6 Memory map and registers

Chapter 6 Memory map and registers 6.1 Memory map SMMU registers occupy two consecutive 64KB pages starting from an at least 64KB-aligned boundary. Other OPTIONAL 64KB pages might follow these pages, depending on implemented features: • If the VATOS interface is supported, one 64KB page is present containing the VATOS registers. • If the Secure VATOS interface is supported, one 64KB page is present containing the S_VATOS registers. • If Enhanced Command queue interfaces are supported for a Security state, one or more Command queue control pages might be present for the respective Security state, each containing one or more ECMDQ interfaces. • If Direct Command queue interfaces are supported for a Security state, all of the following apply: – One or more Direct Command queue control pages might be present for the respective Security state, each containing one or more DCMDQ interfaces. – One DCMDQ global page is present for the respective Security state. • Any number of IMPLEMENTATION DEFINED pages might be present. The presence and base addresses of all OPTIONAL pages are IMPLEMENTATION DEFINED and discoverable: • The presence of VATOS support can be determined from SMMU_IDR0.VATOS. – The VATOS page’s base address is given by SMMU_IDR2.BA_VATOS. – This base address is called O_VATOS hereafter. • The presence of Secure VATOS support can be determined from SMMU_S_IDR1.SECURE_IMPL, SMMU_S_IDR1.SEL2 and SMMU_IDR0.VATOS. – The Secure VATOS page’s base address is given by SMMU_S_IDR2.BA_S_VATOS. – This base address is called O_S_VATOS hereafter. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 345

Chapter 6. Memory map and registers 6.1. Memory map • The presence of Command queue control pages can be determined from SMMU_IDR1.ECMDQ, SMMU_S_IDR0.ECMDQ and SMMU_R_IDR0.ECMDQ. – The number of pages is discoverable from SMMU_()IDR6. – The offset of each page is discoverable from SMMU()CMDQ_CONTROL_PAGE_BASEn.ADDR. – These offsets are referred to as O()CMDQCPn. • The presence of Direct Command queue control pages can be determined from SMMU()IDR6.DCMDQ. – The number of pages is discoverable from SMMU()IDR6. – The offset of each page is discoverable from SMMU()IDR8.BA_DCMDQ. – These offsets are referred to as O()DCMDQCPm. • The presence of a DCMDQ global page can be determined from SMMU()IDR6.DCMDQ. – The offset of the page is discoverable from SMMU()IDR8.BA_DCMDQ_GLOBAL. – The offset is referred to as O(_)DCMDQP_GLOBAL. • The presence of the Realm Pages 0 and 1 can be determined from SMMU_ROOT_IDR0.REALM_IMPL. – The offset for the Realm Page 0 is discoverable from SMMU_ROOT_IDR0.BA_REALM, and this offset is referred to as O_REALM. – Realm Page 1 is in the 64KB of physical address space immediately higher than Realm Page 0. • The presence of all IMPLEMENTATION DEFINED register pages can be determined through the Peripheral ID registers and IMPLEMENTATION DEFINED registers, for example SMMU_IDR4. The base address of OPTIONAL pages is expressed as an offset from the SMMU extension address 0x20000, in units of a 64KB page. An SMMU that does not support any OPTIONAL or IMPLEMENTATION DEFINED register pages will occupy a 128K span of addresses, 0x00000-0x1FFFF. The values of all SMMU_R_CMDQ_CONTROL_PAGE_BASEn.ADDR are such that the pages occupy a contiguous region of address space within the SMMU register file, and they are arranged in ascending value of n. If Secure Command queue control pages are implemented, this contiguous region of address space is immediately after the contiguous region of address space for the Secure Command queue control pages. Offset Register page 0x00000-0x0FFFF SMMU registers, Page 0 0x10000-0x1FFFF SMMU registers, Page 1 0x20000-END 0 or more OPTIONAL pages O_VATOS + 0x0000-0xFFFF VATOS interface registers O_S_VATOS + 0x0000-0xFFFF Secure VATOS interface registers O_CMDQCPn + 0x0000-0xFFFF Command queue control page n O_S_CMDQCPn + 0x0000-0xFFFF Secure Command queue control page n O_R_CMDQCPn + 0x0000-0xFFFF Realm Command queue control page n O_DCMDQCPm + 0x0000-0xFFFF Direct Command queue control page m O_S_DCMDQCPm + 0x0000-0xFFFF Secure Direct Command queue control page m O_R_DCMDQCPm + 0x0000-0xFFFF Realm Direct Command queue control page m O_DCMDQP_GLOBAL + 0x0000-0xFFFF DCMDQ global page O_S_DCMDQP_GLOBAL + 0x0000-0xFFFF Secure DCMDQ global page ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 346

Chapter 6. Memory map and registers 6.1. Memory map Offset Register page O_R_DCMDQP_GLOBAL + 0x0000-0xFFFF Realm DCMDQ global page O_REALM + 0x0000-0xFFFF Realm registers, Page 0 O_REALM + 0x10000-0x1FFFF Realm registers, Page 1 IMPLEMENTATION DEFINED Root Control Page ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 347

Chapter 6. Memory map and registers 6.2. Register overview 6.2 Register overview Unless specified otherwise, all registers are 32-bit, little-endian and allow read and write (R/W) accesses. For all pages except Page 1, undefined register locations are RES0. For Page 1, access to undefined/Reserved register locations is CONSTRAINED UNPREDICTABLE and an implementation has one of the following behaviors: • The location has the same behavior as RES0. • The access has the same effect as would an access to the same offset in Page 0, that is Page 0 and 1 are permitted to alias. The equivalent Page 0 offsets of registers that are defined on Page 1 are Reserved and Arm recommends that they are not accessed. Access to these offsets is CONSTRAINED UNPREDICTABLE and (depending on the implementation of Page 1) has one of the following behaviors: • The location aliases the corresponding register in Page 1. • The access has RAZ/WI behavior. When SMMU_S_IDR1.SECURE_IMPL == 1, SMMU_S_ registers are RAZ/WI to Non-secure access. See section 3.11 Reset, Enable and initialization regarding Non-secure access to SMMU_S_INIT. All other registers are accessible to both Secure and Non-secure accesses. When SMMU_S_IDR1.SECURE_IMPL == 0, SMMU_S_ registers are RES0. In an SMMU with RME, all of the following apply: • All SMMU registers that are specified to be accessible only in Secure PA space in this specification are additionally accessible in Root PA space in an SMMU with RME. • All SMMU registers that are specified to be accessible in Non-secure PA space in this specification are additionally accessible in Root and Realm PA spaces in an SMMU with RME. All SMMU ID registers (those that report the presence or scope of features) hold constant values after reset. Reserved or undefined bit positions in defined registers are RES0: they read as zero and must not be written with non-zero values. An implementation must support aligned 32-bit word access to 32-bit registers, and to both 32-bit halves of 64-bit registers. The SMMU supports aligned 64-bit access to 64-bit registers. Support for other access sizes is IMPLEMENTATION DEFINED. The following constitute an illegal register access: • An access of an unsupported size. • Unaligned accesses, that is an access that does not start on a boundary equal to the access size. An illegal register access is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The access is RAZ/WI. • The access is observed by the register or registers spanned by the access and: – Write access will write any value to this register or registers including to fields of this register or registers outside of the access. This behavior does not enable a Non-secure access to affect registers that are not otherwise accessible to Non-secure accesses. – Read access returns an UNKNOWN value. • The access is terminated with an abort. A 64-bit access to two adjacent 32-bit registers is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The access is RAZ/WI. • A read returns the value of both registers and a write updates both registers, as though two 32-bit accesses were performed in an UNPREDICTABLE order. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 348

Chapter 6. Memory map and registers 6.2. Register overview • One of the pair of registers is read or written and the other register is RAZ/WI, as though a single 32-bit access was performed to an UNPREDICTABLE one of the pair of registers. • The access is terminated with an abort. Note: Arm strongly recommends not to abort accesses to registers that might be used by software that is associated with lower exception levels on the PE, such as the SMMU_VATOS_* or PMCG registers. It is IMPLEMENTATION DEFINED whether a 64-bit access to a 64-bit register is single-copy atomic. An SMMU implementation might internally observe the access in two 32-bit halves. An aligned 32-bit word access is single-copy atomic. All 64-bit fields are composed of two separately-writable 32-bit register halves, with bits[63:32] at offset +4 and [31:0] at offset +0. Some register fields have a dependency on another register field, and are described as Guarded by the other field. A Guarded register field is not permitted to be changed by software unless the field by which it is Guarded is in a certain state (and is not in the process of being Updated to or from that state). For example, SMMU_CMDQ_BASE is Guarded by SMMU_CR0.CMDQEN so that software is only permitted to change SMMU_CMDQ_BASE if SMMU_CR0.CMDQEN == 0. Note: Software must use an appropriate barrier to ensure initialization of Guarded register fields is visible to the SMMU before the SMMU observes a set of the field by which they are Guarded. Registers are not required to support being the target of exclusive or atomic read-modify-write update operations. In this specification, read-only means that writes are ignored. 6.2.1 Registers in Page 0 Offset Register Notes 0x0000 SMMU_IDR0 32-bit, RO 0x0004 SMMU_IDR1 32-bit, RO 0x0008 SMMU_IDR2 32-bit, RO 0x000C SMMU_IDR3 32-bit, RO 0x0010 SMMU_IDR4 32-bit, RO 0x0014 SMMU_IDR5 32-bit, RO 0x0018 SMMU_IIDR 32-bit, RO 0x001C SMMU_AIDR 32-bit, RO 0x0020 SMMU_CR0 32-bit, RW 0x0024 SMMU_CR0ACK 32-bit, RO 0x0028 SMMU_CR1 32-bit, RW 0x002C SMMU_CR2 32-bit, RW 0x0030 SMMU_S2PII 64-bit, RW ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 349

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x0040 SMMU_STATUSR 32-bit, RO 0x0044 SMMU_GBPA 32-bit, RW 0x0048 SMMU_AGBPA 32-bit, RW 0x0050 SMMU_IRQ_CTRL 32-bit, RW 0x0054 SMMU_IRQ_CTRLACK 32-bit, RO 0x0060 SMMU_GERROR 32-bit, RO 0x0064 SMMU_GERRORN 32-bit, RW 0x0068 SMMU_GERROR_IRQ_CFG0 64-bit, RW 0x0070 SMMU_GERROR_IRQ_CFG1 32-bit, RW 0x0074 SMMU_GERROR_IRQ_CFG2 32-bit, RW 0x0080 SMMU_STRTAB_BASE 64-bit, RW 0x0088 SMMU_STRTAB_BASE_CFG 32-bit, RW 0x0090 SMMU_CMDQ_BASE 64-bit, RW 0x0098 SMMU_CMDQ_PROD 32-bit, RW 0x009C SMMU_CMDQ_CONS 32-bit, RW 0x00A0 SMMU_EVENTQ_BASE 64-bit, RW 0x00A8 Optional alias of SMMU_EVENTQ_PROD, otherwise RAZ/WI 0x00AC Optional alias of SMMU_EVENTQ_CONS, otherwise RAZ/WI 0x00B0 SMMU_EVENTQ_IRQ_CFG0 64-bit, RW 0x00B8 SMMU_EVENTQ_IRQ_CFG1 32-bit, RW 0x00BC SMMU_EVENTQ_IRQ_CFG2 32-bit, RW 0x00C0 SMMU_PRIQ_BASE 64-bit, RW 0x00C8 Optional alias of SMMU_PRIQ_PROD, otherwise RAZ/WI 32-bit, RW 0x00CC Optional alias of SMMU_PRIQ_CONS, otherwise RAZ/WI 32-bit, RW 0x00D0 SMMU_PRIQ_IRQ_CFG0 64-bit, RW 0x00D8 SMMU_PRIQ_IRQ_CFG1 32-bit, RW 0x00DC SMMU_PRIQ_IRQ_CFG2 32-bit, RW ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 350

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x0100 SMMU_GATOS_CTRL 32-bit, RW 0x0108 SMMU_GATOS_SID 64-bit, RW 0x0110 SMMU_GATOS_ADDR 64-bit, RW 0x0118 SMMU_GATOS_PAR 64-bit, RO 0x0130 SMMU_MPAMIDR 32-bit, RO 0x0138 SMMU_GMPAM 32-bit, RW 0x013C SMMU_GBPMPAM 32-bit, RW 0x0180 SMMU_VATOS_SEL 32-bit, RW 0x0190 SMMU_IDR6 32-bit, RO 0x0194 SMMU_IDR7 32-bit, RO 0x0198 SMMU_IDR8 32-bit, RO 0x0200 SMMU_DPT_BASE 64-bit, RW 0x0208 SMMU_DPT_BASE_CFG 32-bit, RW 0x0210 SMMU_DPT_CFG_FAR 64-bit, RW 0x0220 SMMU_MECIDR 32-bit, RO 0x0240 SMMU_HDBSS_BASE0 64-bit, RW 0x0248 SMMU_HDBSS_PROD0 64-bit, RW 0x0250 SMMU_HDBSS_BASE1 64-bit, RW 0x0258 SMMU_HDBSS_PROD1 64-bit, RW 0x0260 SMMU_HDBSS_IRQ_CFG0 64-bit, RW 0x0268 SMMU_HDBSS_IRQ_CFG1 32-bit, RW 0x026C SMMU_HDBSS_IRQ_CFG2 32-bit, RW 0x0270 SMMU_HDBSS_MPAM 32-bit, RW 0x0440 SMMU_HACDBS_BASE 64-bit, RW 0x0448 SMMU_HACDBS_CONS 64-bit, RW 0x0450 SMMU_HACDBS_IRQ_CFG0 64-bit, RO 0x0458 SMMU_HACDBS_IRQ_CFG1 32-bit, RO ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 351

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x045C SMMU_HACDBS_IRQ_CFG2 32-bit, RO 0x0460 SMMU_HACDBS_MPAM 32-bit, RW 0x0540 SMMU_CITAB_BASE 64-bit, RW 0x0548 SMMU_CITAB_BASE_CFG 32-bit, RW 0x0E00 - 0x0EFF IMPLEMENTATION DEFINED IMPLEMENTATION DEFINED 0x0FD0- 0x0FFC ID_REGS - identification register space. IMPLEMENTATION DEFINED 0x1000 - 0x3FFF IMPLEMENTATION DEFINED IMPLEMENTATION DEFINED 0x4000 + 32n SMMU_CMDQ_CONTROL_PAGE_BASEn 64-bit, RO 0x4008 + 32n SMMU_CMDQ_CONTROL_PAGE_CFGn 32-bit, RO 0x400C + 32*n SMMU_CMDQ_CONTROL_PAGE_STATUSn 32-bit, RO 0x8000 SMMU_S_IDR0 32-bit, Secure, RO 0x8004 SMMU_S_IDR1 32-bit, Secure, RO 0x8008 SMMU_S_IDR2 32-bit, Secure, RO 0x800C SMMU_S_IDR3 32-bit, Secure, RO 0x8010 SMMU_S_IDR4 32-bit, Secure, RO 0x8020 SMMU_S_CR0 32-bit, Secure, RW 0x8024 SMMU_S_CR0ACK 32-bit, Secure, RO 0x8028 SMMU_S_CR1 32-bit, Secure, RW 0x802C SMMU_S_CR2 32-bit, Secure, RW 0x8030 SMMU_S_S2PII 64-bit, Secure, RW 0x803C SMMU_S_INIT 32-bit, Secure, RW 0x8044 SMMU_S_GBPA 32-bit, Secure, RW 0x8048 SMMU_S_AGBPA 32-bit, Secure, RW ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 352

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x8050 SMMU_S_IRQ_CTRL 32-bit, Secure, RW 0x8054 SMMU_S_IRQ_CTRLACK 32-bit, Secure, RO 0x8060 SMMU_S_GERROR 32-bit, Secure, RO 0x8064 SMMU_S_GERRORN 32-bit, Secure, RW 0x8068 SMMU_S_GERROR_IRQ_CFG0 64-bit, Secure, RW 0x8070 SMMU_S_GERROR_IRQ_CFG1 32-bit, Secure, RW 0x8074 SMMU_S_GERROR_IRQ_CFG2 32-bit, Secure, RW 0x8080 SMMU_S_STRTAB_BASE 64-bit, Secure, RW 0x8088 SMMU_S_STRTAB_BASE_CFG 32-bit, Secure, RW 0x8090 SMMU_S_CMDQ_BASE 64-bit, Secure, RW 0x8098 SMMU_S_CMDQ_PROD 32-bit, Secure, RW 0x809C SMMU_S_CMDQ_CONS 32-bit, Secure, RW 0x80A0 SMMU_S_EVENTQ_BASE 64-bit, Secure, RW 0x80A8 SMMU_S_EVENTQ_PROD 32-bit, Secure, RW 0x80AC SMMU_S_EVENTQ_CONS 32-bit, Secure, RW 0x80B0 SMMU_S_EVENTQ_IRQ_CFG0 64-bit, Secure, RW 0x80B8 SMMU_S_EVENTQ_IRQ_CFG1 32-bit, Secure, RW 0x80BC SMMU_S_EVENTQ_IRQ_CFG2 32-bit, Secure, RW 0x8100 SMMU_S_GATOS_CTRL 32-bit, Secure, RW 0x8108 SMMU_S_GATOS_SID 64-bit, Secure, RW 0x8110 SMMU_S_GATOS_ADDR 64-bit, Secure, RW 0x8118 SMMU_S_GATOS_PAR 64-bit, Secure, RO 0x8130 SMMU_S_MPAMIDR 32-bit, Secure, RO 0x8138 SMMU_S_GMPAM 32-bit, Secure, RW 0x813C SMMU_S_GBPMPAM 32-bit, Secure, RW 0x8180 SMMU_S_VATOS_SEL 32-bit, Secure, RW 0x8190 SMMU_S_IDR6 32-bit, Secure, RO ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 353

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x8194 SMMU_S_IDR7 32-bit, RO 0x8198 SMMU_S_IDR8 32-bit, RO 0x8240 SMMU_S_HDBSS_BASE0 64-bit, RW 0x8248 SMMU_S_HDBSS_PROD0 64-bit, RW 0x8250 SMMU_S_HDBSS_BASE1 64-bit, RW 0x8258 SMMU_S_HDBSS_PROD1 64-bit, RW 0x8260 SMMU_S_HDBSS_IRQ_CFG0 64-bit, RW 0x8268 SMMU_S_HDBSS_IRQ_CFG1 32-bit, RW 0x826C SMMU_S_HDBSS_IRQ_CFG2 32-bit, RW 0x8270 SMMU_S_HDBSS_MPAM 32-bit, RW 0x8440 SMMU_S_HACDBS_BASE 64-bit, RW 0x8448 SMMU_S_HACDBS_CONS 64-bit, RW 0x8450 SMMU_S_HACDBS_IRQ_CFG0 64-bit, RO 0x8458 SMMU_S_HACDBS_IRQ_CFG1 32-bit, RO 0x845C SMMU_S_HACDBS_IRQ_CFG2 32-bit, RO 0x8460 SMMU_S_HACDBS_MPAM 32-bit, RW 0x8E00 - 0x8EFF IMPLEMENTATION DEFINED, Secure IMPLEMENTATION DEFINED, Secure 0x9000 - 0xBFFF IMPLEMENTATION DEFINED, Secure IMPLEMENTATION DEFINED, Secure 0xC000 + 32n SMMU_S_CMDQ_CONTROL_PAGE_BASEn 64-bit, Secure, RO 0xC008 + 32n SMMU_S_CMDQ_CONTROL_PAGE_CFGn 32-bit, Secure, RO 0xC00C + 32*n SMMU_S_CMDQ_CONTROL_PAGE_STATUSn 32-bit, Secure, RO 6.2.2 Registers in Page 1 Offsets are relative to the base of Page 1, 0x10000. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 354

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x00A8 SMMU_EVENTQ_PROD 32-bit, RW 0x00AC SMMU_EVENTQ_CONS 32-bit, RW 0x00C8 SMMU_PRIQ_PROD 32-bit, RW 0x00CC SMMU_PRIQ_CONS 32-bit, RW 6.2.3 Registers in the VATOS page When SMMU_IDR0.VATOS == 1, the VATOS page is present. Offsets are relative to the base of the VATOS page, O_VATOS. See SMMU_IDR2. Offset Register Notes 0x0A00 SMMU_VATOS_CTRL 32-bit, RW 0x0A08 SMMU_VATOS_SID 64-bit, RW 0x0A10 SMMU_VATOS_ADDR 64-bit, RW 0x0A18 SMMU_VATOS_PAR 64-bit, RO 0x0E00 - 0x0EFF IMPLEMENTATION DEFINED 6.2.4 Registers in the S_VATOS page When Secure state is supported and SMMU_S_IDR1.SEL2 == 1 and SMMU_IDR0.VATOS == 1, the S_VATOS page is present. The base address of the S_VATOS page is determined from SMMU_S_IDR2.BA_S_VATOS and referred to as O_S_VATOS: O_S_VATOS = SMMU_BASE + 0x20000 + (SMMU_S_IDR2.BA_S_VATOS * 0x10000) The offsets below are relative to the base of the S_VATOS page, O_S_VATOS. Offset Register Notes 0x0A00 SMMU_S_VATOS_CTRL 32-bit, Secure, RW 0x0A08 SMMU_S_VATOS_SID 64-bit, Secure, RW 0x0A10 SMMU_S_VATOS_ADDR 64-bit, Secure, RW 0x0A18 SMMU_S_VATOS_PAR 64-bit, Secure, RO ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 355

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x0E00 - 0x0EFF IMPLEMENTATION DEFINED Secure 6.2.5 Registers in a Command queue control page When SMMU_IDR1.ECMDQ, SMMU_S_IDR0.ECMDQ or SMMU_R_IDR0.ECMDQ are 1, one or more Command queue control pages are present in the respective security state. A Command queue control page contains the ECMDQ interfaces specified in section 3.5.6 Enhanced Command queue interfaces. The number of ECMDQ interfaces in an ECMDQ control page is determined by the value of SMMU_()IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ. The size of a Command queue control page is 64KB. A Command queue control page is aligned in PA space to 64KB. A Command queue control page is implemented as a set of registers. The ECMDQ interfaces are spaced evenly throughout a Command queue control page. For example, if a control page has 128 ECMDQs, the interfaces are spaced at 512-byte intervals throughout the page. A Command queue control page therefore has 2(SMMU()IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ) copies of the following three registers, as shown below for ECMDQ n: Offset Register Notes 0x00 + ((2^(16 - SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_()ECMDQ_BASEn 64-bit, R/W 0x08 + ((2^(16 - SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_()ECMDQ_PRODn 32-bit, R/W 0x0C + ((2^(16 - SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_()ECMDQ_CONSn 32-bit, R/W 6.2.6 Registers in a Direct Command queue control page When SMMU_()IDR6.DCMDQ is 0b01, one or more Direct Command queue control pages are present in the respective security state. A Direct Command queue control page contains the DCMDQ interfaces specified in section 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. The number of DCMDQ interfaces in a DCMDQ control page is determined by the value of SMMU(_)IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ. The size of a Direct Command queue control page is 64KB. A Direct Command queue control page is aligned in PA space to 64KB. A Direct Command queue control page is implemented as a set of registers. The DCMDQ interfaces are spaced evenly throughout a Direct Command queue control page. For example, if a control page has 128 DCMDQs, the interfaces are spaced at 512-byte intervals throughout the page. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 356

Chapter 6. Memory map and registers 6.2. Register overview A Direct Command queue control page therefore has 2(SMMU_(_)IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ) copies of the following three registers, as shown below for DCMDQ n: Offset Register Notes 0x00 + ((2^(16 - SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_(_)DCMDQ_BASEn 64-bit, R/W 0x08 + ((2^(16 - SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_(_)DCMDQ_PRODn 32-bit, R/W 0x0C + ((2^(16 - SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ)) n) SMMU_()DCMDQ_CONSn 32-bit, R/W 6.2.7 Registers in a DCMDQ global page When SMMU()IDR6.DCMDQ is 0b01, one DCMDQ global page is present in the respective security state. A DCMDQ global page has the following registers: Offset Register Notes 0x0000 + (0x8 * n) SMMU()DCMDQP_ERRn 64-bit, RO 0xE000 + (0x8 * n) SMMU(_)DCMDQP_ERRNn 64-bit, R/W 6.2.8 Root Control Page When SMMU_ROOT_IDR0.ROOT_IMPL == 1, the SMMU Root Control Page is present. Access to the SMMU Root Control Page is bounded by the following rules: • The base address is IMPLEMENTATION DEFINED. • The base address is 64KB aligned. • The page is accessible only in the Root PA space. • Accesses in any PA space other than Root are completed as RAZ/WI. • The Root Control Page base address is distinct from addresses of registers accessible in other PA spaces. Address map: Offset Register Notes 0x0000 SMMU_ROOT_IDR0 32-bit, RO 0x0008 SMMU_ROOT_IIDR 32-bit, RO 0x0020 SMMU_ROOT_CR0 32-bit, R/W 0x0024 SMMU_ROOT_CR0ACK 32-bit, RO 0x0028 SMMU_ROOT_GPT_BASE 64-bit, R/W 0x0030 SMMU_ROOT_GPT_BASE_CFG 64-bit, R/W 0x0038 SMMU_ROOT_GPF_FAR 64-bit, R/W 0x0040 SMMU_ROOT_GPT_CFG_FAR 64-bit, R/W 0x0050 SMMU_ROOT_TLBI 64-bit, R/W, OPTIONAL 0x0058 SMMU_ROOT_TLBI_CTRL 32-bit, R/W, OPTIONAL 0x0060 SMMU_ROOT_GPT_BASE2 64-bit, R/W ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 357

Chapter 6. Memory map and registers 6.2. Register overview Offset Register Notes 0x0068 SMMU_ROOT_GPT_BASE_UPDATE 32-bit, R/W 0x0070 SMMU_ROOT_GPCBW 64-bit, R/W 0x0E00-0x0EFF IMPLEMENTATION DEFINED IMPLEMENTATION DEFINED Locations in the SMMU Root Control Page that are not associated with a register are RES0. 6.2.9 Realm Register Pages The two SMMUv3 Realm Register Pages have the following properties: • The two pages are adjacent and together occupy a naturally-aligned 128KB region of physical address space. • The registers are only accessible in Realm and Root PA spaces. Non-secure and Secure accesses to the page are RAZ/WI. • Addresses configured in these registers are treated as Realm physical addresses by default. Some of the configuration registers have an NS override bit, which selects Non-secure physical address space if set. • If SMMU_IDR1.QUEUES_PRESET is 1 and SMMU_IDR1.REL is 1, then the preset address values in all of the SMMU_R_{CMDQ,EVENTQ,PRIQ}_BASE registers are relative to the base address of the Non-secure SMMU register Page 0. • If SMMU_IDR1.TABLES_PRESET is 1 and SMMU_IDR1.REL is 1, then the preset address value in the SMMU_R_STRTAB_BASE register is relative to the base address of the Non-secure SMMU register Page 0. 6.2.10 Registers in Realm Page 0 When SMMU_ROOT_IDR0.REALM_IMPL == 1, the SMMU Realm Page 0 is present. The layout of Realm Page 0 is as follows: Offset Register name Notes 0x0000 SMMU_R_IDR0 32-bit, RO 0x0004 SMMU_R_IDR1 32-bit, RO 0x0008 SMMU_R_IDR2 32-bit, RO 0x000C SMMU_R_IDR3 32-bit, RO 0x0010 SMMU_R_IDR4 32-bit, RO 0x0018 Reserved, RES0. Implementation identification is described in SMMU_IIDR. There is no SMMU_R_IIDR register. 0x001C SMMU_R_AIDR 32-bit, RO 0x0020 SMMU_R_CR0 32-bit, RW 0x0024 SMMU_R_CR0ACK 32-bit, RO 0x0028 SMMU_R_CR1 32-bit, RW 0x002C SMMU_R_CR2 32-bit, RW 0x0030 SMMU_R_S2PII 64-bit, RW 0x0044 SMMU_R_GBPA 32-bit, RO 0x0048 SMMU_R_AGBPA 32-bit, RW ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 358

Chapter 6. Memory map and registers 6.2. Register overview 0x0050 SMMU_R_IRQ_CTRL 32-bit, RW 0x0054 SMMU_R_IRQ_CTRLACK 32-bit, RO 0x0060 SMMU_R_GERROR 32-bit, RO 0x0064 SMMU_R_GERRORN 32-bit, RW 0x0068 SMMU_R_GERROR_IRQ_CFG0 64-bit, RW 0x0070 SMMU_R_GERROR_IRQ_CFG1 32-bit, RW 0x0074 SMMU_R_GERROR_IRQ_CFG2 32-bit, RW 0x0080 SMMU_R_STRTAB_BASE 64-bit, RW 0x0088 SMMU_R_STRTAB_BASE_CFG 32-bit, RW 0x0090 SMMU_R_CMDQ_BASE 64-bit, RW 0x0098 SMMU_R_CMDQ_PROD 32-bit, RW 0x009C SMMU_R_CMDQ_CONS 32-bit, RW 0x00A0 SMMU_R_EVENTQ_BASE 64-bit, RW 0x00A8 Optional alias of SMMU_R_EVENTQ_PROD. 0x00AC Optional alias of SMMU_R_EVENTQ_CONS. 0x00B0 SMMU_R_EVENTQ_IRQ_CFG0 64-bit, RW 0x00B8 SMMU_R_EVENTQ_IRQ_CFG1 32-bit, RW 0x00BC SMMU_R_EVENTQ_IRQ_CFG2 32-bit, RW 0x00C0 SMMU_R_PRIQ_BASE 64-bit, RW 0x00C8 Optional alias of SMMU_R_PRIQ_PROD. 0x00CC Optional alias of SMMU_R_PRIQ_CONS. 0x00D0 SMMU_R_PRIQ_IRQ_CFG0 64-bit, RW 0x00D8 SMMU_R_PRIQ_IRQ_CFG1 32-bit, RW 0x00DC SMMU_R_PRIQ_IRQ_CFG2 32-bit, RW 0x0130 SMMU_R_MPAMIDR 32-bit, RO 0x0138 SMMU_R_GMPAM 32-bit, RW 0x013C Reserved, RES0 SMMU_R_GBPA.ABORT and SMMU_R_CR0.ATSCHK are RES1, therefore there is no need for an SMMU_R_GBPMPAM register. 0x0190 SMMU_R_IDR6 32-bit, RO 0x0194 SMMU_R_IDR7 32-bit, RO 0x0198 SMMU_R_IDR8 32-bit, RO 0x0200 SMMU_R_DPT_BASE 64-bit, RW 0x0208 SMMU_R_DPT_BASE_CFG 32-bit, RW 0x0210 SMMU_R_DPT_CFG_FAR 64-bit, RW 0x0220 SMMU_R_MECIDR 32-bit, RO ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 359

Chapter 6. Memory map and registers 6.2. Register overview 0x0228 SMMU_R_GMECID 32-bit, RO 0x0240 SMMU_R_HDBSS_BASE0 64-bit, RW 0x0248 SMMU_R_HDBSS_PROD0 64-bit, RW 0x0250 SMMU_R_HDBSS_BASE1 64-bit, RW 0x0258 SMMU_R_HDBSS_PROD1 64-bit, RW 0x0260 SMMU_R_HDBSS_IRQ_CFG0 64-bit, RW 0x0268 SMMU_R_HDBSS_IRQ_CFG1 32-bit, RW 0x026C SMMU_R_HDBSS_IRQ_CFG2 32-bit, RW 0x0270 SMMU_R_HDBSS_MPAM 32-bit, RW 0x0274 SMMU_R_HDBSS_MECID 32-bit, RW 0x0440 SMMU_R_HACDBS_BASE 64-bit, RW 0x0448 SMMU_R_HACDBS_CONS 64-bit, RW 0x0450 SMMU_R_HACDBS_IRQ_CFG0 64-bit, RO 0x0458 SMMU_R_HACDBS_IRQ_CFG1 32-bit, RO 0x045C SMMU_R_HACDBS_IRQ_CFG2 32-bit, RO 0x0460 SMMU_R_HACDBS_MPAM 32-bit, RW 0x0464 SMMU_R_HACDBS_MECID 32-bit, RW 0x0540 SMMU_R_CITAB_BASE 64-bit, RW 0x0548 SMMU_R_CITAB_BASE_CFG 32-bit, RW 0x4000 + (32*n) SMMU_R_CMDQ_CONTROL_PAGE_BASEn 64-bit, RO 0x4008 + (32*n) SMMU_R_CMDQ_CONTROL_PAGE_CFGn 32-bit, RO 0x400C + (32*n) SMMU_R_CMDQ_CONTROL_PAGE_STATUSn 32-bit, RO 0x0E00 to 0x0EFF IMPLEMENTATION DEFINED IMPLEMENTATION DEFINED 6.2.11 Registers in Realm Page 1 When SMMU_ROOT_IDR0.REALM_IMPL == 1, the SMMU Realm Page 1 is present. The layout of Realm Page 1 is as follows: Offset Register name Details 0x00A8 SMMU_R_EVENTQ_PROD Equivalent to SMMU_EVENTQ_PROD. 0x00AC SMMU_R_EVENTQ_CONS Equivalent to SMMU_EVENTQ_CONS. 0x00C8 SMMU_R_PRIQ_PROD Equivalent to SMMU_PRIQ_PROD. 0x00CC SMMU_R_PRIQ_CONS Equivalent to SMMU_PRIQ_CONS. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 360

Chapter 6. Memory map and registers 6.3. Register formats 6.3 Register formats In the following detailed register descriptions, there is information about behavior of accesses to each register. For each register, there is a subsection titled “Accessing the register name”. This subsection in each register description follows the following format: 1. Optional introductory text, that might specify complex access behaviors. 2. A table describing the register page and offset of the register. 3. A simplified description of the register access behavior. In all cases, the information in part 3 describes the behavior from SMMUv3.2 onwards. In some cases, the introductory text in part 1 includes additional, more-relaxed, behaviors that were permitted in SMMUv3.1 and earlier. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 361

Chapter 6. Memory map and registers 6.3. Register formats 6.3.1 SMMU_IDR0 The SMMU_IDR0 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR0 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 30 29 28 27 26 25 24 23 22 21 20 19 18 VMW 17 PRI 16 15 SEV 14 MSI 13 12 11 ATS 10 Hyp 9 8 HTTU 7 6 BTM 5 4 TTF 3 2 S1P 1 S2P 0 RES0 RME_IMPL RES0 ST_LEVEL TERM_MODEL STALL_MODEL ATSRECERR TTENDIAN COHACC DORMHINT NS1ATS ASID16 ATOS VMID16 CD2L VATOS Bit [31] Reserved, RES0. RME_IMPL, bit [30] Indicates support for SMMUv3.3-RME_IMPL. The value of this field is an IMPLEMENTATION DEFINED choice of: RME_IMPL Meaning 0b0 RME features not supported for Non-secure, Secure or Realm programming interfaces. 0b1 RME features supported for Non-secure programming interface, for Secure programming interface if implemented, and for Realm programming interface if implemented. If this field is 1, it is possible to report each of F_STE_FETCH, F_CD_FETCH, F_VMS_FETCH, and F_WALK_EABT with GPCF == 1 in Event queues. If this field is 1, then SMMU_ROOT_IDR0.ROOT_IMPL is 1. Access to this field is RO. Bit [29] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 362

Chapter 6. Memory map and registers 6.3. Register formats ST_LEVEL, bits [28:27] Multi-level Stream table support. The value of this field is an IMPLEMENTATION DEFINED choice of: ST_LEVEL Meaning 0b00 Linear Stream table supported. 0b01 2-level Stream table supported in addition to Linear Stream table. All other values are reserved. Access to this field is RO. TERM_MODEL, bit [26] Terminate model behavior. The value of this field is an IMPLEMENTATION DEFINED choice of: TERM_MODEL Meaning 0b0 CD.A flag determines Abort or RAZ/WI behavior of a terminated transaction. • The act of terminating a transaction might be configured using the CD.A flag to successfully complete the transaction with RAZ/WI behavior or abort the transaction. 0b1 Terminating a transaction with RAZ/WI behavior is not supported, CD.A must be 1. • This means that a terminated transaction will always be aborted. Access to this field is RO. STALL_MODEL, bits [25:24] Stall model support. When SMMU_S_IDR1.SECURE_IMPL == 0: The value of this field is an IMPLEMENTATION DEFINED choice of: STALL_MODEL Meaning 0b00 Stall and Terminate models supported. 0b01 Stall is not supported, all faults terminate transaction and STE.S2S and CD.S must be 0. • CMD_RESUME and CMD_STALL_TERM are not available. 0b10 Stall is forced (all faults eligible to stall cause stall), STE.S2S and CD.S must be 1. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 363

Chapter 6. Memory map and registers 6.3. Register formats All other values are reserved. This field reports whether an implementation supports the Stall model. • Note: STE.S2S must be in the states above only if stage 2 translation was enabled. • Note: An SMMU associated with a PCI system must not have STALL_MODEL == 0b10. Access to this field is RO. Otherwise: This field reports SMMU_S_IDR0.STALL_MODEL unless SMMU_S_IDR0.STALL_MODEL == 0b00 and SMMU_S_CR0.NSSTALLD == 1 in which case Non-secure use of Stall is prevented and this field’s value is 0b01. See section 3.12 Fault models, recording and reporting. Access to this field is RO. ATSRECERR, bit [23] Indicates support for recording Configuration-related errors for ATS and PRI. The value of this field is an IMPLEMENTATION DEFINED choice of: ATSRECERR Meaning 0b0 SMMU supports recording only the base set of Events for ATS-related and PRI requests. 0b1 SMMU supports recording some additional Events for ATS-related and PRI requests. See section 3.9.1.2 Responses to ATS Translation Requests and section 8.1 PRI queue overflow for details of which events are recorded or not. See SMMU_CR2.REC_CFG_ATS for control details. This bit is RES0 if SMMU_IDR0.ATS == 0. Access to this field is RO. TTENDIAN, bits [22:21] Endianness support for translation table walks. The value of this field is an IMPLEMENTATION DEFINED choice of: TTENDIAN Meaning 0b00 Mixed-endian: CD.ENDI and STE.S2ENDI are each permitted to select either endianness, and do not have to have the same value 0b10 Little-endian: CD.ENDI and STE.S2ENDI must select little-endian 0b11 Big-endian: CD.ENDI and STE.S2ENDI must select big-endian All other values are reserved. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 364

Chapter 6. Memory map and registers 6.3. Register formats • Arm strongly recommends that a general-purpose SMMU implementation supports mixed-endian translation table walks. Access to this field is RO. VATOS, bit [20] Virtual ATOS page interface supported. The value of this field is an IMPLEMENTATION DEFINED choice of: VATOS Meaning 0b0 Virtual ATOS page interface not supported. 0b1 Virtual ATOS page interface supported. • ATOS must also be supported • Stage 1 and stage 2 translation must also be supported. Access to this field is RO. CD2L, bit [19] 2-level Context descriptor table supported. The value of this field is an IMPLEMENTATION DEFINED choice of: CD2L Meaning 0b0 2-level CD table not supported. 0b1 2-level CD table supported. Access to this field is RO. VMID16, bit [18] 16-bit VMID supported. The value of this field is an IMPLEMENTATION DEFINED choice of: VMID16 Meaning 0b0 16-bit VMID not supported. • VMID[15:8] is RES0 in command parameters and must be zero in STE.S2VMID. 0b1 16-bit VMID supported. • Note: The value of this field is irrelevant to software unless SMMU_IDR0.S2P == 1. Access to this field is RO. VMW, bit [17] VMID wildcard-matching supported for TLB invalidation. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 365

Chapter 6. Memory map and registers 6.3. Register formats VMW Meaning 0b0 VMID wildcard-matching not supported for TLB invalidation. 0b1 VMID wildcard-matching supported for TLB invalidation. • When SMMU_IDR0.S2P == 0 this field is RES0 Access to this field is RO. PRI, bit [16] Page Request Interface supported. The value of this field is an IMPLEMENTATION DEFINED choice of: PRI Meaning 0b0 Page Request Interface not supported • All SMMU_PRIQ_ registers are Reserved. 0b1 Page Request Interface supported • When SMMU_IDR0.ATS == 0 this field is RES0. • See section 3.9 Support for PCI Express, PASIDs, PRI, and ATS. Access to this field is RO. ATOS, bit [15] Address Translation Operations supported. The value of this field is an IMPLEMENTATION DEFINED choice of: ATOS Meaning 0b0 Address Translation Operations not supported. • SMMU_IDR0.VATOS is RES0 and all SMMU_(S_)GATOS_ registers are Reserved. 0b1 Address Translation Operations supported Access to this field is RO. SEV, bit [14] SMMU, and system, support generation of WFE wake-up events to PE. The value of this field is an IMPLEMENTATION DEFINED choice of: SEV Meaning 0b0 SMMU, and system, do not support generation of WFE wake-up events to PE. 0b1 SMMU, and system, support generation of WFE wake-up events to PE. • Note: WFE might be used on the PE to wait for CMD_SYNC command completion. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 366

Chapter 6. Memory map and registers 6.3. Register formats • This bit must reflect the ability of the system, and SMMU implementation, to convey events to all PEs that are expected to run SMMU maintenance software. Access to this field is RO. MSI, bit [13] Message Signalled Interrupts are supported. The value of this field is an IMPLEMENTATION DEFINED choice of: MSI Meaning 0b0 The implementation supports wired interrupt notifications only. • The MSI fields in SMMU_EVENTQ_IRQ_CFGn, SMMU_PRIQ_IRQ_CFGn and SMMU_GERROR_IRQ_CFGn are RES0. 0b1 Message Signalled Interrupts are supported. • Note: The SMMU_PRIQ_IRQ_CFG2.LO bit is not affected by whether MSIs are implemented or not. Access to this field is RO. ASID16, bit [12] 16-bit ASID support. The value of this field is an IMPLEMENTATION DEFINED choice of: ASID16 Meaning 0b0 16-bit ASID not supported. • ASID[15:8] is RES0 in command parameters and must be zero in CD.ASID. 0b1 16-bit ASID is supported. Note: The value of this bit is irrelevant to software unless SMMU_IDR0.S1P == 1. Access to this field is RO. NS1ATS, bit [11] Split-stage (stage 1-only) ATS not supported. The value of this field is an IMPLEMENTATION DEFINED choice of: NS1ATS Meaning 0b0 Split-stage (stage 1-only) ATS supported. 0b1 Split-stage (stage 1-only) ATS not supported. • Split-stage ATS set by STE.EATS == 0b10 is not supported. See STE.EATS. • RES0 when SMMU_IDR0.ATS == 0 or SMMU_IDR0.S1P == 0 or SMMU_IDR0.S2P == 0. • Note: The value of this field is only relevant to software when ATS and both stages of translation are supported. • See section 3.9 Support for PCI Express, PASIDs, PRI, and ATS. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 367

Chapter 6. Memory map and registers 6.3. Register formats Access to this field is RO. ATS, bit [10] PCIe ATS supported by SMMU. The value of this field is an IMPLEMENTATION DEFINED choice of: ATS Meaning 0b0 PCIe ATS not supported by SMMU. 0b1 PCIe ATS supported by SMMU. • The support provided by an implementation for ATS and PRI influences interpretation of STE.EATS, ATS and PRI-related commands and SMMU_PRIQ_* registers. It does not guarantee that client devices and intermediate components also support ATS and this must be determined separately. See section 3.9 Support for PCI Express, PASIDs, PRI, and ATS. Access to this field is RO. Hyp, bit [9] Hypervisor stage 1 contexts supported. This flag indicates whether TLB entries might be tagged as EL2/EL2-E2H - see STE.STRW. The value of this field is an IMPLEMENTATION DEFINED choice of: Hyp Meaning 0b0 Hypervisor stage 1 contexts not supported. 0b1 Hypervisor stage 1 contexts supported. RES0 when S1P == 0 or S2P == 0. • Arm recommends the implementation of Hyp/EL2 support when S1P == 1 && S2P == 1, that is when both stages of translations are supported. Note: The Hyp bit indicates support for Non-secure EL2 only. If the Secure state is supported, SMMU_S_IDR1.SEL2 indicates support for both S-EL2 and Secure stage 2. Note: There is no SMMU equivalent of the Armv8.4 [2] SCR_EL3.EEL2 flag to enable Secure EL2. Hyp == 1 is mandatory in implementations of SMMUv3.2 or later, if S1P == 1 and S2P == 1. Access to this field is RO. DORMHINT, bit [8] Dormant Hint supported. The value of this field is an IMPLEMENTATION DEFINED choice of: DORMHINT Meaning 0b0 Dormant hint not supported. 0b1 Dormant hint supported. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 368

Chapter 6. Memory map and registers 6.3. Register formats Access to this field is RO. HTTU, bits [7:6] H/W translation table Access flag and Dirty state of the page updates supported. The value of this field is an IMPLEMENTATION DEFINED choice of: HTTU Meaning 0b00 No flag updates supported. 0b01 Access flag update supported. 0b10 Access flag and Dirty state of the page update supported. 0b11 Access flag and Dirty state, and Access flag for Table descriptors supported. • This field reflects the ability of the system, and SMMU implementation, to support hardware update. Note: HTTU is a feature of an SMMU implementation, but the system design also bears upon whether HTTU can be supported. For instance, HTTU requires coherent atomic updates to translation table data which need to be supported by an external interconnect. An SMMU that internally supports HTTU but does not have requisite system support must mark HTTU as 0b00 in this field. Access to this field is RO. BTM, bit [5] Broadcast TLB Maintenance. Indicates support for receiving broadcast TLBI operations issued by Arm PEs in the system. The value of this field is an IMPLEMENTATION DEFINED choice of: BTM Meaning 0b0 Broadcast TLB maintenance not supported. 0b1 Broadcast TLB maintenance supported. • This bit reflects the ability of the system, and SMMU implementation, to support broadcast maintenance. If either the SMMU, or the system, or the interconnect cannot fully support broadcast TLB maintenance, this bit reads as 0. Access to this field is RO. COHACC, bit [4] Coherent access supported to translations, structures and queues. The value of this field is an IMPLEMENTATION DEFINED choice of: COHACC Meaning 0b0 Coherent access for translations, structures and queues is not supported. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 369

Chapter 6. Memory map and registers 6.3. Register formats COHACC Meaning 0b1 IO-coherent access is supported for: • Translation table walks. • Fetches of L1STD, STE, L1CD and CD. • Command queue, Event queue and PRI queue access. • GERROR, CMD_SYNC, Event queue and PRI queue MSIs, if supported. • Whether a specific access is performed in a cacheable shareable manner is dependent on the access type configured for access to structures, queues and translation table walks. • This bit reflects the ability of the system, and SMMU implementation, to support IO-Coherent access to memory shared coherently with the PE. If either the SMMU or system cannot fully support IO-coherent access to SMMU structures/queues/translations, this reads as 0. • Note: This bit only pertains to accesses made directly by the SMMU in response to internal operations. It does not indicate that transactions from client devices are also IO-coherent, this capability must be determined in a system-specific manner, for example using the CCA field specified in the IO Remapping Table [9]. • Note: For embedded implementations using preset tables or queues, this bit only pertains to accesses made outside of the preset structures. Access to this field is RO. TTF, bits [3:2] Translation table formats supported at both stage 1 and stage 2. The value of this field is an IMPLEMENTATION DEFINED choice of: TTF Meaning 0b01 VMSAv8-32 LPAE. 0b10 VMSAv8-64. 0b11 VMSAv8-32 LPAE and VMSAv8-64. All other values are reserved. TTF[0] is 0 in implementations where either SMMU_IDR3.DPT is 1 or SMMU_R_IDR3.DPT is 1. Access to this field is RO. S1P, bit [1] Stage1 translation supported. The value of this field is an IMPLEMENTATION DEFINED choice of: S1P Meaning 0b0 Stage 1 translation not supported. 0b1 Stage 1 translation supported. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 370

Chapter 6. Memory map and registers 6.3. Register formats S2P, bit [0] Stage2 translation supported. The value of this field is an IMPLEMENTATION DEFINED choice of: S2P Meaning 0b0 Stage 2 translation not supported. 0b1 Stage 2 translation supported. Access to this field is RO. Accessing SMMU_IDR0 Accesses to this register use the following encodings: Accessible at offset 0x0000 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 371

Chapter 6. Memory map and registers 6.3. Register formats 6.3.2 SMMU_IDR1 The SMMU_IDR1 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 30 29 REL 28 27 26 CMDQS 25 21 EVENTQS 20 16 PRIQS 15 11 SSIDSIZE 10 6 SIDSIZE 5 0 ECMDQ TABLES_PRE SET ATTR_PERMS_OVR ATTR_TYPES_OVR QUEUES_PRESET ECMDQ, bit [31] Support for enhanced Command queue interface. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ Meaning 0b0 Enhanced Command queue interface not supported. SMMU_IDR6 is RES0. 0b1 Enhanced Command queue interface details are advertised in SMMU_IDR6. If this field is 1, then all of the following are true: • SMMU_IDR0.COHACC == 1. • SMMU_IDR2.RECMDQ == 0. • SMMU_IDR0.MSI == 1. • SMMU_IDR1.QUEUES_PRESET == 0. See section 3.5.6 Enhanced Command queue interfaces. Access to this field is RO. TABLES_PRESET, bit [30] Table base addresses fixed. The value of this field is an IMPLEMENTATION DEFINED choice of: TABLES_PRESET Meaning 0b0 The contents of the registers SMMU_()STRTAB_BASE and SMMU(_)STRTAB_BASE_CFG are not fixed. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 372

Chapter 6. Memory map and registers 6.3. Register formats TABLES_PRESET Meaning 0b1 The contents of the registers SMMU_()STRTAB_BASE and SMMU()STRTAB_BASE_CFG are fixed. Access to this field is RO. QUEUES_PRESET, bit [29] Queue base addresses fixed. The value of this field is an IMPLEMENTATION DEFINED choice of: QUEUES_PRESET Meaning 0b0 The contents of the registers SMMU()CMDQ_BASE, SMMU()EVENTQ_BASE, and if present, SMMU(R_)PRIQ_BASE are not fixed. 0b1 The contents of the registers SMMU_()CMDQ_BASE, SMMU()EVENTQ_BASE, and if present, SMMU(R_)PRIQ_BASE are fixed. This field must be 0 if any of the following are true: • SMMU_IDR1.ECMDQ == 1. • SMMU_S_IDR0.ECMDQ == 1. • SMMU_R_IDR0.ECMDQ == 1. • SMMU_(*_)IDR2.RECMDQ == 1. Access to this field is RO. REL, bit [28] Relative base pointers. The value of this field is an IMPLEMENTATION DEFINED choice of: REL Meaning 0b0 When the corresponding preset field is set, base address registers report an absolute address. 0b1 When the corresponding preset field is set, base address registers report an address offset. • Relative addresses are calculated using an addition of the unsigned ADDR field onto the base address of Page 0. When SMMU_IDR1.TABLES_PRESET == 0 and SMMU_IDR1.QUEUES_PRESET == 0, this field is RES0. Access to this field is RO. ATTR_TYPES_OVR, bit [27] Incoming MemType, Shareability, allocation and transient hints override. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 373

Chapter 6. Memory map and registers 6.3. Register formats ATTR_TYPES_OVR Meaning 0b0 Incoming attributes cannot be overridden before translation or by global bypass. 0b1 Incoming attributes can be overridden. Access to this field is RO. ATTR_PERMS_OVR, bit [26] Incoming Data or Instruction, User or Privileged, input NS attribute override. The value of this field is an IMPLEMENTATION DEFINED choice of: ATTR_PERMS_OVR Meaning 0b0 Incoming attributes cannot be overridden before translation or by global bypass. 0b1 Incoming attributes can be overridden. Access to this field is RO. CMDQS, bits [25:21] Maximum number of Command queue entries. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQS Meaning 0b00000..0b10011 Maximum number of entries as log2(entries). All other values are reserved. • Note: The index register values include an extra bit for wrap. Therefore a queue with 2N entries has indices of N bits, but an index register containing (N+1) bits. Access to this field is RO. EVENTQS, bits [20:16] Maximum number of Event queue entries. The value of this field is an IMPLEMENTATION DEFINED choice of: EVENTQS Meaning 0b00000..0b10011 Maximum number of entries as log2(entries). All other values are reserved. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 374

