Hubbry Logo
Control registerControl registerMain
Open search
Control register
Community hub
Control register
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Contribute something
Control register
Control register
Control register
View on Wikipedia
from Wikipedia

A control register is a processor register that changes or controls the general behavior of a CPU or other digital device. Common tasks performed by control registers include interrupt control, switching the addressing mode, paging control, and coprocessor control.

History

[edit]

The early CPU lacked dedicated control registers, and relied on a limited set of internal signals and flags.[1] When IBM developed a paging version[note 1] of the System/360, they added 16 control registers[2][3] to the design for what became the 360/67. IBM did not provide control registers on other S/360 models, but made them a standard part[4] of System/370, although with different register and bit assignments. As IBM added new features to the architecture, e.g., DAS, S/370-XA, S/370-ESA, ESA/390, they added additional fields to the control registers. With z/Architecture, IBM doubled the control register size to 64 bits.

Control registers in IBM 360/67

[edit]

On the 360/67, CR0 and CR2 are used by address translation, CR 4-6 contain miscellaneous flags including interrupt masks and Extended Control Mode,[3] and CR 8-14[5] contain the switch settings on the 2167 Configuration Unit.

M67 CR0

[edit]

Control Register 0 contains the address of the segment table for dynamic address translation.

M67 CR2

[edit]

Control register 2 is the Relocation exception address register.

M67 CR4

[edit]

CR4 is the extended mask register for channels 0-31. Each bit is the 1/0 channel mask for the corresponding channel.

M67 CR5

[edit]

CR5 is reserved for the extended mask register for channels 32–63. Each bit is the 1/0 channel mask for the corresponding channel.

M67 CR6

[edit]

CR6 contains two mode flags plus extensions to the PSW mask bits.

CR6 Flags and Masks
Field Bit Description
0 0 Machine Check Mask Extension for Channel Controller o
1 1 Machine Check Mask Extension for Channel Controller 1
2-3 Reserved for channel controllers 2-3
4-7 Unassigned
8 8 Extended Control Mode
9 9 Configuration Control Bit
10-23 Unassigned
24-31 External interrupt masking
24 Timer
25 Interrupt Key
26 Malfunction Alert - CPU 1 (Ext. Sig. 2)
27 Malfunction Alert - CPU 2 (Ext. Sig. 3)
28 Reserved (Ext. Sig. 4)
29 Reserved (Ext. Sig. 5)
30 External Interrupt - CPU 1, 2 (Ext. Sig. 6)
31 Reserved (Ext. Sig. 7)

M67 CR8

[edit]

Control Register 8 contains the assignments of Processor Storage units 1–4 to central processing units (CPUs) and channel controllers (CCs).

Processor Storage unit 1-4 assignment
Bit Description
0 Processor Storage Unit 1 to CPU 1
1 Processor Storage Unit 1 to CPU 2
2-3 Reserved for CPU 3-4
4 Processor Storage Unit 1 to CC 0
5 Processor Storage Unit 1 to CC 1
6-7 Reserved for CC 3-4
8 Processor Storage Unit 2 to CPU 1
9 Processor Storage Unit 2 to CPU 2
10-11 Reserved for CPU 3-4
12 Processor Storage Unit 2 to CC 0
13 Processor Storage Unit 2 to CC 1
14-15 Reserved for CC 3-4
16 Processor Storage Unit 3 to CPU 1
17 Processor Storage Unit 3 to CPU 2
18-19 Reserved for CPU 3-4
20 Processor Storage Unit 3 to CC 0
21 Processor Storage Unit 3 to CC 1
22-23 Reserved for CC 3-4
24 Processor Storage Unit 4 to CPU 1
25 Processor Storage Unit 4 to CPU 2
26-27 Reserved for CPU 3-4
28 Processor Storage Unit 4 to CC 0
29 Processor Storage Unit 4 to CC 1
30-31 Reserved for CC 3-4

M67 CR9

[edit]

Control Register 9 contains the assignments of Processor Storage units 5–8 to central processing units (CPUs) and channel controllers (CCs).

Processor Storage unit 1-4 assignment
Bit Description
0 Processor Storage Unit 5 to CPU 1
1 Processor Storage Unit 5 to CPU 2
2-3 Reserved for CPU 3-4
4 Processor Storage Unit 5 to CC 0
5 Processor Storage Unit 5 to CC 1
6-7 Reserved for CC 3-4
8 Processor Storage Unit 6 to CPU 66
9 Processor Storage Unit 6 to CPU 2
10-11 Reserved for CPU 3-4
12 Processor Storage Unit 6 to CC 0
13 Processor Storage Unit 6 to CC 1
14-15 Reserved for CC 3-4
16 Processor Storage Unit 7 to CPU 1
17 Processor Storage Unit 7 to CPU 2
18-19 Reserved for CPU 3-4
20 Processor Storage Unit 7 to CC 0
21 Processor Storage Unit 7 to CC 1
22-23 Reserved for CC 3-4
24 Processor Storage Unit 8 to CPU 1
25 Processor Storage Unit 8 to CPU 2
26-27 Reserved for CPU 3-4
28 Processor Storage Unit 8 to CC 0
29 Processor Storage Unit 8 to CC 1
30-31 Reserved for CC 3-4

M67 CR10

[edit]

Control Register 10 contains the Processor storage address assignment codes.

Processor storage address bits 11-14 assignment codes
Bit Starting Address Code for
0-3 Processor Storage Unit 1
4-7 Processor Storage Unit 2
8-11 Processor Storage Unit 3
12-15 Processor Storage Unit 4
16-19 Processor Storage Unit 5
20-23 Processor Storage Unit 6
24-27 Processor Storage Unit 7
28-31 Processor Storage Unit 8

M67 CR11

[edit]

Control Register 11 contains channel controller (CC) assignments.

CR11 Channel Controller (CC) partitioning
Bit Description
0 CC 0 available on CPU 1
1 CC 0 available on CPU 2
2-3 Reserved for CPUs 3-4
4 CC 1 available on CPU 1
5 CC 1 available on CPU 2
6-7 Reserved for CPUs 3-4
8-15 Unassigned
16 CPU 1 to only CC 0
17 CPU 1 to only CC 1
18-19 Reserved for CC 2-3
20 CPU 2 to only CC 0
21 CPU 2 to only CC 1
22-23 Reserved for CC 2-3
24-31 Unassigned

M67 CR12

[edit]

CR12 contains I/O Control Unit Partitioning.

CR12 I/O Control Unit 1-16 Partitioning
Bit I/O Control Unit Interface
0 1 1
1 2
2 2 1
3 2
4 3 1
5 2
6 4 1
7 2
8 5 1
9 2
10 6 1
11 2
12 7 1
13 2
14 8 1
15 2
16 9 1
17 2
18 10 1
19 2
20 11 1
21 2
22 12 1
23 2
24 13 1
25 2
26 14 1
27 2
28 15 1
29 2
30 16 1
31 2

M67 CR13

[edit]

CR13 contains I/O Control Unit Partitioning.

CR13 I/O Control Unit 17-32 Partitioning
Bit I/O Control Unit Interface
0 17 1
1 2
2 18 1
3 2
4 19 1
5 2
6 20 1
7 2
8 21 1
9 2
10 22 1
11 2
12 23 1
13 2
14 24 1
15 2
16 25 1
17 2
18 26 1
19 2
20 27 1
21 2
22 28 1
23 2
24 29 1
25 2
26 30 1
27 2
28 31 1
29 2
30 32 1
31 2

M67 CR14

[edit]

CR14 contains indicators.

CR14 Indicators
Bit Indicator
0-27 Unassigned
22 2167 Power On
23 Unassigned
24 Direct Control, CPU 1
25 Direct Control, CPU 2
26-27 Unassigned
28 Prefix, CPU 1
29 Prefix, CPU 2
30-31 Unassigned

Control registers in IBM S/390

[edit]

The control registers of ESA/390[6] on the IBM S/390 are an evolutionary enhancement to the control registers on the earlier ESA/370,[7] S/370-XA[8] and S/370[9] processors. For details on which fields are dependent on specific features, consult the Principles of Operation.[10]

