<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE register_page SYSTEM "registers.dtd">
<!-- Copyright (c) 2010-2026 Arm Limited or its affiliates. All rights reserved. -->
<!-- This document is Non-Confidential. This document may only be used and distributed in accordance with the terms of the agreement entered into by Arm and the party that Arm delivered this document to. -->
<!--The data contained in this document is preliminary and subject to change or correction following further review. -->
<?xml-stylesheet href="one_register.xsl" type="text/xsl" ?>







<register_page>
  <registers>
  
    <register execution_state="AArch32" is_register="True" is_internal="True" is_stub_entry="False">
      <reg_short_name>VTTBR</reg_short_name>
        
        <reg_long_name>Virtualization Translation Table Base Register</reg_long_name>



      
            <reg_condition otherwise="UNDEFINED">when FEAT_AA32EL2 is implemented</reg_condition>
      




          <reg_reset_value></reg_reset_value>

      <reg_mappings>
        



    
      
      <reg_mapping>
        
  

    

  

    <mapped_name filename="AArch64-vttbr_el2.xml">VTTBR_EL2</mapped_name>
  <mapped_type>Architectural</mapped_type>
      <mapped_execution_state>AArch64</mapped_execution_state>
    <mapped_from_startbit>63</mapped_from_startbit>
    <mapped_from_endbit>0</mapped_from_endbit>
    <mapped_to_startbit>63</mapped_to_startbit>
    <mapped_to_endbit>0</mapped_to_endbit>
    <mapped_from_rangeset output="63:0">
      <range>
        <msb>63</msb>
        <lsb>0</lsb>
      </range>
    </mapped_from_rangeset>
    <mapped_to_rangeset output="63:0">
      <range>
        <msb>63</msb>
        <lsb>0</lsb>
      </range>
    </mapped_to_rangeset>

      </reg_mapping>

      </reg_mappings>

        <reg_purpose>
          
    
      <purpose_text>
        <para>Holds the base address of the translation table for the initial lookup for stage 2 of an address translation in the Non-secure PL1&amp;0 translation regime, and other information for this translation regime.</para>
      </purpose_text>

        </reg_purpose>

      <reg_groups>
            <reg_group>Memory</reg_group>
            <reg_group>Virt</reg_group>
      </reg_groups>
      <reg_configuration>
        
    
      <configuration_text>
        <para>If EL2 is not implemented, this register is <arm-defined-word>RES0</arm-defined-word> from EL3.</para>
      </configuration_text>

      </reg_configuration>
      
      
        
      <reg_attributes>
          
    
      <attributes_text>
        <para>VTTBR is a 64-bit register.</para>
      </attributes_text>