Chapter 6. Memory map and registers 6.3. Register formats PRIQS, bits [15:11] Maximum number of PRI queue entries. The value of this field is an IMPLEMENTATION DEFINED choice of: PRIQS Meaning 0b00000..0b10011 Maximum number of entries as log2(entries). All other values are reserved. If SMMU_IDR0.PRI == 0, this field has an IMPLEMENTATION SPECIFIC value. Access to this field is RO. SSIDSIZE, bits [10:6] Max bits of SubstreamID. The value of this field is an IMPLEMENTATION DEFINED choice of: SSIDSIZE Meaning 0b00000..0b10100 Maximum number of bits representing the SubstreamID. All other values are reserved. • The value 0b00000 means no substreams are supported. • This field reflects the physical SubstreamID representation size, that is the SMMU cannot represent or be presented with SubstreamIDs greater than SSIDSIZE. Access to this field is RO. SIDSIZE, bits [5:0] Max bits of StreamID. The value of this field is an IMPLEMENTATION DEFINED choice of: SIDSIZE Meaning 0b000000..0b100000 Maximum number of bits representing the StreamID. All other values are reserved. • The value 0b000000 means the SMMU supports one stream. • This must reflect the physical StreamID size, that is the SMMU cannot represent or be presented with StreamIDs greater than SIDSIZE. • When SMMU_IDR1.SIDSIZE >= 7, SMMU_IDR0.ST_LEVEL != 0b00. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 375

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_IDR1 Accesses to this register use the following encodings: Accessible at offset 0x0004 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 376

Chapter 6. Memory map and registers 6.3. Register formats 6.3.3 SMMU_IDR2 The SMMU_IDR2 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 30 29 28 27 26 25 24 RES0 23 10 BA_VATOS 9 0 ECMDQ_C MD_CFGI ECMDQ_CMD_ TLBI ECMDQ_CMD_ATC ECMDQ_CMD_PRI RECMDQ RES0 ECMDQ_CMD_FAULT ECMDQ_CMD_DPTI ECMDQ_CMD_CFGI, bit [31] When SMMU_IDR2.RECMDQ == 1: Support for CMD_CFGI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_CFGI Meaning 0b0 Configuration invalidations are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 Configuration invalidations are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_TLBI, bit [30] When SMMU_IDR2.RECMDQ == 1: Support for CMD_TLBI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 377

Chapter 6. Memory map and registers 6.3. Register formats ECMDQ_CMD_TLBI Meaning 0b0 Only CMD_TLBI_NH_ and CMD_TLBI_NSNH_ALL are supported on the RECMDQs. Other CMD_TLBI_ commands lead to CERROR_ILL when issued to the RECMDQs. 0b1 All TLBI commands which are supported by the implementation are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_ATC, bit [29] When SMMU_IDR2.RECMDQ == 1 and SMMU_IDR0.ATS == 1: Support for CMD_ATC_INV on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_ATC Meaning 0b0 CMD_ATC_INV is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_ATC_INV is supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_PRI, bit [28] When SMMU_IDR2.RECMDQ == 1 and SMMU_IDR0.PRI == 1: Support for CMD_PRI_RESP on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_PRI Meaning 0b0 CMD_PRI_RESP is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_PRI_RESP is supported on the RECMDQs. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 378

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. ECMDQ_CMD_DPTI, bit [27] When SMMU_IDR2.RECMDQ == 1 and SMMU_IDR3.DPT == 1: Support for CMD_DPTI* on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_DPTI Meaning 0b0 DPT maintenance commands are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 DPT maintenance commands are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_FAULT, bit [26] When SMMU_IDR2.RECMDQ == 1: Support for fault response command on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_FAULT Meaning 0b0 CMD_RESUME and CMD_STALL_TERM are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_RESUME and CMD_STALL_TERM are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. Bit [25] Reserved, RES0. RECMDQ, bit [24] Support for Restricted ECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 379

Chapter 6. Memory map and registers 6.3. Register formats RECMDQ Meaning 0b0 Restricted ECMDQs are not supported. 0b1 Restricted ECMDQs are supported. If this field is 1, then all of the following are true: • SMMU_IDR1.ECMDQ == 0. • SMMU_IDR0.COHACC == 1. • SMMU_IDR0.MSI == 1. • SMMU_IDR1.QUEUES_PRESET == 0. Access to this field is RO. Bits [23:10] Reserved, RES0. BA_VATOS, bits [9:0] When SMMU_IDR0.VATOS == 1: VATOS page base address offset. All BA values are encoded as an unsigned offset from SMMU address 0x20000 in units of 64KB. Page_Address = SMMU_BASE + 0x20000 + (BA * 0x10000). This field has an IMPLEMENTATION DEFINED value. Access to this field is RO. Otherwise: Reserved, RES0. Accessing SMMU_IDR2 Accesses to this register use the following encodings: Accessible at offset 0x0008 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 380

Chapter 6. Memory map and registers 6.3. Register formats 6.3.4 SMMU_IDR3 The SMMU_IDR3 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR3 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 29 28 27 26 FNG 25 24 AIE 23 22 THE 21 20 19 18 17 16 DPT 15 14 13 BBML 12 11 RIL 10 STT 9 FWB 8 7 6 PPS 5 XNX 4 3 HAD 2 RES0 1 0 TLBIW HACDBS HDBSS MTCOMB MTEPERM S2PO E0PD PTWNNC PASIDTT EPAN S1PI S2PI MPAM PBHA RES0 Bits [31:29] Reserved, RES0. TLBIW, bit [28] Indicates support for TLBI VMALL for Dirty state The value of this field is an IMPLEMENTATION DEFINED choice of: TLBIW Meaning 0b0 TLBI VMALL for Dirty state is not supported. 0b1 TLBI VMALL for Dirty state is supported. If this bit is 1, then SMMU_IDR0.S2P is 1. Access to this field is RO. HACDBS, bit [27] Indicates support for hardware accelerator for cleaning Dirty state in the Non-secure programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HACDBS Meaning 0b0 Hardware accelerator for cleaning Dirty state is not supported. 0b1 Hardware accelerator for cleaning Dirty state is supported. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 381

Chapter 6. Memory map and registers 6.3. Register formats If this bit is 1, then SMMU_IDR3.HDBSS is 1. Access to this field is RO. HDBSS, bit [26] Support for hardware Dirty state tracking Structure for Non-secure programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HDBSS Meaning 0b0 Hardware Dirty state tracking Structure is not supported for the Non-secure programming interface. 0b1 Hardware Dirty state tracking Structure is supported for the Non-secure programming interface. If this bit is 1, then the following applies: • SMMU_IDR0.HTTU[1] is 1. • SMMU_IDR0.S2P is 1. If SMMU_IDR3.HACDBS is 1, then this bit is 1. Access to this field is RO. FNG, bit [25] Support for interoperability with a PE with FNGx control fields. The value of this field is an IMPLEMENTATION DEFINED choice of: FNG Meaning 0b0 CD.FNGx control bits are RES0. 0b1 The nG bit in stage 1 table descriptors is interpreted depending on the configuration of CD.FNGx. In SMMUv3.5 and later, support for this feature is mandatory when SMMU_IDR0.S1P == 1. If SMMU_IDR0.S1P is 0, this field is RES0. Note: The SMMU does not support concurrent use of two ASIDs for a stage 1 translation regime. Access to this field is RO. MTCOMB, bit [24] Removes No_snoop transformation of output memory attributes and enables controlled transformation of incoming memory attributes. The value of this field is an IMPLEMENTATION DEFINED choice of: MTCOMB Meaning 0b0 Software configuration to combine incoming memory type is not supported, and the No_snoop attribute is not affected by STE.S2FWB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 382

Chapter 6. Memory map and registers 6.3. Register formats MTCOMB Meaning 0b1 Software configuration to combine incoming memory type is supported, and the No_snoop attribute is affected by STE.S2FWB. See also: • 13.1.8 Memory Type Combine (MTCOMB). Access to this field is RO. AIE, bit [23] Indicates support for stage 1 Attribute Index Extension The value of this field is an IMPLEMENTATION DEFINED choice of: AIE Meaning 0b0 Stage 1 Attribute Index Extension is not supported. 0b1 Stage 1 Attribute Index Extension is supported. If SMMU_IDR0.S1P is 0, then this field is RES0. Otherwise, if SMMU_IDR5.D128 is 1, then this bit is 1. If this bit is 1, then the CD.AIE field is present. See also: • CD.{MAIR0, MAIR1}. • CD.AIE. Access to this field is RO. MTEPERM, bit [22] SMMU support for stage 2 MemAttr NoTagAccess encodings The value of this field is an IMPLEMENTATION DEFINED choice of: MTEPERM Meaning 0b0 Stage 2 NoTagAccess encodings are reserved. 0b1 Stage 2 NoTagAccess encodings are supported by the SMMU. If SMMU_IDR0.S2P is 0, this field is RES0. In SMMUv3.4 and later, this bit is 1. Access to this field is RO. THE, bit [21] Support for translation hardening extension The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 383

Chapter 6. Memory map and registers 6.3. Register formats THE Meaning 0b0 Translation hardening extension is not supported. 0b1 Translation hardening extension is supported. If this bit is 1 and SMMU_IDR0.S2P is 1, then SMMU_IDR3.S2PI is 1. If SMMU_IDR0.S1P is 0, then this field is RES0. See also: • 3.27 Translation Hardening. Access to this field is RO. S2PO, bit [20] Support for stage 2 permission overlays The value of this field is an IMPLEMENTATION DEFINED choice of: S2PO Meaning 0b0 Stage 2 permission overlays are not supported. 0b1 Stage 2 permission overlays are supported. If this bit is 1, then SMMU_IDR3.S2PI is 1. See also: • 3.26.2 Stage 2 permission indirections. Access to this field is RO. S2PI, bit [19] Support for stage 2 permission indirections The value of this field is an IMPLEMENTATION DEFINED choice of: S2PI Meaning 0b0 Stage 2 permission indirections are not supported. 0b1 Stage 2 permission indirections are supported. If SMMU_IDR0.S2P is 0, then this field is RES0. Otherwise, if SMMU_IDR5.D128 is 1, then this bit is 1. See also: • 3.26.2 Stage 2 permission indirections. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 384

Chapter 6. Memory map and registers 6.3. Register formats S1PI, bit [18] Support for stage 1 permission indirections The value of this field is an IMPLEMENTATION DEFINED choice of: S1PI Meaning 0b0 Stage 1 permission indirections are not supported. 0b1 Stage 1 permission indirections are supported. If SMMU_IDR0.S1P is 0, then this field is RES0. Otherwise, if SMMU_IDR5.D128 is 1, then this bit is 1. See also: • 3.26.1 Stage 1 permission indirections. Access to this field is RO. EPAN, bit [17] Support for the Enhanced PAN mechanism The value of this field is an IMPLEMENTATION DEFINED choice of: EPAN Meaning 0b0 Enhanced PAN is not supported. 0b1 Enhanced PAN is supported. This bit is 1 in any implementation of SMMUv3.4 or later. Access to this field is RO. PASIDTT, bit [16] The value of this field is an IMPLEMENTATION DEFINED choice of: PASIDTT Meaning 0b0 Use of the PASID TLP prefix on ATS Translated transactions is not supported architecturally. It is IMPLEMENTATION DEFINED whether ATS Translated transactions with a SubstreamID are assigned MPAM values as though they were untranslated transactions. 0b1 Use of the PASID TLP prefix on ATS Translated transactions is supported. This field indicates only that the SMMU supports use of PASID on ATS Translated transactions. Whether the PASID TLP prefix can be presented to the SMMU depends additionally on: • Support for the Translated Memory Requests with PASID capability in the device [1]. • Support for forwarding PASID on Translated Memory Requests in the Root Port. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 385

Chapter 6. Memory map and registers 6.3. Register formats If SMMU_IDR0.ATS is 0, or SMMU_IDR1.SSIDSIZE is 0, then this field is RES0. Note: Issue E.a of the IO Remapping Table [9] specification introduces a bit in the ATS Attribute field of the Root Complex Node to express support for forwarding PASID on Translated Memory Requests. Access to this field is RO. DPT, bit [15] Support for Device Permission Table, and EATS encoding 0b11, for Non-secure streams. The value of this field is an IMPLEMENTATION DEFINED choice of: DPT Meaning 0b0 DPT is not supported. 0b1 DPT is supported. If this bit is 1, then SMMU_IDR0.ATS is 1. For more information see: • STE.EATS • 3.9.1.3 Handling of ATS Translated transactions. • 3.24 Device Permission Table. Access to this field is RO. PTWNNC, bit [14] Behavior of STE.S2PTW bit. The value of this field is an IMPLEMENTATION DEFINED choice of: PTWNNC Meaning 0b0 STE.S2PTW == 0 permits stage 1 translation table walks mapped as Device memory. 0b1 STE.S2PTW == 0 treats stage 1 translation table walks mapped as Device memory, as Normal Non-cacheable accesses. In implementations of SMMUv3.3 and later that have SMMU_IDR0.S2P == 1, SMMU_IDR3.PTWNNC == 1. See STE.S2PTW for details. If SMMU_IDR0.S2P == 0, this bit is RES0. Access to this field is RO. E0PD, bit [13] The value of this field is an IMPLEMENTATION DEFINED choice of: E0PD Meaning 0b0 The E0PD mechanism is not implemented. 0b1 The E0PD mechanism is implemented. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 386

Chapter 6. Memory map and registers 6.3. Register formats This bit is 1 in all implementations of SMMUv3.3 and later. See CD.E0PD0 and CD.E0PD1. Access to this field is RO. BBML, bits [12:11] Break-Before-Make behavior Level. The value of this field is an IMPLEMENTATION DEFINED choice of: BBML Meaning 0b00 Level 0. 0b01 Level 1. 0b10 Level 2. • BBML is 0b01 or 0b10 in an implementation of SMMUv3.2 or later. • See section 3.21.1 Translation tables and TLB invalidation completion behavior. Access to this field is RO. RIL, bit [10] Range-based Invalidations and Level hint support for TLBI. The value of this field is an IMPLEMENTATION DEFINED choice of: RIL Meaning 0b0 Range-based invalidation and level hint are not supported. 0b1 Range-based invalidation and level hint are supported. • RIL is 1 in an implementation of SMMUv3.2 or later. • See section 4.4.1.1 Range-based invalidation and level hint. Access to this field is RO. STT, bit [9] Small translation table support. The value of this field is an IMPLEMENTATION DEFINED choice of: STT Meaning 0b0 Small translation tables are not supported. 0b1 Small translation tables are supported. • STT is 1 in implementations where SMMU_S_IDR1.SEL2 == 1. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 387

Chapter 6. Memory map and registers 6.3. Register formats FWB, bit [8] Stage 2 control of memory types and attributes. The value of this field is an IMPLEMENTATION DEFINED choice of: FWB Meaning 0b0 Stage 2 control of memory types and attributes is not supported and the STE.S2FWB bit is RES0. 0b1 Stage 2 control of memory types and attributes is supported. • FWB is 1 in an implementation of SMMUv3.2 or later. Access to this field is RO. MPAM, bit [7] Memory Partitioning And Monitoring (MPAM) support. The value of this field is an IMPLEMENTATION DEFINED choice of: MPAM Meaning 0b0 MPAM is not supported. 0b1 MPAM is supported in at least one Security state and the SMMU_(S_)MPAMIDR registers are present. The SMMU_(S_)MPAMIDR registers indicate whether MPAM is supported by a corresponding Security state. • MPAM support is optional. • When MPAM is not supported, all MPAM-related register fields are RES0. • See Chapter 17 Memory System Resource Partitioning and Monitoring. Access to this field is RO. Bit [6] Reserved, RES0. PPS, bit [5] The value of this field is an IMPLEMENTATION DEFINED choice of: PPS Meaning 0b0 The STE.PPAR field determines whether the PASID is used on a PRI auto-generated response. 0b1 If the request had a PASID, it is used on a PRI auto-generated response for PRI queue overflow, in the same way as when STE.PPAR == 1. The STE.PPAR field is not checked, and the value is IGNORED. • When SMMU_IDR0.PRI == 0 or SMMU_IDR1.SSIDSIZE == 0, this field is RES0. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 388

Chapter 6. Memory map and registers 6.3. Register formats XNX, bit [4] Indicates support for execute-never control distinction by Exception level at stage 2. The value of this field is an IMPLEMENTATION DEFINED choice of: XNX Meaning 0b0 EL0/EL1 execute control distinction at stage 2 not supported. 0b1 EL0/EL1 execute control distinction at stage 2 supported for both VMSAv8-64 and VMSAv8-32 LPAE stage 2 translation tables. • This feature extends the stage 2 TTD.XN field bit to 2 bits which are encoded, and behave as described in Armv8.2[2]. • In SMMUv3.0, this field is RES0. • In SMMUv3.1 and later, support for this feature is mandatory when stage 2 is supported, that is when SMMU_IDR0.S2P == 1. Access to this field is RO. PBHA, bit [3] Page-Based Hardware Attributes presence. The value of this field is an IMPLEMENTATION DEFINED choice of: PBHA Meaning 0b0 Page-Based Hardware Attributes not supported. • SMMU_IDR3.HAD determines whether Hierarchical Attribute Disables supported. 0b1 Page-Based Hardware Attributes supported. • If this field is one SMMU_IDR3.HAD must be one. • In SMMUv3.0, this field is RES0. • See CD.HWU059 and STE.S2HWU59. Access to this field is RO. HAD, bit [2] Hierarchical Attribute Disable presence. The value of this field is an IMPLEMENTATION DEFINED choice of: HAD Meaning 0b0 No Hierarchical Attribute Disable support. CD.HAD0 and CD.HAD1 are IGNORED. 0b1 CD.HAD0 and CD.HAD1 control Hierarchical Attribute Disable. • In SMMUv3.0, support for this feature is optional when stage 1 is supported, that is when SMMU_IDR0.S1P == 1. • In SMMUv3.1 and later, support for this feature is mandatory when stage 1 is supported, that is when SMMU_IDR0.S1P == 1. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 389

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_IDR0.S1P == 0, SMMU_IDR3.HAD == 0. Access to this field is RO. Bits [1:0] Reserved, RES0. Accessing SMMU_IDR3 Accesses to this register use the following encodings: Accessible at offset 0x000C from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 390

Chapter 6. Memory map and registers 6.3. Register formats 6.3.5 SMMU_IDR4 The SMMU_IDR4 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR4 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions IMPLEMENTATION DEFINED 31 0 IMPLEMENTATION DEFINED, bits [31:0] IMPLEMENTATION DEFINED. Additional Information The contents of this register are IMPLEMENTATION DEFINED and can be used to identify the presence of other IMPLEMENTATION DEFINED register regions elsewhere in the memory map. Accessing SMMU_IDR4 Accesses to this register use the following encodings: Accessible at offset 0x0010 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 391

Chapter 6. Memory map and registers 6.3. Register formats 6.3.6 SMMU_IDR5 The SMMU_IDR5 characteristics are: Purpose Provides information about the features implemented for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR5 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions STALL_MAX 31 16 RES0 15 12 VAX 11 10 9 8 DS 7 6 5 4 3 OAS 2 0 RES0 D128 GRAN64K RES0 GRAN4K GRAN16K STALL_MAX, bits [31:16] Maximum number of outstanding stalled transactions supported by the SMMU and system. This field has an IMPLEMENTATION DEFINED value. • The SMMU guarantees that the total number of Stall fault records that will be recorded in any Event queue, without any having been the subject of a resume or terminate command, will not exceed this number. • This field is RES0 if SMMU_S_IDR1.SECURE_IMPL == 0 and SMMU_IDR0.STALL_MODEL == 0b01, or if SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_S_IDR0.STALL_MODEL == 0b01. Access to this field is RO. Bits [15:12] Reserved, RES0. VAX, bits [11:10] Virtual Address eXtend. The value of this field is an IMPLEMENTATION DEFINED choice of: VAX Meaning 0b00 Virtual addresses of up to 48 bits can be translated per CD.TTBx. 0b01 Virtual addresses of up to 52 bits can be translated per CD.TTBx. 0b10 Virtual addresses of up to 56 bits can be translated by CD.TTBx. • Other values reserved. • In SMMUv3.0, this field is RES0. • An implementation is permitted to support VAX == 0b01 independently of whether OAS == 0b110. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 392

Chapter 6. Memory map and registers 6.3. Register formats • If VAX >= 0b01, then at least one of the following must be true: – SMMU_IDR5.GRAN64K == 1. – SMMU_IDR5.DS == 1 and one or both of SMMU_IDR5.GRAN4K and SMMU_IDR5.GRAN16K are 1. • If SMMU_IDR5.VAX indicates support for 56-bit input addresses, then SMMU_IDR5.D128 is 1. Access to this field is RO. Bit [9] Reserved, RES0. D128, bit [8] Support for 128-bit translation table descriptors. The value of this field is an IMPLEMENTATION DEFINED choice of: D128 Meaning 0b0 128-bit VMSAv9-128 descriptors are not supported. 0b1 128-bit VMSAv9-128 descriptors are supported. Note: Support for VMSAv8-64 and VMSAv8-32 descriptor formats is indicated in SMMU_IDR0.TTF. If this field is 1, then the following bits are all 1: • SMMU_IDR0.TTF[1], indicating support for VMSAv8-64 descriptors. • SMMU_IDR3.{S1PI, S2PO, AIE, MTEPERM}. If this field is 1, then SMMU_IDR0.TTF[0] is 0, meaning that VMSAv8-32 LPAE format descriptors are not supported. Access to this field is RO. DS, bit [7] Support for 52-bit address sizes when using 4KB and 16KB granules, if they are implemented. The value of this field is an IMPLEMENTATION DEFINED choice of: DS Meaning 0b0 52-bit address sizes when using 4KB and 16KB granules not supported. 0b1 52-bit address sizes supported when using 4KB and 16KB granules, if they are each supported. This feature requires that the SMMU supports both or either of 4KB or 16KB granules. If this bit is 1, the SMMU implements behaviors equivalent to the FEAT_LPA2 feature in the PE architecture. If this bit is 1 then the SMMU must additionally support at least 52-bit VA size, as indicated by SMMU_IDR5.VAX. This field is RES0 if both SMMU_IDR5.GRAN4K == 0 and SMMU_IDR5.GRAN16K == 0. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 393

Chapter 6. Memory map and registers 6.3. Register formats GRAN64K, bit [6] 64KB translation granule supported. The value of this field is an IMPLEMENTATION DEFINED choice of: GRAN64K Meaning 0b0 64KB translation granule not supported. 0b1 64KB translation granule supported. Access to this field is RO. GRAN16K, bit [5] 16KB translation granule supported. The value of this field is an IMPLEMENTATION DEFINED choice of: GRAN16K Meaning 0b0 16KB translation granule not supported. 0b1 16KB translation granule supported. Access to this field is RO. GRAN4K, bit [4] 4KB translation granule supported. The value of this field is an IMPLEMENTATION DEFINED choice of: GRAN4K Meaning 0b0 4KB translation granule not supported. 0b1 4KB translation granule supported. • When SMMU_IDR0.TTF[0] == 1, that is when VMSAv8-32 LPAE translation tables are supported, this field is RES1. Access to this field is RO. Bit [3] Reserved, RES0. OAS, bits [2:0] Output Address Size. Size of physical address output from SMMU. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 394

Chapter 6. Memory map and registers 6.3. Register formats OAS Meaning 0b000 32 bits. 0b001 36 bits. 0b010 40 bits. 0b011 42 bits. 0b100 44 bits. 0b101 48 bits. 0b110 52 bits. In SMMUv3.0, this value is Reserved. 0b111 56 bits. In SMMUv3.3, this value is Reserved. • This value must match the system physical address size, see section 3.4 Address sizes. • Note: Where reference is made to OAS, it is the size value that is referenced, not the literal value of this field. • If OAS indicates 52 bits, at least one of the following must be true: – SMMU_IDR5.GRAN64K == 1. – SMMU_IDR5.DS == 1. – SMMU_IDR5.D128 == 1. • If OAS indicates 56 bits, then SMMU_IDR5.D128 == 1. Note: Arm recommends that SMMUv3 implementations support at least 4KB and 64KB granules. Access to this field is RO. Accessing SMMU_IDR5 Accesses to this register use the following encodings: Accessible at offset 0x0014 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 395

Chapter 6. Memory map and registers 6.3. Register formats 6.3.7 SMMU_IIDR The SMMU_IIDR characteristics are: Purpose Provides information about the implementation and implementer of the SMMU, and architecture version supported. Configuration There are no configuration notes. Attributes SMMU_IIDR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions ProductID 31 20 Variant 19 16 Revision 15 12 Implementer 11 0 ProductID, bits [31:20] ProductID. This field has an IMPLEMENTATION DEFINED value. • This field is used to identify the SMMU part. • Note: Normally, when the SMMU_PIDR{0,1} registers are present, Arm expects that the SMMU_PIDR{0,1}.PART_{0,1} fields match the value of SMMU_IIDR.ProductID. If required, however, an implementation is permitted to provide values for SMMU_PIDR.{0,1}.PART_{0,1} that do not match the value of SMMU_IIDR.ProductID. Access to this field is RO. Variant, bits [19:16] Variant. This field has an IMPLEMENTATION DEFINED value. • This field is used to distinguish product variants, or major revisions of the product Access to this field is RO. Revision, bits [15:12] Revision. This field has an IMPLEMENTATION DEFINED value. • This field is used to distinguish minor revisions of the product Access to this field is RO. Implementer, bits [11:0] Implementer. This field has an IMPLEMENTATION DEFINED value. • Contains the JEP106 code of the company that implemented the SMMU: – [11:8] The JEP106 continuation code of the implementer. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 396

Chapter 6. Memory map and registers 6.3. Register formats – [7] Always 0. – [6:0] The JEP106 identity code of the implementer. • For an Arm implementation, bits[11:0] are 0x43B. • Matches the SMMU_PIDR{1,2,4}.DES_{0,1,2} fields, if SMMU_PIDR{1,2,4} are present. Access to this field is RO. Additional Information Note: This register duplicates some of the information that might be present in the ID_REGS SMMU_CIDRx/ SMMU_PIDRx fields. However, those fields are not required to be present in all implementations, so this register provides a way for software to probe this information in a generic way. Arm expects that the SMMU_CIDRx/SMMU_PIDRx fields are used by Arm CoreSight and related debug mechanisms rather than primarily being for the use of drivers. Accessing SMMU_IIDR Accesses to this register use the following encodings: Accessible at offset 0x0018 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 397

Chapter 6. Memory map and registers 6.3. Register formats 6.3.8 SMMU_AIDR The SMMU_AIDR characteristics are: Purpose This register identifies the SMMU architecture version to which the implementation conforms. Configuration There are no configuration notes. Attributes SMMU_AIDR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 8 0 0 0 0 7 4 ArchMinorRev 3 0 ArchMajorRev Bits [31:8] Reserved, RES0. ArchMajorRev, bits [7:4] Major Architecture revision. ArchMajorRev Meaning 0b0000 SMMUv3.x. All other values are reserved. Access to this field is RO. ArchMinorRev, bits [3:0] Minor Architecture revision. The value of this field is an IMPLEMENTATION DEFINED choice of: ArchMinorRev Meaning 0b0000 SMMUv3.0. 0b0001 SMMUv3.1. 0b0010 SMMUv3.2. 0b0011 SMMUv3.3. 0b0100 SMMUv3.4. 0b0101 SMMUv3.5. All other values are reserved. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 398

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_AIDR Accesses to this register use the following encodings: Accessible at offset 0x001C from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 399

Chapter 6. Memory map and registers 6.3. Register formats 6.3.9 SMMU_CR0 The SMMU_CR0 characteristics are: Purpose Non-secure SMMU programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_CR0 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 VMW 8 6 5 4 3 2 1 0 VSIDEN DPT_WALK_EN RES0 RES0 SMMUEN PRIQEN EVENTQEN CMDQEN ATSCHK Bits [31:12] Reserved, RES0. VSIDEN, bit [11] When SMMU_IDR6.VSID == 1: Enable access to the CIT and VSTT structures for DCMDQs that have SID translation enabled. VSIDEN Meaning 0b0 The CIT and VSTT structures cannot be accessed: • Commands requiring SID translation return HERROR_SID_CONFIG. • The SMMU does not access the CIT and VSTT structures and ignores the contents of the SMMU_CITAB_BASE and SMMU_CITAB_BASE_CFG registers. • The SMMU does not access, insert or modify any translation or configuration cache entries which hold information from the CIT or VSTTs except for invalidation by maintenance commands. 0b1 The CIT and VSTT structures required for SID translation can be accessed. Completion of an Update to this field guarantees all of the following: • For any DCMDQ that was disabled or empty during the Update, all later commands consumed when the queue is enabled and non-empty are guaranteed to observe the new value of this field. • For any DCMDQ that was enabled and non-empty during the Update: – Any commands subsequently submitted to that DCMDQ are guaranteed to observe the new value of this field. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 400

Chapter 6. Memory map and registers 6.3. Register formats – For any other commands, it is CONSTRAINED UNPREDICTABLE whether the value used is the old or new value of this field. Software is expected to disable all DCMDQs before Updating this field. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When SMMU_CR0.VSIDEN != SMMU_CR0ACK.VSIDEN, access to this field is RO. • Otherwise, access to this field is RW. Otherwise: Reserved, RES0. DPT_WALK_EN, bit [10] When SMMU_IDR3.DPT == 1: Enable DPT walks for Non-secure state. DPT_WALK_EN Meaning 0b0 Non-secure DPT walks are disabled. 0b1 Non-secure DPT walks are enabled. This field has similar Update behavior to other CR0 fields, in that: When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_CR0ACK.DPT_WALK_EN to the new value. Completion of an Update from 0 to 1 means that: • The SMMU may make fetches of DPT information, and cache DPT entries where permitted. • Transactions for a stream with STE.EATS configured to 0b11 do not result in a DPT_DISABLED DPT lookup fault. Completion of an Update from 1 to 0 means that: • The SMMU has completed all outstanding fetches of DPT information and will not make subsequent fetches. • Previously-cached last-level DPT information in TLBs might continue to be used until completion of appropriate CMD_DPTI_* commands. Note: Completion of a CMD_DPTI_ALL command is guaranteed to be sufficient to remove all DPT information cached in TLBs. Note: Completion of a CMD_DPTI_ALL command is also sufficient to guarantee observability of all Events resulting from the prior DPT_WALK_EN = 1 configuration. • Previously-cached STEs configured with STE.EATS = 0b11 might continue to be used until completion of appropriate Configuration invalidation commands. See also: • STE.EATS. • 3.24 Device Permission Table. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 401

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_CR0.DPT_WALK_EN != SMMU_CR0ACK.DPT_WALK_EN, access to this field is RO. • Otherwise, access to this field is RW. Otherwise: Reserved, RES0. Bit [9] Reserved, RES0. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: VMID Wildcard. VMW Meaning 0b000 TLB invalidations match VMID tags exactly. 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • All other values are reserved, and behave as 0b000. – N == upper bit of VMID as determined by SMMU_IDR0.VMID16. • This field has no effect on VMID matching on translation lookup. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. Bit [5] Reserved, RES0. ATSCHK, bit [4] When SMMU_IDR0.ATS == 1: ATS behavior. ATSCHK Meaning 0b0 Fast mode, all ATS Translated traffic passes through the SMMU without Stream table or TLB lookup. 0b1 Safe mode, all ATS Translated traffic is checked against the corresponding STE.EATS field to determine whether the StreamID is allowed to produce Translated transactions. See also: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 402

Chapter 6. Memory map and registers 6.3. Register formats • Section 3.9.1.2 Responses to ATS Translation Requests. • Section 13.6 PCIe and ATS attribute/permissions handling. • Section 17.3 PCIe ATS transactions. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQEN, bit [3] Enable Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Non-secure Command queue is disabled. 0b1 Processing of commands from the Non-secure Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Event queue writes. EVENTQEN Meaning 0b0 Writes to the Non-secure Event queue are disabled. 0b1 Writes to the Non-secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQEN, bit [1] When SMMU_IDR0.PRI == 1: Enable PRI queue writes. PRIQEN Meaning 0b0 Writes to the PRI queue are disabled. 0b1 Writes to the PRI queue are enabled. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 403

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. SMMUEN, bit [0] Non-secure SMMU enable SMMUEN Meaning 0b0 All Non-secure streams bypass SMMU, with attributes determined from SMMU_GBPA. 0b1 All Non-secure streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_CR0 Accesses to this register use the following encodings: Accessible at offset 0x0020 from SMMUv3_PAGE_0 Accesses to this register are RW. Additional information Each field in this register has a corresponding field in SMMU_CR0ACK. An individual field is described as Updated after the value of the field observed in SMMU_CR0ACK matches the value that was written to the field in SMMU_CR0. Reserved fields in SMMU_CR0 are not reflected in SMMU_CR0ACK. To ensure a field change has taken effect, software must poll the equivalent field in SMMU_CR0ACK after writing the field in this register. Each field in this register is independent and unaffected by ongoing update procedures of adjacent fields. Update of a field must complete in finite time, but is not required to occur immediately. The Update process has side effects which are guaranteed to be complete by the time update completes. A field that has been written is considered to be in a transitional state until Update has completed. Any SMMU function depending on its value observes the old value until the new value takes effect at an UNPREDICTABLE point before Update completes, whereupon the new value is guaranteed to be used. Therefore: • A new value written to a field cannot be assumed to have taken effect until Update completes. • A new value written to a field cannot be assumed not to have taken effect immediately after the write is observed by the SMMU. A written value is observable to reads of the register even before Update has completed. Anywhere this specification refers to behavior depending on a field value (for example, a rule of the form “REG must only be changed if SMMUEN == 0”), it is the post-Update value that is referred to. In this example, the rule would be broken were REG to be changed after the point that SMMU_(*_)CR0.SMMUEN has been written to 1 even if Update has not completed. Similarly, a field that has been written and is still in a transitional state (pre-Update completion) must be considered to still have the old value for the purposes of constraints the old value places upon software. For example, SMMU_CMDQ_CONS must not be written when CMDQEN == 1, or during an as-yet incomplete transition to 0 (as CMDQEN must still be considered to be 1). After altering a field value, software must not alter the value of the field again before the Update of the initial alteration is complete. Behavior on doing so is CONSTRAINED UNPREDICTABLE and one of the following occurs: • The new value is stored and the Update completes with any of the values written: – This behavior is only permitted in SMMUv3.1 and earlier. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 404

Chapter 6. Memory map and registers 6.3. Register formats – Note: The effective field value in use might not match that read back from this register. • The new value is ignored and Update completes using the first value (reflected in SMMU_CR0ACK. • Cease Update if the new value is the same as the original value before the first write. Note: This means no update side effects would occur. Note: A write with the same value (on that is not altered) is permitted. This might occur when altering an unrelated field in the same register while an earlier field Update is in process. 6.3.9.1 VMW Update completes after both of the following occur: • All received broadcast TLB maintenance operations are guaranteed to behave under the new value. • A fetched CMD_TLBI_ command specifying a VMID is guaranteed to be processed using the new value. This field is permitted to be cached in a TLB; an Update of this field must be followed by invalidation of all StreamWorld EL1 TLB entries, for all enabled stages of translation, for the appropriate Security state. This field must not be changed while a CMD_TLBI_ command specifying a VMID, or incoming broadcast TLB invalidation operations could be being processed. If this is done, the invalidations are not guaranteed to affect TLB entries with the specified VMIDs. Note: Arm recommends that software stops issuing invalidation commands and uses CMD_SYNC to ensure any prior invalidation commands are complete before changing this value. Similarly, Arm recommends that software completes all relevant broadcast TLBI operations before changing this field, and avoids issuing subsequent operations until Update is complete. 6.3.9.2 ATSCHK Update completes after both of the following occur: • Newly-fetched configuration is guaranteed to be interpreted with the new value. • ATS Translated Transactions are guaranteed to be treated with the new value. This bit is permitted to be cached in configuration caches. Update of this bit must be followed by invalidation of all STEs associated with ATS traffic. In addition, this bit must not be cleared when traffic could encounter valid STEs having EATS == 0b10. See STE.EATS and section 3.9.2 Changing ATS configuration for details of this rule. If this is done, ATS Translated transactions through such STEs have an IPA address and will be presented to the system directly instead of undergoing stage 2 translation. The point at which this begins to occur is UNPREDICTABLE. 6.3.9.3 CMDQEN When SMMU_()CR0.CMDQEN completes update from 1 to 0: • Command processing has stopped. • Any commands that are in progress have been Consumed in their entirety, and no new commands are fetched from the Command queue. All previous Command queue reads have completed and no reads will later become visible to the system that originated from the previous CMDQEN == 1 configuration. • Consumed commands are not guaranteed to be complete unless the last Consumed command was a CMD_SYNC (whose effects are to force completion of prior commands). • The index after the last Consumed command or the index of the first unprocessed command, if any, is observable in SMMU(_)CMDQ_CONS. Note: Completion of an Update of CMDQEN from 1 to 0 does not guarantee that an outstanding CMD_SYNC MSI has completed. When CMDQEN has completed Update to 1, the SMMU begins processing commands if the CMDQ_PROD / CMDQ_CONS indexes indicate the queue is non-empty and no Command queue error is present. See Chapter 4 Commands. Commands are not fetched when CMDQEN == 0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 405

Chapter 6. Memory map and registers 6.3. Register formats 6.3.9.4 EVENTQEN When SMMU_()CR0.EVENTQEN is transitioned from 1 to 0, SMMU accesses to the queue stop. EVENTQEN completes Update when all committed event records that are in progress become visible in the queue and any Event queue abort conditions are visible in SMMU()GERROR.EVENTQ_ABT_ERR. Uncommitted events from terminated faulting transactions are discarded when the queue becomes unwritable. See section 7.2 Event queue recorded faults and events. 6.3.9.5 PRIQEN The effective value of PRIQEN is dependent on SMMUEN, however the value of SMMU_CR0ACK.PRIQEN is solely affected by the actual value of the SMMU_CR0.PRIQEN field. When the effective value of SMMU_CR0.PRIQEN is transitioned from 1 to 0, page request writes into the queue stop. PRIQEN completes Update when all committed page request records that are in progress become visible in the queue. When the effective value of PRIQEN == 0, incoming requests are discarded; see section 8.2 Miscellaneous. The SMMU_PRIQ registers are Guarded by the actual value of the SMMU_CR0.PRIQEN field, not the effective value. Note: This means that clearing SMMUEN but leaving PRIQEN == 1 is not a permitted method for changing the SMMU_PRIQ_ register configuration. 6.3.9.6 SMMUEN SMMU_CR0.SMMUEN controls translation through the Non-secure interface and behavior of transactions on Non-secure streams. When SMMU_S_IDR1.SECURE_IMPL == 1, SMMU_S_CR0.SMMUEN controls transactions on Secure streams and the SMMU might be translating Secure transactions, even if SMMU_CR0.SMMUEN == 0. In all cases, the effect of the SMMUEN of one programming interface does not affect transactions or requests associated with the other programming interface. When SMMU_()CR0.SMMUEN == 0: • Incoming transactions on streams with Security state matching that of the SMMUEN do not undergo translation, and their behavior is controlled by SMMU()GBPA: – If SMMU()GBPA.ABORT == 0, the transactions bypass the SMMU with attributes determined by the other fields in SMMU()GBPA. This includes transactions supplied with a SubstreamID. – If SMMU()GBPA.ABORT == 1, the transactions are terminated with abort. Note: This behavior also applies to transactions related to command consumption on DCMDQs. In the case of SMMU()GBPA.ABORT == 1, the transactions are further reported to the hypervisor as SMMU()ECMDQ_CONSn.HS_ERR_REASON = HERROR_IPA. See 3.5.7 Direct-mode Enhanced Command Queues. • When SMMU_CR0.SMMUEN == 0, the ATS interface is not operational: – Incoming ATS Translation Requests are returned with Unsupported Request status. – CMD_ATC_INV and CMD_PRI_RESP commands are ignored. – The effective value of PRIQEN is 0 (for SMMU_CR0.SMMUEN) and incoming PRI Page Requests are discarded. – All clients of the interface must undergo re-initialization when the SMMU is re-enabled. For PCIe clients, this will mean endpoint ATS and PRI facilities need to undergo re-initialization. – ATS Translated transactions are terminated with an abort. • Configuration or translation structures are not accessed: – The SMMU does not access the Stream table and ignores the contents of SMMU()STRTAB* configuration registers, which might be written by software when in this state. – Translation and configuration cache entries are not inserted or modified, except for invalidation by maintenance commands or broadcast operations. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 406

Chapter 6. Memory map and registers 6.3. Register formats * Note: Maintenance commands issued while SMMUEN == 0 can therefore guarantee the targeted entries do not exist in SMMU caches after the command has completed. * Note: The ‘other’ Security state might still have SMMUEN == 1 and therefore be inserting cache entries for that Security state. As these entries are not visible to or affected by the Non-secure programming interface, this is only a consideration for the Secure programming interface which can maintain Non-secure cache entries. – Prefetch commands do not access configuration or translations nor insert entries thereof into caches. – HTTU is not performed. Speculative setting of Access flag is prohibited. • As translation does not occur for bypassing transactions, translation-related events are not recorded. See section 7.2 Event queue recorded faults and events for events that are permitted to be recorded when SMMUEN == 0. • ATOS translation requests are not processed, see SMMU_GATOS_CTRL. • Commands and events are still processed, or recorded, as controlled by CMDQEN and EVENTQEN. Completion of an Update of SMMUEN from 0 to 1 ensures that: • Configuration written to SMMU_(_)CR2 has taken effect. • All new transactions will be treated with STE configuration relevant to their stream, and will not undergo SMMU bypass. • All associated ATOS_CTRL.RUN fields are 0, see SMMU_GATOS_CTRL. Completion of an Update of SMMUEN from 1 to 0 ensures that: • All stalled transactions that might be present and that are associated with the programming interface of the SMMUEN have been marked to be terminated with an abort and no new transactions can become stalled. – The STAG value of a stall event record relating to a stalled transaction affected by this update is returned to the set of values that the SMMU might use in future stall event records. – This transition does not guarantee that stalled transactions have already been terminated by the time of the completion. Software must wait for completion of outstanding transactions in an IMPLEMENTATION DEFINED manner. – Note: New transactions cannot stall because SMMU translation is disabled. • Effective PRIQEN value has transitioned to 0, including PRIQEN side effects. • ATOS-specific initialization and termination has completed, see SMMU_GATOS_CTRL for details. • ATOS translation requests that are underway have either completed or are terminated with a INTERNAL_ERR fault. The ATOS_CTRL.RUN fields of all affected ATOS register groups have been cleared, and ATOS_PAR has been updated with the result by the time Update completes. • All new transactions associated with the programming interface of the SMMUEN will undergo SMMU bypass (using the SMMU_(_)GBPA attributes). Note: At the point of transitioning SMMUEN, there might be transactions that are in progress that are buffered in the interconnect. The SMMU has no control over these transactions and the system might provide a mechanism to ensure they are flushed before SMMUEN is cleared, if required. The path of a transaction through the SMMU is atomic with respect to changes of SMMUEN, the SMMU treats a transaction as though SMMUEN did not change mid-way during the path of the transaction path through the SMMU, even if temporally this is not the case. Therefore, when SMMUEN changes, two groups of transactions that are in progress are formed for transactions relevant to the Security state of the SMMUEN in question: those that behave according to the old SMMUEN value, and those that behave according to the new value, so that it appears as though the SMMUEN change instantaneously takes effect at some point in time and incoming transactions are processed in their entirety either before or after this point. There is no requirement for the boundary between these groups to be predictable when SMMUEN is altered in the middle of a stream of transactions. However, interconnect ordering guarantees are maintained throughout. The completion of an update to SMMUEN guarantees that all new transactions arriving at the SMMU will be treated with the new value. A change to SMMUEN is not required to invalidate cached configuration or TLB entries. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 407

Chapter 6. Memory map and registers 6.3. Register formats 6.3.10 SMMU_CR0ACK The SMMU_CR0ACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls in the Non-secure SMMU programming interface, SMMU_CR0. Configuration There are no configuration notes. Attributes SMMU_CR0ACK is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 VMW 8 6 5 4 3 2 1 0 VSIDEN DPT_WALK_EN RES0 RES0 SMMUEN PRIQEN EVENTQEN CMDQEN ATSCHK Bits [31:12] Reserved, RES0. VSIDEN, bit [11] When SMMU_IDR6.VSID == 1: Enable access to the CIT and VSTT structures for DCMDQs that have SID translation enabled. VSIDEN Meaning 0b0 The CIT and VSTT structures cannot be accessed: • Commands requiring SID translation return HERROR_SID_CONFIG. • The SMMU does not access the CIT and VSTT structures and ignores the contents of the SMMU_CITAB_BASE and SMMU_CITAB_BASE_CFG registers. • The SMMU does not access, insert or modify any translation or configuration cache entries which hold information from the CIT or VSTTs except for invalidation by maintenance commands. 0b1 The CIT and VSTT structures required for SID translation can be accessed. See SMMU_CR0.VSIDEN. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When SMMU_CR0.VSIDEN != SMMU_CR0ACK.VSIDEN, access to this field is RO. • Otherwise, access to this field is RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 408

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. DPT_WALK_EN, bit [10] When SMMU_IDR3.DPT == 1: Enable DPT walks for Non-secure state. DPT_WALK_EN Meaning 0b0 Non-secure DPT walks are disabled. 0b1 Non-secure DPT walks are enabled. See SMMU_CR0.DPT_WALK_EN. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [9] Reserved, RES0. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: VMID Wildcard. VMW Meaning 0b000 TLB invalidations match VMID tags exactly. 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • All other values are reserved, and behave as 0b000. – N == upper bit of VMID as determined by SMMU_IDR0.VMID16. • This field has no effect on VMID matching on translation lookup. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. Bit [5] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 409

Chapter 6. Memory map and registers 6.3. Register formats ATSCHK, bit [4] When SMMU_IDR0.ATS == 1: ATS behavior. ATSCHK Meaning 0b0 Fast mode, all ATS Translated traffic passes through the SMMU without Stream table or TLB lookup. 0b1 Safe mode, all ATS Translated traffic is checked against the corresponding STE.EATS field to determine whether the StreamID is allowed to produce Translated transactions. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQEN, bit [3] Enable Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Non-secure Command queue is disabled. 0b1 Processing of commands from the Non-secure Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Event queue writes. EVENTQEN Meaning 0b0 Writes to the Non-secure Event queue are disabled. 0b1 Writes to the Non-secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQEN, bit [1] When SMMU_IDR0.PRI == 1: Enable PRI queue writes. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 410

Chapter 6. Memory map and registers 6.3. Register formats PRIQEN Meaning 0b0 Writes to the PRI queue are disabled. 0b1 Writes to the PRI queue are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SMMUEN, bit [0] Non-secure SMMU enable. SMMUEN Meaning 0b0 All Non-secure streams bypass SMMU, with attributes determined from SMMU_GBPA. 0b1 All Non-secure streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_CR0ACK Accesses to this register use the following encodings: Accessible at offset 0x0024 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 411

Chapter 6. Memory map and registers 6.3. Register formats 6.3.11 SMMU_CR1 The SMMU_CR1 characteristics are: Purpose Non-secure SMMU programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_CR1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 8 7 6 5 4 3 2 1 0 TABLE_SH TABLE_OC TABLE_IC QUEUE_IC QUEUE_OC QUEUE_SH Bits [31:12] Reserved, RES0. TABLE_SH, bits [11:10] Table access Shareability. TABLE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: When SMMU_CR1.TABLE_OC == 0b00 and SMMU_CR1.TABLE_IC == 0b00, this field is IGNORED and behaves as Outer Shareable. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.SMMUEN == ‘0’ – SMMU_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. TABLE_OC, bits [9:8] Table access Outer Cacheability. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 412

Chapter 6. Memory map and registers 6.3. Register formats TABLE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.SMMUEN == ‘0’ – SMMU_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. TABLE_IC, bits [7:6] Table access Inner Cacheability. TABLE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.SMMUEN == ‘0’ – SMMU_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. QUEUE_SH, bits [5:4] Queue access Shareability. QUEUE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 413

Chapter 6. Memory map and registers 6.3. Register formats QUEUE_SH Meaning 0b10 Outer Shareable. 0b11 Inner Shareable. • When SMMU_CR1.QUEUE_OC == 0b00 and SMMU_CR1.QUEUE_IC == 0b00, this field is IG- NORED and behaves as Outer Shareability. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.EVENTQEN == ‘0’ – SMMU_CR0ACK.EVENTQEN == ‘0’ – SMMU_CR0.CMDQEN == ‘0’ – SMMU_CR0ACK.CMDQEN == ‘0’ – SMMU_CR0.PRIQEN == ‘0’ – SMMU_CR0ACK.PRIQEN == ‘0’ – SMMU_HDBSS_BASE0.V == ‘0’ – SMMU_HDBSS_PROD0.VACK == ‘0’ – SMMU_HDBSS_BASE1.V == ‘0’ – SMMU_HDBSS_PROD1.VACK == ‘0’ – SMMU_HACDBS_BASE.EN == ‘0’ – SMMU_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_IDR1.ECMDQ == 0 · SMMU_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Non-secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_ECMDQ_PRODn.EN == SMMU_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_OC, bits [3:2] Queue access Outer Cacheability. QUEUE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 414

Chapter 6. Memory map and registers 6.3. Register formats Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.EVENTQEN == ‘0’ – SMMU_CR0ACK.EVENTQEN == ‘0’ – SMMU_CR0.CMDQEN == ‘0’ – SMMU_CR0ACK.CMDQEN == ‘0’ – SMMU_CR0.PRIQEN == ‘0’ – SMMU_CR0ACK.PRIQEN == ‘0’ – SMMU_HDBSS_BASE0.V == ‘0’ – SMMU_HDBSS_PROD0.VACK == ‘0’ – SMMU_HDBSS_BASE1.V == ‘0’ – SMMU_HDBSS_PROD1.VACK == ‘0’ – SMMU_HACDBS_BASE.EN == ‘0’ – SMMU_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_IDR1.ECMDQ == 0 · SMMU_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Non-secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_ECMDQ_PRODn.EN == SMMU_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_IC, bits [1:0] Queue access Inner Cacheability. QUEUE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_CR0.EVENTQEN == ‘0’ – SMMU_CR0ACK.EVENTQEN == ‘0’ – SMMU_CR0.CMDQEN == ‘0’ – SMMU_CR0ACK.CMDQEN == ‘0’ – SMMU_CR0.PRIQEN == ‘0’ – SMMU_CR0ACK.PRIQEN == ‘0’ – SMMU_HDBSS_BASE0.V == ‘0’ – SMMU_HDBSS_PROD0.VACK == ‘0’ – SMMU_HDBSS_BASE1.V == ‘0’ – SMMU_HDBSS_PROD1.VACK == ‘0’ – SMMU_HACDBS_BASE.EN == ‘0’ ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 415

