questions about vttbr_el2


In the ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile, there's a description about vttbr_el2: " Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address" . I am a little confused, as far as I know , the vttbr_el2 register hold the stage 2 page table base address, so what's the meaning of " stage 1 translation table base address"? 

Also, I tired to open the 2 stage paging in my system. I setup the 2 stage page table at  physical address(0x20000000), and set the vttbr_el2 to this value.However, I got a Data Abort (code: 000101) which means a level 1 translation fault in stage 2 translation mywegmansconnect. So what's the correct usage of  vttbr_el2? 

I am using cortex-a53 and here's the related register value I set:

HCR: 0x80000001

VTCR_EL2: 0x80023558

VTTBR_EL2: 0x20000000

  • Armv8-A can support up to two levels Memory Address Translation stages. Armv8-A CPUs can be configured to enable stage-1 MMU translation only, or stage-2 MMU translation only or both stage-1 and stage-2 MMU translation.

    Usually, the host OS such as Linux uses the stage-1 MMU translation, which translates the Virtual Address (VA) into Physical Address (PA). However, if the Linux OS is running as Virtual Machine as Guest OS, its VA is mapped to Intermediate Physical Address (IPA). This is called stage-1 MMU translation.  Later, the hypervisor software running in EL2 will map the IPA into the PA. This is called stage-2 MMU translation.

    In Arm.ARM, the original text is as below:


    If the Effective value of VTCR_EL2.PS is not 0b110 then:
    • Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address.
    • Register bits[(x-1):1] are RES0.
    • If the implementation supports 52-bit PAs and IPAs then bits[51:48] of the translation table
    base addresses used in this stage of translation are 0b0000.


    VTCR_EL2.PS != 0b110 means it is not 52-bit PA so that it is 48-bit PA.

More questions in this forum