ESA/390 control registers
CR bits Field
0 1 SSM-suppression
0 2 TOD-clock-sync control
0 3 Low-address-protection control
0 4 Extraction-authority control
0 5 Secondary-space control
0 6 Fetch-protection-override control
0 7 Storage-protection-override control
0 8-12 Translation format
0 13 AFP-register control
0 14 Vector control
0 15 Address-space-function control
0 16 Malfunction-alert subclass mask
0 17 Emergency-signal subclass mask
0 18 External-call subclass mask
0 19 TOD-clock sync-check subclass mask
0 20 Clock-comparator subclass mask
0 21 CPU-timer subclass mask
0 22 Service-signal subclass mask
0 24 Set to 1
0 25 Interrupt-key subclass mask
0 26 Set to 1
0 27 ETR subclass mask
0 28 Program-call-fast
0 29 Crypto control
1 0 Primary space-switch-event control
1 1-19 Primary segment-table origin
1 22 Primary subspace-group control
1 23 Primary private-space control
1 24 Primary storage-alteration-event control
1 25-31 Primary segment-table length
2 1-25 Dispatchable-unit-control-table origin
3 0-15 PSW-key mask
3 16-31 Secondary ASN
4 0-15 Authorization index
4 16-31 Primary ASN
5 0 Subsystem-linkage control
5 1-24 Linkage-table origin
5 25-31 Linkage-table length
5 1-25 When the address-space-function control is one,
Primary-ASN-second-table-entry
6 0-7 I/O-interruption subclass mask
7 1-19 Secondary segment-table origin
7 22 Secondary subspace-group control
7 23 Secondary private-space control
7 24 Secondary storage-alteration-event control
7 25-31 Secondary segment-table length
8 0-15 Extended authorization index
8 16-31 Monitor masks
9 0 Successful-branching-event mask
9 1 Instruction-fetching-event mask
9 2 Storage-alteration-event mask
9 3 GR-alteration-event mask
9 4 Store-using-real-address-event mask
9 8 Branch-address control
9 10 Storage-alteration-space control
9 16-31 PER general-register masks
10 1-31 PER starting address
11 1-31 PER ending address
12 0 Branch-trace control
12 1-29 Trace-entry address
12 30 ASN-trace control
12 31 Explicit-trace control
13 0 Home space-switch-event control
13 1-19 Home segment-table origin
13 23 Home private-space control
13 24 Home storage-alteration-event control
13 25-31 Home segment-table length
14 0 Set to 1
14 1 Set to 1
14 2 Extended-save-area control
14 3 Channel-report-pending subclass mask
14 4 Recovery subclass mask
14 5 Degradation subclass mask
14 6 External-damage subclass mask
14 7 Warning subclass mask
14 10 TOD-clock-control-override control
14 12 ASN-translation control
14 13-31 ASN-first-table origin
15 1-28 Linkage-stack-entry address

Control registers in IBM z/Architecture

[edit]

The control registers of z/Architecture[11] are an evolutionary enhancement to the control registers of the earlier ESA/390 on the IBM S/390 processors. For details on which fields are dependent on specific features, consult the Principles of Operation.[12] Because z/Architecture expands the control registers from 32 bits to 64, the bit numbering differs from that in ESA/390.

z/Architecture mode control registers
CR bits Field
0 8 Transactional-execution control
0 9 Transactional-execution program-interruption filtering override
0 10 Clock-comparator sign control
0 13 Cryptography counter control
0 14 Processor-activity-instrumentation-extension control
0 15 Measurement-counter-extraction-authorization control
0 30 Warning-track subclass mask
0 32 TRACE TOD-clock control
0 33 SSM-suppression
0 34 TOD-clock-sync control
0 35 Low-address-protection control
0 36 Extraction-authority control
0 37 Secondary-space control
0 38 Fetch-protection-override control
0 39 Storage-protection-override control
0 40 Enhanced-DAT-enablement control
0 43 Instruction-execution-protection-enablement control
0 44 ASN-and-LX-reuse control
0 45 AFP-register control
0 46 Vector enablement control
0 48 Malfunction-alert subclass mask
0 48 Malfunction-alert subclass mask
0 49 Emergency-signal subclass mask
0 50 External-call subclass mask
0 52 Clock-comparator subclass mask
0 53 CPU-timer subclass mask
0 54 Service-signal subclass mask
0 56 Initialized to 1
0 57 Interrupt-key subclass mask
0 58 Measurement-alert subclass mask
0 59 Timing-alert subclass mask
0 61 Crypto control
1 0-51 Primary Address-Space Control Element (ASCE)
Primary region-table origin
Primary segment-table origin
Primary real-space token origin
1 54 Primary subspace-group control
1 55 Primary private-space control
1 56 Primary storage-alteration-event
1 57 Primary space-switch-event control
1 58 Primary real-space control
1 60-61 Primary designation-type control
1 62-63 Primary table length
2 33-57 Dispatchable-unit-control-table origin
2 59 Guarded-storage-facility enablement control
2 61 Transaction diagnostic scope
2 62-63 Transaction diagnostic control
3 0-31 Secondary ASN-second-table-entry instance number
3 32-47 PSW-key mask
3 48-63 Secondary ASN
4 0-31 Primary ASN-second-table-entry instance number
4 32-47 Authorization index
4 48-63 Primary ASN
5 33-57 Primary-ASN-second-table-entry origin
6 32-39 I/O-interruption subclass mask
7 0-51 Secondary Address-Space Control Element (ASCE)
Secondary region-table origin
Secondary segment-table origin
Secondary real-space token origin
7 54 Secondary subspace-group control
7 55 Secondary private-space control
7 56 Secondary storage-alteration-event control
7 58 Secondary real-space control
7 60-61 Secondary designation-type control
7 62-63 Secondary table length
8 16-31 Enhanced-monitor masks
8 32-47 Extended authorization index
8 48-63 Monitor masks
9 32 Successful-branching-event mask
9 33 Instruction-fetching-event mask
9 34 Storage-alteration-event mask
9 35 Storage-key-alteration-event mask
9 36 Store-using-real-address-event mask
9 37 Zero-address-detection-event mask
9 38 Transaction-end event mask
9 39 Instruction-fetching-nullification-event mask
9 40 Branch-address control
9 41 PER-event-suppression control
9 43 Storage-alteration-space control
10 0-63 PER starting address
11 0-63 PER ending address
12 0 Branch-trace control
12 1 Mode-trace control
12 2-61 Trace-entry address
12 62 ASN-trace control
12 63 Explicit-trace control
13 0-51 Home Address-Space Control Element (ASCE)
Home region-table origin
Home segment-table origin
Home real-space token origin
13 55 Home private-space control
13 56 Home storage-alteration-eventl
13 57 Home space-switch-event control
13 58 Secondary real-space control
13 60-61 Home designation-type control
13 62-63 Home table length
14 32 Set to 1
14 33 Set to 1
14 34 Extended save-area control (ESA/390-compatibility mode

only)

14 35 Channel-report-pending subclass mask
14 36 Recovery subclass mask
14 37 Degradation subclass mask
14 38 External-damage subclass mask
14 39 Warning subclass mask
14 42 TOD-clock-control-override control
14 44 ASN-translation control
14 45-63 ASN-first-table origin
15 0-60 Linkage-stack-entry address

Control registers in Intel x86 series

[edit]

CR0

[edit]

The CR0 register is 32 bits long on the 386 and higher processors. On x64 processors in long mode, it (and the other control registers) is 64 bits long. CR0 has various control flags that modify the basic operation of the processor. Register CR0 is the 32 Bit version of the old Machine Status Word (MSW) register. The MSW register was expanded to the Control Register with the appearance of the i386 processor.

Bit Name Full Name Description
0 PE Protected Mode Enable If 1, system is in protected mode, else, system is in real mode
1 MP Monitor co-processor Controls interaction of WAIT/FWAIT instructions with TS flag in CR0
2 EM Emulation If set, no x87 floating-point unit present, if clear, x87 FPU present
3 TS Task switched Allows saving x87 task context upon a task switch only after x87 instruction used
4 ET Extension type On the 386, it allowed to specify whether the external math coprocessor was an 80287 or 80387
5 NE Numeric error On the 486 and later, enable internal x87 floating point error reporting when set, else enable PC-style error reporting from the internal floating-point unit using external logic[13]
16 WP Write protect When set, the CPU cannot write to read-only pages when privilege level is 0
18 AM Alignment mask Alignment check enabled if AM set, AC flag (in EFLAGS register) set, and privilege level is 3
29 NW Not-write through Globally enables/disable write-through caching
30 CD Cache disable Globally enables/disable the memory cache
31 PG Paging If 1, enable paging and use the § CR3 register, else disable paging.

CR1

[edit]

Reserved, the CPU will throw a #UD exception when trying to access it.

CR2

[edit]

Contains a value called Page Fault Linear Address (PFLA). When a page fault occurs, the address the program attempted to access is stored in the CR2 register.

CR3

[edit]
Typical use of CR3 in address translation with 4 KiB pages

Used when virtual addressing is enabled, hence when the PG bit is set in CR0. CR3 enables the processor to translate linear addresses into physical addresses by locating the page directory and page tables for the current task. Typically, the upper 20 bits of CR3 become the page directory base register (PDBR), which stores the physical address of the first page directory. If the PCIDE bit in CR4 is set, the lowest 12 bits are used for the process-context identifier (PCID).[14]

CR4

[edit]

Used in protected mode to control operations such as virtual-8086 support, enabling I/O breakpoints, page size extension and machine-check exceptions.

