5 Data structure formats

Chapter 5 Data structure formats All SMMU configuration data structures, that is Stream Table Entries and Context Descriptors, are little-endian. Translation table data might be configured for access in either endianness on some implementations, see CD.ENDI, STE.S2ENDI and SMMU_IDR0.TTENDIAN. All non-specified fields are RES0, Reserved, and software must set them to zero. An implementation either: • Detects non-zero values in non-specified fields and considers the structure invalid. • Ignores the Reserved field entirely. All specified fields are required to be checked against the defined structure validity rules in each of the STE and CD sections. A configuration or programming error or invalid use of any of the fields in these structures might cause the whole structure to be deemed invalid, where specified. Any transaction from a device that causes the use of an invalid structure will report an abort back to the device and will log an error event, the nature of which is specific to the nature of the misconfiguration. A structure is used when it is indicated by an STE (or in the case of an STE itself, when an incoming transaction selects it from the Stream table, by StreamID). The memory attribute set by SMMU_(*)CR1.TABLE{SH,OC,IC} is used when fetching the following structures: • Level 1 Stream Table Descriptor. • Stream Table Entry. • Virtual Machine Structure. The attribute set by STE.{S1CIR,S1COR,S1CSH} is used when fetching a Level 1 Context Descriptor and Context Descriptor. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 246

Chapter 5. Data structure formats See section 3.21.3 Configuration structures and configuration invalidation completion for information on structure access, caching and invalidation rules. See section 16.2 Caching for implementation notes on caching and interactions between structures. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 247

Chapter 5. Data structure formats 5.1. L1STD, Level 1 Stream Table Descriptor 5.1 L1STD, Level 1 Stream Table Descriptor The L1STD characteristics are: Purpose Configures the base address and size of a second level Stream table for a range of StreamIDs. Attributes L1STD is a 8-byte structure. Field descriptions RES0 63 56 L2Ptr 55 32 L2Ptr 31 6 5 Span 4 0 RES0 Span, bits [4:0] Size of Level 2 array and validity of L1STD.L2Ptr. Span Meaning 0 L1STD.L2Ptr is invalid. The StreamIDs matching this descriptor are all invalid. 1-11 Level 2 array contains 2(Span-1) STEs (1). 12-31 Reserved, behaves as 0. (1) Span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), that is it must stay within the bounds of the Stream table split point. Bit [5] Reserved, RES0. L2Ptr, bits [55:6] Pointer to the start of the Level-2 array. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits L2Ptr[N:0] are treated as 0 by the SMMU, where N == 5 + (Span - 1). Note: The Level 2 array is therefore aligned to its size by the SMMU. See section 3.4.3 Address sizes of SMMU-originated accesses for behavior of addresses beyond the OAS or physical address range. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 248

Chapter 5. Data structure formats 5.1. L1STD, Level 1 Stream Table Descriptor Bits [63:56] Reserved, RES0. 5.1.1 General properties of the L1STD Incoming StreamIDs that select a descriptor with Span == 0, or a Span set to a Reserved value, or a Span set to an out of bounds value given the split point, or those that select a valid Level 1 descriptor but are outside of the level 2 range described by Span, are deemed invalid. A transaction causing a Stream table lookup that does not reach a valid STE is terminated with an abort to the client device and optionally records an event, see SMMU_(*_)CR2.RECINVSID and C_BAD_STREAMID. When an L1STD is changed, the non-leaf form of CMD_CFGI_STE is the minimum scope of invalidation command required to invalidate SMMU caches of the L1STD entry. Depending on the change, other STE invalidations might be required, for example: • Changing an inactive L1STD with Span == 0 to a non-zero active Span (introducing a new section of level-2 Stream table) requires an invalidation of the L1STD only. As no STEs were reachable for StreamIDs within the span, none require invalidation. • Changing an active L1STD with Span != 0 to an inactive L1STD (decommissioning a span of Stream table) requires an invalidation of the L1STD as well as invalidation of cached STEs from the affected span. Either multiple non-leaf CMD_CFGI_STE commands, or a wider scope such as CMD_CFGI_STE_RANGE or CMD_CFGI_ALL is required. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 249

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry 5.2 STE, Stream Table Entry The STE characteristics are: Purpose Configuration structure for each stream, including: • Whether traffic from the device is permitted. • Whether it is subject to stage 1 translation. • Whether it is subject to stage 2 translation, and the relevant translation tables. • Which data structures locate translation tables for stage 1. Attributes STE is a 64-byte structure. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 250

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Field descriptions S2POI15 511 508 S2POI14 507 504 S2POI13 503 500 S2POI12 499 496 S2POI11 495 492 S2POI10 491 488 S2POI9 487 484 S2POI8 483 480 S2POI7 479 476 S2POI6 475 472 S2POI5 471 468 S2POI4 467 464 S2POI3 463 460 S2POI2 459 456 S2POI1 455 452 S2POI0 451 448 447 446 445 RES0 444 440 S_S2TTB 439 416 RES0 S_S2SKL S_S2TTB 415 388 387 386 385 384 RES0 S_S2SL0_2 S2SW S2SA RES0 383 376 VMSPtr 375 352 VMSPtr 351 332 TL1 331 TL0 330 329 328 PMG 327 320 AssuredOnly MPAM_NS MECID 319 304 S_S2TG 303 302 RES0 301 297 296 295 294 S_S2T0SZ 293 288 S2HDBSS S_S2SL0 PARTID 287 272 IMPLEMENTATION DEFINED 271 256 255 S2SKL 254 253 RES0 252 248 S2TTB 247 224 RES0 S2TTB 223 196 195 194 193 192 S2DS S2SL0_2 S2NSW S2NSA 191 190 189 188 187 S2R 186 S2S 185 184 183 182 181 180 179 S2PS 178 176 S2TG 175 174 S2SH0 173 172 S2OR0 171 170 S2IR0 169 168 S2SL0 167 166 S2T0SZ 165 160 DPT_VMATC H S2POE S2PIE S2HAFT S2HA S2AA64 S2ENDI S2AFFD S2PTW S2HD IMPLEMENTATION DEFINED 159 144 S2VMID 143 128 IMPLEMENTATION DEFINED 127 116 115 114 113 112 NSCFG 111 110 SHCFG 109 108 RES0 107 105 ALLOCCFG 104 101 100 MemAttr 99 96 INSTCFG PRIVCFG MTCFG STRW 95 94 EATS 93 92 91 90 89 88 SW_RESERVED 87 84 MEV 83 82 DCP 81 CONT 80 77 DRE 76 75 74 73 72 S1CSH 71 70 S1COR 69 68 S1CIR 67 66 S1DSS 65 64 S1STALLD S1MPAM S1PIE S2FWB PPAR S2HWU62 S2HWU61 S2HWU59 S2HWU60 S1CDMax 63 59 RES0 58 56 S1ContextPtr 55 32 S1ContextPtr 31 6 S1Fmt 5 4 Config 3 1 V 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 251

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry STE fields follow the convention of an S1 prefix for fields related to stage 1 translation, an S2 prefix for fields relating to stage 2 translation, and neither for fields unrelated to a specific translation stage. In a valid STE, that is where STE.V == 1: • All fields with an S2 prefix (with the exception of S2VMID) are IGNORED when stage 2 bypasses translation STE.Config == 0b10x. • All fields with an S1 prefix are IGNORED when stage 1 bypasses translation (STE.Config == 0b1x0). The validity conditions in field descriptions are written with the assumption that the field is not IGNORED because of a disabled stage of translation. Note: Additionally, the validity check of STE.EATS might assert that STE.S2S == 0 even if stage 2 is in bypass. That is STE.S2S is not IGNORED. All undefined fields, and some defined fields where explicitly noted, are permitted to take RAZ/WI behavior in an Embedded Implementation (EI) providing internal storage for Stream Table Entries, see section 3.16 Embedded Implementations. Permitted differences for such an embedded implementation that does not store STEs in regular memory are marked EI in this section. Note: This allows such implementations to avoid storing bits that do not affect the SMMU behavior. Invalid or contradictory configurations are marked ILLEGAL in field descriptions. Use of an ILLEGAL STE behaves as described for STE.V == 0. V, bit [0] STE Valid. V Meaning 0b0 Structure contents are invalid. Other STE fields are IGNORED. 0b1 Structure contents are valid. Other STE fields behave as described. Care must be taken when updating an STE when this field is 1 as updates might race against SMMU fetching the structure, see section 3.21 Structure access rules and update procedures. Device transactions that select an STE with this field configured to 0 are terminated with an abort reported back to the device and a C_BAD_STE event is recorded. ATS Translation Requests that select an STE with this field configured to 0 are immediately completed with CA status. No event is recorded. If SMMU_CR0.ATSCHK == 1, ATS Translated transactions are checked against STE configuration. Those selecting an invalid STE (with ILLEGAL configuration, or this field configured to 0) are terminated with an abort reported back to the device. No event is recorded. See 3.9 Support for PCI Express, PASIDs, PRI, and ATS for more information on ATS-related transactions. Config, bits [3:1] Stream configuration. Value Traffic can pass? Stage 1 Stage 2 Notes 0b000 No – – Report abort to device, no event recorded. 0b0xx No – – Reserved (behaves as 0b000) 0b100 Yes Bypass Bypass STE.EATS value effectively 0b00 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 252

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Value Traffic can pass? Stage 1 Stage 2 Notes 0b101 Yes Translate Bypass S1 valid 0b110 Yes Bypass Translate S2 valid 0b111 Yes Translate Translate S1 and S2 valid. If stage 1 is not implemented (SMMU_IDR0.S1P == 0), it is ILLEGAL to set STE.Config == 0b1x1. If stage 2 is not implemented (SMMU_IDR0.S2P == 0), it is ILLEGAL to set STE.Config == 0b11x. If stage 2 is implemented, and Secure stage 2 is not supported (SMMU_S_IDR1.SEL2 == 0), and the STE is reached from the Secure Stream table, it is ILLEGAL to set STE.Config == 0b11x. It is ILLEGAL to configure a Secure STE with STE.Config == 0b11x, and STE.S2AA64 selects VMSAv8-32 LPAE. Note: When stage 1 is configured to translate, see the descriptions for STE.S1DSS and STE.S1Fmt for substream configuration. In an EI, STE.Config[0] is permitted to be RAZ/WI if stage 1 is not implemented and STE.Config[1] is permitted to be RAZ/WI if stage 2 is not implemented. When no translation stages are enabled (0b100), ATS Translation Requests (and Translated traffic, if SMMU_CR0.ATSCHK == 1) are denied as though STE.EATS == 0b00; the actual value of the STE.EATS field is IGNORED. Such a Translation Request causes F_BAD_ATS_TREQ and Translated traffic causes F_TRANSL_FORBIDDEN. When STE.Config == 0b000, an ATS Translation Request is denied with UR status and no event is recorded. When STE.Config == 0b000 and SMMU_CR0.ATSCHK == 1, ATS Translated transactions are terminated with an abort and no event is recorded. S1Fmt, bits [5:4] Stage 1 Format. If STE.S1CDMax == 0 (substreams disabled) or SMMU_IDR1.SSIDSIZE == 0 (substreams unsupported), this field is IGNORED and STE.S1ContextPtr points to one CD. Otherwise STE.S1ContextPtr points to: S1Fmt Meaning 0b00 Two or more Context descriptors in a linear table indexed by SubstreamID[STE.S1CDMax - 1:0]. The table is aligned to its size. S1ContextPtr[STE.S1CDMax + 5:6] are RES0. 0b01 2-level table with 4KB L2 leaf tables. L1 table contains 1-16384 L1CD pointers (128KB maximum) to 4KB tables of 64 CDs. If STE.S1CDMax <= 6, only index #0 of the L1 table is used. Otherwise, the L1 table is indexed by SubstreamID[STE.S1CDMax - 1:6]. The L2 table is indexed by SubstreamID[5:0]. L2 tables are 4KB-aligned: L1CD.L2Ptr[11:0] are taken to be zero by the SMMU. L1 tables are aligned to their size, or 64 bytes, whichever is greater. If STE.S1CDMax > 9, S1ContextPtr[STE.S1CDMax - 4:6] are RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 253

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S1Fmt Meaning 0b10 2-level table with 64KB L2 leaf tables. L1 table contains 1-1024 L1CD pointers (8KB maximum) to 64KB tables of 1024 CDs. If STE.S1CDMax<=10, only index #0 of the L1 table is used. Otherwise, the L1 table is indexed by SubstreamID[STE.S1CDMax - 1:10]. The L2 table is indexed by SubstreamID[9:0]. L2 tables are 64KB-aligned: L1CD.L2Ptr[15:12] are RES0 and L1CD.L2Ptr[11:0] are taken to be zero by the SMMU. L1 tables are aligned to their size, or 64 bytes, whichever is greater. If STE.S1CDMax > 13, S1ContextPtr[STE.S1CDMax - 8:6] are RES0. 0b11 Reserved (behaves as 0b00) Bits of STE.S1ContextPtr that are RES0 because of the configuration of STE.S1CDMax must be programmed to zero by software. If they are not programmed to zero, it is CONSTRAINED UNPREDICTABLE which of the following behaviors applies: • The SMMU treats the bits as zero. • If this field is 0b00, the SMMU fetches any CD in the table. • If this field is 0b01 or 0b10, the SMMU fetches any L1CD in the level 1 CD table. When multiple substreams are supported and enabled, the supported range is 2-1024K substreams in all table layouts. If STE.Config == 0b1x0 (stage 1 disabled), this field is IGNORED and the supply of a SubstreamID with a transaction causes the transaction to be terminated with an abort, recording C_BAD_SUBSTREAMID. This is the case for full stream bypass (STE.Config == 0b100), or stage 2-only translation (STE.Config == 0b110). If STE.S1CDMax == 0 (substreams disabled) or SMMU_IDR1.SSIDSIZE == 0 (substreams unsupported), this field is IGNORED and STE.S1ContextPtr points to one CD. If substreams are supported and enabled and stage 1 is enabled and SMMU_IDR0.CD2L == 0, it is ILLEGAL to set this field != 0b00 (as two-stage tables are not supported). In an EI, this field is permitted to be RAZ/WI if stage 1 is not implemented or substreams are unsupported or SMMU_IDR0.CD2L == 0. Note: If stage 2 is configured, STE.S1ContextPtr is an IPA. If this field indicates a 2-level table, the pointers in the first-level table are also IPAs. Otherwise, the pointers are PAs. Note: If this field is 0b00, it can be used for a single CD, or to support multiple CDs for substreams. A 4KB page will hold 64 CDs, and a 64KB page will hold 1024 CDs. Note: Arm expects that the effective number of CDs in simultaneous use is practically limited to the number of distinct address spaces which is limited by the number of ASIDs. If this field is 0b01, 64KB CDs can be accommodated with an 8KB L1 table and multiple 4KB L2 tables. S1ContextPtr, bits [55:6] Pointer to the Stage 1 Context descriptor. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Bits above and below the range of the field are implied as zero in CD address calculations. If STE.Config == 0b1x0 (stage 1 disabled), this field is IGNORED. In an EI, this field is permitted to be RAZ/WI if stage 1 is not implemented. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 254

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry If STE.Config == 0b11x (stage 2 enabled), this pointer is an IPA translated by stage 2 and the programmed value must be within the range of the IAS. Otherwise, this pointer is a PA, is not translated, and must be within the range of the OAS. See 3.4.3 Address sizes of SMMU-originated accesses for allowed behavior of an out-of-range value in this field. In a Realm STE: • If stage 1 and stage 2 translation are enabled, this field is treated as a Realm IPA. • If stage 1 translation is enabled and stage 2 translation is disabled, this field is treated as a Realm physical address. Bits [58:56] Reserved, RES0. S1CDMax, bits [63:59] Log2 of the number of CDs pointed to by STE.S1ContextPtr. The number of CDs pointed to by STE.S1ContextPtr is 2STE.S1CDMax. If SMMU_IDR1.SSIDSIZE == 0, this field is IGNORED. A transaction is not permitted to supply a SubstreamID. If a transaction does so, it will be terminated and a C_BAD_SUBSTREAMID event recorded. In an EI, this field is permitted to be RAZ/WI if stage 1 is not implemented or if SMMU_IDR1.SSIDSIZE == 0. If STE.Config == 0b1x0 (stage 1 disabled), this field is IGNORED. If this field is 0, then all of the following apply: • STE.S1ContextPtr points at one CD. • Substreams are disabled. • Any transaction using this STE that is presented with SSV=1 is terminated with an abort, and a C_BAD_SUBSTREAMID event is generated. If this field is greater than 0, all of the following apply: • STE.S1ContextPtr points at more than one CD. • Transactions with SSV=1 and a SubstreamID that is less than 2STE.S1CDMax use the CD for that SubstreamID. • Transactions with SSV=1 and a SubstreamID that is greater than or equal to 2STE.S1CDMax are terminated with an abort, and a C_BAD_SUBSTREAMID event is generated. The allowable range is 0 to SMMU_IDR1.SSIDSIZE inclusive. Other values are ILLEGAL. The behavior of a transaction without a SubstreamID when STE.S1CDMax > 0 is governed by the STE.S1DSS field. S1DSS, bits [65:64] Default Substream. When substreams are enabled (STE.S1CDMax != 0), this field determines the behavior of a transaction or translation request that arrives without an associated substream: S1DSS Meaning 0b00 Terminate. An abort is reported to the device and the F_STREAM_DISABLED event is recorded. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 255

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S1DSS Meaning 0b01 Bypass stage 1 as though STE.Config == 0b1x0 The transaction can cause a stage 1 Address Size fault if the input address size exceeds the IAS, see section 3.4 Address sizes for details. If the configuration enables stage 2 translation, the address is then translated as an IPA if a stage 1 Address Size fault did not occur. Note: This behavior is identical to a transaction through an STE with STE.Config == 0b1x0. Note: Such a transaction does not fetch a CD, and therefore does not report F_CD_FETCH, C_BAD_CD or a stage 2 Translation-related fault with CLASS == CD. 0b10 Transactions that do not include a substream are translated using the CD associated with Substream 0, which becomes unavailable for use by transactions that include a substream. Transactions that include a substream and select Substream 0 are terminated. An abort is reported to the device and the F_STREAM_DISABLED event is recorded. System software must associate traffic with non-zero substreams because Substream 0 is not available for use. 0b11 Reserved (behaves as 0b00) If STE.Config == 0b1x0 (stage 1 disabled) or STE.S1CDMax == 0 (substreams disabled) or SMMU_IDR1.SSIDSIZE == 0 (substreams unsupported), this field is IGNORED. In an EI, this field is permitted to be RAZ/WI if stage 1 is not implemented or if SMMU_IDR1.SSIDSIZE == 0. Note: PCIe traffic might include a PASID TLP prefix, or might be issued without it. Consequently, it is possible for some transactions to supply a substream while others from the same endpoint do not. Note: This field affects ATS Translation Requests, which can be caused to skip stages of translation as described in section 13.6.3 Split-stage (STE.EATS == 0b10) ATS behavior and responses and 13.6.4 Full ATS skipping stage 1. See section 3.9.2 Changing ATS configuration for information on changing configuration that affects ATS translations that could be cached in an Endpoint. For ATS Translation Requests, if the cases described in 0b00 and 0b10 lead to termination, the Translation Request is terminated with a CA and no event is recorded. S1CIR, bits [67:66] STE.S1ContextPtr memory Inner Region attribute. S1CIR Meaning 0b00 Normal, non-cacheable 0b01 Normal, Write-Back cacheable, Read-Allocate 0b10 Normal, Write-Through cacheable, Read-Allocate 0b11 Normal, Write-Back cacheable, no Read-Allocate Note: Read allocation is a hint in the same way as in the A-profile architecture, and it is IMPLEMENTATION DEFINED whether it has any effect. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 256

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: Because CDs are read-only there is no configuration for cache allocation on write. The value of the write-allocation hint provided for a CD read is IMPLEMENTATION DEFINED. This field, STE.S1COR and STE.S1CSH set the memory access attributes that access the Context descriptor (and Level-1 CD table pointers, if relevant) through STE.S1ContextPtr. If STE.Config == 0b11x (stage 2 enabled), the CD is loaded from IPA space and the attributes are combined with those from the stage 2 translation descriptor of the page mapping the accessed IPA, otherwise, these attributes are used directly. In an EI, this field, STE.S1COR and STE.S1CSH are permitted to be RAZ/WI if stage 1 is not implemented. S1COR, bits [69:68] STE.S1ContextPtr memory Outer Region attribute. S1COR Meaning 0b00 Normal, Non-cacheable 0b01 Normal, Write-Back cacheable, Read-Allocate 0b10 Normal, Write-Through cacheable, Read-Allocate 0b11 Normal, Write-Back cacheable, no Read-Allocate S1CSH, bits [71:70] STE.S1ContextPtr memory Shareability attribute. S1CSH Meaning 0b00 Non-shareable 0b01 Reserved (behaves as 0b00) 0b10 Outer Shareable 0b11 Inner Shareable Note: If both STE.S1CIR and STE.S1COR == 0b00, selecting normal Non-cacheable access, the Shareability of access to CDs is taken to be Outer Shareable regardless of the value of this field. S2HWU59, bit [72] If SMMU_IDR3.PBHA == 1, this field controls the interpretation of bit [59] of the stage 2 translation table final-level (page or block) descriptor. S2HWU59 Meaning 0b0 Bit [59] is not interpreted by hardware for an IMPLEMENTATION DEFINED purpose. 0b1 Bit [59] has IMPLEMENTATION DEFINED hardware use. This field is IGNORED if PBHA are not supported (SMMU_IDR3.PBHA == 0). If STE.S2AA64 selects VMSAv9-128, this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 257

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry In SMMUv3.0 this field is RES0. Note: Stage 2 translations do not have the Hierarchical Attribute Disable (HAD) control present for stage 1 and the stage 2 HWU bits therefore do not have a relation to HAD in the same way as for stage 1. S2HWU60, bit [73] Similar to STE.S2HWU59, but affecting descriptor bit [60]. S2HWU61, bit [74] Similar to STE.S2HWU59, but affecting descriptor bit [61]. S2HWU62, bit [75] Similar to STE.S2HWU59, but affecting descriptor bit [62]. DRE, bit [76] Destructive Read Enable. Some implementations might support transactions with data-destructive effects which intentionally cause cache lines to be invalidated, without writeback even if they are dirty, such as destructive reads or cache invalidation operations, see section 3.22 Destructive reads and directed cache prefetch transactions. Note: The invalidation side-effect is not required for correctness of this class of transaction, but if performed might cause stale data to be made visible. DRE Meaning 0b0 A device request to consume data using a read and invalidate transaction is transformed to a read without a data-destructive side-effect. An Invalidate Cache Maintenance Operation is transformed to a CleanInvalidate operation. 0b1 A device request to consume data using a read and invalidate transaction is permitted to destructively read the requested location. An Invalidate Cache Maintenance Operation is permitted without transformation. Both of these behaviors are dependent on the correct page permissions as described in sections 3.22.2 Permissions model and 16.7.2.2 Permissions model for Cache Maintenance Operations. This field is IGNORED on implementations that do not support this class of transactions. Otherwise, this field is applied for the following transactions: • Transactions that go through at least one stage of translation (if STE.S1DSS configuration or STE.Config == 0b100 causes all stages to be bypassed, a read and invalidate or Invalidate Cache Maintenance Operation is permitted regardless of the value of this field). This includes ATS Translated transactions where Split-stage ATS is enabled. • ATS Translated transactions if SMMU_CR0.ATSCHK == 1 and one of the following conditions is met: – STE.EATS selects Full ATS and SMMU_IDR3.DPT == 1. If SMMU_IDR3.DPT == 0 then it is IMPLEMENTATION DEFINED whether this bit is applied. – STE.EATS selects Full ATS with DPT checks. If SMMU_IDR3.MTCOMB is 1 and a transaction is Forced-WB, then the effective value of this field is 0. In SMMUv3.0 this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 258

