VTCR_EL2
Virtualization Translation Control Register
when FEAT_AA64 is implemented
VTCR
Architectural
AArch32
31
0
31
0
31
0
31
0
The control register for stage 2 of the EL1&0 translation regime.
Memory
Virt
If EL2 is not implemented, this register is RES0 from EL3.
This register has no effect if EL2 is not enabled in the current Security state.
VTCR_EL2 is a 64-bit register.
Unless stated otherwise, any of the bits in VTCR_EL2 are permitted to be cached in a TLB.
63
46
63:46
Reserved, RES0.
HDBSS
45
45
0
Enable use of HDBSS.
If VTCR_EL2.{HA, HD} is not {1, 1}, the Effective value of this field is 0.
If SCR_EL3.HDBSSEn is 0, then this field behaves as 0 for all purposes other than a direct read of the value of this bit.
0b0
Hardware tracking of Dirty state Structure is disabled.
0b1
Hardware tracking of Dirty state Structure is enabled.
AU
When FEAT_HDBSS is implemented
45
45
45
Reserved, RES0.
Otherwise
HAFT
44
44
0
Hardware managed Access Flag for Table descriptors.
Enables the Hardware managed Access Flag for Table descriptors.
0b0
Hardware managed Access Flag for Table descriptors is disabled.
0b1
Hardware managed Access Flag for Table descriptors is enabled.
AU
When FEAT_HAFT is implemented
44
44
44
Reserved, RES0.
Otherwise
43
42
43:42
Reserved, RES0.
TL0
41
41
0
Control bit to check for presence of MMU TopLevel0 permission attribute.
0b0
This bit does not have any effect on stage 2 translations.
0b1
Enables MMU TopLevel0 permission attribute check for TTBR0_EL1 and TTBR1_EL1 translations.
AU
When FEAT_THE is implemented
41
41
41
Reserved, RES0.
Otherwise
GCSH
40
40
0
Assured stage 1 translations for Guarded Control Stacks. Enforces use of the AssuredOnly attribute in stage 2 for the memory accessed by privileged Guarded Control Stack data accesses.
This bit is permitted to be cached in a TLB.
0b0
For the memory accessed by privileged Guarded Control Stack data accesses, the AssuredOnly attribute in stage 2 is not required to be set.
0b1
For the memory accessed by privileged Guarded Control Stack data accesses, the AssuredOnly attribute in stage 2 is required to be set.
AU
When FEAT_THE is implemented and FEAT_GCS is implemented
40
40
40
Reserved, RES0.
Otherwise
39
39
39
Reserved, RES0.
D128
38
38
0
Enables VMSAv9-128 translation system for stage 2 translation.
0b0
Translation system follows VMSAv8-64 translation process.
0b1
Translation system follows VMSAv9-128 translation process.
AU
When FEAT_D128 is implemented
38
38
38
Reserved, RES0.
Otherwise
S2POE
37
37
0
Enable Permission Overlay. Enables permission overlay in stage 2 Permission model.
This bit is not permitted to be cached in a TLB.
0b0
Overlay disabled.
0b1
Overlay enabled.
AU
When FEAT_S2POE is implemented
37
37
37
Reserved, RES0.
Otherwise
S2PIE
36
36
0
Select Permission Model. Enables usage of permission indirection in stage 2 Permission model.
This field is RES1 when VTCR_EL2.D128 is set.
0b0
Direct permission model.
0b1
Indirect permission model.
AU
When FEAT_S2PIE is implemented
36
36
36
Reserved, RES0.
Otherwise
TL1
35
35
0
Control bit to check for presence of MMU TopLevel1 permission attribute.
0b0
This bit does not have any effect on stage 2 translations.
0b1
Enables MMU TopLevel1 permission attribute check for TTBR0_EL1 and TTBR1_EL1 translations.
AU
When FEAT_THE is implemented
35
35
35
Reserved, RES0.
Otherwise
AssuredOnly
34
34
0
AssuredOnly attribute enable for VMSAv8-64. Configures use of bit[58] of the stage 2 translation table Block or Page descriptor.
This field is RES0 when VTCR_EL2.D128 is 1.
0b0
Bit[58] of each stage 2 translation Block or Page descriptor does not indicate AssuredOnly attribute.