Bit Name Full Name Description
0 VME Virtual 8086 Mode Extensions If set, enables support for the virtual interrupt flag (VIF) in virtual-8086 mode.
1 PVI Protected-mode Virtual Interrupts If set, enables support for the virtual interrupt flag (VIF) in protected mode.
2 TSD Time Stamp Disable If set, RDTSC instruction can only be executed when in ring 0, otherwise RDTSC can be used at any privilege level.
3 DE Debugging Extensions If set, enables debug register based breaks on I/O space access.
4 PSE Page Size Extension If set, enables 32-bit paging mode to use 4 MiB huge pages in addition to 4 KiB pages.

If PAE is enabled or the processor is in x86-64 long mode this bit is ignored.[15]

5 PAE Physical Address Extension If set, changes page table layout to translate 32-bit virtual addresses into extended 36-bit physical addresses.
6 MCE Machine Check Exception If set, enables machine check interrupts to occur.
7 PGE Page Global Enabled If set, address translations (PDE or PTE records) may be shared between address spaces.
8 PCE Performance-Monitoring Counter enable If set, RDPMC can be executed at any privilege level, else RDPMC can only be used in ring 0.
9 OSFXSR Operating system support for FXSAVE and FXRSTOR instructions If set, enables Streaming SIMD Extensions (SSE) instructions and fast FPU save & restore.
10 OSXMMEXCPT Operating System Support for Unmasked SIMD Floating-Point Exceptions If set, enables unmasked SSE exceptions.
11 UMIP User-Mode Instruction Prevention If set, the SGDT, SIDT, SLDT, SMSW and STR instructions cannot be executed if CPL > 0.[14]
12 LA57 57-Bit Linear Addresses If set, enables 5-Level Paging.[16][17]: 2–18 
13 VMXE Virtual Machine Extensions Enable see Intel VT-x x86 virtualization.
14 SMXE Safer Mode Extensions Enable see Trusted Execution Technology (TXT)
15 [a] (Reserved) N/a
16 FSGSBASE FSGSBASE Enable If set, enables the instructions RDFSBASE, RDGSBASE, WRFSBASE, and WRGSBASE.
17 PCIDE PCID Enable If set, enables process-context identifiers (PCIDs).
18 OSXSAVE XSAVE and Processor Extended States Enable
19 KL Key Locker Enable If set, enables the AES Key Locker instructions.
20 SMEP[20] Supervisor Mode Execution Protection Enable If set, execution of code in a higher ring generates a fault.
21 SMAP Supervisor Mode Access Prevention Enable If set, access of data in a higher ring generates a fault.[21]
22 PKE Protection Key Enable See Intel 64 and IA-32 Architectures Software Developer's Manual.
23 CET Control-flow Enforcement Technology If set, enables control-flow enforcement technology.[17]: 2–19 
24 PKS Enable Protection Keys for Supervisor-Mode Pages If set, each supervisor-mode linear address is associated with a protection key when 4-level or 5-level paging is in use.[17]: 2–19 
25 UINTR User Interrupts Enable If set, enables user-mode inter-processor interrupts and their associated instructions and data structures.
63-26 N/a (Reserved) N/a
  1. ^ In early drafts of the Intel SGX specification, bit 15 of CR4 was named "CR4.SEE" and was described as an SGX enclave-instruction enable bit.[18] Later revisions of this specification removed references to this bit.[19]

CR5–7

[edit]

Reserved, same case as CR1.

Additional Control registers in Intel x86-64 series

[edit]

EFER

[edit]

Extended Feature Enable Register (EFER) is a model-specific register added in the AMD K6 processor, to allow enabling the SYSCALL/SYSRET instruction, and later for entering and exiting long mode. This register becomes architectural in AMD64 and has been adopted by Intel as IA32_EFER. Its MSR number is 0xC0000080.

Bit Purpose
0 SCE (System Call Extensions)
1 DPE (AMD K6 only: Data Prefetch Enable)
2 SEWBED (AMD K6 only: Speculative EWBE# Disable)
3 GEWBED (AMD K6 only: Global EWBE# Disable)
4 L2D (AMD K6 only: L2 Cache Disable)
5-7 Reserved, Read as Zero
8 LME (Long Mode Enable)
9 Reserved
10 LMA (Long Mode Active)
11 NXE (No-Execute Enable)
12 SVME (Secure Virtual Machine Enable)
13 LMSLE (Long Mode Segment Limit Enable)
14 FFXSR (Fast FXSAVE/FXRSTOR)
15 TCE (Translation Cache Extension)
16 Reserved
17 MCOMMIT (MCOMMIT instruction enable)
18 INTWB (Interruptible WBINVD/WBNOINVD enable)
19 Reserved
20 UAIE (Upper Address Ignore Enable)
21 AIBRSE (Automatic IBRS Enable)
22–63 Reserved

CR8

[edit]

CR8 is a new register accessible in 64-bit mode using the REX prefix. CR8 is used to prioritize external interrupts and is referred to as the task-priority register (TPR).[15]

The AMD64 architecture allows software to define up to 15 external interrupt-priority classes. Priority classes are numbered from 1 to 15, with priority-class 1 being the lowest and priority-class 15 the highest. CR8 uses the four low-order bits for specifying a task priority and the remaining 60 bits are reserved and must be written with zeros.

System software can use the TPR register to temporarily block low-priority interrupts from interrupting a high-priority task. This is accomplished by loading TPR with a value corresponding to the highest-priority interrupt that is to be blocked. For example, loading TPR with a value of 9 (1001b) blocks all interrupts with a priority class of 9 or less, while allowing all interrupts with a priority class of 10 or more to be recognized. Loading TPR with 0 enables all external interrupts. Loading TPR with 15 (1111b) disables all external interrupts.

The TPR is cleared to 0 on reset.

XCR0 and XSS

[edit]

XCR0, or Extended Control Register 0, is a control register which is used to toggle the storing or loading of registers related to specific CPU features using the XSAVE/XRSTOR instructions. It is also used with some features to enable or disable the processor's ability to execute their corresponding instructions. It can be changed using the privileged XSETBV read using the unprivileged XGETBV instructions.[22]

Bit Name Enabled Feature Purpose
0 X87 x87 FPU x87 FPU/MMX State, must be '1'
1 SSE SSE MXCSR and 16 XMM registers
2 AVX AVX 16 upper-halves of the YMM registers[a]
3 BNDREG MPX Four BND registers
4 BNDCSR BNDCFGU and BNDSTATUS registers
5 OPMASK AVX-512 Eight k-mask registers
6 ZMM_Hi256 16 upper-halves of the ZMM registers[b]
7 Hi16_ZMM 16 "high" ZMM registers (ZMM16 through ZMM31)
8 PT Processor Trace
9 PKRU Protection Keys PKRU register
10 PASID
11 CET_U Intel CET User shadow stack
12 CET_S Supervisor shadow stack
13 HDC Hardware Duty Cycling
14 UINTR User interrupts
15 LBR Last Branch Records
16 HWP Hardware P-states
17 XTILECFG Intel AMX 64-byte TILECFG register
18 XTILEDATA Eight 1024-byte TILE registers
19[c] APX Intel APX 16 "high" GPRs (R16 through R31)
20–63 Reserved
  1. ^ The lower 128 bits of all YMM registers is stored in the SSE state.
  2. ^ The lower 256 bits of ZMM registers ZMM0 through ZMM15 are stored in the SSE and AVX states.
  3. ^ Even though Intel APX is indicated through bit 19 of XCR0, it is actually written, through XSAVE (the uncompacted form), in the unused 128 byte space left where Intel MPX went.

There is also the IA32_XSS MSR, which is located at address DA0h. The IA32_XSS MSR controls bits of XCR0 which are considered to be "supervisor" state, and should be invisible to regular programs. It operates with the privileged XSAVES and XRSTORS instructions by adding supervisor state to the data they operate with. Put simply, if the X87 state was enabled in XCR0 and PT state was enabled in IA32_XSS, the XSAVE instruction would only store X87 state, while the privileged XSAVES would store both X87 and PT states. Because it is an MSR, it can be accessed using the RDMSR and WRMSR instructions.

Bit Purpose
0–7 Reserved; must be 0.
8 PT (Enables the saving and loading of nine Processor Trace MSRs.)
10 Processor Address Space ID (PASID) state
11 Control-flow Enforcement Technology (CET) User State
12 Control-flow Enforcement Technology (CET) Supervisor State
13 HDC (Enables the saving and loading of the IA32_PM_CTL1 MSR.)
14 User interrupts (UINTR) state
15 Last branch recording (LBR) state
16 HWP (enables the saving/loading of IA32_HWP_REQUEST MSR)
17–63 Reserved; must be 0.