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry CONT, bits [80:77] Contiguous Hint. This field provides a hint to SMMU caching structures that a fetched STE is identical to its neighbors within a particular span of StreamIDs, and that a cache of the STE might be matched for any future lookup of StreamID for translation purposes within this span. The field is a 4-bit unsigned value specifying the span size. This field does not affect configuration invalidation. Software must ensure every STE in the required range is targeted by appropriate CMD_CFGI_* commands, regardless of the value of the field. When CONT == 0, the STE is an individual STE bordered by STEs not considered identical. Otherwise, the span is defined as a contiguous block of 2CONT STEs starting at a StreamID for which StreamID[CONT-1:0]=0. All defined fields, except for CONT, in all STEs within the stated span must be identical, otherwise the result of an STE lookup has one of the following CONSTRAINED UNPREDICTABLE behaviors: • The requested STE is used as it is represented in the Stream table. • A neighboring STE within the CONT span is used. • An F_CFG_CONFLICT event is reported and the transaction or translation request that led to the STE lookup is aborted. Note: During the process of marking STEs as members of a contiguous span (or taking away such hints), the STEs might differ by their CONT field values. Note: Arm expects that the CONT value is changed in valid STEs and that the STEs in the span are not made invalid before changing CONT. This ensures that the STEs in the span remain identical. A span greater than the size of the Stream table is capped by the SMMU by the size of the Stream table, and does not allow StreamIDs beyond the Stream table span to match an STE. For a given valid STE in a 2-level Stream table, if STE.CONT is configured to a range greater than the number of entries in the level 2 array that locates that STE, use of StreamIDs within the range of that STE.CONT is CONSTRAINED UNPREDICTABLE. Either one of these behaviors is permitted: • The transaction is terminated and a C_BAD_STREAMID error is raised, if the StreamID is outside of the range represented by the Span of the corresponding L1STD. Note: This is the expected behavior when using a StreamID outside of an L1STD.Span range. • The transaction uses any STE from the same Security state as the stream. In an EI, this field is permitted to be RAZ/WI. DCP, bit [81] Directed Cache Prefetch. Some implementations might support directed cache prefetch hint operations which are a standalone hint transaction, or a read/write transaction with hint side-effect, that changes the cache allocation in a part of the cache hierarchy that is not on the direct path to memory. This class of operation does not include those with data-destructive side-effects, see section 3.22 Destructive reads and directed cache prefetch transactions. DCP Meaning 0b0 Directed cache prefetch operations are inhibited. A transaction input with hint side-effect is stripped of the hint. A standalone hint operation completes successfully having no effect on the system. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 259

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry DCP Meaning 0b1 A directed cache prefetch operation is permitted as follows: • A transaction with hint side-effect is performed if the final translation permissions permit the transaction. – Note: This permits a write with side-effect to progress if permissions grant write access, otherwise a Permission fault occurs. • A standalone hint operation is performed if the final permissions grant either read or write or execute permission for the requested address, otherwise the hint completes successfully having no effect on the system. This field is IGNORED on implementations that do not support this class of transactions. Otherwise, this field is applied for the following transactions: • Transactions that go through at least one stage of translation (if STE.S1DSS configuration or STE.Config == 0b100 causes all stages to be bypassed, a directed cache prefetch is permitted regardless of the value of this field). This includes ATS Translated transactions where Split-stage ATS is enabled. • ATS Translated transactions if SMMU_CR0.ATSCHK == 1 and one of the following conditions is met: – STE.EATS selects Full ATS and SMMU_IDR3.DPT == 1. If SMMU_IDR3.DPT == 0 then it is IMPLEMENTATION DEFINED whether this bit is applied. – STE.EATS selects Full ATS with DPT checks. In SMMUv3.0 this field is RES0. PPAR, bit [82] PRI Page request Auto Responses. PPAR Meaning 0b0 Auto-generated responses on PRI queue overflow do not include a PASID TLP prefix. 0b1 Auto-generated responses on PRI queue overflow include a PASID TLP prefix if permitted. See sections 8.1 PRI queue overflow and 8.2 Miscellaneous for the conditions that permit a PASID TLP prefix to be used on an auto-generated response. If SMMU_IDR0.PRI == 0 or SMMU_IDR1.SSIDSIZE == 0, this field is RES0. If SMMU_IDR3.PPS == 1, this field is IGNORED and the behavior of an auto-generated response is the same as described for PPAR == 1. MEV, bit [83] Merge Events arising from terminated transactions from this stream. MEV Meaning 0b0 Do not merge similar fault records 0b1 Permit similar fault records to be merged ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 260

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry The SMMU might be able to reduce the usage of the Event queue by coalescing fault records that share the same page granule of address, access type and SubstreamID. Setting MEV == 1 does not guarantee that faults will be coalesced. Setting MEV == 0 causes a physical SMMU to prevent coalescing of fault records, however, a hypervisor might not honour this setting if it deems a guest to be too verbose. Note: Software must expect, and be able to deal with, coalesced fault records even when MEV == 0. In an EI, this field is permitted to be RAZ/WI if the implementation does not merge events. See section 7.3.1 Event record merging for details on event merging. SW_RESERVED, bits [87:84] Reserved for software use. This field is IGNORED by the SMMU. In an EI, storage must be provided for this field. S1PIE, bit [88] Stage 1 permission indirection enable. S1PIE Meaning 0b0 CDs fetched via this STE cannot enable stage 1 permission indirection. 0b1 CDs fetched via this STE can enable stage 1 permission indirection. If SMMU_IDR3.S1PI == 0 this field is RES0. S2FWB, bit [89] Stage 2 control of attributes. S2FWB Meaning 0b0 Attribute calculation behaves as described in Chapter 13 Attribute Transformation. 0b1 Output attribute calculation and the behavior of the stage 2 page or block descriptor bits [4:2] are affected as described in the VMSA in the A-profile architecture[2] for HCR_EL2.FWB == 1. Note: The VMSA FWB behavior allows the stage 2 memory type to be output directly instead of being combined with that of the stage 1 translation, redefining bit [4] of a stage 2 page or block descriptor to do so. This field applies when both stage 1 and stage 2 translation is performed or when stage 2-only translation is performed. This field is IGNORED when stage 2 translation is not performed. Otherwise, when stage 2 translation is performed, it is ILLEGAL to set this field to 1 when STE.S2AA64 selects VMSAv8-32 LPAE. If SMMU_IDR3.MTEPERM == 1, the effects of this field on the interpretation of memory attributes change. See 3.23 Memory Tagging Extension. Prior to SMMUv3.2 this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 261

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S1MPAM, bit [90] Enable stage 1 control of MPAM. S1MPAM Meaning 0b0 The PARTID and PMG for transactions and SMMU-originated requests relating to this stream are assigned by STE.PARTID and STE.PMG. 0b1 The PARTID and PMG for transactions are assigned by the CD.PARTID and CD.PMG fields, which might be translated using the PARTID_MAP. See section 17.2 Assignment of PARTID and PMG for client transactions. Prior to SMMUv3.2, and if MPAM is not supported in the corresponding Security state, this field is RES0. Otherwise, when MPAM is supported in the corresponding Security state then: • When stage 1 translation is performed, this field controls whether the MPAM IDs are given by the CD or the STE. This applies to stage 1-only and nested configurations. In a nested configuration that has this field configured to 1, CD.PARTID is translated using VMS.PARTID_MAP as described in section 17.2 Assignment of PARTID and PMG for client transactions. • When stage 1 translation is not performed, this field is IGNORED and the STE.PARTID and STE.PMG fields are used. – This applies to STE.Config == 0b1x0 and to scenarios where STE.S1DSS causes stage 1 to bypass. S1STALLD, bit [91] Stage 1 Stall Disable. S1STALLD Meaning 0b0 Allow stalling fault model for stage 1 (configured in CD) 0b1 Disallow stalls to be configured for Stage 1 (faults terminate immediately) If stage 1 is not implemented (SMMU_IDR0.S1P == 0), this field is RES0. If stage 1 is not enabled (STE.Config == 0b1x0), this field is IGNORED. Otherwise, if stage 1 is enabled and SMMU_(*_)IDR0.STALL_MODEL is not 0b00, it is ILLEGAL to set this field to 1 because the Stall model is not supported or not configurable. When the Stall model is configurable, this field must be set for StreamIDs associated with stall-unsafe system topologies or for PCIe clients. EATS, bits [93:92] Enable PCIe ATS translation and traffic. This field enables responses to ATS Translation Requests, and if SMMU_CR0.ATSCHK == 1, controls whether ATS Translated traffic can pass into the system. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 262

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry EATS Meaning 0b00 ATS Translation Requests are returned unsuccessful or aborted (UR) and F_BAD_ATS_TREQ is recorded. Additionally, if SMMU_CR0.ATSCHK == 1, Translated traffic associated with the StreamID of the STE is prevented from bypassing the SMMU. Such traffic is terminated with an abort and a F_TRANSL_FORBIDDEN event is recorded. 0b01 Full ATS: ATS Translation Requests are serviced by translating at all enabled stages of translation. Translated traffic from the StreamID of the STE is allowed to bypass (regardless of SMMU_CR0.ATSCHK). In implementations of SMMUv3.1 and later, this configuration is ILLEGAL if this field is not IGNORED and STE.Config == 0b11x and STE.S2S == 1. In SMMUv3.0 implementations, this configuration is ILLEGAL if this field is not IGNORED and STE.S2S == 1. It is CONSTRAINED UNPREDICTABLE whether or not this check of STE.S2S occurs when STE.Config == 0b10x. Arm recommends that STE.S2S == 1 causes STE.EATS == 0b01 to be ILLEGAL only when STE.Config == 0b11x. This condition is represented by CONSTR_UNPRED_EATS_S2S in the pseudocode description. 0b10 Split-stage ATS: ATS Translation responses return the IPA output of stage 1 translation to the Endpoint or ATC. Subsequent Translated transactions are generated by the Endpoint with IPAs and these undergo stage 2 translation in the SMMU, see section 13.6.3 Split-stage (STE.EATS == 0b10) ATS behavior and responses for details. This configuration must only be used when: • The stream has both stage 1 and stage 2 translation (STE.Config == 0b111) • STE.S2S == 0 • SMMU_IDR0.NS1ATS == 0 • SMMU_CR0.ATSCHK == 1 If any of the following hold, the STE is ILLEGAL (if it is not IGNORED): • STE.Config != 0b111 • STE.S2S == 1. • SMMU_IDR0.NS1ATS == 1. If STE.Config == 0b111 and STE.S2S == 0 and SMMU_IDR0.NS1ATS == 0, but SMMU_CR0.ATSCHK == 0 then STE.EATS == 0b10 configuration behaves as 0b00. Note: See section 13.6.3 Split-stage (STE.EATS == 0b10) ATS behavior and responses and 13.6.4 Full ATS skipping stage 1 which describes interaction of this field with STE.S1DSS. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 263

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry EATS Meaning 0b11 Enable Full ATS with DPT checks: If SMMU_R_IDR3.DPT == 0, then this encoding is Reserved for Realm STEs and behaves as 0b00. If SMMU_IDR3.DPT == 0, then this encoding is Reserved for Non-secure STEs and behaves as 0b00. If the corresponding SMMU_(R_)IDR3.DPT == 1 and StreamWorld is not EL1, this encoding is ILLEGAL and results in C_BAD_STE. For a Non-secure STE, if this encoding is not ILLEGAL and SMMU_CR0.ATSCHK == 0, then this encoding is treated as 0b00. This configuration is ILLEGAL if this field is not IGNORED and STE.Config == 0b11x and STE.S2S == 1. Otherwise: Same as encoding 0b01 but additionally enables per-granule checking of ATS-translated transactions. See also 3.24.1 DPT check. If the STE is Secure, this field is RES0 and has an effective value of 0b00. This field is IGNORED if any of the following hold: • SMMU_IDR0.ATS == 0 – ATS is not supported by the SMMU implementation. No ATS requests can be made, nor Translated traffic passed. • STE.Config[1:0] == 0b00 – When STE.Config == 0b100, the effective value of this field is 0b00.The responses and events recorded for Translation Requests and Translated transactions are as described in this table for STE.EATS == 0b00. – When STE.Config == 0b000, Translation Requests are silently terminated with UR and, if SMMU_CR0.ATSCHK == 1, Translated transactions are silently aborted. Incoming PCIe traffic marked Translated is only checked against the effective value of STE.EATS if SMMU_CR0.ATSCHK == 1, otherwise traffic marked Translated bypasses the SMMU. Incoming ATS Translation Requests are always checked against the effective value of STE.EATS. The behavior when STE.EATS == 0b10 or 0b11 is dependent on SMMU_CR0.ATSCHK; see section 3.9.2 Changing ATS configuration for details on changing ATS configuration. An implementation is permitted to cache ATSCHK in configuration caches, so if ATSCHK is changed while STEs exist with STE.EATS == 0b10 or 0b11 it is UNPREDICTABLE as to whether the behavior on receipt of new requests related to those STEs is as though this field is configured to 0b00 or 0b10. In an EI, this field is permitted to be RAZ/WI if SMMU_IDR0.ATS == 0. Note: There is no dependency between this field being non-zero and the ability for a CD to select the stall fault model with CD.S == 1. Arm expects that the Stall model is not enabled for PCIe-related streams both at stage 2 (STE.S2S == 0) and at stage 1 (CD.S == 0) and that STE.S1STALLD == 1 is used if necessary to ensure that a CD cannot use CD.S == 1 when the CD configuration is not managed the highest-privilege entity in the system. This expectation is present regardless of whether the stream uses ATS or not. If STE.S1STALLD == 0 and CD.S == 1, the Stall model might (if supported) cause PCIe traffic to stall upon fault. STRW, bits [95:94] StreamWorld control. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 264

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Selects the translation regime and associated Exception level controlling this stream, in conjunction with the Security state of the STE as defined by being fetched using the Stream table associated with that Security state, when stage 1 translation is used. If stage 1 is not implemented (SMMU_IDR0.S1P == 0), this field is RES0. In this case, the effective StreamWorld is determined by STE.Config[1]. If SMMU_IDR0.Hyp == 0 and the STE is in the Non-secure Stream table this field is RES0. If STE.Config == 0b11x (stage 2 translation enabled) and the STE is in the Non-secure or Realm Stream table, STRW is IGNORED (if it is not already RES0) and the effective StreamWorld is NS-EL1 or Realm-EL1 respectively. If STE.Config == 0b11x and the STE is Secure and Secure stage 2 is supported, then STRW is IGNORED (if it is not already RES0) and the effective StreamWorld is Secure. If STE.Config == 0b10x (stage 2 bypass) and STE.Config == 0b1x0 (stage 1 bypass), STRW is IGNORED (if it is not already RES0) as no translations are performed. Note: The STRW field is not the same as the StreamWorld, which is an attribute whose Effective value might be influenced by STRW in some configurations, but not in others. See section 3.3.3 Configuration and Translation lookup for a definition of StreamWorld. If Config == 0b101 (stage 1 only), then StreamWorld is determined from the Security state of the Stream table, STRW and SMMU_(*_)CR2.E2H as described below. For STEs reached using the Non-secure Stream table, if STRW is not RES0 or IGNORED then StreamWorld is determined from STRW and SMMU_CR2.E2H as follows: STRW E2H Resulting StreamWorld 0b00 X NS-EL1 0b10 0 NS-EL2 0b10 1 NS-EL2-E2H 0bx1 X Reserved, ILLEGAL For STEs reached using the Realm Stream table, if STRW is not RES0, then StreamWorld is determined from STRW and SMMU_R_CR2.E2H as follows: STE.Config STE.STRW Mode Properties 0b0xx 0bxx Stream disabled See 3.10.3.2 Realm stream disabled. 0b100 0bxx Stream bypass See 3.10.3.3 Realm stream bypass. 0b101 0b00 EL1 stage 1 only Realm EL1&0 stage 1 translation, with stage 2 translation disabled. 0b101 0b10 EL2 or EL2-E2H If SMMU_R_CR2.E2H=0 then Realm EL2 stage 1 stage 1 translation. If SMMU_R_CR2.E2H=1, then Realm EL2&0 stage 1 translation. 0b111 0bxx EL1 stage 1 and 2 Realm EL1&0 stage 1 translation, with stage 2 translation enabled. 0b110 0bxx EL1 stage 2 only Realm EL1&0 stage 1 translation disabled, with stage 2 translation enabled. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 265

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry For STEs reached using the Secure Stream table, if STRW is not RES0 or IGNORED then StreamWorld is determined from STRW and SMMU_S_CR2.E2H as follows: STRW E2H Resulting StreamWorld ILLEGAL when 0b00 X Secure - 0b10 0 S-EL2 SMMU_S_IDR1.SEL2 == 0 0b10 1 S-EL2-E2H SMMU_S_IDR1.SEL2 == 0 0b01 X EL3 SMMU_IDR0.RME_IMPL == 1 0b11 X Reserved, ILLEGAL Always The behaviors of these StreamWorlds are as follows: • Secure tags TLB entries as Secure with an ASID and Arm expects this StreamWorld to be selected for Secure streams used by: – Secure software on an Armv7-A host PE, or Armv8-A host PE whose EL3 runs in AArch32. – Secure-EL1 software on an Armv8-A host PE whose EL3 runs in AArch64. • When Secure stage 2 is supported, that is SMMU_S_IDR1.SEL2 == 1, the Secure StreamWorld additionally tags TLB entries a VMID. • S-EL2 tags TLB entries as Secure EL2 without an ASID. • S-EL2-E2H tags TLB entries as Secure EL2 with an ASID, using E2H mode. • EL3 tags TLB entries as Secure EL3, without an ASID. Note: The StreamWorld affects three things: • The tagging of resulting TLB entries, that is the translation regime, and ASID or VMID. • The number of translation tables used in the CD for stage 1. • The Permissions model used in stage 1 translation table See also: • 3.3.3 Configuration and Translation lookup. • 3.3.4 Transaction attributes: incoming, two-stage translation and overrides. MemAttr, bits [99:96] Memory Attribute override value. If MTCFG == 1, MemAttr provides memory type override for incoming transactions. The encoding matches the VMSAv8-64 stage 2 MemAttr[3:0] field as described in the A-profile architecture[2], except that the following encodings are Reserved (not UNPREDICTABLE) and behave as Device-nGnRnE: • 0b0100 • 0b1000 • 0b1100 Note: In the A-profile architecture[2], FEAT_MTE_PERM introduces the encoding 0b0100 for the stage 2 MemAttr[3:0] field. This behavior is implemented in the SMMU if SMMU_IDR3.MTEPERM == 1. For STE.MemAttr this encoding remains Reserved and behaves as Device-nGnRnE. See section 3.23.1 SMMU support for FEAT_MTE_PERM. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 266

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: This encoding matches the encoding of the stage 2 translation table descriptor MemAttr field that is used when S2FWB == 0. The S2FWB field only affects the stage 2 translation table descriptor MemAttr field, and does not affect the encoding of this field. If MTCFG == 0 or SMMU_IDR1.ATTR_TYPES_OVR == 0, this field is RES0. MTCFG, bit [100] Memory Type configuration. MTCFG Meaning 0b0 Use incoming type or Cacheability 0b1 Replace incoming type or Cacheability with that defined by MemAttr field If SMMU_IDR1.ATTR_TYPES_OVR == 0, this field is RES0 and the incoming Memory Type is used. When SMMU_IDR3.MTCOMB is 0, it is IMPLEMENTATION DEFINED whether MTCFG applies to streams associated with PCIe devices or whether the incoming Memory Type is used for such streams regardless of the field value. ALLOCCFG, bits [104:101] Allocation hints override. • 0b0xxx: Use incoming RA, WA, TR hints • 0b1RWT: Hints are overridden to given values: – Read Allocate == R – Write Allocate == W – Transient == T When overridden by this field, for each of RA/WA and TR, both inner and outer hints are set to the same value. Because it is not architecturally possible to express hints for types that are any-Device or Normal-Non-cacheable, this field has no effect on memory types that are not Normal-WB or Normal-WT, whether such types are provided with transaction from the client device or overridden using MTCFG/MemAttr. Note: A value of 0b1001 encodes Transient with no-allocate. When the SMMU ensures output attribute consistency (see section 13.1.7 Ensuring consistent output attributes), no-allocate is considered to be non-transient. As there is no value of stage 1/stage 2 attribute with which Transient-no-allocate could combine to cause an allocating Transient attribute to be output, 0b1001 is functionally equivalent to 0b1000 (non-Transient, no-allocate). If SMMU_IDR1.ATTR_TYPES_OVR == 0, this field is RES0 and the incoming Allocation hints are used. When SMMU_IDR3.MTCOMB is 0, it is IMPLEMENTATION DEFINED whether ALLOCCFG applies to streams associated with PCIe devices or whether the incoming allocation hints are used for such streams regardless of the field value. When SMMU_IDR3.MTCOMB is 0 and STE.MTCFG is 0, it is CONSTRAINED UNPREDICTABLE whether ALLOCCFG has any effect on the allocation hints for the cacheability domains of a transaction. Bits [107:105] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 267

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry SHCFG, bits [109:108] Shareability configuration. SHCFG Meaning 0b00 Non-shareable 0b01 Use incoming Shareability attribute 0b10 Outer shareable 0b11 Inner shareable Architecturally, any-Device and Normal-iNC-oNC are OSH and Shareability is only variable where cacheable types are used. This field has no effect on memory types that do not contain Normal-{i,o}WB or Normal-{i,o}WT, whether such types are provided with transaction from the client device or overridden using MTCFG/MemAttr. If SMMU_IDR1.ATTR_TYPES_OVR == 0, this field is RES0 and the incoming Shareability attribute is used. When SMMU_IDR3.MTCOMB is 0, it is IMPLEMENTATION DEFINED whether SHCFG applies to streams associated with PCIe devices or whether the incoming Shareability attribute is used for such streams regardless of the field value. NSCFG, bits [111:110] Non-secure attribute configuration. For a Secure stream, NSCFG is interpreted as follows: NSCFG Meaning 0b00 Use incoming NS attribute 0b01 Reserved, behaves as 0b00. 0b10 Secure 0b11 Non-secure NSCFG is IGNORED when the STE is in the Non-secure Stream table. NSCFG is IGNORED when the STE is in the Secure Stream table and stage 1 translation is enabled. In this case the final NS attribute is determined entirely by the translation process (see CD.NSCFGx, the TTD.NSTable and TTD.NS bits). The input NS attribute and this field are not used. If Secure stage 2 is enabled, the output IPA space determined from the stage 1 translation is input into stage 2. See section 3.10.2.2 Secure EL2 and support for Secure stage 2 translation. Otherwise, when the STE is in the Secure Stream table and stage 1 translation is disabled (STE.Config == 0b1x0): • If SMMU_IDR1.ATTR_PERMS_OVR == 0, this field is RES0 and the incoming NS attribute is output from stage 1 directly. If Secure stage 2 is enabled, the NS attribute is input into stage 2 and selects between the Secure and Non-secure IPA spaces. • If SMMU_IDR1.ATTR_PERMS_OVR == 1, this field determines the target IPA or PA space of transactions that bypass stage 1 translation and this value is output from stage 1 as the target IPA or PA space. – Note: Arm recommends that SMMU_IDR1.ATTR_PERMS_OVR == 1 if an implementation might be used in a system where the input NS attribute from a client device on a Secure stream is not accurate, and is required to be overridden by the SMMU configuration. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 268

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry • If Secure stage 2 is enabled, the resulting NS attribute is input into stage 2. See section 3.10.2.2 Secure EL2 and support for Secure stage 2 translation. Note: The function of this field is not related to the CD.NSCFG{0,1} fields (whose purpose is to affect the NS property of the translation table walk). For a Realm stream, NSCFG is interpreted as follows: Value Meaning 0b00 Use incoming NS attribute. 0b01 If SMMU_R_IDR3.XT == 0, then Reserved, behaves as 0b00. If SMMU_R_IDR3.XT == 1, then Check incoming NS attribute. 0b10 Override to Realm. 0b11 Override to Non-secure. Note: If the Realm client device does not provide an input NS attribute, the input NS attribute defaults to Realm. Note: NSCFG is supported for Realm streams regardless of the value of SMMU_IDR1.ATTR_PERMS_OVR. PRIVCFG, bits [113:112] User/privileged attribute configuration. PRIVCFG Meaning 0b00 Use incoming PRIV attribute 0b01 Reserved, behaves as 0b00. 0b10 Unprivileged 0b11 Privileged If SMMU_IDR1.ATTR_PERMS_OVR == 0, this field is RES0 and the incoming PRIV attribute is used. INSTCFG, bits [115:114] Inst/Data attribute configuration. INSTCFG Meaning 0b00 Use incoming INST attribute 0b01 Reserved, behaves as 0b00. 0b10 Data 0b11 Instruction If SMMU_IDR1.ATTR_PERMS_OVR == 0, this field is RES0 and the incoming INST attribute is used. INSTCFG only affects translations for reads, the SMMU considers incoming writes to be Data regardless of this field. See section 13.1.2 Attribute support. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 269

