VSTCR_EL2
Virtualization Secure Translation Control Register
when FEAT_SEL2 is implemented and FEAT_AA64 is implemented
The control register for stage 2 of the Secure EL1&0 translation regime.
Generic System Control
This register has no effect if EL2 is not enabled in the current Security state.
VSTCR_EL2 is a 64-bit register.
Any of the bits in VSTCR_EL2 are permitted to be cached in a TLB.
63
34
63:34
Reserved, RES0.
SL2
33
33
0
Starting level of the Secure stage 2 translation lookup controlled by VSTCR_EL2.
If VTCR_EL2.DS == 1, then VSTCR_EL2.SL2, in combination with VSTCR_EL2.SL0, gives encodings for the Secure stage 2 translation table walk initial lookup level.
If VTCR_EL2.DS == 0, then VSTCR_EL2.SL2 is RES0.
If the translation granule size is not 4KB, then this field is RES0.
AU
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
33
33
33
Reserved, RES0.
Otherwise
32
32
32
Reserved, RES0.
31
31
31
Reserved, RES1.
SA
30
30
30
Secure stage 2 translation output address space.
When the value of VSTCR_EL2.SW is 1, this bit behaves as 1 for all purposes other than reading back the value of the bit.
0b0
All stage 2 translations for the Secure IPA space access the Secure PA space.
0b1
All stage 2 translations for the Secure IPA space access the Non-secure PA space.
AU
SW
29
29
29
Secure stage 2 translation address space.
0b0
All stage 2 translation table walks for the Secure IPA space are to the Secure PA space.
0b1
All stage 2 translation table walks for the Secure IPA space are to the Non-secure PA space.
AU
28
16
28:16
Reserved, RES0.
TG0
15
14
15:14
Secure stage 2 granule size for VSTTBR_EL2.
Other values are reserved.
If FEAT_GTG is implemented, ID_AA64MMFR0_EL1.{TGran4_2, TGran16_2, TGran64_2} indicate which granule sizes are supported for stage 2 translation.
If FEAT_GTG is not implemented, ID_AA64MMFR0_EL1.{TGran4, TGran16, TGran64} indicate which granule sizes are supported.
If the value is programmed to either a reserved value, or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.
It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.
0b00
4KB.
0b01
64KB.
0b10
16KB.
AU
13
8
13:8
Reserved, RES0.
SL0
7
6
1:0
Starting level of the Secure stage 2 translation lookup, controlled by VSTCR_EL2. The meaning of this field depends on the value of VSTCR_EL2.TG0.
If this field is programmed to a value that is not consistent with the programming of VSTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.
0b00
If VSTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 2.
If FEAT_LPA2 is implemented and VSTCR_EL2.SL2 is 0, start at level 2.
If FEAT_LPA2 is implemented and VSTCR_EL2.SL2 is 1, start at level -1.
If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01
If VSTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 1.
If FEAT_LPA2 is implemented and VSTCR_EL2.SL2 is 0, start at level 1.
If FEAT_LPA2 is implemented, the combination of VSTCR_EL2.SL0 == 01 and VSTCR_EL2.SL2 == 1 is reserved.
If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10
If VSTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 0.
If FEAT_LPA2 is implemented and VSTCR_EL2.SL2 is 0, start at level 0.
If FEAT_LPA2 is implemented, the combination of VSTCR_EL2.SL0 == 10 and VSTCR_EL2.SL2 == 1 is reserved.
If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.
0b11
If VSTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 3.
If FEAT_LPA2 is implemented and VSTCR_EL2.SL2 is 0, start at level 3.
If FEAT_LPA2 is implemented, the combination of VSTCR_EL2.SL0 == 11 and VSTCR_EL2.SL2 == 1 is reserved.
If VSTCR_EL2.TG0 is 0b10 (16KB granule) and FEAT_LPA2 is implemented, start at level 0.
AU
When FEAT_TTST is implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
SL0
7
6
1:0
Starting level of the Secure stage 2 translation lookup, controlled by VSTCR_EL2. The meaning of this field depends on the value of VSTCR_EL2.TG0.
All other values are reserved. If this field is programmed to a reserved value, or to a value that is not consistent with the programming of VSTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.
0b00
If VSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01
If VSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10
If VSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 0. If VSTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.
AU
When FEAT_TTST is not implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
7
6
7:6
Reserved, RES0.
Otherwise
T0SZ
5
0
5:0
The size offset of the memory region addressed by VSTTBR_EL2. The region size is 2(64-T0SZ) bytes.
The maximum and minimum possible values for this field depend on the level of translation table and the memory translation granule size, as described in the AArch64 Virtual Memory System Architecture chapter.
If this field is programmed to a value that is not consistent with the programming of SL0, then a stage 2 level 0 Translation fault is generated.
For the 4KB translation granule, if FEAT_LPA2 is implemented and this field is less than 16, the translation table walk begins with a level -1 initial lookup.For the 16KB translation granule, if FEAT_LPA2 is implemented and this field is less than 17, the translation table walk begins with a level 0 initial lookup.
AU
MRS <Xt>, VSTCR_EL2
if !(IsFeatureImplemented(FEAT_SEL2) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if !IsCurrentSecurityState(SS_Secure) then
Undefined();
elsif EffectiveHCR_EL2_NVx() IN {'1x1'} then
X{64}(t) = NVMem(0x048);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if !IsCurrentSecurityState(SS_Secure) then
Undefined();
else
X{64}(t) = VSTCR_EL2();
end;
elsif PSTATE.EL == EL3 then
if SCR_EL3().EEL2 == '0' then
Undefined();
else
X{64}(t) = VSTCR_EL2();
end;
end;
MSR VSTCR_EL2, <Xt>
if !(IsFeatureImplemented(FEAT_SEL2) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if !IsCurrentSecurityState(SS_Secure) then
Undefined();
elsif EffectiveHCR_EL2_NVx() IN {'1x1'} then
NVMem(0x048) = X{64}(t);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if !IsCurrentSecurityState(SS_Secure) then
Undefined();
else
VSTCR_EL2() = X{64}(t);
end;
elsif PSTATE.EL == EL3 then
if SCR_EL3().EEL2 == '0' then
Undefined();
else
VSTCR_EL2() = X{64}(t);
end;
end;
2026-03-26 20:27:25
2026-03_rel