Chapter 6. Memory map and registers 6.3. Register formats – SMMU_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_IDR1.ECMDQ == 0 · SMMU_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Non-secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_ECMDQ_PRODn.EN == SMMU_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. Additional Information The TABLE_ fields set the attributes for access to memory through the SMMU_STRTAB_BASE.ADDR pointer and any accesses made to a VMS through STE.VMSPtr in a Non-secure STE. The QUEUE_ fields set the attributes for access to memory through SMMU_CMDQ_BASE.ADDR, SMMU_EVENTQ_BASE.ADDR and SMMU_PRIQ_BASE.ADDR pointers. When SMMU_IDR1.ECMDQ is 1 or SMMU_IDR2.RECMDQ is 1, QUEUE_ fields set the attributes for access to memory through SMMU_ECMDQ_BASEn.ADDR pointers. Cache allocation hints are present in each BASE register and are ignored unless a cacheable type is used for the table or queue to which the register corresponds. The transient attribute is IMPLEMENTATION DEFINED for each _BASE register. See section 13.1.2 Attribute support; use of an unsupported memory type for structure or queue access might cause the access to be treated as an external abort. For example, in the case of SMMU_STRTAB_BASE, an F_STE_FETCH fault is raised. Accessing SMMU_CR1 Accesses to this register use the following encodings: Accessible at offset 0x0028 from SMMUv3_PAGE_0 Accesses to this register are RW. Additional information 6.3.11.1 TABLE attributes The TABLE_ fields are preset when SMMU_IDR1.TABLES_PRESET == 1 and the effective attribute is unchangeable. In this case, a write of a different value to these fields is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write of the field is IGNORED. • The new value is stored, making it visible to future reads of the field, but have no effect on the (fixed) access type. Otherwise when not PRESET, the TABLE_ attributes reset to an UNKNOWN value and must be initialized by software. These fields are Guarded by SMMU_()CR0.SMMUEN and must only be changed when SMMU()CR0.SMMUEN == 0. A write to these fields when SMMU()CR0.SMMUEN == 1 is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write to the fields is IGNORED. This is the only permitted behavior in SMMUv3.2 and later. • The new attribute is applied, taking effect at an UNPREDICTABLE point before the SMMU is later disabled (SMMUEN transitioned 1 to 0). This behavior is permitted only in SMMUv3.1 and earlier. 6.3.11.2 QUEUE attributes The QUEUE_ fields are fixed and preset when SMMU_IDR1.QUEUES_PRESET == 1 and the effective attribute is unchangeable. In this case, a write of a different value to these fields is CONSTRAINED UNPREDICTABLE in the same way as for preset TABLE_ fields. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 416

Chapter 6. Memory map and registers 6.3. Register formats Otherwise when not preset, the QUEUE_ attributes reset to an UNKNOWN value and must be initialized by software. These fields are Guarded by SMMU_()CR0.EVENTQEN, SMMU_CR0.PRIQEN (for SMMU_CR1 and SMMU()CR0.CMDQEN. They must only change when access to all queues is disabled through SMMU()CR0.EVENTQEN == 0 and SMMU_CR0.PRIQEN == 0 and SMMU()CR0.CMDQEN == 0. In an implementation with Enhanced Command queues, they are additionally guarded by all SMMU()ECMDQ_PRODn.EN and SMMU()ECMDQ_CONSn.ENACK pairs associated with the respective Security state. They must only change when all SMMU()ECMDQ_PRODn.EN == SMMU(*_)ECMDQ_CONSn.ENACK == 0 for the corresponding Security state. A write to these fields when any of these queues are enabled is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write to the fields is IGNORED. This is the only permitted behavior in SMMUv3.2 and later. • The new attribute is applied, taking effect, with respect to an enabled queue access, at an UNPREDICTABLE point before the respective queue is later disabled (the enable flag transitioned from 1 to 0). This behavior is permitted only in SMMUv3.1 and earlier. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 417

Chapter 6. Memory map and registers 6.3. Register formats 6.3.12 SMMU_CR2 The SMMU_CR2 characteristics are: Purpose Non-secure SMMU programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_CR2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 4 3 PTM 2 1 E2H 0 REC_CFG_ATS RECINVSID Bits [31:4] Reserved, RES0. REC_CFG_ATS, bit [3] When SMMU_IDR0.ATSRECERR == 1: Record Configuration-related errors for ATS and PRI in the Event queue. REC_CFG_ATS Meaning 0b0 SMMU records only the base set of Events for ATS-related and PRI requests. 0b1 SMMU records an extended set of Events for ATS-related and PRI requests. See section 3.9.1.2 Responses to ATS Translation Requests and section 8.1 PRI queue overflow for details of which events are recorded or not. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. PTM, bit [2] When SMMU_IDR0.BTM == 1: Private TLB Maintenance. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 418

Chapter 6. Memory map and registers 6.3. Register formats PTM Meaning 0b0 The SMMU participates in broadcast TLB maintenance, if implemented. See SMMU_IDR0.BTM. 0b1 The SMMU is not required to invalidate any local TLB entries on receipt of broadcast TLB maintenance operations for Non-secure EL1, Non-secure EL2 or Non-secure EL2-E2H translation regimes. • Broadcast invalidation for Secure EL1, Secure EL2, Secure EL2-E2H or EL3 translation regimes are not affected by this flag, see SMMU_S_CR2.PTM. • This field resets to an IMPLEMENTATION SPECIFIC value. Arm recommends PTM is reset to 1 where it is supported, but software cannot rely on this value. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. RECINVSID, bit [1] Record event C_BAD_STREAMID from invalid input StreamIDs. RECINVSID Meaning 0b0 C_BAD_STREAMID events are not recorded for the Non-secure programming interface. 0b1 C_BAD_STREAMID events are permitted to be recorded for the Non-secure programming interface. The reset behavior of this field is: • This field resets to an UNKNOWN value. E2H, bit [0] When SMMU_IDR0.Hyp == 1: Enable Non-secure EL2-E2H translation regime. E2H Meaning 0b0 EL2 translation regime, without ASIDs or VMIDs. 0b1 EL2-E2H translation regime used, with ASID. • This field affects the STE.STRW encoding 0b10, which selects a hypervisor translation regime for the resulting translations. The translations are tagged without ASID in EL2 mode, or with ASID in EL2-E2H mode. Note: Arm expects software to set this bit to match HCR_EL2.E2H in host PEs. • This bit is permitted to be cached in configuration caches and TLBs. Changes to this bit must be accompanied by invalidation of configuration and translations associated with streams configured with StreamWorld == NS-EL2 or NS-EL2-E2H. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 419

Chapter 6. Memory map and registers 6.3. Register formats • This bit affects the StreamWorld of Non-secure streams only. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Accessing SMMU_CR2 This register is made read-only when the associated SMMU_CR0.SMMUEN is Updated to 1. This register must only be changed when SMMU_CR0.SMMUEN == 0. After SMMU_CR0.SMMUEN has been changed but before its Update completes, a write to this register is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • Apply the new value. • Ignore the write. In SMMUv3.2 and later, this is the only permitted behavior. When this register is changed, the new value takes effect (affects SMMU behavior corresponding to the field changed) at an UNPREDICTABLE time, bounded by a subsequent Update of SMMUEN to 1. As a side effect of SMMUEN completing Update to 1, a prior change to this register is guaranteed to have taken effect. Accesses to this register use the following encodings: Accessible at offset 0x002C from SMMUv3_PAGE_0 • When SMMU_CR0.SMMUEN == ‘0’ and SMMU_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. Additional information 6.3.12.1 PTM A change to PTM is permitted to take effect at any time prior to a subsequent Update of SMMUEN to 1. If incoming broadcast TLB invalidates are received after PTM is changed but before Update of SMMUEN completes, it is UNPREDICTABLE whether the invalidations take effect. Broadcast invalidations issued after SMMUEN has Updated to 1 are guaranteed to be treated with the value of PTM prior to the SMMUEN update, if PTM has not been modified after SMMUEN was written. 6.3.12.2 RECINVSID This field only has an effect on transactions received when SMMUEN == 1, therefore a change cannot affect transactions in flight. 6.3.12.3 E2H All Non-secure EL2/EL2-E2H configuration cache entries and TLB entries must be invalidated when E2H is changed. The equivalent requirement exists for Secure EL2/EL2-E2H and changes to SMMU_S_CR2.E2H, if implemented. Note: The behavior of the CMD_TLBI_EL2_VAA and CMD_TLBI_EL2_ASID commands depends on the value of E2H. Because, after write of SMMU_CR2, the effective action of E2H is UNPREDICTABLE until SMMUEN is transitioned to 1, it is UNPREDICTABLE whether these two commands behave according to E2H == 0 or E2H == 1. Consequently, CMD_TLBI_EL2_ALL must be used to invalidate EL2 TLB entries. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 420

Chapter 6. Memory map and registers 6.3. Register formats 6.3.13 SMMU_S2PII The SMMU_S2PII characteristics are: Purpose Configuration of stage 2 permission indirection interpretation in Non-secure state. Configuration This register is present only when SMMU_IDR3.S2PI == 1. Otherwise, direct accesses to SMMU_S2PII are RES0. Attributes SMMU_S2PII is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions S2PII15 63 60 S2PII14 59 56 S2PII13 55 52 S2PII12 51 48 S2PII11 47 44 S2PII10 43 40 S2PII9 39 36 S2PII8 35 32 S2PII7 31 28 S2PII6 27 24 S2PII5 23 20 S2PII4 19 16 S2PII3 15 12 S2PII2 11 8 S2PII1 7 4 S2PII0 3 0 S2PII

, bits [4p+3:4p], for p = 15 to 0 The set of 16 stage 2 base permission interpretations. This field is indexed by the PIIndex value derived from a stage 2 Block or Page descriptor, as S2PII[PIIndex4+3 : PIIndex4], to give a permission interpretation. S2PII

Meaning 0b0000 No Access 0b0001 Reserved, treated as No Access 0b0010 MRO 0b0011 MRO-TL1 0b0100 WO 0b0101 Reserved, treated as No Access 0b0110 MRO-TL0 0b0111 MRO-TL01 0b1000 RO 0b1001 RO+uX 0b1010 RO+pX 0b1011 RO+puX 0b1100 RW 0b1101 RW+uX 0b1110 RW+pX ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 421

Chapter 6. Memory map and registers 6.3. Register formats S2PII

Meaning 0b1111 RW+puX This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S2PII Arm strongly recommends that this register is not written if SMMUEN is 1 and there are any STEs for which STE.S2PIE is 1. Accesses to this register use the following encodings: Accessible at offset 0x0030 from SMMUv3_PAGE_0 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 422

Chapter 6. Memory map and registers 6.3. Register formats 6.3.14 SMMU_STATUSR The SMMU_STATUSR characteristics are: Purpose Provides information on the status of the component. Configuration There are no configuration notes. Attributes SMMU_STATUSR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 0 DORMANT Bits [31:1] Reserved, RES0. DORMANT, bit [0] When SMMU_IDR0.DORMHINT == 1: Dormant hint. DORMANT Meaning 0b0 The SMMU might have cached translation or configuration structure data, or be in the process of doing so. 0b1 The SMMU guarantees that no translation or configuration structure data is cached, and that no prefetches are in-flight. Software might avoid issuing configuration invalidation or TLB invalidation commands for changes to structures made visible to the SMMU before reading this hint as 1. See section 3.19.1 Dormant state. If SMMU_IDR0.RME_IMPL == 0, this field is not guaranteed to apply to GPT information in TLBs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Accessing SMMU_STATUSR Accesses to this register use the following encodings: Accessible at offset 0x0040 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 423

Chapter 6. Memory map and registers 6.3. Register formats 6.3.15 SMMU_GBPA The SMMU_GBPA characteristics are: Purpose Global ByPass Attribute Configuration There are no configuration notes. Attributes SMMU_GBPA is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 21 20 19 18 17 16 RES0 15 14 SHCFG 13 12 ALLOCCFG 11 8 RES0 7 5 4 MemAttr 3 0 Update ABORT PRIVCFG INSTCFG MTCFG Update, bit [31] Update completion flag. See section 6.3.15.1 Update procedure. The reset behavior of this field is: • This field resets to '0'. Bits [30:21] Reserved, RES0. ABORT, bit [20] Abort all incoming transactions. ABORT Meaning 0b0 Do not abort incoming transactions. Transactions bypass the SMMU with attributes given by other fields in this register. 0b1 Abort all incoming transactions. Note: An implementation can reset this field to 1, in order to implement a default deny policy on reset. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. INSTCFG, bits [19:18] Instruction/data override. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 424

Chapter 6. Memory map and registers 6.3. Register formats INSTCFG Meaning 0b00 Use incoming. 0b01 Reserved, behaves as 0b00. 0b10 Data. 0b11 Instruction. • INSTCFG only affects reads, writes are always output as Data. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. PRIVCFG, bits [17:16] User/privileged override. PRIVCFG Meaning 0b00 Use incoming. 0b01 Reserved, behaves as 0b00. 0b10 Unprivileged. 0b11 Privileged. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Bits [15:14] Reserved, RES0. SHCFG, bits [13:12] Shareability override. SHCFG Meaning 0b00 Non-shareable. 0b01 Use incoming. 0b10 Outer Shareable. 0b11 Inner Shareable. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. ALLOCCFG, bits [11:8] Allocation Configuration. • 0b0xxx use incoming RA/WA/TR allocation/transient hints. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 425

Chapter 6. Memory map and registers 6.3. Register formats • 0b1RWT Hints are overridden to given values: – Read Allocate == R. – Write Allocate == W. – Transient == T. • When overridden by this field, for each of RA, WA, and TR, both inner- and outer- hints are set to the same value. Because it is not architecturally possible to express hints for types that are Device or Normal Non-cacheable, this field has no effect on memory types that are not Normal-WB or Normal-WT, whether such types are provided with a transaction or overridden using MTCFG/MemAttr. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Bits [7:5] Reserved, RES0. MTCFG, bit [4] Memory Type override. MTCFG Meaning 0b0 Use incoming memory type. 0b1 Override incoming memory type using MemAttr field. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. MemAttr, bits [3:0] Memory type. • Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Accessing SMMU_GBPA Accesses to this register use the following encodings: Accessible at offset 0x0044 from SMMUv3_PAGE_0 • When SMMU_GBPA.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. Additional information This register controls the global bypass attributes used for transactions from Non-secure StreamIDs (as determined by SEC_SID) when SMMU_CR0.SMMUEN == 0. Transactions passing through the SMMU when it is disabled might have their attributes overridden/assigned using this register. Where Use incoming is selected, the attribute is taken from that supplied on the incoming interconnect, if supported. If the incoming interconnect does not supply the attribute, the SMMU generates a default attribute, which is selected for Use incoming. See Chapter 13 Attribute Transformation for details. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 426

Chapter 6. Memory map and registers 6.3. Register formats If SMMU_IDR3.MTCOMB == 0, it is IMPLEMENTATION DEFINED whether MTCFG, SHCFG and ALLOCCFG apply to streams associated with PCIe devices or whether incoming attributes are used for such streams regardless of the field values. If SMMU_IDR1.ATTR_TYPES_OVR == 0, MTCFG, SHCFG, ALLOCCFG are effectively fixed as Use incoming and it is IMPLEMENTATION SPECIFIC whether these fields read as zero or a previously written value. In this case, MemAttr reads as UNKNOWN. If SMMU_IDR1.ATTR_PERMS_OVR == 0, INSTCFG and PRIVCFG are effectively fixed as Use incoming and it is IMPLEMENTATION SPECIFIC whether these fields read as zero or a previously written value. If the outgoing interconnect does not support a particular attribute, the value written to the corresponding field of this register is IGNORED and it is IMPLEMENTATION SPECIFIC whether the field reads as zero or a previously written value. Update resets to zero and all other fields reset to an IMPLEMENTATION DEFINED state. This allows an implementation to provide useful default transaction attributes when software leaves the SMMU uninitialized. 6.3.15.1 Update procedure This register must be written with a single 32-bit write that simultaneously sets the Update bit to 1. Software must then poll the Update bit which is cleared when the attribute update has completed. The Update flag allows software to determine when a change in attributes takes effect. Transactions arriving at the SMMU after completion of a GBPA update are guaranteed to take the new attributes written. If GBPA is altered in the middle of a stream of transactions, the exact point in the sequence at which the change takes effect is UNPREDICTABLE. Note: It is the responsibility of client devices to ensure that transactions generated prior to an update have completed, meaning that no more transactions will become globally visible to the required Shareability domain of the overridden attributes with attributes given by a previous value of the register. This is achieved in an IMPLEMENTATION DEFINED manner. This register must only be written when Update == 0 (prior updates are complete). A write when an Update == 1, that is when a prior update is underway, is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write is IGNORED and update completes using the initial value. This is the only permitted behavior in SMMUv3.2 and later. • Update completes with any value. – Note: The effective attribute in use might not match that read back from this register. If this register is written without simultaneously setting Update to 1, the effect is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write is IGNORED. This is the only permitted behavior in SMMUv3.2 and later. • The written value is stored and is visible to future reads of the register, but does not affect transactions. • The written value affects transactions at an UNPREDICTABLE update point: – There is no guarantee that all transactions arriving at the SMMU after the write will take the new value, or that all transactions prior to the write have completed. When this register is written (correctly observing the requirements in this section), the new value is observable to future reads of the register even if they occur before the Update has completed. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 427

Chapter 6. Memory map and registers 6.3. Register formats 6.3.16 SMMU_AGBPA The SMMU_AGBPA characteristics are: Purpose Alternate Global ByPass Attribute. Configuration There are no configuration notes. Attributes SMMU_AGBPA is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions IMPLEMENTATION DEFINED 31 0 IMPLEMENTATION DEFINED, bits [31:0] IMPLEMENTATION DEFINED attributes to assign. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Additional Information • This register allows an implementation to apply an additional non-architected attributes or tag to bypassing transactions. • If this field is unsupported by an implementation it is RES0. • Note: Arm does not recommend that this register further modifies existing architected bypass attributes. The process used to change contents of this register in relation to SMMU_GBPA.Update is IMPLEMEN- TATION DEFINED. Accessing SMMU_AGBPA Accesses to this register use the following encodings: Accessible at offset 0x0048 from SMMUv3_PAGE_0 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 428

Chapter 6. Memory map and registers 6.3. Register formats 6.3.17 SMMU_IRQ_CTRL The SMMU_IRQ_CTRL characteristics are: Purpose Interrupt control and configuration register. Configuration There are no configuration notes. Attributes SMMU_IRQ_CTRL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN PRIQ_IRQEN EVENTQ_IRQEN Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_IDR3.HACDBS == 1: Non-secure state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing are disabled. 0b1 Interrupts related to the completion of HACDBS processing are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_IDR3.HDBSS == 1: Non-secure state HDBSS interrupt enable. HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Non-secure state HDBSS table are disabled. 0b1 Interrupts related to a full Non-secure state HDBSS table are enabled. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 429

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Event queue interrupt enable. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Non-secure Event queue are disabled. 0b1 Interrupts from the Non-secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQ_IRQEN, bit [1] When SMMU_IDR0.PRI == 1: PRI queue interrupt enable. PRIQ_IRQEN Meaning 0b0 Interrupts from PRI queue are disabled. 0b1 Interrupts from PRI queue are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. GERROR_IRQEN, bit [0] GERROR interrupt enable. GERROR_IRQEN Meaning 0b0 Interrupts from Non-secure Global errors are disabled. 0b1 Interrupts from Non-secure Global errors are enabled. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 430

Chapter 6. Memory map and registers 6.3. Register formats Additional Information Each field in this register has a corresponding field in SMMU_IRQ_CTRLACK, with the same Update observability semantics as fields in SMMU_CR0 versus SMMU_CR0ACK. This register contains IRQ enable flags for GERROR, PRI queue and Event queue interrupt sources. These enables allow or inhibit both edge-triggered wired outputs if implemented and MSI writes if implemented. IRQ enable flags Guard the MSI address and payload registers when MSIs supported, SMMU_IDR0.MSI == 1, which must only be changed when their respective enable flag is 0. See SMMU_GERROR_IRQ_CFG0 for details. Accessing SMMU_IRQ_CTRL Accesses to this register use the following encodings: Accessible at offset 0x0050 from SMMUv3_PAGE_0 Accesses to this register are RW. Additional information Completion of Update to IRQ enables guarantees the following side effects: • Completion of an Update of x_IRQEN from 0 to 1 guarantees that the MSI configuration in SMMU_x_IRQ_CFG{0,1,2} will be used for all future MSIs generated from source x. All wired or MSI interrupts that are triggered from a source relate to occurrences that happened after the completion of the Update that enabled the source. It is not permitted to trigger an interrupt that relates to an occurrence that happened before the source was enabled, even if the source was previously enabled at the time of the occurrence. • An Update of x_IRQEN from 1 to 0 completes when all prior MSIs have completed. An MSI has completed when it is visible to its Shareability domain, or when it has aborted, and the abort is recorded in the appropriate SMMU_(*_)GERROR bit. Completion of this Update guarantees that no new MSI writes or wired edge events from source x become visible until the source is re-enabled. See section 3.18.1 MSI synchronization. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 431

Chapter 6. Memory map and registers 6.3. Register formats 6.3.18 SMMU_IRQ_CTRLACK The SMMU_IRQ_CTRLACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls of interrupts in SMMU_IRQ_CTRL. Configuration There are no configuration notes. Attributes SMMU_IRQ_CTRLACK is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN PRIQ_IRQEN EVENTQ_IRQEN Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_IDR3.HACDBS == 1: Non-secure state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing are disabled. 0b1 Interrupts related to the completion of HACDBS processing are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_IDR3.HDBSS == 1: Non-secure state HDBSS interrupt enable. HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Non-secure state HDBSS table are disabled. 0b1 Interrupts related to a full Non-secure state HDBSS table are enabled. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 432

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Event queue interrupt enable. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Non-secure Event Queue are disabled. 0b1 Interrupts from the Non-secure Event Queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQ_IRQEN, bit [1] When SMMU_IDR0.PRI == 1: PRI queue interrupt enable. PRIQ_IRQEN Meaning 0b0 Interrupts from PRI Queue are disabled. 0b1 Interrupts from PRI Queue are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. GERROR_IRQEN, bit [0] GERROR interrupt enable. GERROR_IRQEN Meaning 0b0 Interrupts from Non-secure Global errors are disabled. 0b1 Interrupts from Non-secure Global errors are enabled. The reset behavior of this field is: • This field resets to '0'. Additional Information Undefined bits read as zero. Fields in this register are RAZ if their corresponding SMMU_IRQ_CTRL field is reserved. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 433

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_IRQ_CTRLACK Accesses to this register use the following encodings: Accessible at offset 0x0054 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 434

Chapter 6. Memory map and registers 6.3. Register formats 6.3.19 SMMU_GERROR The SMMU_GERROR characteristics are: Purpose Reporting of Global Error conditions. Configuration There are no configuration notes. Attributes SMMU_GERROR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR DPT_ERR CMDQP_ERR SFM_ERR CMDQ_ER R RES0 EVENTQ_ABT_ER R PRIQ_ABT_ERR MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR MSI_PRIQ_ABT_ERR MSI_GERROR_ABT_ERR This register, in conjunction with SMMU_GERRORN, indicates whether global error conditions exist. See section 7.5 Global error recording. An error is active if the value of SMMU_GERROR[x] is different to the corresponding SMMU_GERRORN[x] bit. The SMMU toggles SMMU_GERROR[x] when an error becomes active. An external agent acknowledges the error by toggling the corresponding SMMU_GERRORN[x], making the GERRORN[x] bit the same value as the corresponding GERROR[x] bit. Acknowledging an error deactivates the error, allowing a new occurrence to be reported at a later time, however: • SFM_ERR indicates that Service failure mode has been entered. Acknowledging this GERROR bit does not exit Service failure mode which remains active and is resolved in an IMPLEMENTATION DEFINED way. The SMMU does not toggle a bit when an error is already active. An error is only activated if it is in an inactive state. Note: Software is not intended to trigger interrupts by arranging for GERRORN[x] to differ from GERROR[x]. See SMMU_GERRORN. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] When SMMU_IDR6.DCMDQ == 1: Error on a DCMDQ control page. When this bit is different to SMMU_GERRORN.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 435

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. MSI_HACDBS_ABT_ERR, bit [14] When SMMU_IDR3.HACDBS == 1 and SMMU_IDR0.MSI == 1: Non-secure state HACDBS processing completed MSI abort. When this bit is different from SMMU_GERRORN.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_IDR3.HACDBS == 1: Non-secure state HACDBS error. When this bit is different from SMMU_GERRORN.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_IDR3.HDBSS == 1 and SMMU_IDR0.MSI == 1: Non-secure state HDBSS table full MSI abort. When this bit is different from SMMU_GERRORN.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_IDR3.HDBSS == 1: Non-secure state HDBSS update error. When this bit is different from SMMU_GERRORN.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_HDBSS_PRODn.ERR_REASON. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 436

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Otherwise: Reserved, RES0. DPT_ERR, bit [10] When SMMU_IDR3.DPT == 1: DPT Lookup fault. When this bit is different from SMMU_GERRORN.DPT_ERR, it indicates that one or more DPT lookup faults have occurred, and that syndrome information is available in SMMU_DPT_CFG_FAR. For more information see 3.24.4 DPT lookup errors The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQP_ERR, bit [9] When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1: When this bit is different to SMMU_GERRORN.CMDQP_ERR, it indicates that one or more errors have been encountered on a Command queue control page interface. See section 3.5.6.3 Errors relating to an ECMDQ interface. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SFM_ERR, bit [8] • When this bit is different to SMMU_GERRORN[8], the SMMU has entered Service failure mode. – Traffic through the SMMU has stopped. The SMMU has stopped processing commands and recording events. The RAS registers describe the error. – Acknowledgement of this error through GERRORN does not clear the Service failure mode error, which is cleared in an IMPLEMENTATION DEFINED way. See Section 12.3 Service Failure Mode (SFM). – SFM triggers SFM_ERR in SMMU_GERROR, and when SMMU_S_IDR1.SECURE_IMPL == 1 in SMMU_S_GERROR. The reset behavior of this field is: • This field resets to '0'. MSI_GERROR_ABT_ERR, bit [7] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERRORN[7], a GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 437

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. MSI_PRIQ_ABT_ERR, bit [6] When SMMU_IDR0.MSI == 1 and SMMU_IDR0.PRI == 1: • When this bit is different to SMMU_GERRORN[6], a PRI queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERRORN[5], an Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERRORN[4], a CMD_SYNC MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. PRIQ_ABT_ERR, bit [3] When SMMU_IDR0.PRI == 1: • When this bit is different to SMMU_GERRORN[3], an access to the PRI queue was terminated with abort. – Page Request records might have been lost. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. EVENTQ_ABT_ERR, bit [2] ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 438

Chapter 6. Memory map and registers 6.3. Register formats • When this bit is different to SMMU_GERRORN[2], an access to the Event queue was terminated with abort. – Event records might have been lost. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. CMDQ_ERR, bit [0] • When this bit is different to SMMU_GERRORN[0], a command has been encountered that cannot be processed. – SMMU_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. – Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_GERROR Accesses to this register use the following encodings: Accessible at offset 0x0060 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 439

Chapter 6. Memory map and registers 6.3. Register formats 6.3.20 SMMU_GERRORN The SMMU_GERRORN characteristics are: Purpose Acknowledgement of Global Error conditions. Configuration There are no configuration notes. Attributes SMMU_GERRORN is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR DPT_ERR CMDQP_ERR SFM_ERR CMDQ_ER R RES0 EVENTQ_ABT_ER R PRIQ_ABT_ERR MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR MSI_PRIQ_ABT_ERR MSI_GERROR_ABT_ERR This register has the same fields as SMMU_GERROR. Software must not toggle fields in this register that correspond to errors that are inactive. It is CONSTRAINED UNPREDICTABLE whether or not an SMMU activates errors if this is done. The SMMU does not alter fields in this register. A read of this register returns the values that were last written to the defined fields of the register. Note: Software might maintain an internal copy of the last value written to this register, for comparison against values read from SMMU_GERROR when probing for errors. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] When SMMU_IDR6.DCMDQ == 1: Error on a DCMDQ control page. When this bit is different to SMMU_GERROR.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. The status of SMMU_GERROR.DCMDQP_ERR and SMMU_GERRORN.DCMDQP_ERR does not affect command consumption on a DCMDQ: command consumption on the erroneous queue restarts once the error has been acknowledged, either by the guest via the SMMU_DCMDQ_PRODn.ERRACK register field or by the hypervisor via the SMMU_ECMDQ_PRODn.HS_ERRACK register field, depending on the error type. Errors on a DCMDQ are always reported and acknowledged through SMMU_GERROR.DCMDQP_ERR and SMMU_GERRORN.DCMDQP_ERR respectively. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 440

Chapter 6. Memory map and registers 6.3. Register formats SMMU_GERROR.CMDQP_ERR and SMMU_GERRORN.CMDQP_ERR are only used to report and acknowledge errors on an ECMDQ which is not in direct-mode. Otherwise: Reserved, RES0. MSI_HACDBS_ABT_ERR, bit [14] When SMMU_IDR3.HACDBS == 1 and SMMU_IDR0.MSI == 1: Non-secure state HACDBS processing completed MSI abort. When this bit is different from SMMU_GERROR.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_IDR3.HACDBS == 1: Non-secure state HACDBS error. When this bit is different from SMMU_GERROR.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_IDR3.HDBSS == 1 and SMMU_IDR0.MSI == 1: Non-secure state HDBSS table full MSI abort. When this bit is different from SMMU_GERROR.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_IDR3.HDBSS == 1: Non-secure state HDBSS update error. When this bit is different from SMMU_GERROR.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_HDBSS_PRODn.ERR_REASON. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 441

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. DPT_ERR, bit [10] When SMMU_IDR3.DPT == 1: DPT Lookup fault. See SMMU_GERROR.DPT_ERR. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQP_ERR, bit [9] When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1: See SMMU_GERROR.CMDQP_ERR. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SFM_ERR, bit [8] • When this bit is different to SMMU_GERROR[8], the SMMU has entered Service failure mode. – Traffic through the SMMU has stopped. The SMMU has stopped processing commands and recording events. The RAS registers describe the error. – Acknowledgement of this error through GERRORN does not clear the Service failure mode error, which is cleared in an IMPLEMENTATION DEFINED way. See Section 12.3 Service Failure Mode (SFM). – SFM triggers SFM_ERR in SMMU_GERROR, and when SMMU_S_IDR1.SECURE_IMPL == 1 in SMMU_S_GERROR. The reset behavior of this field is: • This field resets to '0'. MSI_GERROR_ABT_ERR, bit [7] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERROR[7], a GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 442

Chapter 6. Memory map and registers 6.3. Register formats MSI_PRIQ_ABT_ERR, bit [6] When SMMU_IDR0.MSI == 1 and SMMU_IDR0.PRI == 1: • When this bit is different to SMMU_GERROR[6], a PRI queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERROR[5], an Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_IDR0.MSI == 1: • When this bit is different to SMMU_GERROR[4], a CMD_SYNC MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. PRIQ_ABT_ERR, bit [3] When SMMU_IDR0.PRI == 1: • When this bit is different to SMMU_GERROR[3], an access to the PRI queue was terminated with abort. – Page Request records might have been lost. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. EVENTQ_ABT_ERR, bit [2] • When this bit is different to SMMU_GERROR[2], an access to the Event queue was terminated with abort. – Event records might have been lost. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 443

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. CMDQ_ERR, bit [0] • When this bit is different to SMMU_GERROR[0], a command has been encountered that cannot be processed. – SMMU_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. – Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Additional Information Fields that are Reserved in SMMU_GERROR are also Reserved in this register. Accessing SMMU_GERRORN Accesses to this register use the following encodings: Accessible at offset 0x0064 from SMMUv3_PAGE_0 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 444

Chapter 6. Memory map and registers 6.3. Register formats 6.3.21 SMMU_GERROR_IRQ_CFG0 The SMMU_GERROR_IRQ_CFG0 characteristics are: Purpose Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_GERROR_IRQ_CFG0 are RES0. Attributes SMMU_GERROR_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_IRQ_CTRL.GERROR_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_GERROR_IRQ_CFG0 SMMU_GERROR_IRQ_CFG0 is Guarded by SMMU_IRQ_CTRL.GERROR_IRQEN and must only be modified when SMMU_IRQ_CTRL.GERROR_IRQEN == 0. These update conditions are common for all SMMU__IRQ_CFG{0,1,2} register sets in the SMMU with respect to their corresponding SMMU_IRQ_CTRL._IRQEN flag. In SMMUv3.1 and earlier, a write while SMMU_IRQ_CTRL.GERROR_IRQEN == 1 is CONSTRAINED UNPRE- DICTABLE and has one of the following behaviors: • The register takes on any value, which might cause MSIs to be written to UNPREDICTABLE addresses or with UNPREDICTABLE payload values. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 445

Chapter 6. Memory map and registers 6.3. Register formats • The write is IGNORED. • A read following such a write will return an UNKNOWN value. In SMMUv3.2 and later, a write while SMMU_IRQ_CTRL.GERROR_IRQEN == 1 is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x0068 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 446

Chapter 6. Memory map and registers 6.3. Register formats 6.3.22 SMMU_GERROR_IRQ_CFG1 The SMMU_GERROR_IRQ_CFG1 characteristics are: Purpose Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_GERROR_IRQ_CFG1 are RES0. Attributes SMMU_GERROR_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_GERROR_IRQ_CFG1 SMMU_GERROR_IRQ_CFG1 is Guarded by SMMU_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0070 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 447

Chapter 6. Memory map and registers 6.3. Register formats 6.3.23 SMMU_GERROR_IRQ_CFG2 The SMMU_GERROR_IRQ_CFG2 characteristics are: Purpose Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_GERROR_IRQ_CFG2 are RES0. Attributes SMMU_GERROR_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 448

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_GERROR_IRQ_CFG2 SMMU_GERROR_IRQ_CFG2 is Guarded by SMMU_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0074 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 449

Chapter 6. Memory map and registers 6.3. Register formats 6.3.24 SMMU_STRTAB_BASE The SMMU_STRTAB_BASE characteristics are: Purpose Configuration of Stream table base address. Configuration There are no configuration notes. Attributes SMMU_STRTAB_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:6] 55 32 RES0 ADDR[55:6] 31 6 RES0 5 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:6] Physical address of Stream table base, bits [55:6]. Address bits above and below this field range are implied as zero. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 450

Chapter 6. Memory map and registers 6.3. Register formats When a Linear Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b00, the effective base address is aligned by the SMMU to the table size, ignoring the least-significant bits in the ADDR range as required to do so: ADDR[LOG2SIZE + 5:0] = 0. When a 2-level Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b01, the effective base address is aligned by the SMMU to the larger of 64 bytes or the first-level table size: ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0. The alignment of ADDR is affected by the literal value of the respective SMMU_STRTAB_BASE_CFG.LOG2SIZE field and is not limited by SIDSIZE. Note: This means that configuring a table that is larger than required by the incoming StreamID span results in some entries being unreachable, but the table is still aligned to the configured size. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. Additional Information Access attributes of the Stream table are set using the SMMU_CR1.TABLE_ fields, a Read-Allocate hint is provided for Stream table accesses with the RA field. Accessing SMMU_STRTAB_BASE This register is Guarded by SMMU_CR0.SMMUEN and must only be written when SMMU_CR0.SMMUEN == 0. These update conditions are common for all SMMU_(S_)STRTAB_ registers in the SMMU with respect to their corresponding SMMUEN. In SMMUv3.1 and earlier, a write while SMMU_CR0.SMMUEN == 1 is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The register takes on any value, which might cause STEs to be fetched from an UNPREDICTABLE address. • The write is ignored. • A read following such a write will return an UNKNOWN value. In SMMUv3.2 and later, a write while SMMU_CR0.SMMUEN == 1 is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x0080 from SMMUv3_PAGE_0 • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_CR0.SMMUEN == ‘0’ and SMMU_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 451

Chapter 6. Memory map and registers 6.3. Register formats 6.3.25 SMMU_STRTAB_BASE_CFG The SMMU_STRTAB_BASE_CFG characteristics are: Purpose Configuration of Stream table. Configuration There are no configuration notes. Attributes SMMU_STRTAB_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 18 FMT 17 16 RES0 15 11 SPLIT 10 6 LOG2SIZE 5 0 Bits [31:18] Reserved, RES0. FMT, bits [17:16] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Format of Stream table. FMT Meaning 0b00 Linear - ADDR points to an array of STEs. 0b01 2-level - ADDR points to an array of Level 1 Stream Table Descriptors. Other values are reserved, behave as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [15:11] Reserved, RES0. SPLIT, bits [10:6] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: StreamID split point for multi-level table. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 452

Chapter 6. Memory map and registers 6.3. Register formats SPLIT Meaning 0b00110 6 bits - 4KB leaf tables. 0b01000 8 bits - 16KB leaf tables. 0b01010 10 bits - 64KB leaf tables. This field determines the split point of a 2-level Stream table, selected by the number of bits at the bottom level. This field is IGNORED if FMT == 0b00. Other values are reserved, behave as 0b0110. The upper-level L1STD is located using StreamID[LOG2SIZE - 1:SPLIT] and this indicates the lowest-level table which is indexed by StreamID[SPLIT - 1:0]. For example, selecting SPLIT == 6 (0b0110) causes StreamID[5:0] to be used to index the lowest level Stream table and StreamID[LOG2SIZE - 1:6] to index the upper level table. Note: If SPLIT >= LOG2SIZE, a single upper-level descriptor indicates one bottom-level Stream table with 2LOG2SIZE usable entries. The L1STD.Span value’s valid range is up to SPLIT + 1, but not all of this Span is accessible, as it is not possible to use a StreamID >= 2LOG2SIZE. Note: Arm recommends that a Linear table, FMT == 0b00, is used instead of programming SPLIT >= LOG2SIZE. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. LOG2SIZE, bits [5:0] Table size as log2(entries). The maximum StreamID value that can be used to index into the Stream table is 2LOG2SIZE - 1. The StreamID range is equal to the number of STEs in a linear Stream table or the maximum sum of the STEs in all second-level tables. The number of L1STDs in the upper level of a 2-level table is MAX(1, 2LOG2SIZE-SPLIT). Except for readback of a written value, the effective LOG2SIZE is MIN(LOG2SIZE, SMMU_IDR1.SIDSIZE) for the purposes of input StreamID range checking and upper/lower/linear Stream table index address calculation. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information A transaction having a StreamID >= 2LOG2SIZE is out of range. Such a transaction is terminated with abort and a C_BAD_STREAMID event is recorded if permitted by SMMU_CR2.RECINVSID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 453

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_STRTAB_BASE_CFG This register is Guarded by SMMU_CR0.SMMUEN and must only be written when SMMU_CR0.SMMUEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x0088 from SMMUv3_PAGE_0 • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_CR0.SMMUEN == ‘0’ and SMMU_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 454

Chapter 6. Memory map and registers 6.3. Register formats 6.3.26 SMMU_CMDQ_BASE The SMMU_CMDQ_BASE characteristics are: Purpose Configuration of the Command queue base address. Configuration There are no configuration notes. Attributes SMMU_CMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Address of Command queue base, bits [55:5]. • Address bits above and below this field range are treated as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ADDR bits [4:0] are treated as zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 455

Chapter 6. Memory map and registers 6.3. Register formats – Note: For example, a queue with 28 entries is 4096 bytes in size so software must align an allocation, and therefore ADDR, to a 4KB boundary. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS. Except for the purposes of readback of this register, any use of the value of this field is capped at the maximum, SMMU_IDR1.CMDQS. • The minimum size is 0, for one entry, but this must be aligned to a 32-byte (2 entry) boundary as above. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information Upon initialization, if SMMU_IDR1.QUEUES_PRESET == 0 then the SMMU_CMDQ_BASE.LOG2SIZE field might affect which bits of SMMU_CMDQ_CONS.RD and SMMU_CMDQ_PROD.WR can be written upon initialization. The registers must be initialized in this order: 1. Write SMMU_CMDQ_BASE to set the queue base and size. 2. Write initial values to SMMU_CMDQ_CONS and SMMU_CMDQ_PROD. 3. Enable the queue with an Update of the respective SMMU_CR0.CMDQEN to 1. This also applies to the initialization of Event queue and PRI queue registers. Access attributes of the Command queue are set using the SMMU_CR1.QUEUE_* fields. A Read-Allocate hint is provided for Command queue accesses with the RA field. Accessing SMMU_CMDQ_BASE SMMU_CMDQ_BASE is Guarded by SMMU_CR0.CMDQEN and must only be modified when SMMU_CR0.CMDQEN == 0 These update conditions are common for all SMMU_(S_)CMDQ_{BASE, CONS} registers in the SMMU with respect to their corresponding CMDQEN. In SMMUv3.1 and earlier, a write while SMMU_CR0.CMDQEN == 1 is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The register takes on any value, which might cause commands to be fetched from an UNPREDICTABLE address. • The write is ignored. • A read following such a write will return an UNKNOWN value. In SMMUv3.2 and later, a write while SMMU_CR0.CMDQ_EN == 1 is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x0090 from SMMUv3_PAGE_0 • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_CR0.CMDQEN == ‘0’ and SMMU_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 456

Chapter 6. Memory map and registers 6.3. Register formats • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 457

Chapter 6. Memory map and registers 6.3. Register formats 6.3.27 SMMU_CMDQ_PROD The SMMU_CMDQ_PROD characteristics are: Purpose Allows Command queue producer to update the write index. Configuration There are no configuration notes. Attributes SMMU_CMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 20 WR 19 0 Bits [31:20] Reserved, RES0. WR, bits [19:0] Command queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Command queue write index wrap flag. Bits [QS-1:0]: WR - Command queue write index. • Updated by the host PE (producer) indicating the next empty space in the queue after new data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_CMDQ_BASE.LOG2SIZE, see SMMU_CMDQ_CONS. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.CMDQS < 19, bits [19:CMDQS+1] are UNKNOWN on read. If QS == 0 the queue has one entry. Zero bits of WR index are present and WR_WRAP is bit zero. When software increments WR, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and WR_WRAP toggled. Note: In the degenerate case of a one-entry queue, an increment of WR consists solely of a toggle of WR_WRAP. There is space in the queue for additional commands if: SMMU_CMDQ_CONS.RD != SMMU_CMDQ_PROD.WR || SMMU_CMDQ_CONS.RD_WRAP == SMMU_CMDQ_PROD.WR_WRAP ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 458

Chapter 6. Memory map and registers 6.3. Register formats The value written to this register must only move the pointer in a manner consistent with adding N consecutive entries to the Command queue, updating WR_WRAP when appropriate. When SMMU_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_CR0.CMDQEN is transitioned from 0 to 1. A write to this register causes the SMMU to consider the Command queue for processing if SMMU_CR0.CMDQEN == 1 and SMMU_GERROR.CMDQ_ERR is not active. Accessing SMMU_CMDQ_PROD Accesses to this register use the following encodings: Accessible at offset 0x0098 from SMMUv3_PAGE_0 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 459

Chapter 6. Memory map and registers 6.3. Register formats 6.3.28 SMMU_CMDQ_CONS The SMMU_CMDQ_CONS characteristics are: Purpose Command queue consumer read index. Configuration There are no configuration notes. Attributes SMMU_CMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 ERR 30 24 RES0 23 20 RD 19 0 RES0 Bit [31] Reserved, RES0. ERR, bits [30:24] Error reason code. • When a command execution error is detected, ERR is set to a reason code and then the SMMU_GERROR.CMDQ_ERR global error becomes active. • The value in this field is UNKNOWN when the CMDQ_ERR global error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [23:20] Reserved, RES0. RD, bits [19:0] Command queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Queue read index wrap flag. Bits [QS-1:0]: RD - Queue read index. • Updated by the SMMU (consumer) to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_CMDQ_BASE.LOG2SIZE and SMMU_CMDQ_BASE.LOG2SIZE <= SMMU_IDR1.CMDQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 460

Chapter 6. Memory map and registers 6.3. Register formats If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the RD index is always wrapped to the current queue size given by SMMU_CMDQ_BASE.LOG2SIZE. If QS == 0 the queue has one entry. Zero bits of RD index are present and RD_WRAP is bit zero. When SMMU_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_CR0.CMDQEN is transitioned from 0 to 1. Upon a write to this register, when SMMU_CR0.CMDQEN == 0, the ERR field is permitted to either take the written value or ignore the written value. Note: There is no requirement for the SMMU to update this value after every command consumed. It might be updated only after an IMPLEMENTATION SPECIFIC number of commands have been consumed. However, an SMMU must ultimately update RD in finite time to indicate free space to software. When a command execution error is detected, ERR is set to a reason code and then the respective SMMU_GERROR.CMDQ_ERR error becomes active. RD remains pointing at the infringing command for debug. The SMMU resumes processing commands after the CMDQ_ERR error is acknowledged, if the Command queue is enabled at that time. SMMU_GERROR.CMDQ_ERR has no other interaction with SMMU_CR0.CMDQEN than that a Command queue error can only be detected when the queue is enabled and therefore consuming commands. A change to SMMU_CR0.CMDQEN does not affect, or acknowledge, SMMU_GERROR.CMDQ_ERR which must be explicitly acknowledged. See section 7.1 Command queue errors. Accessing SMMU_CMDQ_CONS This register is Guarded by SMMU_CR0.CMDQEN and must only be modified when SMMU_CR0.CMDQEN == 0. See SMMU_CMDQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x009C from SMMUv3_PAGE_0 • When SMMU_CR0.CMDQEN == ‘0’ and SMMU_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 461

Chapter 6. Memory map and registers 6.3. Register formats 6.3.29 SMMU_EVENTQ_BASE The SMMU_EVENTQ_BASE characteristics are: Purpose Event queue base address register. Configuration There are no configuration notes. Attributes SMMU_EVENTQ_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 WA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. WA, bit [62] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] PA of queue base, bits [55:5]. • Address bits above and below this field range are treated as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 462

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE is less than or equal to SMMU_IDR1.EVENTQS. Except for the purposes of readback of this register, any use of the value of this field is capped at the maximum, SMMU_IDR1.EVENTQS. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information See SMMU_CMDQ_BASE for initialization order with respect to the PROD and CONS registers. Events destined for an Event queue (for the appropriate Security state, if supported) are delivered into the queue if SMMU_CR0.EVENTQEN == 1 and the queue is writable. If SMMU_CR0.EVENTQEN == 0, no events are delivered into the queue. See section 7.2 Event queue recorded faults and events; some events might be lost in these situations. Access attributes of the Event queue are set using the SMMU_CR1.QUEUE_* fields. A Write-Allocate hint is provided for Event queue accesses with the WA field. Accessing SMMU_EVENTQ_BASE SMMU_EVENTQ_BASE is Guarded by SMMU_CR0.EVENTQEN and must only be modified when SMMU_CR0.EVENTQEN == 0 These update conditions are common for all SMMU_(S_)EVENTQ_{BASE, PROD} registers in the SMMU with respect to their corresponding EVENTQEN. In SMMUv3.1 and earlier, a write while SMMU_CR0.EVENTQEN == 1 is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The register takes on any value, which might cause events to be written to an UNPREDICTABLE address. • The write is ignored. • A read following such a write will return an UNKNOWN value. In SMMUv3.2 and later, a write while SMMU_CR0.EVENTQ_EN == 1 is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x00A0 from SMMUv3_PAGE_0 • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_CR0.EVENTQEN == ‘0’ and SMMU_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 463

Chapter 6. Memory map and registers 6.3. Register formats 6.3.30 SMMU_EVENTQ_IRQ_CFG0 The SMMU_EVENTQ_IRQ_CFG0 characteristics are: Purpose Event queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_EVENTQ_IRQ_CFG0 are RES0. Attributes SMMU_EVENTQ_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_EVENTQ_IRQ_CFG0 SMMU_EVENTQ_IRQ_CFG0 is Guarded by SMMU_IRQ_CTRL.EVENTQ_IRQEN and must only be modified when SMMU_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00B0 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 464

Chapter 6. Memory map and registers 6.3. Register formats 6.3.31 SMMU_EVENTQ_IRQ_CFG1 The SMMU_EVENTQ_IRQ_CFG1 characteristics are: Purpose Event queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_EVENTQ_IRQ_CFG1 are RES0. Attributes SMMU_EVENTQ_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_EVENTQ_IRQ_CFG1 SMMU_EVENTQ_IRQ_CFG1 is Guarded by SMMU_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00B8 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 465

Chapter 6. Memory map and registers 6.3. Register formats 6.3.32 SMMU_EVENTQ_IRQ_CFG2 The SMMU_EVENTQ_IRQ_CFG2 characteristics are: Purpose Event queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_EVENTQ_IRQ_CFG2 are RES0. Attributes SMMU_EVENTQ_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded in the same way as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 466

Chapter 6. Memory map and registers 6.3. Register formats Note: The encodings of all of the SMMU_*_IRQ_CFG2 MemAttr and SH fields are the same. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. Accessing SMMU_EVENTQ_IRQ_CFG2 SMMU_EVENTQ_IRQ_CFG2 is Guarded by SMMU_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00BC from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 467

Chapter 6. Memory map and registers 6.3. Register formats 6.3.33 SMMU_PRIQ_BASE The SMMU_PRIQ_BASE characteristics are: Purpose Configuration of the PRI queue base address. Configuration This register is present only when SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_BASE are RES0. Attributes SMMU_PRIQ_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 WA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. WA, bit [62] Write allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] PA of queue base, bits [55:5]. • Address bits above and below this field range are implied as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 468

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE <= SMMU_IDR1.PRIQS (which has a maximum value of 19). Except for the purposes of readback of this register, any use of this field’s value is capped at SMMU_IDR1.PRIQS. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See SMMU_CMDQ_BASE for initialization order with respect to the PROD and CONS registers. Access attributes of the PRI queue are set using the SMMU_CR1.QUEUE_* fields. A Write-Allocate hint is provided for PRI queue accesses with the WA field. Accessing SMMU_PRIQ_BASE SMMU_PRIQ_BASE is Guarded by SMMU_CR0.PRIQEN and must only be modified when SMMU_CR0.PRIQEN == 0 These update conditions are common for both SMMU_PRIQ_{BASE, PROD} registers in the SMMU with respect to PRIQEN. In SMMUv3.1 and earlier, a write while SMMU_CR0.PRIQEN == 1 is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The register takes on any value, which might cause events to be written to an UNPREDICTABLE address. • The write is ignored. • A read following such a write will return an UNKNOWN value. In SMMUv3.2 and later, a write while SMMU_CR0.PRIQ_EN == 1 is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x00C0 from SMMUv3_PAGE_0 • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_CR0.PRIQEN == ‘0’ and SMMU_CR0ACK.PRIQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 469

Chapter 6. Memory map and registers 6.3. Register formats 6.3.34 SMMU_PRIQ_IRQ_CFG0 The SMMU_PRIQ_IRQ_CFG0 characteristics are: Purpose PRI queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1 and SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_IRQ_CFG0 are RES0. Attributes SMMU_PRIQ_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_IRQ_CTRL.PRIQ_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_PRIQ_IRQ_CFG0 SMMU_PRIQ_IRQ_CFG0 is Guarded by SMMU_IRQ_CTRL.PRIQ_IRQEN and must only be modified when SMMU_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00D0 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 470

Chapter 6. Memory map and registers 6.3. Register formats 6.3.35 SMMU_PRIQ_IRQ_CFG1 The SMMU_PRIQ_IRQ_CFG1 characteristics are: Purpose PRI queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1 and SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_IRQ_CFG1 are RES0. Attributes SMMU_PRIQ_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_PRIQ_IRQ_CFG1 SMMU_PRIQ_IRQ_CFG1 is Guarded by SMMU_IRQ_CTRL.PRIQ_IRQEN, and must only be modified when SMMU_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00D8 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 471

Chapter 6. Memory map and registers 6.3. Register formats 6.3.36 SMMU_PRIQ_IRQ_CFG2 The SMMU_PRIQ_IRQ_CFG2 characteristics are: Purpose PRI queue interrupt configuration register. Configuration This register is present only when SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_IRQ_CFG2 are RES0. Attributes SMMU_PRIQ_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions LO 31 RES0 30 6 SH 5 4 MemAttr 3 0 Similar to SMMU_GERROR_IRQ_CFG2 but for PRI queue MSIs. LO, bit [31] Last Only. LO Meaning 0b0 Send PRI queue interrupt when PRI queue transitions from empty to non-empty. 0b1 Send PRI queue interrupt when PRI message received with L bit set. • When the message is written to PRI queue, the interrupt is visible after the queue entry becomes visible. See section 3.18 Interrupts and notifications • When the message is discarded because of a PRI queue overflow, the interrupt is generated. When the message is discarded for any other reason, the interrupt is not generated. An interrupt is generated only if a PRI message is received with the L bit set. Note: This field applies to wired and MSI interrupts. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:6] Reserved, RES0. SH, bits [5:4] When SMMU_IDR0.MSI == 1: Shareability. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 472

