Control register

A control register is a processor register that changes or controls the general behavior of a CPU or other digital device. Common tasks performed by control registers include interrupt control, switching the addressing mode, paging control, and coprocessor control.

History

The early CPU lacked dedicated control registers, and relied on a limited set of internal signals and flags. When IBM developed a paging version of the System/360, they added 16 control registers to the design for what became the 360/67. IBM did not provide control registers on other S/360 models, but made them a standard part of System/370, although with different register and bit assignments. As IBM added new features to the architecture, e.g., DAS, S/370-XA, S/370-ESA, ESA/390, they added additional fields to the control registers. With z/Architecture, IBM doubled the control register size to 64 bits.

Control registers in IBM 360/67

On the 360/67, CR0 and CR2 are used by address translation, CR 4-6 contain miscellaneous flags including interrupt masks and Extended Control Mode, and CR 8-14 contain the switch settings on the 2167 Configuration Unit.

M67 CR0

Control Register 0 contains the address of the segment table for dynamic address translation.

M67 CR2

Control register 2 is the Relocation exception address register.

M67 [|CR4]

CR4 is the extended mask register for channels 0-31.
Each bit is the 1/0 channel mask for the corresponding channel.

M67 CR5

CR5 is reserved for the extended mask register for channels 32–63.
Each bit is the 1/0 channel mask for the corresponding channel.

M67 CR6

CR6 contains two mode flags plus extensions to the PSW mask bits.

Field	Bit	Description
0	0	Machine Check Mask Extension for Channel Controller o
1	1	Machine Check Mask Extension for Channel Controller 1
2-3		Reserved for channel controllers 2-3
4-7		Unassigned
8	8	Extended Control Mode
9	9	Configuration Control Bit
10-23		Unassigned
24-31		External interrupt masking
	24	Timer
	25	Interrupt Key
	26	Malfunction Alert - CPU 1
	27	Malfunction Alert - CPU 2
	28	Reserved
	29	Reserved
	30	External Interrupt - CPU 1, 2
	31	Reserved

M67 CR8

Control Register 8 contains the assignments of Processor Storage units 1–4 to central processing units and channel controllers.

Bit	Description
0	Processor Storage Unit 1 to CPU 1
1	Processor Storage Unit 1 to CPU 2
2-3	Reserved for CPU 3-4
4	Processor Storage Unit 1 to CC 0
5	Processor Storage Unit 1 to CC 1
6-7	Reserved for CC 3-4
8	Processor Storage Unit 2 to CPU 1
9	Processor Storage Unit 2 to CPU 2
10-11	Reserved for CPU 3-4
12	Processor Storage Unit 2 to CC 0
13	Processor Storage Unit 2 to CC 1
14-15	Reserved for CC 3-4
16	Processor Storage Unit 3 to CPU 1
17	Processor Storage Unit 3 to CPU 2
18-19	Reserved for CPU 3-4
20	Processor Storage Unit 3 to CC 0
21	Processor Storage Unit 3 to CC 1
22-23	Reserved for CC 3-4
24	Processor Storage Unit 4 to CPU 1
25	Processor Storage Unit 4 to CPU 2
26-27	Reserved for CPU 3-4
28	Processor Storage Unit 4 to CC 0
29	Processor Storage Unit 4 to CC 1
30-31	Reserved for CC 3-4

M67 CR9

Control Register 9 contains the assignments of Processor Storage units 5–8 to central processing units and channel controllers.

Bit	Description
0	Processor Storage Unit 5 to CPU 1
1	Processor Storage Unit 5 to CPU 2
2-3	Reserved for CPU 3-4
4	Processor Storage Unit 5 to CC 0
5	Processor Storage Unit 5 to CC 1
6-7	Reserved for CC 3-4
8	Processor Storage Unit 6 to CPU 66
9	Processor Storage Unit 6 to CPU 2
10-11	Reserved for CPU 3-4
12	Processor Storage Unit 6 to CC 0
13	Processor Storage Unit 6 to CC 1
14-15	Reserved for CC 3-4
16	Processor Storage Unit 7 to CPU 1
17	Processor Storage Unit 7 to CPU 2
18-19	Reserved for CPU 3-4
20	Processor Storage Unit 7 to CC 0
21	Processor Storage Unit 7 to CC 1
22-23	Reserved for CC 3-4
24	Processor Storage Unit 8 to CPU 1
25	Processor Storage Unit 8 to CPU 2
26-27	Reserved for CPU 3-4
28	Processor Storage Unit 8 to CC 0
29	Processor Storage Unit 8 to CC 1
30-31	Reserved for CC 3-4

M67 CR10

Control Register 10 contains the Processor storage address assignment codes.