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry IMPLEMENTATION DEFINED, bits [127:116] IMPLEMENTATION DEFINED per-stream configuration. (For example, QoS overrides for configuration access, data streams.) S2VMID, bits [143:128] Virtual Machine Identifier Marks TLB entries inserted because of translations located through this STE, differentiating them from translations belonging to different virtual machines. For a Non-secure STE when stage 2 is implemented (SMMU_IDR0.S2P == 1) translations resulting from a StreamWorld == NS-EL1 configuration are VMID-tagged with STE.S2VMID when either of stage 1 (STE.Config == 0b1x1) or stage 2 (STE.Config == 0b11x) provide translation. For a Secure STE when Secure stage 2 is implemented, that is SMMU_S_IDR1.SEL2 == 1, and when StreamWorld == Secure: • Translations are VMID-tagged with STE.S2VMID when stage 2 is enabled (STE.Config == 0b11x), including nested configuration. • When only stage 1 is enabled, this field is IGNORED and translations are tagged with VMID 0. Note: Secure VMIDs and Non-secure VMIDs are different namespaces. See section 3.10.2.2 Secure EL2 and support for Secure stage 2 translation. When an implementation supports only 8-bit VMIDs, that is when SMMU_IDR0.VMID16 == 0, it is ILLEGAL for bits STE.S2VMID[15:8] to be non-zero unless this field is IGNORED. STE.S2VMID[15:0] is IGNORED and no VMID tagging occurs when any of the following are true: • Stage 2 is not implemented in the Security state corresponding to the STE. • STE.Config[1:0] == 0b00. Note: In this case, no TLB entries are inserted as translation is bypassed. • A Non-secure STE StreamWorld is not NS-EL1. • A Secure STE has a StreamWorld other than “Secure”. • A Realm STE StreamWorld is not Realm-EL1. Note: If SMMU_IDR0.S2P == 0, then for broadcast TLB maintenance, the SMMU is only required to invalidate Non-secure EL1 or Secure StreamWorld TLB entries if VMID is 0 in the broadcast TLB maintenance operation. See 3.17 TLB tagging, VMIDs, ASIDs and participation in broadcast TLB maintenance. In an EI, this field is permitted to be RAZ/WI if stage 2 is not implemented. In an EI implementing stage 2 with 8-bit VMIDs, STE.S2VMID[15:8] are permitted to be RAZ/WI. If 16-bit VMIDs are supported by an implementation, the full VMID[15:0] value is used regardless of STE.S2AA64. Arm expects that legacy and AArch32 hypervisor software using 8-bit VMIDs will write zero-extended 8-bit values in the VMID field in this case. See section 3.17 TLB tagging, VMIDs, ASIDs and participation in broadcast TLB maintenance for more information on ASID and VMID TLB tagging. Changes to the STE.S2VMID field of an STE are not automatically reflected in cached translations, which must be subjected to separate TLB maintenance. Note: This field might be supplied by an implementation in transactions to the memory system for IMPLEMENTA- TION DEFINED purposes. IMPLEMENTATION DEFINED, bits [159:144] IMPLEMENTATION DEFINED. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 270

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2T0SZ, bits [165:160] Size of IPA input region covered by stage 2 translation table. This field is equivalent to VTCR_EL2.T0SZ in the A-profile architecture[2]. This field is 4 bits ([3:0]) and bits [5:4] are IGNORED when stage 2 translation is VMSAv8-32 LPAE, as indicated by STE.S2AA64. The input region size is calculated the same as in the A-profile architecture[2]. When STE.S2AA64 selects VMSAv8-64 or VMSAv9-128, this field is 6 bits and the region size is calculated the same as for VTCR_EL2 in the A-profile architecture[2]. If stage 2 translation is enabled (STE.Config == 0b11x), legal values of STE.S2SL0 and STE.S2TG relate to this field as defined by the Translation system in the A-profile architecture[2], in section D5.2.3, “Controlling Address translation stages”. Note: This field is IGNORED when stage 2 is implemented but not enabled (STE.Config == 0b10x). When STE.S2AA64 selects VMSAv8-64: • If SMMU_IDR3.STT == 0, the maximum valid value is 39. • If SMMU_IDR3.STT == 1, the maximum valid value is: – 48, when STE.S2TG selects a 4KB or 16KB granule – 47, when STE.S2TG selects a 64KB granule. • In SMMUv3.0, the minimum valid value for this field is (64-IAS). • In architectures after SMMUv3.0: – If STE.S2TG selects a 4KB or 16KB granule and STE.S2DS == 0, the minimum valid value for this field is MAX(16, 64-IAS). • Otherwise, the minimum valid value for this field is MAX(12, 64-IAS). When STE.S2AA64 selects VMSAv9-128: • The maximum valid value is: – 48, when STE.S2TG selects a 4KB or 16KB granule. – 47, when STE.S2TG selects a 64KB granule. • The minimum valid value is MAX(8, 64-IAS). Note: see section 3.4 Address sizes for restrictions on IAS. When STE.S2AA64 selects VMSAv8-32 LPAE, this field encodes a value from -8 to 7 as defined by the Translation system in the A-profile architecture[2]. Note: When STE.S2AA64 selects VMSAv8-32 LPAE all 4-bit values are valid, therefore it is not possible to use a value outside the valid range but it is still possible for this field to be inconsistent with STE.S2SL0. In SMMUv3.0 implementations, the use of a value out of range of these maximum and minimum valid values is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The STE becomes ILLEGAL. • The STE is not ILLEGAL and the effective value used by the translation is the maximum permitted value (if the programmed value is greater than the maximum permitted value) or the minimum permitted value (if the programmed value is less than the minimum permitted value). Note: This condition is represented by constr_unpred_S2T0SZ_oor_ILLEGAL in the pseudocode description. In implementations of SMMUv3.1 and later, an STE is treated as ILLEGAL if it contains a STE.S2T0SZ value out of range of these maximum and minimum values. The usable range of values is further constrained by a function of the starting level set by STE.S2SL0 and, if STE.S2AA64 selects VMSAv8-64 or VMSAv8-32 LPAE, granule size set by STE.S2TG as described by the translation system in the A-profile architecture[2]. Use of a value of STE.S2T0SZ that is inconsistent with the permitted range (given STE.S2SL0 and STE.S2TG) is ILLEGAL. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 271

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: The SMMU behavior differs from the Translation system in the A-profile architecture[2], in which the legal range of VTCR_EL2.T0SZ values can also depend on whether EL1&0 stage 1 uses VMSAv8-32 LPAE or VMSAv8-64. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. S2SL0, bits [167:166] Starting level of stage 2 translation table walk. If STE.S2DS == 1 and STE.S2TG selects 4KB, this field is considered in combination with the STE.S2SL0_2 field. The stage 2 walk start level is a function of STE.{S2SL0_2, S2SL0} and the value of STE.S2TG. When STE.S2AA64 selects VMSAv8-64, the encoding of STE.{S2SL0_2, S2SL0} is the same as for the VTCR_EL2.{SL2, SL0} fields in the A-profile architecture[2]. When STE.S2AA64 selects VMSAv8-32 LPAE, the encoding of this field is the same as for the VTCR.SL0 field in the A-profile architecture[2]. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. If stage 2 translation is enabled (STE.Config == 0b11x), it is ILLEGAL for the configuration of STE.{S2SL0_2, S2SL0} to be inconsistent with STE.S2T0SZ and STE.S2TG. If STE.S2AA64 selects VMSAv9-128, this field is RES0. S2IR0, bits [169:168] Inner region Cacheability for stage 2 translation table access. S2IR0 Meaning 0b00 Non-cacheable 0b01 Write-back Cacheable, Read-Allocate, Write-Allocate 0b10 Write-through cacheable, Read-Allocate 0b11 Write-back cacheable, Read-Allocate, no Write-Allocate The only time that translation table entries are written by the SMMU is when HTTU is in use, and because the read effect of the atomic update might cause read allocation of the affected translation table entry into a data cache, it is IMPLEMENTATION DEFINED as to whether 0b01 and 0b11 differ. Many memory systems might require use of Normal Write-back Cacheable memory for the atomic updates of translation table entries to occur correctly. If HTTU is enabled and this field is configured to 0b00 or 0b10, then it is IMPLEMENTATION DEFINED which of the following behaviors occurs for hardware updates of Access flag and dirty state: • The hardware update occurs correctly as an atomic read-modify-write operation. • The hardware update occurs, but the read-modify-write operation is not guaranteed to be atomic. • The hardware update is attempted but fails and generates an F_WALK_EABT event. Arm recommends that software uses 0b01 or 0b11 when HTTU is enabled for this translation table unless the behavior of an implementation is otherwise known. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 272

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2OR0, bits [171:170] Outer region Cacheability for stage 2 translation table access. Same as for S2IR0. S2SH0, bits [173:172] Shareability for stage 2 translation table access. S2SH0 Meaning 0b00 Non-shareable 0b01 Reserved, behaves as 0b00. 0b10 Outer Shareable 0b11 Inner Shareable Note: If both S2IR0 and S2OR0 == 0b00, selecting normal Non-cacheable access, the Shareability of translation table access is taken to be OSH regardless of the value of this field. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. S2TG, bits [175:174] Stage 2 Translation Granule size. S2TG Meaning 0b00 4KB 0b01 64KB 0b10 16KB 0b11 Reserved If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. Otherwise, if stage 2 translation is disabled (STE.Config == 0b10x), this field is IGNORED. Otherwise, if stage 2 translation is enabled (STE.Config == 0b11x), • If STE.S2AA64 selects VMSAv8-32 LPAE, this field is RES0 and the effective value of this field is 4KB. • If STE.S2AA64 selects VMSAv8-64 or VMSAv9-128, this field must only select a granule supported by the SMMU, as described in SMMU_IDR5, and use of an unsupported size or Reserved value is ILLEGAL. • It is ILLEGAL for STE.S2T0SZ and STE.S2SL0 to be inconsistent with the value of this field, as described in the A-profile architecture[2]. S2PS, bits [178:176] Physical address Size. This field is equivalent to VTCR_EL2.PS in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 273

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2PS Meaning 0b000 32 bits 0b001 36 bits 0b010 40 bits 0b011 42 bits 0b100 44 bits 0b101 48 bits 0b110 52 bits In SMMUv3.0 implementations, this value is Reserved and behaves as 0b101. 0b111 56 bits. In SMMUv3.0 implementations, this value is Reserved and behaves as 0b101. In implementations of SMMUv3.1 to SMMUv3.3, this value is Reserved and behaves as 0b110. Software must not rely on the behavior of Reserved values. This field determines the Physical address size for the purpose of Address Size fault checking the output of stage 2 translation, see section 3.4 Address sizes. If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. If STE.S2AA64 selects VMSAv8-32 LPAE, this field is IGNORED and the effective stage 2 output address size is taken as 40 bits. If STE.S2AA64 selects VMSAv8-64 or VMSAv9-128, the effective stage 2 output address size is given by: eff_S2PS = MIN(S2PS, SMMU_IDR5.OAS); The effective value of this field is capped to the OAS. When STE.S2AA64 selects VMSAv8-64 or VMSAv9-128, setting this field to any value greater than the cap defined here behaves as though this field equals the cap size. Software must not rely on this behavior. Note: This includes use of a Reserved value. An Address Size fault occurs if stage 2 translation outputs an address that has non-zero bits above eff_S2PS. If STE.S2AA64 selects VMSAv8-64, an address of 52 bits in size can be output from stage 2 when eff_S2PS is 52 and either: • 64KB granule is in use for that translation table. • STE.S2DS == 1. An address of 56 bits in size can be output from stage 2 when STE.S2AA64 selects VMSAv9-128. Note: In configurations where eff_S2PS is larger than the address output from the stage 2 descriptor, output bits above the address are treated as zero and no Address Size fault can occur. In SMMUv3.0 addresses are limited to 48 bits. S2AA64, bit [179] Stage 2 translation table format for S2TTB0, and S_S2TTB0 if appropriate. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 274

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2AA64 Meaning Applies when 0b0 Use VMSAv8-32 LPAE descriptor formats. SMMU_IDR0.TTF[0] == 1 0b0 Use VMSAv9-128 descriptor formats. SMMU_IDR5.D128 == 1 0b1 Use VMSAv8-64 descriptor formats. If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. If SMMU_IDR5.D128 == 0 and stage 2 translation is enabled (STE.Config == 0b11x), it is ILLEGAL to select: • VMSAv8-32 LPAE tables when VMSAv8-32 LPAE tables are not supported (SMMU_IDR0.TTF[0] == 0). • VMSAv8-64 tables when VMSAv8-64 tables are not supported (SMMU_IDR0.TTF[1] == 0). If an STE is in the Secure stream table and STE.Config == 0b11x, it is ILLEGAL to select VMSAv8-32 LPAE. If this field selects VMSAv9-128, then STE.{S2SL0, S2SL0_2, S_S2SL0, S_S2SL0_2} fields are all RES0. If SMMU_IDR5.D128 == 1, the behavior of this field is equivalent to VTCR_EL2.D128 in the A-profile architecture[2], with reversed polarity. Note: The stage 2 translation table permissions are interpreted slightly differently between VMSAv8-64 and VMSAv8-32 LPAE format tables, for example, a VMSAv8-64 stage 2 table can encode an execute-only page permission whereas a VMSAv8-32 LPAE stage 2 table cannot, see the A-profile architecture[2] for more information. This field is permitted to be cached in a TLB. S2ENDI, bit [180] Stage 2 translation table endianness. S2ENDI Meaning 0b0 Little Endian 0b1 Big Endian If Stage 2 translation is enabled (STE.Config == 0b11x), it is ILLEGAL for this field to select an unimplemented endianness (as indicated by SMMU_IDR0.TTENDIAN). If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. S2AFFD, bit [181] Stage 2 Access Flag Fault Disable. When HTTU is not in use at stage 2 because (STE.S2HA == 0 or HTTU is not supported, this flag determines the behavior on access of a stage 2 page whose descriptor has AF == 0: S2AFFD Meaning 0b0 An Access flag fault occurs (behavior controlled by STE.S2R and STE.S2S bits) ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 275

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2AFFD Meaning 0b1 An Access flag fault never occurs; the TTD.AF bit is considered to be always 1. When (STE.S2HA == 1, this flag is IGNORED. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. S2PTW, bit [182] Protected Table Walk. For an STE configured for translation at both stages, a stage 1 translation table walk access or CD fetch access made to a stage 2 page with any Device type is terminated and recorded as a stage 2 Permission fault if this field is set. Note: This might provide early indication of a programming error. S2PTW Meaning 0b0 If SMMU_IDR3.PTWNNC == 0: CD fetch and stage 1 translation table walks allowed to any valid stage 2 address. If SMMU_IDR3.PTWNNC == 1: A translation table access or CD fetch mapped as any Device type occurs as if it is to Normal Non-cacheable memory. 0b1 CD fetch or Stage 1 translation table walks to stage 2 addresses mapped as any Device are terminated. A stage 2 Permission fault is recorded. If STE.Config[1:0] != 0b11, this field is IGNORED. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. S2HD, bit [183] Hardware Translation Table Update of stage 2 Dirty flags. See definition of S2HA. S2HA, bit [184] Hardware Translation Table Update of stage 2 Access flags. When combined with STE.S2HD as {STE.S2HA, STE.S2HD}: • 0b00: HTTU disabled • 0b10: Update of Access flag enabled • 0b01: Reserved. If STE.S2HD == 1 is not ILLEGAL, behaves as (STE.S2HA == 0 and STE.S2HD == 0). • 0b11: Update of Access flag and dirty state of the page enabled If stage 2 translation is enabled (STE.Config == 0b11x), • It is ILLEGAL to set STE.S2HA or (STE.S2HD if STE.S2AA64 selects VMSAv8-32 LPAE. • It is ILLEGAL to set STE.S2HA if SMMU_IDR0.HTTU == 0b00. • It is ILLEGAL to set STE.S2HD if SMMU_IDR0.HTTU == 0b00 or 0b01. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 276

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry These fields are RES0 if stage 2 is not implemented. In an EI, this field is permitted to be RAZ/WI if stage 2 is not implemented or SMMU_IDR0.HTTU == 0b00. In an EI, STE.S2HD is permitted to be RAZ/WI if stage 2 is not implemented or SMMU_IDR0.HTTU == 0b0x. Note: If HTTU is enabled when S2OR0 or S2IR0 indicate Non-cacheable memory, behavior is IMPLEMENTATION DEFINED, see 3.15 Coherency considerations and memory access types. A system might only be able to perform atomic updates using cacheable normal memory, or might implement other means for doing so. S2S, bit [185] Stage 2 fault behavior - Stall. See section 5.5 Fault configuration (A, R, S bits) for a description of fault configuration. When STE.Config == 0b10x (Stage 2 disabled), {S2R, S2S} are IGNORED. If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. For accesses with PM = 1, this field is treated as 0 for all purposes other than STE validity checks. S2R, bit [186] Stage 2 fault behavior - Record. See section 5.5 Fault configuration (A, R, S bits) for a description of fault configuration. When STE.Config == 0b10x (Stage 2 disabled), {S2R, S2S} are IGNORED. If stage 2 is not implemented, that is when SMMU_IDR0.S2P == 0, this field is RES0. S2HAFT, bit [187] Enable hardware update of Access flag in Table descriptors. S2HAFT Meaning 0b0 Stage 2 HAFT disabled. 0b1 Stage 2 HAFT enabled. If STE.S2HA is 0 and not IGNORED, it is ILLEGAL to set this field to 1 and this results in C_BAD_STE. This field is permitted to be cached in a TLB. If SMMU_IDR0.HTTU != 0b11 this field is RES0. S2PIE, bit [188] Stage 2 permissions indirection enable. This field is equivalent to VCTR_EL2.S2PIE in the A-profile architecture[2]. S2PIE Meaning 0b0 Stage 2 translations use the Direct Permission Scheme. 0b1 Stage 2 translations use the Indirect Permission Scheme. Note: For each Security state, this field must be configured consistently for all STEs that have the same value of STE.S2VMID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 277

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry If STE.S2AA64 selects VMSAv9-128, this field is RES0 and stage 2 translations use the Indirect Permission Scheme. If SMMU_IDR3.S2PI == 0 or STE.S2AA64 selects VMSAv8-32 this field is RES0. This field is permitted to be cached in a TLB. S2POE, bit [189] Stage 2 permission overlay enable. This field is similar to VCTR_EL2.S2POE in the A-profile architecture[2]. S2POE Meaning 0b0 Do not apply stage 2 overlay permissions. 0b1 Apply stage 2 overlay permissions. If stage 2 translations use the Direct Permission Scheme, it is ILLEGAL to set this field to 1 and this results in C_BAD_STE. If any of STE.{S2HWU62, S2HWU61, S2HWU60, S2HWU59} are 1, it is ILLEGAL to set this field to 1 and this results in C_BAD_STE. This field is permitted to be cached in a TLB. Note: In the A-profile architecture[2], the equivalent bit is not permitted to be cached in a TLB, because it is expected to be updated in a manner that is synchronous relative to accesses made in the EL1&0 translation regime. However, this is not possible in the SMMU, as a device might make accesses at any time, so this field is permitted to be cached in a TLB. If SMMU_IDR3.S2PO == 0 this field is RES0. DPT_VMATCH, bits [191:190] VMID matching requirement for DPT checks. If SMMU_(R_)IDR3.DPT == 0 or STE.EATS != 0b11, then this field is RES0. For a Non-secure STE with STE.EATS == 0b11, the encoding is: DPT_VMATCH Meaning 0b00 STE.S2VMID is required to match or the DPT entry is required to have AC = 0b10. 0b01 STE.S2VMID is required to match or the DPT entry is required to have AC = 0b01 or 0b10. 0b10 S2VMID not required to match. 0b11 Reserved, behaves as 0b00. For a Realm STE with STE.EATS == 0b11, then all of the following apply: • The only permitted value is encoding 0b00, and this behaves as described for Non-secure STEs. • It is ILLEGAL to program this field to any value other than 0b00. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 278

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: If DPT_VMATCH is not consistently configured for all STEs with the same STE.S2VMID field, it is possible that accesses are checked according to the most-permissive DPT_VMATCH field for that group of STEs. This field is not permitted to be cached in a TLB. See also: • 3.24.1 DPT check. S2NSW, bit [192] This field gives the NS bit used for all stage 2 translation table walks for the Secure stream Non-secure IPA space, that is, made through STE.S2TTB. When the STE is not in the Secure Stream table then this field is RES0. If SMMU_S_IDR1.SEL2 == 0 then this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. S2NSA, bit [193] This field gives the NS bit that is output for all stage 2 Secure stream Non-secure IPA translations. When the STE is not in the Secure Stream table then this field is RES0. If SMMU_S_IDR1.SEL2 == 0 then this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. Otherwise, when STE.S2NSW == 1 or the effective value of STE.S2SA is 1, this field is IGNORED and the stage 2 Secure stream Non-secure IPA translation results in the target Non-secure PA space. Note: The effective value of the STE.S2SA field is treated as being 1 when the STE.S2SW field is 1. S2SL0_2, bit [194] Bit [2] of STE.S2SL0. See the definition of STE.S2SL0. This field is IGNORED if stage 2 is implemented but not enabled. If STE.S2AA64 selects VMSAv9-128, then this field is RES0. If SMMU_IDR5.DS == 0 this field is RES0. If STE.S2AA64 selects VMSAv8-32 LPAE then this field is RES0. S2DS, bit [195] Enable 52-bit input and output address size when using 4KB and 16KB granules. S2DS Meaning 0b0 52-bit address sizes when using 4KB and 16KB granules disabled. 0b1 52-bit address sizes when using 4KB and 16KB granules enabled. The effect of this field on the interpretation of stage 2 translation table descriptors is the same as for the VTCR_EL2.DS bit as specified in FEAT_LPA2 in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 279

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry The effect of this field on the determination of whether the STE.{S2T0SZ, S2SL0, S_S2T0SZ, S_S2SL0} fields are configured inconsistently is the same as for the effect of the VTCR_EL2.DS bit on V(S)TCR_EL2.{T0SZ, SL0, SL2} specified in FEAT_LPA2 in the A-profile architecture[2]. If this field is 1, the Shareability attribute for a Cacheable location translated by tables pointed to by STE.S2TTB is taken from STE.S2SH0. For a stream with Secure stage 2 translation enabled, if this field is 1, the Shareability attribute for a cacheable location translated by tables pointed to by STE.S_S2TTB is taken from STE.S2SH0. This field is IGNORED if stage 2 is implemented but not enabled. This field is RES0 if any of the following are true: • STE.S2AA64 selects VMSAv9-128. • STE.S2AA64 selects VMSAv8-32 LPAE. • STE.S2TG selects 64KB. • For a Secure stream, if STE.S_S2TG selects 64KB. If SMMU_IDR5.DS == 0 this field is RES0. S2TTB, bits [247:196] In SMMUv3.1 and later, if STE.S2AA64 selects VMSAv9-128, then bits[247:196] represent the address of Stage 2 Translation Table base, bits[55:4]. Otherwise: • In SMMUv3.1 and later: – Bits[243:196] represent the address of Stage 2 Translation Table base, bits[51:4]. – Bits[247:244] are RES0. • In SMMUv3.0: – Bits[239:196] represent the address of Stage 2 Translation Table base, bits[47:4]. – Bits[247:240] are RES0. Address bits above and below the field range are treated as zero. Bits [(x-1):0] are treated as if all the bits are zero, where x is defined by the required alignment of the translation table as given in the A-profile architecture[2]. Note: The SMMU effectively aligns the value in this field before use. For VMSAv8-64 a 64-byte minimum alignment on starting-level translation table addresses is imposed when the effective STE.S2PS value indicates 52-bit output. In this case bits [5:0] are treated as zero. For VMSAv9-128 a 32-byte minimum alignment on starting-level translation table addresses is imposed regardless of the effective STE.S2PS value. In this case bits [4:0] are treated as zero. If Stage 2 translation is enabled (STE.Config[1]=1), it is ILLEGAL for the address in this field to be outside the range described by the effective STE.S2PS value. It is ILLEGAL for the address in this field to be outside of a 48-bit range when STE.S2AA64 selects VMSAv8-64 and STE.S2TG selects a granule smaller than 64KB and STE.S2DS == 0. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. In an EI, the high-order bits of TTB outside of the PA size (SMMU_IDR5.OAS) are permitted to be RAZ/WI. If these bits are not implemented as RAZ/WI, they must store the full address field and correctly support the ILLEGAL address range-check described above. In a Realm STE, STE.S2TTB, if required, is treated as being a Realm physical address. Bits [252:248] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 280

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2SKL, bits [254:253] Skip Level configuration for initial lookup for stage 2 translations using STE.S2TTB. This field is equivalent to VTTBR_EL2.SKL in the A-profile architecture[2]. S2SKL Meaning 0b00 Skip 0 levels. 0b01 Skip 1 level. 0b10 Skip 2 levels. 0b11 Skip 3 levels. If STE.S2AA64 selects VMSAv9-128, this field is interpreted as the Skip Level for the initial lookup for stage 2 translations that use STE.S2TTB. If STE.S2AA64 selects VMSAv8-64, then this field is RES0. If SMMU_IDR5.D128 == 0 this field is RES0. This field is permitted to be cached in a TLB. Bit [255] Reserved, RES0. IMPLEMENTATION DEFINED, bits [271:256] IMPLEMENTATION DEFINED. PARTID, bits [287:272] MPAM partition ID assigned to accesses related to this StreamID. If MPAM is not supported in the corresponding Security state, then this field is RES0. This field is interpreted as having an UNKNOWN value if it is configured with a value greater than the corresponding SMMU_()MPAMIDR.PARTID_MAX. The corresponding SMMU(_)MPAMIDR.PARTID_MAX is chosen as follows: • For a Non-secure Stream, then SMMU_MPAMIDR.PARTID_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0 or STE.MPAM_NS == 0, then SMMU_S_MPAMIDR.PARTID_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and STE.MPAM_NS == 1, then SMMU_MPAMIDR.PARTID_MAX. Prior to SMMUv3.2 this field is RES0. See Chapter 17 Memory System Resource Partitioning and Monitoring for more information on use of this field. S_S2T0SZ, bits [293:288] Size of Secure IPA input region covered by stage 2 translation table. This field is equivalent to VSTCR_EL2.T0SZ in the A-profile architecture[2]. This field is encoded the same as, and has the same validity requirements as STE.S2T0SZ. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 281