Chapter 6. Memory map and registers 6.3. Register formats SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. MemAttr, bits [3:0] When SMMU_IDR0.MSI == 1: Memory type. Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. The encodings of all of the SMMU_*_IRQ_CFG2 MemAttr and SH fields are the same. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. Accessing SMMU_PRIQ_IRQ_CFG2 SMMU_PRIQ_IRQ_CFG2 is Guarded by SMMU_IRQ_CTRL.PRIQ_IRQEN, and must only be modified when SMMU_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00DC from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 473

Chapter 6. Memory map and registers 6.3. Register formats 6.3.37 SMMU_GATOS_CTRL The SMMU_GATOS_CTRL characteristics are: Purpose Global ATOS translation control register. Configuration This register is present only when SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_GATOS_CTRL are RES0. Attributes SMMU_GATOS_CTRL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 RUN 0 Bits [31:1] Reserved, RES0. RUN, bit [0] Run ATOS translation. • Software must write this bit to 1 to initiate the translation operation, after initializing the ATOS_SID and ATOS_ADDR registers. • The SMMU clears the RUN flag after the translation completes and its result is visible in ATOS_PAR. • A write of 0 to this flag might change the value of the flag but has no other effect. Software must only write 0 to this flag when the flag is zero. The reset behavior of this field is: • This field resets to '0'. Additional Information SMMU_GATOS_{CTRL, SID, ADDR, PAR} are only present if SMMU_IDR0.ATOS == 1; otherwise, they are Reserved. See Chapter 9 Address Translation Operations for more information on the overall behavior of ATOS operations. Accessing SMMU_GATOS_CTRL RUN is Guarded by SMMU_CR0.SMMUEN and must only be set when SMMUEN == 1 and RUN == 0. ATOS_CTRL.RUN must not be set to 1 after SMMU_CR0.SMMUEN has been written to 0, including at a point prior to the completion of an Update to SMMUEN. In SMMUv3.1 and earlier, behavior of doing so is CONSTRAINED UNPREDICTABLE and one of the following occurs: • The write is IGNORED. • The value is stored and visible for readback, but no other effect occurs and RUN is not cleared by the SMMU unless SMMUEN is later Updated to 1. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 474

Chapter 6. Memory map and registers 6.3. Register formats In SMMUv3.2 and later, such a write is IGNORED Between software writing ATOS_CTRL.RUN == 1 and observing the SMMU having cleared it to 0 again: • In SMMUv3.1 and earlier, writes to ATOS_SID, ATOS_ADDR and VATOS_SEL (if appropriate) are CONSTRAINED UNPREDICTABLE and one of the following occurs: – The write is IGNORED. – Translation is performed with any value of the written register. After completion, ATOS_PAR is UNKNOWN. Note: HTTU might have been performed to an UNPREDICTABLE set of translation table descriptors that could otherwise have been updated using any given value of the written register. • In SMMUv3.2 and later, writes to ATOS_SID, ATOS_ADDR, and VATOS_SEL (if appropriate) are IG- NORED. • In SMMUv3.1 and earlier, writes to ATOS_CTRL are CONSTRAINED UNPREDICTABLE and one of the following occurs: – The write is IGNORED. – The value is stored and visible for readback, but translation is unaffected and completes normally. Note: If RUN == 0 was written, it is not possible to determine that the translation has completed. – Reads of ATOS_PAR return UNKNOWN. • In SMMUv3.2 and later, writes to ATOS_CTRL are IGNORED. The completion of an Update of SMMU_CR0.SMMUEN from 1 to 0 while RUN == 1 is contingent on the completion of the ATOS operation, which clears RUN. Clearing SMMU_CR0.SMMUEN while RUN == 1 is CONSTRAINED UNPREDICTABLE and the completion of the SMMUEN == 0 Update ensures one of the following behaviors: • The operation has completed normally and a valid translation/fault response is reported. • The ATOS operation has been aborted, reporting ATOS_PAR.FAULT == 1 and ATOS_PAR.FAULTCODE == INTERNAL_ERR. – The translation table walks for the ongoing ATOS translation might have been partially performed. If HTTU was performed during the translation, an UNPREDICTABLE set of the translation table descriptors relevant to the translation table walks might have been updated. An Update of SMMU_CR0.SMMUEN from 0 to 1 clears RUN, if RUN was set while SMMU_CR0.SMMUEN == 0. Completion of the Update occurs after RUN has been cleared for all Non-secure ATOS register groups. The behavior specified here is consistent across all SMMU_ATOS_ registers and their corresponding SMMUEN and ATOS_CTRL.RUN bits. Accesses to this register use the following encodings: Accessible at offset 0x0100 from SMMUv3_PAGE_0 • When SMMU_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 475

Chapter 6. Memory map and registers 6.3. Register formats 6.3.38 SMMU_GATOS_SID The SMMU_GATOS_SID characteristics are: Purpose Global ATOS StreamID register. Configuration This register is present only when SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_GATOS_SID are RES0. Attributes SMMU_GATOS_SID is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 53 52 SUBSTREAMID 51 32 SSID_VALID STREAMID 31 0 Bits [63:53] Reserved, RES0. SSID_VALID, bit [52] When SMMU_IDR1.SSIDSIZE != '00000': SubstreamID valid. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. SUBSTREAMID, bits [51:32] SubstreamID of request. • If SMMU_IDR1.SSIDSIZE < 20, bits [51:(32 + SMMU_IDR1.SSIDSIZE)] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID of request. • This is written with the StreamID (used to locate translations/CDs) of the request later submitted to SMMU_GATOS_ADDR. • If SMMU_IDR1.SID_SIZE < 32, bits [31:SMMU_IDR1.SID_SIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 476

Chapter 6. Memory map and registers 6.3. Register formats Additional Information Bits of SubstreamID and StreamID outside of the supported range are RES0. Accessing SMMU_GATOS_SID This register is Guarded by SMMU_GATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0108 from SMMUv3_PAGE_0 • When SMMU_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 477

Chapter 6. Memory map and registers 6.3. Register formats 6.3.39 SMMU_GATOS_ADDR The SMMU_GATOS_ADDR characteristics are: Purpose Global ATOS translation address register. Configuration This register is present only when SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_GATOS_ADDR are RES0. Attributes SMMU_GATOS_ADDR is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions ADDR[63:12] 63 32 ADDR[63:12] 31 12 TYPE 11 10 PnU 9 RnW 8 InD 7 6 RES0 5 0 HTTUI ADDR, bits [63:12] Requested input address, bits [63:12]. The reset behavior of this field is: • This field resets to an UNKNOWN value. TYPE, bits [11:10] Request type. TYPE Meaning 0b00 Reserved. 0b01 Stage 1 (VA to IPA). 0b10 Stage 2 (IPA to PA). 0b11 Stage 1 and stage 2 (VA to PA). • Use of a Reserved value results in an INV_REQ ATOS error. The reset behavior of this field is: • This field resets to an UNKNOWN value. PnU, bit [9] Privileged or User access. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 478

Chapter 6. Memory map and registers 6.3. Register formats PnU Meaning 0b0 Unprivileged. 0b1 Privileged. The reset behavior of this field is: • This field resets to an UNKNOWN value. RnW, bit [8] Read/write access. RnW Meaning 0b0 Write. 0b1 Read. The reset behavior of this field is: • This field resets to an UNKNOWN value. InD, bit [7] Instruction/data access. InD Meaning 0b0 Data. 0b1 Instruction. • This bit is IGNORED if RnW == 0, and the effective InD for writes is Data. The reset behavior of this field is: • This field resets to an UNKNOWN value. HTTUI, bit [6] Inhibit hardware update of the Access flag and dirty state. HTTUI Meaning 0b0 Flag update (HTTU) might occur, where supported by the SMMU, according to HA:HD configuration fields at stage 1 and stage 2. 0b1 HTTU is inhibited, regardless of HA/HD configuration. • The ATOS operation causes no state change and is passive. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 479

Chapter 6. Memory map and registers 6.3. Register formats Additional Information The PnU and InD attributes are not affected by the STE.INSTCFG or STE.PRIVCFG overrides. Accessing SMMU_GATOS_ADDR This register is Guarded by SMMU_GATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0110 from SMMUv3_PAGE_0 • When SMMU_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 480

Chapter 6. Memory map and registers 6.3. Register formats 6.3.40 SMMU_GATOS_PAR The SMMU_GATOS_PAR characteristics are: Purpose Global ATOS translation results register. This result register encodes both successful results and error results. The format is determined by the FAULT field. Configuration This register is present only when SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_GATOS_PAR are RES0. Attributes SMMU_GATOS_PAR is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions When SMMU_GATOS_PAR.FAULT == '0': ATTR 63 56 ADDR[55:12] 55 32 ADDR[55:12] 31 12 11 10 SH 9 8 RES0 7 1 0 Size RES0 FAULT When FAULT == 0, a successful result is present: ATTR, bits [63:56] Memory attributes, in MAIR format. The reset behavior of this field is: • This field resets to an UNKNOWN value. ADDR, bits [55:12] Result address, bits [55:12]. • Address bits above and below [55:12] are treated as zero. • Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Size, bit [11] Translation page/block size flag. Size Meaning 0b0 Translation is 4KB. 0b1 Translation is determined by position of lowest 1 bit in ADDR field. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 481

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [10] Reserved, RES0. SH, bits [9:8] Shareability attribute. SH Meaning 0b00 Non-shareable. 0b01 Reserved. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: Shareability is returned as Outer Shareable when ATTR selects any Device type. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [7:1] Reserved, RES0. FAULT, bit [0] Fault/error status. FAULT Meaning 0b0 No fault. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information for When SMMU_GATOS_PAR.FAULT == '0' The Size field allows the size of the translation to be determined, using an encoding in the ADDR field. The translated address is aligned to the translation size (appropriate number of LSBs zeroed) and then, if the size is greater than 4KB, a single bit is set such that its position, N, denotes the translation size, where 2(N+1) == size in bytes. Note: For example, if Size == 1 and ADDR[14:12] == 0 and ADDR[15] == 1, the lowest set bit is 15 so the translation size is 215+1, or 64KB. In this case, the actual output address must be aligned to 64KB by masking out bit 15. Similarly, an output address with ADDR[13:12] == 0b10 denotes a page of size 213+1, or 16KB, and the output address is taken from ADDR[14] upwards. An implementation that does not support all of the defined attributes is permitted to return the behavior that the cache supports, instead of the exact value from the translation table entries. Similarly, an implementation might return the translation page/block size that is cached rather than the size that is determined from the translation table entries. The memory attributes and Shareability that are returned in ATTR and SH are determined from the translation tables without including STE overrides that might be configured for the given stream: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 482

Chapter 6. Memory map and registers 6.3. Register formats • When ATOS_ADDR.TYPE == stage 1, the stage 1 translation table attributes are returned. • When ATOS_ADDR.TYPE == stage 2, the stage 2 translation table attributes are returned. In this case, the allocation and transient hints in ATTR are: – RA == WA == 1. – TR == 0. – Note: The stage 2 TTD.MemAttr[3:0] field does not encode RA/WA/TR. • When ATOS_ADDR.TYPE == stage 1 and stage 2, the attributes returned are those from stage 1 combined with stage 2 (where combined is as defined in Chapter 13 Attribute Transformation). When SMMU_GATOS_PAR.FAULT == '1': 63 60 RES0 59 56 FADDR[55:12] 55 32 IMPLEMENTATION DEFINED FADDR[55:12] 31 12 FAULTCODE 11 4 3 REASON 2 1 0 RES0 FAULT When FAULT == 1, the translation has failed and a fault syndrome is present: IMPLEMENTATION DEFINED, bits [63:60] IMPLEMENTATION DEFINED fault data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:56] Reserved, RES0. FADDR, bits [55:12] Stage 2 fault page address, bits [55:12]. • The value returned in FADDR depends on the cause of the fault. See section 9.1.4 ATOS_PAR for details. • Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULTCODE, bits [11:4] Fault/error code. • See section 9.1.4 ATOS_PAR for details. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [3] Reserved, RES0. REASON, bits [2:1] Class of activity causing fault. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 483

Chapter 6. Memory map and registers 6.3. Register formats • This indicates the stage and reason for the fault. See section 9.1.4 ATOS_PAR for details. REASON Meaning 0b00 Stage 1 translation-related fault occurred, or miscellaneous non-translation fault not attributable to a translation stage (for example, F_BAD_STE). 0b01 CD: Stage 2 fault occurred because of a CD fetch. 0b10 TT: Stage 2 fault occurred because of a stage 1 translation table walk. 0b11 IN: Stage 2 fault occurred because of the input address to stage 2 (output address from successful stage 1 translation table walk, or address given in ATOS_ADDR for stage 2-only translation). The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULT, bit [0] Fault/error status. FAULT Meaning 0b1 Fault or translation error. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_GATOS_PAR The content of ATOS_PAR registers is UNKNOWN if values in the ATOS register group are modified after a translation has been initiated by setting ATOS_CTRL.RUN == 1. See section 9.1.4 ATOS_PAR. This register has an UNKNOWN value if read when SMMU_GATOS_CTRL.RUN == 1. Accesses to this register use the following encodings: Accessible at offset 0x0118 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 484

Chapter 6. Memory map and registers 6.3. Register formats 6.3.41 SMMU_MPAMIDR The SMMU_MPAMIDR characteristics are: Purpose MPAM capability identification register for Non-secure state. Configuration This register is present only when SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_MPAMIDR are RES0. Attributes SMMU_MPAMIDR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 24 PMG_MAX 23 16 PARTID_MAX 15 0 Bits [31:24] Reserved, RES0. PMG_MAX, bits [23:16] This field has an IMPLEMENTATION DEFINED value. • The maximum PMG value that is permitted to be used in Non-secure state. Access to this field is RO. PARTID_MAX, bits [15:0] This field has an IMPLEMENTATION DEFINED value. • The maximum PARTID value that is permitted to be used in Non-secure state. Access to this field is RO. Additional Information The PMG bit width is defined as the bit position of the most significant 1 in PMG_MAX[7:0], plus one, or is defined as zero if PMG_MAX is zero. Note: For example, if PMG_MAX == 0x0f, the PMG bit width is 4. The PARTID bit width is defined as the bit position of the most significant 1 in PARTID_MAX[15:0], plus one, or is defined as zero if PARTID_MAX is zero. Note: For example, if PARTID_MAX == 0x0034, the PARTID bit width is 6. Note: PMG_MAX and PARTID_MAX specify the maximum values of each ID type that can be configured in the corresponding Security state. These values do not describe properties of the rest of the system, which are discovered using mechanisms that are outside the scope of this specification. Note: Either field is architecturally permitted to be zero-sized, but Arm recommends that PARTID_MAX is non-zero when MPAM is implemented. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 485

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_MPAMIDR Accesses to this register use the following encodings: Accessible at offset 0x0130 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 486

Chapter 6. Memory map and registers 6.3. Register formats 6.3.42 SMMU_GMPAM The SMMU_GMPAM characteristics are: Purpose Global MPAM configuration register for SMMU-originated transactions relating to the Non-secure programming interface. Configuration This register is present only when SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_GMPAM are RES0. Attributes SMMU_GMPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 24 SO_PMG 23 16 SO_PARTID 15 0 Update Update, bit [31] Update completion flag. For more information see below. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. SO_PMG, bits [23:16] PMG for SMMU-originated accesses. • This field determines the PMG of the SMMU-originated transactions described below. • Bits above the supported PMG bit width, as indicated by SMMU_MPAMIDR.PMG_MAX, are RES0. • If a value is programmed that is greater than the corresponding PMG_MAX, an UNKNOWN PMG is used. The reset behavior of this field is: • This field resets to 0x00. SO_PARTID, bits [15:0] PARTID for SMMU-originated accesses. • This field determines the PARTID of the SMMU-originated transactions described below. • Bits above the supported PARTID bit width, as indicated by SMMU_MPAMIDR.PARTID_MAX, are RES0. • If a value is programmed that is greater than SMMU_MPAMIDR.PARTID_MAX, an UNKNOWN PARTID is used. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 487

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to 0x0000. Additional Information The SO_PMG and SO_PARTID values determine the MPAM attributes applied to the following SMMU-originated accesses that are associated with the Non-secure programming interface: • L1STD and STE accesses. • Queue accesses. • SMMU core MSIs. The Update flag behaves the same as the SMMU_GBPA.Update mechanism. It indicates that a change to this register has been accepted and when the Update flag is observed to be zero after a correct update procedure, the new values are guaranteed to be applied to future SMMU-originated accesses. Accessing SMMU_GMPAM This register must only be written when Update == 0 (prior updates are complete). A write when an Update == 1, that is when a prior update is underway, is IGNORED. A write of new values that does not set Update == 1 is IGNORED. When this register is written, correctly observing the requirements in this section, the new value is observable to future reads of the register even if they occur before the Update has completed. Accesses to this register use the following encodings: Accessible at offset 0x0138 from SMMUv3_PAGE_0 • When SMMU_GMPAM.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 488

Chapter 6. Memory map and registers 6.3. Register formats 6.3.43 SMMU_GBPMPAM The SMMU_GBPMPAM characteristics are: Purpose MPAM configuration register for global bypass transactions relating to the Non-secure programming interface. Configuration This register is present only when SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_GBPMPAM are RES0. Attributes SMMU_GBPMPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 24 GBP_PMG 23 16 GBP_PARTID 15 0 Update Update, bit [31] Update completion flag. For more information see below. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. GBP_PMG, bits [23:16] PMG value for transactions in Global ByPass • This field determines the default PMG applied to all client transactions that bypass translation for the reasons described below. • Bits above the supported PMG bit width, as indicated by SMMU_MPAMIDR.PMG_MAX, are RES0. • If a value is programmed that is greater than SMMU_MPAMIDR.PMG_MAX, an UNKNOWN PMG is used. The reset behavior of this field is: • This field resets to 0x00. GBP_PARTID, bits [15:0] PARTID value for transactions in Global ByPass. • This field determines the default PARTID applied to all client transactions that bypass translation for the reasons described below. • Bits above the supported PARTID bit width, as indicated by SMMU_MPAMIDR.PARTID_MAX, are RES0. • If a value is programmed that is greater than SMMU_MPAMIDR.PARTID_MAX, an UNKNOWN PARTID is used. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 489

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to 0x0000. Additional Information The GBP_PMG and GBP_PARTID attributes apply to client transactions from Non-secure streams that bypass translation because: • The SMMU programming interface is disabled with SMMU_CR0.SMMUEN == 0, or, • The transaction is ATS Translated and ATSCHK == 0. See section 3.9.1 ATS Interface. When SMMU_CR0.SMMUEN == 1, the PMG and PARTID of a non-ATS Translated transaction are determined by STE, and if appropriate, CD configuration. The Update flag behaves the same as the SMMU_GBPA.Update mechanism. It indicates that a change to this register has been accepted and when the Update flag is observed to be zero after a correct update procedure, the new values are guaranteed to be applied to future client transactions. Accessing SMMU_GBPMPAM This register must only be written when Update == 0 (prior updates are complete). A write when an Update == 1, that is when a prior update is underway, is IGNORED. A write of new values that does not set Update == 1 is IGNORED. When this register is written, correctly observing the requirements in this section, the new value is observable to future reads of the register even if they occur before the Update has completed. Accesses to this register use the following encodings: Accessible at offset 0x013C from SMMUv3_PAGE_0 • When SMMU_GBPMPAM.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 490

Chapter 6. Memory map and registers 6.3. Register formats 6.3.44 SMMU_VATOS_SEL The SMMU_VATOS_SEL characteristics are: Purpose VATOS VMID selection. Configuration This register is present only when SMMU_IDR0.VATOS == 1. Otherwise, direct accesses to SMMU_VATOS_SEL are RES0. Attributes SMMU_VATOS_SEL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 VMID 15 0 Bits [31:16] Reserved, RES0. VMID, bits [15:0] VMID associated with the VM that is using the VATOS interface. • When SMMU_IDR0.VMID16 == 0, bits [15:8] of this field are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information When requests are made through VATOS, this field is compared to the S2VMID field of the STE selected in the request. The request is denied if the STE configuration means that translations are not tagged with a VMID, or the VMID values do not match (indicating a lookup for a StreamID not assigned to the VM that has been granted access to the VATOS interface). See section 9.1.6 SMMU_(S_)VATOS_SEL. Accessing SMMU_VATOS_SEL This register is Guarded by SMMU_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0180 from SMMUv3_PAGE_0 • When SMMU_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 491

Chapter 6. Memory map and registers 6.3. Register formats 6.3.45 SMMU_IDR6 The SMMU_IDR6 characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Non-secure programming interface. Configuration There are no configuration notes. Attributes SMMU_IDR6 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 28 27 24 23 20 19 16 15 11 RES0 10 9 VSIDSIZE 8 4 VSID 3 2 DCMDQ 1 0 CMDQ_CONTROL_PAGE_LOG2NU MP DCMDQ_CONTROL_PAGE_LOG2NUMQ DCMDQ_CONTROL_PAGE_LOG2NUMP CMDQ_CONTROL_PAGE_LOG2NUMQ Bits [31:28] Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMP, bits [27:24] When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1: Number of Command queue control pages supported. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b0000..0b1000 Number of Command queue control pages supported as log2(pages). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMQ, bits [23:20] When SMMU_IDR6.DCMDQ == 1: Number of DCMDQ interfaces per control page. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 492

Chapter 6. Memory map and registers 6.3. Register formats DCMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000 Number of queues supported per DCMDQ control page as log2(queues). All other values are reserved. In this version of the architecture, the only allowed value for this field is 0b0000, meaning the SMMU supports a single DCMDQ interface per control page The hypervisor can reserve ECMDQs for its own usage. The number of ECMDQs reserved in such a manner needs to be a multiple of the number of DCMDQ interfaces per DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMQ, bits [19:16] When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1: Number of queues per Command queue control page. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000..0b1000 Number of queues supported per Command queue control page as log2(queues). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Command queue per Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMP, bits [15:11] When SMMU_IDR6.DCMDQ == 1: Number of DCMDQ control pages. The value of this field is an IMPLEMENTATION DEFINED choice of: DCMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b00000..0b10000 Number of DCMDQ control pages supported as log2(pages). All other values are reserved. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 493

Chapter 6. Memory map and registers 6.3. Register formats The number of DCMDQ control pages cannot be larger than: • The total number of ECMDQs implemented across all ECMDQ control pages. • The StreamID size. The number of DCMDQ control pages in SMMU_IDR6 is therefore an upper limit: the number of active DCMDQ control pages is determined by the number of ECMDQs the hypervisor has reserved for its own usage. Note: 0b00000 is a legal value. In this case, the SMMU supports a single DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. Bits [10:9] Reserved, RES0. VSIDSIZE, bits [8:4] When SMMU_IDR6.VSID == 1: Maximum bits of vSID. The value of this field is an IMPLEMENTATION DEFINED choice of: VSIDSIZE Meaning 0b00000..0b10000 Maximum number of bits representing the vSID. All other values are reserved. The value 0b00000 means the SMMU supports the translation of 1 vSID. The value of this field must be smaller than or equal to SMMU_IDR1.SIDSIZE. The hypervisor must present an emulated SMMU to the guest with a maximal SID length which is equal to the vSID length supported by the hardware implementation. That is, in the emulated SMMU the hypervisor sets SMMU_IDR1.SIDSIZE to the value of this field in the hardware implementation or smaller. Access to this field is RO. Otherwise: Reserved, RES0. VSID, bits [3:2] Support for virtual to physical StreamID translation. The value of this field is an IMPLEMENTATION DEFINED choice of: VSID Meaning 0b00 Translation of virtual to physical StreamIDs is not supported. 0b01 Translation of virtual to physical StreamIDs is supported. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 494

Chapter 6. Memory map and registers 6.3. Register formats All other values are reserved. This field is RES0 if any of the following are true: • SMMU_IDR6.DCMDQ == 0. • SMMU_IDR0.ATS == 0. Access to this field is RO. DCMDQ, bits [1:0] Indicates support for Direct Enhanced Command Queues. The value of this field is an IMPLEMENTATION DEFINED choice of: DCMDQ Meaning 0b00 Direct Enhanced Command Queues are not supported. 0b01 Direct Enhanced Command Queues are supported. All other values are reserved. If this field is 1, then all of the following are true: • SMMU_IDR1.ECMDQ == 1. • SMMU_IDR0.S1P == 1. • SMMU_IDR0.S2P == 1. • SMMU_IDR0.STALL_MODEL != 0b10. Access to this field is RO. Additional Information See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_IDR6 Accesses to this register use the following encodings: Accessible at offset 0x0190 from SMMUv3_PAGE_0 When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 495

Chapter 6. Memory map and registers 6.3. Register formats 6.3.46 SMMU_IDR7 The SMMU_IDR7 characteristics are: Purpose Provides information on the qSID base for Non-secure state. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_IDR7 are RES0. Attributes SMMU_IDR7 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions QSID_BASE 31 0 QSID_BASE, bits [31:0] Offset in StreamID space to block of StreamIDs assigned to be used as qSIDs. This field has an IMPLEMENTATION DEFINED value. Bits above the StreamID size, advertised in SMMU_IDR1.SIDSIZE, are RES0. Bits below the number of DCMDQ control pages, advertised in SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP, are RES0. The qSID is the concatenation of the value of this field and the DCMDQ control page index, where log2nump is SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP: qSID = {SMMU_IDR7[31:log2nump], DCMDQ control page index [log2nump - 1:0]}. For more information, see 3.5.7.3.1 Queue StreamID (qSID). Access to this field is RO. Accessing SMMU_IDR7 Accesses to this register use the following encodings: Accessible at offset 0x0194 from SMMUv3_PAGE_0 When SMMU_IDR6.DCMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 496

Chapter 6. Memory map and registers 6.3. Register formats 6.3.47 SMMU_IDR8 The SMMU_IDR8 characteristics are: Purpose Provides information on the offsets for the DCMDQ control pages and DCMDQ global page. Configuration There are no configuration notes. Attributes SMMU_IDR8 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions BA_DCMDQ 31 14 RES0 13 10 BA_DCMDQ_GLOBAL 9 0 BA_DCMDQ, bits [31:14] When SMMU_IDR6.DCMDQ == 1: Offset to the first DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of DCMDQ control page m can be calculated as follows: O_DCMDQCPm = SMMU_BASE + 0x20000 + BA_DCMDQ * 0x10000 + m * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. Bits [13:10] Reserved, RES0. BA_DCMDQ_GLOBAL, bits [9:0] When SMMU_IDR6.DCMDQ == 1: Offset to the global DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of the DCMDQ global control page can be calculated as follows: O_DCMDQCP_GLOBAL = SMMU_BASE + 0x20000 + BA_DCMDQ_GLOBAL * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 497

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_IDR8 Accesses to this register use the following encodings: Accessible at offset 0x0198 from SMMUv3_PAGE_0 When SMMU_IDR6.DCMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 498

Chapter 6. Memory map and registers 6.3. Register formats 6.3.48 SMMU_DPT_BASE The SMMU_DPT_BASE characteristics are: Purpose Provides the base address for the Non-secure Device Permission Table. Configuration This register is present only when SMMU_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_DPT_BASE are RES0. Attributes SMMU_DPT_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 BADDR[55:12] 55 32 RES0 BADDR[55:12] 31 12 RES0 11 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. BADDR, bits [55:12] Base address of level 0 of the DPT. This is a Non-secure physical address. The address is aligned by the SMMU to the greater of 4KB and the size of the table. Least-significant bits that are unused because of alignment are treated as zero by the SMMU, and are RES0. Bits above the implemented output address size, advertised in SMMU_IDR5.OAS, are RES0, an SMMU implementation is not required to provide storage for these bits, and they are treated as zero by the SMMU. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 499

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to an UNKNOWN value. Bits [11:0] Reserved, RES0. Accessing SMMU_DPT_BASE Accesses to this register use the following encodings: Accessible at offset 0x0200 from SMMUv3_PAGE_0 • When SMMU_CR0.DPT_WALK_EN == ‘1’ or SMMU_CR0ACK.DPT_WALK_EN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 500

Chapter 6. Memory map and registers 6.3. Register formats 6.3.49 SMMU_DPT_BASE_CFG The SMMU_DPT_BASE_CFG characteristics are: Purpose Provides the configuraton for the Device Permission Table for Non-secure state. Configuration This register is present only when SMMU_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_DPT_BASE_CFG are RES0. Attributes SMMU_DPT_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 24 L0DPTSZ 23 20 RES0 19 16 DPTGS 15 14 RES0 13 3 DPTPS 2 0 Bits [31:24] Reserved, RES0. L0DPTSZ, bits [23:20] This field specifies the number of least-significant address bits protected by each entry in the level 0 of the DPT. L0DPTSZ Meaning 0b0000 30-bits. Each entry covers 1GB of address space. 0b0100 34-bits. Each entry covers 16GB of address space. 0b0110 36-bits. Each entry covers 64GB of address space. 0b1001 39-bits. Each entry covers 512GB of address space. All other values are reserved. It is invalid to configure this field to any of the following: • A reserved encoding. • An address size that exceeds the implemented physical address size advertised in SMMU_IDR5.OAS. • An address size that exceeds the DPT region size configured in SMMU_DPT_BASE_CFG.DPTPS. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [19:16] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 501

Chapter 6. Memory map and registers 6.3. Register formats DPTGS, bits [15:14] DPT Granule size. DPTGS Meaning 0b00 4KB Invalid if SMMU_IDR5.GRAN4K == 0. 0b01 64KB Invalid if SMMU_IDR5.GRAN64K == 0. 0b10 16KB Invalid if SMMU_IDR5.GRAN16K == 0. 0b11 Reserved This field is permitted to be cached in a TLB. Note: Software should program this field to the mininal value that could be returned as the size of an ATS Translation Completion. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [13:3] Reserved, RES0. DPTPS, bits [2:0] The size of the memory region protected by the DPT, in terms of an encoded number of least-significant address bits. DPTPS Meaning 0b000 32-bits 4GB. 0b001 36-bits 64GB. 0b010 40-bits 1TB. 0b011 42-bits 4TB. 0b100 44-bits 16TB. 0b101 48-bits 256TB. 0b110 52-bits 4PB. 0b111 56-bits 64PB. Values exceeding the implemented physical address size, advertised in SMMU_IDR5.OAS are invalid. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_DPT_BASE_CFG Accesses to this register use the following encodings: Accessible at offset 0x0208 from SMMUv3_PAGE_0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 502

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_CR0.DPT_WALK_EN == ‘1’ or SMMU_CR0ACK.DPT_WALK_EN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 503

Chapter 6. Memory map and registers 6.3. Register formats 6.3.50 SMMU_DPT_CFG_FAR The SMMU_DPT_CFG_FAR characteristics are: Purpose This register reports details of the Non-secure Device Permission Table lookup error. Configuration This register is present only when SMMU_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_DPT_CFG_FAR are RES0. Attributes SMMU_DPT_CFG_FAR is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 FADDR[55:12] 55 32 FADDR[55:12] 31 12 RES0 11 8 7 4 RES0 3 2 1 0 DPT_FAULTCODE FAULT LEVEL Bits [63:56] Reserved, RES0. FADDR, bits [55:12] The physical address input to the DPT check that caused the DPT lookup error. If FAULT == 0, the value of this field is zero. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Access to this field is RO. Bits [11:8] Reserved, RES0. DPT_FAULTCODE, bits [7:4] DPT_FAULTCODE Meaning 0b0000 DPT_DISABLED SMMU_CR0.DPT_WALK_EN is zero. 0b0001 DPT_WALK_FAULT Invalid DPT configuration or descriptor. 0b0010 DPT_GPC_FAULT GPC fault on DPT fetch. 0b0011 DPT_EABT External abort on DPT fetch. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 504

Chapter 6. Memory map and registers 6.3. Register formats If FAULT == 0, the value of this field is zero. Access to this field is RO. Bits [3:2] Reserved, RES0. LEVEL, bit [1] Reports the level of the fault. LEVEL Meaning 0b0 Level 0 0b1 Level 1 If FAULT == 0, the value of this field is zero. Access to this field is RO. FAULT, bit [0] FAULT Meaning 0b0 There have been zero DPT lookup faults since this register was last cleared. 0b1 There have been one or more DPT lookup faults since this register was last cleared to 0. A write of one to this field is IGNORED and does not trigger an update of SMMU_GERROR, and does not make this fault active. The reset behavior of this field is: • This field resets to '0'. Additional Information This register contains the syndrome information for the fault reported in SMMU_GERROR.DPT_ERR Note: If a Non-secure DPT lookup resolves to an entry that marks “No access”, that is not a Non-secure DPT lookup fault and it is not reported in this register. See also: • Section 3.24.4 DPT lookup errors. Accessing SMMU_DPT_CFG_FAR This register is read-write, with the following constraints: • Any write to this register is IGNORED unless the write clears the FAULT bit. • When a write clears the FAULT bit, the entire register is cleared to zero. Accesses to this register use the following encodings: Accessible at offset 0x0210 from SMMUv3_PAGE_0 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 505

Chapter 6. Memory map and registers 6.3. Register formats 6.3.51 SMMU_MECIDR The SMMU_MECIDR characteristics are: Purpose Provides information about the number of bits of MECID supported for PM = 1 accesses. Configuration There are no configuration notes. Attributes SMMU_MECIDR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 1 31 RES0 30 4 PMECIDSIZE 3 0 MECIDR_IMPL MECIDR_IMPL, bit [31] Presence of SMMU_MECIDR. MECIDR_IMPL Meaning 0b1 SMMU_MECIDR is implemented. Access to this field is RO. Bits [30:4] Reserved, RES0. PMECIDSIZE, bits [3:0] MECID Size for Non-secure PM = 1 accesses. The number of bits minus one of MECID supported by the SMMU for the Input MECID of Non-secure accesses with PM = 1. The value of this field is an IMPLEMENTATION DEFINED choice of: PMECIDSIZE Meaning 0b0000..0b1111 The number of bits minus one of MECID for Non-secure accesses with PM = 1 All other values are reserved. The value 0b0000 is a valid encoding and indicates that one bit of MECID is supported. • Note: This field only affects the Input MECID supplied on PM = 1 accesses (STE.MECID remains RES0 for Non-secure streams). Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 506

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_MECIDR Accesses to this register use the following encodings: Accessible at offset 0x0220 from SMMUv3_PAGE_0 Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 507

Chapter 6. Memory map and registers 6.3. Register formats 6.3.52 SMMU_HDBSS_BASE0 The SMMU_HDBSS_BASE0 characteristics are: Purpose Configuration of Non-secure state HDBSS table 0 base address. Configuration This register is present only when SMMU_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_HDBSS_BASE0 are RES0. Attributes SMMU_HDBSS_BASE0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_HDBSS_PROD0.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_CR1. For each table that was written, SMMU_HDBSS_PROD0.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_HDBSS_PROD0.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 508

Chapter 6. Memory map and registers 6.3. Register formats WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE0.V == ‘1’ and SMMU_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE0.V == ‘1’ and SMMU_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 509

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE0.V == ‘1’ and SMMU_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Accessing SMMU_HDBSS_BASE0 Accesses to this register use the following encodings: Accessible at offset 0x0240 from SMMUv3_PAGE_0 • When SMMU_HDBSS_BASE0.V == ‘0’ and SMMU_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • When SMMU_HDBSS_BASE0.V == ‘1’ and SMMU_HDBSS_PROD0.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 510

Chapter 6. Memory map and registers 6.3. Register formats 6.3.53 SMMU_HDBSS_PROD0 The SMMU_HDBSS_PROD0 characteristics are: Purpose Index register that allows producer to offset into Non-secure state HDBSS table 0. Configuration This register is present only when SMMU_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_HDBSS_PROD0 are RES0. Attributes SMMU_HDBSS_PROD0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_HDBSS_BASE0.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_HDBSS_BASE0.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 511

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HDBSS_PROD0 Accesses to this register use the following encodings: Accessible at offset 0x0248 from SMMUv3_PAGE_0 • When SMMU_HDBSS_BASE0.V == ‘0’ and SMMU_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 512

Chapter 6. Memory map and registers 6.3. Register formats 6.3.54 SMMU_HDBSS_BASE1 The SMMU_HDBSS_BASE1 characteristics are: Purpose Configuration of Non-secure state HDBSS table 1 base address. Configuration This register is present only when SMMU_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_HDBSS_BASE1 are RES0. Attributes SMMU_HDBSS_BASE1 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_HDBSS_PROD1.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_CR1. For each table that was written, SMMU_HDBSS_PROD1.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_HDBSS_PROD1.ERR_REASON, with the exception of SMMU_HDBSS_PROD1.ERR_REASON == 0b11. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 513

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE1.V == ‘1’ and SMMU_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE1.V == ‘1’ and SMMU_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 514

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HDBSS_BASE1.V == ‘1’ and SMMU_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Accessing SMMU_HDBSS_BASE1 Accesses to this register use the following encodings: Accessible at offset 0x0250 from SMMUv3_PAGE_0 • When SMMU_HDBSS_BASE1.V == ‘0’ and SMMU_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • When SMMU_HDBSS_BASE1.V == ‘1’ and SMMU_HDBSS_PROD1.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 515

Chapter 6. Memory map and registers 6.3. Register formats 6.3.55 SMMU_HDBSS_PROD1 The SMMU_HDBSS_PROD1 characteristics are: Purpose Index register that allows producer to offset into Non-secure state HDBSS table 1. Configuration This register is present only when SMMU_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_HDBSS_PROD1 are RES0. Attributes SMMU_HDBSS_PROD1 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_HDBSS_BASE1.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_HDBSS_BASE1.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason Code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 516

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HDBSS_PROD1 Accesses to this register use the following encodings: Accessible at offset 0x0258 from SMMUv3_PAGE_0 • When SMMU_HDBSS_BASE1.V == ‘0’ and SMMU_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 517

Chapter 6. Memory map and registers 6.3. Register formats 6.3.56 SMMU_HDBSS_IRQ_CFG0 The SMMU_HDBSS_IRQ_CFG0 characteristics are: Purpose Non-secure state HDBSS interrupt configuration register 0. Configuration This register is present only when SMMU_IDR3.HDBSS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HDBSS_IRQ_CFG0 are RES0. Attributes SMMU_HDBSS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits[55:2]. High-order bits of ADDR above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits[1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_HDBSS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x0260 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 518

Chapter 6. Memory map and registers 6.3. Register formats 6.3.57 SMMU_HDBSS_IRQ_CFG1 The SMMU_HDBSS_IRQ_CFG1 characteristics are: Purpose Non-secure state HDBSS interrupt configuration register 1. Configuration This register is present only when SMMU_IDR3.HDBSS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HDBSS_IRQ_CFG1 are RES0. Attributes SMMU_HDBSS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HDBSS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x0268 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 519

Chapter 6. Memory map and registers 6.3. Register formats 6.3.58 SMMU_HDBSS_IRQ_CFG2 The SMMU_HDBSS_IRQ_CFG2 characteristics are: Purpose Non-secure state HDBSS interrupt configuration register 2. Configuration This register is present only when SMMU_IDR3.HDBSS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HDBSS_IRQ_CFG2 are RES0. Attributes SMMU_HDBSS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 520

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_HDBSS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x026C from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 521

Chapter 6. Memory map and registers 6.3. Register formats 6.3.59 SMMU_HDBSS_MPAM The SMMU_HDBSS_MPAM characteristics are: Purpose MPAM configuration register for accesses to an HDBSS table. Configuration This register is present only when SMMU_IDR3.HDBSS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_HDBSS_MPAM are RES0. Attributes SMMU_HDBSS_MPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 24 PMG 23 16 PARTID 15 0 Bits [31:24] Reserved, RES0. PMG, bits [23:16] PMG for accesses to an HDBSS table. For a description of PMG, see SMMU_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to an HDBSS table. For a description of PARTID, see SMMU_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HDBSS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x0270 from SMMUv3_PAGE_0 • When SMMU_HDBSS_BASE0.V == ‘0’, SMMU_HDBSS_PROD0.VACK == ‘0’, SMMU_HDBSS_BASE1.V == ‘0’, and SMMU_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 522

Chapter 6. Memory map and registers 6.3. Register formats 6.3.60 SMMU_HACDBS_BASE The SMMU_HACDBS_BASE characteristics are: Purpose Control register for Non-secure state HACDBS base address. Configuration This register is present only when SMMU_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_HACDBS_BASE are RES0. Attributes SMMU_HACDBS_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions EN 63 62 RA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 EN, bit [63] Enable use of the HACDBS. EN Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. This field has similar Update behavior to fields in SMMU_CR0, such that when its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_HACDBS_CONS.ENACK to the new value. Completion of an Update from 1 to 0 ensures that all outstanding walks, including the update of descriptors from writable-dirty to writable-clean, have completed. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. RA, bit [61] Read Allocate hint. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 523

Chapter 6. Memory map and registers 6.3. Register formats RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HACDBS_BASE.EN == ‘1’ and SMMU_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HACDBS base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HACDBS is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HACDBS_BASE.EN == ‘1’ and SMMU_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HACDBS. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 524

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_HACDBS_BASE.EN == ‘1’ and SMMU_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Accessing SMMU_HACDBS_BASE Accesses to this register use the following encodings: Accessible at offset 0x0440 from SMMUv3_PAGE_0 • When SMMU_HACDBS_BASE.EN == ‘1’ and SMMU_HACDBS_CONS.ENACK == ‘1’, accesses to this register are RW. • When SMMU_HACDBS_BASE.EN == ‘0’ and SMMU_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 525

Chapter 6. Memory map and registers 6.3. Register formats 6.3.61 SMMU_HACDBS_CONS The SMMU_HACDBS_CONS characteristics are: Purpose Index register that allows consumer to offset into Non-secure state HACBDS. Configuration This register is present only when SMMU_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_HACDBS_CONS are RES0. Attributes SMMU_HACDBS_CONS is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 59 RES0 58 56 INDEX 55 32 ENACK ERR_REASON STREAMID 31 0 ENACK, bit [63] Enable use of the HACDBS acknowledge. ENACK Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. See SMMU_HACDBS_BASE.EN. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_HACDBS_BASE.ERRACK, then an error has occurred while processing a HACDBS entry. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:59] HACDBS error. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 526

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b000 No error. 0b001 STRUCTF - A read of an entry from the HACDBS has experienced an error. 0b010 IPAF - A stage 2 walk of an IPA from a HACDBS entry has experienced a translation-related fault or an external abort. 0b011 IPAHACF - Processing of an entry from the HACDBS experienced an error that is not a translation-related fault or an external abort. 0b100 STEF - An error occured while fetching or interpreting the STE, or any associated structures. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [58:56] Reserved, RES0. INDEX, bits [55:32] Next entry to read from HACDBS. This field indicates the index of the HACDBS entry that the SMMU will read next. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID required for stage 2 table walks for HACDBS entries. The StreamID is used to locate the STE which contains the stage 2 table walk configuration required to process HACDBS entries. If SMMU_IDR1.SID_SIZE < 32, bits [31:SMMU_IDR1.SID_SIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HACDBS_CONS Accesses to this register use the following encodings: Accessible at offset 0x0448 from SMMUv3_PAGE_0 • When SMMU_HACDBS_BASE.EN == ‘0’ and SMMU_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 527

Chapter 6. Memory map and registers 6.3. Register formats 6.3.62 SMMU_HACDBS_IRQ_CFG0 The SMMU_HACDBS_IRQ_CFG0 characteristics are: Purpose Non-secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_IDR3.HACDBS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HACDBS_IRQ_CFG0 are RES0. Attributes SMMU_HACDBS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR 55 32 ADDR 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits [55:2]. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits [1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_HACDBS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x0450 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 528

Chapter 6. Memory map and registers 6.3. Register formats 6.3.63 SMMU_HACDBS_IRQ_CFG1 The SMMU_HACDBS_IRQ_CFG1 characteristics are: Purpose Non-secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_IDR3.HACDBS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HACDBS_IRQ_CFG1 are RES0. Attributes SMMU_HACDBS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HACDBS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x0458 from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 529

Chapter 6. Memory map and registers 6.3. Register formats 6.3.64 SMMU_HACDBS_IRQ_CFG2 The SMMU_HACDBS_IRQ_CFG2 characteristics are: Purpose Non-secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_IDR3.HACDBS == 1 and SMMU_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_HACDBS_IRQ_CFG2 are RES0. Attributes SMMU_HACDBS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 530

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_HACDBS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x045C from SMMUv3_PAGE_0 • When SMMU_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 531

Chapter 6. Memory map and registers 6.3. Register formats 6.3.65 SMMU_HACDBS_MPAM The SMMU_HACDBS_MPAM characteristics are: Purpose MPAM configuration register for accesses to the HACDBS. Configuration This register is present only when SMMU_IDR3.HACDBS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_HACDBS_MPAM are RES0. Attributes SMMU_HACDBS_MPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 24 PMG 23 16 PARTID 15 0 Bits [31:24] Reserved, RES0. PMG, bits [23:16] PMG for accesses to the HACDBS. For a description of PMG, see SMMU_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to the HACDBS. For a description of PARTID, see SMMU_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_HACDBS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x0460 from SMMUv3_PAGE_0 • When SMMU_HACDBS_BASE.EN == ‘0’ and SMMU_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 532

Chapter 6. Memory map and registers 6.3. Register formats 6.3.66 SMMU_CITAB_BASE The SMMU_CITAB_BASE characteristics are: Purpose Configuration of the Command Queue Information Table base address. Configuration This register is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to SMMU_CITAB_BASE are RES0. Attributes SMMU_CITAB_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR 55 32 RES0 ADDR 31 4 RES0 3 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint for an access to the CIT and the VSTTs. For more information, see SMMU_STRTAB_BASE.RA. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:4] Physical address of the Command Queue Information Table base, bits[55:4]. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits ADDR[N:0] are treated as 0 by the SMMU where: • N == LOG2SIZE + 3, when the CIT is linear. The address is therefore aligned to its size by the SMMU. • N == max(3, (LOG2SIZE - SPLIT - 1 + 3)), when the CIT has 2 levels. The address is therefore aligned to the larger of the CITE size or the L1 array size. For more information, see SMMU_STRTAB_BASE.ADDR. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 533

Chapter 6. Memory map and registers 6.3. Register formats Bits [3:0] Reserved, RES0. Accessing SMMU_CITAB_BASE This register is Guarded by SMMU_CR0.VSIDEN and must only be written when SMMU_CR0.VSIDEN is 0. Accesses to this register use the following encodings: Accessible at offset 0x0540 from SMMUv3_PAGE_0 • When SMMU_CR0.VSIDEN == ‘0’ and SMMU_CR0ACK.VSIDEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 534

Chapter 6. Memory map and registers 6.3. Register formats 6.3.67 SMMU_CITAB_BASE_CFG The SMMU_CITAB_BASE_CFG characteristics are: Purpose Configuration of the Command Queue Information Table. Configuration This register is present only when SMMU_IDR6.VSID == 1. Otherwise, direct accesses to SMMU_CITAB_BASE_CFG are RES0. Attributes SMMU_CITAB_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 18 FMT 17 16 RES0 15 11 SPLIT 10 6 LOG2SIZE 5 0 Bits [31:18] Reserved, RES0. FMT, bits [17:16] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Format of the Command Queue Information Table. FMT Meaning 0b00 Linear Command Queue Information Table. 0b01 2-level Command Queue Information Table. Other values are reserved, behave as 0b00. For more information, see SMMU_STRTAB_BASE_CFG.FMT. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [15:11] Reserved, RES0. SPLIT, bits [10:6] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Split point for multi-level table. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 535

Chapter 6. Memory map and registers 6.3. Register formats SPLIT Meaning 0b01000 8 bits, 4KB leaf tables. 0b01010 10 bits, 16KB leaf tables. 0b01100 12 bits, 64KB leaf tables. Other values are reserved and behave as 0b01000 If SMMU_CITAB_BASE_CFG.FMT == 0b00, this field is IGNORED. For more information, see SMMU_STRTAB_BASE_CFG.SPLIT. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. LOG2SIZE, bits [5:0] Table size as log2(entries) Except for readback of a written value, the effective LOG2SIZE is <= SMMU_(R_)IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP for the purpose of upper/lower/linear CIT index address calculation. For more information, see SMMU_STRTAB_BASE_CFG.LOG2SIZE. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_CITAB_BASE_CFG This register is Guarded by SMMU_CR0.VSIDEN and must only be written when SMMU_CR0.VSIDEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x548 from SMMUv3_PAGE_0 • When SMMU_CR0.VSIDEN == ‘0’ and SMMU_CR0ACK.VSIDEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 536

Chapter 6. Memory map and registers 6.3. Register formats 6.3.68 SMMU_CMDQ_CONTROL_PAGE_BASE, n = 0 - 255 The SMMU_CMDQ_CONTROL_PAGE_BASE characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Non-secure programming interface. Configuration This register is present only when SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_CMDQ_CONTROL_PAGE_BASE are RES0. Attributes SMMU_CMDQ_CONTROL_PAGE_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:16] 55 32 ADDR[55:16] 31 16 RES0 15 3 CMDQGS 2 1 0 CMDQ_CO NTROL_P AGE_PRE SET Bits [63:56] Reserved, RES0. ADDR, bits [55:16] Base address of the Command queue control page, bits [55:16]. The bits [15:0] of the base address are 0. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. The value of this field is an offset from the base address of SMMU Register Page 0, not an absolute address. The values of all SMMU_CMDQ_CONTROL_PAGE_BASEn.ADDR are such that the pages occupy a contiguous region of address space within the SMMU register file, and they are arranged in ascending value of n. Bits [15:3] Reserved, RES0. CMDQGS, bits [2:1] Granule size to use for the Command queue control page. CMDQGS Meaning 0b01 64KB ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 537

Chapter 6. Memory map and registers 6.3. Register formats CMDQ_CONTROL_PAGE_PRESET, bit [0] Indicates whether queue controls for this interface are stored in Normal memory or registers. CMDQ_CONTROL_PAGE_PRESET Meaning 0b1 The ECMDQ interfaces for this page are implemented as registers in the SMMU. This bit is 1 in implementations of SMMUv3.3. Accessing SMMU_CMDQ_CONTROL_PAGE_BASE Accesses to this register use the following encodings: Accessible at offset 0x4000 + (32 * n) from SMMUv3_PAGE_0 When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 538

Chapter 6. Memory map and registers 6.3. Register formats 6.3.69 SMMU_CMDQ_CONTROL_PAGE_CFG, n = 0 - 255 The SMMU_CMDQ_CONTROL_PAGE_CFG characteristics are: Purpose Control for Enhanced Command queue interface for the SMMU Non-secure programming interface. Configuration This register is present only when SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_CMDQ_CONTROL_PAGE_CFG are RES0. Attributes SMMU_CMDQ_CONTROL_PAGE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 EN 0 Bits [31:1] Reserved, RES0. EN, bit [0] Command queue control page enable. EN Meaning 0b1 Command queue control page is enabled. This field is RES1. Accessing SMMU_CMDQ_CONTROL_PAGE_CFG Accesses to this register use the following encodings: Accessible at offset 0x4008 + (32 * n) from SMMUv3_PAGE_0 When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 539

