AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# TTBR0_EL1, Translation Table Base Register 0 (EL1)

The TTBR0_EL1 characteristics are:

## Purpose

Holds the base address of the translation table for the initial lookup for stage 1 of the translation of an address from the lower VA range in the EL1&0 translation regime, and other information for this translation regime.

## Configuration

AArch64 System register TTBR0_EL1 bits [63:0] are architecturally mapped to AArch32 System register TTBR0[63:0].

TTBR0_EL1 is a 128-bit register that can also be accessed as a 64-bit value. If it is accessed as a 64-bit register, accesses read and write bits [63:0] and do not modify bits [127:64].

## Attributes

TTBR0_EL1 is a:

- 128-bit register when FEAT_D128 is implemented and TCR2_EL1.D128 == 1
- 64-bit register when FEAT_D128 is not implemented or TCR2_EL1.D128 == 0

## Field descriptions

### When FEAT_D128 is implemented and TCR2_EL1.D128 == 1:

127 | 126 | 125 | 124 | 123 | 122 | 121 | 120 | 119 | 118 | 117 | 116 | 115 | 114 | 113 | 112 | 111 | 110 | 109 | 108 | 107 | 106 | 105 | 104 | 103 | 102 | 101 | 100 | 99 | 98 | 97 | 96
RES0
95 | 94 | 93 | 92 | 91 | 90 | 89 | 88 | 87 | 86 | 85 | 84 | 83 | 82 | 81 | 80 | 79 | 78 | 77 | 76 | 75 | 74 | 73 | 72 | 71 | 70 | 69 | 68 | 67 | 66 | 65 | 64
RES0 | BADDR[50:43] | RES0
63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
ASID | BADDR[42:0]
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
BADDR[42:0] | RES0 | SKL | CnP

#### Bits [127:88]

Reserved, RES0.

#### BADDR, bits [87:80, 47:5]

Translation table base address:

- Bits A[55:x] of the stage 1 translation table base address bits are in register bits[87:80, 47:x].
- Bits A[(x-1):0] of the stage 1 translation table base address are zero.

Address bit x is the minimum address bit required to align the translation table to the size of the table. x is calculated based on LOG2(StartTableSize), as described in VMSAv9-128. The smallest permitted value of x is 5.

The BADDR field is split as follows:

- BADDR[50:43] is TTBR0_EL1[87:80].
- BADDR[42:0] is TTBR0_EL1[47:5].

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### Bits [79:64]

Reserved, RES0.

#### ASID, bits [63:48]

An ASID for the translation table base address. The TCR_EL1.A1 field selects either TTBR0_EL1.ASID or TTBR1_EL1.ASID.

If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RES0.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### Bits [4:3]

Reserved, RES0.

#### SKL, bits [2:1]

Skip Level associated with translation table walks using TTBR0_EL1.

This determines the number of levels to be skipped from the regular start level of the stage 1 EL1&0 translation table walks using TTBR0_EL1.

SKL | Meaning
--- | ---
0b00 | Skip 0 level from the regular start level.
0b01 | Skip 1 level from the regular start level.
0b10 | Skip 2 levels from the regular start level.
0b11 | Skip 3 levels from the regular start level.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### CnP, bit [0]
When FEAT_TTCNP is implemented:

Common not Private. This bit indicates whether each entry that is pointed to by TTBR0_EL1 is a member of a common set that can be used by every PE in the Inner Shareable domain for which the value of TTBR0_EL1.CnP is 1.

CnP | Meaning
--- | ---
0b0 | The translation table entries pointed to by TTBR0_EL1, for the current translation regime and ASID, are permitted to differ from corresponding entries for TTBR0_EL1 for other PEs in the Inner Shareable domain. This is not affected by: The value of TTBR0_EL1.CnP on those other PEs. The value of the current ASID. If EL2 is implemented and enabled in the current Security state, the value of the current VMID.
0b1 | The translation table entries pointed to by TTBR0_EL1 are the same as the translation table entries for every other PE in the Inner Shareable domain for which the value of TTBR0_EL1.CnP is 1 and all of the following apply: The translation table entries are pointed to by TTBR0_EL1. The translation tables relate to the same translation regime. The ASID is the same as the current ASID. If EL2 is implemented and enabled in the current Security state, the value of the current VMID.

This bit is permitted to be cached in a TLB.

When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 and stage 2.

Note

If the value of the TTBR0_EL1.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and those TTBR0_EL1s do not point to the same translation table entries when the other conditions specified for the case when the value of CnP is 1 apply, then the results of translations are CONSTRAINED UNPREDICTABLE, see 'CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values'.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

### When FEAT_D128 is not implemented or TCR2_EL1.D128 == 0:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
ASID | BADDR[47:1]
BADDR[47:1] | CnP

#### ASID, bits [63:48]

An ASID for the translation table base address. The TCR_EL1.A1 field selects either TTBR0_EL1.ASID or TTBR1_EL1.ASID.