      </reg_attributes>
      <reg_fieldsets>
        






<fields id="fieldset_0" length="64">
  <text_before_fields/>
  <field id="fieldset_0-63_56" has_partial_fieldset="False" is_linked_to_partial_fieldset="False" is_access_restriction_possible="False" is_variable_length="False" is_constant_value="False" is_partial_field="False" is_conditional_field_name="False" rwtype="RES0">
    <field_msb>63</field_msb>
    <field_lsb>56</field_lsb>
    <rel_range>63:56</rel_range>
    <field_description order="before"/>
    <field_description order="before">
      <para>Reserved, <arm-defined-word>RES0</arm-defined-word>.</para>
    </field_description>
  </field>
  <field id="fieldset_0-55_48" has_partial_fieldset="False" is_linked_to_partial_fieldset="False" is_access_restriction_possible="False" is_variable_length="False" is_constant_value="False" is_partial_field="False" is_conditional_field_name="False">
    <field_name>VMID</field_name>
    <field_msb>55</field_msb>
    <field_lsb>48</field_lsb>
    <rel_range>55:48</rel_range>
    <field_description order="before">
      <para>The VMID for the translation table.</para>
    </field_description>
    <field_resets>
      <field_reset reset_type="Warm">
        <field_reset_conditions>
          <field_reset_condition condition="the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2">
            <field_reset>
              <field_reset_expression>0x00</field_reset_expression>
            </field_reset>
          </field_reset_condition>
          <field_reset_condition>
            <field_reset>
              <field_reset_standard_text>AU</field_reset_standard_text>
            </field_reset>
          </field_reset_condition>
        </field_reset_conditions>
      </field_reset>
    </field_resets>
  </field>
  <field id="fieldset_0-47_1" has_partial_fieldset="False" is_linked_to_partial_fieldset="False" is_access_restriction_possible="False" is_variable_length="False" is_constant_value="False" is_partial_field="False" is_conditional_field_name="False">
    <field_name>BADDR</field_name>
    <field_msb>47</field_msb>
    <field_lsb>1</field_lsb>
    <rel_range>47:1</rel_range>
    <field_description order="before"><para>Translation table base address, bits[47:x], Bits [x-1:1] are <arm-defined-word>RES0</arm-defined-word>, with the additional requirement that if bits[x-1:3] are not all zero, this is a misaligned translation table base address, with effects that are <arm-defined-word>CONSTRAINED UNPREDICTABLE</arm-defined-word>, and must be one of the following:</para>
<list type="unordered">
<listitem><content>Register bits [x-1:3] are treated as if all the bits are zero. The value read back from these bits is either the value written or zero.</content>
</listitem><listitem><content>The result of the calculation of an address for a translation table walk using this register can be corrupted in those bits that are nonzero.</content>
</listitem></list>
<para>x is determined from the value of <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.SL0 and <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.T0SZ as follows:</para>
<list type="unordered">
<listitem><content>If <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.SL0 is <binarynumber>0b00</binarynumber>, meaning that lookup starts at level 2, then x is 14 - <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.T0SZ.</content>
</listitem><listitem><content>If <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.SL0 is <binarynumber>0b01</binarynumber>, meaning that lookup starts at level 1, then x is 5 - <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.T0SZ.</content>
</listitem><listitem><content>If <register_link state="AArch32" id="AArch32-vtcr.xml">VTCR</register_link>.SL0 is either <binarynumber>0b10</binarynumber> or <binarynumber>0b11</binarynumber> then a stage 2 level 1 Translation fault is generated.</content>
</listitem></list>
<para>If bits[47:40] of the translation table base address are not zero, an Address size fault is generated.</para></field_description>
    <field_resets>
      <field_reset reset_type="Warm">
        <field_reset_standard_text>AU</field_reset_standard_text>
      </field_reset>
    </field_resets>
  </field>
  <field id="fieldset_0-0_0-1" has_partial_fieldset="False" is_linked_to_partial_fieldset="False" is_access_restriction_possible="False" is_variable_length="False" is_constant_value="False" is_partial_field="False" is_conditional_field_name="False" reserved_type="RES0">
    <field_name>CnP</field_name>
    <field_msb>0</field_msb>
    <field_lsb>0</field_lsb>
    <rel_range>0</rel_range>
    <field_description order="before">
      <para>Common not Private. This bit indicates whether each entry that is pointed to by VTTBR is a member of a common set that can be used by every PE in the Inner Shareable domain for which the value of VTTBR.CnP is 1.</para>
    </field_description>
    <field_description order="after"><para>When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 and stage 2.</para>
<note><para>If the value of the VTTBR.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and those VTTBRs do not point to the same translation table entries when the VMID value is the same as the current VMID, then the results of translations are <arm-defined-word>CONSTRAINED UNPREDICTABLE</arm-defined-word>, see <xref linkend="#CEGICEHJ">'CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values'</xref>.</para></note></field_description>
    <field_values impdef="False">
      <field_value_instance>
        <field_value>0b0</field_value>
        <field_value_description>
          <para>The translation table entries pointed to by VTTBR are permitted to differ from the entries for VTTBR for other PEs in the Inner Shareable domain. This is not affected by the value of the current VMID.</para>
        </field_value_description>
      </field_value_instance>
      <field_value_instance>
        <field_value>0b1</field_value>
        <field_value_description>
          <para>The translation table entries pointed to by VTTBR are the same as the translation table entries for every other PE in the Inner Shareable domain for which the value of VTTBR.CnP is 1 and the VMID is the same as the current VMID.</para>
        </field_value_description>
      </field_value_instance>
    </field_values>
    <field_resets>
      <field_reset reset_type="Warm">
        <field_reset_standard_text>AU</field_reset_standard_text>
      </field_reset>
    </field_resets>
    <fields_condition>When FEAT_TTCNP is implemented</fields_condition>
  </field>
  <field id="fieldset_0-0_0-2" has_partial_fieldset="False" is_linked_to_partial_fieldset="False" is_access_restriction_possible="False" is_variable_length="False" is_constant_value="False" is_partial_field="False" is_conditional_field_name="False" rwtype="RES0">
    <field_msb>0</field_msb>
    <field_lsb>0</field_lsb>
    <rel_range>0</rel_range>
    <field_description order="before"/>
    <field_description order="before">
      <para>Reserved, <arm-defined-word>RES0</arm-defined-word>.</para>
    </field_description>
    <fields_condition>Otherwise</fields_condition>
  </field>
  <text_after_fields/>
</fields>