Chapter 6. Memory map and registers 6.3. Register formats 6.3.70 SMMU_CMDQ_CONTROL_PAGE_STATUS, n = 0 - 255 The SMMU_CMDQ_CONTROL_PAGE_STATUS characteristics are: Purpose Status of Enhanced Command queue interface for the SMMU Non-secure programming interface. Configuration This register is present only when SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_CMDQ_CONTROL_PAGE_STATUS are RES0. Attributes SMMU_CMDQ_CONTROL_PAGE_STATUS is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 0 ENACK Bits [31:1] Reserved, RES0. ENACK, bit [0] Command queue control page enable. ENACK Meaning 0b1 Command queue control page is enabled. This field is RES1. Accessing SMMU_CMDQ_CONTROL_PAGE_STATUS Accesses to this register use the following encodings: Accessible at offset 0x400C + (32 * n) from SMMUv3_PAGE_0 When SMMU_IDR1.ECMDQ == 1 or SMMU_IDR2.RECMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 540

Chapter 6. Memory map and registers 6.3. Register formats 6.3.71 SMMU_S_IDR0 The SMMU_S_IDR0 characteristics are: Purpose Provides information about the features implemented for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IDR0 are RES0. Attributes SMMU_S_IDR0 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 26 25 24 RES0 23 14 MSI 13 RES0 12 0 ECMDQ STALL_MODEL ECMDQ, bit [31] Support for enhanced Command queue interface for Secure programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ Meaning 0b0 Secure Enhanced Command queue interface not supported. SMMU_S_IDR6 is RES0. 0b1 Secure Enhanced Command queue interface details are advertised in SMMU_S_IDR6. If this field is 1, then all of the following are true: • SMMU_IDR0.COHACC == 1. • SMMU_S_IDR2.RECMDQ == 0. • SMMU_S_IDR0.MSI == 1. • SMMU_IDR1.QUEUES_PRESET == 0. See section 3.5.6 Enhanced Command queue interfaces. Access to this field is RO. Bits [30:26] Reserved, RES0. STALL_MODEL, bits [25:24] Stalling fault model support. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 541

Chapter 6. Memory map and registers 6.3. Register formats STALL_MODEL Meaning 0b00 Stall and Terminate models supported. 0b01 Stall is not supported, all faults terminate transaction and STE.S2S and CD.S must be 0. CMD_RESUME and CMD_STALL_TERM are not available. 0b10 Stall is forced (all faults eligible to stall cause stall), STE.S2S and CD.S must be 1. All other values are reserved. • Note: STE.S2S must be in the states above only if stage 2 translation was enabled. • Encoded identically to SMMU_IDR0.STALL_MODEL, this field indicates the SMMU support for the Stall model and the Terminate model. • For more information, see SMMU_S_CR0.NSSTALLD. Access to this field is RO. Bits [23:14] Reserved, RES0. MSI, bit [13] Secure Message Signalled Interrupts are supported. The value of this field is an IMPLEMENTATION DEFINED choice of: MSI Meaning 0b0 The SMMU supports wired interrupt notifications only for Secure events and GERROR. • The MSI fields in SMMU_S_EVENTQ_IRQ_CFGn and SMMU_S_GERROR_IRQ_CFGn are RES0. 0b1 Message Signalled Interrupts are supported for Secure events and GERROR. • Note: Arm strongly recommends that an implementation supports Non-secure MSIs (SMMU_IDR0.MSI == 1) if Secure MSIs are supported. Access to this field is RO. Bits [12:0] Reserved, RES0. Accessing SMMU_S_IDR0 Accesses to this register use the following encodings: Accessible at offset 0x8000 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 542

Chapter 6. Memory map and registers 6.3. Register formats 6.3.72 SMMU_S_IDR1 The SMMU_S_IDR1 characteristics are: Purpose Provides information about the features implemented for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IDR1 are RES0. Attributes SMMU_S_IDR1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 30 29 RES0 28 6 S_SIDSIZE 5 0 SECURE_ IMPL SEL2 RES0 • Note: If the SMMU implementation supports SubstreamIDs, the size of the SubstreamID that is provided for Secure StreamIDs is the same as the size that is provided for Non-secure StreamIDs. Therefore, there is no separate Secure SSIDSIZE option. SECURE_IMPL, bit [31] Secure state implemented. The value of this field is an IMPLEMENTATION DEFINED choice of: SECURE_IMPL Meaning 0b0 The SMMU does not implement Secure state. All SMMU_S_* Secure registers are RAZ/WI. 0b1 The SMMU implements Secure state. When SECURE_IMPL == 1, stage 1 must be supported, and therefore SMMU_IDR0.S1P == 1. If SECURE_IMPL == 1 and SMMU_IDR0.RME_IMPL == 1, then all the following apply: • SMMU_S_IDR1.SEL2 == 1. • The EL3 StreamWorld is not supported. • It is possible to report each of F_STE_FETCH, F_CD_FETCH, F_VMS_FETCH, and F_WALK_EABT with GPCF == 1 in the Secure Event queue. See also: • 3.10.2 Support for Secure state. Access to this field is RO. Bit [30] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 543

Chapter 6. Memory map and registers 6.3. Register formats SEL2, bit [29] Secure EL2 and Secure stage 2 support. The value of this field is an IMPLEMENTATION DEFINED choice of: SEL2 Meaning 0b0 Secure EL2 and Secure stage 2 are not supported. 0b1 Secure EL2 is supported and Secure STEs are permitted to be configured with STE.STRW == 0b10. Secure stage 2 is supported and Secure STEs are permitted to be configured with STE.Config == 0b11x. • Secure EL2 and Secure stage 2 support is optional in SMMUv3.2 and later. • SEL2 == 0 if SMMU_IDR0.S1P == 0 or if SMMU_IDR0.S2P == 0. Access to this field is RO. Bits [28:6] Reserved, RES0. S_SIDSIZE, bits [5:0] Max bits of Secure StreamID. The value of this field is an IMPLEMENTATION DEFINED choice of: S_SIDSIZE Meaning 0b000000..0b100000 Maximum number of bits representing the Secure StreamID. • Equivalent to SMMU_IDR1.SIDSIZE and encoded the same way, this field determines the maximum Secure StreamID value and therefore the maximum size of the Secure Stream table. Access to this field is RO. Accessing SMMU_S_IDR1 Accesses to this register use the following encodings: Accessible at offset 0x8004 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 544

Chapter 6. Memory map and registers 6.3. Register formats 6.3.73 SMMU_S_IDR2 The SMMU_S_IDR2 characteristics are: Purpose Provides information about the features implemented for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IDR2 are RES0. Attributes SMMU_S_IDR2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 30 29 28 27 26 25 24 RES0 23 10 BA_S_VATOS 9 0 ECMDQ_C MD_CFGI ECMDQ_CMD_ TLBI ECMDQ_CMD_ATC ECMDQ_CMD_PRI RECMDQ RES0 ECMDQ_CMD_FAULT ECMDQ_CMD_DPTI ECMDQ_CMD_CFGI, bit [31] When SMMU_S_IDR2.RECMDQ == 1: Support for Secure state CMD_CFGI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_CFGI Meaning 0b0 Configuration invalidations are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 Configuration invalidations are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_TLBI, bit [30] When SMMU_S_IDR2.RECMDQ == 1: Support for Secure state CMD_TLBI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 545

Chapter 6. Memory map and registers 6.3. Register formats ECMDQ_CMD_TLBI Meaning 0b0 Only CMD_TLBI_NH_ is supported on the RECMDQs. Other CMD_TLBI_ commands lead to CERROR_ILL when issued to the RECMDQs. 0b1 All TLBI commands which are supported by the implementation are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_ATC, bit [29] When SMMU_S_IDR2.RECMDQ == 1, SMMU_IDR0.ATS == 1, and SMMU_S_IDR3.SAMS == '0': Support for Secure state CMD_ATC_INV on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_ATC Meaning 0b0 CMD_ATC_INV is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_ATC_INV is supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_PRI, bit [28] When SMMU_S_IDR2.RECMDQ == 1, SMMU_IDR0.PRI == 1, and SMMU_S_IDR3.SAMS == '0': Support for Secure state CMD_PRI_RESP on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_PRI Meaning 0b0 CMD_PRI_RESP is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_PRI_RESP is supported on the RECMDQs. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 546

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. ECMDQ_CMD_DPTI, bit [27] When SMMU_S_IDR2.RECMDQ == 1, SMMU_IDR3.DPT == 1, and SMMU_S_IDR3.SAMS == '0': Support for CMD_DPTI* on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_DPTI Meaning 0b0 DPT maintenance commands are not supported on the RECMDQs and lead to CERROR_ILL when issued to the RECMDQs. 0b1 DPT maintenance commands are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_FAULT, bit [26] When SMMU_S_IDR2.RECMDQ == 1: Support for Secure state fault response command on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_FAULT Meaning 0b0 CMD_RESUME and CMD_STALL_TERM are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_RESUME and CMD_STALL_TERM are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. Bit [25] Reserved, RES0. RECMDQ, bit [24] Support for Restricted ECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 547

Chapter 6. Memory map and registers 6.3. Register formats RECMDQ Meaning 0b0 Restricted ECMDQs are not supported. 0b1 Restricted ECMDQs are supported. If this field is 1, then all of the following are true: • SMMU_S_IDR0.ECMDQ == 0. • SMMU_IDR0.COHACC == 1. • SMMU_S_IDR0.MSI == 1. • SMMU_IDR1.QUEUES_PRESET == 0. Access to this field is RO. Bits [23:10] Reserved, RES0. BA_S_VATOS, bits [9:0] When SMMU_IDR0.VATOS == 1: S_VATOS page base address offset. If SMMU_IDR0.VATOS == 0, no S_VATOS page is present. This field has an IMPLEMENTATION DEFINED value. If Secure state is supported and SMMU_S_IDR1.SEL2 == 1 and SMMU_IDR0.VATOS == 1, the S_VATOS registers are present. The address of the S_VATOS page is determined from this field and is referred to as O_S_VATOS: O_S_VATOS = SMMU_BASE + 0x20000 + (SMMU_S_IDR2.BA_S_VATOS * 0x10000) Access to this field is RO. Otherwise: Reserved, RES0. Accessing SMMU_S_IDR2 Accesses to this register use the following encodings: Accessible at offset 0x8008 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 548

Chapter 6. Memory map and registers 6.3. Register formats 6.3.74 SMMU_S_IDR3 The SMMU_S_IDR3 characteristics are: Purpose Provides information about the features implemented for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IDR3 are RES0. Attributes SMMU_S_IDR3 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 28 27 26 RES0 25 7 6 RES0 5 0 HACDBS HDBSS SAMS Bits [31:28] Reserved, RES0. HACDBS, bit [27] Indicates support for hardware accelerator for cleaning Dirty state for the Secure programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HACDBS Meaning 0b0 Hardware accelerator for cleaning Dirty state is not supported for the Secure programming interface. 0b1 Hardware accelerator for cleaning Dirty state is supported for the Secure programming interface. If SMMU_IDR3.HACDBS is 0, then this field is RES0. If this field is 1, then SMMU_S_IDR3.HDBSS must be 1. Access to this field is RO. HDBSS, bit [26] Support for hardware Dirty state tracking Structure for Secure programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HDBSS Meaning 0b0 Hardware Dirty state tracking Structure is not supported for the Secure programming interface. 0b1 Hardware Dirty state tracking Structure is supported for the Secure programming interface. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 549

Chapter 6. Memory map and registers 6.3. Register formats If SMMU_IDR3.HDBSS is 0, then this field is RES0. Access to this field is RO. Bits [25:7] Reserved, RES0. SAMS, bit [6] Secure ATS Maintenance Support. The value of this field is an IMPLEMENTATION DEFINED choice of: SAMS Meaning 0b0 If SMMU_IDR0.ATS == 1, the CMD_ATC_INV command is supported when issued on the Non-secure and Secure Command queues. If SMMU_IDR0.PRI == 1, the CMD_PRI_RESP command is supported when issued on the Non-secure and Secure Command queues. If SMMU_IDR3.DPT == 1, the CMD_DPTI_ALL and CMD_DPTI_PA commands are supported when issued on the Non-secure and Secure Command queues. 0b1 If SMMU_IDR0.ATS == 1, the CMD_ATC_INV command is supported when issued on the Non-secure Command queues, but raises CERROR_ILL when issued on the Secure Command queues. If SMMU_IDR0.PRI == 1, the CMD_PRI_RESP command is supported when issued on the Non-secure Command queues, but raises CERROR_ILL when issued on the Secure Command queues. If SMMU_IDR3.DPT == 1, the CMD_DPTI_ALL and CMD_DPTI_PA commands are supported when issued on the Non-Secure Command queues, but raise CERROR_ILL when issued on the Secure Command queues. If SMMU_IDR0.ATS == 0, this field is RES0. Note: This ID field has the opposite polarity from most ID fields. Note: This field only controls command support on the: • Non-secure and Secure Command queues. • Non-secure and Secure Enhanced Command queues. This field does not affect the interpretation of these commands on the Non-secure and Secure direct-mode Enhanced Command queues. Access to this field is RO. Bits [5:0] Reserved, RES0. Accessing SMMU_S_IDR3 Accesses to this register use the following encodings: Accessible at offset 0x800C from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 550

Chapter 6. Memory map and registers 6.3. Register formats 6.3.75 SMMU_S_IDR4 The SMMU_S_IDR4 characteristics are: Purpose Provides information about the features implemented for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IDR4 are RES0. Attributes SMMU_S_IDR4 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions IMPLEMENTATION DEFINED 31 0 IMPLEMENTATION DEFINED, bits [31:0] IMPLEMENTATION DEFINED. Additional Information The contents of this register are IMPLEMENTATION DEFINED and can be used to identify the presence of other IMPLEMENTATION DEFINED register regions elsewhere in the memory map. Accessing SMMU_S_IDR4 Accesses to this register use the following encodings: Accessible at offset 0x8010 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 551

Chapter 6. Memory map and registers 6.3. Register formats 6.3.76 SMMU_S_CR0 The SMMU_S_CR0 characteristics are: Purpose Secure SMMU programming interface control and configuration register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CR0 are RES0. Attributes SMMU_S_CR0 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 10 9 VMW 8 6 SIF 5 4 3 2 1 0 NSSTALLD RES0 CMDQEN SMMUEN RES0 EVENTQEN Bits [31:10] Reserved, RES0. NSSTALLD, bit [9] Non-secure stall disable. NSSTALLD Meaning 0b0 Non-secure programming interface might use Stall model. 0b1 Non-secure programming interface prohibited from using Stall model. • When SMMU_S_IDR0.STALL_MODEL == 0b00, setting this bit modifies the Non-secure behavior so that only the Terminate model is available for Non-secure streams and SMMU_IDR0.STALL_MODEL reads as 0b01. Otherwise, if NSSTALLD == 0, SMMU_IDR0.STALL_MODEL == SMMU_S_IDR0.STALL_MODEL. • When SMMU_S_IDR0.STALL_MODEL != 0b00, this bit is RES0 and SMMU_IDR0.STALL_MODEL == SMMU_S_IDR0.STALL_MODEL. – Note: A reserved SMMU_S_CR0 bit is not reflected into SMMU_S_CR0ACK. The reset behavior of this field is: • This field resets to '0'. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: Secure VMID Wildcard. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 552

Chapter 6. Memory map and registers 6.3. Register formats VMW Meaning 0b000 TLB invalidations match VMID tags exactly. 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • The VMW field is defined in the same way as SMMU_CR0.VMW, but affects Secure VMID matching on invalidation. • All other values are reserved, and behave as 0b000. – N == upper bit of VMID as determined by SMMU_IDR0.VMID16. • This field has no effect on VMID matching on translation lookup. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. SIF, bit [5] Secure Instruction Fetch. SIF Meaning 0b0 Secure transactions might exit the SMMU as a Non-secure instruction fetch. 0b1 Secure transactions determined to be Non-secure instruction fetch are treated as a Permission fault. This field causes transactions from a Secure stream that are determined to be an instruction fetch, after INSTCFG fields are applied, to experience a Permission fault if their effective stage 1 output NS attribute is Non-secure. • When translation is disabled because SMMUEN == 0, the transaction is terminated with abort and no F_PERMISSION is recorded. • When SMMUEN is set, one of the following occurs and, if the Event queue is writable, a stage 1 F_PERMISSION is recorded: – If stage 1 translation is disabled (STE.Config selects bypass, including the case where Config == 0b1x1 and STE.S1DSS causes stage 1 to be skipped, behaving as though Config == 0b1x0) the faulting transaction is terminated with abort. – If stage 1 translation is applied (STE.Config enables stage 1 and STE.S1DSS does not cause stage 1 translation to be skipped), CD.{A,R,S} govern stall and terminate behavior of the transaction. – The F_PERMISSION event is reported with CLASS = IN and S2 = 0. The SIF field is permitted to be cached in a TLB or configuration cache and an Update of this field requires invalidation of all Secure TLB entries and configuration caches. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 553

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Bit [4] Reserved, RES0. CMDQEN, bit [3] Enable Secure Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Secure Command queue is disabled. 0b1 Processing of commands from the Secure Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Secure Event queue writes. EVENTQEN Meaning 0b0 Writes to the Secure Event queue are disabled. 0b1 Writes to the Secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. SMMUEN, bit [0] Secure SMMU enable. SMMUEN Meaning 0b0 All Secure streams bypass the SMMU, with attributes determined from SMMU_S_GBPA. 0b1 All Secure streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 554

Chapter 6. Memory map and registers 6.3. Register formats Additional Information The Update procedure, with respect to flags reflected into SMMU_S_CR0ACK, is the same as for SMMU_CR0. The Update side effects of CMDQEN, EVENTQEN, and SMMUEN fields are similar to their respective equivalents in SMMU_CR0. Accessing SMMU_S_CR0 Accesses to this register use the following encodings: Accessible at offset 0x8020 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. Additional information For more information, see the additional information section in SMMU_CR0. 6.3.76.1 NSSTALLD This bit has no Update side effects. NSSTALLD prevents Non-secure configuration from using the Stall model, therefore stall-related commands are unavailable and use of STE and CD stall configuration renders the structures ILLEGAL. This bit is permitted to be cached in configuration caches. This bit must not be modified when any of the following could occur: • Non-secure CMD_STALL_TERM or CMD_RESUME commands have been submitted to the Non-secure Command queue, therefore might be processed. • Non-secure transactions are being translated through structures configured to stall faults. A change to this bit takes effect at an UNPREDICTABLE point prior to Update completion. If changed while the above stall-related activities are occurring, it is UNPREDICTABLE whether transactions and commands behave in manner corresponding to either value of this bit, until Update of this bit completes. Update completes when it is guaranteed that all of the following are observable: • Any subsequent fetch of an STE or CD will behave in a manner relating to the new value of this bit. • Any subsequently consumed command will behave in a manner relating to the new value of this bit. • The value of SMMU_IDR0.STALL_MODEL reflects the new value of this bit. Note: After Update is completed, client transactions might be affected by stall configuration previously cached in a Configuration cache, until completion of an appropriate invalidation operation. Note: Secure software is expected to Update this bit before Non-secure software can access the SMMU. 6.3.76.2 SIF This bit has no Update side effects. For a transaction that bypasses translation, a change to SIF is guaranteed to be visible with respect to that transaction after the new value of SIF is acknowledged in SMMU_S_CR0ACK.SIF. For a transaction that undergoes translation, a change to SIF is guaranteed to be visible with respect to that transaction only after the completion of a TLB invalidation of a scope related to that transaction, where the TLB invalidation is made visible to the SMMU after the new value of SIF is acknowledged in SMMU_S_CR0ACK.SIF. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 555

Chapter 6. Memory map and registers 6.3. Register formats 6.3.77 SMMU_S_CR0ACK The SMMU_S_CR0ACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls in Secure SMMU programming interface, SMMU_S_CR0. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CR0ACK are RES0. Attributes SMMU_S_CR0ACK is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 10 9 VMW 8 6 SIF 5 4 3 2 1 0 NSSTALLD RES0 CMDQEN SMMUEN RES0 EVENTQEN Bits [31:10] Reserved, RES0. NSSTALLD, bit [9] Non-secure stall disable. NSSTALLD Meaning 0b0 Non-secure programming interface might use Stall model. 0b1 Non-secure programming interface prohibited from using Stall model. When SMMU_S_IDR0.STALL_MODEL != 0b00, this bit is RES0 and SMMU_IDR0.STALL_MODEL == SMMU_S_IDR0.STALL_MODEL. • Note: A reserved SMMU_S_CR0 bit is not reflected into SMMU_S_CR0ACK. The reset behavior of this field is: • This field resets to '0'. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: Secure VMID Wildcard. VMW Meaning 0b000 TLB invalidations match VMID tags exactly. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 556

Chapter 6. Memory map and registers 6.3. Register formats VMW Meaning 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • The VMW field is defined in the same way as SMMU_CR0.VMW, but affects Secure VMID matching on invalidation. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. SIF, bit [5] Secure Instruction Fetch. SIF Meaning 0b0 Secure transactions might exit the SMMU as a Non-secure instruction fetch. 0b1 Secure transactions determined to be Non-secure instruction fetch are treated as a Permission fault. The reset behavior of this field is: • This field resets to '0'. Bit [4] Reserved, RES0. CMDQEN, bit [3] Enable Secure Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Secure Command queue is disabled. 0b1 Processing of commands from the Secure Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Secure Event queue writes. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 557

Chapter 6. Memory map and registers 6.3. Register formats EVENTQEN Meaning 0b0 Writes to the Secure Event queue are disabled. 0b1 Writes to the Secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. SMMUEN, bit [0] Secure SMMU enable. SMMUEN Meaning 0b0 All Secure streams bypass the SMMU, with attributes determined from SMMU_S_GBPA. 0b1 All Secure streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. Additional Information Undefined bits read as zero. Fields in this register are RAZ if their corresponding SMMU_S_CR0 field is IGNORED. An Update to a field in SMMU_S_CR0 is considered complete, along with any side effects, when the respective field in this register is observed to take the new value. The Update procedure, with respect to flags reflected in SMMU_S_CR0ACK, is the same as for SMMU_CR0 and SMMU_CR0ACK. Accessing SMMU_S_CR0ACK Accesses to this register use the following encodings: Accessible at offset 0x8024 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 558

Chapter 6. Memory map and registers 6.3. Register formats 6.3.78 SMMU_S_CR1 The SMMU_S_CR1 characteristics are: Purpose Secure SMMU programming interface control and configuration register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CR1 are RES0. Attributes SMMU_S_CR1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 8 7 6 5 4 3 2 1 0 TABLE_SH TABLE_OC TABLE_IC QUEUE_IC QUEUE_OC QUEUE_SH Bits [31:12] Reserved, RES0. TABLE_SH, bits [11:10] Secure Stream table access Shareability. TABLE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When SMMU_S_CR1.TABLE_OC == 0b00 and SMMU_S_CR1.TABLE_IC == 0b00, this field is IGNORED and behaves as Outer Shareable. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.SMMUEN == ‘0’ – SMMU_S_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 559

Chapter 6. Memory map and registers 6.3. Register formats TABLE_OC, bits [9:8] Secure Stream table access Outer Cacheability. TABLE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.SMMUEN == ‘0’ – SMMU_S_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. TABLE_IC, bits [7:6] Secure Stream table Inner Cacheability. TABLE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.SMMUEN == ‘0’ – SMMU_S_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. QUEUE_SH, bits [5:4] Secure queue access Shareability. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 560

Chapter 6. Memory map and registers 6.3. Register formats QUEUE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When SMMU_S_CR1.QUEUE_OC == 0b00 and SMMU_S_CR1.QUEUE_IC == 0b00, this field is IGNORED and behaves as Outer Shareable. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.EVENTQEN == ‘0’ – SMMU_S_CR0ACK.EVENTQEN == ‘0’ – SMMU_S_CR0.CMDQEN == ‘0’ – SMMU_S_CR0ACK.CMDQEN == ‘0’ – SMMU_S_CR0.PRIQEN == ‘0’ – SMMU_S_CR0ACK.PRIQEN == ‘0’ – SMMU_S_HDBSS_BASE0.V == ‘0’ – SMMU_S_HDBSS_PROD0.VACK == ‘0’ – SMMU_S_HDBSS_BASE1.V == ‘0’ – SMMU_S_HDBSS_PROD1.VACK == ‘0’ – SMMU_S_HACDBS_BASE.EN == ‘0’ – SMMU_S_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_S_IDR0.ECMDQ == 0 · SMMU_S_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_S_ECMDQ_PRODn.EN == SMMU_S_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_OC, bits [3:2] Secure queue access Outer Cacheability. QUEUE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 561

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.EVENTQEN == ‘0’ – SMMU_S_CR0ACK.EVENTQEN == ‘0’ – SMMU_S_CR0.CMDQEN == ‘0’ – SMMU_S_CR0ACK.CMDQEN == ‘0’ – SMMU_S_CR0.PRIQEN == ‘0’ – SMMU_S_CR0ACK.PRIQEN == ‘0’ – SMMU_S_HDBSS_BASE0.V == ‘0’ – SMMU_S_HDBSS_PROD0.VACK == ‘0’ – SMMU_S_HDBSS_BASE1.V == ‘0’ – SMMU_S_HDBSS_PROD1.VACK == ‘0’ – SMMU_S_HACDBS_BASE.EN == ‘0’ – SMMU_S_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_S_IDR0.ECMDQ == 0 · SMMU_S_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_S_ECMDQ_PRODn.EN == SMMU_S_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_IC, bits [1:0] Secure queue access Inner Cacheability. QUEUE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_S_CR0.EVENTQEN == ‘0’ – SMMU_S_CR0ACK.EVENTQEN == ‘0’ – SMMU_S_CR0.CMDQEN == ‘0’ – SMMU_S_CR0ACK.CMDQEN == ‘0’ – SMMU_S_CR0.PRIQEN == ‘0’ – SMMU_S_CR0ACK.PRIQEN == ‘0’ – SMMU_S_HDBSS_BASE0.V == ‘0’ ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 562

Chapter 6. Memory map and registers 6.3. Register formats – SMMU_S_HDBSS_PROD0.VACK == ‘0’ – SMMU_S_HDBSS_BASE1.V == ‘0’ – SMMU_S_HDBSS_PROD1.VACK == ‘0’ – SMMU_S_HACDBS_BASE.EN == ‘0’ – SMMU_S_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_S_IDR0.ECMDQ == 0 · SMMU_S_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Secure state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_S_ECMDQ_PRODn.EN == SMMU_S_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. Additional Information The TABLE_ fields set the attributes for access to memory through the SMMU_S_STRTAB_BASE.ADDR pointer and any accesses made to a VMS through STE.VMSPtr in a Secure STE. The QUEUE_ fields set the attributes for access to memory through SMMU_S_CMDQ_BASE.ADDR and SMMU_S_EVENTQ_BASE.ADDR pointers. When SMMU_S_IDR0.ECMDQ is 1 or SMMU_S_IDR2.RECMDQ is 1, QUEUE_ fields set the attributes for access to memory through SMMU_S_ECMDQ_BASEn.ADDR pointers. Cache allocation hints are present in each BASE register and are IGNORED unless a cacheable type is used for the table or queue to which the register corresponds. The transient attribute is IMPLEMENTATION DEFINED for each BASE register. See section 13.1.2 Attribute support. Use of an unsupported memory type for structure or queue access might cause the access to be treated as an external abort. For example, in the case of SMMU_S_STRTAB_BASE, a F_STE_FETCH fault is raised. Accessing SMMU_S_CR1 The fields in this register are guarded by various queue and table enable bits. See sections 6.3.11.1 TABLE attributes and 6.3.11.2 QUEUE_* attributes. Accesses to this register use the following encodings: Accessible at offset 0x8028 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 563

Chapter 6. Memory map and registers 6.3. Register formats 6.3.79 SMMU_S_CR2 The SMMU_S_CR2 characteristics are: Purpose Secure SMMU programming interface control and configuration register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CR2 are RES0. Attributes SMMU_S_CR2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 3 PTM 2 1 E2H 0 RECINVSID Bits [31:3] Reserved, RES0. PTM, bit [2] When SMMU_IDR0.BTM == 1: Private TLB Maintenance. PTM Meaning 0b0 The SMMU participates in broadcast TLB maintenance, if implemented. 0b1 The SMMU is not required to invalidate any local TLB entries on receipt of broadcast TLB maintenance operations for Secure EL1, Secure EL2, Secure EL2-E2H or EL3 translation regimes. • Broadcast invalidation for Non-secure EL1, Non-secure EL2 or Non-secure EL2-E2H translation regimes are not affected by this flag, see SMMU_CR2.PTM. • Arm recommends that this field resets to 1, but software cannot rely on this value. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Otherwise: Reserved, RES0. RECINVSID, bit [1] Record event C_BAD_STREAMID from invalid input StreamIDs. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 564

Chapter 6. Memory map and registers 6.3. Register formats RECINVSID Meaning 0b0 C_BAD_STREAMID events are not recorded for the Secure programming interface. 0b1 C_BAD_STREAMID events are permitted to be recorded for the Secure programming interface. The reset behavior of this field is: • This field resets to an UNKNOWN value. E2H, bit [0] When SMMU_S_IDR1.SEL2 == 1: Enable Secure EL2-E2H translation regime. E2H Meaning 0b0 Secure EL2 translation regime used, without ASID. 0b1 Secure EL2-E2H translation regime used, with ASID. • This field affects the STE.STRW encoding 0b10, which selects a hypervisor translation regime for the resulting translations. The translations are tagged without ASID in EL2 mode, or with ASID in EL2-E2H mode. Note: Arm expects software to set this bit to match the Secure HCR_EL2.E2H in host PEs. • This bit is permitted to be cached in configuration caches and TLBs. Changes to this bit must be accompanied by invalidation of configuration and translations associated with streams configured with StreamWorld == S-EL2 or S-EL2-E2H. • This bit affects the StreamWorld of Secure streams only. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Accessing SMMU_S_CR2 This register is made read-only when the SMMU_S_CR0.SMMUEN is Updated to 1. This register must only be changed when SMMU_S_CR0.SMMUEN == 0. A write to this register after SMMU_S_CR0.SMMUEN has been changed before its Update completes is CON- STRAINED UNPREDICTABLE and has one of the following behaviors: • Apply the new value. • Ignore the write. When this register is changed, the new value takes effect (affects SMMU behavior corresponding to the field changed) at an UNPREDICTABLE time, bounded by a subsequent Update to SMMUEN to 1. As a side effect of SMMUEN completing Update to 1, a prior change to this register is guaranteed to have taken effect. Accesses to this register use the following encodings: Accessible at offset 0x802C from SMMUv3_PAGE_0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 565

Chapter 6. Memory map and registers 6.3. Register formats • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_CR0.SMMUEN == ‘0’ and SMMU_S_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 566

Chapter 6. Memory map and registers 6.3. Register formats 6.3.80 SMMU_S_S2PII The SMMU_S_S2PII characteristics are: Purpose Configuration of stage 2 permission indirection interpretation in Secure state for Secure and Non-secure IPA spaces. Configuration This register is present only when SMMU_IDR3.S2PI == 1. Otherwise, direct accesses to SMMU_S_S2PII are RES0. Attributes SMMU_S_S2PII is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions S2PII15 63 60 S2PII14 59 56 S2PII13 55 52 S2PII12 51 48 S2PII11 47 44 S2PII10 43 40 S2PII9 39 36 S2PII8 35 32 S2PII7 31 28 S2PII6 27 24 S2PII5 23 20 S2PII4 19 16 S2PII3 15 12 S2PII2 11 8 S2PII1 7 4 S2PII0 3 0 S2PII

, bits [4p+3:4p], for p = 15 to 0 The set of 16 stage 2 base permission interpretations. This field is indexed by the PIIndex value derived from a stage 2 Block or Page descriptor, as S2PII[PIIndex4+3 : PIIndex4], to give a permission interpretation. S2PII

Meaning 0b0000 No Access 0b0001 Reserved, treated as No Access 0b0010 MRO 0b0011 MRO-TL1 0b0100 WO 0b0101 Reserved, treated as No Access 0b0110 MRO-TL0 0b0111 MRO-TL01 0b1000 RO 0b1001 RO+uX 0b1010 RO+pX 0b1011 RO+puX 0b1100 RW 0b1101 RW+uX ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 567

Chapter 6. Memory map and registers 6.3. Register formats S2PII

Meaning 0b1110 RW+pX 0b1111 RW+puX This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_S2PII Arm strongly recommends that this register is not written if SMMUEN is 1 and there are any STEs for which STE.S2PIE is 1. Accesses to this register use the following encodings: Accessible at offset 0x8030 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 568

Chapter 6. Memory map and registers 6.3. Register formats 6.3.81 SMMU_S_INIT The SMMU_S_INIT characteristics are: Purpose Provides controls for the invalidation of all cache and TLB contents. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_INIT are RES0. Attributes SMMU_S_INIT is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 0 INV_ALL Bits [31:1] Reserved, RES0. INV_ALL, bit [0] Invalidate all cache and TLB contents. • For writes: – 0b0: If INV_ALL == 0, ignored. – 0b1: SMMU-global invalidation is performed for all configuration caches and TLBs for all translation regimes and Security states. • For reads: – 0b0: There is no outstanding global invalidation operation. – 0b1: There is an outstanding global invalidation operation. • Note: This field can be used to simplify Secure software that otherwise makes no use of the SMMU but must safely initialize the SMMU for use by Non-secure software. See section 3.11 Reset, Enable and initialization. • Note: When SMMU_S_IDR1.SECURE_IMPL == 1, but no Secure software exists, Arm strongly recommends this register is exposed for use by Non-secure initialization software. • Note: If the system provides an IMPLEMENTATION DEFINED mechanism that allows Non-secure software to access this register, Secure software is expected to disable this mechanism after the SMMU is initialized. If SMMU_ROOT_IDR0.REALM_IMPL == 1, then SMMU_S_INIT.INV_ALL has no effect if SMMU_ROOT_CR0.GPCEN == 1, and it is Root firmware’s responsibility to write to INV_ALL before enabling granule protection checks. If SMMU_IDR6.DCMDQ == 1, then SMMU_S_INIT.INV_ALL also invalidates any caches used for SID translation. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 569

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Additional Information When observing the conditions in this section, a write of INV_ALL to 1 causes an invalidation of all cache and TLB entries that are present before the write and on completion of the invalidation the SMMU resets INV_ALL to 0, including when an invalidation operation was already underway before the write. Note: If the conditions regarding SMMUEN are observed correctly, a write of 1 to INV_ALL is guaranteed to invalidate the SMMU caches and reset INV_ALL to 0 when complete. The completion of an INV_ALL invalidation is not required to depend on the completion of any outstanding transactions. An INV_ALL invalidation operation affects locked configuration cache and locked TLB entries, if an implementation supports locking of cache entries. Note: As GPT information is permitted to be cached in a TLB, an INV_ALL operation also invalidates all GPT information cached in TLBs if SMMU_IDR0.RME_IMPL == 1. If SMMU_IDR0.RME_IMPL == 0 then an INV_ALL operation is not guaranteed to invalidate any cached GPT information from TLBs. Accessing SMMU_S_INIT SMMU_S_INIT.INV_ALL has no effect if SMMU_ROOT_CR0.GPCEN == 1. If SMMU_ROOT_CR0.GPCEN == 0, a write of 1 to INV_ALL when any SMMU_(*_)CR0.SMMUEN == 1, or an Update of any SMMUEN to 1 is in progress, or SMMU_ROOT_CR0.ACCESSEN == 1, or an Update of ACCESSEN to 1 is in progress, is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The write is IGNORED. • The invalidation operation occurs and completes, with INV_ALL reset to 0 on completion. An Update of SMMUEN to 1 while an INV_ALL invalidation operation is underway has a CONSTRAINED UNPREDICTABLE effect on the invalidation operation and has one of the following behaviors: • The invalidation operation completes successfully, with INV_ALL reset to 0 after completion. • The invalidation operation might not affect any cache or TLB entries, and INV_ALL is reset to 0 by the SMMU. After INV_ALL is written to 1, a write of 0 before the invalidation operation is observed to have completed is CONSTRAINED UNPREDICTABLE and has one of the following behaviors: • The invalidation operation does not take place. • The invalidation operation completes successfully but it cannot be determined when this completion occurs. Note: It is Root firmware’s responsibility to write to INV_ALL before enabling SMMU_ROOT_CR0.{ACCESSEN, GPCEN}. Accesses to this register use the following encodings: Accessible at offset 0x803C from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 570

Chapter 6. Memory map and registers 6.3. Register formats 6.3.82 SMMU_S_GBPA The SMMU_S_GBPA characteristics are: Purpose Secure Global Bypass Attributes. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GBPA are RES0. Attributes SMMU_S_GBPA is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 21 20 19 18 17 16 NSCFG 15 14 SHCFG 13 12 ALLOCCFG 11 8 RES0 7 5 4 MemAttr 3 0 Update ABORT PRIVCFG INSTCFG MTCFG Update, bit [31] Update completion flag, see section 6.3.15.1 Update procedure. The reset behavior of this field is: • This field resets to '0'. Bits [30:21] Reserved, RES0. ABORT, bit [20] Abort all incoming transactions. ABORT Meaning 0b0 Do not abort incoming transactions. Transactions bypass the SMMU with attributes given by other fields in this register. 0b1 Abort all incoming transactions. Note: An implementation can reset this field to 1, in order to implement a default deny policy on reset. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. INSTCFG, bits [19:18] Instruction/Data override. INSTCFG Meaning 0b00 Use incoming. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 571

Chapter 6. Memory map and registers 6.3. Register formats INSTCFG Meaning 0b01 Reserved, behaves as 0b00. 0b10 Data. 0b11 Instruction. • INSTCFG only affects reads. Writes are always output as Data. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. PRIVCFG, bits [17:16] User/Privileged override. PRIVCFG Meaning 0b00 Use incoming. 0b01 Reserved, behaves as 0b00. 0b10 Unprivileged. 0b11 Privileged. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. NSCFG, bits [15:14] NS attribute override. NSCFG Meaning 0b00 Use incoming. 0b01 Reserved, behaves as 0b00. 0b10 Secure. 0b11 Non-secure. • If SMMU_IDR1.ATTR_PERMS_OVR == 0 NSCFG is fixed as Use incoming and it is IMPLEMENTA- TION SPECIFIC whether this field reads as zero or a previously written value. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. SHCFG, bits [13:12] Shareability override. SHCFG Meaning 0b00 Non-shareable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 572

Chapter 6. Memory map and registers 6.3. Register formats SHCFG Meaning 0b01 Use incoming. 0b10 Outer Shareable. 0b11 Inner Shareable. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. ALLOCCFG, bits [11:8] Allocation configuration • 0b0xxx use incoming RA/WA/TR allocation/transient hints. • 0b1RWT Hints are overridden to given values: – Read Allocate == R. – Write Allocate == W. – Transient == T. • When overridden by this field, for each of RA, WA, and TR, both inner- and outer- hints are set to the same value. Because it is not architecturally possible to express hints for types that are Device or Normal Non-cacheable, this field has no effect on memory types that are not Normal-WB or Normal-WT, whether such types are provided with a transaction or overridden using MTCFG/MemAttr. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Bits [7:5] Reserved, RES0. MTCFG, bit [4] Memory type override. MTCFG Meaning 0b0 Use incoming memory type. 0b1 Override incoming memory type using MemAttr field. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. MemAttr, bits [3:0] Memory type. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 573

Chapter 6. Memory map and registers 6.3. Register formats Additional Information This register controls the Secure global bypass attributes used for transactions from Secure StreamIDs when SMMU_S_CR0.SMMUEN == 0. Transactions passing through the SMMU when it is disabled might have their attributes overridden or assigned using this register. Accessing SMMU_S_GBPA Accesses to this register use the following encodings: Accessible at offset 0x8044 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GBPA.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 574

Chapter 6. Memory map and registers 6.3. Register formats 6.3.83 SMMU_S_AGBPA The SMMU_S_AGBPA characteristics are: Purpose Secure Alternate Global ByPass Attribute. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_AGBPA are RES0. Attributes SMMU_S_AGBPA is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions IMPLEMENTATION DEFINED 31 0 IMPLEMENTATION DEFINED, bits [31:0] IMPLEMENTATION DEFINED attributes to assign. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Additional Information • This register allows an implementation to apply an additional non-architected attributes or tag to bypassing transactions. • If this field is unsupported by an implementation, it is RES0. • Note: Arm does not recommend that this register further modifies existing architected bypass attributes. The process used to change contents of this register in relation to SMMU_S_GBPA. Update is IMPLE- MENTATION DEFINED. Accessing SMMU_S_AGBPA Accesses to this register use the following encodings: Accessible at offset 0x8048 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 575

Chapter 6. Memory map and registers 6.3. Register formats 6.3.84 SMMU_S_IRQ_CTRL The SMMU_S_IRQ_CTRL characteristics are: Purpose Secure interrupt control and configuration register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IRQ_CTRL are RES0. Attributes SMMU_S_IRQ_CTRL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN RES0 EVENTQ_IRQEN This register is similar to SMMU_IRQ_CTRL, but controls interrupts from the Secure programming interface. It relates to SMMU_S_IRQ_CTRLACK in the same way that SMMU_IRQ_CTRL relates to SMMU_IRQ_CTRLACK. Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_S_IDR3.HACDBS == 1: Secure state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing for Secure state are disabled. 0b1 Interrupts related to the completion of HACDBS processing for Secure state are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_S_IDR3.HDBSS == 1: Secure state HDBSS interrupt enable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 576

Chapter 6. Memory map and registers 6.3. Register formats HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Secure state HDBSS table are disabled. 0b1 Interrupts related to a full Secure state HDBSS table are enabled. Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Secure Event queue interrupt enable. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Secure Event queue are disabled. 0b1 Interrupts from the Secure Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. GERROR_IRQEN, bit [0] Secure GERROR interrupt enable. GERROR_IRQEN Meaning 0b0 Interrupts from Secure Global errors are disabled. 0b1 Interrupts from Secure Global errors are enabled. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_S_IRQ_CTRL Accesses to this register use the following encodings: Accessible at offset 0x8050 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 577

Chapter 6. Memory map and registers 6.3. Register formats 6.3.85 SMMU_S_IRQ_CTRLACK The SMMU_S_IRQ_CTRLACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls of interrupts in SMMU_S_IRQ_CTRL. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_IRQ_CTRLACK are RES0. Attributes SMMU_S_IRQ_CTRLACK is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN RES0 EVENTQ_IRQEN Undefined bits read as zero. Fields in this register are RAZ if the corresponding SMMU_S_IRQ_CTRL field is Reserved. Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_S_IDR3.HACDBS == 1: Secure state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing for Secure state are disabled. 0b1 Interrupts related to the completion of HACDBS processing for Secure state are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_S_IDR3.HDBSS == 1: Secure state HDBSS interrupt enable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 578

Chapter 6. Memory map and registers 6.3. Register formats HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Secure state HDBSS table are disabled. 0b1 Interrupts related to a full Secure state HDBSS table are enabled. Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Secure Event queue interrupt enable. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Secure Event Queue are disabled. 0b1 Interrupts from the Secure Event Queue are enabled. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. GERROR_IRQEN, bit [0] Secure GERROR interrupt enable. GERROR_IRQEN Meaning 0b0 Interrupts from Secure Global errors are disabled. 0b1 Interrupts from Secure Global errors are enabled. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_S_IRQ_CTRLACK Accesses to this register use the following encodings: Accessible at offset 0x8054 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 579

Chapter 6. Memory map and registers 6.3. Register formats 6.3.86 SMMU_S_GERROR The SMMU_S_GERROR characteristics are: Purpose Reporting of Secure Global Error conditions. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GERROR are RES0. Attributes SMMU_S_GERROR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR RES0 CMDQP_ERR SFM_ERR CMDQ_ER R RES0 EVENTQ_ABT_ER R RES0 MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR RES0 MSI_GERROR_ABT_ERR See SMMU_GERROR for information on GERROR behavior. This register provides a similar facility to SMMU_GERROR, except for errors relating to the Secure programming interface. This register, in conjunction with SMMU_S_GERRORN, indicates whether global error conditions exist. See section 7.5 Global error recording. An error is active if the value of SMMU_S_GERROR[x] is different to the corresponding SMMU_S_GERRORN[x] bit. The SMMU toggles SMMU_S_GERROR[x] when an error becomes active. An external agent acknowledges the error by toggling the corresponding SMMU_S_GERRORN[x], making the GERRORN[x] bit the same value as the corresponding GERROR[x] bit. Acknowledging an error deactivates the error, allowing a new occurrence to be reported at a later time, however: • SFM_ERR indicates that Service failure mode has been entered. Acknowledging this GERROR bit does not exit Service failure mode which remains active and is resolved in an IMPLEMENTATION DEFINED way. The SMMU does not toggle a bit when an error is already active. An error is only activated if it is in an inactive state. Note: Software is not intended to trigger interrupts by arranging for GERRORN[x] to differ from GERROR[x]. See section SMMU_GERRORN. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 580

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_S_IDR6.DCMDQ == 1: Secure state error on a DCMDQ control page. When this bit is different to SMMU_S_GERRORN.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. Otherwise: Reserved, RES0. MSI_HACDBS_ABT_ERR, bit [14] When SMMU_S_IDR3.HACDBS == 1 and SMMU_S_IDR0.MSI == 1: Secure state HACDBS processing completed MSI abort. When this bit is different from SMMU_S_GERRORN.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_S_IDR3.HACDBS == 1: Secure state HACDBS error. When this bit is different from SMMU_S_GERRORN.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_S_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_S_IDR3.HDBSS == 1 and SMMU_S_IDR0.MSI == 1: Secure state HDBSS table full MSI abort. When this bit is different from SMMU_S_GERRORN.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_S_IDR3.HDBSS == 1: Secure state HDBSS update error. When this bit is different from SMMU_S_GERRORN.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_S_HDBSS_PRODn.ERR_REASON. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 581

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [10] Reserved, RES0. CMDQP_ERR, bit [9] When SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1: When this bit is different to SMMU_S_GERRORN.CMDQP_ERR, it indicates that one or more errors have been encountered on a Secure Command queue control page interface. See section 3.5.6.3 Errors relating to an ECMDQ interface. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SFM_ERR, bit [8] • When this bit is different to SMMU_S_GERRORN[8], the SMMU has entered Service failure mode. – Traffic through the SMMU has stopped. The SMMU has stopped processing commands and recording events. The RAS registers describe the error. – Acknowledgement of this error through GERRORN does not clear the Service failure mode error, which is cleared in an IMPLEMENTATION DEFINED way. See Section 12.3 Service Failure Mode (SFM). • SFM triggers SFM_ERR in SMMU_GERROR, and when SMMU_S_IDR1.SECURE_IMPL == 1 in SMMU_S_GERROR. The reset behavior of this field is: • This field resets to '0'. MSI_GERROR_ABT_ERR, bit [7] When SMMU_S_IDR0.MSI == 1: • When this bit is different to SMMU_S_GERRORN[7], a Secure GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [6] Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_S_IDR0.MSI == 1: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 582

Chapter 6. Memory map and registers 6.3. Register formats • When this bit is different to SMMU_S_GERRORN[5], a Secure Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_S_IDR0.MSI == 1: • When this bit is different to SMMU_S_GERRORN[4], a Secure CMD_SYNC MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [3] Reserved, RES0. EVENTQ_ABT_ERR, bit [2] • When this bit is different to SMMU_S_GERRORN[2], an access to the Secure Event queue was terminated with abort. – Event records might have been lost. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. CMDQ_ERR, bit [0] • When this bit is different to SMMU_S_GERRORN[0], a command has been encountered that cannot be processed on the Secure Command queue. – SMMU_S_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. • Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_S_GERROR Accesses to this register use the following encodings: Accessible at offset 0x8060 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 583

Chapter 6. Memory map and registers 6.3. Register formats 6.3.87 SMMU_S_GERRORN The SMMU_S_GERRORN characteristics are: Purpose Acknowledgement of Secure Global Error conditions. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GERRORN are RES0. Attributes SMMU_S_GERRORN is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR RES0 CMDQP_ERR SFM_ERR CMDQ_ER R RES0 EVENTQ_ABT_ER R RES0 MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR RES0 MSI_GERROR_ABT_ERR Software must not toggle fields in this register that correspond to errors that are inactive. It is CONSTRAINED UNPREDICTABLE whether or not an SMMU activates errors if this is done. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] When SMMU_S_IDR6.DCMDQ == 1: Secure state error on a DCMDQ control page. When this bit is different to SMMU_S_GERROR.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. The status of SMMU_S_GERROR.DCMDQP_ERR and SMMU_S_GERRORN.DCMDQP_ERR does not affect command consumption on a DCMDQ: command consumption on the erroneous queue restarts once the error has been acknowledged, either by the guest via the SMMU_S_DCMDQ_PRODn.ERRACK register field or by the hypervisor via the SMMU_S_ECMDQ_PRODn.HS_ERRACK register field, depending on the error type. Errors on a DCMDQ are always reported and acknowledged through SMMU_S_GERROR.DCMDQP_ERR and SMMU_S_GERRORN.DCMDQP_ERR respectively. SMMU_S_GERROR.CMDQP_ERR and SMMU_S_GERRORN.CMDQP_ERR are only used to report and acknowledge errors on an ECMDQ which is not in direct-mode. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 584

Chapter 6. Memory map and registers 6.3. Register formats MSI_HACDBS_ABT_ERR, bit [14] When SMMU_S_IDR3.HACDBS == 1 and SMMU_S_IDR0.MSI == 1: Secure state HACDBS processing completed MSI abort. When this bit is different from SMMU_S_GERROR.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_S_IDR3.HACDBS == 1: Secure state HACDBS error. When this bit is different from SMMU_GERROR.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_S_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_S_IDR3.HDBSS == 1 and SMMU_S_IDR0.MSI == 1: Secure state HDBSS table full MSI abort. When this bit is different from SMMU_S_GERROR.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_S_IDR3.HDBSS == 1: Secure state HDBSS update error. When this bit is different from SMMU_S_GERROR.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_S_HDBSS_PRODn.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [10] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 585

Chapter 6. Memory map and registers 6.3. Register formats CMDQP_ERR, bit [9] When SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1: See SMMU_S_GERROR.CMDQP_ERR. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SFM_ERR, bit [8] • When this bit is different to SMMU_S_GERROR[8], the SMMU has entered Service failure mode. The reset behavior of this field is: • This field resets to '0'. MSI_GERROR_ABT_ERR, bit [7] When SMMU_S_IDR0.MSI == 1: • When this bit is different to SMMU_S_GERROR[7], a Secure GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [6] Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_S_IDR0.MSI == 1: • When this bit is different to SMMU_S_GERROR[5], a Secure Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_S_IDR0.MSI == 1: • When this bit is different to SMMU_S_GERROR[4], a Secure CMD_SYNC MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 586

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. Bit [3] Reserved, RES0. EVENTQ_ABT_ERR, bit [2] • When this bit is different to SMMU_S_GERROR[2], an access to the Secure Event queue was terminated with abort. – Event records might have been lost. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. CMDQ_ERR, bit [0] • When this bit is different to SMMU_S_GERROR[0], a command has been encountered that cannot be processed on the Secure Command queue. – SMMU_S_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. – Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Additional Information Fields that are RES0 in SMMU_S_GERROR are also RES0 in this register. Accessing SMMU_S_GERRORN Accesses to this register use the following encodings: Accessible at offset 0x8064 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 587

Chapter 6. Memory map and registers 6.3. Register formats 6.3.88 SMMU_S_GERROR_IRQ_CFG0 The SMMU_S_GERROR_IRQ_CFG0 characteristics are: Purpose Secure Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1 and SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GERROR_IRQ_CFG0 are RES0. Attributes SMMU_S_GERROR_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_S_IRQ_CTRL.GERROR_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_S_GERROR_IRQ_CFG0 SMMU_S_GERROR_IRQ_CFG0 is Guarded by SMMU_S_IRQ_CTRL.GERROR_IRQEN and must only be modified when SMMU_S_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8068 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 588

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_S_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 589

