AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# VTCR_EL2, Virtualization Translation Control Register

The VTCR_EL2 characteristics are:

## Purpose

The control register for stage 2 of the EL1&0 translation regime.

## Configuration

AArch64 System register VTCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register VTCR[31:0] .

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

VTCR_EL2 is a 64-bit register.

## Field descriptions

The VTCR_EL2 bit assignments are:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES1 | NSA | NSW | HWU62 | HWU61 | HWU60 | HWU59 | RES0 | HD | HA | RES0 | VS | PS | TG0 | SH0 | ORGN0 | IRGN0 | SL0 | T0SZ
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

Any of the bits in VTCR_EL2 are permitted to be cached in a TLB.

#### Bits [63:32]

Reserved, RES0.

#### Bit [31]

Reserved, RES1.

#### NSA, bit [30]
From Armv8.4:

Non-secure stage 2 translation output address space.

NSA | Meaning
--- | ---
0b0 | All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation regime access the Secure PA space.
0b1 | All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation regime access the Non-secure PA space.

This bit behaves as 1 for all purposes other than reading back the value of the bit when one of the following is true:

- The PE is executing in Non-secure state.
- The value of VTCR_EL2.NSW is 1.
- The value of VSTCR_EL2.SA is 1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### NSW, bit [29]
From Armv8.4:

Non-secure stage 2 translation table address space.

NSW | Meaning
--- | ---
0b0 | All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 translation regime are to the Secure PA space.
0b1 | All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 translation regime are to the Non-secure PA space.

When the PE is executing in Non-secure state, this bit behaves as 1 for all purposes other than reading back the value of the bit.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU62, bit [28]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 2 translation table Block or Page entry.

HWU62 | Meaning
--- | ---
0b0 | Bit[62] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[62] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU61, bit [27]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 2 translation table Block or Page entry.

HWU61 | Meaning
--- | ---
0b0 | Bit[61] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[61] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU60, bit [26]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 2 translation table Block or Page entry.

HWU60 | Meaning
--- | ---
0b0 | Bit[60] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[60] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HWU59, bit [25]
When ARMv8.2-TTPBHA is implemented:

Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 2 translation table Block or Page entry.

HWU59 | Meaning
--- | ---
0b0 | Bit[59] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1 | Bit[59] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [24:23]

Reserved, RES0.

#### HD, bit [22]
When ARMv8.1-TTHM is implemented:

Hardware management of dirty state in stage 2 translations when EL2 is enabled in the current Security state.

HD | Meaning
--- | ---
0b0 | Stage 2 hardware management of dirty state disabled.
0b1 | Stage 2 hardware management of dirty state enabled, only if the VTCR_EL2.HA bit is also set to 1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HA, bit [21]
When ARMv8.1-TTHM is implemented:

Hardware Access flag update in Non-secure and Secure stage 2 translations when EL2 is enabled in the current Security state.

HA | Meaning
--- | ---
0b0 | Stage 2 Access flag update disabled.
0b1 | Stage 2 Access flag update enabled.

####
Otherwise:

Reserved, RES0.

#### Bit [20]

Reserved, RES0.

#### VS, bit [19]
When ARMv8.1-VMID16 is implemented:

VMID Size.

VS | Meaning
--- | ---
0b0 | 8 bit - the upper 8 bits of VTTBR_EL2 and VSTTBR_EL2 are ignored by the hardware, and treated as if they are all zeros, for every purpose except when reading back the register.
0b1 | 16 bit - the upper 8 bits of VTTBR_EL2 and VSTTBR_EL2 are used for allocation and matching in the TLB.

If the implementation only supports an 8-bit VMID, this field is RES0.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### PS, bits [18:16]

Physical address Size for the Second Stage of translation.

PS | Meaning
--- | ---
0b000 | 32 bits, 4GB.
0b001 | 36 bits, 64GB.
0b010 | 40 bits, 1TB.
0b011 | 42 bits, 4TB.
0b100 | 44 bits, 16TB.
0b101 | 48 bits, 256TB.
0b110 | 52 bits, 4PB.

Other values are reserved.

The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not rely on this property as the behavior of the reserved values might change in a future revision of the architecture.

The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size is 64KB.

In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated as 0b110, then bits[51:48] of every translation table base address for the stage of translation controlled by VTCR_EL2 are 0b0000.

This field resets to an architecturally UNKNOWN value.

#### TG0, bits [15:14]

Granule size for the VTTBR_EL2.

TG0 | Meaning
--- | ---
0b00 | 4KB.
0b01 | 64KB.
0b10 | 16KB.

Other values are reserved.

If the value is programmed to either a reserved value, or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.

It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.

This field resets to an architecturally UNKNOWN value.

#### SH0, bits [13:12]

Shareability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.

SH0 | Meaning
--- | ---
0b00 | Non-shareable.
0b10 | Outer Shareable.
0b11 | Inner Shareable.

Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in AArch64 System registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section K1.2.2.

This field resets to an architecturally UNKNOWN value.

#### ORGN0, bits [11:10]

Outer cacheability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.

ORGN0 | Meaning
--- | ---
0b00 | Normal memory, Outer Non-cacheable.
0b01 | Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

#### IRGN0, bits [9:8]

Inner cacheability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.

IRGN0 | Meaning
--- | ---
0b00 | Normal memory, Inner Non-cacheable.
0b01 | Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10 | Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11 | Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.

This field resets to an architecturally UNKNOWN value.

#### SL0, bits [7:6]
When ARMv8.4-TTST is implemented:

Starting level of the Secure stage 2 translation lookup, controlled by VTCR_EL2. The meaning of this field depends on the value of VTCR_EL2.TG0.

SL0 | Meaning
--- | ---
0b00 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 0. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.
0b11 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 3.

All other values are reserved. If this field is programmed to a reserved value, or to a value that is not consistent with the programming of VTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Starting level of the Secure stage 2 translation lookup, controlled by VTCR_EL2. The meaning of this field depends on the value of VTCR_EL2.TG0.

SL0 | Meaning
--- | ---
0b00 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10 | If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 0. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.

All other values are reserved. If this field is programmed to a reserved value, or to a value that is not consistent with the programming of VTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.

This field resets to an architecturally UNKNOWN value.

#### T0SZ, bits [5:0]

The size offset of the memory region addressed by VTTBR_EL2. The region size is 2(64-T0SZ) bytes.

The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.

If this field is programmed to a value that is not consistent with the programming of SL0 then a stage 2 level 0 Translation fault is generated.

This field resets to an architecturally UNKNOWN value.

## Accessing the VTCR_EL2

Any of the bits in VTCR_EL2 are permitted to be cached in a TLB.

Accesses to this register use the following encodings:

#### MRS <Xt>, VTCR_EL2

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0010 | 0b0001 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then return NVMem[0x040]; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then return VTCR_EL2; elsif PSTATE.EL == EL3 then return VTCR_EL2;

#### MSR VTCR_EL2, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0010 | 0b0001 | 0b010

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then NVMem[0x040] = X[t]; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then VTCR_EL2 = X[t]; elsif PSTATE.EL == EL3 then VTCR_EL2 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

15/04/2019 16:47; 8c23526ba8a13a72aada4137daf3e3977b49036e

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.