See also

[edit]

Notes

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia

Control register

View on Grokipedia
from Grokipedia
In , a control register is a special-purpose that alters or controls the general behavior of a CPU or other digital hardware, such as enabling interrupts, setting operating modes, configuring , and activating processor features. These registers are typically accessible only in privileged modes, like kernel or mode, to prevent unauthorized modifications that could compromise system stability and . Control registers differ from general-purpose registers by their dedicated role in system configuration and status monitoring, often integrating with the processor's to direct datapath operations and . They may include bits for flags like privilege levels, stack pointer selection, or feature enables, and are frequently paired with status registers that report execution conditions such as overflow or zero results. Access to these registers is governed by specific instructions, such as MOV to/from CR in x86 or MRS/MSR in ARM, ensuring controlled interaction by operating systems and . Examples of control registers abound across architectures; in Intel's and processors, registers like CR0 enable paging and task-switched , while CR4 controls features such as no-execute page and extensions. In ARMv8-M, the CONTROL register (a 2- to 8-bit field) manages privilege modes (privileged or unprivileged), stack selection (main or process stack), and optional extensions like floating-point context or pointer authentication. These registers are essential for implementing , , and error reporting, with their design optimized for speed, security, and compatibility in modern computing systems.

Overview

Definition

A control register is a used to configure, control, or report on the operational behavior of a (CPU). These registers enable the modification of key processor functions, such as mode switching between user and supervisor states, interrupt handling mechanisms, and settings. Unlike general-purpose registers, which serve primarily for temporary data storage and arithmetic operations during program execution, control registers are specialized for system-level management and are typically accessible only in privileged modes. Status registers, by contrast, focus on reporting runtime conditions like arithmetic results or error flags without directly altering behavior; however, control registers often integrate both control and status capabilities to provide a unified interface for monitoring and adjustment. Common behaviors governed by control registers include enabling or disabling protection modes for secure execution environments, configuring caching policies for performance optimization, activating paging for support, and setting parameters for the to handle precision and rounding. Control registers first appeared in mainframe computers during the , for example in the Model 67.

Purpose and Functions

Control registers serve as configurable hardware components that govern the core operational modes of a (CPU), enabling the dynamic adjustment of system behavior to support diverse workloads and ensure efficient resource utilization. By modifying the contents of these registers, the processor can activate or deactivate essential features such as interrupt masking, which allows the system to temporarily ignore external signals during critical operations, and , which facilitates virtual address translation for larger address spaces. These functions are crucial for enabling multitasking environments where multiple processes share hardware resources without interference. A primary role of control registers lies in enforcing privilege levels, which delineate execution modes like user and kernel (or ) to uphold and stability. These registers store flags that determine the current privilege state, restricting user-level from accessing privileged instructions or hardware controls that could compromise the operating , while permitting seamless transitions during calls or interrupts. Additionally, they contribute to by capturing status information on faults, overflows, or other anomalies, allowing the CPU to vector to appropriate handlers and maintain orderly recovery. This layered protection model prevents unauthorized escalations and supports robust error management in complex software ecosystems. Control registers further influence performance by providing mechanisms to tailor and , such as enabling cache configurations that promote data coherency in multiprocessor setups or activating specialized units for vectorized computations. For example, bit fields within these registers can toggle caching modes to balance speed and consistency, reducing latency in shared-memory applications, or enable extensions like floating-point to accelerate numerical workloads. However, the volatile nature of these settings demands meticulous oversight by the operating system, as improper alterations can induce , such as invalid memory accesses or disrupted flows, potentially leading to system halts. Typical bit fields include enable/disable toggles for paging and rings, offering granular control over and access permissions without requiring full hardware reconfiguration.

Access Methods

Control registers in computer architectures are typically accessed through dedicated special-purpose instructions, such as move-to-control-register or read-from-control-register opcodes, rather than standard load or store operations used for general-purpose registers or . These instructions ensure controlled interaction with the hardware state, allowing precise manipulation of system-level configurations without interfering with the regular data flow. Access to control registers is strictly enforced through privilege levels, generally limited to kernel or supervisor mode to safeguard against unauthorized modifications by user-level processes. This restriction aligns with the need for privileged operations like mode switching, where altering control register bits can transition the processor between user and kernel execution contexts. Attempts to access these registers from unprivileged modes trigger hardware-enforced checks, preventing tampering that could compromise system integrity. Improper access to control registers results in exceptions or , depending on the architecture's mechanism. For instance, executing a privileged control register instruction in user mode typically generates a protection fault or general protection exception, which the operating system can then handle by terminating the offending or the violation. Such error handling mechanisms are essential for maintaining processor stability and isolating faulty code. While special instructions predominate for core CPU control registers, variations exist across architectures, including coprocessor interfaces where control-like functions are managed through coprocessor-specific opcodes. Additionally, some systems employ memory-mapped I/O for peripheral control registers, mapping them into the for access via standard instructions, though this is less common for primary CPU control due to and considerations. The privileged nature of control register access plays a critical role in by mitigating attacks, where an adversary might attempt to elevate user privileges by directly altering system control settings. By confining modifications to trusted kernel code, these mechanisms thwart exploits that could otherwise enable unauthorized control over hardware resources, such as or handling.

Historical Development

Origins in Mainframes

The concept of control registers emerged prominently in the architecture, announced in 1964, where they played a foundational role in supporting multiprogramming by managing program relocation and . In this design, general-purpose registers served as base registers for address formation, combining a 24-bit base address with a 12-bit displacement to enable static relocation of programs in main , allowing multiple programs to share storage without fixed absolute addressing. Additionally, 4-bit protection keys, embedded in the (PSW) and associated with 2,048-byte blocks of storage, provided hardware-enforced isolation by comparing keys during access attempts, preventing unauthorized inter-program interference and facilitating supervised multitasking environments. These mechanisms, including the 64-bit PSW for controlling instruction sequencing and interruption handling, laid the groundwork for systems, though full via dynamic address translation was introduced later in the Model 67 variant. This approach drew influence from earlier innovations in the Atlas computer, operational from 1962 at the University of Manchester, which pioneered hardware controls for paging through Page Address Registers (PARs). In the Atlas, 32 PARs, each tied to a 512-word page in core memory, used associative matching to map virtual block addresses to physical locations, triggering supervisor intervention on faults to swap pages from drum storage, thus enabling efficient multiprogramming with overlay management. The System/360 adapted similar principles of hardware-mediated address translation and protection but simplified them for broader commercial applicability, focusing on base-register relocation rather than full paging to balance performance and cost across models ranging from 8K to 512K bytes of memory. Early implementations faced significant hardware challenges, particularly the complexity of supporting dynamic reconfiguration—such as reassigning storage or I/O resources under program control—for and specialized operations without relying on . Fixed-wiring logic in higher-performance models like the 70 required intricate circuit designs to handle varying paths (8 to 64 bits) and interruption priorities, increasing demands and circuit delays up to 70 nanoseconds. By the late , the architecture transitioned toward programmable controls, with read-only storage implementing microprograms in most models (e.g., 30 through 62), allowing flexible instruction interpretation and easier reconfiguration while maintaining compatibility. This shift reduced hardware complexity for lower-end systems and supported the evolution toward more robust multiprogramming in subsequent architectures.

Evolution in Microprocessors

The transition from mainframe systems to microprocessors in the 1970s necessitated more compact and efficient control mechanisms to manage memory and operations within limited silicon resources. The microprocessor, released in , represented a key shift by incorporating four 16-bit segment registers (CS, DS, ES, SS) that enabled , allowing access to up to 1 MB of through base-offset addressing while providing basic isolation between code, data, and stack segments for rudimentary protection against invalid accesses. During the 1980s and 1990s, control registers expanded significantly to support advanced operating system features like protected memory and caching in both CISC and emerging RISC designs. The Intel 80286 (1982) introduced the Machine Status Word (MSW), a 16-bit control register that enabled protected mode for task switching, privilege levels, and virtual addressing, laying the groundwork for modern control registers like CR0. The subsequent Intel 80386 (1985) extended this with 32-bit control registers, including CR0 for enabling paging and extensions, and CR3 for the page directory base address, facilitating demand-paged virtual memory. In parallel, RISC architectures adopted dedicated control structures; for instance, the MIPS R2000 (1985) used Coprocessor 0 (CP0) registers such as Status and Cause for exception handling, interrupt control, and MMU configuration, while the ARM1 (1985) employed the Current Program Status Register (CPSR) to manage processor modes, flags, and interrupt masking. Caching controls emerged in the 1990s, with bits in CR0 and CR4 on x86 processors to enable and configure on-chip caches, improving performance for multitasking environments. Virtualization bits began appearing toward the late 1990s, such as preliminary support in x86 for hypervisor access to control states. The saw further proliferation of control registers to accommodate 64-bit addressing, multi-core processing, and enhanced amid growing server and desktop demands. AMD's introduction of the 64-bit extension in 2003 extended CR0, CR3, and CR4 to 64 bits, with CR3 supporting extensions up to 52 bits for larger memory spaces in multi-core systems. Security enhancements included the No-Execute ( in CR4, first implemented by in 2003 to mark data pages as non-executable, reducing exploits by preventing . followed with the Execute Disable (XD) bit in CR4 on processors in 2004. demands, spurred by software like (released 1999), drove hardware accelerations; 's VT-x (2005) introduced the Virtual Machine Control Structure (VMCS), a set of control fields managing guest/host transitions, CR access, and virtualization across multi-core CPUs. This evolutionary trajectory was primarily driven by operating system requirements for robust and hardware efficiency, as exemplified by VMware's early x86 hypervisors in the late , which exposed the need for direct control register trapping to enable efficient guest isolation without full emulation overheads. Control registers continue to evolve with multi-core and accelerator ecosystems, supporting advanced vector units like for AI workloads through optimized tensor operations.