Chapter 6. Memory map and registers 6.3. Register formats 6.3.89 SMMU_S_GERROR_IRQ_CFG1 The SMMU_S_GERROR_IRQ_CFG1 characteristics are: Purpose Secure Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1 and SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GERROR_IRQ_CFG1 are RES0. Attributes SMMU_S_GERROR_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] Secure MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_GERROR_IRQ_CFG1 SMMU_S_GERROR_IRQ_CFG1 is Guarded by SMMU_S_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_S_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8070 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 590

Chapter 6. Memory map and registers 6.3. Register formats 6.3.90 SMMU_S_GERROR_IRQ_CFG2 The SMMU_S_GERROR_IRQ_CFG2 characteristics are: Purpose Secure Global Error interrupt configuration register. Configuration This register is present only when SMMU_IDR0.MSI == 1 and SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_GERROR_IRQ_CFG2 are RES0. Attributes SMMU_S_GERROR_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 591

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_GERROR_IRQ_CFG2 SMMU_S_GERROR_IRQ_CFG2 is Guarded by SMMU_S_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_S_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8074 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 592

Chapter 6. Memory map and registers 6.3. Register formats 6.3.91 SMMU_S_STRTAB_BASE The SMMU_S_STRTAB_BASE characteristics are: Purpose Stream Table Base address register in Secure state. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_STRTAB_BASE are RES0. Attributes SMMU_S_STRTAB_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:6] 55 32 RES0 ADDR[55:6] 31 6 RES0 5 0 Access attributes of the Stream table are set using the SMMU_S_CR1.TABLE_* fields, a Read-Allocate hint is provided for Stream table accesses with the RA field. Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:6] Physical address of Stream table base, bits [55:6]. Address bits above and below this field range are implied as zero. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 593

Chapter 6. Memory map and registers 6.3. Register formats Note: An implementation is not required to store these bits. When a Linear Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b00, the effective base address is aligned by the SMMU to the table size, ignoring the least-significant bits in the ADDR range as required to do so: ADDR[LOG2SIZE + 5:0] = 0. When a 2-level Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b01, the effective base address is aligned by the SMMU to the larger of 64 bytes or the first-level table size: ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0. The alignment of ADDR is affected by the literal value of the respective SMMU_STRTAB_BASE_CFG.LOG2SIZE field and is not limited by SIDSIZE. Note: This means that configuring a table that is larger than required by the incoming StreamID span results in some entries being unreachable, but the table is still aligned to the configured size. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. Accessing SMMU_S_STRTAB_BASE This register is Guarded by SMMU_S_CR0.SMMUEN and must only be written when SMMU_S_CR0.SMMUEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x8080 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_S_CR0.SMMUEN == ‘0’ and SMMU_S_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 594

Chapter 6. Memory map and registers 6.3. Register formats 6.3.92 SMMU_S_STRTAB_BASE_CFG The SMMU_S_STRTAB_BASE_CFG characteristics are: Purpose Configuration of Secure Stream table. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_STRTAB_BASE_CFG are RES0. Attributes SMMU_S_STRTAB_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 18 FMT 17 16 RES0 15 11 SPLIT 10 6 LOG2SIZE 5 0 Bits [31:18] Reserved, RES0. FMT, bits [17:16] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Format of Stream table. FMT Meaning 0b00 Linear - ADDR points to an array of STEs. 0b01 2-level - ADDR points to an array of Level 1 Stream Table Descriptors. Other values are reserved, behave as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [15:11] Reserved, RES0. SPLIT, bits [10:6] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: StreamID split point for multi-level table. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 595

Chapter 6. Memory map and registers 6.3. Register formats SPLIT Meaning 0b00110 6 bits - 4KB leaf tables. 0b01000 8 bits - 16KB leaf tables. 0b01010 10 bits - 64KB leaf tables. This field determines the split point of a 2-level Stream table, selected by the number of bits at the bottom level. This field is IGNORED if FMT == 0b00. Other values are reserved, behave as 0b0110. The upper-level L1STD is located using StreamID[LOG2SIZE - 1:SPLIT] and this indicates the lowest-level table which is indexed by StreamID[SPLIT - 1:0]. For example, selecting SPLIT == 6 (0b0110) causes StreamID[5:0] to be used to index the lowest level Stream table and StreamID[LOG2SIZE - 1:6] to index the upper level table. Note: If SPLIT >= LOG2SIZE, a single upper-level descriptor indicates one bottom-level Stream table with 2LOG2SIZE usable entries. The L1STD.Span value’s valid range is up to SPLIT + 1, but not all of this Span is accessible, as it is not possible to use a StreamID >= 2LOG2SIZE. Note: Arm recommends that a Linear table, FMT == 0b00, is used instead of programming SPLIT >= LOG2SIZE. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. LOG2SIZE, bits [5:0] Table size as log2(entries). The maximum StreamID value that can be used to index into the Stream table is 2LOG2SIZE - 1. The StreamID range is equal to the number of STEs in a linear Stream table or the maximum sum of the STEs in all second-level tables. The number of L1STDs in the upper level of a 2-level table is MAX(1, 2LOG2SIZE-SPLIT). Except for readback of a written value, the effective LOG2SIZE is MIN(LOG2SIZE, SMMU_IDR1.SIDSIZE) for the purposes of input StreamID range checking and upper/lower/linear Stream table index address calculation. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information A transaction having a StreamID >= 2LOG2SIZE is out of range. Such a transaction is terminated with abort and a C_BAD_STREAMID event is recorded if permitted by SMMU_CR2.RECINVSID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 596

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_STRTAB_BASE_CFG This register is Guarded by SMMU_S_CR0.SMMUEN and must only be written when SMMU_S_CR0.SMMUEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x8088 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_S_CR0.SMMUEN == ‘0’ and SMMU_S_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 597

Chapter 6. Memory map and registers 6.3. Register formats 6.3.93 SMMU_S_CMDQ_BASE The SMMU_S_CMDQ_BASE characteristics are: Purpose Configuration of the Secure Command queue base address. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CMDQ_BASE are RES0. Attributes SMMU_S_CMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Read Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Physical address of Secure Command queue base, bits [55:5]. • Address bits above and below this field range are implied as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 598

Chapter 6. Memory map and registers 6.3. Register formats • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. – Note: For example, a queue with 28 entries is 4096 bytes in size so software must align an allocation, and therefore ADDR, to a 4KB boundary. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS. Except for the purposes of readback of this register, any use of this field’s value is capped at the maximum, SMMU_IDR1.CMDQS. The minimum size is 0, for one entry, but this must be aligned to a 32-byte (2 entry) boundary as above. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information Upon initialization, if SMMU_IDR1.QUEUES_PRESET == 0 then the SMMU_S_CMDQ_BASE.LOG2SIZE field might affect which bits of SMMU_S_CMDQ_CONS.RD and SMMU_S_CMDQ_PROD.WR can be written upon initialization. The registers must be initialized in this order: 1. Write SMMU_S_CMDQ_BASE to set the queue base and size. 2. Write initial values to SMMU_S_CMDQ_CONS and SMMU_S_CMDQ_PROD. 3. Enable the queue with an Update of the respective SMMU_S_CR0.CMDQEN to 1. This also applies to the initialization of Secure Event queue registers. Access attributes of the Secure Command queue are set using the SMMU_S_CR1.QUEUE_* fields. A Read-Allocate hint is provided for Secure Command queue accesses with the RA field. Accessing SMMU_S_CMDQ_BASE This register is Guarded by SMMU_S_CR0.CMDQEN and must only be modified when SMMU_S_CR0.CMDQEN == 0. See SMMU_CMDQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8090 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_S_CR0.CMDQEN == ‘0’ and SMMU_S_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 599

Chapter 6. Memory map and registers 6.3. Register formats 6.3.94 SMMU_S_CMDQ_PROD The SMMU_S_CMDQ_PROD characteristics are: Purpose Allows Command queue producer to update the Secure write index. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CMDQ_PROD are RES0. Attributes SMMU_S_CMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 20 WR 19 0 Bits [31:20] Reserved, RES0. WR, bits [19:0] Secure Command queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Secure Command queue write index wrap flag. Bits [QS-1:0]: WR - Secure Command queue write index. • Updated by the host PE (producer) indicating the next empty space in the queue after the new data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_S_CMDQ_BASE.LOG2SIZE, see SMMU_S_CMDQ_CONS. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.CMDQS < 19, bits [19:CMDQS + 1] are UNKNOWN on read. If QS == 0 the queue has one entry: zero bits of WR index are present and WR_WRAP is bit zero. When software increments WR, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and WR_WRAP toggled. Note: In the limit case of a one-entry queue, an increment of WR consists solely of a toggle of WR_WRAP. There is space in the queue for additional commands if: SMMU_S_CMDQ_CONS.RD != SMMU_S_CMDQ_PROD.WR || SMMU_S_CMDQ_CONS.RD_WRAP == SMMU_S_CMDQ_PROD.WR_WRAP ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 600

Chapter 6. Memory map and registers 6.3. Register formats The value written to this register must only move the pointer in a manner consistent with adding N consecutive entries to the command queue, updating WR_WRAP when appropriate. When SMMU_S_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_S_CR0.CMDQEN is transitioned from 0 to 1. A write to this register causes the SMMU to consider the Command queue for processing if SMMU_S_CR0.CMDQEN == 1 and SMMU_S_GERROR.CMDQ_ERR is not active. Accessing SMMU_S_CMDQ_PROD Accesses to this register use the following encodings: Accessible at offset 0x8098 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 601

Chapter 6. Memory map and registers 6.3. Register formats 6.3.95 SMMU_S_CMDQ_CONS The SMMU_S_CMDQ_CONS characteristics are: Purpose Secure Command queue consumer read index. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_CMDQ_CONS are RES0. Attributes SMMU_S_CMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 ERR 30 24 RES0 23 20 RD 19 0 RES0 Bit [31] Reserved, RES0. ERR, bits [30:24] Error reason code. • When a command execution error is detected, ERR is set to a reason code and then the SMMU_S_GERROR.CMDQ_ERR global error becomes active. • The value in this field is UNKNOWN when the CMDQ_ERR global error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [23:20] Reserved, RES0. RD, bits [19:0] Secure Queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Queue read index wrap flag. Bits [QS-1:0]: RD - Queue read index. • Updated by the SMMU (consumer) to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_S_CMDQ_BASE.LOG2SIZE and SMMU_S_CMDQ_BASE.LOG2SIZE <= SMMU_IDR1.CMDQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 602

Chapter 6. Memory map and registers 6.3. Register formats If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the RD index is always wrapped to the current queue size given by SMMU_S_CMDQ_BASE.LOG2SIZE. If QS == 0 the queue has one entry: zero bits of RD index are present and RD_WRAP is bit zero. When SMMU_S_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of this register’s bits that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_S_CR0.CMDQEN is transitioned from 0 to 1. Upon a write to this register, when SMMU_S_CR0.CMDQEN == 0, the ERR field is permitted to either take the written value or ignore the written value. Note: There is no requirement for the SMMU to update this value after every command consumed, it might be updated only after an IMPLEMENTATION SPECIFIC number of commands have been consumed. However, an SMMU must ultimately update RD in finite time to indicate free space to software. When a command execution error is detected, ERR is set to a reason code and then the respective SMMU_S_GERROR.CMDQ_ERR error becomes active. RD remains pointing at the infringing command for debug. The SMMU resumes processing commands after the CMDQ_ERR error is acknowledged, if the Secure Command queue is enabled at that time. SMMU_S_GERROR.CMDQ_ERR has no other interaction with SMMU_S_CR0.CMDQEN than that a Secure Command queue error can only be detected when the queue is enabled and therefore consuming commands. A change to CMDQEN does not affect, or acknowledge, SMMU_S_GERROR.CMDQ_ERR which must be explicitly acknowledged. See section 7.1 Command queue errors. Accessing SMMU_S_CMDQ_CONS This register is Guarded by SMMU_S_CR0.CMDQEN and must only be modified when SMMU_S_CR0.CMDQEN == 0. See SMMU_CMDQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x809C from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_CR0.CMDQEN == ‘0’ and SMMU_S_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 603

Chapter 6. Memory map and registers 6.3. Register formats 6.3.96 SMMU_S_EVENTQ_BASE The SMMU_S_EVENTQ_BASE characteristics are: Purpose Secure Event queue base address register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_BASE are RES0. Attributes SMMU_S_EVENTQ_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 WA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. WA, bit [62] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Physical address of Secure Event queue base, bits [55:5]. • Address bits above and below this field range are treated as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 604

Chapter 6. Memory map and registers 6.3. Register formats • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE is less than or equal to SMMU_IDR1.EVENTQS. Except for the purposes of readback of this register, any use of the value of this field is capped at the maximum, SMMU_IDR1.EVENTQS. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information See SMMU_S_CMDQ_BASE for initialization order with respect to the PROD and CONS registers. Events destined for an Event queue (for the appropriate Security state, if supported) are delivered into the queue if SMMU_S_CR0.EVENTQEN == 1 and the queue is writable. If SMMU_S_CR0.EVENTQEN == 0, no events are delivered into the queue. See section 7.2 Event queue recorded faults and events, some events might be lost in these situations. Access attributes of the Secure Event queue are set using the SMMU_S_CR1.QUEUE_* fields. A Write-Allocate hint is provided for Secure Event queue accesses with the WA field. Accessing SMMU_S_EVENTQ_BASE SMMU_S_EVENTQ_BASE is Guarded by SMMU_S_CR0.EVENTQEN and must only be modified when EVENTQEN == 0. See SMMU_EVENTQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x80A0 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_S_CR0.EVENTQEN == ‘0’ and SMMU_S_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 605

Chapter 6. Memory map and registers 6.3. Register formats 6.3.97 SMMU_S_EVENTQ_PROD The SMMU_S_EVENTQ_PROD characteristics are: Purpose Secure Event queue producer write index. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_PROD are RES0. Attributes SMMU_S_EVENTQ_PROD is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 20 WR 19 0 OVFLG OVFLG, bit [31] Secure Event queue overflowed. • A Secure Event queue overflow is indicated using this flag. This flag is toggled by the SMMU when a queue overflow is detected, if OVFLG == SMMU_S_EVENTQ_CONS.OVACKFLG. • This flag will not be updated until a prior overflow is acknowledged by setting SMMU_S_EVENTQ_CONS.OVACKFLG equal to OVFLG. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. WR, bits [19:0] Secure Event queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Queue write index wrap flag. Bits [QS-1:0]: WR - Queue write index. This field indicates the next space to be written by the SMMU. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_S_EVENTQ_BASE.LOG2SIZE, see SMMU_S_EVENTQ_CONS. If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the WR index is always wrapped to the current queue size given by QS. If QS == 0 the queue has one entry: zero bits of WR index are present and WR_WRAP is bit zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 606

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_S_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_S_CR0.EVENTQEN is transitioned from 0 to 1. Note: See section 7.4 Event queue overflow for details on queue overflow. An overflow condition is entered when a record has been discarded due to a full enabled Secure Event queue. The following conditions do not cause an overflow condition: • Event records discarded when the Secure Event queue is disabled, that is when SMMU_S_CR0.EVENTQEN == 0. • A stalled faulting transaction, as stall event records do not get discarded when the queue is full or disabled. Accessing SMMU_S_EVENTQ_PROD This register is Guarded by SMMU_S_CR0.EVENTQEN and must only be modified when SMMU_S_CR0.EVENTQEN == 0. See SMMU_EVENTQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x80A8 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_CR0.EVENTQEN == ‘0’ and SMMU_S_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 607

Chapter 6. Memory map and registers 6.3. Register formats 6.3.98 SMMU_S_EVENTQ_CONS The SMMU_S_EVENTQ_CONS characteristics are: Purpose Secure Event queue consumer read index. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_CONS are RES0. Attributes SMMU_S_EVENTQ_CONS is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 20 RD 19 0 OVACKFLG OVACKFLG, bit [31] Overflow acknowledge flag. • Software must set this flag to the value of SMMU_S_EVENTQ_PROD.OVFLG when it is safe for the SMMU to report a future Event queue overflow. Arm recommends that this is be done on initialization and after a previous Event queue overflow is handled by software. • See section 7.4 Event queue overflow. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. RD, bits [19:0] Secure Event queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Secure Event queue read index wrap flag. Bits [QS-1:0]: RD - Secure Event queue read index. • Updated by the PE to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_S_EVENTQ_BASE.LOG2SIZE and SMMU_S_EVENTQ_BASE.LOG2SIZE <= SMMU_IDR1.EVENTQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 608

Chapter 6. Memory map and registers 6.3. Register formats If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.EVENTQS < 19, bits [19:EVENTQS + 1] are UNKNOWN on read. If QS == 0 the queue has one entry: zero bits of RD index are present and RD_WRAP is bit zero. When software increments RD, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and RD_WRAP toggled. Arm recommends that software initializes the register to a valid value before SMMU_S_CR0.EVENTQEN is transitioned from 0 to 1. When SMMU_S_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Accessing SMMU_S_EVENTQ_CONS Accesses to this register use the following encodings: Accessible at offset 0x80AC from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 609

Chapter 6. Memory map and registers 6.3. Register formats 6.3.99 SMMU_S_EVENTQ_IRQ_CFG0 The SMMU_S_EVENTQ_IRQ_CFG0 characteristics are: Purpose Secure Event queue interrupt configuration register. Configuration This register is present only when SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_IRQ_CFG0 are RES0. Attributes SMMU_S_EVENTQ_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_S_EVENTQ_IRQ_CFG0 SMMU_S_EVENTQ_IRQ_CFG0 is Guarded by SMMU_S_IRQ_CTRL.EVENTQ_IRQEN and must only be modified when SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x80B0 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 610

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 611

Chapter 6. Memory map and registers 6.3. Register formats 6.3.100 SMMU_S_EVENTQ_IRQ_CFG1 The SMMU_S_EVENTQ_IRQ_CFG1 characteristics are: Purpose Secure Event queue interrupt configuration register. Configuration This register is present only when SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_IRQ_CFG1 are RES0. Attributes SMMU_S_EVENTQ_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_EVENTQ_IRQ_CFG1 SMMU_S_EVENTQ_IRQ_CFG1 is Guarded by SMMU_S_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x80B8 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 612

Chapter 6. Memory map and registers 6.3. Register formats 6.3.101 SMMU_S_EVENTQ_IRQ_CFG2 The SMMU_S_EVENTQ_IRQ_CFG2 characteristics are: Purpose Secure Event queue interrupt configuration register. Configuration This register is present only when SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_EVENTQ_IRQ_CFG2 are RES0. Attributes SMMU_S_EVENTQ_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded in the same way as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 613

Chapter 6. Memory map and registers 6.3. Register formats Note: The encodings of all of the SMMU_*_IRQ_CFG2 MemAttr and SH fields are the same. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. Accessing SMMU_S_EVENTQ_IRQ_CFG2 SMMU_S_EVENTQ_IRQ_CFG2 is Guarded by SMMU_S_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x80BC from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 614

Chapter 6. Memory map and registers 6.3. Register formats 6.3.102 SMMU_S_GATOS_CTRL The SMMU_S_GATOS_CTRL characteristics are: Purpose Secure Global ATOS translation control register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_S_GATOS_CTRL are RES0. Attributes SMMU_S_GATOS_CTRL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 RUN 0 Bits [31:1] Reserved, RES0. RUN, bit [0] Run ATOS translation. • Arm recommends that software writes this bit to 1 to initiate the translation operation, after initializing the ATOS_SID and ATOS_ADDR registers. • The SMMU clears the RUN flag after the translation completes and its result is visible in ATOS_PAR. • A write of 0 to this flag might change the value of the flag but has no other effect. Software must only write 0 to this flag when the flag is zero. The reset behavior of this field is: • This field resets to '0'. Additional Information See Chapter 9 Address Translation Operations for more information on the overall behavior of ATOS operations. Accessing SMMU_S_GATOS_CTRL RUN is Guarded by SMMU_S_CR0.SMMUEN and must only be set when SMMUEN == 1 and RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8100 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 615

Chapter 6. Memory map and registers 6.3. Register formats 6.3.103 SMMU_S_GATOS_SID The SMMU_S_GATOS_SID characteristics are: Purpose Secure Global ATOS StreamID register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_S_GATOS_SID are RES0. Attributes SMMU_S_GATOS_SID is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 54 53 52 SUBSTREAMID 51 32 SSEC SSID_VALID STREAMID 31 0 Bits [63:54] Reserved, RES0. SSEC, bit [53] Secure stream lookup. SSEC Meaning 0b0 Non-secure stream lookup: STREAMID field is a Non-secure StreamID. 0b1 Secure stream lookup: STREAMID field is a Secure StreamID. • Note: In SMMU_S_VATOS_SID this field is RES1 and STREAMID is a Secure StreamID. The reset behavior of this field is: • This field resets to an UNKNOWN value. SSID_VALID, bit [52] When SMMU_IDR1.SSIDSIZE != '00000': SubstreamID valid. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 616

Chapter 6. Memory map and registers 6.3. Register formats SUBSTREAMID, bits [51:32] SubstreamID of request. • If SMMU_IDR1.SSIDSIZE < 20, bits [51:32 + SMMU_IDR1.SSIDSIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID of request. • This is written with the StreamID (used to locate translations/CDs) of the request later submitted to SMMU_S_GATOS_ADDR. • If SMMU_IDR1.SID_SIZE < 32 and SMMU_S_IDR1.S_SIDSIZE < 32, bits [31:MAX(SMMU_IDR1.SID_SIZE, SMMU_S_IDR1.S_SID_SIZE)] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information Bits of SUBSTREAMID and STREAMID outside of the supported range are RES0. Accessing SMMU_S_GATOS_SID This register is Guarded by SMMU_S_GATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8108 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 617

Chapter 6. Memory map and registers 6.3. Register formats 6.3.104 SMMU_S_GATOS_ADDR The SMMU_S_GATOS_ADDR characteristics are: Purpose Secure Global ATOS translation address register. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_S_GATOS_ADDR are RES0. Attributes SMMU_S_GATOS_ADDR is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions ADDR[63:12] 63 32 ADDR[63:12] 31 12 TYPE 11 10 PnU 9 RnW 8 InD 7 6 5 NS 4 RES0 3 0 HTTUI RES0 ADDR, bits [63:12] Requested input address, bits [63:12]. The reset behavior of this field is: • This field resets to an UNKNOWN value. TYPE, bits [11:10] Request type. TYPE Meaning 0b00 Reserved. 0b01 Stage 1 (VA to IPA). 0b10 Stage 2 (IPA to PA). 0b11 Stage 1 and stage 2 (VA to PA). • Use of a Reserved value results in an INV_REQ ATOS error. The reset behavior of this field is: • This field resets to an UNKNOWN value. PnU, bit [9] Privileged or User access. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 618

Chapter 6. Memory map and registers 6.3. Register formats PnU Meaning 0b0 Unprivileged. 0b1 Privileged. The reset behavior of this field is: • This field resets to an UNKNOWN value. RnW, bit [8] Read/Write access. RnW Meaning 0b0 Write. 0b1 Read. The reset behavior of this field is: • This field resets to an UNKNOWN value. InD, bit [7] Instruction/Data access. InD Meaning 0b0 Data. 0b1 Instruction. • This bit is IGNORED if RnW == 0, and the effective InD for writes is Data. The reset behavior of this field is: • This field resets to an UNKNOWN value. HTTUI, bit [6] Inhibit hardware update of the Access flag and dirty state. HTTUI Meaning 0b0 Flag update (HTTU) might occur, where supported by the SMMU, according to the HA and HD configuration fields at stage 1 and stage 2. 0b1 HTTU is inhibited, regardless of HA and HD configuration. • The ATOS operation causes no state change. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [5] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 619

Chapter 6. Memory map and registers 6.3. Register formats NS, bit [4] When SMMU_S_IDR1.SEL2 == '1': Input NS attribute. • This bit is used in the scenario where the selected stream is Secure and one of the following applies: – The stream is configured for stage 1 and stage 2 translation and an ATOS lookup is made for stage 1 and stage 2, but stage 1 translation is bypassed due to STE.S1DSS. – The stream is configured for stage 1 and stage 2 translation and an ATOS lookup is made for stage 2 only. – The stream is configured for stage 2 translation only and an ATOS lookup is made for stage 2 only. • In these scenarios, this bit provides the IPA space determination required for a Secure stage 2 translation. • This bit is ignored when stage 2 translation is not performed or when stage 1 translation is performed. • Note: When stage 1 translation is performed, the IPA space determination provided to stage 2 comes from stage 1 translation tables. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [3:0] Reserved, RES0. Accessing SMMU_S_GATOS_ADDR This register is Guarded by SMMU_S_GATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8110 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 620

Chapter 6. Memory map and registers 6.3. Register formats 6.3.105 SMMU_S_GATOS_PAR The SMMU_S_GATOS_PAR characteristics are: Purpose Secure Global ATOS translation operation results register. This result register encodes both successful results and error results. The format is determined by the FAULT field. Unless otherwise specified, the fields of SMMU_S_GATOS_PAR behave in an equivalent manner to the fields of SMMU_GATOS_PAR. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR0.ATOS == 1. Otherwise, direct accesses to SMMU_S_GATOS_PAR are RES0. Attributes SMMU_S_GATOS_PAR is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions When SMMU_S_GATOS_PAR.FAULT == '0': ATTR 63 56 ADDR[55:12] 55 32 ADDR[55:12] 31 12 11 NS 10 SH 9 8 RES0 7 1 0 Size FAULT When FAULT == 0, a successful result is present: ATTR, bits [63:56] Memory attributes, in MAIR format. The reset behavior of this field is: • This field resets to an UNKNOWN value. ADDR, bits [55:12] Result address, bits [55:12]. • Address bits above and below [55:12] are treated as zero. • Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Size, bit [11] Translation page/block size flag. Size Meaning 0b0 Translation is 4KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 621

Chapter 6. Memory map and registers 6.3. Register formats Size Meaning 0b1 Translation is determined by position of lowest 1 bit in ADDR field. The reset behavior of this field is: • This field resets to an UNKNOWN value. NS, bit [10] Final NS attribute. • Note: This bit is RES0 in SMMU_GATOS_PAR and SMMU_VATOS_PAR. The reset behavior of this field is: • This field resets to an UNKNOWN value. SH, bits [9:8] Shareability attribute. SH Meaning 0b00 Non-shareable. 0b01 Reserved. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: Shareability is returned as Outer Shareable when ATTR selects any Device type. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [7:1] Reserved, RES0. FAULT, bit [0] Fault/error status. FAULT Meaning 0b0 No fault. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information for When SMMU_S_GATOS_PAR.FAULT == '0' The Size field allows the size of the translation to be determined, using an encoding in the ADDR field. The translated address is aligned to the translation size (appropriate number of LSBs zeroed) and then, if the size is greater than 4KB, a single bit is set such that its position, N, denotes the translation size, where 2(N+1) == size in bytes. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 622

Chapter 6. Memory map and registers 6.3. Register formats Note: For example, if Size == 1 and ADDR[14:12] == 0 and ADDR[15] == 1, the lowest set bit is 15 so the translation size is 215+1, or 64KB. In this case, Arm expects software to align the actual output address to 64KB by masking out bit 15. Similarly, an output address with ADDR[13:12] == 0b10 denotes a page of size 213+1, or 16KB, and the output address is taken from ADDR[47] upwards. An implementation that does not support all of the defined attributes is permitted to return the behavior that the cache supports, instead of the exact value from the translation table entries. Similarly, an implementation might return the translation page or block size that is cached rather than the size that is determined from the translation table entries. The returned memory attributes and Shareability are determined from the translation tables without including STE overrides that might be configured for the given stream. • When ATOS_ADDR.TYPE == stage 1, the stage 1 translation table attributes are returned. • When ATOS_ADDR.TYPE == stage 2, the stage 2 translation table attributes are returned. In this case, the allocation and transient hints in ATTR are: – RA == WA == 1. – TR == 0. – Note: The stage 2 TTD.MemAttr[3:0] field does not encode RA/WA/TR. • When ATOS_ADDR.TYPE == stage 1 and stage 2, the attributes returned are those from stage 1 combined with stage 2 (where combined is as defined in Chapter 13 Attribute Transformation). When SMMU_S_GATOS_PAR.FAULT == '1': 63 60 RES0 59 56 FADDR[55:12] 55 32 IMPLEMENTATION DEFINED FADDR[55:12] 31 12 FAULTCODE 11 4 3 REASON 2 1 0 NSIPA FAULT When FAULT == 1, the translation has failed and a fault syndrome is present: IMPLEMENTATION DEFINED, bits [63:60] IMPLEMENTATION DEFINED fault data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:56] Reserved, RES0. FADDR, bits [55:12] Stage 2 fault page address, bits [55:12]. • The value returned in FADDR depends on the cause of the fault. See section 9.1.4 *ATOS_PAR for details. • Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 623

Chapter 6. Memory map and registers 6.3. Register formats FAULTCODE, bits [11:4] Fault/error code. • See section 9.1.4 ATOS_PAR for details. The reset behavior of this field is: • This field resets to an UNKNOWN value. NSIPA, bit [3] When SMMU_S_IDR1.SEL2 == 1: Stage 2 fault IPA NS attribute. • When an IPA is recorded for a fault response of an ATOS request that is made to a Secure stream, that is, with ATOS_SID.SSEC == 1, this field equals the final NS bit that was output from stage 1. This value indicates whether FADDR is in the Secure or Non-secure IPA space. – Note: When stage 1 translation is bypassed, NSIPA is the value of SMMU_S_GATOS_ADDR.NS in the request. • This field value is zero when any of the following are true: – FADDR takes the default value of 0 and does not report an IPA. See section 9.1.4 ATOS_PAR for details. – A request is made through SMMU_S_GATOS_PAR for a Non-secure stream. A reported IPA for a fault on a Non-secure stream is implicitly Non-secure. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. REASON, bits [2:1] Class of activity causing fault. • This indicates the stage and reason for the fault. See section 9.1.4 *ATOS_PAR for details. REASON Meaning 0b00 Stage 1 translation-related fault occurred, or miscellaneous non-translation fault not attributable to a translation stage (for example F_BAD_STE). 0b01 CD: Stage 2 fault occurred because of a CD fetch. 0b10 TT: Stage 2 fault occurred because of a stage 1 translation table walk. 0b11 IN: Stage 2 fault occurred because of the input address to stage 2 (output address from successful stage 1 translation table walk, or address given in ATOS_ADDR for stage 2-only translation). The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULT, bit [0] Fault/error status. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 624

Chapter 6. Memory map and registers 6.3. Register formats FAULT Meaning 0b1 Fault or translation error. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_GATOS_PAR The content of ATOS_PAR registers is UNKNOWN if values in the ATOS register group are modified after a translation has been initiated by setting ATOS_CTRL.RUN == 1. See section 9.1.4 *ATOS_PAR. This register has an UNKNOWN value if read when SMMU_S_GATOS_CTRL.RUN == 1. Accesses to this register use the following encodings: Accessible at offset 0x8118 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 625

Chapter 6. Memory map and registers 6.3. Register formats 6.3.106 SMMU_S_MPAMIDR The SMMU_S_MPAMIDR characteristics are: Purpose MPAM capability identification register for Secure state. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_S_MPAMIDR are RES0. Attributes SMMU_S_MPAMIDR is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 26 25 24 PMG_MAX 23 16 PARTID_MAX 15 0 HAS_MPAM_NS RES0 Similar to SMMU_MPAMIDR, but for MPAM capability identification for Secure state. It is valid when SMMU_IDR3.MPAM == 1 in the same manner as SMMU_MPAMIDR. Bits [31:26] Reserved, RES0. HAS_MPAM_NS, bit [25] The value of this field is an IMPLEMENTATION DEFINED choice of: HAS_MPAM_NS Meaning 0b0 The MPAM_NS mechanism for Secure state is not implemented. 0b1 The MPAM_NS mechanism for Secure state is implemented. See section 17.7 Determination of PARTID space values. If Realm state is implemented, this field has the same value as SMMU_R_MPAMIDR.HAS_MPAM_NS. Access to this field is RO. Bit [24] Reserved, RES0. PMG_MAX, bits [23:16] This field has an IMPLEMENTATION DEFINED value. • The maximum PMG value that is permitted to be used in Secure state. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 626

Chapter 6. Memory map and registers 6.3. Register formats PARTID_MAX, bits [15:0] This field has an IMPLEMENTATION DEFINED value. • The maximum PARTID value that is permitted to be used in Secure state. Access to this field is RO. Additional Information The PMG bit width is defined as the bit position of the most significant 1 in PMG_MAX[7:0], plus one, or is defined as zero if PMG_MAX is zero. Note: For example, if PMG_MAX == 0x0f, the PMG bit width is 4. The PARTID bit width is defined as the bit position of the most significant 1 in PARTID_MAX[15:0], plus one, or is defined as zero if PARTID_MAX is zero. Note: For example, if PARTID_MAX == 0x0034, the PARTID bit width is 6. Note: PMG_MAX and PARTID_MAX specify the maximum values of each ID type that can be configured in the corresponding Security state. These values do not describe properties of the rest of the system, which are discovered using mechanisms that are outside the scope of this specification. Note: Either field is architecturally permitted to be zero-sized, but Arm recommends that PARTID_MAX is non-zero when MPAM is implemented. Accessing SMMU_S_MPAMIDR Accesses to this register use the following encodings: Accessible at offset 0x8130 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 627

Chapter 6. Memory map and registers 6.3. Register formats 6.3.107 SMMU_S_GMPAM The SMMU_S_GMPAM characteristics are: Purpose Global MPAM configuration register for SMMU-originated transactions relating to the Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_S_GMPAM are RES0. Attributes SMMU_S_GMPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 25 24 SO_PMG 23 16 SO_PARTID 15 0 Update MPAM_NS The fields and their behavior are the same as SMMU_GMPAM, but for the Secure programming interface. Any references to Non-secure registers in the SMMU_GMPAM definition are replaced by their corresponding Secure equivalent. Update, bit [31] Update completion flag. The reset behavior of this field is: • This field resets to '0'. Bits [30:25] Reserved, RES0. MPAM_NS, bit [24] When SMMU_S_MPAMIDR.HAS_MPAM_NS == 1: MPAM_NS Meaning 0b0 Accesses controlled by this register use Secure PARTID space. 0b1 Accesses controlled by this register use Non-secure PARTID space. PARTID and PMG values for accesses for Secure state are determined according to section 17.7 Determination of PARTID space values. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 628

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. SO_PMG, bits [23:16] PMG for SMMU-originated accesses. • This field determines the PMG of the SMMU-originated transactions for Secure state, for more information see SMMU_GMPAM. • If SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and MPAM_NS == 1, the maximum PMG value is SMMU_MPAMIDR.PMG_MAX. • Otherwise, the maximum PMG value is SMMU_S_MPAMIDR.PMG_MAX. • Bits above the supported PMG bit width, as indicated by the maximum PMG value, are RES0. • If a value is programmed that is greater than the maximum supported PMG value, an UNKNOWN PMG is used. The reset behavior of this field is: • This field resets to 0x00. SO_PARTID, bits [15:0] PARTID for SMMU-originated accesses. • This field determines the PARTID of SMMU-originated transactions for Secure state. For more information see SMMU_GMPAM. • If SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and MPAM_NS == 1, the maximum PARTID value is SMMU_MPAMIDR.PARTID_MAX. • Otherwise, the maximum PARTID value is SMMU_S_MPAMIDR.PARTID_MAX. • Bits above the supported PARTID bit width, as indicated by the maximum PARTID value, are RES0. • If a value is programmed that is greater than the maximum supported PARTID value, an UNKNOWN PARTID is used. The reset behavior of this field is: • This field resets to 0x0000. Accessing SMMU_S_GMPAM Accesses to this register use the following encodings: Accessible at offset 0x8138 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GMPAM.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 629

Chapter 6. Memory map and registers 6.3. Register formats 6.3.108 SMMU_S_GBPMPAM The SMMU_S_GBPMPAM characteristics are: Purpose MPAM configuration register for global bypass transactions relating to the Secure programming interface. Configuration This register is present only when SMMU_S_IDR1.SECURE_IMPL == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_S_GBPMPAM are RES0. Attributes SMMU_S_GBPMPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 31 RES0 30 25 24 GBP_PMG 23 16 GBP_PARTID 15 0 Update MPAM_NS The fields and their behavior are the same as SMMU_GBPMPAM, but for the Secure programming interface. Any references to Non-secure registers in the SMMU_GBPMPAM definition are replaced by their corresponding Secure equivalent. Update, bit [31] Update completion flag. The reset behavior of this field is: • This field resets to '0'. Bits [30:25] Reserved, RES0. MPAM_NS, bit [24] When SMMU_S_MPAMIDR.HAS_MPAM_NS == 1: MPAM_NS Meaning 0b0 Accesses controlled by this register use Secure PARTID space. 0b1 Accesses controlled by this register use Non-secure PARTID space. PARTID and PMG values for accesses for Secure state are determined according to section 17.7 Determination of PARTID space values. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 630

Chapter 6. Memory map and registers 6.3. Register formats GBP_PMG, bits [23:16] PMG value for transactions in Global ByPass. • This field determines the default PMG applied to all Secure client transactions that bypass translation, for more information see SMMU_GBPMPAM. • If SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and MPAM_NS == 1, the maximum PMG value is SMMU_MPAMIDR.PMG_MAX. • Otherwise, the maximum PMG value is SMMU_S_MPAMIDR.PMG_MAX. • Bits above the supported PMG bit width are RES0. • If a value is programmed that is greater than the maximum supported PMG value, an UNKNOWN PMG is used. The reset behavior of this field is: • This field resets to 0x00. GBP_PARTID, bits [15:0] PARTID value for transactions in Global ByPass. • This field determines the default PARTID applied to all Secure client transactions that bypass translation. For more information see SMMU_GBPMPAM. • If SMMU_S_MPAMIDR.HAS_MPAM_NS == 1 and MPAM_NS == 1, the maximum PARTID value is SMMU_MPAMIDR.PARTID_MAX. • Otherwise, the maximum PARTID value is SMMU_S_MPAMIDR.PARTID_MAX. • Bits above the supported PARTID bit width are RES0. • If a value is programmed that is greater than the maximum supported PARTID value, an UNKNOWN PARTID is used. The reset behavior of this field is: • This field resets to 0x0000. Accessing SMMU_S_GBPMPAM Accesses to this register use the following encodings: Accessible at offset 0x813C from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_GBPMPAM.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 631

Chapter 6. Memory map and registers 6.3. Register formats 6.3.109 SMMU_S_VATOS_SEL The SMMU_S_VATOS_SEL characteristics are: Purpose Secure VATOS VMID selection. Configuration This register is present only when SMMU_IDR0.VATOS == 1 and SMMU_S_IDR1.SEL2 == 1. Otherwise, direct accesses to SMMU_S_VATOS_SEL are RES0. Attributes SMMU_S_VATOS_SEL is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 16 VMID 15 0 When requests are made through VATOS, this field is compared to the S2VMID field of the STE selected in the request. The request is denied if the STE configuration means that translations are not tagged with a VMID, or the VMID values do not match (indicating a lookup for a StreamID not assigned to the VM that has been granted access to the VATOS interface). See section 9.1.6 SMMU_(S_)VATOS_SEL. Note: The Secure VATOS interface does not support ATOS requests for Non-secure StreamIDs because SMMU_S_VATOS_SEL checks that an STE.S2VMID field matches the secure VMID in SMMU_S_VATOS_SEL. Bits [31:16] Reserved, RES0. VMID, bits [15:0] VMID associated with the VM that is using the VATOS interface. • When SMMU_IDR0.VMID16 == 0, bits [15:8] of this field are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information This register is similar to SMMU_VATOS_SEL, but configures a Secure VMID to associate with the Secure VATOS interface. Accessing SMMU_S_VATOS_SEL This register is Guarded by SMMU_S_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x8180 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 632

Chapter 6. Memory map and registers 6.3. Register formats 6.3.110 SMMU_S_IDR6 The SMMU_S_IDR6 characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Secure programming interface. Configuration There are no configuration notes. Attributes SMMU_S_IDR6 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 28 27 24 23 20 19 16 15 11 RES0 10 2 DCMDQ 1 0 CMDQ_CONTROL_PAGE_LOG2NU MP DCMDQ_CONTROL_PAGE_LOG2NUMQ DCMDQ_CONTROL_PAGE_LOG2NUMP CMDQ_CONTROL_PAGE_LOG2NUMQ Bits [31:28] Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMP, bits [27:24] When SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1: Number of Secure Command queue control pages supported. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b0000..0b1000 Number of Command queue control pages supported as log2(pages). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Secure Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMQ, bits [23:20] When SMMU_S_IDR6.DCMDQ == 1: Number of Secure state DCMDQ interfaces per control page. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 633

Chapter 6. Memory map and registers 6.3. Register formats DCMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000 Number of queues supported per DCMDQ control page as log2(queues). All other values are reserved. In this version of the architecture, the only allowed value for this field is 0b0000, meaning the SMMU supports a single DCMDQ interface per control page The hypervisor can reserve ECMDQs for its own usage. The number of ECMDQs reserved in such a manner needs to be a multiple of the number of DCMDQ interfaces per DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMQ, bits [19:16] When SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1: Number of queues per Secure Command queue control page. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000..0b1000 Number of queues supported per Command queue control page as log2(queues). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Command queue per Secure Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMP, bits [15:11] When SMMU_S_IDR6.DCMDQ == 1: Number of Secure state DCMDQ control pages. The value of this field is an IMPLEMENTATION DEFINED choice of: DCMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b00000..0b10000 Number of DCMDQ control pages supported as log2(pages). All other values are reserved. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 634

Chapter 6. Memory map and registers 6.3. Register formats The number of DCMDQ control pages cannot be larger than: • The total number of ECMDQs implemented across all ECMDQ control pages. • The StreamID size. The number of DCMDQ control pages in SMMU_S_IDR6 is therefore an upper limit: the number of active DCMDQ control pages is determined by the number of ECMDQs the hypervisor has reserved for its own usage. Note: 0b00000 is a legal value. In this case, the SMMU supports a single Secure DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. Bits [10:2] Reserved, RES0. DCMDQ, bits [1:0] Indicates support for Secure state Direct Enhanced Command Queues. The value of this field is an IMPLEMENTATION DEFINED choice of: DCMDQ Meaning 0b00 Direct Enhanced Command Queues are not supported. 0b01 Direct Enhanced Command Queues are supported. All other values are reserved. If this field is 1, then all of the following are true: • SMMU_S_IDR0.ECMDQ == 1. • SMMU_S_IDR1.SEL2 == 1. • SMMU_S_IDR0.STALL_MODEL != 0b10. Access to this field is RO. Additional Information See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_S_IDR6 Accesses to this register use the following encodings: Accessible at offset 0x8190 from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 635

Chapter 6. Memory map and registers 6.3. Register formats 6.3.111 SMMU_S_IDR7 The SMMU_S_IDR7 characteristics are: Purpose Provides information on the qSID base for Secure state. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_IDR7 are RES0. Attributes SMMU_S_IDR7 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions QSID_BASE 31 0 QSID_BASE, bits [31:0] Offset in StreamID space to block of StreamIDs assigned to be used as qSIDs in Secure state. This field has an IMPLEMENTATION DEFINED value. Bits above the StreamID size, advertised in SMMU_S_IDR1.S_SIDSIZE, are RES0. Bits below the number of DCMDQ control pages, advertised in SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP, are RES0. The qSID is the concatenation of the value of this field and the DCMDQ control page index, where log2nump is SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP: qSID = {SMMU_S_IDR7[31:log2nump], DCMDQ control page index [log2nump - 1:0]}. For more information, see 3.5.7.3.1 Queue StreamID (qSID). Access to this field is RO. Accessing SMMU_S_IDR7 Accesses to this register use the following encodings: Accessible at offset 0x8194 from SMMUv3_PAGE_0 When SMMU_S_IDR6.DCMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 636

Chapter 6. Memory map and registers 6.3. Register formats 6.3.112 SMMU_S_IDR8 The SMMU_S_IDR8 characteristics are: Purpose Provides information on the offsets for the Secure DCMDQ control pages and Secure DCMDQ global page. Configuration There are no configuration notes. Attributes SMMU_S_IDR8 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions BA_DCMDQ 31 14 RES0 13 10 BA_DCMDQ_GLOBAL 9 0 BA_DCMDQ, bits [31:14] When SMMU_S_IDR6.DCMDQ == 1: Offset to the first DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of DCMDQ control page m can be calculated as follows: O_DCMDQCPm = SMMU_BASE + 0x20000 + BA_DCMDQ * 0x10000 + m * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. Bits [13:10] Reserved, RES0. BA_DCMDQ_GLOBAL, bits [9:0] When SMMU_S_IDR6.DCMDQ == 1: Offset to the global DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of the DCMDQ global control page can be calculated as follows: O_DCMDQCP_GLOBAL = SMMU_BASE + 0x20000 + BA_DCMDQ_GLOBAL * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 637

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_IDR8 Accesses to this register use the following encodings: Accessible at offset 0x8198 from SMMUv3_PAGE_0 When SMMU_S_IDR6.DCMDQ == 1, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 638

Chapter 6. Memory map and registers 6.3. Register formats 6.3.113 SMMU_S_HDBSS_BASE0 The SMMU_S_HDBSS_BASE0 characteristics are: Purpose Configuration of Secure state HDBSS table 0 base address. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_S_HDBSS_BASE0 are RES0. Attributes SMMU_S_HDBSS_BASE0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_S_HDBSS_PROD0.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_S_CR1. For each table that was written, SMMU_S_HDBSS_PROD0.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_S_HDBSS_PROD0.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 639

Chapter 6. Memory map and registers 6.3. Register formats WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE0.V == ‘1’ and SMMU_S_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE0.V == ‘1’ and SMMU_S_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 640

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE0.V == ‘1’ and SMMU_S_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Accessing SMMU_S_HDBSS_BASE0 Accesses to this register use the following encodings: Accessible at offset 0x8240 from SMMUv3_PAGE_0 • When SMMU_S_HDBSS_BASE0.V == ‘0’ and SMMU_S_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • When SMMU_S_HDBSS_BASE0.V == ‘1’ and SMMU_S_HDBSS_PROD0.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 641

Chapter 6. Memory map and registers 6.3. Register formats 6.3.114 SMMU_S_HDBSS_PROD0 The SMMU_S_HDBSS_PROD0 characteristics are: Purpose Index register that allows producer to offset into Secure state HDBSS table 0. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_S_HDBSS_PROD0 are RES0. Attributes SMMU_S_HDBSS_PROD0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_S_HDBSS_BASE0.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_S_HDBSS_BASE0.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason Code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 642

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HDBSS_PROD0 Accesses to this register use the following encodings: Accessible at offset 0x8248 from SMMUv3_PAGE_0 • When SMMU_S_HDBSS_BASE0.V == ‘0’ and SMMU_S_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 643

Chapter 6. Memory map and registers 6.3. Register formats 6.3.115 SMMU_S_HDBSS_BASE1 The SMMU_S_HDBSS_BASE1 characteristics are: Purpose Configuration of Secure state HDBSS table 1 base address. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_S_HDBSS_BASE1 are RES0. Attributes SMMU_S_HDBSS_BASE1 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_S_HDBSS_PROD1.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_S_CR1. For each table that was written, SMMU_S_HDBSS_PROD1.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_S_HDBSS_PROD1.ERR_REASON, with the exception of SMMU_S_HDBSS_PROD1.ERR_REASON == 0b11. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 644

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE1.V == ‘1’ and SMMU_S_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE1.V == ‘1’ and SMMU_S_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 645

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HDBSS_BASE1.V == ‘1’ and SMMU_S_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Accessing SMMU_S_HDBSS_BASE1 Accesses to this register use the following encodings: Accessible at offset 0x8250 from SMMUv3_PAGE_0 • When SMMU_S_HDBSS_BASE1.V == ‘0’ and SMMU_S_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • When SMMU_S_HDBSS_BASE1.V == ‘1’ and SMMU_S_HDBSS_PROD1.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 646

Chapter 6. Memory map and registers 6.3. Register formats 6.3.116 SMMU_S_HDBSS_PROD1 The SMMU_S_HDBSS_PROD1 characteristics are: Purpose Index register that allows producer to offset into Secure state HDBSS table 1. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_S_HDBSS_PROD1 are RES0. Attributes SMMU_S_HDBSS_PROD1 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_S_HDBSS_BASE1.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_S_HDBSS_BASE1.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason Code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 647

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HDBSS_PROD1 Accesses to this register use the following encodings: Accessible at offset 0x8258 from SMMUv3_PAGE_0 • When SMMU_S_HDBSS_BASE1.V == ‘0’ and SMMU_S_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 648

Chapter 6. Memory map and registers 6.3. Register formats 6.3.117 SMMU_S_HDBSS_IRQ_CFG0 The SMMU_S_HDBSS_IRQ_CFG0 characteristics are: Purpose Secure state HDBSS interrupt configuration register 0. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HDBSS_IRQ_CFG0 are RES0. Attributes SMMU_S_HDBSS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits[55:2]. High-order bits of ADDR above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits[1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_S_HDBSS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x8260 from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 649

Chapter 6. Memory map and registers 6.3. Register formats 6.3.118 SMMU_S_HDBSS_IRQ_CFG1 The SMMU_S_HDBSS_IRQ_CFG1 characteristics are: Purpose Secure state HDBSS interrupt configuration register 1. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HDBSS_IRQ_CFG1 are RES0. Attributes SMMU_S_HDBSS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HDBSS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x8268 from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 650

Chapter 6. Memory map and registers 6.3. Register formats 6.3.119 SMMU_S_HDBSS_IRQ_CFG2 The SMMU_S_HDBSS_IRQ_CFG2 characteristics are: Purpose Secure state HDBSS interrupt configuration register 2. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HDBSS_IRQ_CFG2 are RES0. Attributes SMMU_S_HDBSS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 651

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_HDBSS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x826C from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 652

Chapter 6. Memory map and registers 6.3. Register formats 6.3.120 SMMU_S_HDBSS_MPAM The SMMU_S_HDBSS_MPAM characteristics are: Purpose MPAM configuration register for accesses to a Secure HDBSS table. Configuration This register is present only when SMMU_S_IDR3.HDBSS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_S_HDBSS_MPAM are RES0. Attributes SMMU_S_HDBSS_MPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 25 24 PMG 23 16 PARTID 15 0 MPAM_NS Bits [31:25] Reserved, RES0. MPAM_NS, bit [24] MPAM_NS for accesses to an HDBSS table. For a description of MPAM_NS, see SMMU_S_GMPAM.MPAM_NS. The reset behavior of this field is: • This field resets to an UNKNOWN value. PMG, bits [23:16] PMG for accesses to an HDBSS table. For a description of PMG, see SMMU_S_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to an HDBSS table. For a description of PARTID, see SMMU_S_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HDBSS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x8270 from SMMUv3_PAGE_0 • When SMMU_S_HDBSS_BASE0.V == ‘0’, SMMU_S_HDBSS_PROD0.VACK == ‘0’, SMMU_S_HDBSS_BASE1.V == ‘0’, and SMMU_S_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 653

Chapter 6. Memory map and registers 6.3. Register formats • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 654

Chapter 6. Memory map and registers 6.3. Register formats 6.3.121 SMMU_S_HACDBS_BASE The SMMU_S_HACDBS_BASE characteristics are: Purpose Control register for Secure state HACDBS base address. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_S_HACDBS_BASE are RES0. Attributes SMMU_S_HACDBS_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions EN 63 62 RA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 EN, bit [63] Enable use of the HACDBS. EN Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. This field has similar Update behavior to fields in SMMU_CR0, such that when its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_S_HACDBS_CONS.ENACK to the new value. Completion of an Update from 1 to 0 ensures that all outstanding walks, including the update of descriptors from writable-dirty to writable-clean, have completed. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. RA, bit [61] Read Allocate hint. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 655

Chapter 6. Memory map and registers 6.3. Register formats RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HACDBS_BASE.EN == ‘1’ and SMMU_S_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HACDBS base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HACDBS is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HACDBS_BASE.EN == ‘1’ and SMMU_S_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HACDBS. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 656