If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RES0.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### BADDR[47:1], bits [47:1]

Translation table base address:

- Bits A[47:x] of the stage 1 translation table base address bits are in register bits[47:x].
- Bits A[(x-1):0] of the stage 1 translation table base address are zero.

Address bit x is the minimum address bit required to align the translation table to the size of the table. The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on the value of TCR_EL1.T0SZ, the translation stage, and the translation granule size.

If the value of TCR_EL1.IPS is not 0b110, then:

- Register bits[(x-1):1] are RES0.
- If the implementation supports 52-bit PAs and IPAs, then bits A[51:48] of the stage 1 translation table base address are 0b0000.

The BADDR field represents a 52-bit address if one of the following applies:

- FEAT_LPA is implemented, the 64KB granule size is in use, and the value of TCR_EL1.IPS is 0b110.
- FEAT_LPA2 is implemented, the 4KB or 16KB granule size is in use, and the Effective value of TCR_EL1.DS is 1.
- FEAT_D128 is implemented, 56-bit PAs are supported, the 64KB granule size is in use, and the value of TCR2_EL1.D128 is 0.

When TTBR0_EL1.BADDR represents a 52-bit addresses, all of the following apply:

- Bits A[51:48] of the stage 1 translation table base address bits are in register bits[5:2].
- Register bit[1] is RES0.
- The smallest permitted value of x is 6.
- When x>6, register bits[(x-1):6] are RES0.

Note

If BADDR represents a 52-bit address, and the translation table has fewer than eight entries, the table must be aligned to 64 bytes. Otherwise the translation table must be aligned to the size of the table.

For the 64KB granule, if FEAT_LPA is not implemented, and the value of TCR_EL1.IPS is 0b110, one the following IMPLEMENTATION DEFINED behaviors occur:

- BADDR uses the extended format to represent a 52-bit base address.
- BADDR does not use the extended format.

When the value of ID_AA64MMFR0_EL1.PARange indicates that the implementation supports a 56 bit PA size, bits A[55:52] of the stage 1 translation table base address are zero.

If any register bit[47:1] that is defined as RES0 has the value 1 when a translation table walk is done using TTBR0_EL1, then the translation table base address might be misaligned, with effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following:

- Bits A[(x-1):0] of the stage 1 translation table base address are treated as if all the bits are zero. The value read back from the corresponding register bits is either the value written to the register or zero.
- The result of the calculation of an address for a translation table walk using this register can be corrupted in those bits that are nonzero.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### CnP, bit [0]
When FEAT_TTCNP is implemented:

Common not Private. This bit indicates whether each entry that is pointed to by TTBR0_EL1 is a member of a common set that can be used by every PE in the Inner Shareable domain for which the value of TTBR0_EL1.CnP is 1.

CnP | Meaning
--- | ---
0b0 | The translation table entries pointed to by TTBR0_EL1, for the current translation regime and ASID, are permitted to differ from corresponding entries for TTBR0_EL1 for other PEs in the Inner Shareable domain. This is not affected by: The value of TTBR0_EL1.CnP on those other PEs. The value of the current ASID. If EL2 is implemented and enabled in the current Security state, the value of the current VMID.
0b1 | The translation table entries pointed to by TTBR0_EL1 are the same as the translation table entries for every other PE in the Inner Shareable domain for which the value of TTBR0_EL1.CnP is 1 and all of the following apply: The translation table entries are pointed to by TTBR0_EL1. The translation tables relate to the same translation regime. The ASID is the same as the current ASID. If EL2 is implemented and enabled in the current Security state, the value of the current VMID.

This bit is permitted to be cached in a TLB.

When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 and stage 2.

Note

If the value of the TTBR0_EL1.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and those TTBR0_EL1s do not point to the same translation table entries when the other conditions specified for the case when the value of CnP is 1 apply, then the results of translations are CONSTRAINED UNPREDICTABLE, see 'CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values'.

The reset behavior of this field is:

- On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

## Accessing TTBR0_EL1

When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL3 using the accessor name TTBR0_EL1 or TTBR0_EL12 are not guaranteed to be ordered with respect to accesses using the other accessor name.

