation disabled. See the SCTLR_EL3.I field for the behavior of instruction accesses to Normal memory.
0b1 | EL3 stage 1 address translation enabled.

The reset behavior of this field is:

- On a Warm reset, in a system where the PE resets into EL3, this field resets to 0.

## Accessing SCTLR_EL3

Accesses to this register use the following encodings in the System register encoding space:

#### MRS <Xt>, SCTLR_EL3

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b110 | 0b0001 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then X[t, 64] = SCTLR_EL3;

#### MSR SCTLR_EL3, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b110 | 0b0001 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then if IsFeatureImplemented(FEAT_FGWTE3) && FGWTE3_EL3.SCTLR_EL3 == '1' then AArch64.SystemAccessTrap(EL3, 0x18); else SCTLR_EL3 = X[t, 64];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

26/03/2024 09:49; 67c0ae5282a7629ba0ea0ba7267b43cd4f7939f6

Copyright © 2010-2024 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.