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_HACDBS_BASE.EN == ‘1’ and SMMU_S_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Accessing SMMU_S_HACDBS_BASE Accesses to this register use the following encodings: Accessible at offset 0x8440 from SMMUv3_PAGE_0 • When SMMU_S_HACDBS_BASE.EN == ‘1’ and SMMU_S_HACDBS_CONS.ENACK == ‘1’, accesses to this register are RW. • When SMMU_S_HACDBS_BASE.EN == ‘0’ and SMMU_S_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 657

Chapter 6. Memory map and registers 6.3. Register formats 6.3.122 SMMU_S_HACDBS_CONS The SMMU_S_HACDBS_CONS characteristics are: Purpose Index register that allows consumer to offset into Secure state HACBDS. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_S_HACDBS_CONS are RES0. Attributes SMMU_S_HACDBS_CONS is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions 63 ERR 62 61 59 RES0 58 56 INDEX 55 32 ENACK ERR_REASON STREAMID 31 0 ENACK, bit [63] Enable use of the HACDBS acknowledge. ENACK Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. See SMMU_S_HACDBS_BASE.EN. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_S_HACDBS_BASE.ERRACK, then an error has occurred while processing a HACDBS entry. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:59] HACDBS error. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 658

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b000 No error. 0b001 STRUCTF - A read of an entry from the HACDBS has experienced an error. 0b010 IPAF - A stage 2 walk of an IPA from a HACDBS entry has experienced a translation-related fault or an external abort. 0b011 IPAHACF - Processing of an entry from the HACDBS experienced an error that is not a translation-related fault or an external abort. 0b100 STEF - An error occured while fetching or interpreting the STE, or any associated structures. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [58:56] Reserved, RES0. INDEX, bits [55:32] Next entry to read from HACDBS. This field indicates the index of the HACDBS entry that the SMMU will read next. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID required for stage 2 table walks for HACDBS entries. The StreamID is used to locate the STE which contains the stage 2 table walk configuration required to process HACDBS entries. If SMMU_IDR1.SID_SIZE < 32, bits [31:SMMU_IDR1.SID_SIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HACDBS_CONS Accesses to this register use the following encodings: Accessible at offset 0x8448 from SMMUv3_PAGE_0 • When SMMU_S_HACDBS_BASE.EN == ‘0’ and SMMU_S_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 659

Chapter 6. Memory map and registers 6.3. Register formats 6.3.123 SMMU_S_HACDBS_IRQ_CFG0 The SMMU_S_HACDBS_IRQ_CFG0 characteristics are: Purpose Secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HACDBS_IRQ_CFG0 are RES0. Attributes SMMU_S_HACDBS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR 55 32 ADDR 31 2 RES0 1 0 Bits [63:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits [55:2]. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits [1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. Accessing SMMU_S_HACDBS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x8450 from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 660

Chapter 6. Memory map and registers 6.3. Register formats 6.3.124 SMMU_S_HACDBS_IRQ_CFG1 The SMMU_S_HACDBS_IRQ_CFG1 characteristics are: Purpose Secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HACDBS_IRQ_CFG1 are RES0. Attributes SMMU_S_HACDBS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HACDBS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x8458 from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 661

Chapter 6. Memory map and registers 6.3. Register formats 6.3.125 SMMU_S_HACDBS_IRQ_CFG2 The SMMU_S_HACDBS_IRQ_CFG2 characteristics are: Purpose Secure state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1 and SMMU_S_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_S_HACDBS_IRQ_CFG2 are RES0. Attributes SMMU_S_HACDBS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 662

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_HACDBS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x845C from SMMUv3_PAGE_0 • When SMMU_S_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_S_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 663

Chapter 6. Memory map and registers 6.3. Register formats 6.3.126 SMMU_S_HACDBS_MPAM The SMMU_S_HACDBS_MPAM characteristics are: Purpose MPAM configuration register for accesses to the Secure HACDBS. Configuration This register is present only when SMMU_S_IDR3.HACDBS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_S_HACDBS_MPAM are RES0. Attributes SMMU_S_HACDBS_MPAM is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 25 24 PMG 23 16 PARTID 15 0 MPAM_NS Bits [31:25] Reserved, RES0. MPAM_NS, bit [24] MPAM_NS for accesses to the HACDBS. For a description of MPAM_NS, see SMMU_S_GMPAM.MPAM_NS. The reset behavior of this field is: • This field resets to an UNKNOWN value. PMG, bits [23:16] PMG for accesses to the HACDBS. For a description of PMG, see SMMU_S_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to the HACDBS. For a description of PARTID, see SMMU_S_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_HACDBS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x8460 from SMMUv3_PAGE_0 • When SMMU_S_HACDBS_BASE.EN == ‘0’ and SMMU_S_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 664

Chapter 6. Memory map and registers 6.3. Register formats 6.3.127 SMMU_S_CMDQ_CONTROL_PAGE_BASE, n = 0 - 255 The SMMU_S_CMDQ_CONTROL_PAGE_BASE characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_S_CMDQ_CONTROL_PAGE_BASE are RES0. Attributes SMMU_S_CMDQ_CONTROL_PAGE_BASE is a 64-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:16] 55 32 ADDR[55:16] 31 16 RES0 15 3 CMDQGS 2 1 0 CMDQ_CO NTROL_P AGE_PRE SET Bits [63:56] Reserved, RES0. ADDR, bits [55:16] Base address of the Command queue control page, bits [55:16]. The bits [15:0] of the base address are 0. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. The value of this field is an offset from the base address of SMMU Register Page 0, not an absolute address. The values of all SMMU_S_CMDQ_CONTROL_PAGE_BASEn.ADDR are such that the pages occupy a contiguous region of address space within the SMMU register file, and they are arranged in ascending value of n. Bits [15:3] Reserved, RES0. CMDQGS, bits [2:1] Granule size to use for the Command queue control page. CMDQGS Meaning 0b01 64KB ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 665

Chapter 6. Memory map and registers 6.3. Register formats CMDQ_CONTROL_PAGE_PRESET, bit [0] Indicates whether queue controls for this interface are stored in Normal memory or registers. CMDQ_CONTROL_PAGE_PRESET Meaning 0b1 The ECMDQ interfaces for this page are implemented as registers in the SMMU. This bit is 1 in implementations of SMMUv3.3. Accessing SMMU_S_CMDQ_CONTROL_PAGE_BASE Accesses to this register use the following encodings: Accessible at offset 0xC000 + (32 * n) from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 666

Chapter 6. Memory map and registers 6.3. Register formats 6.3.128 SMMU_S_CMDQ_CONTROL_PAGE_CFG, n = 0 - 255 The SMMU_S_CMDQ_CONTROL_PAGE_CFG characteristics are: Purpose Control for Enhanced Command queue interface for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_S_CMDQ_CONTROL_PAGE_CFG are RES0. Attributes SMMU_S_CMDQ_CONTROL_PAGE_CFG is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 EN 0 Bits [31:1] Reserved, RES0. EN, bit [0] Command queue control page enable. EN Meaning 0b1 Command queue control page is enabled. This field is RES1. Accessing SMMU_S_CMDQ_CONTROL_PAGE_CFG Accesses to this register use the following encodings: Accessible at offset 0xC008 + (32 * n) from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 667

Chapter 6. Memory map and registers 6.3. Register formats 6.3.129 SMMU_S_CMDQ_CONTROL_PAGE_STATUS, n = 0 - 255 The SMMU_S_CMDQ_CONTROL_PAGE_STATUS characteristics are: Purpose Status of Enhanced Command queue interface for the SMMU Secure programming interface. Configuration This register is present only when SMMU_S_IDR0.ECMDQ == 1 or SMMU_S_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_S_CMDQ_CONTROL_PAGE_STATUS are RES0. Attributes SMMU_S_CMDQ_CONTROL_PAGE_STATUS is a 32-bit register. This register is part of the SMMUv3_PAGE_0 block. Field descriptions RES0 31 1 0 ENACK Bits [31:1] Reserved, RES0. ENACK, bit [0] Command queue control page enable. ENACK Meaning 0b1 Command queue control page is enabled. This field is RES1. Accessing SMMU_S_CMDQ_CONTROL_PAGE_STATUS Accesses to this register use the following encodings: Accessible at offset 0xC00C + (32 * n) from SMMUv3_PAGE_0 • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 668

Chapter 6. Memory map and registers 6.3. Register formats 6.3.130 SMMU_EVENTQ_PROD The SMMU_EVENTQ_PROD characteristics are: Purpose Allows Event queue producer to update the read index. Configuration There are no configuration notes. Attributes SMMU_EVENTQ_PROD is a 32-bit register. This register is part of the SMMUv3_PAGE_1 block. Field descriptions 31 RES0 30 20 WR 19 0 OVFLG OVFLG, bit [31] Event queue overflowed flag. • An Event queue overflow is indicated using this flag. This flag is toggled by the SMMU when a queue overflow is detected, if OVFLG == SMMU_EVENTQ_CONS.OVACKFLG. • This flag will not be updated until a prior overflow is acknowledged by setting SMMU_EVENTQ_CONS.OVACKFLG equal to OVFLG. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. WR, bits [19:0] Event queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Queue write index wrap flag. Bits [QS-1:0]: WR - Queue write index. • Next space to be written by SMMU. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_EVENTQ_BASE.LOG2SIZE, see SMMU_EVENTQ_CONS. If QS < 19, bits [19:QS+1] are RAZ. When incremented by the SMMU, the WR index is always wrapped to the current queue size given by QS. If QS == 0 the queue has one entry. Zero bits of WR index are present and WR_WRAP is bit zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 669

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this registers that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_CR0.EVENTQEN is transitioned from 0 to 1. Note: See section 7.4 Event queue overflow for details on queue overflow. An overflow condition is entered when a record has been discarded due to a full enabled Event queue. The following conditions do not cause an overflow condition: • Event records discarded when the Event queue is disabled, that is when SMMU_CR0.EVENTQEN == 0. • A stalled faulting transaction, as stall event records do not get discarded when the Event queue is full or disabled. Accessing SMMU_EVENTQ_PROD This register is Guarded by SMMU_CR0.EVENTQEN and must only be modified when SMMU_CR0.EVENTQEN == 0. See SMMU_EVENTQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00A8 from SMMUv3_PAGE_1 • When SMMU_CR0.EVENTQEN == ‘0’ and SMMU_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 670

Chapter 6. Memory map and registers 6.3. Register formats 6.3.131 SMMU_EVENTQ_CONS The SMMU_EVENTQ_CONS characteristics are: Purpose Event queue consumer read index. Configuration There are no configuration notes. Attributes SMMU_EVENTQ_CONS is a 32-bit register. This register is part of the SMMUv3_PAGE_1 block. Field descriptions 31 RES0 30 20 RD 19 0 OVACKFLG OVACKFLG, bit [31] Overflow acknowledge flag. • Software must set this flag to the value of SMMU_EVENTQ_PROD.OVFLG when it is safe for the SMMU to report a future EVENT queue overflow. Arm recommends that this is done on initialization and after a previous Event queue overflow is handled by software. • See section 7.4 Event queue overflow. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. RD, bits [19:0] Event queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Event queue read index wrap flag. Bits [QS-1:0]: RD - Event queue read index. • Updated by the PE to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_EVENTQ_BASE.LOG2SIZE and SMMU_EVENTQ_BASE.LOG2SIZE <= SMMU_IDR1.EVENTQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.EVENTQS < 19, bits [19:EVENTQS + 1] are UNKNOWN on read. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 671

Chapter 6. Memory map and registers 6.3. Register formats If QS == 0 the queue has one entry. Zero bits of RD index are present and RD_WRAP is bit zero. When software increments RD, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and RD_WRAP toggled. Arm recommends that software initializes the register to a valid value before SMMU_CR0.EVENTQEN is transitioned from 0 to 1. When SMMU_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Accessing SMMU_EVENTQ_CONS Accesses to this register use the following encodings: Accessible at offset 0x00AC from SMMUv3_PAGE_1 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 672

Chapter 6. Memory map and registers 6.3. Register formats 6.3.132 SMMU_PRIQ_PROD The SMMU_PRIQ_PROD characteristics are: Purpose PRI queue write index status. Configuration This register is present only when SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_PROD are RES0. Attributes SMMU_PRIQ_PROD is a 32-bit register. This register is part of the SMMUv3_PAGE_1 block. Field descriptions 31 RES0 30 20 WR 19 0 OVFLG OVFLG, bit [31] • This flag is toggled by the SMMU when a queue overflow is detected, in which case one or more requests have been lost. • An overflow condition is present when this flag is different from SMMU_PRIQ_CONS.OVACKFLG. This flag is not updated until the overflow is acknowledged by setting SMMU_PRIQ_CONS.OVACKFLG equal to OVFLG. The reset behavior of this field is: • This field resets to '0'. Bits [30:20] Reserved, RES0. WR, bits [19:0] Queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Queue write index wrap flag. Bits [QS-1:0]: WR - Queue write index. • Next space to be written by SMMU. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_PRIQ_BASE.LOG2SIZE; see SMMU_PRIQ_CONS. If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the WR index is always wrapped to the current queue size given by QS. If QS == 0 the queue has one entry: zero bits of WR index are present and WR_WRAP is bit zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 673

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_PRIQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before transitioning SMMU_CR0.PRIQEN from 0 to 1. Accessing SMMU_PRIQ_PROD SMMU_PRIQ_PROD is Guarded by SMMU_CR0.PRIQEN and must only be modified when PRIQEN == 0. See SMMU_PRIQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00C8 from SMMUv3_PAGE_1 • When SMMU_CR0.PRIQEN == ‘0’ and SMMU_CR0ACK.PRIQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 674

Chapter 6. Memory map and registers 6.3. Register formats 6.3.133 SMMU_PRIQ_CONS The SMMU_PRIQ_CONS characteristics are: Purpose PRI queue consumer read index. Configuration This register is present only when SMMU_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_PRIQ_CONS are RES0. Attributes SMMU_PRIQ_CONS is a 32-bit register. This register is part of the SMMUv3_PAGE_1 block. Field descriptions 31 RES0 30 20 RD 19 0 OVACKFLG OVACKFLG, bit [31] Overflow acknowledge flag. • Note: Software sets this flag to the value of SMMU_PRIQ_PROD.OVFLG when it is ready for the SMMU to report a new PRI queue overflow. Arm expects this to be done on initialization and after a previous PRI queue overflow has been handled by software. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. RD, bits [19:0] Queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Queue read index wrap flag. Bits [QS-1:0]: RD - Queue read index. • Updated by the PE to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_PRIQ_BASE.LOG2SIZE and SMMU_PRIQ_BASE.LOG2SIZE <= SMMU_IDR1.PRIQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.PRIQS < 19, bits [19:PRIQS + 1] are UNKNOWN on read. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 675

Chapter 6. Memory map and registers 6.3. Register formats If QS == 0 the queue has one entry: zero bits of RD index are present and RD_WRAP is bit zero. When software increments RD, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and RD_WRAP toggled. When SMMU_PRIQ_BASE.LOG2SIZE is increased within its valid range, the value of this register’s bits that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_CR0.PRIQEN is transitioned from 0 to 1. Accessing SMMU_PRIQ_CONS Accesses to this register use the following encodings: Accessible at offset 0x00CC from SMMUv3_PAGE_1 Accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 676

Chapter 6. Memory map and registers 6.3. Register formats 6.3.134 SMMU_VATOS_CTRL The SMMU_VATOS_CTRL characteristics are: Purpose VATOS translation control register. Configuration This register is present only when SMMU_IDR0.VATOS == 1. Otherwise, direct accesses to SMMU_VATOS_CTRL are RES0. Attributes SMMU_VATOS_CTRL is a 32-bit register. This register is part of the SMMUv3_VATOS block. Field descriptions RES0 31 1 RUN 0 Bits [31:1] Reserved, RES0. RUN, bit [0] Run ATOS translation. • Software must write this bit to 1 to initiate the translation operation, after initializing the ATOS_SID and ATOS_ADDR registers. • The SMMU clears the RUN flag after the translation completes and its result is visible in ATOS_PAR. • A write of 0 to this flag might change the value of the flag but has no other effect. Software must only write 0 to this flag when the flag is zero. The reset behavior of this field is: • This field resets to '0'. Additional Information This register has a similar encoding and behavior to SMMU_GATOS_CTRL, except it applies to the Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. SMMU_VATOS_{CTRL, SID, ADDR, PAR} are only present if SMMU_IDR0.VATOS == 1; otherwise, they are Reserved. See Chapter 9 Address Translation Operations for more information on the overall behavior of ATOS operations. Accessing SMMU_VATOS_CTRL RUN is Guarded by SMMU_CR0.SMMUEN and must only be set when SMMUEN == 1 and RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A00 from SMMUv3_VATOS • When SMMU_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 677

Chapter 6. Memory map and registers 6.3. Register formats 6.3.135 SMMU_VATOS_SID The SMMU_VATOS_SID characteristics are: Purpose VATOS StreamID register. Configuration This register is present only when SMMU_IDR0.VATOS == 1. Otherwise, direct accesses to SMMU_VATOS_SID are RES0. Attributes SMMU_VATOS_SID is a 64-bit register. This register is part of the SMMUv3_VATOS block. Field descriptions RES0 63 53 52 SUBSTREAMID 51 32 SSID_VALID STREAMID 31 0 This register has a similar encoding and behavior to SMMU_GATOS_SID, except it applies to the Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. Bits [63:53] Reserved, RES0. SSID_VALID, bit [52] When SMMU_IDR1.SSIDSIZE != '00000': SubstreamID valid. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. SUBSTREAMID, bits [51:32] SubstreamID of request. • If SMMU_IDR1.SSIDSIZE < 20, bits [51:(32 + SMMU_IDR1.SSIDSIZE)] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID of request. • This is written with the StreamID (used to locate translations/CDs) of the request later submitted to SMMU_VATOS_ADDR. • If SMMU_IDR1.SID_SIZE < 32, bits [31:SMMU_IDR1.SID_SIZE] are RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 678

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information • Bits of SubstreamID and StreamID outside of the supported range are RES0. Accessing SMMU_VATOS_SID This register is Guarded by SMMU_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A08 from SMMUv3_VATOS • When SMMU_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 679

Chapter 6. Memory map and registers 6.3. Register formats 6.3.136 SMMU_VATOS_ADDR The SMMU_VATOS_ADDR characteristics are: Purpose VATOS translation address register. Configuration This register is present only when SMMU_IDR0.VATOS == 1. Otherwise, direct accesses to SMMU_VATOS_ADDR are RES0. Attributes SMMU_VATOS_ADDR is a 64-bit register. This register is part of the SMMUv3_VATOS block. Field descriptions ADDR[63:12] 63 32 ADDR[63:12] 31 12 TYPE 11 10 PnU 9 RnW 8 InD 7 6 RES0 5 0 HTTUI This register has a similar encoding and behavior to SMMU_GATOS_ADDR, except it applies to the Virtual ATOS interface. ADDR, bits [63:12] Requested input address, bits [63:12]. The reset behavior of this field is: • This field resets to an UNKNOWN value. TYPE, bits [11:10] Request type. TYPE Meaning 0b00 Reserved. 0b01 Stage 1 (VA to IPA). 0b10 Reserved. 0b11 Reserved. • Use of a Reserved value results in an INV_REQ ATOS error. The reset behavior of this field is: • This field resets to an UNKNOWN value. PnU, bit [9] Privileged or User access. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 680

Chapter 6. Memory map and registers 6.3. Register formats PnU Meaning 0b0 Unprivileged. 0b1 Privileged. The reset behavior of this field is: • This field resets to an UNKNOWN value. RnW, bit [8] Read/Write access. RnW Meaning 0b0 Write. 0b1 Read. The reset behavior of this field is: • This field resets to an UNKNOWN value. InD, bit [7] Instruction/Data access. InD Meaning 0b0 Data. 0b1 Instruction. • This bit is IGNORED if RnW == 0, and the effective InD for writes is Data. The reset behavior of this field is: • This field resets to an UNKNOWN value. HTTUI, bit [6] Inhibit hardware update of the Access flag and dirty state. HTTUI Meaning 0b0 Flag update (HTTU) might occur, where supported by the SMMU, according to HA:HD configuration fields at stage 1 and stage 2. 0b1 HTTU is inhibited, regardless of HA/HD configuration. • The ATOS operation causes no state change and is passive. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 681

Chapter 6. Memory map and registers 6.3. Register formats Additional Information The PnU and InD attributes are not affected by the STE.INSTCFG or STE.PRIVCFG overrides. Accessing SMMU_VATOS_ADDR This register is Guarded by SMMU_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A10 from SMMUv3_VATOS • When SMMU_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 682

Chapter 6. Memory map and registers 6.3. Register formats 6.3.137 SMMU_VATOS_PAR The SMMU_VATOS_PAR characteristics are: Purpose VATOS translation results register. This register has a similar encoding and behavior to SMMU_GATOS_PAR, except it applies to the Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. This result register encodes both successful results and error results. The format is determined by the FAULT field. Configuration This register is present only when SMMU_IDR0.VATOS == 1. Otherwise, direct accesses to SMMU_VATOS_PAR are RES0. Attributes SMMU_VATOS_PAR is a 64-bit register. This register is part of the SMMUv3_VATOS block. Field descriptions When SMMU_VATOS_PAR.FAULT == '0': ATTR 63 56 ADDR[55:12] 55 32 ADDR[55:12] 31 12 11 10 SH 9 8 RES0 7 1 0 Size RES0 FAULT When FAULT == 0, a successful result is present: ATTR, bits [63:56] Memory attributes, in MAIR format. The reset behavior of this field is: • This field resets to an UNKNOWN value. ADDR, bits [55:12] Result address, bits [55:12]. • Address bits above and below [55:12] are treated as zero. • Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Size, bit [11] Translation page/block size flag. Size Meaning 0b0 Translation is 4KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 683

Chapter 6. Memory map and registers 6.3. Register formats Size Meaning 0b1 Translation is determined by position of lowest 1 bit in ADDR field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [10] Reserved, RES0. SH, bits [9:8] Shareability attribute. SH Meaning 0b00 Non-shareable. 0b01 Reserved. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: Shareability is returned as Outer Shareable when ATTR selects any Device type. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [7:1] Reserved, RES0. FAULT, bit [0] Fault/error status. FAULT Meaning 0b0 No Fault. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_VATOS_PAR.FAULT == '1': 63 60 RES0 59 56 FADDR[55:12] 55 32 IMPLEMENTATION DEFINED FADDR[55:12] 31 12 FAULTCODE 11 4 3 REASON 2 1 0 RES0 FAULT When FAULT == 1, the translation has failed and a fault syndrome is present: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 684

Chapter 6. Memory map and registers 6.3. Register formats IMPLEMENTATION DEFINED, bits [63:60] IMPLEMENTATION DEFINED fault data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:56] Reserved, RES0. FADDR, bits [55:12] Fault page address, bits [55:12]. • The value returned in FADDR depends on the cause of the fault. See section 9.1.4 ATOS_PAR for details. • Note: Because the ATOS_PAR.FADDR field returns a fault IPA only when an ATOS_ADDR.TYPE == 0b10 request is made, and VATOS_ADDR.TYPE must be 0b01, this field is always 0. The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULTCODE, bits [11:4] Fault/error code. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [3] Reserved, RES0. REASON, bits [2:1] Class of activity causing fault. • This indicates the stage and reason for the fault. The only value permitted in SMMU_S_VATOS_PAR.REASON is 0b00. See section 9.1.4 ATOS_PAR for details. REASON Meaning 0b00 Stage 1 translation-related fault occurred, or miscellaneous non-translation fault not attributable to a translation stage (for example, F_BAD_STE). 0b01 Reserved. 0b10 Reserved. 0b11 Reserved. The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULT, bit [0] Fault/error status. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 685

Chapter 6. Memory map and registers 6.3. Register formats FAULT Meaning 0b1 Fault or translation error. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_VATOS_PAR The content of ATOS_PAR registers is UNKNOWN if values in the ATOS register group are modified after a translation has been initiated by setting ATOS_CTRL.RUN == 1. See section 9.1.4 *ATOS_PAR. This register has an UNKNOWN value if read when SMMU_VATOS_CTRL.RUN == 1. Accesses to this register use the following encodings: Accessible at offset 0x0A18 from SMMUv3_VATOS Accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 686

Chapter 6. Memory map and registers 6.3. Register formats 6.3.138 SMMU_S_VATOS_CTRL The SMMU_S_VATOS_CTRL characteristics are: Purpose Provides Secure VATOS controls. Configuration This register is present only when SMMU_IDR0.VATOS == 1 and SMMU_S_IDR1.SEL2 == 1. Otherwise, direct accesses to SMMU_S_VATOS_CTRL are RES0. Attributes SMMU_S_VATOS_CTRL is a 32-bit register. This register is part of the SMMUv3_S_VATOS block. Field descriptions RES0 31 1 RUN 0 This register has a similar encoding and behavior to SMMU_S_GATOS_CTRL, except it applies to the Secure Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. Bits [31:1] Reserved, RES0. RUN, bit [0] Run ATOS translation. The reset behavior of this field is: • This field resets to '0'. Additional Information • Arm recommends that software writes this bit to 1 to initiate the translation operation, after initializing the ATOS_SID and ATOS_ADDR registers. • The SMMU clears the RUN flag after the translation completes and its result is visible in ATOS_PAR. • A write of 0 to this flag might change the value of the flag but has no other effect. Software must only write 0 to this flag when the flag is zero. Accessing SMMU_S_VATOS_CTRL RUN is Guarded by SMMU_S_CR0.SMMUEN and must only be set when SMMUEN == 1 and RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A00 from SMMUv3_S_VATOS • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 687

Chapter 6. Memory map and registers 6.3. Register formats 6.3.139 SMMU_S_VATOS_SID The SMMU_S_VATOS_SID characteristics are: Purpose Secure VATOS StreamID register. Configuration This register is present only when SMMU_IDR0.VATOS == 1 and SMMU_S_IDR1.SEL2 == 1. Otherwise, direct accesses to SMMU_S_VATOS_SID are RES0. Attributes SMMU_S_VATOS_SID is a 64-bit register. This register is part of the SMMUv3_S_VATOS block. Field descriptions RES0 63 54 53 52 SUBSTREAMID 51 32 RES1 SSID_VALID STREAMID 31 0 This register is encoded in a similar way to SMMU_S_GATOS_SID, except it applies to the Secure Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. • Bit [53] is RES1 and the SMMU_S_VATOS_SID.STREAMID field is taken as a Secure StreamID. Note: The Secure VATOS interface does not support ATOS requests for Non-secure StreamIDs because SMMU_S_VATOS_SEL checks that an STE.S2VMID field matches the secure VMID in SMMU_S_VATOS_SEL. Bits [63:54] Reserved, RES0. Bit [53] Reserved, RES1. SSID_VALID, bit [52] When SMMU_IDR1.SSIDSIZE != '00000': SubstreamID valid. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. SUBSTREAMID, bits [51:32] SubstreamID of request. • If SMMU_IDR1.SSIDSIZE < 20, bits [51:32 + SMMU_IDR1.SSIDSIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 688

Chapter 6. Memory map and registers 6.3. Register formats STREAMID, bits [31:0] Secure StreamID of request. • This is written with the StreamID (used to locate translations/CDs) of the request later submitted to SMMU_S_VATOS_ADDR. • If SMMU_IDR1.SID_SIZE < 32 and SMMU_S_IDR1.S_SIDSIZE < 32, bits [31:MAX(SMMU_IDR1.SIDSIZE, SMMU_S_IDR1.S_SIDSIZE)] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information Bits of SUBSTREAMID and STREAMID outside of the supported range are RES0. Accessing SMMU_S_VATOS_SID This register is Guarded by SMMU_S_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A08 from SMMUv3_S_VATOS • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 689

Chapter 6. Memory map and registers 6.3. Register formats 6.3.140 SMMU_S_VATOS_ADDR The SMMU_S_VATOS_ADDR characteristics are: Purpose Secure virtual ATOS translation address register Configuration This register is present only when SMMU_IDR0.VATOS == 1 and SMMU_S_IDR1.SEL2 == 1. Otherwise, direct accesses to SMMU_S_VATOS_ADDR are RES0. Attributes SMMU_S_VATOS_ADDR is a 64-bit register. This register is part of the SMMUv3_S_VATOS block. Field descriptions ADDR[63:12] 63 32 ADDR[63:12] 31 12 TYPE 11 10 PnU 9 RnW 8 InD 7 6 RES0 5 0 HTTUI This register is encoded in a similar way to SMMU_S_GATOS_ADDR, except it applies to the Secure Virtual ATOS interface. See Chapter 9 Address Translation Operations for details. • Field [4] of SMMU_S_VATOS_ADDR is RES0. ADDR, bits [63:12] Requested input address, bits [63:12]. The reset behavior of this field is: • This field resets to an UNKNOWN value. TYPE, bits [11:10] Request type. TYPE Meaning 0b00 Reserved. 0b01 Stage 1 (VA to IPA). 0b10 Reserved. 0b11 Reserved. • Use of a Reserved value results in an INV_REQ ATOS error. The reset behavior of this field is: • This field resets to an UNKNOWN value. PnU, bit [9] Privileged or User access. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 690

Chapter 6. Memory map and registers 6.3. Register formats PnU Meaning 0b0 Unprivileged. 0b1 Privileged. The reset behavior of this field is: • This field resets to an UNKNOWN value. RnW, bit [8] Read/write access. RnW Meaning 0b0 Write. 0b1 Read. The reset behavior of this field is: • This field resets to an UNKNOWN value. InD, bit [7] Instruction/data access. InD Meaning 0b0 Data. 0b1 Instruction. • This bit is IGNORED if RnW == 0, and the effective InD for writes is Data. The reset behavior of this field is: • This field resets to an UNKNOWN value. HTTUI, bit [6] Inhibit hardware update of the Access flag and dirty state. HTTUI Meaning 0b0 Flag update (HTTU) might occur, where supported by the SMMU, according to HA and HD configuration fields at stage 1 and stage 2. 0b1 HTTU is inhibited, regardless of HA and HD configuration. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 691

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_S_VATOS_ADDR This register is Guarded by SMMU_S_VATOS_CTRL.RUN and must only be altered when RUN == 0. See SMMU_GATOS_CTRL for more detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0A10 from SMMUv3_S_VATOS • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_VATOS_CTRL.RUN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 692

Chapter 6. Memory map and registers 6.3. Register formats 6.3.141 SMMU_S_VATOS_PAR The SMMU_S_VATOS_PAR characteristics are: Purpose Secure VATOS translation operation results register. This result register encodes both successful results and error results. The format is determined by the FAULT field. Unless otherwise specified, the fields of SMMU_S_VATOS_PAR behave in an equivalent manner to the fields of SMMU_VATOS_PAR. Configuration This register is present only when SMMU_IDR0.VATOS == 1 and SMMU_S_IDR1.SEL2 == 1. Otherwise, direct accesses to SMMU_S_VATOS_PAR are RES0. Attributes SMMU_S_VATOS_PAR is a 64-bit register. This register is part of the SMMUv3_S_VATOS block. Field descriptions When SMMU_S_VATOS_PAR.FAULT == '0': ATTR 63 56 ADDR[55:12] 55 32 ADDR[55:12] 31 12 11 NS 10 SH 9 8 RES0 7 1 0 Size FAULT When FAULT == 0, a successful result is present: This register has a similar encoding and behavior to SMMU_VATOS_PAR, except it applies to the Secure Virtual ATOS interface. • Note: Because the ATOS_PAR.FADDR field returns a fault IPA only when an ATOS_ADDR.TYPE == 0b10 request is made, and VATOS_ADDR.TYPE must be 0b01, the SMMU_S_VATOS_PAR.FADDR and SMMU_S_VATOS_PAR.NSIPA fields are always 0. • See Chapter 9 Address Translation Operations for details. This result register encodes both successful results and error results. The format is determined by the FAULT field. ATTR, bits [63:56] Memory attributes, in MAIR format. The reset behavior of this field is: • This field resets to an UNKNOWN value. ADDR, bits [55:12] Result address, bits [55:12]. • Address bits above and below [55:12] are treated as zero. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 693

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to an UNKNOWN value. Size, bit [11] Translation page/block size flag. The Size field allows the size of the translation to be determined, using an encoding in the ADDR field. The Size flag indicates that: Size Meaning 0b0 Translation is 4KB. 0b1 Translation is determined by position of lowest 1 bit in ADDR field. The reset behavior of this field is: • This field resets to an UNKNOWN value. NS, bit [10] Final NS attribute. • Note: This bit is RES0 in SMMU_GATOS_PAR and SMMU_VATOS_PAR. • Note: As Secure VATOS translations are for stage 1 only, there is no need to supply an input NS attribute value. Input NS attributes are not considered when stage 1 is configured for translation. If stage 1 is configured for bypass, the output NS attribute is IMPLEMENTATION DEFINED. See Section 9.1.3 *ATOS_ADDR. The reset behavior of this field is: • This field resets to an UNKNOWN value. SH, bits [9:8] Shareability attribute. SH Meaning 0b00 Non-shareable. 0b01 Reserved. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: Shareability is returned as Outer Shareable when ATTR selects any Device type. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [7:1] Reserved, RES0. FAULT, bit [0] Fault/error status. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 694

Chapter 6. Memory map and registers 6.3. Register formats FAULT Meaning 0b0 No fault. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_VATOS_PAR.FAULT == '1': 63 60 RES0 59 56 FADDR[55:12] 55 32 IMPLEMENTATION DEFINED FADDR[55:12] 31 12 FAULTCODE 11 4 3 REASON 2 1 0 NSIPA FAULT When FAULT == 1, the translation has failed and a fault syndrome is present: IMPLEMENTATION DEFINED, bits [63:60] IMPLEMENTATION DEFINED fault data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:56] Reserved, RES0. FADDR, bits [55:12] Fault page address, bits [55:12]. • Note: Because the ATOS_PAR.FADDR field returns a fault IPA only when an ATOS_ADDR.TYPE == 0b10 request is made, and VATOS_ADDR.TYPE must be 0b01, this field is always 0. The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULTCODE, bits [11:4] Fault/error code. • See section 9.1.4 ATOS_PAR for details. The reset behavior of this field is: • This field resets to an UNKNOWN value. NSIPA, bit [3] Fault IPA NS attribute. • Note: Because the ATOS_PAR.FADDR field returns a fault IPA only when an ATOS_ADDR.TYPE == 0b10 request is made, and VATOS_ADDR.TYPE must be 0b01, this field is always 0. See section 9.1.4 ATOS_PAR for details. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 695

Chapter 6. Memory map and registers 6.3. Register formats REASON, bits [2:1] Class of activity causing fault. • This indicates the stage and reason for the fault. The only value permitted in SMMU_S_VATOS_PAR.REASON is 0b00. See section 9.1.4 ATOS_PAR for details. REASON Meaning 0b00 Stage 1 translation-related fault occurred, or miscellaneous non-translation fault not attributable to a translation stage (for example, F_BAD_STE). 0b01 Reserved. 0b10 Reserved. 0b11 Reserved. The reset behavior of this field is: • This field resets to an UNKNOWN value. FAULT, bit [0] Fault/error status. FAULT Meaning 0b1 Fault or translation error. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_S_VATOS_PAR The content of ATOS_PAR registers is UNKNOWN if values in the ATOS register group are modified after a translation has been initiated by setting ATOS_CTRL.RUN == 1. See section 9.1.4 ATOS_PAR. This register has an UNKNOWN value if read when SMMU_S_VATOS_CTRL.RUN == 1. Accesses to this register use the following encodings: Accessible at offset 0x0A18 from SMMUv3_S_VATOS • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 696

Chapter 6. Memory map and registers 6.3. Register formats 6.3.142 SMMU_ECMDQ_BASE, n = 0 - 255 The SMMU_ECMDQ_BASE characteristics are: Purpose Configuration of the Command queue base address. Configuration There are no configuration notes. Attributes SMMU_ECMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_CMDQCP block. Field descriptions DM 63 RA 62 61 RES0 60 56 ADDR[55:5] 55 32 VSID ADDR[55:5] 31 5 LOG2SIZE 4 0 DM, bit [63] When SMMU_IDR6.DCMDQ == 1: Mode of the command queue for Non-secure state. DM Meaning 0b0 Queue is in regular mode. 0b1 Queue is in direct-mode. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. RA, bit [62] Non-secure state Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 697

Chapter 6. Memory map and registers 6.3. Register formats VSID, bit [61] When SMMU_IDR6.VSID == 1: SID translation is enabled on this queue for Non-secure state. VSID Meaning 0b0 SID translation is not enabled. 0b1 SID translation is enabled. This field is IGNORED when SMMU_ECMDQ_BASEn.DM == ‘0’. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [60:56] Reserved, RES0. ADDR, bits [55:5] Non-secure address of Command queue base, bits [55:5]. The reset behavior of this field is: • This field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Non-secure state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_CMDQ_BASE.LOG2SIZE. See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_ECMDQ_BASE There are many copies of the SMMU_ECMDQ_ registers. The offset presented here is for a group of ECMDQ registers at index n within a Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_CMDQCP • When SMMU_ECMDQ_PROD.EN == ‘0’ and SMMU_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 698

Chapter 6. Memory map and registers 6.3. Register formats • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 699

Chapter 6. Memory map and registers 6.3. Register formats 6.3.143 SMMU_ECMDQ_PROD, n = 0 - 255 The SMMU_ECMDQ_PROD characteristics are: Purpose Allows Command queue producer to update the write index. Configuration There are no configuration notes. Attributes SMMU_ECMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_CMDQCP block. Field descriptions EN 31 RES0 30 24 23 22 RES0 21 20 WR 19 0 ERRACK HS_ERRACK EN, bit [31] Non-secure state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Non-secure state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. When SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_IDR6.DCMDQ == 1, and SMMU_ECMDQ_BASE.DM == ‘1’, access to this field is RO. HS_ERRACK, bit [22] When SMMU_IDR6.DCMDQ == 1: Non-secure state hypervisor-serviced error status acknowledge. This field is IGNORED when SMMU_ECMDQ_BASEn.DM == ‘0’. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bits [21:20] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 700

Chapter 6. Memory map and registers 6.3. Register formats WR, bits [19:0] Non-secure state Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_CMDQ_PROD. QS is derived from SMMU_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_IDR6.DCMDQ == 1, and SMMU_ECMDQ_BASE.DM == ‘1’, access to this field is RO. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_ECMDQ_PROD There are many copies of the SMMU_ECMDQ_ registers. The offset presented here is for a group of ECMDQ registers at index n within a Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_CMDQCP • When SMMU_ECMDQ_PROD.EN == ‘0’ and SMMU_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_ECMDQ_PROD.EN == ‘1’ and SMMU_ECMDQ_CONS.ENACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 701

Chapter 6. Memory map and registers 6.3. Register formats 6.3.144 SMMU_ECMDQ_CONS, n = 0 - 255 The SMMU_ECMDQ_CONS characteristics are: Purpose Command queue consumer read index. Configuration There are no configuration notes. Attributes SMMU_ECMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_CMDQCP block. Field descriptions 31 30 29 27 26 24 ERR 23 22 21 20 RD 19 0 ENACK RES0 HS_ERR_REASON SYNTH_SYNC_ERR HS_ERR ERR_REASON ENACK, bit [31] Non-secure state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bit [30] Reserved, RES0. HS_ERR_REASON, bits [29:27] When SMMU_IDR6.DCMDQ == 1: Non-secure state hypervisor-serviced error reason code. HS_ERR_REASON Meaning 0b000 HERROR_NONE - No hypervisor-serviced error active. 0b001 HERROR_IPA - Fault during address translation. 0b010 HERROR_SID_EABT - External abort during SID translation. 0b011 HERROR_SID_CONFIG - Config error during SID translation. 0b100 HERROR_MSI_ABT - A CMD_SYNC MSI was terminated with an abort. HS_ERR_REASON is UNKNOWN if SMMU_ECMDQ_BASEn.DM == ‘0’. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 702

Chapter 6. Memory map and registers 6.3. Register formats HS_ERR_REASON is UNKNOWN if no hypervisor-serviced error is active. The HERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. ERR_REASON, bits [26:24] Non-secure state Error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if an error is not active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. ERR, bit [23] Non-secure state Error status. The reset behavior of this field is: • This field resets to '0'. HS_ERR, bit [22] When SMMU_IDR6.DCMDQ == 1: Non-secure state hypervisor-serviced error status. This field is UNKNOWN when SMMU_ECMDQ_BASEn.DM == ‘0’. When this field differs from SMMU_ECMDQ_PRODn.HS_ERRACK, a hypervisor-serviced error is active. When a hypervisor-serviced error is active, no commands are being fetched or consumed on the corresponding DCMDQ interface. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 703

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. SYNTH_SYNC_ERR, bits [21:20] When SMMU_IDR6.DCMDQ == 1: Non-secure Synthesized synchronization error report. SYNTH_SYNC_ERR Meaning 0b00 No pending errors. 0b01 Pending error due to a timed-out CMD_ATC_INV command. 0b10 Pending error due to an aborted MSI for the previous CMD_SYNC. 0b11 Pending errors due to both a timed-out CMD_ATC_INV command and an aborted MSI for the previous CMD_SYNC. SYNTH_SYNC_ERR is UNKNOWN if SMMU_ECMDQ_BASEn.DM == ‘0’. When a synthesized synchronization operation detects errors which are pending to be reported on a subsequent CMD_SYNC, it sets this field. See 3.5.7.6.1 Synthesized Synchronization. The reset behavior of this field is: • This field resets to '00'. Otherwise: Reserved, RES0. RD, bits [19:0] Non-secure state Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_CMDQ_CONS. QS is derived from SMMU_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_ECMDQ_CONS There are many copies of the SMMU_ECMDQ_* registers. The offset presented here is for a group of ECMDQ registers at index n within a Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 704

Chapter 6. Memory map and registers 6.3. Register formats Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)))* n) from SMMUv3_CMDQCP • When SMMU_ECMDQ_PROD.EN == ‘0’ and SMMU_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 705

Chapter 6. Memory map and registers 6.3. Register formats 6.3.145 SMMU_S_ECMDQ_BASE, n = 0 - 255 The SMMU_S_ECMDQ_BASE characteristics are: Purpose Configuration of the Secure state Command queue base address. Configuration There are no configuration notes. Attributes SMMU_S_ECMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_S_CMDQCP block. Field descriptions DM 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 ADDR[55:5] 31 5 LOG2SIZE 4 0 DM, bit [63] When SMMU_S_IDR6.DCMDQ == 1: Mode of the command queue for Secure state. DM Meaning 0b0 Queue is in regular mode. 0b1 Queue is in direct-mode. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. RA, bit [62] Secure state Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 706

Chapter 6. Memory map and registers 6.3. Register formats Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Secure address of Command queue base, bits [55:5]. The reset behavior of this field is: • This field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Secure state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_S_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_S_CMDQ_BASE.LOG2SIZE. See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_S_ECMDQ_BASE There are many copies of the SMMU_S_ECMDQ_ registers. The offset presented here is for a group of Secure ECMDQ registers at index n within a Secure Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_S_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_S_CMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_PROD.EN == ‘0’ and SMMU_S_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 707

Chapter 6. Memory map and registers 6.3. Register formats 6.3.146 SMMU_S_ECMDQ_PROD, n = 0 - 255 The SMMU_S_ECMDQ_PROD characteristics are: Purpose Allows Secure state Command queue producer to update the write index. Configuration There are no configuration notes. Attributes SMMU_S_ECMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_S_CMDQCP block. Field descriptions EN 31 RES0 30 24 23 22 RES0 21 20 WR 19 0 ERRACK HS_ERRACK EN, bit [31] Secure state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Secure state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. When SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_IDR6.DCMDQ == 1, and SMMU_S_ECMDQ_BASE.DM == ‘1’, access to this field is RO. HS_ERRACK, bit [22] When SMMU_S_IDR6.DCMDQ == 1: Secure state hypervisor-serviced error status acknowledge. This field is IGNORED when SMMU_S_ECMDQ_BASEn.DM == ‘0’. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bits [21:20] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 708

Chapter 6. Memory map and registers 6.3. Register formats WR, bits [19:0] Secure state Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_S_CMDQ_PROD. QS is derived from SMMU_S_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_IDR6.DCMDQ == 1, and SMMU_S_ECMDQ_BASE.DM == ‘1’, access to this field is RO. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_S_ECMDQ_PROD There are many copies of the SMMU_S_ECMDQ_ registers. The offset presented here is for a group of Secure ECMDQ registers at index n within a Secure Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_S_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_S_CMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_PROD.EN == ‘0’ and SMMU_S_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_S_ECMDQ_PROD.EN == ‘1’ and SMMU_S_ECMDQ_CONS.ENACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 709

Chapter 6. Memory map and registers 6.3. Register formats 6.3.147 SMMU_S_ECMDQ_CONS, n = 0 - 255 The SMMU_S_ECMDQ_CONS characteristics are: Purpose Secure state Command queue consumer read index. Configuration There are no configuration notes. Attributes SMMU_S_ECMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_S_CMDQCP block. Field descriptions 31 30 29 27 26 24 ERR 23 22 21 20 RD 19 0 ENACK RES0 HS_ERR_REASON SYNTH_SYNC_ERR HS_ERR ERR_REASON ENACK, bit [31] Secure state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bit [30] Reserved, RES0. HS_ERR_REASON, bits [29:27] When SMMU_S_IDR6.DCMDQ == 1: Secure state hypervisor-serviced error reason code. HS_ERR_REASON Meaning 0b000 HERROR_NONE - No hypervisor-serviced error active. 0b001 HERROR_IPA - Fault during address translation. 0b010 HERROR_SID_EABT - External abort during SID translation. 0b011 HERROR_SID_CONFIG - Config error during SID translation. 0b100 HERROR_MSI_ABT - A CMD_SYNC MSI was terminated with an abort. HS_ERR_REASON is UNKNOWN if SMMU_S_ECMDQ_BASEn.DM == ‘0’. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 710

Chapter 6. Memory map and registers 6.3. Register formats HS_ERR_REASON is UNKNOWN if no hypervisor-serviced error is active. The HERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. ERR_REASON, bits [26:24] Secure state Error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if an error is not active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. ERR, bit [23] Secure state Error status. The reset behavior of this field is: • This field resets to '0'. HS_ERR, bit [22] When SMMU_S_IDR6.DCMDQ == 1: Secure state hypervisor-serviced error status. This field is UNKNOWN when SMMU_S_ECMDQ_BASEn.DM == ‘0’. When this field differs from SMMU_S_ECMDQ_PRODn.HS_ERRACK, a hypervisor-serviced error is active. When a hypervisor-serviced error is active, no commands are being fetched or consumed on the corresponding DCMDQ interface. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 711

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. SYNTH_SYNC_ERR, bits [21:20] When SMMU_S_IDR6.DCMDQ == 1: Secure Synthesized synchronization error report. SYNTH_SYNC_ERR Meaning 0b00 No pending errors. 0b01 Pending error due to a timed-out CMD_ATC_INV command. 0b10 Pending error due to an aborted MSI for the previous CMD_SYNC. 0b11 Pending errors due to both a timed-out CMD_ATC_INV command and an aborted MSI for the previous CMD_SYNC. SYNTH_SYNC_ERR is UNKNOWN if SMMU_S_ECMDQ_BASEn.DM == ‘0’. When a synthesized synchronization operation detects errors which are pending to be reported on a subsequent CMD_SYNC, it sets this field. See 3.5.7.6.1 Synthesized Synchronization. The reset behavior of this field is: • This field resets to '00'. Otherwise: Reserved, RES0. RD, bits [19:0] Secure state Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_S_CMDQ_CONS. QS is derived from SMMU_S_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_S_ECMDQ_CONS There are many copies of the SMMU_S_ECMDQ_* registers. The offset presented here is for a group of Secure ECMDQ registers at index n within a Secure Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 712

Chapter 6. Memory map and registers 6.3. Register formats Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_S_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)))* n) from SMMUv3_S_CMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_PROD.EN == ‘0’ and SMMU_S_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 713

Chapter 6. Memory map and registers 6.3. Register formats 6.3.148 SMMU_R_ECMDQ_BASE, n = 0 - 255 The SMMU_R_ECMDQ_BASE characteristics are: Purpose Configuration of the Realm state Command queue base address. Configuration There are no configuration notes. Attributes SMMU_R_ECMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_R_CMDQCP block. Field descriptions DM 63 RA 62 61 RES0 60 56 ADDR[55:5] 55 32 VSID ADDR[55:5] 31 5 LOG2SIZE 4 0 DM, bit [63] When SMMU_R_IDR6.DCMDQ == 1: Mode of the command queue for Realm state. DM Meaning 0b0 Queue is in regular mode. 0b1 Queue is in direct-mode. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. RA, bit [62] Realm state Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 714

Chapter 6. Memory map and registers 6.3. Register formats VSID, bit [61] When SMMU_R_IDR6.VSID == 1: SID translation is enabled on this queue for Realm state. VSID Meaning 0b0 SID translation is not enabled. 0b1 SID translation is enabled. This field is IGNORED when SMMU_R_ECMDQ_BASEn.DM == ‘0’. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [60:56] Reserved, RES0. ADDR, bits [55:5] Realm address of Command queue base, bits [55:5]. The reset behavior of this field is: • This field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Realm state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_R_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_R_CMDQ_BASE.LOG2SIZE. See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_R_ECMDQ_BASE There are many copies of the SMMU_R_ECMDQ_ registers. The offset presented here is for a group of Realm ECMDQ registers at index n within a Realm Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_R_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_R_CMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 715

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_R_ECMDQ_PROD.EN == ‘0’ and SMMU_R_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 716

Chapter 6. Memory map and registers 6.3. Register formats 6.3.149 SMMU_R_ECMDQ_PROD, n = 0 - 255 The SMMU_R_ECMDQ_PROD characteristics are: Purpose Allows Realm state Command queue producer to update the write index. Configuration There are no configuration notes. Attributes SMMU_R_ECMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_R_CMDQCP block. Field descriptions EN 31 RES0 30 24 23 22 RES0 21 20 WR 19 0 ERRACK HS_ERRACK EN, bit [31] Realm state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Realm state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. When SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_IDR6.DCMDQ == 1, and SMMU_R_ECMDQ_BASE.DM == ‘1’, access to this field is RO. HS_ERRACK, bit [22] When SMMU_R_IDR6.DCMDQ == 1: Realm state hypervisor-serviced error status acknowledge. This field is IGNORED when SMMU_R_ECMDQ_BASEn.DM == ‘0’. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bits [21:20] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 717

Chapter 6. Memory map and registers 6.3. Register formats WR, bits [19:0] Realm state Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_R_CMDQ_PROD. QS is derived from SMMU_R_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_IDR6.DCMDQ == 1, and SMMU_R_ECMDQ_BASE.DM == ‘1’, access to this field is RO. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_R_ECMDQ_PROD There are many copies of the SMMU_R_ECMDQ_ registers. The offset presented here is for a group of Realm ECMDQ registers at index n within a Realm Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_R_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_R_CMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_PROD.EN == ‘0’ and SMMU_R_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_R_ECMDQ_PROD.EN == ‘1’ and SMMU_R_ECMDQ_CONS.ENACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 718

Chapter 6. Memory map and registers 6.3. Register formats 6.3.150 SMMU_R_ECMDQ_CONS, n = 0 - 255 The SMMU_R_ECMDQ_CONS characteristics are: Purpose Realm state Command queue consumer read index. Configuration There are no configuration notes. Attributes SMMU_R_ECMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_R_CMDQCP block. Field descriptions 31 30 29 27 26 24 ERR 23 22 21 20 RD 19 0 ENACK RES0 HS_ERR_REASON SYNTH_SYNC_ERR HS_ERR ERR_REASON ENACK, bit [31] Realm state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bit [30] Reserved, RES0. HS_ERR_REASON, bits [29:27] When SMMU_R_IDR6.DCMDQ == 1: Realm state hypervisor-serviced error reason code. HS_ERR_REASON Meaning 0b000 HERROR_NONE - No hypervisor-serviced error active. 0b001 HERROR_IPA - Fault during address translation. 0b010 HERROR_SID_EABT - External abort during SID translation. 0b011 HERROR_SID_CONFIG - Config error during SID translation. 0b100 HERROR_MSI_ABT - A CMD_SYNC MSI was terminated with an abort. HS_ERR_REASON is UNKNOWN if SMMU_R_ECMDQ_BASEn.DM == ‘0’. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 719