0b1
Bit[58] of each stage 2 translation Block or Page descriptor indicates AssuredOnly attribute.
AU
When FEAT_THE is implemented
34
34
34
Reserved, RES0.
Otherwise
SL2
33
33
0
Starting level of the stage 2 translation lookup controlled by VTCR_EL2.
If VTCR_EL2.DS == 1, then VTCR_EL2.SL2, in combination with VTCR_EL2.SL0, gives encodings for the stage 2 translation table walk initial lookup level.
If VTCR_EL2.DS == 0, then VTCR_EL2.SL2 is RES0.
If the translation granule size is not 4KB, then this field is RES0.
AU
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
33
33
33
Reserved, RES0.
Otherwise
DS
32
32
0
This field affects:
Whether a 52-bit output address can be described by the translation tables of the 4KB or 16KB translation granules.
The minimum value of VTCR_EL2.T0SZ and VSTCR_EL2.T0SZ.
How and where shareability for Block and Page descriptors are encoded.
This field is RES0 for a 64KB translation granule.
0b0
Bits[49:48] of translation descriptors are RES0.
Bits[9:8] in Block and Page descriptors encode shareability information in the SH[1:0] field. Bits[9:8] in Table descriptors are ignored by hardware.
The minimum value of VTCR_EL2.T0SZ is 16. Any memory access using a smaller value generates a stage 2 level 0 translation table fault.
The minimum value of VSTCR_EL2.T0SZ is 16. Any memory access using a smaller value generates a stage 2 level 0 translation table fault.
Output address[51:48] is 0000.
0b1
Bits[49:48] of translation descriptors hold output address[49:48].
Bits[9:8] in translation descriptors hold output address[51:50].
The shareability information of Block and Page descriptors for cacheable locations is determined by VTCR_EL2.SH0.
The minimum value of VTCR_EL2.T0SZ is 12. Any memory access using a smaller value generates a stage 2 level 0 translation table fault.
The minimum value of VSTCR_EL2.T0SZ is 12. Any memory access using a smaller value generates a stage 2 level 0 translation table fault.
As FEAT_LPA must be implemented if VTCR_EL2.DS == 1, the minimum values of VTCR_EL2.T0SZ and VSTCR_EL2.T0SZ are 12, as determined by that extension.For the TLBI range instructions affecting IPA, the format of the argument is changed so that bits[36:0] hold BaseADDR[52:16]. For the 4KB translation granule, bits[15:12] of BaseADDR are treated as 0000. For the 16KB translation granule, bits[15:14] of BaseADDR are treated as 00.
This forces alignment of the ranges used by the TLBI range instructions.
AU
When FEAT_LPA2 is implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
32
32
32
Reserved, RES0.
Otherwise
31
31
31
Reserved, RES1.
NSA
30
30
0
Non-secure stage 2 translation output address space for the Secure EL1&0 translation regime.
This bit behaves as 1 for all purposes other than reading back the value of the bit when one of the following is true:
The value of VTCR_EL2.NSW is 1.
The value of VSTCR_EL2.SA is 1.
0b0
All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation regime access the Secure PA space.
0b1
All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation regime access the Non-secure PA space.
AU
When FEAT_SEL2 is implemented
30
30
30
Reserved, RES0.
Otherwise
NSW
29
29
0
Non-secure stage 2 translation table address space for the Secure EL1&0 translation regime.
0b0
All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 translation regime are to the Secure PA space.
0b1
All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 translation regime are to the Non-secure PA space.
AU
When FEAT_SEL2 is implemented
29
29
29
Reserved, RES0.
Otherwise
HWU62
28
28
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 2 translation table Block or Page entry.
0b0
Bit[62] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[62] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.
AU
When FEAT_HPDS2 is implemented
28
28
28
Reserved, RES0.
Otherwise
HWU61
27
27
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 2 translation table Block or Page entry.
0b0
Bit[61] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[61] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.
AU
When FEAT_HPDS2 is implemented
27
27
27
Reserved, RES0.
Otherwise
HWU60
26
26
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 2 translation table Block or Page entry.
0b0
Bit[60] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[60] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.
AU
When FEAT_HPDS2 is implemented
26
26
26
Reserved, RES0.