<reg_fieldset length="64">
  <fieldat id="fieldset_0-63_56" msb="63" lsb="56"/>
  <fieldat id="fieldset_0-55_48" msb="55" lsb="48"/>
  <fieldat id="fieldset_0-47_1" msb="47" lsb="1"/>
  <fieldat id="fieldset_0-0_0-1" msb="0" lsb="0"/>
</reg_fieldset>


      </reg_fieldsets>

      <access_mechanisms>
          






    
        
        <access_mechanism accessor="MRRC VTTBR" type="SystemAccessor">
            <encoding>
            <access_instruction>MRRC{&lt;c&gt;}{&lt;q&gt;} &lt;coproc&gt;, {#}&lt;opc1&gt;, &lt;Rt&gt;, &lt;Rt2&gt;, &lt;CRm&gt;</access_instruction>
                
                <enc n="coproc" v="0b1111"/>
                
                <enc n="CRm" v="0b0010"/>
                
                <enc n="opc1" v="0b0110"/>
            </encoding>
            <access_permission>
                <ps name="MRRC" sections="1" secttype="access_permission">
                <pstext>
if !IsFeatureImplemented(FEAT_AA32EL2) then
    Undefined();
elsif PSTATE.EL == EL0 then
    Undefined();
elsif PSTATE.EL == EL1 then
    if EL2Enabled() &amp;&amp; IsFeatureImplemented(FEAT_AA64EL2) &amp;&amp; !ELUsingAArch32(EL2) &amp;&amp; HSTR_EL2().T2 == '1' then
        AArch64_AArch32SystemAccessTrap(EL2, 0x04);
    elsif EL2Enabled() &amp;&amp; IsFeatureImplemented(FEAT_AA32EL2) &amp;&amp; ELUsingAArch32(EL2) &amp;&amp; HSTR().T2 == '1' then
        AArch32_TakeHypTrapException(0x04);
    else
        Undefined();
    end;
elsif PSTATE.EL == EL2 then
    R(t, t2) = VTTBR();
elsif PSTATE.EL == EL3 then
    if SCR().NS == '0' then
        Undefined();
    else
        R(t, t2) = VTTBR();
    end;
end;
                </pstext>
                </ps>
            </access_permission>
        </access_mechanism>
    
        
        <access_mechanism accessor="MCRR VTTBR" type="SystemAccessor">
            <encoding>
            <access_instruction>MCRR{&lt;c&gt;}{&lt;q&gt;} &lt;coproc&gt;, {#}&lt;opc1&gt;, &lt;Rt&gt;, &lt;Rt2&gt;, &lt;CRm&gt;</access_instruction>
                
                <enc n="coproc" v="0b1111"/>
                
                <enc n="CRm" v="0b0010"/>
                
                <enc n="opc1" v="0b0110"/>
            </encoding>
            <access_permission>
                <ps name="MCRR" sections="1" secttype="access_permission">
                <pstext>
if !IsFeatureImplemented(FEAT_AA32EL2) then
    Undefined();
elsif PSTATE.EL == EL0 then
    Undefined();
elsif PSTATE.EL == EL1 then
    if EL2Enabled() &amp;&amp; IsFeatureImplemented(FEAT_AA64EL2) &amp;&amp; !ELUsingAArch32(EL2) &amp;&amp; HSTR_EL2().T2 == '1' then
        AArch64_AArch32SystemAccessTrap(EL2, 0x04);
    elsif EL2Enabled() &amp;&amp; IsFeatureImplemented(FEAT_AA32EL2) &amp;&amp; ELUsingAArch32(EL2) &amp;&amp; HSTR().T2 == '1' then
        AArch32_TakeHypTrapException(0x04);
    else
        Undefined();
    end;
elsif PSTATE.EL == EL2 then
    VTTBR() = R(t, t2);
elsif PSTATE.EL == EL3 then
    if SCR().NS == '0' then
        Undefined();
    else
        VTTBR() = R(t, t2);
    end;
end;
                </pstext>
                </ps>
            </access_permission>
        </access_mechanism>

      </access_mechanisms>

      <arch_variants>
      </arch_variants>
  </register>
</registers>
<timestamp>2026-03-26 20:27:25</timestamp>
<commit_id>2026-03_rel</commit_id>
</register_page>