Bit	Starting Address Code for
0-3	Processor Storage Unit 1
4-7	Processor Storage Unit 2
8-11	Processor Storage Unit 3
12-15	Processor Storage Unit 4
16-19	Processor Storage Unit 5
20-23	Processor Storage Unit 6
24-27	Processor Storage Unit 7
28-31	Processor Storage Unit 8

M67 CR11

Control Register 11 contains channel controller assignments.

Bit	Description
0	CC 0 available on CPU 1
1	CC 0 available on CPU 2
2-3	Reserved for CPUs 3-4
4	CC 1 available on CPU 1
5	CC 1 available on CPU 2
6-7	Reserved for CPUs 3-4
8-15	Unassigned
16	CPU 1 to only CC 0
17	CPU 1 to only CC 1
18-19	Reserved for CC 2-3
20	CPU 2 to only CC 0
21	CPU 2 to only CC 1
22-23	Reserved for CC 2-3
24-31	Unassigned

M67 CR12

CR12 contains I/O Control Unit Partitioning.

Bit	I/O Control Unit	Interface
0	1	1
1	1	2
2	2	1
3	2	2
4	3	1
5	3	2
6	4	1
7	4	2
8	5	1
9	5	2
10	6	1
11	6	2
12	7	1
13	7	2
14	8	1
15	8	2
16	9	1
17	9	2
18	10	1
19	10	2
20	11	1
21	11	2
22	12	1
23	12	2
24	13	1
25	13	2
26	14	1
27	14	2
28	15	1
29	15	2
30	16	1
31	16	2

M67 CR13

CR13 contains I/O Control Unit Partitioning.

Bit	I/O Control Unit	Interface
0	17	1
1	17	2
2	18	1
3	18	2
4	19	1
5	19	2
6	20	1
7	20	2
8	21	1
9	21	2
10	22	1
11	22	2
12	23	1
13	23	2
14	24	1
15	24	2
16	25	1
17	25	2
18	26	1
19	26	2
20	27	1
21	27	2
22	28	1
23	28	2
24	29	1
25	29	2
26	30	1
27	30	2
28	31	1
29	31	2
30	32	1
31	32	2

M67 CR14

CR14 contains indicators.

Bit	Indicator
0-27	Unassigned
22	2167 Power On
23	Unassigned
24	Direct Control, CPU 1
25	Direct Control, CPU 2
26-27	Unassigned
28	Prefix, CPU 1
29	Prefix, CPU 2
30-31	Unassigned

Control registers in IBM S/390

The control registers of ESA/390 on the IBM S/390 are an evolutionary enhancement to the control registers on the earlier ESA/370, S/370-XA and S/370 processors. For details on which fields are dependent on specific features, consult the Principles of Operation.

CR	bits	Field
0	1	SSM-suppression
0	2	TOD-clock-sync control
0	3	Low-address-protection control
0	4	Extraction-authority control
0	5	Secondary-space control
0	6	Fetch-protection-override control
0	7	Storage-protection-override control
0	8-12	Translation format
0	13	AFP-register control
0	14	Vector control
0	15	Address-space-function control
0	16	Malfunction-alert subclass mask
0	17	Emergency-signal subclass mask
0	18	External-call subclass mask
0	19	TOD-clock sync-check subclass mask
0	20	Clock-comparator subclass mask
0	21	CPU-timer subclass mask
0	22	Service-signal subclass mask
0	24	Set to 1
0	25	Interrupt-key subclass mask
0	26	Set to 1
0	27	ETR subclass mask
0	28	Program-call-fast
0	29	Crypto control
1	0	Primary space-switch-event control
1	1-19	Primary segment-table origin
1	22	Primary subspace-group control
1	23	Primary private-space control
1	24	Primary storage-alteration-event control
1	25-31	Primary segment-table length
2	1-25	Dispatchable-unit-control-table origin
3	0-15	PSW-key mask
3	16-31	Secondary ASN
4	0-15	Authorization index
4	16-31	Primary ASN
5	0	Subsystem-linkage control
5	1-24	Linkage-table origin
5	25-31	Linkage-table length
5	1-25	When the address-space-function control is one, Primary-ASN-second-table-entry
6	0-7	I/O-interruption subclass mask
7	1-19	Secondary segment-table origin
7	22	Secondary subspace-group control
7	23	Secondary private-space control
7	24	Secondary storage-alteration-event control
7	25-31	Secondary segment-table length
8	0-15	Extended authorization index
8	16-31	Monitor masks
9	0	Successful-branching-event mask
9	1	Instruction-fetching-event mask
9	2	Storage-alteration-event mask
9	3	GR-alteration-event mask
9	4	Store-using-real-address-event mask
9	8	Branch-address control
9	10	Storage-alteration-space control
9	16-31	PER general-register masks
10	1-31	PER starting address
11	1-31	PER ending address
12	0	Branch-trace control
12	1-29	Trace-entry address
12	30	ASN-trace control
12	31	Explicit-trace control
13	0	Home space-switch-event control
13	1-19	Home segment-table origin
13	23	Home private-space control
13	24	Home storage-alteration-event control
13	25-31	Home segment-table length
14	0	Set to 1
14	1	Set to 1
14	2	Extended-save-area control
14	3	Channel-report-pending subclass mask
14	4	Recovery subclass mask
14	5	Degradation subclass mask
14	6	External-damage subclass mask
14	7	Warning subclass mask
14	10	TOD-clock-control-override control
14	12	ASN-translation control
14	13-31	ASN-first-table origin
15	1-28	Linkage-stack-entry address