Control Registers in IBM Architectures

System/360 Model 67

The System/360 Model 67 introduced 16 32-bit control registers, designated CR0 through CR15, significantly expanding upon the limited control facilities of standard System/360 models to enable dynamic translation (DAT), resource partitioning, and enhanced interrupt handling for environments. These registers were accessible only in supervisor state via dedicated instructions such as Load Multiple Control (LMCCTL), Store Multiple Control (SMCCTL), Load Control (LCCTL), and Store Control (SCCTL), ensuring privileged control over system resources. Unlike the base System/360 architecture, which supported only basic external masking and lacked virtual addressing, the Model 67's control registers facilitated the first implementation of paging and segmentation in IBM mainframes, supporting virtual address spaces of 16 megabytes (24-bit) or up to 4 gigabytes (with optional 32-bit addressing extension). This design was pivotal for operating systems like the Time Sharing System (TSS/360) and CP-67/CMS, allowing multiple users to share physical memory securely through address translation and isolation mechanisms. CR0 functioned as the segment table designation register, with bits 0-7 specifying the of the segment table (in units of 64-byte blocks, up to 256 entries) and bits 8-31 providing the real origin of the table (aligned to a 64-byte boundary). This register was central to DAT, where the CPU used it to locate segment table entries (STEs), each containing a page origin and protection bits, thereby 24-bit virtual addresses into real addresses for access to physical storage. CR2 served as the exception identification register, capturing bits 0-23 of the virtual that triggered a segment exception or , along with additional bits for exception codes, to assist in fault recovery and program debugging in virtualized environments. CR1, CR3, CR5, CR7, and CR15 remained unassigned in the Model 67, reserved for future extensions. These addressing-focused registers marked a departure from base System/360 models, which had no equivalent DAT support and relied solely on real addressing without hardware. For protection and interrupt management, CR4 provided extended I/O channel masks, covering channels 0-13 (bits 0-6 for channels 0-6, bits 8-14 for 7-13, with summary bits at 7 and 15). CR6 included masks for external machine checks (bits 0-1 for channel controllers) and external interrupts (bits 24-31), along with bits for timing and error handling, enhancing system stability during time-shared operations. In multiprocessor configurations, CR8 through CR14 acted as partitioning sensing registers, mirroring the state of manual switches that configured connections between processor storage units (PSUs), channel controllers, and I/O control units— for example, CR8 and CR9 indicated active interfaces for PSUs 1-4 to CPUs and controllers, while CR10 specified PSU address assignments (using 4-bit codes for base addresses like 0-256K bytes). CR12 and CR13 sensed I/O control unit partitioning, and CR14 reflected overall system status, such as power-on signals for attached processors. These configuration registers enabled logical partitioning of hardware resources, a feature absent in non-67 models, to isolate time-sharing tasks and support up to two CPUs in duplex configurations sharing storage without contention. The combination of these registers with the Model 67's high-resolution interval timer (13-microsecond ticks, accessible via separate instructions) provided the foundational timing mechanisms for process scheduling and quotas in early virtual memory systems. In S/390, CR0 bit 31 selects 31-bit addressing mode for compatibility with System/360. CR14 manages ASN-first-table origin for translation in virtualized environments.

S/390

The (S/390) family, introduced in 1990, implements the Enterprise Systems Architecture/390 (ESA/390), which features 16 32-bit control registers (CR0 through CR15) to manage processor state, addressing, interruptions, and in enterprise environments. These registers build on earlier mainframe designs while introducing enhancements for logical partitioning (LPARs) via the Processor Resource/Systems Manager (PR/SM) facility, allowing up to 15 LPARs in a single-image configuration, model-dependent, with each LPAR maintaining its own independent set of control registers for isolated execution. This design supports dynamic and multi-system coupling, enabling scalable enterprise computing without disrupting ongoing operations. Key control registers handle management and switching, critical for and partitioning. CR0 controls dynamic address translation (DAT) modes, overrides such as low-address (bit 3) and secondary-space control (bit 5), and address-space-function control (bit 15) to manage 31-bit addressing and ASN-second-table entry sizes. CR1 designates the primary segment-table origin and length for dynamic transitions, with bit 0 for space-switch-event control. CR4 holds the primary address space number (ASN) and index for ASN validation and space switching. CR3 manages the PSW-key and secondary ASN to enforce access controls during space switches. CR2 designates the dispatchable-unit-control-table origin for access-list entries. These registers ensure secure, efficient partitioning by isolating s per LPAR, maintaining backward compatibility with System/360's 24-bit addressing through a selectable in CR0 (bit 31). Registers CR4 through CR7 extend timer, clock, and multi-system controls for coupled environments. CR5 manages subsystem-linkage and primary ASN-second-table entry origins, facilitating coordinated operations across partitions. CR6 masks I/O interruption subclasses (bits 0-7), while CR7 designates the secondary segment-table origin and , with bits for private-space control to enhance and time-of-day (TOD) handling in multi-system setups, including external interruption masks for clock comparators (CR0, bit 20) and CPU timers (CR0, bit 21). These extensions enable precise timing and synchronization in enterprise configurations, such as those using multi-system coupling facilities. CR8 through CR11 address subchannel sets and I/O configuration, vital for high-performance in partitioned systems. CR8 provides the extended index for access-register translation and monitor-mask bits to control event interruptions. CR9 configures program-event-recording (PER) masks for tracing (bit 8) and storage-alteration events (bit 10), aiding I/O monitoring. CR10 and CR11 define the starting and ending addresses for PER storage areas, enabling detailed of I/O-related activities. These registers support dynamic I/O reconfiguration in Enterprise Systems Connection (ESCON) environments, allowing non-disruptive changes to channel paths and subchannels during runtime, a key innovation for enterprise scalability. Finally, CR12 through CR15 focus on recovery and monitoring modes to ensure reliability in LPAR environments. CR12 enables branch-trace control (bit 0), ASN tracing (bit 30), and trace-table addressing for partitioned workloads. CR13 handles home space-switch events (bit 0) and home segment-table designation, supporting recovery from space-related faults. CR14 includes masks for recovery interruptions (bit 4), channel-report-pending (bit 3), and ASN translation control (bit 12), along with the ASN-first-table origin to facilitate fault isolation and recovery across LPARs. CR15 points to the current linkage-stack entry for program invocation tracking. Together, these registers provide robust monitoring and recovery mechanisms, preserving ESA/390's compatibility with System/360 while advancing 31-bit addressing and partitioning for enterprise resilience.

z/Architecture

In , introduced by in 2000 as a 64-bit extension of prior mainframe architectures, there are 16 control registers, each 64 bits wide, that play a central role in managing system resources for high-availability environments supporting operating systems such as and . These registers enable precise control over , , performance tuning, and security features, with extensions that facilitate scalability in enterprise data centers. While maintaining with S/390 control registers, z/Architecture enhances them for 64-bit addressing and advanced virtualization, allowing seamless migration of legacy workloads to modern cloud-integrated mainframes. Control Register 0 (CR0) is enhanced to oversee (TLB) operations and access register modes, incorporating bits for dynamic address translation (DAT) enhancement (bit 40), secondary-space control (bit 37), and access register reuse (bit 44), which collectively support efficient handling in multiprocessor configurations. Similarly, Control Register 1 (CR1) governs secondary space control with 64-bit origins, including the secondary address-space-control element (SASCE) across bits 0-63 and space-switch event controls (bits 1-3), enabling flexible switching critical for database and . Control Register 4 (CR4) manages program event recording (PER) via bits 0-1 for enablement and bits 32-39 for event masks, alongside clock comparator settings (bits 8-31) and CPU timer interruptions (bit 53), aiding in and timing precision for high-throughput applications. Control Register 14 (CR14) focuses on tracing and performance monitoring, with bits 0-1 for and mode tracing configuration, bits 35-39 for machine-check subclass masks, and bits 45-63 specifying the ASN-first-table origin, allowing real-time capture of trace entries at real addresses to optimize system diagnostics. New features introduced in include dedicated bits in control registers for the logical partition hypervisor (PR/SM), supporting up to 15 logical partitions with shared resources and live relocation capabilities, with dispatchable-unit-control-table origin in CR2. Additionally, as of the z990 processor in 2003, bits like CR13 bit 61 enable counters for hardware-accelerated crypto operations via the Assist facility, enhancing data privacy with instructions like CIPHER MESSAGE. By 2025, 's evolution includes the z16 processor (announced 2024), integrating quantum-safe cryptography via Crypto Express8S hardware supporting post-quantum algorithms such as CRYSTALS-Kyber and for hybrid key exchanges and dual-signing schemes that protect against quantum threats without altering legacy applications. These advancements ensure remains resilient for mission-critical workloads, emphasizing and secure in hybrid cloud ecosystems.