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: This field is not used with a stage 2 translation table for which STE.S2AA64 selects VMSAv8-32 LPAE, as this configuration is not permitted. If SMMU_S_IDR1.SEL2 == 0 this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. When the STE is not in the Secure Stream table this field is RES0. S_S2SL0, bits [295:294] Secure stage 2 translation starting level for STE.S_S2TTB. If STE.S2DS == 1 and STE.S_S2TG selects 4KB, this field is considered in combination with the STE.S_S2SL0_2 field. STE.{S_S2SL0_2, S_S2SL0} are encoded the same as, and have the same validity requirements as STE.{S2SL0_2, S2SL0}. When any of the following are true this field is RES0: • SMMU_S_IDR1.SEL2 == 0. • The STE is not fetched for Secure state. • STE.S2AA64 selects VMSAv9-128. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. If stage 2 is not implemented, that is if SMMU_IDR0.S2P == 0, this field is RES0. S2HDBSS, bit [296] When SMMU_IDR3.HDBSS == 1: Dirty tracking enable. S2HDBSS Meaning 0b0 Hardware Dirty state tracking Structure is disabled. 0b1 Hardware Dirty state tracking Structure is enabled. This field is RES0 if any of the following are true: • SMMU_IDR3.HDBSS == 0 and the STE is Non-secure. • SMMU_S_IDR3.HDBSS == 0 and the STE is Secure. • SMMU_R_IDR3.HDBSS == 0 and the STE is Realm. • STE.S2HD == 0. Otherwise: Reserved, RES0. Bits [301:297] Reserved, RES0. S_S2TG, bits [303:302] Secure stage 2 translation granule for STE.S_S2TTB. This field is encoded the same as, and has the same validity requirements, as STE.S2TG. This field is equivalent to VSTCR_EL2.TG0 in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 282

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry If SMMU_S_IDR1.SEL2 == 0 this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. When the STE is not in the Secure Stream table this field is RES0. MECID, bits [319:304] MECID for SMMU-originated and client-orientated accesses related to this StreamID. The MECID value is used for all of the following accesses: • Stage 1 and stage 2 translation table accesses for this stream, including the stage 2 translation of addresses used in L1CD and CD fetches. • Fetches of L1CD and CD structures for this stream. • Client-originated accesses to Realm PA space for this stream. • If SMMU_IDR6.DCMDQ == 1: – DCMDQ fetches. – MSI writes due to a CMD_SYNC consumed on a DCMDQ. • If SMMU_IDR6.VSID == 1: – CIT and VSTT fetches. For STEs fetched for Non-secure or Secure streams this field is RES0. If SMMU_R_IDR3.MEC == 0, this field is RES0. For a Realm stream with STE.Config[2] == 0, this field is IGNORED. Bits above the supported MECID size are RES0. The supported MECID size is indicated in SMMU_R_MECIDR.MECIDSIZE. If SMMU_R_MECIDR.MECIDSIZE is less than 0xf, the SMMU treats bits [15:MECIDSIZE+1] of this field as 0. This field is permitted to be cached in a configuration cache. Note: If multiple agents can access the same location with mismatched MECID values, the location can become UNKNOWN, as described in the FEAT_MEC specification in the A-profile architecture[2]. Arm expects all Realm STEs with matching STE.S2VMID values also have matching MECID values. PMG, bits [327:320] MPAM PMG assigned to accesses related to this StreamID. If MPAM is not supported in the corresponding Security state this field is RES0. For a Non-secure StreamID, this field is interpreted as having an UNKNOWN value if it is configured with a value greater than SMMU_MPAMIDR.PMG_MAX. For a Secure StreamID if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0 or STE.MPAM_NS == 0, this field is interpreted as having an UNKNOWN value if it is configured with a value greater than SMMU_S_MPAMIDR.PMG_MAX. For a Secure StreamID if SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and STE.MPAM_NS == 1, this field is interpreted as having an UNKNOWN value if it is configured with a value greater than SMMU_MPAMIDR.PMG_MAX. Prior to SMMUv3.2 this field is RES0. See Chapter 17 Memory System Resource Partitioning and Monitoring for more information on use of this field. MPAM_NS, bit [328] PARTID space value for accesses related to this StreamID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 283

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry MPAM_NS Meaning 0b0 Accesses for structures reached from this STE use the PARTID space corresponding to the Security state of STE. 0b1 Accesses for structures reached from this STE use the Non-secure PARTID space. For a Non-secure STE this field is RES0. For a Secure STE if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0, this field is RES0. for a Realm STE if SMMU_R_MPAMIDR.HAS_MPAM_NS == 0, this field is RES0. If this field is 1, then accesses using MPAM information derived from information in this STE use Non-secure PARTID space. This STE.MPAM_NS field affects the PARTID space used for: • CD fetches • Stage 1 translation table walks • Stage 2 translation table walks • Client transactions Note: This field does not affect the PARTID space used for VMS fetches. See 17.7 Determination of PARTID space values. AssuredOnly, bit [329] Stage 2 AssuredOnly behavior enable. This field is equivalent to VTCR_EL2.AssuredOnly in the A-profile architecture[2], but with an additional requirement that CDs are fetched from AssuredOnly memory in order to permit a stage 1 translation to have the Assured Translation property. AssuredOnly Meaning 0b0 AssuredOnly permission checks are disabled. 0b1 AssuredOnly permission checks are enabled. If STE.S2AA64 selects VMSAv9-128, this field is RES0 and AssuredOnly permission checks are enabled. If SMMU_IDR3.THE == 0, this field is RES0. This field is permitted to be cached in a TLB. TL0, bit [330] Stage 2 TopLevel 0 check enable. This field is equivalent to VTCR_EL2.TL0 in the A-profile architecture[2]. If SMMU_IDR3.THE == 0 this field is RES0. This field is permitted to be cached in a TLB. TL1, bit [331] Stage 2 TopLevel 1 check enable. This field is equivalent to VTCR_EL2.TL1 in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 284

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry If SMMU_IDR3.THE == 0 this field is RES0. This field is permitted to be cached in a TLB. VMSPtr, bits [375:332] VMS pointer. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Physical address pointer to the VMS structure associated with the stream. For an STE in the Non-secure Stream Table, this address belongs to Non-secure PA space. For an STE in the Secure Stream Table, this address belongs to Secure PA space. For an STE in the Realm Stream table, this address belongs to the Realm PA space. Prior to SMMUv3.2 and when the VMS is not supported, this field is RES0. See section Virtual Machine Structure for information on the VMS and when it is supported. When the VMS is supported in the corresponding Security state: • The VMSPtr is enabled if all of the following are true: – STE.Config == 0b111 and STE.S1MPAM == 1. – STE.MPAM_NS selects a PARTID space for which SMMU_(*_)MPAMIDR.PARTID_MAX is non-zero. • If the VMSPtr is enabled, then an address greater than the OAS leads to a C_BAD_STE error. Note: This refers to the OAS from SMMU_IDR5.OAS, not STE.S2PS. • If the VMSPtr is not enabled, then VMSPtr is IGNORED. Note: These rules may change if other facilities are added to the VMS. Address bits [11:0] and [63:56] are taken as zero. Bits [383:376] Reserved, RES0. S2SW, bit [384] This field gives the NS bit used for all stage 2 translation table walks for Secure IPA space, that is, made through STE.S_S2TTB. When the STE is not in the Secure Stream table this field is RES0. In a Secure STE if SMMU_S_IDR1.SEL2 == 0 this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. S2SA, bit [385] This field gives the NS bit that is output for all stage 2 Secure IPA translations. When the STE is not in the Secure Stream table this field is RES0. In a Secure STE if SMMU_S_IDR1.SEL2 == 0, this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. Otherwise, when STE.S2SW == 1, this field is IGNORED and the effective STE.S2SA value is treated as being 1. Note: When this field is 1, both the stage 2 Non-secure IPA and the stage 2 Secure IPA translations target Non-secure PA space. See STE.S2NSA. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 285

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S_S2SL0_2, bit [386] Bit [2] of STE.S_S2SL0. See the definition of STE.S_S2SL0. This field is IGNORED if stage 2 is implemented but not enabled. If STE.S2AA64 selects VMSAv9-128 then this field is RES0. If STE.S2AA64 selects VMSAv8-32 LPAE then this field is RES0. If SMMU_IDR5.DS == 0 this field is RES0. Bit [387] Reserved, RES0. S_S2TTB, bits [439:388] In SMMUv3.1 and later, if STE.S2AA64 selects VMSAv9-128, then bits[439:388] represent the address of Secure Stage 2 Translation Table base, bits[55:4]. Otherwise: • In SMMUv3.1 and later: – Bits[435:388] represent the address of Secure Stage 2 Translation Table base, bits[51:4]. – Bits[439:436] are RES0. • In SMMUv3.0: – Bits[431:388] represent the address of Secure Stage 2 Translation Table base, bits[47:4]. – Bits[439:432] are RES0. This field is encoded the same, and has the same validity requirements, as STE.S2TTB. The STE.S_S2TTB translation table is configured using the same STE.S2* fields as STE.S2TTB, with the exception of the following fields which are specific to STE.S_S2TTB: • STE.S_S2SL0. • STE.S_S2TG. • STE.S_S2T0SZ. • STE.S2SW. • STE.S2SA. If SMMU_S_IDR1.SEL2 == 0 this field is RES0. If SMMU_S_IDR1.SEL2 == 1, this field is IGNORED in a Secure STE that has STE.Config == 0b10x. When the STE is not in the Secure Stream table this field is RES0. Bits [444:440] Reserved, RES0. S_S2SKL, bits [446:445] Skip Level configuration for initial lookup for stage 2 translations using STE.S_S2TTB. If STE.S2AA64 selects VMSAv9-128, this field is interpreted as the Skip Level for the initial lookup for stage 2 translations that use STE.S_S2TTB. This field is equivalent to VSTTBR_EL2.SKL in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 286

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S_S2SKL Meaning 0b00 Skip 0 levels. 0b01 Skip 1 level. 0b10 Skip 2 levels. 0b11 Skip 3 levels. This field is RES0 if any of the following are true: • STE.S2AA64 selects VMSAv8-64. • SMMU_IDR5.D128 == 0. • The STE is not in the Secure Stream table. This field is permitted to be cached in a TLB. Bit [447] Reserved, RES0. S2POI

, bits [4p+451:4p+448], for p = 15 to 0 Stage 2 permission overlay interpretation. This field is equivalent to S2POR_EL1 in the A-profile architecture[2]. The set of 16 stage 2 permission overlay interpretations for this stream. This field is indexed by the POIndex value derived from the translation table descriptor, as STE.S2POI[4POIndex+3:4POIndex]. S2POI

Meaning 0b0000 No Access 0b0001 Reserved, treated as C_BAD_STE. 0b0010 MRO 0b0011 MRO-TL1 0b0100 WO 0b0101 Reserved, treated as C_BAD_STE. 0b0110 MRO-TL0 0b0111 MRO-TL01 0b1000 RO 0b1001 RO+uX 0b1010 RO+pX 0b1011 RO+puX 0b1100 RW 0b1101 RW+uX 0b1110 RW+pX ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 287

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry S2POI

Meaning 0b1111 RW+puX This field is RES0 if any of the following are true: • SMMU_IDR3.S2PO is 0. • STE.S2POE is 0. • Stage 2 permission indirection is not enabled. Note: This can be configured in STE.S2PIE, but if STE.S2AA64 selects VMSAv9-128 then stage 2 permission indirection is implicitly enabled. • STE.S2AA64 selects VMSAv8-32 LPAE. This field is IGNORED if stage 2 translation is disabled. The effect of this field on the stage 2 translation of an output address from stage 1 is not permitted to be cached in a TLB. The effect of this field on the stage 2 translation of a stage 1 translation table walk is permitted to be cached in a TLB. If SMMU_IDR3.S2PO == 0 this field is RES0. 5.2.1 General properties of the STE If V == 1 and Config == 0b100 (Stream Bypass), the S1 and S2 fields are IGNORED. The following fields are used to apply attributes to the Bypass transactions: • MTCFG/MemAttr, ALLOCCFG, SHCFG. • NSCFG (Ignored unless STE is selected from Secure Stream table). • PRIVCFG, INSTCFG. If V == 1 and Config == 0b000 (disabled), the CONT field is permitted to be obeyed. The remaining fields contain no relevant configuration and are IGNORED. Transactions selecting such an STE will be silently terminated with an abort. For more details on the memory attribute and permissions overrides (MTCFG, ALLOCCFG, SHCFG, NSCFG, PRIVCFG, INSTCFG), see Chapter 13 Attribute Transformation. An STE or L1STD that is successfully fetched might be cached by the SMMU in any state, therefore any modification, commissioning or decommissioning of an STE must be followed by a CMD_CFGI_STE command. A failed fetch (F_STE_FETCH) does not cause an STE or L1STD to be cached. When cached, an STE is uniquely identified by SEC_SID and StreamID. Note: An STE from one Stream table index X is unrelated to the STE at index X of the Stream table of the other Security state. If an implementation supports bypass transactions (because STE.Config == 0b100) by creating ‘identity-mapped’ TLB entries, the presence of these entries is not visible to software. Changing STE.Config does not require explicit TLB invalidation. Note: STE configuration invalidation is required for any alteration to an STE. Note: StreamWorld (as determined from the STRW field, SMMU_CR2.E2H, SMMU_S_CR2.E2H, Config[1:0] and the Security state of the Stream table that fetches the STE) controls the tagging of TLB entries, so a change of the StreamWorld of a stream makes lookups performed for the stream fail to match TLB entries of a prior StreamWorld or translation regime. Software must consider the possibility of such TLB entries still being present if a prior StreamWorld configuration is returned to, unless explicit invalidation has occurred. Arm recommends that TLB entries that are made unreachable by a change in StreamWorld are invalidated after the change to avoid their unanticipated use by a future configuration that happens to match the old StreamWorld, ASID and VMID (if appropriate). ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 288

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry Note: The following STE properties affect the interpretation of a CD located through the STE: • StreamWorld. • S1STALLD. • VMSAv8-32 LPAE stage 2 translation (STE.Config == 0b11x and STE.S2AA64 selects VMSAv8-32 LPAE). When stage 2 translation is enabled (STE.Config == 0b11x), the correct setting of the stage 2 table walk starting level, S2SL0, is dependent on the granule size, S2TG, and the required IPA address size (S2T0SZ). All three fields must be set in a manner consistent with the equivalent Armv8-A fields. A mismatch causes the STE to be considered ILLEGAL. When Secure stage 2 is supported and enabled, the same requirement also applies to S_S2SL0, S_S2TG0 and S_S2T0SZ. Note: In Armv8-A, an inconsistency between SL0, TG and T0SZ is reported as a Translation fault. In addition, a S2TTB base address outside the range indicated by the effective STE.S2PS value makes the STE ILLEGAL. When Secure stage 2 is enabled, this rule also applies to S_S2TTB. Note: In Armv8-A, an inconsistency between TTBR and PS is reported as an Address Size fault. The following STE fields are permitted to be cached as part of a translation or TLB entry and, when altered, software must perform explicit invalidation of any TLB entry that might have cached these fields, after performing STE structure cache invalidation: • S2TTB. • S2PTW. • S2VMID. • S2T0SZ. • S2IR0. • S2OR0. • S2SH0. • S2SL0. • S2TG. • S2PS. • S2AFFD. • S2HA. • S2HD. • S2ENDI. • S2AA64. • S_S2TTB. • S2NSW. • S2NSA. • S2SW. • S2SA. • S_S2SL0. • S_S2TG0. • S_S2T0SZ. • S2FWB. • TL1. • TL0. • AssuredOnly. • S2PIE. • S2POE. • S2POI. • S2SKL. • S_S2SKL. • S2HAFT. All other STE fields are not permitted to be cached as part of a translation or TLB entry, which means that alterations to all other STE fields do not require invalidation of TLB entries. IMPLEMENTATION DEFINED STE ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 289

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry fields might have IMPLEMENTATION DEFINED invalidation requirements. Note: Invalidation of an STE also implicitly invalidates cached CDs fetched through the STE. For a given Security state, stage 2 configuration from STEs with the same S2VMID is considered interchangeable by the SMMU. Note: Software must ensure that all STEs containing the same S2VMID value are identical for non- IGNORED fields permitted to be cacheable as part of a TLB entry, in the list in this section. Fields that are IGNORED because of a stage 2 bypass (STE.Config == 0b10x) are not covered by this rule. Note: As the properties of TLB entries inserted from an STE depend on the fields listed here, a difference would cause TLB entries to be cached with different properties. It would be UNPREDICTABLE as to whether a TLB entry was cached using a particular STE sharing an S2VMID value, therefore the properties returned by a general TLB lookup under the given VMID become UNPREDICTABLE. 5.2.2 Validity of STE The following pseudocode indicates whether an STE is considered valid or ILLEGAL, for the purposes of determining a configuration error (C_BAD_STE). Further checks are required (for example, on the extent of an incoming SubstreamID with respect to STE.S1CDMax) after an STE is discovered to be valid. // IgnoreSTESTRW() // =============== // Returns TRUE if STE.STRW is unused // Returns FALSE otherwise boolean IgnoreSTESTRW(bits(3) Config, SecurityState sec_sid) // Stage 1 not implemented if SMMU_IDR0.S1P == '0' then return TRUE; // Non-Secure AND Hyp not supported if sec_sid == SS_NonSecure && SMMU_IDR0.Hyp == '0' then return TRUE; // Stage 2 translation enabled if Config == '11x' then return TRUE; // Bypass, no translations if Config == '100' then return TRUE; // STRW is used return FALSE; // IgnoreSTES2VMID() // ================= // Returns TRUE if STE.S2VMID is ignored // Returns FALSE otherwise boolean IgnoreSTES2VMID(bits(3) Config, bits(2) STRW, SecurityState sec_sid) if Config == '0xx' then // Translation is disabled return TRUE; if sec_sid == SS_NonSecure && SMMU_IDR0.S2P == '0' then // STE is NS and NS stage 2 is not implemented return TRUE; if sec_sid == SS_Secure && SMMU_S_IDR1.SEL2 == '0' then // STE is Secure and S-stage 2 not implemented return TRUE; if Config == '100' then // Bypass, no translations return TRUE; if STRW != '00' && !IgnoreSTESTRW(Config, sec_sid) then // Not using an EL1 streamworld return TRUE; if sec_sid == SS_Secure && Config == '101' then // Secure, only Stage 1 return TRUE; // S2VMID is not ignored ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 290

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry return FALSE; // Assuming SMMU_S_IDR1.SECURE_IMPL == 1, NSSTALLD may affect // the Non-secure STALL_MODEL: See section 3.12. bits(2) EffectiveSMMU_IDR0_STALL_MODEL() return SMMU_S_IDR0.STALL_MODEL == 0b00 ? (SMMU_S_CR0.NSSTALLD == 0 ? 0b00 : 0b01) : SMMU_S_IDR0.STALL_MODEL; // SteIllegal() // ============ // Returns TRUE if STE is considered ILLEGAL // Returns FALSE otherwise boolean SteIllegal(STE_t STE, bits(2) SEC_SID, bits(32) SID) // Intermediate Values SecurityState sec_sid = DecodeSecSid(SEC_SID); integer pa_range = CalcPARange(STE.S2PS, STE.S2AA64); boolean strw_unused = IgnoreSTESTRW(STE.Config, sec_sid); boolean s2vmid_ignored = IgnoreSTES2VMID(STE.Config, STE.STRW, sec_sid); bits(2) eff_idr0_stall_model = EffectiveSMMU_IDR0_STALL_MODEL(); TGSize s2tg = TG0(STE.S2TG); TGSize s_s2tg = TG0(STE.S_S2TG); boolean using_vmsa32 = SMMU_IDR5.D128 == '0' && STE.S2AA64 == '0'; boolean using_vmsa64 = STE.S2AA64 == '1'; boolean using_vmsa128 = SMMU_IDR5.D128 == '1' && STE.S2AA64 == '0'; // See the definition of the STE.EATS field in section 5.2 boolean constr_unpred_EATS_S2S; // See the definition of the STE.S2T0SZ field in section 5.2 boolean constr_unpred_S2T0SZ_or_ILLEGAL; // Check if SID belongs to the qSID range integer log2nump = Log2NumDCMDQPages(sec_sid); bits(32) qsid_base = QsidBase(sec_sid); boolean from_dcmdq = SID<31:log2nump> == qsid_base<31:log2nump>; // For STEs associated with DCMDQ control pages, it is IMPLEMENTATION DEFINED // whether, in addition to the general STE validity checks: // * No additional checks are performed. // * Additional checks are performed on STE.Config, STE.{MTCFG,SHCFG} // and STE.{S2S,S2R}. This is represented by the "Apply DCMDQ STE checks" // && "Account for S2S in STE check for DCMDQ" boolean expression. // * Additional checks are performed on STE.Config, STE.{MTCFG,SHCFG} // and STE.S2R. Note: The value of STE.S2S does not affect STE validity // in this case. This is represented by the "Apply DCMDQ STE checks" // && !"Account for S2S in STE check for DCMDQ" boolean expression. if from_dcmdq && boolean IMPLEMENTATION_DEFINED "Apply DCMDQ STE checks" then // STEs fetched using a qSID require Stage 2 only translation. if STE.Config != '110' then return TRUE; // STEs fetched using a qSID require that cacheability and shareability are not // overridden. if SMMU_IDR1.ATTR_TYPES_OVR == '1' && STE. != '001' then return TRUE; // STEs fetched using a qSID require a configuration that does not ignore S2VMID. if s2vmid_ignored then return TRUE; // STEs fetched using a qSID require that faults are recorded. if STE.S2R == '0' then return TRUE; if boolean IMPLEMENTATION_DEFINED "Account for S2S in STE check for DCMDQ" then // STEs fetched using a qSID require that transactions do not stall // on a fault. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 291

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry if STE.S2S == '1' then return TRUE; if SMMU_AIDR.ArchMajorRev == '0000' && SMMU_AIDR.ArchMinorRev == '0000' then constr_unpred_EATS_S2S = ConstrainUnpredictableBool(); constr_unpred_S2T0SZ_oor_ILLEGAL = ConstrainUnpredictableBool(); else // In SMMUv3.1 and later, these cases are always ILLEGAL constr_unpred_EATS_S2S = FALSE; constr_unpred_S2T0SZ_or_ILLEGAL = TRUE; // Check if Valid if STE.V == '0' then return TRUE; // Check if performing Translation if STE.Config == '0xx' then return FALSE; // Check STE.Config[0] if STE.Config == '1x1' && SMMU_IDR0.S1P == '0' then // Stage 1 enabled but not supported return TRUE; // Check for cases where stage 2 translation is enabled but not supported if STE.Config == '11x' then if SMMU_IDR0.S2P == '0' then // Stage 2 not supported return TRUE; if SMMU_IDR0.S2P == '1' && sec_sid == SS_Secure && SMMU_S_IDR1.SEL2 == '0' then // Secure stage 2 not supported return TRUE; if using_vmsa32 && sec_sid != SS_NonSecure then // Cannot use Secure or Realm stage 2 in VMSAv8-32 LPAE return TRUE; // Check ATS configuration if ((sec_sid == SS_NonSecure && SMMU_IDR0.ATS == '1') || (sec_sid == SS_Realm && SMMU_R_IDR0.ATS == '1')) && STE.Config != 'x00' then // Needs to be NS/Realm, ATS enabled, and not Bypass if STE.EATS == '10' then // Split-stage ATS mode if STE.Config != '111' || STE.S2S == '1' || SMMU_IDR0.NS1ATS == '1' then // Either STE not configured for split-stage ATS // or it's not supported return TRUE; if STE.EATS == '01' && STE.S2S == '1' then // Full ATS mode if STE.Config == '11x' || constr_unpred_EATS_S2S then // if stage 2 enabled or CONSTRAINED UNPREDICTABLE for SMMUv3.0 return TRUE; if STE.EATS == '11' then if ((sec_sid == SS_Realm && SMMU_R_IDR3.DPT == 1) || (sec_sid == SS_NonSecure && SMMU_IDR3.DPT == 1)) && !strw_unused && STE.STRW != '00' then // StreamWorld other than EL1 is ILLEGAL for DPT use return TRUE; if sec_sid == SS_Realm && SMMU_R_IDR3.DPT == 1 && STE.DPT_VMATCH != '00' then // For Realm, the only permitted DPT_VMATCH is 0b00 return TRUE; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 292