Otherwise
HWU59
25
25
0
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 2 translation table Block or Page entry.
0b0
Bit[59] of each stage 2 translation table Block or Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose.
0b1
Bit[59] of each stage 2 translation table Block or Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose.
AU
When FEAT_HPDS2 is implemented
25
25
25
Reserved, RES0.
Otherwise
24
23
24:23
Reserved, RES0.
HD
22
22
0
Hardware management of dirty state in stage 2 translations when EL2 is enabled in the current Security state.
When the Effective value of VTCR_EL2.HA is 0, this field behaves as 0 for all purposes other than a direct read of the value of this field.
0b0
Stage 2 hardware management of dirty state disabled.
0b1
Stage 2 hardware management of dirty state enabled.
AU
When FEAT_HAFDBS is implemented
22
22
22
Reserved, RES0.
Otherwise
HA
21
21
0
Hardware Access flag update in stage 2 translations when EL2 is enabled in the current Security state.
0b0
Stage 2 Access flag update disabled.
0b1
Stage 2 Access flag update enabled.
AU
When FEAT_HAF is implemented
21
21
21
Reserved, RES0.
Otherwise
20
20
20
Reserved, RES0.
VS
19
19
0
VMID Size.
0b0
8-bit VMID. The upper 8 bits of VTTBR_EL2 are ignored by the hardware, and treated as if they are all zeros, for every purpose except when reading back the register.
0b1
16-bit VMID. The upper 8 bits of VTTBR_EL2 are used for allocation and matching in the TLB.
AU
When FEAT_VMID16 is implemented
19
19
19
Reserved, RES0.
Otherwise
PS
18
16
18:16
Physical address Size for the second stage of translation.
The values 0b110 and 0b111 represent different output address sizes depending on implementation choices and translation configuration.
The following table captures the output address size represented by the value 0b110:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleDS1Represented OA size
Any0b0101AnyAny48 bits, 256TB
VMSAv8-640b011x4KB or 16KB048 bits, 256TB
VMSAv8-640b011x4KB or 16KB152 bits, 4PB
VMSAv8-640b011x64KBN/A52 bits, 4PB
VMSAv9-1280b011xAnyN/A52 bits, 4PB
1 This column represents the value of VTCR_EL2.DS.
The following table captures the output address size represented by the value 0b111:
Descriptor FormatID_AA64MMFR0_EL1.PARangeTranslation GranuleRepresented OA size
Any0b0110AnyOA size represented by0b110
VMSAv8-640b0111AnyOA size represented by0b110
VMSAv9-1280b0111Any56 bits, 64PB
If 52-bit PA is supported, and the translation table descriptors cannot express an OA larger than 48-bits, then bits[51:48] of every translation table base address are treated as 0b0000 for the stage of translation controlled by VTCR_EL2.
If 56-bit PA is supported, and the translation table descriptors cannot express an OA larger than 52-bits, then bits[55:52] of every translation table base address are treated as 0b0000 for the stage of translation controlled by VTCR_EL2.
0b000
32 bits, 4GB.
0b001
36 bits, 64GB.
0b010
40 bits, 1TB.
0b011
42 bits, 4TB.
0b100
44 bits, 16TB.
0b101
48 bits, 256TB.
0b110
52 bits, 4PB.
0b111
56 bits, 64PB.
AU
TG0
15
14
15:14
Granule size for the VTTBR_EL2.
Other values are reserved.
If FEAT_GTG is implemented, ID_AA64MMFR0_EL1.{TGran4_2, TGran16_2, TGran64_2} indicate which granule sizes are supported for stage 2 translation.
If FEAT_GTG is not implemented, ID_AA64MMFR0_EL1.{TGran4, TGran16, TGran64} indicate which granule sizes are supported.
If the value is programmed to either a reserved value or a size that has not been implemented, then the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented for all purposes other than the value read back from this register.
It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value that corresponds to the size chosen.
0b00
4KB.
0b01
64KB.
0b10
16KB.
AU
SH0
13
12
13:12
Shareability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.
Other values are reserved. The effect of programming this field to a Reserved value is that behavior is CONSTRAINED UNPREDICTABLE.
0b00
Non-shareable.
0b10
Outer Shareable.
0b11
Inner Shareable.