Control Registers in x86 Architectures

32-bit x86 Registers

In the 32-bit x86 architecture, introduced with the 80386 , control registers (CR0 through CR7) play a central role in managing processor modes, , and paging mechanisms. These registers enable the transition from to , enforce privilege levels for security, and control operations, forming the foundation of the system's multitasking and isolation capabilities. Access to these registers is restricted to kernel-mode code (current privilege level 0) via the MOV instruction, ensuring that only trusted software can alter critical system states. CR0, the machine status register, governs fundamental processor behaviors including protected mode enablement and paging activation. Its bit 0 (PE) enables , allowing segmentation and privilege rings for , a feature first introduced in the in 1982. Bit 31 (PG) activates paging for management, while bit 16 (WP) enforces on user pages even from mode to prevent unauthorized modifications, added in the Intel 80486 in 1989. Other bits like 30 (CD) for cache disable and 29 (NW) for not-write-through policy support memory consistency in protected environments. CR0 was initially defined in the 80286 but expanded significantly in the 80386 in 1985 to include paging and controls. CR1 remains reserved and unused in the standard architecture, with attempts to access it triggering an undefined instruction exception to maintain compatibility. CR2 holds the 32-bit linear address that triggered the most recent , aiding operating systems in resolving memory access violations during execution. This register is automatically loaded by the processor on page faults and is read-only in typical usage, though writable under privilege level 0. It was introduced alongside paging in the 80386 in 1985. CR3 serves as the page directory base register (PDBR), storing the physical base address of the page directory used for translating virtual to physical addresses in paged . Bits 4 (PCD) and 3 (PWT) control caching for page tables, optimizing performance in systems. Loading CR3 invalidates the (TLB) to ensure consistency. Like CR2, it debuted with the 80386's paging support in 1985. CR4 extends feature controls for advanced and processor capabilities, introduced in the processor in 1993. Bit 4 (PSE) enables 4 MB large pages to reduce TLB pressure in 32-bit paging, while bit 5 (PAE) supports 36-bit physical addressing for up to 64 GB of RAM, added in the in 1995. Bit 7 (PGE) allows global page entries to persist across context switches, enhancing efficiency in multitasking environments. Reserved bits in CR4 must remain zero to avoid general protection faults. CR5 through CR7 are reserved for future use or processor-specific implementations in the IA-32 architecture; standard usage treats them as undefined, requiring zero values on access to prevent exceptions.
RegisterPrimary FunctionKey Bits (Examples)Introduction
CR0Mode and protection controlPE (0), PG (31), WP (16)80286 (1982), expanded 80386 (1985)
CR1ReservedNone80386 (1985)
CR2Page fault addressLinear address (full 32 bits)80386 (1985)
CR3Page directory basePDBR (31:12), PCD (4), PWT (3)80386 (1985)
CR4Feature extensionsPSE (4), PAE (5), PGE (7)Pentium (1993), PAE in Pentium Pro (1995)
CR5–CR7Reserved/implementation-specificNone80386 (1985)

64-bit x86-64 Extensions

The architecture, originally developed by and adopted by , introduces several new and extended control registers to support 64-bit operations, enhanced , and modern features like and . These extensions build upon the legacy 32-bit control registers (CR0 through CR3) by adding 64-bit width where necessary, new registers for interrupt handling and state management, and bits to enable and process-context identifiers. Key additions include the Extended Feature Enable Register (EFER), CR8 for task-priority control, and extended control registers like XCR0 and the XSAVE feature mask (XSS), which facilitate efficient handling of extended processor states in 64-bit environments. The EFER, a 64-bit (MSR) at address C000_0080h, was introduced in the AMD64 specification in 2000 and first implemented in the processor in 2003. It enables critical 64-bit features through specific bits: bit 0 (SCE) activates the SYSCALL and SYSRET instructions for efficient system calls in ; bit 8 (LME) enables when combined with CR0.PG=1 and CR4.PAE=1; bit 10 (LMA, read-only) indicates that is active; and bit 11 (NXE) enables no-execute (NX) page protection to prevent code execution from data pages marked non-executable, requiring CR4.PAE=1. Access to EFER is restricted to ring 0 via RDMSR and WRMSR instructions, and it plays a foundational role in transitioning to and operating within 64-bit , supporting up to 48-bit virtual addressing. CR8, introduced as part of the AMD64 architecture, serves as the Task Priority Register (TPR) exclusively in 64-bit mode, accessible via MOV instructions with the REX prefix at privilege level 0. Its lower 8 bits (bits 7:0) define the task priority level (TPL), which masks below the specified priority threshold—e.g., a TPL of 0x0F disables all fixed-priority interrupts, while 0x00 allows all. CR8 synchronizes with the local APIC's TPR (at offset 80h) for filtering and is essential for real-time and multitasking in 64-bit operating systems like Windows 64-bit. Upper bits (63:8) are reserved and must be zero. In virtualized environments, CR8 supports virtual TPR management without affecting physical interrupts. Extensions to legacy control registers include modifications for long mode compatibility. While long mode activation relies on EFER.LME rather than a direct CR0 bit, CR0's existing PE (protected mode enable, bit 0) and PG (paging enable, bit 31) bits are prerequisites, with CR0 now supporting 64-bit physical addressing up to 52 bits in modern implementations. CR4 gains the PCIDE bit (bit 17, Process-Context ID Enable), introduced in Intel's Westmere microarchitecture in 2010, which allows the processor to cache translation lookaside buffer (TLB) entries tagged with a 12-bit process-context identifier (PCID) from CR3 bits 11:0. This reduces TLB flushes during context switches in 64-bit multitasking. PCIDE requires CR4.PGE=1 and is ignored if CR0.PG=0. For managing extended processor states like AVX and SSE in 64-bit mode, Intel introduced XCR0 (Extended Control Register 0) in the Nehalem microarchitecture in 2008. This 64-bit register, accessed via XGETBV (read) and XSETBV (write) at ring 0 with CR4.OSXSAVE=1, controls which components of the XSAVE area are saved or restored by instructions like XSAVE and XRSTOR. Key bits include 0 (x87 FPU/MMX state, always 1), 1 (SSE state, including XMM registers and MXCSR), and 2 (AVX state, YMM registers); higher bits (e.g., 5-7 for AVX-512) enable vector extensions. XCR0 optimizes context switching by selectively managing up to 512 bytes or more of state, reducing overhead in 64-bit applications using SIMD instructions. Bits must form a valid combination per CPUID enumeration (leaf 0DH). Post-2013, with the Haswell microarchitecture, Intel added support for supervisor-only extended states via the IA32_XSS MSR (address DA0h), known as the XSAVE extended state feature mask. This 64-bit MSR, writable at ring 0 via WRMSR, specifies user-configurable supervisor states (e.g., for CET or custom extensions) that can be saved/restored using XSAVES and XRSTORS instructions, complementing XCR0's user/application states. IA32_XSS enables selective management of states beyond the standard XCR0 mask, such as Intel Processor Trace or protection keys, without affecting application-visible state; it must be zeroed on INIT and is crucial for kernel-level 64-bit security features. XSAVES uses the union of XCR0 and IA32_XSS to determine the save mask, optimizing for supervisor contexts in long mode. These 64-bit control register extensions underpin and in x86-64. Intel's VT-x, introduced in 2005 with the Prescott , leverages EFER, CR4 (including PCIDE for TLB optimization), and XCR0 to virtualize , allowing guest OSes to run in 64-bit submode with VMX controls for CR access (e.g., VM-entry checks on CR0/CD and CR0/NW bits). AMD's SVM (Secure Virtual Machine) analogously uses EFER and CR8 for 64-bit guest virtualization since 2006.