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry // Check STE.STRW if sec_sid != SS_Secure && !strw_unused && STE.STRW == 'x1' then // Reserved NS & R STRW values are ILLEGAL if STRW is used return TRUE; if sec_sid == SS_Secure && !strw_unused && STE.STRW == '11' then // Reserved S STRW value is ILLEGAL if STRW used return TRUE; if sec_sid == SS_Secure && !strw_unused && STE.STRW == '01' && SMMU_IDR0.RME_IMPL == '1' then // EL3 is not supported if RME is supported return TRUE; if sec_sid == SS_Secure && SMMU_S_IDR1.SEL2 == '0' && STE.STRW == '10' && STE.Config == '101' then // Secure EL2(-E2H) but Secure EL2 not supported return TRUE; // Stage 1 Translation if STE.Config == '1x1' then // Check STE.S1STALLD if STE.S1STALLD == '1' then if sec_sid == SS_NonSecure && eff_idr0_stall_model != '00' then // NS Stall Model != Stall and Terminate return TRUE; if sec_sid == SS_Secure && SMMU_S_IDR0.STALL_MODEL != '00' then // S Stall Model != Stall and Terminate return TRUE; if sec_sid == SS_Realm && SMMU_R_IDR0.STALL_MODEL == '01' then // R Stall model does not support stalling return TRUE; // Check STE.S1CDMax // 2^S1CDMax - Number of CDs pointed to by S1ContextPtr. // The allowable range is 0 to SMMU_IDR1.SSIDSIZE if SMMU_IDR1.SSIDSIZE != '00000' then if UInt(STE.S1CDMax) > UInt(SMMU_IDR1.SSIDSIZE) then return TRUE; // Check STE.S1Fmt if substreams are supported if SMMU_IDR1.SSIDSIZE != '00000' && STE.S1CDMax != '00000' && // and 2-level CD table not supported. SMMU_IDR0.CD2L == '0' && // it is ILLEGAL to set S1Fmt != 00 (11 behaves as 00) (STE.S1Fmt == '01' || STE.S1Fmt == '10') then return TRUE; // Check STE.S1ContextPtr // by checking if PA/IPA is out of range if STES1ContextPtrOutOfRange(STE.Config, STE.S1ContextPtr) then return TRUE; // Stage 2 Translation - SMMU_IDR0.S2P already checked above if STE.Config == '11x' then // Check STE.S2FWB if using_vmsa32 && SMMU_IDR3.FWB == '1' && STE.S2FWB == '1' then // Cannot use FWB in VMSAv8-32 LPAE return TRUE; // Check STE.S2S if STE.S2S == '1' then if sec_sid == SS_NonSecure && eff_idr0_stall_model == '01' then // stall_model doesn't support stalls, but S2S == 1 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 293

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry return TRUE; if sec_sid == SS_Secure && SMMU_S_IDR0.STALL_MODEL == '01' then // Secure stall_model doesn't support stalls, but S2S == 1 return TRUE; if sec_sid == SS_Realm && SMMU_R_IDR0.STALL_MODEL == '01' then // Realm state does not support stall return TRUE; if sec_sid == SS_NonSecure && eff_idr0_stall_model == '10' && STE.S2S == '0' then // stall_model forcing stall, but S2S == 0 return TRUE; if sec_sid == SS_Secure && SMMU_S_IDR0.STALL_MODEL == '10' && STE.S2S == '0' then // Secure stall_model forcing stall, but S2S == 0 return TRUE; // Check STE.S2AA64 if using_vmsa32 && SMMU_IDR0.TTF == 'x0' then // STE is VMSAv8-32 LPAE but not supported return TRUE; if using_vmsa64 && SMMU_IDR0.TTF == '0x' then // STE is VMSAv8-64 but not supported return TRUE; // Check STE HW Translation Table Update of stage 2 Access flag and Dirty state if (STE.S2HA == '1' || STE.S2HD == '1') && (using_vmsa32 || SMMU_IDR0.HTTU == '00') then // No flag updates supported by the system // or STE is VMSAv8-32 LPAE at stage 2 // yet S2HA OR S2HD set return TRUE; if STE.S2HD == '1' && SMMU_IDR0.HTTU == '01' then // SMMU only supports Access flag update, not Dirty state return TRUE; if STE.S2HAFT == '1' && STE.S2HA == '0' && SMMU_IDR0.HTTU == '11' then // Stage 2 hardware update of Access flag in Table descriptors is enabled, // but hardware update of Access flag is not return TRUE; // Check STE.S2TG if !using_vmsa32 && !GranuleSupported(s2tg) then // unsupported granule size, or Reserved value return TRUE; // Check STE.S2TTB if STES2TTBOutOfRange(using_vmsa128, STE.S2DS, STE.S2TTB, s2tg, pa_range) then return TRUE; // Check STE.S2T0SZ if !using_vmsa32 && STES2T0SZInvalid(using_vmsa128, STE.S2DS, STE.S2T0SZ, s2tg) && constr_unpred_S2T0SZ_or_ILLEGAL then return TRUE; // Check consistency of S2 Translation fields if ((using_vmsa32 && STEWalkConfigInconsistentAA32(STE.S2T0SZ, STE.S2SL0)) || (using_vmsa64 && STEWalkConfigInconsistentAA64(STE.S2T0SZ, STE.S2DS, STE., s2tg)) || (using_vmsa128 && STEWalkConfigInconsistentD128(STE.S2T0SZ, STE.S2SKL, s2tg))) then return TRUE; // Secure version of above 4 cases if sec_sid == SS_Secure then ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 294

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry // Check STE.S_S2TG if !GranuleSupported(s_s2tg) then return TRUE; // Check STE.S_S2TTB if STES2TTBOutOfRange(using_vmsa128, STE.S2DS, STE.S_S2TTB, s_s2tg, pa_range) then return TRUE; // Check STE.S_S2T0SZ if STES2T0SZInvalid(using_vmsa128, STE.S2DS, STE.S_S2T0SZ, s_s2tg) then return TRUE; // Check consistency of S2 Translation fields // A Secure STE with stage 2 translation enabled is not permitted to use VMSAv8-32. if ((using_vmsa64 && STEWalkConfigInconsistentAA64(STE.S_S2T0SZ, STE.S2DS, STE., s_s2tg)) || (using_vmsa128 && STEWalkConfigInconsistentD128(STE.S_S2T0SZ, STE.S_S2SKL, s_s2tg))) then return TRUE; // Check Endianness if SMMU_IDR0.TTENDIAN == '10' && STE.S2ENDI == '1' then // Only little-endian supported, but STE configures big-endian return TRUE; if SMMU_IDR0.TTENDIAN == '11' && STE.S2ENDI == '0' then // Only big-endian supported, but STE configures little-endian return TRUE; // Check STE.S2PIE if SMMU_IDR3.S2PI == '1' && STE.S2PIE == '1' && using_vmsa32 then // Stage 2 permission indirection is enabled, but Stage 2 uses VMSAv8-32 return TRUE; // Check STE.S2POE if SMMU_IDR3.S2PO == '1' && STE.S2POE == '1' then if STE.S2PIE == '0' && !using_vmsa128 then // Stage 2 Overlay is enabled, but Stage 2 Indirect permissions is not return TRUE; if SMMU_IDR3.PBHA == '1' && STE. != '0000' then // Stage 2 Overlay is enabled, but STE bits corresponding to PBHA are not ZERO return TRUE; // Check STE.S2POI for i = 0 to 15 if STE.S2POI<(i*4)+:4> IN { '0001', '0101' } then // Stage 2 Overlay is enabled, but S2POI contains a Reserved encoding return TRUE; // Check STE.S2VMID if !s2vmid_ignored && SMMU_IDR0.VMID16 == '0' && STE.S2VMID<15:8> != '00000000' then // Implementation only supports 8-bit VMIDs // but STE VMID > 8-bits and STE.S2VMID isn't ignored return TRUE; // Check STE.VMSPtr if STE.Config == '111' && STE.S1MPAM == '1' && STEVMSPtrOutOfRange(STE.VMSPtr) then // The VMSPtr is enabled, and is out of range return TRUE; // No ILLEGAL conditions met return FALSE; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 295

Chapter 5. Data structure formats 5.2. STE, Stream Table Entry // STES2T0SZInvalid() // ================== // Returns TRUE if (S_)S2T0SZ value is outside the range that // is valid when stage 2 is implemented and is VMSAv8-64 or VMSAv9-128 // Returns FALSE otherwise boolean STES2T0SZInvalid(boolean using_vmsa128, bit DS, bits(6) S2T0SZ, TGSize S2TG) integer txsz_min, txsz_max; integer s2t0sz = UInt(S2T0SZ); integer ias = IAS(); // find txsz_max // Small translation table supported if SMMU_IDR3.STT == '1' && S2TG IN {TGSize_4KB, TGSize_16KB} then txsz_max = 48; // Small translation table supported and S2TG not IN {4KB, 16KB} elsif SMMU_IDR3.STT == '1' then txsz_max = 47; // Small translation table not supported else txsz_max = 39; // find txsz_min // SMMUv3.0 if SMMU_AIDR.ArchMajorRev == '0000' && SMMU_AIDR.ArchMinorRev == '0000' then txsz_min = 64-ias; // SMMUv3.1 onwards elsif using_vmsa128 then txsz_min = MAX(8, 64-ias); elsif S2TG == TGx_64KB || (SMMU_IDR5.DS == '1' && DS == '1') then txsz_min = Max(12, 64-ias); else // S2TG is 4KB or 16KB and 52-bit or larger not supported txsz_min = Max(16, 64 - ias); return (s2t0sz < txsz_min || s2t0sz > txsz_max); // Log2NumDCMDQPages() // ================== // Returns log2 of the number of DCMDQ pages for the given security state integer Log2NumDCMDQPages(SecurityState sec_sid) case sec_sid of when SS_NonSecure return UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP); when SS_Secure return UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP); when SS_Realm return UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP); otherwise return 0; // QsidBase() // ========== // Returns the base of StreamID region dedicated for DCMDQs bits(32) QsidBase(SecurityState sec_sid) case sec_sid of when SS_NonSecure return UInt(SMMU_IDR7.QSID_BASE); when SS_Secure return UInt(SMMU_S_IDR7.QSID_BASE); when SS_Realm return UInt(SMMU_R_IDR7.QSID_BASE); otherwise return 0; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 296

Chapter 5. Data structure formats 5.3. L1CD, Level 1 Context Descriptor 5.3 L1CD, Level 1 Context Descriptor The L1CD characteristics are: Purpose Configures the base address of a second level CD table for a range of SubstreamIDs. Attributes L1CD is a 8-byte structure. Field descriptions RES0 63 56 L2Ptr 55 32 L2Ptr 31 12 RES0 11 1 V 0 When stage 1 is enabled and substreams are enabled and two-level Context Descriptor tables are in use (STE.S1Fmt != 0b00), the stage 1 context pointer indicates an array of Level 1 Context Descriptors which contain pointers to Level 2 CD tables. V, bit [0] Valid. V Meaning 0b0 L2Ptr invalid 0b1 L2Ptr valid - CDs are indexed through to the next level table. Bits [11:1] Reserved, RES0. L2Ptr, bits [55:12] Pointer to next-level table. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as zero. The programmed value must be in the range of the IAS if stage 2 is enabled for the stream causing a CD fetch through this descriptor, or in the range of the OAS if stage 2 is not enabled for the stream. See section 3.4.3 Address sizes of SMMU-originated accesses for behavior of addresses beyond IPA or PA address range. Bits [63:56] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 297

Chapter 5. Data structure formats 5.3. L1CD, Level 1 Context Descriptor 5.3.1 General properties of the L1CD If a CD fetch for a transaction with SubstreamID encounters an L1CD with V == 0, L2Ptr is IGNORED, the transaction is terminated with abort and a C_BAD_SUBSTREAMID event is recorded. See the invalidation examples for L1STD in section 5.1 Level 1 Stream Table Descriptor. When an L1CD is changed, the non-leaf form of CMD_CFGI_CD is the minimum scope of invalidation command required to invalidate SMMU caches of the L1CD entry. Depending on the change, other CD invalidations might be required, for example: • Changing an inactive L1CD with V == 0 to an active V == 1 form (introducing a new section of level-2 CD table) requires an invalidation of the L1CD only. Because no CDs were reachable for SubstreamIDs within the span, none require invalidation. A CMD_CFGI_CD can be used with Leaf == 0 and any SubstreamID that matches the L1CD entry. • Changing an active L1CD with V == 1 to an inactive L1CD (decommissioning a span of SubstreamIDs) requires an invalidation of the L1CD as well as invalidation of cached CDs from the affected span. Either multiple non-leaf CMD_CFGI_CD commands, or a wider scope such as CMD_CFGI_CD_ALL, CMD_CFGI_STE or CMD_CFGI_ALL is required. See also the CD notes in Section 5.4.1 CD notes. An L1CD can be cached multiple times for the same reason as a single CD can be cached multiple times if accessed through multiple StreamIDs. This situation requires an invalidation procedure covering multiple StreamIDs. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 298

Chapter 5. Data structure formats 5.4. CD, Context Descriptor 5.4 CD, Context Descriptor The CD characteristics are: Purpose Configuration structure for stage 1 translation containing the base address of the translation tables and information for the translation regime for each of the lower and higher VA ranges. Attributes CD is a 64-byte structure. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 299

Chapter 5. Data structure formats 5.4. CD, Context Descriptor Field descriptions RES0 511 496 PIIP15 495 493 PIIP14 492 490 PIIP13 489 487 PIIP12 486 484 PIIP11 483 481 480 PIIP10 PIIP10 479 478 PIIP9 477 475 PIIP8 474 472 PIIP7 471 469 PIIP6 468 466 PIIP5 465 463 PIIP4 462 460 PIIP3 459 457 PIIP2 456 454 PIIP1 453 451 PIIP0 450 448 RES0 447 432 PIIU15 431 429 PIIU14 428 426 PIIU13 425 423 PIIU12 422 420 PIIU11 419 417 416 PIIU10 PIIU10 415 414 PIIU9 413 411 PIIU8 410 408 PIIU7 407 405 PIIU6 404 402 PIIU5 401 399 PIIU4 398 396 PIIU3 395 393 PIIU2 392 390 PIIU1 389 387 PIIU0 386 384 RES0 383 376 PMG 375 368 PARTID 367 352 IMPLEMENTATION DEFINED 351 320 AMAIR1 319 288 AMAIR0 287 256 MAIR1 255 224 MAIR0 223 192 SKL1 191 190 189 188 PIE 187 DS 186 185 184 TTB1 183 160 HWU160 HWU159 FNG1 RES0 TTB1 159 132 AIE 131 130 129 128 E0PD1 NSCFG1 DisCH1 SKL0 127 126 125 124 123 122 121 120 TTB0 119 96 HWU060 HWU059 EPAN FNG0 MTOp PnCH TTB0 95 68 67 66 65 64 HAFT E0PD0 NSCFG0 DisCH0 ASID 63 48 47 A 46 R 45 S 44 HA 43 HD 42 41 PAN 40 39 38 37 WXN 36 35 IPS 34 32 ASET AA64 TBI1 AFFD UWXN TBI0 V 31 30 SH1 29 28 OR1 27 26 IR1 25 24 TG1 23 22 T1SZ 21 16 15 14 SH0 13 12 OR0 11 10 IR0 9 8 TG0 7 6 T0SZ 5 0 EPD1 ENDI EPD0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 300

Chapter 5. Data structure formats 5.4. CD, Context Descriptor The CD structure contains stage 1 translation table pointers and associated fields (such as ASID and table walk attributes). Translation tables might be interpreted as VMSAv8-32 LPAE, VMSAv8-64 or VMSAv9-128 formats (as controlled by the AA64 field). Invalid or contradictory CD configurations are marked ILLEGAL. A transaction that attempts to translate through a CD containing ILLEGAL configuration is terminated with an abort and a C_BAD_CD event is recorded in the Event queue appropriate to the Security state of the transaction, as determined by SEC_SID. Note: In accordance with Armv8-A [2], the interpretation of the translation table descriptor permissions is a function of the translation table format (from CD.AA64) and the Exception level to which the tables correspond (as determined by the STE StreamWorld). T0SZ, bits [5:0] Size of VA region covered by TTB0. This field is equivalent to TCR_ELx.T0SZ in the A-profile architecture[2]. If CD.AA64 selects VMSAv8-32 LPAE: • This field is 3 bits ([2:0]) and bits [5:3] are IGNORED. • The input region size is calculated the same as in AArch32 TTBCR in the A-profile architecture[2]. • The valid range of values is 0 to 7 inclusive. – Note: All 3-bit values are valid, therefore it is not possible to use an out of range value when CD.AA64 selects VMSAv8-32 LPAE. If CD.AA64 selects VMSAv8-64: • This field is 6 bits and the region size is calculated the same as for TCR_ELx.T0SZ in the A-profile architecture[2]. • If SMMU_IDR3.STT == 0, the maximum valid value is 39. • If SMMU_IDR3.STT == 1, the maximum valid value is: – 48, if the corresponding CD.TGx selects a 4KB or 16KB granule. – 47, if the corresponding CD.TGx selects a 64KB granule. • If SMMU_IDR5.VAX indicates support for 52-bit VAs and either of the following also hold, the minimum permitted value is 12: – The corresponding CD.TGx selects a 64KB granule size. – CD.DS == 1 and the corresponding CD.TGx selects a 4KB or 16KB granule size. Otherwise, the minimum valid value is 16. If CD.AA64 selects VMSAv9-128: • The maximum valid value is: – 48, if CD.TGx selects a 4KB or 16KB granule. – 47, if CD.TGx selects a 64KB granule. • The minimum valid value is: – 8, if SMMU_IDR5.VAX indicates support for 56-bit VAs and StreamWorld is EL3. – 9, if SMMU_IDR5.VAX indicates support for 56-bit VAs and StreamWorld is EL1 or any-EL2-E2H. – 12, if SMMU_IDR5.VAX indicates support for 52-bit VAs. – 16, if SMMU_IDR5.VAX indicates support for 48-bit VAs. Note: VMSAv9-128 is not supported for StreamWorld any-EL2. In implementations of SMMUv3.1 and later, a CD is treated as ILLEGAL if it contains a TxSZ value outside the range of these maximum and minimum values. In SMMUv3.0 implementations, a fetch of a CD containing an out of range value is CONSTRAINED UNPRE- DICTABLE and has one of the following behaviors: • The CD becomes ILLEGAL. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 301

Chapter 5. Data structure formats 5.4. CD, Context Descriptor • The CD is not ILLEGAL and the Effective value used by the translation is 39 if the programmed value is greater than 39, or 16 if the programmed value is less than 16. IGNORED if the Effective value of CD.EPD0 == 1. TG0, bits [7:6] TTB0 Translation Granule size, if CD.AA64 selects VMSAv8-64 or VMSAv9-128. This field is equivalent to TCR_ELx.TG0 in the A-profile architecture[2]. TG0 Meaning 0b00 4KB 0b01 64KB 0b10 16KB 0b11 Reserved This field must only select a granule supported by the SMMU, as indicated by SMMU_IDR5. Use of an unsupported size or Reserved value is ILLEGAL, except this field is IGNORED if the effective value of CD.EPD0 == 1. Note: The different encoding of CD.TG1 to this field is consistent with the Translation System in the A-profile architecture[2]. If CD.AA64 selects VMSAv8-32 LPAE, this field and CD.TG1 are IGNORED. IR0, bits [9:8] Inner region Cacheability for TTB0 access. IR0 Meaning 0b00 Non-cacheable 0b01 Write-back Cacheable, Read-Allocate, Write-Allocate 0b10 Write-through Cacheable, Read-Allocate 0b11 Write-back Cacheable, Read-Allocate, no Write-Allocate The only time that translation table entries are written by the SMMU is when HTTU is in use, and because the read effect of the atomic update might cause read allocation of the affected translation table entry into a data cache, it is IMPLEMENTATION DEFINED as to whether 0b01 and 0b11 differ. Many memory systems might require use of Normal Write-back Cacheable memory for the atomic updates of translation table entries to occur correctly. If HTTU is enabled and this field is configured to 0b00 or 0b10, then it is IMPLEMENTATION DEFINED which of the following behaviors occurs for hardware updates of Access flag and dirty state: • The hardware update occurs correctly as an atomic read-modify-write operation. • The hardware update occurs, but the read-modify-write operation is not guaranteed to be atomic. • The hardware update is attempted but fails and generates an F_WALK_EABT event. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 302

Chapter 5. Data structure formats 5.4. CD, Context Descriptor Arm recommends that software uses 0b01 or 0b11 when HTTU is enabled for this translation table unless the behavior of an implementation is otherwise known. This field is IGNORED if the effective value of CD.EPD0 == 1. OR0, bits [11:10] Outer region Cacheability for TTB0 access. OR0 Meaning 0b00 Non-cacheable 0b01 Write-back Cacheable, Read-Allocate, Write-Allocate 0b10 Write-through Cacheable, Read-Allocate 0b11 Write-back Cacheable, Read-Allocate, no Write-Allocate The behavior of this field is otherwise the same as for CD.IR0. SH0, bits [13:12] Shareability for TTB0 access. SH0 Meaning 0b00 Non-shareable 0b01 Reserved (behaves as 0b00) 0b10 Outer Shareable 0b11 Inner Shareable Note: If both CD.IR0 and CD.OR0 are configured to 0b00, selecting normal Non-cacheable access, the Shareability of TTB0 access is taken to be OSH regardless of the value of this field. IGNORED if the effective value of CD.EPD0 == 1. EPD0, bit [14] TTB0 translation table walk disable. EPD0 Meaning 0b0 Perform translation table walks using TTB0. 0b1 A TLB miss on an address that is translated using TTB0 causes a Translation fault. No translation table walk is performed. CD.T0SZ/CD.TG0/CD.IR0/CD.OR0/CD.SH0/CD.TTB0 are IGNORED. Consistent with translation in the A-profile architecture[2], this field and CD.EPD1 are IGNORED (and their effective value is 0) if this CD is located from an STE with StreamWorld of any-EL2 or EL3. It is only possible for an EL1 (Secure, Non-secure or Realm) or any-EL2-E2H stream to disable translation table walk using this field or CD.EPD1. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 303

Chapter 5. Data structure formats 5.4. CD, Context Descriptor ENDI, bit [15] Translation table endianness. ENDI Meaning 0b0 Little Endian 0b1 Big Endian If the effective values of both CD.EPD0 and CD.EPD1 are 1, this field is IGNORED. Otherwise: If SMMU_IDR0.TTENDIAN == 0b10, it is ILLEGAL to set this field to 1. If SMMU_IDR0.TTENDIAN == 0b11, it is ILLEGAL to set this field to 0. T1SZ, bits [21:16] VA region size covered by TTB1. This field is equivalent to TCR_ELx.T1SZ in the A-profile architecture[2]. This field has the same encoding as CD.T0SZ. IGNORED if the effective value of CD.EPD1 == 1. If StreamWorld == any-EL2 or EL3, this field is RES0. TG1, bits [23:22] TTB1 Translation Granule size. This field is equivalent to TCR_ELx.TG1 in the A-profile architecture[2]. TG1 Meaning 0b00 Reserved 0b01 16KB 0b10 4KB 0b11 64KB This field must only select a granule supported by the SMMU, as indicated by SMMU_IDR5. Use of an unsupported size or Reserved value is ILLEGAL, except this field is IGNORED if the effective value of CD.EPD1 == 1. Note: The different encoding of this field to CD.TG0 is consistent with the Translation System in the A-profile architecture[2]. If StreamWorld == any-EL2 or EL3 this field is RES0, otherwise if CD.AA64 selects VMSAv8-32 LPAE, CD.TG0 and this field are IGNORED. IR1, bits [25:24] Inner region Cacheability for TTB1 access. Same encoding as CD.IR0. IGNORED if the effective value of CD.EPD1 == 1. If StreamWorld == any-EL2 or EL3 this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 304

Chapter 5. Data structure formats 5.4. CD, Context Descriptor OR1, bits [27:26] Outer region Cacheability for TTB1 access. Same encoding as CD.OR0. IGNORED if the effective value of CD.EPD1 == 1. If StreamWorld == any-EL2 or EL3 this field is RES0. SH1, bits [29:28] Shareability for TTB1 access. Same encoding as CD.SH0. IGNORED if the effective value of CD.EPD1 == 1. If StreamWorld == any-EL2 or EL3 this field is RES0. EPD1, bit [30] TTB1 translation table walk disable. Same encoding as CD.EPD0. Affects CD.T1SZ/CD.TG1/CD.IR1/CD.OR1/CD.SH1/CD.TTB1. V, bit [31] CD Valid. V Meaning 0b0 Invalid - use of the CD by an incoming transaction is ILLEGAL 0b1 Valid If this field is 0, the entire rest of the structure is IGNORED. An incoming transaction causing a CD with this field configured to 0 to be located from a valid STE is terminated with an abort and a C_BAD_CD event is recorded. IPS, bits [34:32] Intermediate Physical address Size. This field is equivalent to TCR_ELx.PS in the A-profile architecture[2]. IPS Meaning 0b000 32 bits 0b001 36 bits 0b010 40 bits 0b011 42 bits 0b100 44 bits 0b101 48 bits 0b110 In SMMUv3.0 implementations, this value is Reserved and behaves as 0b101. In implementations of SMMUv3.1 and later, this value selects 52 bits of IPA. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 305