Accesses to this register use the following encodings in the System register encoding space:

#### MRS <Xt>, TTBR0_EL1

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.TRVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGRTR_EL2.TTBR0_EL1 == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then X[t, 64] = NVMem[0x200]; else X[t, 64] = TTBR0_EL1<63:0>; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X[t, 64] = TTBR0_EL2<63:0>; else X[t, 64] = TTBR0_EL1<63:0>; elsif PSTATE.EL == EL3 then X[t, 64] = TTBR0_EL1<63:0>;

#### MSR TTBR0_EL1, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.TVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGWTR_EL2.TTBR0_EL1 == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem[0x200] = X[t, 64]; else TTBR0_EL1<63:0> = X[t, 64]; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then TTBR0_EL2<63:0> = X[t, 64]; else TTBR0_EL1<63:0> = X[t, 64]; elsif PSTATE.EL == EL3 then TTBR0_EL1<63:0> = X[t, 64];

#### MRS <Xt>, TTBR0_EL12

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then X[t, 64] = NVMem[0x200]; elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X[t, 64] = TTBR0_EL1<63:0>; else UNDEFINED; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then X[t, 64] = TTBR0_EL1<63:0>; else UNDEFINED;

#### MSR TTBR0_EL12, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then NVMem[0x200] = X[t, 64]; elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then TTBR0_EL1<63:0> = X[t, 64]; else UNDEFINED; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then TTBR0_EL1<63:0> = X[t, 64]; else UNDEFINED;

#### When FEAT_D128 is implemented

#### MRRS <Xt>, <Xt+1>, TTBR0_EL1

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif EL2Enabled() && HCR_EL2.TRVM == '1' then AArch64.SystemAccessTrap(EL2, 0x14); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGRTR_EL2.TTBR0_EL1 == '1' then AArch64.SystemAccessTrap(EL2, 0x14); elsif EL2Enabled() && (!IsHCRXEL2Enabled() || HCRX_EL2.D128En == '0') then AArch64.SystemAccessTrap(EL2, 0x14); elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); elsif EffectiveHCR_EL2_NVx() IN {'111'} then (X[t2, 64], X[t, 64]) = Split(NVMem[0x200, 128], 64); else (X[t2, 64], X[t, 64]) = Split(TTBR0_EL1, 64); elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); elsif ELIsInHost(EL2) then (X[t2, 64], X[t, 64]) = Split(TTBR0_EL2, 64); else (X[t2, 64], X[t, 64]) = Split(TTBR0_EL1, 64); elsif PSTATE.EL == EL3 then (X[t2, 64], X[t, 64]) = Split(TTBR0_EL1, 64);

#### When FEAT_D128 is implemented

#### MSRR TTBR0_EL1, <Xt>, <Xt+1>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif EL2Enabled() && HCR_EL2.TVM == '1' then AArch64.SystemAccessTrap(EL2, 0x14); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3.FGTEn == '1') && HFGWTR_EL2.TTBR0_EL1 == '1' then AArch64.SystemAccessTrap(EL2, 0x14); elsif EL2Enabled() && (!IsHCRXEL2Enabled() || HCRX_EL2.D128En == '0') then AArch64.SystemAccessTrap(EL2, 0x14); elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem[0x200, 128] = X[t2, 64]:X[t, 64]; else TTBR0_EL1<127:0> = X[t2, 64]:X[t, 64]; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); elsif ELIsInHost(EL2) then TTBR0_EL2<127:0> = X[t2, 64]:X[t, 64]; else TTBR0_EL1<127:0> = X[t2, 64]:X[t, 64]; elsif PSTATE.EL == EL3 then TTBR0_EL1<127:0> = X[t2, 64]:X[t, 64];

#### When FEAT_D128 is implemented

#### MRRS <Xt>, <Xt+1>, TTBR0_EL12

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then (X[t2, 64], X[t, 64]) = Split(NVMem[0x200, 128], 64); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x14); else UNDEFINED; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); else (X[t2, 64], X[t, 64]) = Split(TTBR0_EL1, 64); else UNDEFINED; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then (X[t2, 64], X[t, 64]) = Split(TTBR0_EL1, 64); else UNDEFINED;

#### When FEAT_D128 is implemented

#### MSRR TTBR0_EL12, <Xt>, <Xt+1>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0010 | 0b0000 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then NVMem[0x200, 128] = X[t2, 64]:X[t, 64]; elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x14); else UNDEFINED; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then if HaveEL(EL3) && EL3SDDUndefPriority() && SCR_EL3.D128En == '0' then UNDEFINED; elsif HaveEL(EL3) && SCR_EL3.D128En == '0' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x14); else TTBR0_EL1<127:0> = X[t2, 64]:X[t, 64]; else UNDEFINED; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then TTBR0_EL1<127:0> = X[t2, 64]:X[t, 64]; else UNDEFINED;

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

26/03/2024 09:49; 67c0ae5282a7629ba0ea0ba7267b43cd4f7939f6

Copyright © 2010-2024 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.