Control Registers in RISC Architectures

ARM

In architectures, particularly the A-profile used in embedded and mobile systems, control registers are primarily accessed through the system control , known as CP15 in 32-bit modes, to configure core features such as , caching, and isolation. These registers enable fine-grained control over processor behavior, optimizing for low-power operations in devices like smartphones and IoT systems. Unlike general-purpose registers, control registers are privileged and accessed via specific instructions like MRC and MCR in ARMv7, or MRS and MSR in , ensuring secure configuration by the operating system or . The System Control Register (SCTLR), a of control registers, governs key aspects of the memory system and execution environment. It controls the (MMU) enablement via the M bit, data and instruction cache operations through the C and I bits respectively, endianness selection with the B bit for big-endian byte order, and Thumb execution state via the T bit for mixed 16/32-bit instructions. Introduced in the ARMv4 architecture in 1996, the SCTLR has evolved to support advanced features like vector base address relocation in later versions, providing a unified interface for system initialization in power-constrained environments. CP15 registers are organized by coprocessor register numbers (CRn) for modular access, allowing identification of processor capabilities and management of protections. The ID registers in CR0, such as the Main ID Register (MIDR), report processor features like architecture version and cache sizes, aiding software in runtime adaptations. The Domain Access Control Register (DACR) in CR3 specifies access permissions for up to 16 domains, enabling domain-based protection without full overhead. Fault status is captured in registers like the Instruction Fault Status Register (IFSR) and Data Fault Status Register (DFSR) in CR5, which detail abort causes such as alignment faults or errors, facilitating in embedded applications. This coprocessor-centric model emphasizes efficiency for mobile workloads. Application-specific control registers extend core functionality for and . The Auxiliary Control Register (ACTLR), an implementation-defined register in CR1, tunes features like branch prediction enablement and SMP () coherence, allowing vendors to optimize for specific silicon variants without altering the base architecture. In systems supporting TrustZone extensions introduced in 2004, the Non-Secure Access Control Register (NSACR) in CR1 regulates non-secure world access to coprocessors and advanced SIMD units, enforcing isolation between secure and normal execution environments critical for . The transition to 64-bit processing in AArch64, introduced with ARMv8 in 2011, extends control registers for larger address spaces and virtualization. The SCTLR gains an EL1 variant (SCTLR_EL1) for exception level-specific controls, while the Translation Control Register (TCR_EL1) in the system register space manages stage-1 translation parameters like granule sizes and physical address extensions, replacing aspects of the 32-bit TTBR setup for scalable memory virtualization in servers and high-end mobiles. These 64-bit registers maintain backward compatibility with AArch32 modes, supporting hybrid 32/64-bit ecosystems. As of 2025, ARMv9 enhancements bolster through the Confidential Compute Architecture (CCA), integrating Realm Management Extensions (RME) into control registers for dynamic resource attestation and isolation. This allows secure enclaves via new registers like RMMCTL_EL1 for realm creation, protecting sensitive workloads like AI inference from host OS interference, with implementations demonstrated in platforms such as Fujitsu's for HPC and .

MIPS

In the MIPS architecture, Coprocessor 0 (CP0) serves as the system control coprocessor, providing essential registers for managing exceptions, interrupts, , and processor configuration, particularly in embedded systems where efficient handling of real-time events is critical. These registers are accessed exclusively in kernel mode using the Move To Coprocessor 0 (MTC0) and Move From Coprocessor 0 (MFC0) instructions, which transfer data between general-purpose registers and CP0, enabling privileged operations like exception processing without user-mode interference. CP0's design emphasizes simplicity and low overhead, supporting the RISC philosophy by integrating control functions directly into the core pipeline for fast context switching in operating systems. The (CP0 Register 12, Select 0), also known as SR, governs key processor states including enabling, exception levels, and usability. Its (IE) bit (bit 0) controls global interrupt masking, while the Exception Level (EXL) bit (bit 1) indicates whether the processor is handling an exception, preventing further interrupts during critical sections. The Usable (CU) bits (bits 28-31) manage access to coprocessors like the , and the Kernel//User (KSU) bits (bits 5-3) define the current operating mode, enforcing privilege separation between kernel and user spaces. These features ensure reliable by isolating kernel operations from user code. The Cause Register (CP0 Register 13, Select 0) captures details of the most recent exception or , aiding in precise trap resolution. The Exception Code (ExcCode) field (bits 6-2) encodes the type of event, such as TLB misses (code 2) or arithmetic overflows (code 12), while the Interrupt Pending (IP) bits (bits 15-8) track hardware and software . The Branch Delay (BD) bit (bit 31) flags whether the exception occurred in a , allowing handlers to adjust restoration accurately. Together with the , it forms the core of MIPS exception processing, as seen in real-time operating systems like , where these registers determine CPU state for and exception dispatching on a shared stack. The Context Register (CP0 Register 4, Select 0) assists in management by pointing to kernel or user stacks during trap handling. Its PTEBase field (bits 31-23) holds an OS-defined pointer to the entry base for TLB refills, while BadVPN2 (bits 22-4) stores the virtual page number of the faulting address, streamlining context switches without full register dumps. This register is vital for efficient exception recovery in memory-intensive embedded applications. For TLB management in virtual addressing, the EntryHi (CP0 Register 10, Select 0) and EntryLo0/EntryLo1 (CP0 Registers 2 and 3, Select 0) registers, introduced with the R2000 processor in 1985, define translation entries. EntryHi's VPN2 field (bits 31-13) holds the virtual page number, and ASID (bits 7-0) specifies the identifier for . EntryLo0 and EntryLo1 map even and odd pages, respectively, with fields for physical frame number (PFN, bits 29-6), cache attributes (C, bits 5-3), (D, bit 2), valid bit (V, bit 1), and global bit (G, bit 0). These enable software-loaded TLB operations via instructions like TLBR (read) and TLBWI (write), supporting the architecture's fixed 64-entry TLB for cost-effective . The Config Register (CP0 Register 16, Select 0), which evolved significantly in the processor released in 1991, configures hardware parameters like cache sizes and memory access modes. Its K0 field (bits 2-0) sets cache coherency for Kseg0 uncached space, while MT (bits 9-7) indicates the MMU type (e.g., 1 for TLB). Additional bits like BE (bit 15) control , and cache size fields (e.g., bits 25-24) define instruction and cache organizations, allowing adaptation to varying requirements post-reset. This register's flexibility supports scalable implementations from simple microcontrollers to high-performance cores.

RISC-V

In RISC-V, control and status registers (CSRs) form a key component of the privileged architecture, providing mechanisms for managing processor state, interrupts, exceptions, and memory protection across privilege modes. These registers are addressed using a 12-bit encoding space, enabling a sparse layout that supports modular extensions without requiring a fixed number of registers, which is particularly advantageous for custom instruction set architectures (ISAs) in open-source hardware designs. The base set of CSRs was introduced in the initial RV32I specification from 2010, evolving through subsequent ratified versions to support embedded, IoT, and accelerator applications. The mstatus register (CSR address 0x300) is central to privilege and management, with bits like MIE (bit 3) controlling global machine-mode enables and MPP (bits 11-12) storing the prior privilege mode (e.g., 00 for user mode, 11 for machine mode). Complementing this, the mie (0x304) and mip (0x344) registers handle machine-level s: mie enables specific types such as external (MEIE, bit 11), (MTIE, bit 7), and software interrupts, while mip indicates pending status for the same (e.g., MEIP for external, MTIP for ). For trap handling, mcause (0x342) encodes the cause of exceptions or s (with bit XLEN-1 distinguishing s from exceptions and lower bits specifying codes like 8 for environment calls), often paired with mtval (0x343) to hold trap-specific values such as faulting addresses. Access to these CSRs occurs via dedicated instructions like CSRRW (read-modify-write using registers) and CSRRWI (using immediates), ensuring atomic operations from appropriate privilege levels. Memory management is facilitated by the satp register (0x180), which configures supervisor-mode address translation in schemes like Sv39 (39-bit virtual addresses) or Sv48 (48-bit), with its MODE field (bits 63-60 in RV64) selecting the paging mode and PPN (bits 0-43) pointing to the root , alongside ASID for isolation. The architecture supports extensions through additional CSRs; for instance, the H-extension for hypervisors, ratified in 2021, introduces registers like hstatus (0x602) for virtual supervisor mode control, hedeleg (0x602) for trap delegation, and hgatp (0x531) for guest address translation, enabling nested . Similarly, the vector extension (RVV 1.0, ratified in 2021) adds vcsr (0x006), which manages vector configuration including rounding modes and tracks state via the VS field in mstatus (off, initial, clean, or dirty). This modular CSR framework distinguishes by allowing ratifiable extensions for diverse applications, from low-power IoT devices to high-performance accelerators, without the rigidity of fixed register sets in other architectures.