Chapter 5. Data structure formats 5.4. CD, Context Descriptor IPS Meaning 0b111 In SMMUv3.0 implementations, this value is Reserved and behaves as 0b101. In implementations of SMMUv3.1 to SMMUv3.3, this value is Reserved and behaves as 0b110. In implementations of SMMUv3.4 and later, this value selects 56 bits of IPA. Software must not rely on the behavior of Reserved values. Addresses output from the stage 1 translation table walks through either TTBx table base are range-checked against the effective value of this field, causing a stage 1 Address Size fault if out of range. This means that if the output address of any stage 1 translation has non-zero bits above eff_IPS, where eff_IPS is the effective number of IPA bits, an F_ADDR_SIZE is recorded. See section 3.4 Address sizes. This check applies to stage 1 next-level table addresses in Table descriptors, as well as stage 1 output addresses in Block and Page descriptors. If CD.AA64 selects VMSAv8-32 LPAE, IPS is IGNORED and effective stage 1 output address size of 40 bits is always used. This reflects the 40-bit IPA used in VMSAv8-32 LPAE translations. An Address Size fault occurs if the output address bits [47:40] of a VMSAv8-32 LPAE stage 1 translation table descriptor are programmed as non-zero. If CD.AA64 selects VMSAv8-64 or VMSAv9-128: • The effective stage 1 output address size is given by: eff_IPS = MIN(CD.IPS, SMMU_IDR5.OAS); The effective IPS size is capped to the OAS. • Setting this field to any value greater than the cap behaves as though this field equals the cap size. Software must not rely on this behavior. In SMMUv3.0 addresses are limited to 48 bits. If CD.AA64 selects VMSAv8-64, an address of 52 bits in size can only be represented in a descriptor when: • A 64KB granule is in use for that translation table. • CD.DS == 1. An address of 56 bits in size can be represented in a descriptor when CD.AA64 selects VMSAv9-128. Note: In configurations where the effective IPS is larger than the address output from the descriptor, output bits above the address are treated as zero and no Address Size fault can occur. AFFD, bit [35] Access Flag Fault Disable. When HTTU is not in use because HA == 0 or HTTU is not supported, this flag determines the behavior on access of a stage 1 page whose descriptor has AF == 0: AFFD Meaning 0b0 An Access flag fault occurs (behavior controlled by ARS bits) 0b1 An Access flag fault never occurs. The TTD.AF bit is considered to be always 1. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 306

Chapter 5. Data structure formats 5.4. CD, Context Descriptor If HA == 1, this flag is IGNORED. Note: Because AFFD == 1 causes a TTD.AF bit to be considered to be 1, a resulting TLB entry will contain AF == 1. WXN, bit [36] Write Execute Never. This flag controls overall permission of an instruction read to any writable page located using TTB{0,1}: WXN Meaning 0b0 Instruction read is allowed as normal 0b1 Instruction read to writable page raises a Permission fault UWXN, bit [37] Unprivileged Write Execute Never. This flag controls overall permission of a privileged instruction read to a page marked writable for user privilege that is located through TTB{0,1}: UWXN Meaning 0b0 Instruction read is allowed as normal 0b1 Instruction read from user-writable page raises a stage 1 Permission Fault In configurations for which all accesses are considered privileged, for example StreamWorld == any-EL2 or StreamWorld == EL3, this field has no effect and is IGNORED. If CD.AA64 selects VMSAv9-128, this field is RES0. If CD.AA64 selects VMSAv8-64, this field is IGNORED. Note: In VMSAv8-64, all EL0-writable regions are treated as being PXN. TBI0, bit [38] Top Byte Ignore for TTB0. TBIx affects generation of a Translation fault for addresses having VA[63:56] dissimilar to a sign-extension of VA[55] in the same way as TBI in the A-profile architecture[2]. Note: Refer to section 3.9.1 ATS Interface for additional considerations for use of TBI with PCIe ATS. TBI1, bit [39] Top Byte Ignore for TTB1. If StreamWorld == any-EL2 or EL3 this field is RES0. PAN, bit [40] Privileged Access Never. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 307

Chapter 5. Data structure formats 5.4. CD, Context Descriptor When 1, this field disables data read or data write access by privileged transactions to a virtual address where unprivileged access to the virtual address is permitted at stage 1. Note: See the A-profile architecture[2] for information on PAN. Note: When HADx is used, the APTable bits do not affect the permission of a translation. Privileged transactions are those configured through an STE with STE.PRIVCFG == Privileged, or an STE with STE.PRIVCFG == “Use Incoming” and marked as Privileged by the client device. This field is IGNORED when StreamWorld == any-EL2 or StreamWorld == EL3 and PAN is effectively 0. AA64, bit [41] Translation table format for both TTB0 and TTB1. AA64 Meaning Applies when 0b0 Use VMSAv8-32 LPAE descriptor formats. SMMU_IDR0.TTF[0] == 1 0b0 Use VMSAv9-128 descriptor formats. SMMU_IDR5.D128 == 1 0b1 Use VMSAv8-64 descriptor formats. Note: This is consistent with the A-profile architecture[2], where use of 128-bit descriptors is supported for EL2&0 translation regimes but not for EL2 translation regimes. The behavior of this field if SMMU_IDR5.D128 == 1 is equivalent to TCR(2)ELx.D128 in the A-profile architecture[2], with reversed polarity. It is ILLEGAL to select VMSAv8-32 LPAE tables when either: • VMSAv8-32 LPAE tables are not supported (SMMU_IDR0.TTF[0] == 0) • StreamWorld == any-EL2-E2H or S-EL2 or EL3. It is ILLEGAL to select VMSAv8-64 tables when either: • VMSAv8-64 tables are not supported (SMMU_IDR0.TTF[1] == 0) • Stage 2 translates (STE.Config == 0b11x) and STE.S2AA64 selects VMSAv8-32. – Note: Consistent with the VMSA in the A-profile architecture[2], a 64-bit stage 1 is not supported on a 32-bit stage 2. Note: When VMSAv8-64 is selected, the IPS field selects a variable output address size, the translation granule can be altered, HTTU can be enabled and page permissions are interpreted differently, see the other fields for details. It is ILLEGAL to select VMSAv9-128 tables if any of the following are true: • StreamWorld is EL2. Configuring stage 1 to use VMSAv9-128 tables is permitted if StreamWorld is EL2-E2H in the SMMU, as configured in SMMU(*_)CR2.E2H and STE.{Config, STRW}. • STE.S1PIE is 0. This field is permitted to be cached in a TLB. HD, bit [42] Hardware Translation Table Update of Dirty flags for CD.TTB0 and CD.TTB1. See definition of HA. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 308

Chapter 5. Data structure formats 5.4. CD, Context Descriptor HA, bit [43] Hardware Translation Table Update of Access flags for CD.TTB0 and CD.TTB1. When combined with CD.HD as {HD, HA}: • 0b00: HTTU disabled. • 0b01: Update of Access flag enabled. • 0b10: Reserved. If CD.HD == 1 is not ILLEGAL, behaves as though this field is 0 and CD.HD is 0. • 0b11: Update of Access flag and dirty state of the page enabled. These flags are IGNORED if CD.AA64 selects VMSAv8-32 LPAE. Otherwise: • It is ILLEGAL to set HA if SMMU_IDR0.HTTU == 0b00. • It is ILLEGAL to set HD if SMMU_IDR0.HTTU == 0b00 or 0b01. Note: If HTTU is enabled when ORx or IRx indicate Non-cacheable memory, behavior is IMPLEMENTATION DEFINED, see 3.15 Coherency considerations and memory access types. Some systems might only be able to perform atomic updates using normal cacheable memory. Incompatible attributes might cause HTTU not to be performed but system integrity must be maintained as a CD might be under control of a malicious VM. S, bit [44] Stage 1 fault behavior. See section 5.5 Fault configuration (A, R, S bits) for a description of fault configuration. For accesses with PM = 1, this field is treated as 0 for all purposes other than CD validity checks. R, bit [45] Stage 1 fault behavior. See section 5.5 Fault configuration (A, R, S bits) for a description of fault configuration. A, bit [46] Stage 1 fault behavior. See section 5.5 Fault configuration (A, R, S bits) for a description of fault configuration. ASET, bit [47] ASID Set. Selects type for ASID, between sets shared and non-shared with PE ASIDs. This flag affects broadcast TLB invalidation participation and the scope within which Global TLB entries are matched: ASET Meaning 0b0 ASID in shared set: This ASID, and address space described by CD.TTB0 and CD.TTB1, are shared with that of a process on the PE. All matching broadcast invalidation messages will invalidate TLB entries created from this context (where supported and globally enabled), keeping SMMU and PE address spaces synchronized. 0b1 ASID in non-shared set: TLB entries created from this context are not expected to be invalidated by some broadcast invalidations as described in section 3.17 TLB tagging, VMIDs, ASIDs and participation in broadcast TLB maintenance. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 309

Chapter 5. Data structure formats 5.4. CD, Context Descriptor For invalidation by ASID scope such entries require SMMU invalidation commands to be issued. This ASID represents an SMMU-local address space, not shared with PE processes, therefore broadcast invalidation from a coincidentally matching ASID is irrelevant to this address space. Use of ASET == 1 might avoid over-invalidation and improve performance. Note: All other broadcast TLB invalidations, except for those listed here, are expected to affect matching TLB entries created when ASET == 1. For example, TLBI VMALLE1IS must invalidate all TLB entries matching a given VMID, regardless of ASET. ASET must be included in any Global cached translations inserted using a CD reached through an STE with StreamWorld == NS-EL1 or Secure or any-EL2-E2H. In these StreamWorlds, ASET is also intended (but not required) to be included in non-Global translations to allow them to opt-out of broadcast invalidation. Changes to a the ASET of a CD or the ASID, or both, are not automatically reflected in cached translations. Arm recommends that these are subjected to separate TLB maintenance. ASET is permitted to be included in cached translations inserted using a CD reached through an STE with StreamWorld == any EL2 or EL3. ASID, bits [63:48] Address Space Identifier. See ASET field. Tag for TLB entries inserted due to translations from this CD, differentiating them from translations with the same VA from different address spaces. ASID must tag all cached translations inserted using this CD through an STE with StreamWorld == NS-EL1 or Secure or any-EL2-E2H. This field is IGNORED if StreamWorld == any-EL2 or EL3. Otherwise, when an implementation supports only 8-bit ASIDs (SMMU_IDR0.ASID16 == 0), it is ILLEGAL for ASID[15:8] to be non-zero. If 16-bit ASIDs are supported by an implementation, the full ASID[15:0] value is used regardless of CD.AA64. Arm expects that legacy/AArch32 software using 8-bit ASIDs will write zero-extended 8-bit values in the ASID field in this case. NSCFG0, bit [64] Non-secure attribute for the memory associated with the starting-level translation table to which CD.TTB0 points. NSCFG0 Meaning 0b0 Starting-level descriptor of CD.TTB0 is fetched using NS == 0 access 0b1 Starting-level descriptor of CD.TTB0 is fetched using NS == 1 access This field is used only when the CD is reached from a Secure STE and is otherwise IGNORED. Bit [65] When SMMU_IDR5.D128 == 1: DisCH0, bit [65] Disable the Contiguous bit for the initial level of walk for CD.TTB0. This field is equivalent to TCR(2)_ELx.DisCH0 in the A-profile architecture[2]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 310

Chapter 5. Data structure formats 5.4. CD, Context Descriptor DisCH0 Meaning 0b0 No effect on the Contiguous bit. 0b1 The Contiguous bit in Block or Page descriptors at the initial level of walk is treated as 0. The interpretation of this field only applies if CD.AA64 selects VMSAv9-128. If CD.EPD0 is 1, this field is IGNORED. This field is permitted to be cached in a TLB. Otherwise: HAD0, bit [65] Hierarchical Attribute Disable for the CD.TTB0 region. HAD0 Meaning 0b0 Hierarchical attributes are enabled. 0b1 Hierarchical attributes are disabled. The presence of this feature can be determined from SMMU_IDR3.HAD; if SMMU_IDR3.HAD == 0, this field and CD.HAD1 are IGNORED. Otherwise: When this field is 1, the APTable, PXNTable and XNTable/UXNTable fields of table descriptors walked through CD.TTB0 become IGNORED, might be used by software for any purpose and do not affect translation. When StreamWorld == any-EL2 or EL3, this effect includes the APTable[0] and PXNTable bits which are otherwise Reserved by VMSA in these translation regimes. This field and CD.HAD1 are supported for both VMSAv8-32 LPAE and VMSAv8-64 translation tables. E0PD0, bit [66] Disable unprivileged access to addresses translated by CD.TTB0. When an access is prevented by the E0PD mechanism, the event is reported as a Translation Fault, F_TRANSLATION. This field is equivalent to TCR_ELx.E0PD0 in the A-profile architecture[2]. Note: Consistent with FEAT_E0PD in the A-profile architecture[2], Arm expects that the fault should take the same time to generate, whether the address is present in the TLB or not, to mitigate attacks that use fault timing. E0PD only applies to VMSAv8-64 translation regimes with StreamWorld configured as EL1, Secure or any-EL2-E2H. E0PD0 Meaning 0b0 Unprivileged access to any address translated by CD.TTB0 will not generate a fault by this mechanism 0b1 Unprivileged access to any address translated by CD.TTB0 will generate a Translation fault ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 311

Chapter 5. Data structure formats 5.4. CD, Context Descriptor If SMMU_IDR3.E0PD == 0 this field is RES0. If CD.AA64 selects VMSAv8-32 LPAE or if StreamWorld is EL3 or any-EL2, this field is RES0. This field is permitted to be cached in a TLB. HAFT, bit [67] Enable hardware update of Access flag in Table descriptors. HAFT Meaning 0b0 Stage 1 HAFT disabled. 0b1 Stage 1 HAFT enabled. If CD.HA is 0 and not IGNORED, it is ILLEGAL to set this field to 1 and this results in C_BAD_CD. This field is permitted to be cached in a TLB. If SMMU_IDR0.HTTU != 0b11 this field is RES0. TTB0, bits [119:68] In SMMUv3.1 and later, if CD.AA64 selects VMSAv9-128, then bits[119:68] represent the address of the TT0 base, bits[55:4]. Otherwise: • In SMMUv3.1 and later: – Bits[115:68] represent the address of the TT0 base, bits[51:4]. – Bits[119:116] are RES0. • In SMMUv3.0: – Bits[111:68] represent the address of the TT0 base, bits[47:4]. – Bits[119:112] are RES0. Address bits above and below the field range are implied as zero. Bits [(x-1):0] are treated as if all the bits are zero, where x is defined by the required alignment of the translation table as given by the VMSA in the A-profile architecture[2]. Note: The SMMU effectively aligns the value in this field before use. If CD.AA64 selects VMSAv8-64, then a 64-byte minimum alignment on starting-level translation table addresses is imposed when the effective IPS value indicates 52-bit output. In this case bits [5:0] are treated as zero. If CD.AA64 selects VMSAv9-128, then a 32-byte minimum alignment on starting-level translation table addresses is imposed regardless of the effective IPS value. In this case bits [4:0] are treated as zero. If the effective value of CD.EPD0 == 1, this field is IGNORED. Otherwise, it is ILLEGAL for the address in this field to be outside the range described by the CD’s effective IPS value. In addition, it is ILLEGAL for the address in this field to be outside of a 48-bit range when CD.DS == 0, CD.AA64 selects VMSAv8-64 and CD.TG0 selects a granule smaller than 64KB. FNG0, bit [120] When SMMU_IDR3.FNG == 1: Force non-global translations for TTB0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 312

Chapter 5. Data structure formats 5.4. CD, Context Descriptor FNG0 Meaning 0b0 This bit has no effect on the interpretation of the nG bit. 0b1 Translations by TTB0 are treated as non-global regardless of the value of the nG bit. If CD.AA64 selects VMSAv8-32, this field is RES0. If StreamWorld == any-EL2 or EL3, this field is RES0. This field is permitted to be cached in a TLB. Otherwise: Reserved, RES0. MTOp, bit [121] Memory type transformation operator. MTOp Meaning 0b0 Input memory type to stage 1 is replaced with the memory type specified by stage 1. 0b1 Input memory type to stage 1 is combined with the memory type specified by stage 1. If STE.MTCFG == 1 and this field is configured to combine, then STE.MemAttr is combined with the memory type specified by stage 1. If SMMU_IDR3.MTCOMB == 0 this field is RES0 and has no effect. Note: ATOS requests do not supply memory attributes. Therefore, the SMMU constructs and assigns default memory attributes to these requests. See section 13.1.3 Default input attributes. PnCH, bit [122] Stage 1 Protected attribute enable. This field is equivalent to TCR(2)_ELx.PnCH in the A-profile architecture[2]. PnCH Meaning 0b0 Protected attribute disabled. 0b1 Protected attribute enabled. If CD.AA64 selects VMSAv9-128, then this field is RES0. If VMSAv9-128 is selected, the functionality of this field is implicitly enabled, however, the Contiguous bit disable property of this field does not apply. If CD.AA64 selects VMSAv8-32 LPAE, then this field is RES0. If SMMU_IDR3.THE == 0 this field is RES0. See also: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 313

Chapter 5. Data structure formats 5.4. CD, Context Descriptor • 3.27.1 Protected attribute. • 3.27.2 AssuredOnly permission checks. This field is permitted to be cached in a TLB. EPAN, bit [123] Control for Enhanced PAN mechanism. EPAN Meaning 0b0 When CD.PAN == 1, a privileged data access to a page with stage 1 unprivileged data access permission generates F_PERMISSION as a result of the Privileged Access Never mechanism. 0b1 When CD.PAN == 1, a privileged data access to a page with stage 1 unprivileged data or stage 1 unprivileged instruction access permission generates F_PERMISSION as a result of the Privileged Access Never mechanism. Any data access, including speculative accesses, that is prevented by CD.PAN == 1 will not cause allocation into a cache. If any of the following are true this field is RES0: • CD.AA64 selects VMSAv8-32 LPAE. • StreamWorld is any-EL2 or EL3. • Stage 1 permission indirection is enabled. Note: If stage 1 permission indirection is enabled, and CD.PAN is 1, the PAN check behaves as though this field is also 1. See section 3.26.1 Stage 1 permission indirections. If SMMU_IDR3.EPAN == 0 this field is RES0. This field is permitted to be cached in a TLB. HWU059, bit [124] If SMMU_IDR3.PBHA == 1 and CD.HAD0 == 1, this field controls the interpretation of bit [59] of the stage 1 translation table final-level (page or block) descriptor pointed at by CD.TTB0: HWU059 Meaning 0b0 Bit [59] is not interpreted by hardware for an IMPLEMENTATION DEFINED purpose. 0b1 Bit [59] has IMPLEMENTATION DEFINED hardware use. This field is IGNORED when PBHA are not supported (SMMU_IDR3.PBHA == 0) or when CD.HAD0 == 0. If CD.AA64 selects VMSAv9-128, this field is RES0. In SMMUv3.0 this field is RES0. HWU060, bit [125] Similar to CD.HWU059, but affecting descriptor bit [60]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 314

Chapter 5. Data structure formats 5.4. CD, Context Descriptor Bits [127:126] When SMMU_IDR5.D128 == 1: SKL0, bits [127:126] Skip Level configuration for initial lookup for stage 1 translations using TTB0. This field is equivalent to TTBR0_ELx.SKL in the A-profile architecture[2]. SKL0 Meaning 0b00 Skip 0 levels. 0b01 Skip 1 level. 0b10 Skip 2 levels. 0b11 Skip 3 levels. The interpretation of this field only applies if CD.AA64 selects VMSAv9-128. If CD.EPD0 is 1, this field is IGNORED. This field is permitted to be cached in a TLB. Otherwise: HWU0, bits [127:126] HWU062 and HWU061. Similar to CD.HWU059, but affecting descriptor bits [62, 61]. NSCFG1, bit [128] Non-secure attribute for the memory associated with the starting-level translation table to which CD.TTB1 points. See CD.NSCFG0. If StreamWorld == any-EL2 or EL3 this field is RES0. Bit [129] When SMMU_IDR5.D128 == 1: DisCH1, bit [129] Disable the Contiguous bit for the initial level of walk for CD.TTB1. This field is equivalent to TCR(2)_ELx.DisCH1 in the A-profile architecture[2]. DisCH1 Meaning 0b0 No effect on the Contiguous bit. 0b1 The Contiguous bit in Block or Page descriptors at the initial level of walk is treated as 0. The interpretation of this field only applies if CD.AA64 selects VMSAv9-128. If StreamWorld is EL3 or any-EL2, this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 315

Chapter 5. Data structure formats 5.4. CD, Context Descriptor If CD.EPD1 is 1, this field is IGNORED. This field is permitted to be cached in a TLB. Otherwise: HAD1, bit [129] Hierarchical Attribute Disable for the CD.TTB1 region. HAD1 Meaning 0b0 Hierarchical attributes are enabled 0b1 Hierarchical attributes are disabled If SMMU_IDR3.HAD == 1, this field is RES0 if StreamWorld == any-EL2 or EL3. E0PD1, bit [130] Disable unprivileged access to addresses translated by CD.TTB1. When an access is prevented by the E0PD mechanism, the event is reported as a Translation Fault, F_TRANSLATION. This field is equivalent to TCR_ELx.E0PD1 in the A-profile architecture[2]. Note: Consistent with FEAT_E0PD in the A-profile architecture[2], Arm expects that the fault should take the same time to generate, whether the address is present in the TLB or not, to mitigate attacks that use fault timing. E0PD only applies to VMSAv8-64 translation regimes with StreamWorld configured as EL1, Secure or any-EL2-E2H. E0PD1 Meaning 0b0 Unprivileged access to any address translated by CD.TTB1 will not generate a fault by this mechanism 0b1 Unprivileged access to any address translated by CD.TTB1 will generate a Translation fault If SMMU_IDR3.E0PD == 0 this field is RES0. If CD.AA64 selects VMSAv8-32 LPAE or if StreamWorld is EL3 or any-EL2, this field is RES0. This field is permitted to be cached in a TLB. AIE, bit [131] Enable stage 1 attribute extension. AIE Meaning 0b0 Stage 1 attribute extension is disabled. 0b1 Stage 1 attribute extension is enabled. If SMMU_IDR3.AIE is 0, this field is RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 316

Chapter 5. Data structure formats 5.4. CD, Context Descriptor For more information see CD.{MAIR0, MAIR1}. This field is permitted to be cached in a TLB. TTB1, bits [183:132] In SMMUv3.1 and later, if CD.AA64 selects VMSAv9-128, then bits[183:132] represent the address of the TT1 base, bits[55:4]. Otherwise: • In SMMUv3.1 and later: – Bits[179:132] represent the address of the TT1 base, bits[51:4]. – Bits[183:180] are RES0. • In SMMUv3.0: – Bits[175:132] represent the address of the TT1 base, bits[47:4]. – Bits[183:176] are RES0. Address bits above and below the field range are implied as zero. See the notes below about when CD.TTB1 might be valid. Bits [(x-1):0] are treated as if all the bits are zero, where x is defined by the required alignment of the translation table as given by the VMSA in the A-profile architecture[2]. Note: The SMMU effectively aligns the value in this field before use. If CD.AA64 selects VMSAv8-64, then a 64-byte minimum alignment on starting-level translation table addresses is imposed when the effective IPS value indicates 52-bit output. In this case bits [5:0] are treated as zero. If CD.AA64 selects VMSAv8-128, then a 32-byte minimum alignment on starting-level translation table addresses is imposed regardless of the effective IPS value. In this case bits [4:0] are treated as zero. If StreamWorld == any-EL2 or EL3 this field is RES0, otherwise if the effective value of CD.EPD1 == 1, this field is IGNORED. Otherwise, it is ILLEGAL for the address in this field to be outside the range described by the effective IPS value of the CD. In addition, it is ILLEGAL for the address in this field to be outside of a 48-bit range when CD.DS == 0, CD.AA64 selects VMSAv8-64 and CD.TG1 selects a granule smaller than 64KB. FNG1, bit [184] When SMMU_IDR3.FNG == 1: Force non-global translations for TTB1. FNG1 Meaning 0b0 This bit has no effect on the interpretation of the nG bit. 0b1 Translations by TTB1 are treated as non-global regardless of the value of the nG bit. If CD.AA64 selects VMSAv8-32, this field is RES0. If StreamWorld == any-EL2 or EL3, this field is RES0. This field is permitted to be cached in a TLB. Otherwise: Reserved, RES0. Bit [185] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 317