AU
ORGN0
11
10
11:10
Outer cacheability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.
0b00
Normal memory, Outer Non-cacheable.
0b01
Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
IRGN0
9
8
9:8
Inner cacheability attribute for memory associated with translation table walks using VTTBR_EL2 or VSTTBR_EL2.
0b00
Normal memory, Inner Non-cacheable.
0b01
Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable.
0b10
Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable.
0b11
Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable.
AU
SL0
7
6
1:0
Starting level of the stage 2 translation lookup, controlled by VTCR_EL2. The meaning of this field depends on the value of VTCR_EL2.TG0.
If this field is programmed to a value that is not consistent with the programming of VTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.
0b00
If VTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 2.
If FEAT_LPA2 is implemented and VTCR_EL2.SL2 is 0, start at level 2.
If FEAT_LPA2 is implemented and VTCR_EL2.SL2 is 1, start at level -1.
If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01
If VTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 1.
If FEAT_LPA2 is implemented and VTCR_EL2.SL2 is 0, start at level 1.
If FEAT_LPA2 is implemented, the combination of VTCR_EL2.SL0 == 01 and VTCR_EL2.SL2 == 1 is reserved.
If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10
If VTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 0.
If FEAT_LPA2 is implemented and VTCR_EL2.SL2 is 0, start at level 0.
If FEAT_LPA2 is implemented, the combination of VTCR_EL2.SL0 == 10 and VTCR_EL2.SL2 == 1 is reserved.
If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.
0b11
If VTCR_EL2.TG0 is 0b00 (4KB granule):
If FEAT_LPA2 is not implemented, start at level 3.
If FEAT_LPA2 is implemented and VTCR_EL2.SL2 is 0, start at level 3.
If FEAT_LPA2 is implemented, the combination of VTCR_EL2.SL0 == 11 and VTCR_EL2.SL2 == 1 is reserved.
If VTCR_EL2.TG0 is 0b10 (16KB granule) and FEAT_LPA2 is implemented, start at level 0.
AU
When FEAT_TTST is implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
SL0
7
6
1:0
Starting level of the stage 2 translation lookup, controlled by VTCR_EL2. The meaning of this field depends on the value of VTCR_EL2.TG0.
All other values are reserved. If this field is programmed to a reserved value, or to a value that is not consistent with the programming of VTCR_EL2.T0SZ, then a stage 2 level 0 Translation fault is generated.
0b00
If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 3.
0b01
If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 2.
0b10
If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 0. If VTCR_EL2.TG0 is 0b10 (16KB granule) or 0b01 (64KB granule), start at level 1.
AU
When FEAT_TTST is not implemented and (FEAT_D128 is not implemented or VTCR_EL2.D128 == '0')
7
6
7:6
Reserved, RES0.
Otherwise
T0SZ
5
0
5:0
The size offset of the memory region addressed by VTTBR_EL2. The region size is 2(64-T0SZ) bytes.
The maximum and minimum possible values for T0SZ depend on the level of translation table and the memory translation granule size, as described in 'The AArch64 Virtual Memory System Architecture'.
If this field is programmed to a value that is not consistent with the programming of SL0, then a stage 2 level 0 Translation fault is generated.
For the 4KB translation granule, if FEAT_LPA2 is implemented, VTCR_EL2.DS is 1, and this field is less than 16, the translation table walk begins with a level -1 initial lookup.For the 16KB translation granule, if FEAT_LPA2 is implemented, VTCR_EL2.DS is 1, and this field is less than 17, the translation table walk begins with a level 0 initial lookup.
AU
Unless stated otherwise, any of the bits in VTCR_EL2 are permitted to be cached in a TLB.
MRS <Xt>, VTCR_EL2
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() IN {'1x1'} then
X{64}(t) = NVMem(0x040);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
X{64}(t) = VTCR_EL2();
elsif PSTATE.EL == EL3 then
X{64}(t) = VTCR_EL2();
end;
MSR VTCR_EL2, <Xt>
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() IN {'1x1'} then
NVMem(0x040) = X{64}(t);
elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
VTCR_EL2() = X{64}(t);
elsif PSTATE.EL == EL3 then
VTCR_EL2() = X{64}(t);
end;
2026-03-26 20:27:25
2026-03_rel