PowerPC

In the PowerPC architecture, Special Purpose Registers (SPRs) function as control registers to manage processor states, particularly in high-performance server and embedded systems. The Machine State Register (MSR), a fundamental 32-bit or 64-bit register depending on the implementation, has been integral since the architecture's inception in 1991. It controls byte ordering through the LE bit (little-endian when set, big-endian when clear), enables external interrupts via the bit, and enforces privilege levels with the PR bit (problem state for user mode, state for kernel mode) and IR bit (instruction relocate mode for 64-bit addressing). These bits ensure secure and efficient operation across diverse applications, from embedded controllers to enterprise servers. The Floating-Point Status and Control Register (FPSCR) is a 32-bit SPR dedicated to management, recording the outcomes of operations and configuring behaviors such as modes (e.g., round to nearest or toward zero via bits 30-31) and for conditions like invalid operation, overflow, underflow, and inexact results (bits 0-4 for sticky flags). Instructions like mffs (move from FPSCR) allow software to read these bits for error checking, while mtfsf (move to FPSCR fields) enables precise control, supporting high-precision computations in scientific and graphics workloads. Hardware-dependent control is provided by the Hide Registers HID0 and HID1, introduced with the PowerPC 601 core and carried forward in subsequent implementations like the 603e and 750 series. HID0 includes bits for cache management, such as ICE (instruction cache enable) and DCE (data cache enable) to disable caches for or real-time , and BTIC (branch target instruction cache) control for optimization. HID1 extends this with configuration for additional features like L2 cache parity and controls, allowing fine-tuned hardware behavior in superscalar pipelines. For 64-bit virtual memory support in Book E variants developed in the 2000s for embedded applications, the Segment Lookaside Buffer (SLB) registers form a cache of segment table entries, translating effective addresses to virtual addresses with up to 80-bit virtual spaces (configurable as 2^n bytes where 65 ≤ n ≤ 80). Each SLB entry includes an effective segment ID (ESID) and virtual segment ID (VSID), enabling efficient large-address-space handling without full table walks, as defined in the Book III. The Processor Version Register (PVR), a read-only 32-bit SPR, aids feature detection by encoding the processor model (bits 16-31) and revision level (bits 0-15), allowing operating systems to query capabilities like cache sizes or instruction extensions at runtime. SPRs are accessed exclusively via privileged instructions: Move to SPR (mtspr), which loads an SPR from a general-purpose register, and Move from SPR (mfspr), which stores an SPR value to a general-purpose register, ensuring controlled modifications in supervisor mode. The processor, introduced in 2017, evolved these mechanisms with new SPRs for AI acceleration, including 2.0 controls in registers like the NVLink Configuration Register (NVLINKCFG), supporting up to 25 GB/s bidirectional GPU links for tensor computations and data analytics. By 2025, IBM's enhancements to control registers emphasize hybrid cloud scalability, incorporating dynamic execution register controls for adaptive privilege management and integrated support for transparent memory encryption via new SPR bits, reducing overhead in distributed environments while maintaining compatibility with prior PowerPC modes. In multi-core setups, these registers facilitate synchronized state handling across threads, optimizing resource sharing in parallel workloads.

References

  1. https://www.sciencedirect.com/topics/computer-science/control-register
  2. https://www.intel.com/content/dam/develop/external/us/en/documents/335592-sdm-vol-4.pdf
  3. https://cs.calvin.edu/activities/books/c%2B%2B/engr-sci/WebItems/Chap05/ComputerArchitecture.pdf
  4. https://developer.arm.com/documentation/107656/latest/Registers/Special-purpose-registers/CONTROL-register
  5. https://bitsavers.trailing-edge.com/pdf/ibm/360/functional_characteristics/A27-2719-0_360-67_funcChar.pdf
  6. https://developer.arm.com/documentation/107656/latest/Registers/Special-purpose-registers
  7. https://www.geeksforgeeks.org/operating-systems/privileged-and-non-privileged-instructions-in-operating-system/
  8. https://developer.arm.com/documentation/102412/latest/Privilege-and-Exception-levels/Types-of-privilege
  9. https://os.phil-opp.com/cpu-exceptions/
  10. https://cwe.mitre.org/data/definitions/284.html
  11. https://cwe.mitre.org/data/definitions/1262.html
  12. https://www.sciencedirect.com/topics/computer-science/memory-mapped-register
  13. https://portswigger.net/web-security/access-control
  14. https://attack.mitre.org/tactics/TA0004/
  15. https://www.ece.ucdavis.edu/~vojin/CLASSES/EEC272/S2005/Papers/IBM360-Amdahl_april64.pdf
  16. https://bitsavers.trailing-edge.com/pdf/ibm/360/princOps/A22-6821-0_360PrincOps.pdf
  17. https://ethw.org/Milestones:Atlas_Computer_and_the_Invention_of_Virtual_Memory%2C_1957-1962
  18. http://bitsavers.org/components/intel/8086/9800722-03_The_8086_Family_Users_Manual_Oct79.pdf
  19. https://kib.kiev.ua/x86docs/Intel/VT-x/C97063-002.pdf
  20. https://www.intel.com/content/www/us/en/developer/articles/technical/intel-avx-512-instructions.html
  21. http://www.bitsavers.org/pdf/ibm/360/functional_characteristics/GA27-2719-2_360-67_funcChar.pdf
  22. https://dl.acm.org/doi/pdf/10.1145/1464182.1464190
  23. http://www.bitsavers.org/pdf/ibm/360/tss/C20-1647-0_360-67_TSS_Tech.pdf
  24. https://publibfp.dhe.ibm.com/epubs/pdf/dz9ar008.pdf
  25. https://www.scribd.com/doc/6750439/ESA-390-Principles-of-Operation
  26. https://publibfp.dhe.ibm.com/epubs/pdf/a227832d.pdf
  27. https://www.redbooks.ibm.com/redbooks/pdfs/sg247070.pdf
  28. https://www.ibm.com/products/z16
  29. https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf
  30. https://www.computinghistory.org.uk/det/6187/Intel-introduces-the-80286-microprocessor/
  31. https://www.computinghistory.org.uk/det/6192/Intel-introduces-the-80386-microprocessor/
  32. https://en.wikichip.org/wiki/intel/80486
  33. https://en.wikichip.org/wiki/intel/pentium
  34. https://cdrdv2-public.intel.com/671447/325384-sdm-vol-3abcd.pdf
  35. https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html
  36. https://developer.arm.com/documentation/den0013/latest/ARM-Processor-Modes-and-Registers/Registers/Coprocessor-15
  37. https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/Virtual-Memory-System-Architecture--VMSA-/CP15-registers-for-a-VMSA-implementation/c1--System-Control-Register--SCTLR-?lang=en
  38. https://www.cs.utexas.edu/~simon/378/resources/ARMv7-AR_TRM.pdf
  39. https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/The-CPUID-Identification-Scheme/The-CPUID-registers/CP15-c0--Processor-Feature-registers
  40. https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/Virtual-Memory-System-Architecture--VMSA-/CP15-registers-for-a-VMSA-implementation/c3--Domain-Access-Control-Register--DACR-?lang=en
  41. https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/Virtual-Memory-System-Architecture--VMSA-/CP15-registers-for-a-VMSA-implementation/CP15-c5--Fault-status-registers
  42. https://developer.arm.com/documentation/ddi0601/2021-06/AArch32-Registers/ACTLR--Auxiliary-Control-Register
  43. https://developer.arm.com/documentation/ddi0601/2025-06/AArch32-Registers/NSACR--Non-Secure-Access-Control-Register
  44. https://developer.arm.com/documentation/ddi0595/2021-03/AArch64-Registers/SCTLR-EL1--System-Control-Register--EL1-
  45. https://developer.arm.com/documentation/ddi0595/2020-12/AArch64-Registers/TCR-EL1--Translation-Control-Register--EL1-?lang=en
  46. https://cs140e.sergio.bz/docs/ARMv8-Reference-Manual.pdf
  47. https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture
  48. https://community.arm.com/arm-community-blogs/b/servers-and-cloud-computing-blog/posts/how-fujitsu-implemented-confidential-computing-on-fujitsu-monaka-with-arm-cca
  49. https://www.cs.cornell.edu/courses/cs3410/2008fa/MIPS_Vol3.pdf
  50. https://groups.csail.mit.edu/cag/raw/documents/R4400_Uman_book_Ed2.pdf
  51. https://daq00.triumf.ca/~daqweb/doc/vxworks/tornado2/docs/vxworks/guide/x-mips4.html
  52. https://www.cpushack.com/MIPSCPU.html
  53. https://gunkies.org/wiki/MIPS_R4000
  54. https://docs.riscv.org/reference/isa/v20240411/_attachments/riscv-privileged.pdf
  55. https://riscv.org/wp-content/uploads/2017/05/riscv-spec-v2.2.pdf
  56. https://www.nxp.com/docs/en/user-guide/MPCFPE_AD_R1.pdf
  57. https://www.ibm.com/docs/en/aix/7.2.0?topic=storage-floating-point-processor
  58. http://www.bitsavers.org/components/motorola/PowerPC/1995_MPC603EUM_PowerPC_603e_Users_Manual.pdf
  59. https://arcb.csc.ncsu.edu/~mueller/cluster/ps3/SDK3.0/docs/arch/PPC_Vers202_Book3_public.pdf
  60. https://www.nxp.com/docs/en/supporting-information/PPCPVR.pdf
  61. https://www.ibm.com/docs/ssw_aix_72/assembler/idalangref_mfspr_spr_instrs.html
  62. https://wiki.raptorcs.com/w/images/9/95/POWER9_Registers_vol3_version1.2_pub.pdf
  63. https://newsroom.ibm.com/2020-08-17-IBM-Reveals-Next-Generation-IBM-POWER10-Processor
Add your contribution
Related Hubs
Contribute something
User Avatar
No comments yet.