Chapter 5. Data structure formats 5.4. CD, Context Descriptor DS, bit [186] Enable 52-bit input and output address size when using 4KB and 16KB granules. DS Meaning 0b0 52-bit address sizes when using 4KB and 16KB granules disabled. 0b1 52-bit address sizes when using 4KB and 16KB granules enabled. This field affects both the input and output address sizes, as follows: • The effect of this field on the interpretation of stage 1 translation table descriptors is the same as for the TCR_ELx.DS bit as specified in FEAT_LPA2 in the A-profile architecture[2]. • The effect of this field on the determination of whether the CD.TxSZ fields are configured to out-of-range values is the same as for the TCR_ELx.DS bit specified in FEAT_LPA2 in the A-profile architecture[2]. If this field is 1 and CD.TGx selects 4KB or 16KB, then the Shareability attribute for a Cacheable location translated by tables pointed to by CD.TTBx is taken from CD.SHx. If any of the following are true this field is RES0: • SMMU_IDR5.DS == 0. • CD.AA64 selects VMSAv9-128. • CD.AA64 selects VMSAv8-32 LPAE. • StreamWorld == EL1 or EL2-E2H, and both CD.TG0 and CD.TG1 select 64KB. • StreamWorld == EL2 or EL3, and CD.TG0 selects 64KB. PIE, bit [187] Stage 1 permission indirection enable. This field is equivalent to TCR(2)_ELx.PIE in the A-profile architecture[2]. PIE Meaning 0b0 Use permissions directly from stage 1 translation table descriptors. 0b1 Use stage 1 Indirect Permission Scheme. If any of the following conditions are true this field is RES0: • SMMU_IDR3.S1PI is 0. • STE.S1PIE is 0. • CD.AA64 selects VMSAv9-128. Stage 1 permission indirection is implicitly enabled. • CD.AA64 selects VMSAv8-32. Stage 1 permission indirection is not supported. This field is permitted to be cached in a TLB. HWU159, bit [188] If SMMU_IDR3.PBHA == 1 and CD.HAD1 == 1, this field controls the interpretation of bit [59] of the Stage 1 translation table final-level (page or block) descriptor pointed at by CD.TTB1: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 318

Chapter 5. Data structure formats 5.4. CD, Context Descriptor HWU159 Meaning 0b0 Bit [59] is not interpreted by hardware for an IMPLEMENTATION DEFINED purpose. 0b1 Bit [59] has IMPLEMENTATION DEFINED hardware usage. This field is IGNORED when PBHA are not supported (SMMU_IDR3.PBHA == 0) or when CD.HAD1 == 0. In SMMUv3.0 this field is RES0. HWU160, bit [189] Similar to CD.HWU159, but affecting descriptor bit [60]. Bits [191:190] When SMMU_IDR5.D128 == 1: SKL1, bits [191:190] Skip Level configuration for initial lookup for stage 1 translations using TTB1. This field is equivalent to TTBR1_ELx.SKL in the A-profile architecture[2]. SKL1 Meaning 0b00 Skip 0 levels. 0b01 Skip 1 level. 0b10 Skip 2 levels. 0b11 Skip 3 levels. The interpretation of this field only applies if CD.AA64 selects VMSAv9-128. Otherwise behaves the same as CD.SKL0, but for translations using TTB1. If StreamWorld is EL3 or any-EL2, this field is RES0. If CD.EPD1 is 1, this field is IGNORED. This field is permitted to be cached in a TLB. Otherwise: HWU1, bits [191:190] HWU162 and HWU161. Similar to HWU159, but affecting descriptor bits [62, 61]. MAIR0, bits [223:192] Memory Attribute Indirection Register 0, bits[31:0]. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 319

Chapter 5. Data structure formats 5.4. CD, Context Descriptor MAIR1, bits [255:224] Memory Attribute Indirection Register 1, bits[31:0]. Equivalent to the A-profile architecture[2] Memory Attribute Indirection Registers, the MAIR0 and MAIR1 fields are indexed by AttrIndx in descriptors fetched from TTB0 & TTB1 and contain attributes encoded in the same way as in Arm VMSAv8-64 MAIR registers with the following exceptions: All encodings defined as UNPREDICTABLE in VMSAv8-64 are Reserved in this architecture, and behave as follows: Attr[3:0] If Attr[7:4] == 0b0000 If Attr[7:4] != 0b0000 0b0000 Same as VMSAv8-64 Reserved, behaves as Normal-iWT Transient with RW = 0b11 0b00RW where RW != 0b00 Reserved, behaves as Device-nGnRnE Same as VMSAv8-64 0b01RW where RW != 0b00 Reserved, behaves as Device-nGnRE Same as VMSAv8-64 0b10RW where RW != 0b00 Reserved, behaves as Device-nGRE Same as VMSAv8-64 0b11RW where RW != 0b00 Reserved, behaves as Device-GRE Same as VMSAv8-64 Note: The encoding 0b11110000, “Tagged Normal Memory” in the A-profile architecture[2] is not supported in SMMUv3. MAIR, as referenced in the table below, is the concatenation of {CD.MAIR1, CD.MAIR0} as a 64-bit value. If SMMU_IDR3.AIE is 0 or CD.AIE is 0, then MAIR is indexed by AttrIndx[2:0] from stage 1 Block or Page descriptors. If SMMU_IDR3.AIE is 1 and CD.AIE is 1 then MAIR is indexed by AttrIndx[3:0] as follows: AttrIndx[3:0] MAIR output 7 >= x >= 0 Bits [(8x)+7 : 8x] x>7 Bits [63:56] Consistent with the A-profile architecture[2], AttrIndx[3] is derived as follows: • If CD.AA64 selects VMSAv8-64, then AttrIndx[3] is bit [59] of Block and Page descriptors. • If CD.AA64 selects VMSAv9-128, then AttrIndx[3] is bit [5] of Block and Page descriptors. AMAIR0, bits [287:256] Auxiliary Memory Attribute Indirection Register 0, bits[31:0]. AMAIR1, bits [319:288] Auxiliary Memory Attribute Indirection Register 1, bits[31:0]. Equivalent to PE Auxiliary Memory Attribute Indirection Registers. The content of the AMAIR{1,0} fields is IMPLEMENTATION DEFINED and might enable extended functionality. If software has no IMPLEMENTATION SPECIFIC knowledge it must set the AMAIR{1,0} fields to zero. An implementation must remain compatible with generic driver software by maintaining correct behavior when the AMAIR is set to zero. If SMMU_IDR3.AIE is 0 or CD.AIE is 0, then in a typical implementation, the AMAIR{1,0} fields are split into eight one-byte fields indexed by the AttrIndx[2:0] field from stage 1 Block or Page descriptors but this is not required. If SMMU_IDR3.AIE is 1 and CD.AIE is 1 then AMAIR is indexed by AttrIndx[3:0] from stage 1 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 320

Chapter 5. Data structure formats 5.4. CD, Context Descriptor Block or Page descriptors as follows: Note: AMAIR, as referenced in the table below, is the concatenation of {CD.AMAIR1, CD.AMAIR0} as a 64-bit value. AttrIndx[3:0] AMAIR output 7 >= x >= 0 Bits [(8x)+7 : 8x] x>7 Bits [63:56] Consistent with the A-profile architecture[2], AttrIndx[3] is derived as follows: • If CD.AA64 selects VMSAv8-64, then AttrIndx[3] is bit [59] of Block and Page descriptors. • If CD.AA64 selects VMSAv9-128, then AttrIndx[3] is bit [5] of Block and Page descriptors. IMPLEMENTATION DEFINED, bits [351:320] IMPLEMENTATION DEFINED, for example QoS, allocation, or transient hints for translation table access. PARTID, bits [367:352] MPAM Partition ID. If MPAM is not supported in the corresponding Security state, or if STE.S1MPAM == 0, this field is RES0. Otherwise: When STE.Config == 0b111 and STE.S1MPAM == 1, PARTID[4:0] is the 5-bit virtual PARTID used for client transactions. Bits [15:5] are RES0. The virtual ID is translated to a physical ID using the VMS.PARTID_MAP structure. When STE.Config == 0b101 and STE.S1MPAM == 1, this field is the physical PARTID used for client transactions. In this configuration, this field is interpreted as having an UNKNOWN value if it is configured with a value greater than the corresponding SMMU_()MPAMIDR.PARTID_MAX. The corresponding SMMU()MPAMIDR.PARTID_MAX is chosen as follows: • For a Non-secure Stream, then SMMU_MPAMIDR.PMG_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0 or STE.MPAM_NS == 0, then SMMU_S_MPAMIDR.PMG_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and STE.MPAM_NS == 1, then SMMU_MPAMIDR.PMG_MAX. See Chapter 17 Memory System Resource Partitioning and Monitoring for more information on use of this field. PMG, bits [375:368] MPAM Performance Monitor Group. If MPAM is not supported in the corresponding Security state or if STE.S1MPAM == 0, this field is RES0. This field is interpreted as having an UNKNOWN value if it is configured with a value greater than the corresponding SMMU()MPAMIDR.PMG_MAX. The corresponding SMMU(_)MPAMIDR.PMG_MAX is chosen as follows: • For a Non-secure Stream, then SMMU_MPAMIDR.PMG_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0 or STE.MPAM_NS == 0, then SMMU_S_MPAMIDR.PMG_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and STE.MPAM_NS == 1, then SMMU_MPAMIDR.PMG_MAX. See Chapter 17 Memory System Resource Partitioning and Monitoring for more information on use of this field. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 321

Chapter 5. Data structure formats 5.4. CD, Context Descriptor Bits [383:376] Reserved, RES0. PIIU

, bits [3p+386:3p+384], for p = 15 to 0 The set of 16 stage 1 Unprivileged base permission interpretations. This field is indexed by the PIIndex value derived from a stage 1 Block or Page descriptor, as PIIU[(PIIndex3)+2 : PIIndex3], to give a permission interpretation. PIIU

Meaning 0b000 No Access. 0b001 Read-only. 0b010 Execute-only. 0b011 Read-execute. 0b101 Read-write. 0b111 Read-write-execute. All other values are reserved, and treated as C_BAD_CD. If StreamWorld is EL3 or any-EL2, this field is RES0. Note: The encoding of this field is different from the encoding of the Perm field in the PIRE0_ELx registers in the A-profile architecture[2]. If stage 1 permission indirection is disabled, this field is RES0. This field is permitted to be cached in a TLB. Bits [447:432] Reserved, RES0. PIIP

, bits [3p+450:3p+448], for p = 15 to 0 The set of 16 stage 1 Privileged base permission interpretations. This field is indexed by the PIIndex value derived from a stage 1 Block or Page descriptor, as PIIP[(PIIndex3)+2 : PIIndex3], to give a permission interpretation. PIIP

Meaning 0b000 No Access. 0b001 Read-only. 0b010 Execute-only. 0b011 Read-execute. 0b101 Read-write. 0b111 Read-write-execute. All other values are reserved, and treated as C_BAD_CD. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 322

Chapter 5. Data structure formats 5.4. CD, Context Descriptor If PIIP[x] grants Privileged execute permission, and CD.PIIU[x] is not RES0 and grants Unprivileged write permission, this is ILLEGAL and results in C_BAD_CD. Note: The encoding of this field is different from the encoding of the Perm field in the PIR_ELx registers in the A-profile architecture[2]. If stage 1 permission indirection is disabled, this field is RES0. This field is permitted to be cached in a TLB. Bits [511:496] Reserved, RES0. 5.4.1 CD notes Note: Consistent with Armv8.1 [2] PE translation, translation table descriptor bits APTable, PXNTable and UXNTable control hierarchical permission attributes for lower levels of translation table walks. Not all systems use this feature, so the CD Hierarchical Attribute Disable flags allow translation table walks using TTB0 and TTB1 to be performed ignoring these bits. Software is then free to use the APTable, PXNTable and UXNTable fields for other purposes. When a CD is used from a stream configured with StreamWorld == any-EL2 or EL3 (but not any-EL2-E2H): • Only one translation table is supported (TTB0) and TTB1 is unreachable. • ASID is IGNORED. When TTB1 is unreachable: • The following fields become RES0: TTB1, TBI[1], TG1, SH1, OR1, IR1, T1SZ, HAD1, NSCFG1. • T0SZ must cover the required VA input space A CD must only be configured to be located through a set of multiple STEs when all STEs in the set configure an identical Exception level (given by the STE StreamWorld). Note: For example, one STE configuring a stream as NS-EL2 and another STE configuring a stream as NS-EL1 must not both share the same CD as, in this configuration, TTB1 is both enabled and unused depending on the StreamID that locates the CD. Similarly, a CD with AA64 == 0 is ILLEGAL if reached from an STE with StreamWorld == any-EL2-E2H but not if reached from an STE with StreamWorld == NS-EL1 or Secure. The legality of a CD is, in part, affected by following properties of the STE used to locate the CD: • StreamWorld. • S1STALLD. • AA64 and Config[1] (to detect VMSAv8-32 LPAE stage 2 translation). When a CD is reached from an STE whose state causes the CD to be considered ILLEGAL, C_BAD_CD is raised and the transaction causing the configuration lookup is terminated with an abort. When using the Direct Permission Scheme at stage 1, the interpretation of the lower bit of the translation table descriptor AP[2:1] field changes depending on the translation regime under which the table is walked, Translation tables located from STEs with StreamWorld == any-EL2 or EL3 are under EL2 or EL3 AArch64 state ownership and, consistent with Armv8-A PEs, the AP[1] bit (of AP[2:1]) is ignored and treated as 1, see section 13.4.1 Stage 1 page permissions. Depending on the presentation of an address to the SMMU, TTB1 might never be selected in some implementations, see section 3.4.1 Input address size and Virtual Address size for details. In Armv8-A, an inconsistency between TTBRx and IPS is reported as an Address Size fault. A CD TTBx address outside the range of IPS makes the CD ILLEGAL, recording a C_BAD_CD error. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 323

Chapter 5. Data structure formats 5.4. CD, Context Descriptor A CD or L1CD that is successfully fetched might be cached in any state, therefore any modification, commissioning or decommissioning of a CD must be followed by a CMD_CFGI_CD command to make the modification visible to the SMMU. A failed fetch (F_CD_FETCH, or a stage 2 fault where CLASS == CD) does not cause a CD or L1CD to be cached. The translation table walks performed from TTB0 or TTB1 are always performed in IPA space if stage 2 translations are enabled (STE.Config == 0b11x). If stage 2 translations are not enabled (or if the SMMU does not implement stage 2), translation table walks are always performed in PA space. CDs are fetched from IPA space if stage 2 translations are enabled, otherwise they are fetched from PA space. Note: This enables a hypervisor to point directly to guest-managed CD structures and translation tables. The following CD fields are permitted to be cached as part of a translation or TLB entry, and alteration requires invalidation of any TLB entry that might have cached these fields, in addition to CD structure cache invalidation: • HAD{0,1}. • AFFD. • ASID+ASET (affect tagging of TLB entries, so a change may not require old entries to be invalidated). • MAIR. • AMAIR. • EPD{0,1}. • TTB{0,1}. • T{0,1}SZ. • OR{0,1}. • IR{0,1}. • SH{0,1}. • ENDI. • TG{0,1}. • HA, HD. • WXN, UWXN. • AA64. • TBI. • IPS. • NSCFG{0,1}. • PAN. • EPAN. • PnCH. • PIE. • PIIP. • PIIU. • DisCH0. • DisCH1. • SKL0. • SKL1. • AIE. • HAFT. • FNG{0,1}. Alteration of the remaining fields of the CD does not require an explicit invalidation of any structure other than the CD itself: • A,R,S The PARTID and PMG fields are not permitted to be cached in a TLB entry and these fields are permitted to differ between CDs having the same ASID value within the same VMID. Note: Changes to IMPLEMENTATION DEFINED fields might have IMPLEMENTATION DEFINED invalidation requirements. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 324

Chapter 5. Data structure formats 5.4. CD, Context Descriptor When cached in an SMMU, a CD is uniquely identified by the tuple {StreamID, SubstreamID} including the qualification of StreamID by SEC_SID. This means that: • Multiple CDs are distinguished by StreamID, so CDs located from the same SubstreamID index but through different StreamIDs are considered separate and can contain different configuration: – Note: Different devices (StreamIDs) might therefore use the same SubstreamID value to associate transactions with different process address spaces in an OS. The SubstreamID namespace is local to the StreamID. • A common CD (or CD table) shared by different STEs is permitted to be cached as multiple entries that are specific to each possible {StreamID, SubstreamID} combination. – A change to such a CD requires invalidation of the CD cache. When CMD_CFGI_CD(_ALL) is used, it must be issued multiple times for every {StreamID, SubstreamID} combination that the CD is reachable from. – Note: The SMMU might prefetch a reachable structure, so even if a CD was not accessed by a transaction with a particular StreamID, it might have been prefetched through the STE of that stream, so must still be invalidated using that StreamID. It might arise that multiple CDs represent the same address space (therefore TLB entries), as identified by a combination of Security state, StreamWorld or translation regime, VMID tag (if relevant) and ASID tag (if relevant). This can happen in any of the following (non-exhaustive list of) cases: • Several STEs with StreamWorld == Secure each point to their own CD that contains a common ASID value – Secure translation regime differentiates address spaces by ASID (but not VMID). • Several STEs with StreamWorld == NS-EL1 contain a common VMID. Each STE points to its own CD that contains a common ASID value: – NS-EL1 differentiates address spaces by ASID and VMID. • An STE with StreamWorld == any-EL2 points to a table of more than one CD. – EL2 has no ASIDs, therefore multiple CDs represent the same (single) set of translations. • An STE with StreamWorld == any-EL2-E2H points to a CD table where some entries use the same ASID value: – EL2-E2H differentiates address spaces by ASID only. If multiple CDs exist in the same translation regime representing the same address space, any of these CDs can insert TLB entries matching lookup in that address space. All such CDs are considered interchangeable by the SMMU and must contain identical configuration for fields that are permitted to be cacheable as part of a TLB entry. Note: The EL2 and EL3 translation regimes do not differentiate address spaces by ASID, therefore all CDs referenced from STEs having StreamWorld any-EL2 or EL3 must be identical for fields permitted to be cacheable in a TLB. This includes tables of multiple CDs referenced from one STE, or CDs referenced one to one from an STE. It is not expected that SubstreamIDs (therefore a CD table with multiple entries) will be used with STEs configured for any-EL2 or EL3 StreamWorlds. If a software error causes two CDs representing the same address space to differ, the result of a TLB lookup for that address space is UNPREDICTABLE. The SMMU must not allow such an error to provide device access to memory locations outside of the Security state of the stream, or that would not otherwise have been accessible given a stage 2 configuration, if present. Note: Fields permitted to be cached as part of a TLB entry modify the properties of the TLB entry. A difference in CD configuration can cause TLB entries to be cached with different properties in the same address space. It would be UNPREDICTABLE as to which CD inserted a given TLB entry, therefore the properties returned by a general TLB lookup become UNPREDICTABLE. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 325

Chapter 5. Data structure formats 5.4. CD, Context Descriptor 5.4.1.1 EPDx behavior The CD EPD0 and EPD1 fields disable translation configuration related to TTB0 and TTB1, respectively. Validity checks are not performed on fields that are disabled or IGNORED by CD.EPDx. This table shows interaction of CD.TxSZ with EPDx and incoming addresses that select TTB0 or TTB1 translation configuration: Virtual Address (VMSAv8-64 example shown) Effective EPD0 Effective EPD1 T0SZ T1SZ Result 0xFFFFXXXXXXXXXXXX 0 0 Valid Valid Translates through TTB1 0x0000XXXXXXXXXXXX 0 0 Valid Valid Translates through TTB0 0xFFFFXXXXXXXXXXXX 0 0 X Invalid(1) C_BAD_CD 0x0000XXXXXXXXXXXX 0 0 X Invalid(1) C_BAD_CD 0xFFFFXXXXXXXXXXXX 0 0 Invalid(1) X C_BAD_CD 0x0000XXXXXXXXXXXX 0 0 Invalid(1) X C_BAD_CD 0xFFFFXXXXXXXXXXXX 0 1 Valid X TLB miss causes F_TRANSLATION (translation through TTB1 is disabled) 0x0000XXXXXXXXXXXX 0 1 Valid X Translates through TTB0 0xFFFFXXXXXXXXXXXX 0 1 Invalid(1) X C_BAD_CD 0x0000XXXXXXXXXXXX 0 1 Invalid(1) X C_BAD_CD 0xFFFFXXXXXXXXXXXX 1 0 X Valid Translates through TTB1 0x0000XXXXXXXXXXXX 1 0 X Valid TLB miss causes F_TRANSLATION (translation through TTB1 is disabled) 0xFFFFXXXXXXXXXXXX 1 0 X Invalid(1) C_BAD_CD 0x0000XXXXXXXXXXXX 1 0 X Invalid(1) C_BAD_CD • The high-order bits or bits of the VA determine whether TTB0 or TTB1 is selected, according to the A-profile architecture[2]. • In the cases marked (1), TxSZ is shown as being an invalid value and the SMMU treating this as making the CD ILLEGAL, for the purposes of illustration. See CD.T0SZ, this is one of the CONSTRAINED UNPREDICTABLE behaviors for an out-of-range TxSZ. • EPDx == 1 causes TxSZ to be IGNORED and an invalid TxSZ value (or an invalid TTBx or TGx value) does not lead to C_BAD_CD. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 326

Chapter 5. Data structure formats 5.4. CD, Context Descriptor • When EPDx == 1, a translation table walk through TTBx causes F_TRANSLATION. – Note: The A-profile architecture[2] allows a TLB hit to occur for an input address associated with an EPD bit set to 1, but the translation table walk is disabled upon miss. 5.4.2 Validity of CD The following function indicates whether a CD is considered valid or ILLEGAL, for the purposes of determining a configuration error (C_BAD_CD). Subsequent checks must be performed as part of the translation process and further faults might arise, but these are unrelated to the validity of configuration structures. // CdIllegal() // =========== // Returns TRUE if CD is considered ILLEGAL // Returns FALSE otherwise boolean CdIllegal(STE_t STE, CD_t CD, bits(2) SEC_SID) // Intermediate values SecurityState sec_sid = DecodeSecSid(SEC_SID); STE_StreamWorld ste_streamworld = SteStreamWorld(STE.Config, STE.STRW, SEC_SID); boolean n_transl_cfg0 = EffectiveCDEPD0(CD.EPD0, ste_streamworld); boolean n_transl_cfg1 = EffectiveCDEPD1(CD.EPD1, ste_streamworld); TGx tg0 = TG0(CD.TG0); TGx tg1 = TG1(CD.TG1); integer ipa_range = CalcPARange(CD.IPS, CD.AA64); boolean using_vmsa32 = SMMU_IDR5.D128 == '0' && CD.AA64 == '0'; boolean using_vmsa64 = CD.AA64 == '1'; boolean using_vmsa128 = SMMU_IDR5.D128 == '1' && CD.AA64 == '0'; bits(2) stall_model; case sec_sid of when SS_NonSecure stall_model = EffectiveSMMU_IDR0_STALL_MODEL(); when SS_Secure stall_model = SMMU_S_IDR0.STALL_MODEL; when SS_Realm stall_model = SMMU_R_IDR0.STALL_MODEL; boolean constr_unpred_TxSZ_or_illegal; if SMMU_AIDR.ArchMajorRev == '0000' && SMMU_AIDR.ArchMinorRev == '0000' then constr_unpred_TxSZ_or_illegal = ConstrainUnpredictableBool(Unpredictable_CD_TxSZ); else // In SMMUv3.1 and later, these cases are always ILLEGAL constr_unpred_TxSZ_or_illegal = TRUE; if CD.V == '0' then // CD is ILLEGAL if not valid return TRUE; if STE.S1STALLD == '1' && CD.S == '1' then // Stalls disabled for the stream but enabled for the CD return TRUE; if SMMU_IDR0.TERM_MODEL == '1' && CD.A == '0' then // Terminating a transaction with RAZ/WI behavior is not supported, // CD.A must be 1. return TRUE; if stall_model == '01' && CD.S == '1' then // Stall is not supported, but CD.S ==1 return TRUE; if stall_model == '10' && CD.S == '0' then // Stall is forced, but CD.S == 0 return TRUE; // Check CD.ENDI if (!n_transl_cfg0 || !n_transl_cfg1) && // CD.ENDI is not IGNORED ((SMMU_IDR0.TTENDIAN == '10' && CD.ENDI == '1') || (SMMU_IDR0.TTENDIAN == '11' && CD.ENDI == '0')) then // Endianess of CD doesn't match system supported endianess return TRUE; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 327