Control registers in IBM z/Architecture

The control registers of z/Architecture are an evolutionary enhancement to the control registers of the earlier ESA/390 on the IBM S/390 processors. For details on which fields are dependent on specific features, consult the Principles of Operation.
Because z/Architecture expands the control registers from 32 bits to 64, the bit numbering differs from that in ESA/390.

CR	bits	Field
0	8	Transactional-execution control
0	9	Transactional-execution program-interruption filtering override
0	10	Clock-comparator sign control
0	13	Cryptography counter control
0	14	Processor-activity-instrumentation-extension control
0	15	Measurement-counter-extraction-authorization control
0	30	Warning-track subclass mask
0	32	TRACE TOD-clock control
0	33	SSM-suppression
0	34	TOD-clock-sync control
0	35	Low-address-protection control
0	36	Extraction-authority control
0	37	Secondary-space control
0	38	Fetch-protection-override control
0	39	Storage-protection-override control
0	40	Enhanced-DAT-enablement control
0	43	Instruction-execution-protection-enablement control
0	44	ASN-and-LX-reuse control
0	45	AFP-register control
0	46	Vector enablement control
0	48	Malfunction-alert subclass mask
0	48	Malfunction-alert subclass mask
0	49	Emergency-signal subclass mask
0	50	External-call subclass mask
0	52	Clock-comparator subclass mask
0	53	CPU-timer subclass mask
0	54	Service-signal subclass mask
0	56	Initialized to 1
0	57	Interrupt-key subclass mask
0	58	Measurement-alert subclass mask
0	59	Timing-alert subclass mask
0	61	Crypto control
1	0-51	Primary Address-Space Control Element Primary region-table origin Primary segment-table origin Primary real-space token origin
1	54	Primary subspace-group control
1	55	Primary private-space control
1	56	Primary storage-alteration-event
1	57	Primary space-switch-event control
1	58	Primary real-space control
1	60-61	Primary designation-type control
1	62-63	Primary table length
2	33-57	Dispatchable-unit-control-table origin
2	59	Guarded-storage-facility enablement control
2	61	Transaction diagnostic scope
2	62-63	Transaction diagnostic control
3	0-31	Secondary ASN-second-table-entry instance number
3	32-47	PSW-key mask
3	48-63	Secondary ASN
4	0-31	Primary ASN-second-table-entry instance number
4	32-47	Authorization index
4	48-63	Primary ASN
5	33-57	Primary-ASN-second-table-entry origin
6	32-39	I/O-interruption subclass mask
7	0-51	Secondary Address-Space Control Element Secondary region-table origin Secondary segment-table origin Secondary real-space token origin
7	54	Secondary subspace-group control
7	55	Secondary private-space control
7	56	Secondary storage-alteration-event control
7	58	Secondary real-space control
7	60-61	Secondary designation-type control
7	62-63	Secondary table length
8	16-31	Enhanced-monitor masks
8	32-47	Extended authorization index
8	48-63	Monitor masks
9	32	Successful-branching-event mask
9	33	Instruction-fetching-event mask
9	34	Storage-alteration-event mask
9	35	Storage-key-alteration-event mask
9	36	Store-using-real-address-event mask
9	37	Zero-address-detection-event mask
9	38	Transaction-end event mask
9	39	Instruction-fetching-nullification-event mask
9	40	Branch-address control
9	41	PER-event-suppression control
9	43	Storage-alteration-space control
10	0-63	PER starting address
11	0-63	PER ending address
12	0	Branch-trace control
12	1	Mode-trace control
12	2-61	Trace-entry address
12	62	ASN-trace control
12	63	Explicit-trace control
13	0-51	Home Address-Space Control Element Home region-table origin Home segment-table origin Home real-space token origin
13	55	Home private-space control
13	56	Home storage-alteration-eventl
13	57	Home space-switch-event control
13	58	Secondary real-space control
13	60-61	Home designation-type control
13	62-63	Home table length
14	32	Set to 1
14	33	Set to 1
14	34	Extended save-area control
14	35	Channel-report-pending subclass mask
14	36	Recovery subclass mask
14	37	Degradation subclass mask
14	38	External-damage subclass mask
14	39	Warning subclass mask
14	42	TOD-clock-control-override control
14	44	ASN-translation control
14	45-63	ASN-first-table origin
15	0-60	Linkage-stack-entry address

