VSTTBR_EL2, Virtualization Secure Translation Table Base Register
The VSTTBR_EL2 characteristics are:
The base register for stage 2 of the Secure EL1&0 translation regime. Holds the base address of the translation table for the initial lookup for stage 2 of an address translation in the Secure EL1&0 translation regime, and other information for this translation stage.
This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to VSTTBR_EL2 are UNDEFINED.
This register has no effect if EL2 is not enabled in the current Security state.
RW fields in this register reset to architecturally UNKNOWN values.
VSTTBR_EL2 is a 64-bit register.
The VSTTBR_EL2 bit assignments are:
Any of the bits in VSTTBR_EL2 are permitted to be cached in a TLB.
BADDR, bits [47:1]
Translation table base address, A[47:x] or A[51:x].
- Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation that includes ARMv8.2-LPA and is using the 64KB translation granule.
- A translation table must be aligned to the size of the table, except that when using a translation table base address larger than 48 bits the minimum alignment of a table containing fewer than eight entries is 64 bytes.
If the value of VTCR_EL2.PS is 0b110, then:
- Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is determined as follows:
- If x >= 6 then z=x.
- Otherwise, z=6.
- Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address.
- When z>x register bits[(z-1):x] are RES0, and bits[(z-1):x] of the translation table base address are zero.
- When x>6 register bits[(x-1):6] are RES0.
- Register bit is RES0.
- Bits[5:2] of the stage 1 translation table base address are zero.
When the value of ID_AA64MMFR0_EL1.PARange indicates that the implementation does not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB translation granule when the value of VTCR_EL2.PS is 0b110 and the value of register bits[5:2] is nonzero, an Address size fault is generated.
If the Effective value of VTCR_EL2.PS is not 0b110 then:
- Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address.
- Register bits[(x-1):1] are RES0.
- If the implementation supports 52-bit PAs and IPAs then bits[51:48] of the translation table base addresses used in this stage of translation are 0b0000.
If any VSTTBR_EL2[47:1] bit that is defined as RES0 has the value 1 when a translation table walk is performed using VSTTBR_EL2, then the translation table base address might be misaligned, with effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following:
- Bits[x-1:0] of the translation table base address are treated as if all the bits are zero. The value read back from the corresponding register bits is either the value written to the register or zero.
- The result of the calculation of an address for a translation table walk using this register can be corrupted in those bits that are nonzero.
The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on the value of VSTCR_EL2.T0SZ, the stage of translation, and the translation granule size.
This field resets to an architecturally UNKNOWN value.
CnP, bit 
Common not Private, for stage 2 of the Secure EL1&0 translation regime. In an implementation that includes ARMv8.2-TTCNP, indicates whether each entry that is pointed to by VSTTBR_EL2 is a member of a common set that can be used by every PE in the Inner Shareable domain for which the value of VSTTBR_EL2.CnP is 1.
The translation table entries pointed to by VSTTBR_EL2 are permitted to differ from the entries for VSTTBR_EL2 for other PEs in the Inner Shareable domain. This is not affected by the value of the current VMID.
The translation table entries pointed to by VSTTBR_EL2 are the same as the translation table entries for every other PE in the Inner Shareable domain for which the value of VSTTBR_EL2.CnP is 1 and the VMID is the same as the current VMID.
If the value of VSTTBR_EL2.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and those VSTTBR_EL2s do not point to the same translation table entries when using the current VMID, then the results of translations using VSTTBR_EL2 are CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on page K1-6254.
When this register has an architecturally-defined reset value, this field resets to a value that is architecturally UNKNOWN.
This field resets to an architecturally UNKNOWN value.
Accessing the VSTTBR_EL2
Accesses to this register use the following encodings:
MRS <Xt>, VSTTBR_EL2
if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then return NVMem[0x030]; elsif EL2Enabled() && HCR_EL2.NV == '1' then if SCR_EL3.NS == '1' then UNDEFINED; else AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if SCR_EL3.NS == '1' then UNDEFINED; else return VSTTBR_EL2; elsif PSTATE.EL == EL3 then return VSTTBR_EL2;
MSR VSTTBR_EL2, <Xt>
if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then NVMem[0x030] = X[t]; elsif EL2Enabled() && HCR_EL2.NV == '1' then if SCR_EL3.NS == '1' then UNDEFINED; else AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if SCR_EL3.NS == '1' then UNDEFINED; else VSTTBR_EL2 = X[t]; elsif PSTATE.EL == EL3 then VSTTBR_EL2 = X[t];