Chapter 5. Data structure formats 5.4. CD, Context Descriptor // Check CD.AA64 // AArch32 tables not supported by system or the above StreamWorlds if using_vmsa32 && ((SMMU_IDR0.TTF == 'x0') || ste_streamworld IN {STE_StreamWorld_EL3, STE_StreamWorld_any_EL2_E2H}) then return TRUE; // VMSAv8-32 LPAE tables are not supported for S-EL2 StreamWorld if sec_sid == SS_Secure && ste_streamworld == STE_StreamWorld_any_EL2 && using_vmsa32 then assert SMMU_S_IDR1.SEL2 == '1'; return TRUE; // AArch64 tables not supported by system or the STE if using_vmsa64 && ((SMMU_IDR0.TTF == '0x') || (STE.Config == '11x' && STE.S2AA64 == '0' && SMMU_IDR5.D128 == '0')) then return TRUE; // Check CD.HA, CD.HD, CD.HAFT if !using_vmsa32 && // The following conditions are ILLEGAL when VMSAv8-64 or // when VMSAv9-128 are used. // No flag updates supported, but CD wants to update flag (((CD.HA == '1' || CD.HD == '1') && (SMMU_IDR0.HTTU == '00')) || // Only access flag update suppported, but CD updates dirty flag (CD.HD == '1' && SMMU_IDR0.HTTU == '01') || // Hardware update of AF in Table descriptors is supported and enabled, // but update of AF in leaf descriptors is not enabled (SMMU_IDR0.HTTU == '11' && CD.HAFT == '1' && CD.HA == '0')) then return TRUE; // Check CD.ASID. // While in one of the following SteamWorlds, // and the system only supports 8-bit ASIDs, if the CD.ASID field // is non-zero for the 8 MSBs, the CD is ILLEGAL if ste_streamworld IN { STE_StreamWorld_NS_EL1, STE_StreamWorld_Secure, STE_StreamWorld_Realm_EL1, STE_StreamWorld_any_EL2_E2H } && SMMU_IDR0.ASID16 == '0' && CD.ASID<15:8> != '00000000' then return TRUE; // Check CD.TxSZ if (!using_vmsa32 && constr_unpred_TxSZ_or_illegal) && ((!n_transl_cfg0 && CDTxSZInvalid(ste_streamworld, using_vmsa128, CD.DS, CD.T0SZ, tg0)) || (!n_transl_cfg1 && CDTxSZInvalid(ste_streamworld, using_vmsa128, CD.DS, CD.T1SZ, tg1))) then return TRUE; // Check CD.TTBx if !n_transl_cfg0 && ((!using_vmsa32 && !GranuleSupported(tg0)) || CDTTBxOutOfRange(CD.TTB0, CDTTBxValidRange(using_vmsa128, CD.DS, tg0, ipa_range))) then return TRUE; if !n_transl_cfg1 && ((!using_vmsa32 && !GranuleSupported(tg1)) || CDTTBxOutOfRange(CD.TTB1, CDTTBxValidRange(using_vmsa128, CD.DS, tg1, ipa_range))) then return TRUE; // Check VMSAv9-128 if using_vmsa128 then if STE.S1PIE == '0' then // CD uses VMSAv9-128, but STE disables use of permission indirection return TRUE; if ste_streamworld == STE_StreamWorld_any_EL2 then // CD uses VMSAv9-128, but STE selects Stream World EL2 return TRUE; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 328

Chapter 5. Data structure formats 5.4. CD, Context Descriptor if ((!n_transl_cfg0 && CDSLInvalidD128(CD.SKL0, CD.T0SZ, tg0)) || (!n_transl_cfg1 && CDSLInvalidD128(CD.SKL1, CD.T1SZ, tg1))) then // CD configured the start level of translation to an invalid value return TRUE; // Check CD.{PIIP,PIIU} (permission indirection) if ((using_vmsa64 && SMMU_IDR3.S1PI == '1' && STE.S1PIE == '1' && CD.PIE == '1') || using_vmsa128) then for i = 0 to 15 if CD.PIIP<(i3)+:3> IN { '100','110' } then // Stage 1 permission indirection is enabled, // but PIIP contains a Reserved encoding return TRUE; // If the stream world supports unprivileged transactions, check PIIU if ste_streamworld IN { STE_StreamWorld_any_EL2_E2H, STE_StreamWorld_NS_EL1, STE_StreamWorld_Realm_EL1, STE_StreamWorld_Secure } then if CD.PIIU<(i3)+:3> IN { '100','110' } then // Stage 1 permission indirection is enabled, // but PIIU contains a Reserved encoding return TRUE; if CD.PIIP<(i3)+:3> == 'x1x' && CD.PIIU<(i3)+:3> == '1xx' then // Permitting execution by privileged transactions while also permitting // writes by unprivileged transactions is ILLEGAL return TRUE; // CD is not ILLEGAL return FALSE; // CDTxSZInvalid() // =============== // Returns TRUE if TxSZ is outside the valid range // when stage 1 is using VMSAv8-64 or VMSAv9-128 // Returns FALSE otherwise boolean CDTxSZInvalid(STE_StreamWorld ste_streamworld, boolean using_vmsa128, bit DS, bits(6) TxSZ, TGx TG) integer txsz_min, txsz_max; integer txsz = UInt(TxSZ); // Find txsz_max if SMMU_IDR3.STT == '1' && TG IN {TGx_4KB, TGx_16KB} then // Small translation table supported txsz_max = 48; elsif SMMU_IDR3.STT == '1' then // Small translation table supported but TG NOT IN {4KB, 16KB} txsz_max = 47; else // Small translation table not supported txsz_max = 39; // find txsz_min if SMMU_IDR5.VAX == '10' then if using_vmsa128 then // VMSAv9-128 can use up to 56-bit VAs if ste_streamworld == STE_StreamWorld_EL3 then txsz_min = 8; else txsz_min = 9; elsif TG == TGx_64KB || (SMMU_IDR5.DS == '1' && DS == '1') then // VMSAv8-64 can use up to 52-bit VAs in certain configurations txsz_min = 12; else // Other VMSAv8-64 configurations can only use up to 48-bit VAs txsz_min = 16; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 329

Chapter 5. Data structure formats 5.4. CD, Context Descriptor elsif SMMU_IDR5.VAX == '01' then if TG == TGx_64KB || (SMMU_IDR5.DS == '1' && DS == '1') || using_vmsa128 then // VMSAv8-64 can use up to 52-bit VAs in certain configurations // VMSAv9-128 can use up to 56-bit VAs, but only 52-bit VAs are implemented txsz_min = 12; else // Other VMSAv8-64 configurations can only use up to 48-bit VAs txsz_min = 16; else // Only 48-bit VAs are implemented txsz_min = 16; return (txsz < txsz_min || txsz > txsz_max); // CDSLInvalidD128() // ================= // Returns TRUE if start level is invalid when using VMSAv9-128 // Returns FALSE otherwise boolean CDSLInvalidD128(bits(2) SKL, bits(6) TxSZ, TGx TG) integer iasize = 64 - UInt(TxSZ); integer granulebits = TGSize(TG); integer stride = granulebits - 4; integer startlevel = 3 - (((iasize-1) - granulebits) DIV stride); return startlevel + UInt(SKL) > 3; ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 330

Chapter 5. Data structure formats 5.5. Fault configuration (A, R, S bits) 5.5 Fault configuration (A, R, S bits) The STE contains fault configuration for faults derived from stage 2 translations (S2R, S2S) and the CD contains fault configuration for faults derived from stage 1 translations (A, R, S). A applies to CD.A, R applies to STE.S2R and CD.R, S applies to STE.S2S and CD.S. The A, R and S flags control fault behavior for transactions experiencing the following Translation-related faults during stage1 or stage 2 translation, see section 3.12 Fault models, recording and reporting: • F_TRANSLATION. • F_ACCESS. • F_ADDR_SIZE. • F_PERMISSION. Transactions are terminated with an abort if they encounter any other fault or configuration error and attempt to record an event in the relevant Event queue. This case is unaffected by the A, R and S flags. When a transaction encounters one of the four Translation-related faults, it might be immediately terminated or stalled (in which case it is later retried, or terminated, according to software command). The following flags are used to configure fault behavior: A Abort behavior upon transaction termination When set and a transaction experiencing one of the faults listed in this section is terminated, an abort or bus error is returned to the client device. When clear, such a transaction is completed successfully with RAZ/WI behavior so that the client does not receive an error condition. This configuration exists only for stage 1. The termination behavior of stage 2 is abort, as though an implied A == 1. An SMMU might only implement abort termination (with no RAZ/WI support) and indicate this behavior through the SMMU_IDR0.TERM_MODEL flag. For these implementations, configuring CD.A == 0 renders the CD ILLEGAL. The A flag has no effect on faults arising from ATS Translation Requests, which do not support RAZ/WI behavior. R Record event When set, the detection of the fault is recorded in the Event queue. When clear, the fault record is suppressed. This field only suppresses a fault record if S == 0 and if the fault is of one of the four Translation-related faults. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 331

Chapter 5. Data structure formats 5.5. Fault configuration (A, R, S bits) S Stall upon fault When set, an incoming transaction experiencing one of the four Translation-related faults is stalled. No response is given to the transaction until software issues a resume or terminate command, whereupon the transaction is either retried or terminated. The stall is always reported and the R bit is ignored. Configuration or faults not arising during stage 1 or stage 2 translation cause the transaction to be terminated, regardless of the setting of this bit. When clear, an incoming transaction experiencing a fault is terminated immediately in a manner according to A. The CD.S flag has no effect on Translation-related faults arising from ATS Translation Requests, for which a R == W == 0 response is given, see section 3.9.1 ATS interface. Some implementations might not support stalling of eligible transactions and immediately terminate the transaction (with behavior determined by the A bit). Other implementations might not support immediate termination of transactions (that fault in a manner eligible to stall). Such implementations indicate these behaviors through the SMMU_(S_)IDR0.STALL_MODEL field. When stage 1 translation is enabled (STE.Config[0] == 1), an STE is considered ILLEGAL if: • SMMU_(S_)IDR0.STALL_MODEL != 0b00 and STE.S1STALLD == 1. A CD (Stage 1 translation enabled) is considered ILLEGAL if one of the following applies: • SMMU_(S_)IDR0.STALL_MODEL == 0b00 and STE.S1STALLD == 1 and CD.S == 1. • SMMU_(S_)IDR0.STALL_MODEL == 0b01 and CD.S == 1. • SMMU_(S_)IDR0.STALL_MODEL == 0b10 and CD.S == 0. When stage 2 translation is enabled (STE.Config[1] == 1), an STE is considered ILLEGAL if one of the following applies: • SMMU_(S_)IDR0.STALL_MODEL == 0b01 and STE.S2S == 1. • SMMU_(S_)IDR0.STALL_MODEL == 0b10 and STE.S2S == 0. • Note: If SMMU_S_IDR1.SEL2 == 0, Stage 2-enabled STEs cannot also be Secure. When STE.S1STALLD == 1, STE.Config[0] == 1, and SMMU_R_IDR0.STALL_MODEL == 0b01, this is ILLEGAL for the Realm programming interface and results in C_BAD_STE. When STE.S2S == 1, STE.Config[1] == 1, and SMMU_R_IDR0.STALL_MODEL == 0b01, this is ILLEGAL for the Realm programming interface and results in C_BAD_STE. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 332

Chapter 5. Data structure formats 5.5. Fault configuration (A, R, S bits) Fault detected Stall configured? Record fault event Software fixup Report configured? Y Y N Terminate with abort Terminate RAZ/WI Abort configured? N Y N Record fault event Y RESUME or STALL_TERM Retry transaction afresh Retry Terminate Translation- related fault N Record fault event Resume abort parameter Abt RAZ/WI Translation, Permission, AccessFlag or AddressSize fault Figure 5.1: Fault configuration flow These flags can be used, in the following combinations, to affect transactions experiencing one of the four Translation-related faults: ARS 0b000 Silently terminate transactions at the SMMU, with writes acknowledged successfully and reads returning zero, RAZ/WI. 0b010 Terminate transactions at the SMMU in a RAZ/WI manner, but record fault event as well. 0bxx1 Stall transaction and record fault event. In this case, the effective value of R is assumed to be 1 so that it is impossible for transactions to stall without an event being recorded. Only the stalled transaction is held and subsequent non-faulting transactions in the same stream or substream might complete (subject to interconnect ordering rules) before the stall is resolved, see section 3.12.2 Stall model. Later receipt of a CMD_RESUME or CMD_STALL_TERM ensures that the transaction will be retried or terminated (with termination behavior given by the CMD_RESUME operation). 0b100 Transaction abort reported to client, silent. 0b110 Transaction abort reported to client, fault event recorded. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 333

Chapter 5. Data structure formats 5.5. Fault configuration (A, R, S bits) Note: Although the STE has no A flag, stage 2 behavior is as though an effective A flag is fixed at 1. Note: ARS == 0bxx1 is ILLEGAL when the SMMU does not support Stall behavior, or when an STE has explicitly disabled stage 1 stall configuration but stage 1 is configured to use it: • A CD with CD.S == 1 is considered ILLEGAL if either of the following is true: – SMMU_()IDR0.STALL_MODEL == 0b00 and the CD is reached through an STE with STE.S1STALLD == 1. – SMMU()IDR0.STALL_MODEL == 0b01. • A STE with STE.S2S == 1 is considered ILLEGAL if SMMU()IDR0.STALL_MODEL == 0b01. Note: ARS == 0bxx0 is ILLEGAL when the SMMU forces Stall behavior: • A CD with CD.S == 0 is considered ILLEGAL if SMMU(_)IDR0.STALL_MODEL == 0b10. • A STE with stage 2 translation enabled and STE.S2S == 0 is considered ILLEGAL if SMMU_IDR0.STALL_MODEL == 0b10. Note: There is no separate Hit Under Previous Context Fault configuration as in prior SMMU architectures because those contain a different concept of in-register context configuration being in a stall state, whereas in SMMUv3 it is only the transaction that is stalled, separate from the configuration in memory. The treatment of stalls is therefore a per-stream or per-transaction concept rather than a per-translation context concept. Where interconnect ordering rules allow, later transactions might overtake a stalled transaction associated with the same StreamID (and SubstreamID, if supplied with all transactions). A device might restrict ordering further if required. See section 3.12.2 Stall model for more details. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 334

Chapter 5. Data structure formats 5.6. VMS, Virtual Machine Structure 5.6 VMS, Virtual Machine Structure The VMS characteristics are: Purpose Structure for per-VM configuration that can be shared across multiple StreamIDs with the same S2VMID. Attributes VMS is a 4096-byte structure. Field descriptions The Virtual Machine Structure, VMS, is an SMMU concept and is a structure that is located from the pointer field STE.VMSPtr. The VMS holds per-VM facilities. The VMS is 4KB in size and is 4KB-aligned. Multiple STEs can point to the same VMS if required, for example to avoid duplication. If a group of STEs with the same VMID contain different VMS pointers then it is UNPREDICTABLE which of the pointers are used for VMS access for a given STE in the group. Note: This means that multiple STEs within a Security state with the same VMID must point to the same VMS. The VMS is fetched using the same Security state as the STE that references it. The attributes used to access the VMS are the same as those used to fetch STEs in the corresponding Security state. See SMMU_CR1 and SMMU_STRTAB_BASE. PARTID_MAP, bits [511:0] Map from virtual CD.PARTID values to physical PARTID values. Array of 32 16-bit little-endian physical PARTIDs, indexed by the virtual PARTID from CD.PARTID for a CD located through the same STE as that of the VMS. If an entry is configured with a value that is greater than the supported PARTID size, indicated by the corresponding SMMU_()MPAMIDR.PARTID_MAX, an UNKNOWN PARTID is used. The corresponding SMMU(_)MPAMIDR.PARTID_MAX is chosen as follows: • For a Non-secure Stream, then SMMU_MPAMIDR.PARTID_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 0 or STE.MPAM_NS == 0, then SMMU_S_MPAMIDR.PARTID_MAX. • For a Secure Stream, if SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and STE.MPAM_NS == 1, then SMMU_MPAMIDR.PARTID_MAX. Note: There is no equivalent mapping for PMGs because they do not need to be mapped from virtual to physical values. Note: The number 32 derives from the MPAM PE limit in the A-profile architecture[2]. Bits [32767:512] Reserved, RES0. The area of the VMS outside of the PARTID_MAP structure is RES0. Note: It is the intention to use the VMS to extend the SMMU with future per-VM functionality unrelated to MPAM. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 335

Chapter 5. Data structure formats 5.6. VMS, Virtual Machine Structure 5.6.1 VMS presence and fetching The VMS is supported by a Security state if all the statements below are true: • SMMU_IDR3.MPAM == 1 • SMMU_IDR0.S1P == 1 • SMMU_IDR0.S2P == 1 • For Non-secure state: – SMMU_MPAMIDR.PARTID_MAX != 0 • For Secure state: – SMMU_S_IDR1.SEL2 == 1 and any of the following is true: * SMMU_S_MPAMIDR.PARTID_MAX != 0 * SMMU_MPAMIDR.PARTID_MAX != 0 and SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 • For Realm state, any of the following is true: – SMMU_R_MPAMIDR.PARTID_MAX != 0 – SMMU_MPAMIDR.PARTID_MAX != 0 and SMMU_R_MPAMIDR.HAS_MPAM_NS == 1 The VMS is not always enabled even if an implementation supports it. See STE.VMSPtr for information on when the VMS is enabled. If the VMS is enabled, an SMMU is permitted but not required to access the VMS when processing a transaction that uses an STE but does not require information from the VMS indicated from the STE. If this happens and the access results in an External abort, the transaction is treated as though it required the VMS and the abort is reported for the transaction as an F_VMS_FETCH event. Note: For example, a nested configuration with STE.S1MPAM == 1 enables the VMS and the VMS is required for a transaction that undergoes both stages of translation. A different transaction using the same STE might bypass stage 1 due to STE.S1DSS == 0b01 configuration and in this case the VMS is permitted to be accessed. This means that VMS access error might be detected and reported relating to a transaction that does not require information from the VMS. See section 7.3.20 F_VMS_FETCH. Note: It is also possible that non-client transaction accesses experience a VMS access error. See section 8.1 PRI queue overflow. 5.6.2 VMS caching and invalidation The contents of VMS.PARTID_MAP are permitted to be cached as part of any of the following architecturally-visible structures: • A configuration cache entry. – Indexed by StreamID. – Invalidated by an operation affecting a StreamID, meaning an invalidation scope of CMD_CFGI_STE or wider. • A separate configuration cache for PARTID_MAP contents. – Indexed by VMID. PARTID_MAP information is not cached in a TLB. Because the PARTID_MAP contents might be cached in structures indexed by StreamID and VMID, a change to PARTID_MAP requires invalidation by both StreamID and VMID. The configuration invalidation commands CMD_CFGI_STE and CMD_CFGI_STE_RANGE invalidate cached information that is cached indexed by StreamID from all VMS fields relating to the StreamIDs in the scope of a given command. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 336

Chapter 5. Data structure formats 5.6. VMS, Virtual Machine Structure The configuration invalidation command CMD_CFGI_ALL invalidates cached information regardless of whether it is cached indexed by StreamID or VMID. The command CMD_CFGI_VMS_PIDM invalidates any separate caching of PARTID_MAP. See section 4.3.5.1 Usage for more information on invalidation of VMS fields. The VMS does not interact with SMMU_(*_)CR0.VMW. If STEs with different VMIDs point to a common VMS, information from the VMS might be cached multiple times and invalidation will require multiple operations that apply to all VMIDs that reference the VMS. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 337

Chapter 5. Data structure formats 5.7. CITE, Command Queue Control Page Information Table Entry 5.7 CITE, Command Queue Control Page Information Table Entry The CITE characteristics are: Purpose Pointer to a vSID Translation Table (VSTT) associated with a DCMDQ control page. Configuration This structure is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to CITE are UNDEFINED. Attributes CITE is a 16-byte structure. Field descriptions SPLIT 127 123 RES0 122 96 RES0 95 64 LOG2SIZE 63 58 RES0 57 56 VSTT_BASE 55 32 VSTT_BASE 31 3 RES0 2 1 V 0 V, bit [0] Validity of this entry. V Meaning 0b0 This CITE is invalid. 0b1 This CITE is valid. Bits [2:1] Reserved, RES0. VSTT_BASE, bits [55:3] Pointer to the start of the vSID Translation Table. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits VSTT_BASE[N:0] are treated as 0 by the SMMU, where N == max(2, (LOG2SIZE - SPLIT - 1 + 3)). The address is therefore aligned to the larger of the VSTTE size or the L1 array size. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 338

Chapter 5. Data structure formats 5.7. CITE, Command Queue Control Page Information Table Entry Bits [57:56] Reserved, RES0. LOG2SIZE, bits [63:58] Table size as log2(entries). The maximum StreamID value that can be used to index into the VSTT table is 2LOG2SIZE - 1. The StreamID range is equal to the number of VSTT entries in a linear VSTT table or the maximum sum of the VSTT entries in all second-level tables. The number of L1VSTTDs in the upper level of a 2-level table is MAX(1, 2LOG2SIZE-SPLIT). Except for readback of a written value, the effective LOG2SIZE is <= SMMU_(R_)IDR6.VSIDSIZE for the purposes of input StreamID range checking and upper/lower/linear VSTT table index address calculation. Bits [122:64] Reserved, RES0. SPLIT, bits [127:123] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: vSID split point for multi-level table. This field determines the split point of a 2-level VSTT table, selected by the number of bits at the bottom level. SPLIT Meaning 0b01001 9 bits - 4KB VSTT leaf tables. 0b01011 11 bits - 16KB VSTT leaf tables. 0b01101 13 bits - 64KB VSTT leaf tables. Other values are reserved, and behave as 0b01001. The upper-level L1VSTTD is located using StreamID[LOG2SIZE - 1:SPLIT] and this indicates the lowest-level table which is indexed by StreamID[SPLIT - 1:0]. Note: If SPLIT >= LOG2SIZE, a single upper-level descriptor indicates one bottom-level VSTT table with 2LOG2SIZE usable entries. The L1VSTTD.Span value’s valid range is up to SPLIT + 1, but not all of this Span is accessible, as it is not possible to use a StreamID >= 2LOG2SIZE. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 339

Chapter 5. Data structure formats 5.8. L1CITD, Level 1 Command Queue Control Page Information Table Descriptor 5.8 L1CITD, Level 1 Command Queue Control Page Information Table Descriptor The L1CITD characteristics are: Purpose Configures the base address and size of a second level Command Queue Information Table (CIT) for a range of qSIDs. Configuration This structure is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to L1CITD are UNDEFINED. Attributes L1CITD is a 8-byte structure. Field descriptions Span 63 59 RES0 58 56 L2Ptr 55 32 L2Ptr 31 4 RES0 3 0 Bits [3:0] Reserved, RES0. L2Ptr, bits [55:4] Pointer to the start of the Level 2 CIT. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits L2Ptr[N:0] are treated as 0 by the SMMU, where N == 3 + (Span - 1). The L2Ptr is therefore aligned to the size of the Level 2 CIT by the SMMU. Bits [58:56] Reserved, RES0. Span, bits [63:59] 2n size of Level 2 array and validity of L1CIT.L2Ptr. Span Meaning 0 L1CIT.L2Ptr is invalid. The qSIDs matching this descriptor are all invalid. 1-13 Level 2 array contains 2(Span-1) CIT entries. 14-31 Reserved, behaves as 0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 340

Chapter 5. Data structure formats 5.8. L1CITD, Level 1 Command Queue Control Page Information Table Descriptor (1) Span must be within the range of 0 to (SMMU_CITAB_BASE_CFG.SPLIT + 1), that is it must stay within the bounds of the CIT split point. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 341

Chapter 5. Data structure formats 5.9. L1VSTTD, Level 1 vSID Translation Table descriptor 5.9 L1VSTTD, Level 1 vSID Translation Table descriptor The L1VSTTD characteristics are: Purpose Configures the base address and size of a second level VSTT for a range of vSIDs. Configuration This structure is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to L1VSTTD are UNDEFINED. Attributes L1VSTTD is a 8-byte structure. Field descriptions Span 63 59 RES0 58 56 L2Ptr 55 32 L2Ptr 31 3 RES0 2 0 Bits [2:0] Reserved, RES0. L2Ptr, bits [55:3] Pointer to the start of the Level 2 VSTT. Bits above the implemented OA size, reported in SMMU_(R_)IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits L2Ptr[N:0] are treated as 0 by the SMMU, where N == 2 + (Span - 1). The L2Ptr is therefore aligned to the size of the Level 2 VSTT by the SMMU. Bits [58:56] Reserved, RES0. Span, bits [63:59] 2n size of Level 2 array and validity of L1VSTTD.L2Ptr. Span Meaning 0 L1VSTTD.L2Ptr is invalid. A vSID matching this descriptor does not map onto a pSID and commands carrying this vSID are IGNORED. 1-14 Level 2 array contains 2(Span-1) VSTT entries. 15-31 Reserved, behaves as 0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 342

Chapter 5. Data structure formats 5.9. L1VSTTD, Level 1 vSID Translation Table descriptor (1) Span must be within the range of 0 to CITE.SPLIT, that is it must stay within the bounds of the VSTT split point. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 343

Chapter 5. Data structure formats 5.10. VSTTE, vSID Translation Table Entry 5.10 VSTTE, vSID Translation Table Entry The VSTTE characteristics are: Purpose Contains the SID of the physical device, associated with the virtual SID used to index into the VSTT. Configuration This structure is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to VSTTE are UNDE- FINED. Attributes VSTTE is a 8-byte structure. Field descriptions PSID 63 32 RES0 31 1 0 PSID_VA LID PSID_VALID, bit [0] Qualifier to for PSID field. PSID_VALID Meaning 0b0 This vSID does not map onto a pSID and commands carrying this vSID are IGNORED. 0b1 This vSID maps onto a pSID and commands carrying this vSID will be scoped with VSTTE.PSID. Bits [31:1] Reserved, RES0. PSID, bits [63:32] Physical SID, translation of the virtual SID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 344