Control registers in Intel [x86] series

CR0

The CR0 register is 32 bits long on the 386 and higher processors. On x64 processors in long mode, it is 64 bits long. CR0 has various control flags that modify the basic operation of the processor. Register CR0 is the 32 Bit version of the old Machine Status Word register. The MSW register was expanded to the Control Register with the appearance of the i386 processor.

Bit	Name	Full Name	Description
0	PE	Protected Mode Enable	If 1, system is in protected mode, else, system is in real mode
1	MP	Monitor co-processor	Controls interaction of WAIT/FWAIT instructions with TS flag in CR0
2	EM	Emulation	If set, no x87 floating-point unit present, if clear, x87 FPU present
3	TS	Task switched	Allows saving x87 task context upon a task switch only after x87 instruction used
4	ET	Extension type	On the 386, it allowed to specify whether the external math coprocessor was an 80287 or 80387
5	NE	Numeric error	On the 486 and later, enable internal x87 floating point error reporting when set, else enable PC-style error reporting from the internal floating-point unit using external logic
16	WP	Write protect	When set, the CPU cannot write to read-only pages when privilege level is 0
18	AM	Alignment mask	Alignment check enabled if AM set, AC flag set, and privilege level is 3
29	NW	Not-write through	Globally enables/disable write-through caching
30	CD	Cache disable	Globally enables/disable the memory cache
31	PG	Paging	If 1, enable paging and use the register, else disable paging.

CR1

Reserved, the CPU will throw a #UD exception when trying to access it.

CR2

Contains a value called Page Fault Linear Address. When a page fault occurs, the address the program attempted to access is stored in the CR2 register.

CR3

Image:X86 Paging 4K.svg|thumb|Typical use of CR3 in address translation with 4 KiB pages
Used when virtual addressing is enabled, hence when the PG bit is set in CR0. CR3 enables the processor to translate linear addresses into physical addresses by locating the page directory and page tables for the current task. Typically, the upper 20 bits of CR3 become the page directory base register, which stores the physical address of the first page directory. If the PCIDE bit in CR4 is set, the lowest 12 bits are used for the process-context identifier.

CR4

Used in protected mode to control operations such as virtual-8086 support, enabling I/O breakpoints, page size extension and machine-check exceptions.

Bit	Name	Full Name	Description
0	VME	Virtual 8086 Mode Extensions	If set, enables support for the virtual interrupt flag in virtual-8086 mode.
1	PVI	Protected-mode Virtual Interrupts	If set, enables support for the virtual interrupt flag in protected mode.
2	TSD	Time Stamp Disable	If set, RDTSC instruction can only be executed when in ring 0, otherwise RDTSC can be used at any privilege level.
3	DE	Debugging Extensions	If set, enables debug register based breaks on I/O space access.
4	PSE	Page Size Extension	If set, enables 32-bit paging mode to use 4 MiB huge pages in addition to 4 KiB pages. If PAE is enabled or the processor is in x86-64 long mode this bit is ignored.
5	PAE	Physical Address Extension	If set, changes page table layout to translate 32-bit virtual addresses into extended 36-bit physical addresses.
6	MCE	Machine Check Exception	If set, enables machine check interrupts to occur.
7	PGE	Page Global Enabled	If set, address translations may be shared between address spaces.
8	PCE	Performance-Monitoring Counter enable	If set, RDPMC can be executed at any privilege level, else RDPMC can only be used in ring 0.
9	OSFXSR	Operating system support for FXSAVE and FXRSTOR instructions	If set, enables Streaming SIMD Extensions instructions and fast FPU save & restore.
10	OSXMMEXCPT	Operating System Support for Unmasked SIMD Floating-Point Exceptions	If set, enables unmasked SSE exceptions.
11	UMIP	User-Mode Instruction Prevention	If set, the SGDT, SIDT, SLDT, SMSW and STR instructions cannot be executed if CPL > 0.
12	LA57	57-Bit Linear Addresses	If set, enables 5-Level Paging.
13	VMXE	Virtual Machine Extensions Enable	see Intel VT-x x86 virtualization.
14	SMXE	Safer Mode Extensions Enable	see Trusted Execution Technology
15
16	FSGSBASE	FSGSBASE Enable	If set, enables the instructions RDFSBASE, RDGSBASE, WRFSBASE, and WRGSBASE.
17	PCIDE	PCID Enable	If set, enables process-context identifiers.
18	OSXSAVE	XSAVE and Processor Extended States Enable
19	KL	Key Locker Enable	If set, enables the AES Key Locker instructions.
20		Supervisor Mode Execution Protection Enable	If set, execution of code in a higher ring generates a fault.
21	SMAP	Supervisor Mode Access Prevention Enable	If set, access of data in a higher ring generates a fault.
22	PKE	Protection Key Enable	See Intel 64 and IA-32 Architectures Software Developer's Manual.
23	CET	Control-flow Enforcement Technology	If set, enables control-flow enforcement technology.
24	PKS	Enable Protection Keys for Supervisor-Mode Pages	If set, each supervisor-mode linear address is associated with a protection key when 4-level or 5-level paging is in use.
25	UINTR	User Interrupts Enable	If set, enables user-mode inter-processor interrupts and their associated instructions and data structures.
63-26

CR5–7

Reserved, same case as CR1.

Additional Control registers in Intel [x86-64] series

EFER

Extended Feature Enable Register is a model-specific register added in the AMD K6 processor, to allow enabling the SYSCALL/SYSRET instruction, and later for entering and exiting long mode. This register becomes architectural in AMD64 and has been adopted by Intel as IA32_EFER. Its MSR number is 0xC0000080.

Bit	Purpose
0	SCE
1	DPE
2	SEWBED
3	GEWBED
4	L2D
5-7	Reserved, Read as Zero
8	LME
9	Reserved
10	LMA
11	NXE
12	SVME
13	LMSLE
14	FFXSR
15	TCE
16	Reserved
17	MCOMMIT
18	INTWB
19	Reserved
20	UAIE
21	AIBRSE
22–63	Reserved

CR8

CR8 is a new register accessible in 64-bit mode using the REX prefix. CR8 is used to prioritize external interrupts and is referred to as the task-priority register.
The AMD64 architecture allows software to define up to 15 external interrupt-priority classes. Priority classes are numbered from 1 to 15, with priority-class 1 being the lowest and priority-class 15 the highest. CR8 uses the four low-order bits for specifying a task priority and the remaining 60 bits are reserved and must be written with zeros.
System software can use the TPR register to temporarily block low-priority interrupts from interrupting a high-priority task. This is accomplished by loading TPR with a value corresponding to the highest-priority interrupt that is to be blocked. For example, loading TPR with a value of 9 blocks all interrupts with a priority class of 9 or less, while allowing all interrupts with a priority class of 10 or more to be recognized. Loading TPR with 0 enables all external interrupts. Loading TPR with 15 disables all external interrupts.
The TPR is cleared to 0 on reset.

XCR0 and XSS

XCR0, or Extended Control Register 0, is a control register which is used to toggle the storing or loading of registers related to specific CPU features using the XSAVE/XRSTOR instructions. It is also used with some features to enable or disable the processor's ability to execute their corresponding instructions. It can be changed using the privileged XSETBV read using the unprivileged XGETBV instructions.
There is also the IA32_XSS MSR, which is located at address DA0h. The IA32_XSS MSR controls bits of XCR0 which are considered to be "supervisor" state, and should be invisible to regular programs. It operates with the privileged XSAVES and XRSTORS instructions by adding supervisor state to the data they operate with. Put simply, if the X87 state was enabled in XCR0 and PT state was enabled in IA32_XSS, the XSAVE instruction would only store X87 state, while the privileged XSAVES would store both X87 and PT states. Because it is an MSR, it can be accessed using the RDMSR and WRMSR instructions.

Bit	Purpose
0–7	Reserved; must be 0.
8	PT
10	Processor Address Space ID state
11	Control-flow Enforcement Technology User State
12	Control-flow Enforcement Technology Supervisor State
13	HDC
14	User interrupts state
15	Last branch recording state
16	HWP
17–63	Reserved; must be 0.