Chapter 6. Memory map and registers 6.3. Register formats HS_ERR_REASON is UNKNOWN if no hypervisor-serviced error is active. The HERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. ERR_REASON, bits [26:24] Realm state Error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if an error is not active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. The reset behavior of this field is: • This field resets to an UNKNOWN value. ERR, bit [23] Realm state Error status. The reset behavior of this field is: • This field resets to '0'. HS_ERR, bit [22] When SMMU_R_IDR6.DCMDQ == 1: Realm state hypervisor-serviced error status. This field is UNKNOWN when SMMU_R_ECMDQ_BASEn.DM == ‘0’. When this field differs from SMMU_R_ECMDQ_PRODn.HS_ERRACK, a hypervisor-serviced error is active. When a hypervisor-serviced error is active, no commands are being fetched or consumed on the corresponding DCMDQ interface. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 720

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. SYNTH_SYNC_ERR, bits [21:20] When SMMU_R_IDR6.DCMDQ == 1: Realm Synthesized synchronization error report. SYNTH_SYNC_ERR Meaning 0b00 No pending errors. 0b01 Pending error due to a timed-out CMD_ATC_INV command. 0b10 Pending error due to an aborted MSI for the previous CMD_SYNC. 0b11 Pending errors due to both a timed-out CMD_ATC_INV command and an aborted MSI for the previous CMD_SYNC. SYNTH_SYNC_ERR is UNKNOWN if SMMU_R_ECMDQ_BASEn.DM == ‘0’. When a synthesized synchronization operation detects errors which are pending to be reported on a subsequent CMD_SYNC, it sets this field. See 3.5.7.6.1 Synthesized Synchronization. The reset behavior of this field is: • This field resets to '00'. Otherwise: Reserved, RES0. RD, bits [19:0] Realm state Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_R_CMDQ_CONS. QS is derived from SMMU_R_ECMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. Accessing SMMU_R_ECMDQ_CONS There are many copies of the SMMU_R_ECMDQ_* registers. The offset presented here is for a group of Realm ECMDQ registers at index n within a Realm Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 721

Chapter 6. Memory map and registers 6.3. Register formats Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_R_IDR6.CMDQ_CONTROL_PAGE_LOG2NUMQ)))* n) from SMMUv3_R_CMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_PROD.EN == ‘0’ and SMMU_R_ECMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 722

Chapter 6. Memory map and registers 6.3. Register formats 6.3.151 SMMU_DCMDQ_BASE, n = 0 - 255 The SMMU_DCMDQ_BASE characteristics are: Purpose Non-secure state configuration of the Direct Command queue base address. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_DCMDQ_BASE are RES0. Attributes SMMU_DCMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_DCMDQCP block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Non-secure state Read-Allocate. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Non-secure state address of Direct Command queue base, bits [55:5]. The address in this field is translated by the SMMU, for all enabled stages of translation according to STE.Config and STE.STRW. For more information, see 3.5.7.3.2 Stream Table Entry (STE). The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 723

Chapter 6. Memory map and registers 6.3. Register formats LOG2SIZE, bits [4:0] Non-secure state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_CMDQ_BASE.LOG2SIZE. See section 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_DCMDQ_BASE There are many copies of the SMMU_DCMDQ_ registers. The offset presented here is for a group of DCMDQ registers at index n within a Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.1 Memory map. Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_DCMDQCP • When SMMU_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_BASE.DM == ‘1’, SMMU_DCMDQ_CONS.ENACK == ‘0’, and SMMU_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 724

Chapter 6. Memory map and registers 6.3. Register formats 6.3.152 SMMU_DCMDQ_PROD, n = 0 - 255 The SMMU_DCMDQ_PROD characteristics are: Purpose Allows Direct Command queue producer to update the write index in Non-secure state. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_DCMDQ_PROD are RES0. Attributes SMMU_DCMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_DCMDQCP block. Field descriptions EN 31 RES0 30 24 23 RES0 22 20 WR 19 0 ERRACK EN, bit [31] Non-secure state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Non-secure state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. WR, bits [19:0] Non-secure state Direct Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_CMDQ_PROD. QS is derived from SMMU_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 725

Chapter 6. Memory map and registers 6.3. Register formats For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_DCMDQ_PROD There are many copies of the SMMU_DCMDQ_ registers. The offset presented here is for a group of DCMDQ registers at index n within a Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_DCMDQCP • When SMMU_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_BASE.DM == ‘1’, SMMU_DCMDQ_CONS.ENACK == ‘1’, and SMMU_DCMDQ_PROD.EN == ‘1’, accesses to this register are RW. • When SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_BASE.DM == ‘1’, SMMU_DCMDQ_CONS.ENACK == ‘0’, and SMMU_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 726

Chapter 6. Memory map and registers 6.3. Register formats 6.3.153 SMMU_DCMDQ_CONS, n = 0 - 255 The SMMU_DCMDQ_CONS characteristics are: Purpose Non-secure state Direct Command queue consumer read index. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_DCMDQ_CONS are RES0. Attributes SMMU_DCMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_DCMDQCP block. Field descriptions 31 RES0 30 27 26 24 ERR 23 RES0 22 20 RD 19 0 ENACK ERR_REASON ENACK, bit [31] Non-secure state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bits [30:27] Reserved, RES0. ERR_REASON, bits [26:24] Non-secure state error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if no error is active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 727

Chapter 6. Memory map and registers 6.3. Register formats ERR, bit [23] Non-secure state error status. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. RD, bits [19:0] Non-secure state Direct Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_CMDQ_CONS. QS is derived from SMMU_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_DCMDQ_CONS There are many copies of the SMMU_DCMDQ_ registers. The offset presented here is for a group of DCMDQ registers at index n within a Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_DCMDQCP • When SMMU_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_ECMDQ_CONS.ENACK == ‘1’, SMMU_ECMDQ_PROD.EN == ‘1’, SMMU_ECMDQ_BASE.DM == ‘1’, SMMU_DCMDQ_CONS.ENACK == ‘0’, and SMMU_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 728

Chapter 6. Memory map and registers 6.3. Register formats 6.3.154 SMMU_S_DCMDQ_BASE, n = 0 - 255 The SMMU_S_DCMDQ_BASE characteristics are: Purpose Secure state configuration of the Direct Command queue base address. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_DCMDQ_BASE are RES0. Attributes SMMU_S_DCMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_S_DCMDQCP block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Secure state Read-Allocate. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Secure state address of Direct Command queue base, bits [55:5]. The address in this field is translated by the SMMU, for all enabled stages of translation according to STE.Config and STE.STRW. For more information, see 3.5.7.3.2 Stream Table Entry (STE). The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 729

Chapter 6. Memory map and registers 6.3. Register formats LOG2SIZE, bits [4:0] Secure state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_S_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_S_CMDQ_BASE.LOG2SIZE. See section 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_S_DCMDQ_BASE There are many copies of the SMMU_S_DCMDQ_ registers. The offset presented here is for a group of Secure DCMDQ registers at index n within a Secure Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.1 Memory map. Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_S_DCMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_BASE.DM == ‘1’, SMMU_S_DCMDQ_PROD.EN == ‘0’, and SMMU_S_DCMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_S_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 730

Chapter 6. Memory map and registers 6.3. Register formats 6.3.155 SMMU_S_DCMDQ_PROD, n = 0 - 255 The SMMU_S_DCMDQ_PROD characteristics are: Purpose Allows Direct Command queue producer to update the write index for Secure state. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_DCMDQ_PROD are RES0. Attributes SMMU_S_DCMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_S_DCMDQCP block. Field descriptions EN 31 RES0 30 24 23 RES0 22 20 WR 19 0 ERRACK EN, bit [31] Secure state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Secure state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. WR, bits [19:0] Secure state Direct Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_S_CMDQ_PROD. QS is derived from SMMU_S_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 731

Chapter 6. Memory map and registers 6.3. Register formats For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_S_DCMDQ_PROD There are many copies of the SMMU_S_DCMDQ_ registers. The offset presented here is for a group of Secure DCMDQ registers at index n within a Secure Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_S_DCMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_BASE.DM == ‘1’, SMMU_S_DCMDQ_PROD.EN == ‘1’, and SMMU_S_DCMDQ_CONS.ENACK == ‘1’, accesses to this register are RW. • When SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_BASE.DM == ‘1’, SMMU_S_DCMDQ_PROD.EN == ‘0’, and SMMU_S_DCMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_S_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 732

Chapter 6. Memory map and registers 6.3. Register formats 6.3.156 SMMU_S_DCMDQ_CONS, n = 0 - 255 The SMMU_S_DCMDQ_CONS characteristics are: Purpose Secure state Direct Command queue consumer read index. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_DCMDQ_CONS are RES0. Attributes SMMU_S_DCMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_S_DCMDQCP block. Field descriptions 31 RES0 30 27 26 24 ERR 23 RES0 22 20 RD 19 0 ENACK ERR_REASON ENACK, bit [31] Secure state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bits [30:27] Reserved, RES0. ERR_REASON, bits [26:24] Secure state error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if no error is active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 733

Chapter 6. Memory map and registers 6.3. Register formats ERR, bit [23] Secure state error status. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. RD, bits [19:0] Secure state Direct Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_S_CMDQ_CONS. QS is derived from SMMU_S_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_S_DCMDQ_CONS There are many copies of the SMMU_S_DCMDQ_ registers. The offset presented here is for a group of Secure DCMDQ registers at index n within a Secure Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_S_DCMDQCP • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_S_ECMDQ_CONS.ENACK == ‘1’, SMMU_S_ECMDQ_PROD.EN == ‘1’, SMMU_S_ECMDQ_BASE.DM == ‘1’, SMMU_S_DCMDQ_PROD.EN == ‘0’, and SMMU_S_DCMDQ_CONS.ENACK == ‘0’, accesses to this register are RW. • When SMMU_S_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 734

Chapter 6. Memory map and registers 6.3. Register formats 6.3.157 SMMU_R_DCMDQ_BASE, n = 0 - 255 The SMMU_R_DCMDQ_BASE characteristics are: Purpose Realm state configuration of the Direct Command queue base address. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_DCMDQ_BASE are RES0. Attributes SMMU_R_DCMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_R_DCMDQCP block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Realm state Read-Allocate. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Realm state address of Direct Command queue base, bits [55:5]. The address in this field is translated by the SMMU, for all enabled stages of translation according to STE.Config and STE.STRW. For more information, see 3.5.7.3.2 Stream Table Entry (STE). The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 735

Chapter 6. Memory map and registers 6.3. Register formats LOG2SIZE, bits [4:0] Realm state queue size as log2(entries). The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information The fields in this register all have equivalent meaning to the corresponding fields in SMMU_R_CMDQ_BASE. LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS, with the same constraints as SMMU_R_CMDQ_BASE.LOG2SIZE. See section 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_R_DCMDQ_BASE There are many copies of the SMMU_R_DCMDQ_ registers. The offset presented here is for a group of Realm DCMDQ registers at index n within a Realm Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.1 Memory map. Accesses to this register use the following encodings: Accessible at offset 0x00 + ((2 ^ (16 - UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_R_DCMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_BASE.DM == ‘1’, SMMU_R_DCMDQ_CONS.ENACK == ‘0’, and SMMU_R_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 736

Chapter 6. Memory map and registers 6.3. Register formats 6.3.158 SMMU_R_DCMDQ_PROD, n = 0 - 255 The SMMU_R_DCMDQ_PROD characteristics are: Purpose Allows Direct Command queue producer to update the write index for Realm state. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_DCMDQ_PROD are RES0. Attributes SMMU_R_DCMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_R_DCMDQCP block. Field descriptions EN 31 RES0 30 24 23 RES0 22 20 WR 19 0 ERRACK EN, bit [31] Realm state queue enable. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Bits [30:24] Reserved, RES0. ERRACK, bit [23] Realm state error status acknowledge. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. WR, bits [19:0] Realm state Direct Command queue write index. This field is treated as WR and WR_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_R_CMDQ_PROD. QS is derived from SMMU_R_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 737

Chapter 6. Memory map and registers 6.3. Register formats For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_R_DCMDQ_PROD There are many copies of the SMMU_R_DCMDQ_ registers. The offset presented here is for a group of Realm DCMDQ registers at index n within a Realm Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x08 + ((2 ^ (16 - UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_R_DCMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_BASE.DM == ‘1’, SMMU_R_DCMDQ_CONS.ENACK == ‘1’, and SMMU_R_DCMDQ_PROD.EN == ‘1’, accesses to this register are RW. • When SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_BASE.DM == ‘1’, SMMU_R_DCMDQ_CONS.ENACK == ‘0’, and SMMU_R_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 738

Chapter 6. Memory map and registers 6.3. Register formats 6.3.159 SMMU_R_DCMDQ_CONS, n = 0 - 255 The SMMU_R_DCMDQ_CONS characteristics are: Purpose Realm state Direct Command queue consumer read index. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_DCMDQ_CONS are RES0. Attributes SMMU_R_DCMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_R_DCMDQCP block. Field descriptions 31 RES0 30 27 26 24 ERR 23 RES0 22 20 RD 19 0 ENACK ERR_REASON ENACK, bit [31] Realm state queue enable acknowledge. See 3.5.7.5.1 Effects of Updating SMMU_ECMDQ_PROD.EN on a DCMDQ. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. Bits [30:27] Reserved, RES0. ERR_REASON, bits [26:24] Realm state error reason code. ERR_REASON Meaning 0b000 CERROR_NONE - No error. 0b001 CERROR_ILL - Command illegal and cannot be correctly consumed. 0b010 CERROR_ABT - Abort on command fetch. 0b011 CERROR_ATC_INV_SYNC - A CMD_SYNC failed to successfully complete one or more previous CMD_ATC_INV commands. ERR_REASON is UNKNOWN if no error is active. The CERROR_NONE encoding is defined for completeness only, and is not provided by the SMMU in any error case. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 739

Chapter 6. Memory map and registers 6.3. Register formats ERR, bit [23] Realm state error status. The reset behavior of this field is: • This field resets to '0'. Bits [22:20] Reserved, RES0. RD, bits [19:0] Realm state Direct Command queue read index. This field is treated as RD and RD_WRAP sub-fields, with equivalent meaning to the corresponding fields in SMMU_R_CMDQ_CONS. QS is derived from SMMU_R_DCMDQ_BASEn.LOG2SIZE with the same constraints as for other queues. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See sections 3.5.6.2 Enabling and disabling an ECMDQ interface and 3.5.6.3 Errors relating to an ECMDQ interface. For information on the observable values when the SMMU comes out of reset, see 3.5.7.1 Configuration of ECMDQ and DCMDQ interfaces. Accessing SMMU_R_DCMDQ_CONS There are many copies of the SMMU_R_DCMDQ_ registers. The offset presented here is for a group of Realm DCMDQ registers at index n within a Realm Direct Command queue control page. For the definition of how the groups are organised in memory, see section 6.2.5 Registers in a Command queue control page . Accesses to this register use the following encodings: Accessible at offset 0x0C + ((2 ^ (16 - UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMQ))) n) from SMMUv3_R_DCMDQCP • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_BASE.DM == ‘0’, accesses to this register are RAZ/WI. • When SMMU_R_ECMDQ_CONS.ENACK == ‘1’, SMMU_R_ECMDQ_PROD.EN == ‘1’, SMMU_R_ECMDQ_BASE.DM == ‘1’, SMMU_R_DCMDQ_CONS.ENACK == ‘0’, and SMMU_R_DCMDQ_PROD.EN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 740

Chapter 6. Memory map and registers 6.3. Register formats 6.3.160 SMMU_DCMDQP_ERR, n = 0 - 1023 The SMMU_DCMDQP_ERR characteristics are: Purpose Error reporting for DCMDQ control pages. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_DCMDQP_ERR are RES0. Attributes SMMU_DCMDQP_ERR is a 64-bit register. This register is part of the SMMUv3_DCMDQP_NS_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERR63 DCMDQP_ERR 62 DCMDQP_ERR61 DCMDQP_ERR60 DCMDQP_ERR59 DCMDQP_ERR58 DCMDQP_ERR57 DCMDQP_ERR56 DCMDQP_ERR55 DCMDQP_ERR54 DCMDQP_ERR53 DCMDQP_ERR52 DCMDQP_ERR51 DCMDQP_ERR50 DCMDQP_ERR49 DCMDQP_ERR48 DCMDQP_ ERR32 DCMDQP_ERR 33 DCMDQP_ERR34 DCMDQP_ERR35 DCMDQP_ERR36 DCMDQP_ERR37 DCMDQP_ERR38 DCMDQP_ERR39 DCMDQP_ERR40 DCMDQP_ERR41 DCMDQP_ERR42 DCMDQP_ERR43 DCMDQP_ERR44 DCMDQP_ERR45 DCMDQP_ERR46 DCMDQP_ERR47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERR31 DCMDQP_ERR 30 DCMDQP_ERR29 DCMDQP_ERR28 DCMDQP_ERR27 DCMDQP_ERR26 DCMDQP_ERR25 DCMDQP_ERR24 DCMDQP_ERR23 DCMDQP_ERR22 DCMDQP_ERR21 DCMDQP_ERR20 DCMDQP_ERR19 DCMDQP_ERR18 DCMDQP_ERR17 DCMDQP_ERR16 DCMDQP_ ERR0 DCMDQP_ERR 1 DCMDQP_ERR2 DCMDQP_ERR3 DCMDQP_ERR4 DCMDQP_ERR5 DCMDQP_ERR6 DCMDQP_ERR7 DCMDQP_ERR8 DCMDQP_ERR9 DCMDQP_ERR10 DCMDQP_ERR11 DCMDQP_ERR12 DCMDQP_ERR13 DCMDQP_ERR14 DCMDQP_ERR15 DCMDQP_ERR

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 741

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Non-secure state. SMMU_DCMDQP_ERRn.DCMDQP_ERRp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_DCMDQP_ERRNn.DCMDQP_ERRNp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RO. • Otherwise, access to this field is RES0. Accessing SMMU_DCMDQP_ERR These registers are only present when SMMU_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0x0000 + (0x8 * n) from SMMUv3_DCMDQP_NS_GLOBAL • When (n * 64) >= (2 ˆ UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 742

Chapter 6. Memory map and registers 6.3. Register formats 6.3.161 SMMU_DCMDQP_ERRN, n = 0 - 1023 The SMMU_DCMDQP_ERRN characteristics are: Purpose Error acknowledge for DCMDQ control pages. Configuration This register is present only when SMMU_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_DCMDQP_ERRN are RES0. Attributes SMMU_DCMDQP_ERRN is a 64-bit register. This register is part of the SMMUv3_DCMDQP_NS_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERRN63 DCMDQP_ERR N62 DCMDQP_ERRN61 DCMDQP_ERRN60 DCMDQP_ERRN59 DCMDQP_ERRN58 DCMDQP_ERRN57 DCMDQP_ERRN56 DCMDQP_ERRN55 DCMDQP_ERRN54 DCMDQP_ERRN53 DCMDQP_ERRN52 DCMDQP_ERRN51 DCMDQP_ERRN50 DCMDQP_ERRN49 DCMDQP_ERRN48 DCMDQP_ ERRN32 DCMDQP_ERR N33 DCMDQP_ERRN34 DCMDQP_ERRN35 DCMDQP_ERRN36 DCMDQP_ERRN37 DCMDQP_ERRN38 DCMDQP_ERRN39 DCMDQP_ERRN40 DCMDQP_ERRN41 DCMDQP_ERRN42 DCMDQP_ERRN43 DCMDQP_ERRN44 DCMDQP_ERRN45 DCMDQP_ERRN46 DCMDQP_ERRN47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERRN31 DCMDQP_ERR N30 DCMDQP_ERRN29 DCMDQP_ERRN28 DCMDQP_ERRN27 DCMDQP_ERRN26 DCMDQP_ERRN25 DCMDQP_ERRN24 DCMDQP_ERRN23 DCMDQP_ERRN22 DCMDQP_ERRN21 DCMDQP_ERRN20 DCMDQP_ERRN19 DCMDQP_ERRN18 DCMDQP_ERRN17 DCMDQP_ERRN16 DCMDQP_ ERRN0 DCMDQP_ERR N1 DCMDQP_ERRN2 DCMDQP_ERRN3 DCMDQP_ERRN4 DCMDQP_ERRN5 DCMDQP_ERRN6 DCMDQP_ERRN7 DCMDQP_ERRN8 DCMDQP_ERRN9 DCMDQP_ERRN10 DCMDQP_ERRN11 DCMDQP_ERRN12 DCMDQP_ERRN13 DCMDQP_ERRN14 DCMDQP_ERRN15 DCMDQP_ERRN

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 743

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Non-secure state. SMMU_DCMDQP_ERRNn.DCMDQP_ERRNp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_DCMDQP_ERRn.DCMDQP_ERRp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RW. • Otherwise, access to this field is RAZ/WI. Accessing SMMU_DCMDQP_ERRN These registers are only present when SMMU_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0xE000 + (0x8 * n) from SMMUv3_DCMDQP_NS_GLOBAL • When (n * 64) >= (2 ˆ UInt(SMMU_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 744

Chapter 6. Memory map and registers 6.3. Register formats 6.3.162 SMMU_R_DCMDQP_ERR, n = 0 - 1023 The SMMU_R_DCMDQP_ERR characteristics are: Purpose Error reporting for DCMDQ control pages in Realm state. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_DCMDQP_ERR are RES0. Attributes SMMU_R_DCMDQP_ERR is a 64-bit register. This register is part of the SMMUv3_DCMDQP_R_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERR63 DCMDQP_ERR 62 DCMDQP_ERR61 DCMDQP_ERR60 DCMDQP_ERR59 DCMDQP_ERR58 DCMDQP_ERR57 DCMDQP_ERR56 DCMDQP_ERR55 DCMDQP_ERR54 DCMDQP_ERR53 DCMDQP_ERR52 DCMDQP_ERR51 DCMDQP_ERR50 DCMDQP_ERR49 DCMDQP_ERR48 DCMDQP_ ERR32 DCMDQP_ERR 33 DCMDQP_ERR34 DCMDQP_ERR35 DCMDQP_ERR36 DCMDQP_ERR37 DCMDQP_ERR38 DCMDQP_ERR39 DCMDQP_ERR40 DCMDQP_ERR41 DCMDQP_ERR42 DCMDQP_ERR43 DCMDQP_ERR44 DCMDQP_ERR45 DCMDQP_ERR46 DCMDQP_ERR47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERR31 DCMDQP_ERR 30 DCMDQP_ERR29 DCMDQP_ERR28 DCMDQP_ERR27 DCMDQP_ERR26 DCMDQP_ERR25 DCMDQP_ERR24 DCMDQP_ERR23 DCMDQP_ERR22 DCMDQP_ERR21 DCMDQP_ERR20 DCMDQP_ERR19 DCMDQP_ERR18 DCMDQP_ERR17 DCMDQP_ERR16 DCMDQP_ ERR0 DCMDQP_ERR 1 DCMDQP_ERR2 DCMDQP_ERR3 DCMDQP_ERR4 DCMDQP_ERR5 DCMDQP_ERR6 DCMDQP_ERR7 DCMDQP_ERR8 DCMDQP_ERR9 DCMDQP_ERR10 DCMDQP_ERR11 DCMDQP_ERR12 DCMDQP_ERR13 DCMDQP_ERR14 DCMDQP_ERR15 DCMDQP_ERR

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 745

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Realm state. SMMU_R_DCMDQP_ERRn.DCMDQP_ERRp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_R_DCMDQP_ERRNn.DCMDQP_ERRNp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RO. • Otherwise, access to this field is RES0. Accessing SMMU_R_DCMDQP_ERR These registers are only present when SMMU_R_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0x0000 + (0x8 * n) from SMMUv3_DCMDQP_R_GLOBAL • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When (n * 64) >= (2 ˆ UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 746

Chapter 6. Memory map and registers 6.3. Register formats 6.3.163 SMMU_R_DCMDQP_ERRN, n = 0 - 1023 The SMMU_R_DCMDQP_ERRN characteristics are: Purpose Error acknowledge for DCMDQ control pages in Realm state. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_DCMDQP_ERRN are RES0. Attributes SMMU_R_DCMDQP_ERRN is a 64-bit register. This register is part of the SMMUv3_DCMDQP_R_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERRN63 DCMDQP_ERR N62 DCMDQP_ERRN61 DCMDQP_ERRN60 DCMDQP_ERRN59 DCMDQP_ERRN58 DCMDQP_ERRN57 DCMDQP_ERRN56 DCMDQP_ERRN55 DCMDQP_ERRN54 DCMDQP_ERRN53 DCMDQP_ERRN52 DCMDQP_ERRN51 DCMDQP_ERRN50 DCMDQP_ERRN49 DCMDQP_ERRN48 DCMDQP_ ERRN32 DCMDQP_ERR N33 DCMDQP_ERRN34 DCMDQP_ERRN35 DCMDQP_ERRN36 DCMDQP_ERRN37 DCMDQP_ERRN38 DCMDQP_ERRN39 DCMDQP_ERRN40 DCMDQP_ERRN41 DCMDQP_ERRN42 DCMDQP_ERRN43 DCMDQP_ERRN44 DCMDQP_ERRN45 DCMDQP_ERRN46 DCMDQP_ERRN47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERRN31 DCMDQP_ERR N30 DCMDQP_ERRN29 DCMDQP_ERRN28 DCMDQP_ERRN27 DCMDQP_ERRN26 DCMDQP_ERRN25 DCMDQP_ERRN24 DCMDQP_ERRN23 DCMDQP_ERRN22 DCMDQP_ERRN21 DCMDQP_ERRN20 DCMDQP_ERRN19 DCMDQP_ERRN18 DCMDQP_ERRN17 DCMDQP_ERRN16 DCMDQP_ ERRN0 DCMDQP_ERR N1 DCMDQP_ERRN2 DCMDQP_ERRN3 DCMDQP_ERRN4 DCMDQP_ERRN5 DCMDQP_ERRN6 DCMDQP_ERRN7 DCMDQP_ERRN8 DCMDQP_ERRN9 DCMDQP_ERRN10 DCMDQP_ERRN11 DCMDQP_ERRN12 DCMDQP_ERRN13 DCMDQP_ERRN14 DCMDQP_ERRN15 DCMDQP_ERRN

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 747

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Realm state. SMMU_R_DCMDQP_ERRNn.DCMDQP_ERRNp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_R_DCMDQP_ERRn.DCMDQP_ERRp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RW. • Otherwise, access to this field is RAZ/WI. Accessing SMMU_R_DCMDQP_ERRN These registers are only present when SMMU_R_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0xE000 + (0x8 * n) from SMMUv3_DCMDQP_R_GLOBAL • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When (n * 64) >= (2 ˆ UInt(SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 748

Chapter 6. Memory map and registers 6.3. Register formats 6.3.164 SMMU_S_DCMDQP_ERR, n = 0 - 1023 The SMMU_S_DCMDQP_ERR characteristics are: Purpose Error reporting for DCMDQ control pages in Secure state. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_DCMDQP_ERR are RES0. Attributes SMMU_S_DCMDQP_ERR is a 64-bit register. This register is part of the SMMUv3_DCMDQP_S_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERR63 DCMDQP_ERR 62 DCMDQP_ERR61 DCMDQP_ERR60 DCMDQP_ERR59 DCMDQP_ERR58 DCMDQP_ERR57 DCMDQP_ERR56 DCMDQP_ERR55 DCMDQP_ERR54 DCMDQP_ERR53 DCMDQP_ERR52 DCMDQP_ERR51 DCMDQP_ERR50 DCMDQP_ERR49 DCMDQP_ERR48 DCMDQP_ ERR32 DCMDQP_ERR 33 DCMDQP_ERR34 DCMDQP_ERR35 DCMDQP_ERR36 DCMDQP_ERR37 DCMDQP_ERR38 DCMDQP_ERR39 DCMDQP_ERR40 DCMDQP_ERR41 DCMDQP_ERR42 DCMDQP_ERR43 DCMDQP_ERR44 DCMDQP_ERR45 DCMDQP_ERR46 DCMDQP_ERR47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERR31 DCMDQP_ERR 30 DCMDQP_ERR29 DCMDQP_ERR28 DCMDQP_ERR27 DCMDQP_ERR26 DCMDQP_ERR25 DCMDQP_ERR24 DCMDQP_ERR23 DCMDQP_ERR22 DCMDQP_ERR21 DCMDQP_ERR20 DCMDQP_ERR19 DCMDQP_ERR18 DCMDQP_ERR17 DCMDQP_ERR16 DCMDQP_ ERR0 DCMDQP_ERR 1 DCMDQP_ERR2 DCMDQP_ERR3 DCMDQP_ERR4 DCMDQP_ERR5 DCMDQP_ERR6 DCMDQP_ERR7 DCMDQP_ERR8 DCMDQP_ERR9 DCMDQP_ERR10 DCMDQP_ERR11 DCMDQP_ERR12 DCMDQP_ERR13 DCMDQP_ERR14 DCMDQP_ERR15 DCMDQP_ERR

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 749

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Secure state. SMMU_S_DCMDQP_ERRn.DCMDQP_ERRp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_S_DCMDQP_ERRNn.DCMDQP_ERRNp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RO. • Otherwise, access to this field is RES0. Accessing SMMU_S_DCMDQP_ERR These registers are only present when SMMU_S_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0x0000 + (0x8 * n) from SMMUv3_DCMDQP_S_GLOBAL • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When (n * 64) >= (2 ˆ UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 750

Chapter 6. Memory map and registers 6.3. Register formats 6.3.165 SMMU_S_DCMDQP_ERRN, n = 0 - 1023 The SMMU_S_DCMDQP_ERRN characteristics are: Purpose Error acknowledge for DCMDQ control pages in Secure state. Configuration This register is present only when SMMU_S_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_S_DCMDQP_ERRN are RES0. Attributes SMMU_S_DCMDQP_ERRN is a 64-bit register. This register is part of the SMMUv3_DCMDQP_S_GLOBAL block. Field descriptions 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 DCMDQP_ ERRN63 DCMDQP_ERR N62 DCMDQP_ERRN61 DCMDQP_ERRN60 DCMDQP_ERRN59 DCMDQP_ERRN58 DCMDQP_ERRN57 DCMDQP_ERRN56 DCMDQP_ERRN55 DCMDQP_ERRN54 DCMDQP_ERRN53 DCMDQP_ERRN52 DCMDQP_ERRN51 DCMDQP_ERRN50 DCMDQP_ERRN49 DCMDQP_ERRN48 DCMDQP_ ERRN32 DCMDQP_ERR N33 DCMDQP_ERRN34 DCMDQP_ERRN35 DCMDQP_ERRN36 DCMDQP_ERRN37 DCMDQP_ERRN38 DCMDQP_ERRN39 DCMDQP_ERRN40 DCMDQP_ERRN41 DCMDQP_ERRN42 DCMDQP_ERRN43 DCMDQP_ERRN44 DCMDQP_ERRN45 DCMDQP_ERRN46 DCMDQP_ERRN47 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ ERRN31 DCMDQP_ERR N30 DCMDQP_ERRN29 DCMDQP_ERRN28 DCMDQP_ERRN27 DCMDQP_ERRN26 DCMDQP_ERRN25 DCMDQP_ERRN24 DCMDQP_ERRN23 DCMDQP_ERRN22 DCMDQP_ERRN21 DCMDQP_ERRN20 DCMDQP_ERRN19 DCMDQP_ERRN18 DCMDQP_ERRN17 DCMDQP_ERRN16 DCMDQP_ ERRN0 DCMDQP_ERR N1 DCMDQP_ERRN2 DCMDQP_ERRN3 DCMDQP_ERRN4 DCMDQP_ERRN5 DCMDQP_ERRN6 DCMDQP_ERRN7 DCMDQP_ERRN8 DCMDQP_ERRN9 DCMDQP_ERRN10 DCMDQP_ERRN11 DCMDQP_ERRN12 DCMDQP_ERRN13 DCMDQP_ERRN14 DCMDQP_ERRN15 DCMDQP_ERRN

, bits [p], for p = 63 to 0 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 751

Chapter 6. Memory map and registers 6.3. Register formats An error acknowledge bit for a DCMDQ control page in Secure state. SMMU_S_DCMDQP_ERRNn.DCMDQP_ERRNp, for p = 0 to 63, corresponds to DCMDQ control page (n * 64 + p). When this bit is different to SMMU_S_DCMDQP_ERRn.DCMDQP_ERRp, one or more errors are active on DCMDQ control page (n * 64 + p). The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When p < (2 ˆ UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), access to this field is RW. • Otherwise, access to this field is RAZ/WI. Accessing SMMU_S_DCMDQP_ERRN These registers are only present when SMMU_S_IDR6.DCMDQ == 1. Otherwise, these registers are RES0. Accesses to this register use the following encodings: Accessible at offset 0xE000 + (0x8 * n) from SMMUv3_DCMDQP_S_GLOBAL • When an access is not Secure and an access is not Root, accesses to this register are RAZ/WI. • When (n * 64) >= (2 ˆ UInt(SMMU_S_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP)), accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 752

Chapter 6. Memory map and registers 6.3. Register formats 6.3.166 SMMU_ROOT_IDR0 The SMMU_ROOT_IDR0 characteristics are: Purpose Feature identification register Configuration There are no configuration notes. Attributes SMMU_ROOT_IDR0 is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions BA_REALM 31 22 RES0 21 8 GDI 7 6 NSO 5 4 3 2 1 1 0 GPTS APPSAA REALM_IMPL ROOT_IM PL BGPTM RGPTM BA_REALM, bits [31:22] When SMMU_ROOT_IDR0.REALM_IMPL == 1: The base address offset of Realm Register Page 0. This field has an IMPLEMENTATION DEFINED value. The offset is determined from the following calculation: O_REALM = 0x20000 + (BA_REALM * 0x10000) SMMU_REALM_BASE = SMMU_PAGE_0_BASE + O_REALM Bit BA_REALM[0] is always zero, and the offset is therefore always aligned to a multiple of 128KB. Note: The offset is relative to Page 0 of the SMMU programmers’ interface and not related to the IMPLEMENTATION DEFINED base address of the SMMU Root control page. Access to this field is RO. Otherwise: Reserved, RES0. Bits [21:8] Reserved, RES0. GDI, bit [7] Indicates support for Granular Data Isolation (GDI). The value of this field is an IMPLEMENTATION DEFINED choice of: GDI Meaning 0b0 Granular Data Isolation is not supported. 0b1 Granular Data Isolation is supported. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 753

Chapter 6. Memory map and registers 6.3. Register formats If this bit is 1 then: • SMMU_ROOT_IDR0.NSO is 1. • SMMU_IDR0.TTF[0] is 0. • SMMU_IDR0.STALL_MODEL != 0b10. If this bit is 1 and SMMU_IDR0.ATS is 1, then SMMU_IDR0.RME_IMPL is 1. Access to this field is RO. GPTS, bit [6] Indicates support for the GPT scaling features. The value of this field is an IMPLEMENTATION DEFINED choice of: GPTS Meaning 0b0 GPT scaling features are not supported. 0b1 GPT scaling features are supported. If this bit is 1 then SMMU_ROOT_IDR0.APPSAA is 1. Access to this field is RO. NSO, bit [5] Indicates support for the Non-Secure only (NSO) GPI encoding. The value of this field is an IMPLEMENTATION DEFINED choice of: NSO Meaning 0b0 Granule protection checks do not support the NSO encoding. 0b1 Granule protection checks support the NSO encoding. Access to this field is RO. APPSAA, bit [4] Above PPS All Access support. The value of this field is an IMPLEMENTATION DEFINED choice of: APPSAA Meaning 0b0 Accesses with physical addresses that exceed the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS must be to Non-secure PA space. 0b1 Accesses with physical addresses that exceed the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS are handled according to SMMU_ROOT_GPT_BASE_CFG.APPSAA. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 754

Chapter 6. Memory map and registers 6.3. Register formats This field indicates support for controlling how accesses above the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS are handled. Access to this field is RO. REALM_IMPL, bit [3] Presence of Realm programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: REALM_IMPL Meaning 0b0 Realm programming interface is not present. 0b1 Realm programming interface is present. The Realm programming interface includes: • The Realm register pages. • The Realm StreamID space and Stream table. • The Realm queues and tables. If this field is 1, then SMMU_IDR0.RME_IMPL is 1. Access to this field is RO. RGPTM, bit [2] Register TLBI by PA support. The value of this field is an IMPLEMENTATION DEFINED choice of: RGPTM Meaning 0b0 SMMU_ROOT_TLBI and SMMU_ROOT_TLBI_CTRL are not present. 0b1 SMMU_ROOT_TLBI and SMMU_ROOT_TLBI_CTRL are present. If SMMU_ROOT_IDR0.BGPTM is 0, then this field is 1. See also: • SMMU_ROOT_TLBI. • SMMU_ROOT_TLBI_CTRL. Access to this field is RO. BGPTM, bit [1] Broadcast TLBI by PA support. The value of this field is an IMPLEMENTATION DEFINED choice of: BGPTM Meaning 0b0 This SMMU does not participate in broadcast TLBI PA operations. 0b1 This SMMU does participate in broadcast TLBI PA operations. This field indicates both that: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 755

Chapter 6. Memory map and registers 6.3. Register formats • The SMMU supports receipt of broadcast TLBI PA operations issued by PEs. • The SMMU is integrated in the memory system such that TLBI PA operations issued to the Outer Shareable shareability domain by PEs correctly reach the SMMU. The value of this field is independent of the value of SMMU_IDR0.BTM, SMMU_CR2.PTM, and SMMU_S_CR2.PTM. See also: • 3.17.7 Broadcast TLB maintenance for GPT information. Access to this field is RO. ROOT_IMPL, bit [0] Presence of Root registers. Reads as 0b1 Access to this field is RO. Accessing SMMU_ROOT_IDR0 Accesses to this register use the following encodings: Accessible at offset 0x0000 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 756

Chapter 6. Memory map and registers 6.3. Register formats 6.3.167 SMMU_ROOT_IIDR The SMMU_ROOT_IIDR characteristics are: Purpose Implementation identification register. Configuration There are no configuration notes. Attributes SMMU_ROOT_IIDR is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions ProductID 31 20 Variant 19 16 Revision 15 12 Implementer 11 0 ProductID, bits [31:20] This field is used to identify the SMMU part. This field has an IMPLEMENTATION DEFINED value. Access to this field is RO. Variant, bits [19:16] The field is used to distinguish product variants, or major revisions of the product. This field has an IMPLEMENTATION DEFINED value. Access to this field is RO. Revision, bits [15:12] This field used to distinguish minor revisions of the product. This field has an IMPLEMENTATION DEFINED value. Access to this field is RO. Implementer, bits [11:0] Contains the JEP106 code of the company that implemented the SMMU. • SMMU_ROOT_IIDR[11:8] - The JEP106 continuation code of the implementer. • SMMU_ROOT_IIDR[7] - Always 0. • SMMU_ROOT_IIDR[6:0] - The JEP106 identity code of the implementer. For an Arm implementation, bits[11:0] are 0x43B. This field has an IMPLEMENTATION DEFINED value. Access to this field is RO. Accessing SMMU_ROOT_IIDR Accesses to this register use the following encodings: Accessible at offset 0x0008 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 757

Chapter 6. Memory map and registers 6.3. Register formats 6.3.168 SMMU_ROOT_CR0 The SMMU_ROOT_CR0 characteristics are: Purpose Root Control Register Configuration Each field in this register has a corresponding field in SMMU_ROOT_CR0ACK, with the same Update observability semantics as fields in SMMU_CR0 versus SMMU_CR0ACK. Attributes SMMU_ROOT_CR0 is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 31 2 1 0 GPCEN ACCESSE N Bits [31:2] Reserved, RES0. GPCEN, bit [1] Enable Granule Protection Checks. GPCEN Meaning 0b0 All accesses bypass granule protection checks. 0b1 All client and SMMU-originated accesses, except for GPT walks, are subject to granule protection checks. When this bit is changed, the SMMU updates SMMU_ROOT_CR0ACK.GPCEN to match, once the following observability requirements are satisfied. This is referred to as completion of an Update. Completion of an Update of GPCEN from 0 to 1 guarantees that: • All future client-originated and SMMU-originated transactions are subject to granule protection checks. • All previous transactions that were issued without a granule protection check have completed. Completion of an Update of GPCEN from 1 to 0 guarantees that: • All future client-originated and SMMU-originated transactions will bypass granule protection checks. • All prior faults to be reported in SMMU_ROOT_GPF_FAR and SMMU_ROOT_GPT_CFG_FAR have been reported. • The SMMU has completed all outstanding fetches of GPT information. Note: Completion of an Update of GPCEN from 1 to 0 does not guarantee that outstanding accesses using the previous GPT configuration have completed. However, completion of a TLBI by PA with scope PAALL after the completion of the Update of GPCEN does guarantee this, including for Non-secure accesses made to Locations above the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 758

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Accessing this field has the following behavior: • Access to this field is RO if any of the following are true: – SMMU_ROOT_CR0.ACCESSEN != SMMU_ROOT_CR0ACK.ACCESSEN – SMMU_ROOT_CR0.GPCEN != SMMU_ROOT_CR0ACK.GPCEN • Otherwise, access to this field is RW. ACCESSEN, bit [0] Enable accesses from the SMMU and client devices. ACCESSEN Meaning 0b0 SMMU-originated accesses and client-originated accesses do not become observable. 0b1 SMMU-originated accesses and client-originated accesses are not terminated by this mechanism. This bit has higher priority than GPCEN. When this bit is changed, the SMMU updates SMMU_ROOT_CR0ACK.ACCESSEN to match, once the observability requirements below are satisfied. This is referred to as completion of an Update. Completion of an Update of ACCESSEN from 0 to 1 guarantees that: • Previous accesses that were to be terminated by this mechanism have been marked to be terminated. • Future client-originated and SMMU-originated accesses might succeed, according to other architectural checks. Note: It is Root firmware’s responsibility to set ACCESSEN to 1 only after an Update of GPCEN to 1 has successfully completed, in order to guarantee a consistent update order. Completion of an Update of ACCESSEN from 1 to 0 guarantees that: • Previous client-originated accesses not terminated by this mechanism are observable to their Shareability domain. • Previous SMMU-originated accesses, including GPT fetches, have completed. • The SMMU will not issue GPT fetches. • Future SMMU-originated accesses will be terminated as though experiencing a GPF as-reported in SMMU_ROOT_GPF_FAR. • Future client-originated accesses will be processed in a manner consistent with any access to a physical address experiencing a GPF. This includes: – An access is terminated with an external abort as a result of a configuration structure or translation table access experiencing a GPF. – An access is terminated with an external abort as a result of a GPF on the output address of that access. – If cached configuration information and information cached in TLBs would permit the access to be stalled, it is stalled. – If cached configuration information and information cached in TLBs would permit the access to be completed as RAZ/WI, it is completed as RAZ/WI. Note: For an SMMU that supports stall model, advertised in SMMU_(S_)IDR0.STALL_MODEL, there may be outstanding transactions affected by stall configuration if ACCESSEN is programmed to 0 while SMMU_(S_)CR0.SMMUEN == 1. Configuration of SMMU_(S_)CR0.SMMUEN to 0 guarantees termination of stalled transactions. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 759

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Accessing this field has the following behavior: • Access to this field is RO if any of the following are true: – SMMU_ROOT_CR0.ACCESSEN != SMMU_ROOT_CR0ACK.ACCESSEN – SMMU_ROOT_CR0.GPCEN != SMMU_ROOT_CR0ACK.GPCEN • Otherwise, access to this field is RW. Accessing SMMU_ROOT_CR0 Accesses to this register use the following encodings: Accessible at offset 0x0020 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 760

Chapter 6. Memory map and registers 6.3. Register formats 6.3.169 SMMU_ROOT_CR0ACK The SMMU_ROOT_CR0ACK characteristics are: Purpose Provides acknowledgment of changes to configuration in SMMU_ROOT_CR0. Configuration There are no configuration notes. Attributes SMMU_ROOT_CR0ACK is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 31 2 1 0 GPCEN ACCESSE N Bits [31:2] Reserved, RES0. GPCEN, bit [1] Acknowledgment that granule protection checks are enabled. See: SMMU_ROOT_CR0.GPCEN. The reset behavior of this field is: • This field resets to '0'. ACCESSEN, bit [0] Acknowledgment that SMMU-originated and client-originated accesses are enabled. See: SMMU_ROOT_CR0.ACCESSEN. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_ROOT_CR0ACK Accesses to this register use the following encodings: Accessible at offset 0x0024 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 761

Chapter 6. Memory map and registers 6.3. Register formats 6.3.170 SMMU_ROOT_GPT_BASE The SMMU_ROOT_GPT_BASE characteristics are: Purpose Control register for Granule Protection Table base address. This register is analogous to GPTBR_EL3. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPT_BASE is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 63 52 ADDR[51:12] 51 32 ADDR[51:12] 31 12 RES0 11 0 Bits [63:52] Reserved, RES0. ADDR, bits [51:12] Base address of the L0GPT, bits [51:12]. The SMMU always treats this address as being in the Root physical address space. This field represents bits [51:12] of the level 0 GPT base address. Bits that are taken to be zero are RES0 and the SMMU treats them as zero when computing addresses for lookups. Bits above the implemented output address size, advertised in SMMU_IDR5.OAS, are RES0. The level 0 GPT is aligned in memory to the greater of: • The size of the level 0 GPT in bytes. • 4KB. Bits [x:0] of the base address are taken to be zero, where: • x = Max(pps - l0gptsz + 2, 11) • pps is derived from SMMU_ROOT_GPT_BASE_CFG.PPS as follows: PPS pps 0b000 32 0b001 36 0b010 40 0b011 42 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 762

Chapter 6. Memory map and registers 6.3. Register formats PPS pps 0b100 44 0b101 48 0b110 52 • l0gptsz is derived from SMMU_ROOT_GPT_BASE_CFG.L0GPTSZ as follows: L0GPTSZ l0gptsz 0b0000 30 0b0100 34 0b0110 36 0b1001 39 If x is greater than 11, then BADDR[x - 12:0] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [11:0] Reserved, RES0. Accessing SMMU_ROOT_GPT_BASE After a write of this register, the SMMU is not required to use the new base address value until completion of a subsequent TLBI by PA ALL operation. Completion of such a TLBI by PA ALL operation also guarantees that the SMMU has completed all outstanding GPT walks that used the old configuration. Accesses to this register use the following encodings: Accessible at offset 0x0028 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • When SMMU_ROOT_CR0.GPCEN == ‘0’ and SMMU_ROOT_CR0ACK.GPCEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 763

Chapter 6. Memory map and registers 6.3. Register formats 6.3.171 SMMU_ROOT_GPT_BASE_CFG The SMMU_ROOT_GPT_BASE_CFG characteristics are: Purpose Control register for Granule Protection Checks. The fields in SMMU_ROOT_GPT_BASE_CFG are the same as for GPCCR_EL3, except there is no copy of GPCCR_EL3.GPC. See SMMU_ROOT_CR0.GPCEN. Configuration of reserved or invalid values leads to a GPT lookup error, reported as Invalid configuration of GPT configuration registers. See also: • 3.25.4 Reporting of GPC faults. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPT_BASE_CFG is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 63 32 RES0 31 30 29 RES0 28 27 NSP 26 SA 25 24 L0GPTSZ 23 20 NSO 19 18 17 16 PGS 15 14 SH 13 12 ORGN 11 10 IRGN 9 8 RES0 7 4 3 PPS 2 0 GPCBW APPSAA RES0 RES0 GPCP PPS3 Bits [63:30] Reserved, RES0. GPCBW, bit [29] When SMMU_ROOT_IDR0.GPTS == 1: GPC Bypass Window Enable. GPCBW Meaning 0b0 GPC bypass windows are disabled. 0b1 GPC bypass windows are enabled. This field governs the behavior of the GPC bypass windows. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 764

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. Bits [28:27] Reserved, RES0. NSP, bit [26] When SMMU_ROOT_IDR0.GDI == 1: Non-secure Protected. NSP Meaning 0b0 GPI encoding value of 0b0101 is Reserved. 0b1 GPI encoding value of 0b0101 is Non-secure Protected. This field governs the behavior of the GPI encoding for NSP. Note: If the configuration of SMMU_ROOT_GPT_BASE_CFG defines a GPI encoding as Reserved then it is also considered Reserved for the purpose of GPT descriptor validation checks. This bit is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. SA, bit [25] When SMMU_ROOT_IDR0.GDI == 1: System Agent. SA Meaning 0b0 GPI encoding value of 0b0100 is Reserved. 0b1 GPI encoding value of 0b0100 is System Agent. This field governs the behavior of the GPI encoding for SA. This bit is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. APPSAA, bit [24] ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 765

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_ROOT_IDR0.APPSAA == 1: Above PPS All Access. APPSAA Meaning 0b0 Accesses with physical addresses that exceed the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS must be to Non-secure PA space, otherwise they generate a GPF at level 0. 0b1 Accesses that exceed the range configured in SMMU_ROOT_GPT_BASE_CFG.PPS, to any PA space, do not generate a GPF because of this control. This field governs the behavior of memory accesses to Secure, Realm and Root PA space, for physical addresses above the range configured by SMMU_ROOT_GPT_BASE_CFG.PPS. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. L0GPTSZ, bits [23:20] Level 0 GPT entry size. This field specifies the number of least significant address bits protected by each entry in the level 0 GPT. L0GPTSZ Meaning 0b0000 30-bits. Each entry covers 1GB of address space. 0b0100 34-bits. Each entry covers 16GB of address space. 0b0110 36-bits. Each entry covers 64GB of address space. 0b1001 39-bits. Each entry covers 512GB of address space. The reset behavior of this field is: • This field resets to an UNKNOWN value. Access to this field is RO. NSO, bit [19] When SMMU_ROOT_IDR0.NSO == 1: Enable Non-secure only. NSO Meaning 0b0 GPI encoding value of 0b1101 is Reserved. 0b1 GPI encoding value of 0b1101 is NSO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 766

Chapter 6. Memory map and registers 6.3. Register formats This field governs the behavior of the GPI encoding for NSO. Note: If the configuration of SMMU_ROOT_GPT_BASE_CFG defines a GPI encoding as Reserved then it is also considered Reserved for the purpose of GPT descriptor validation checks. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bit [18] Reserved, RES0. GPCP, bit [17] Granule Protection Check Priority. GPCP Meaning 0b0 All GPC faults are reported with a priority consistent with the GPC being performed on any access to physical address space. 0b1 A GPC fault for the fetch of a Table descriptor for a stage 2 translation table walk might not be generated or reported. All other GPC faults are reported with a priority consistent with the GPC being performed on any access to physical address space. This field is permitted to be cached in a TLB. An implementation is permitted to treat this field as RES0, with an Effective value of 0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bit [16] Reserved, RES0. PGS, bits [15:14] Physical Granule size. PGS Meaning 0b00 4KB. Invalid if SMMU_IDR5.GRAN4K == 0. 0b01 64KB. Invalid if SMMU_IDR5.GRAN64K == 0. 0b10 16KB. Invalid if SMMU_IDR5.GRAN16K == 0. 0b11 Reserved. The value of this field is permitted to be cached in a TLB. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 767

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to an UNKNOWN value. SH, bits [13:12] GPT fetch Shareability attribute SH Meaning 0b00 Non-shareable. 0b01 Reserved. 0b10 Outer Shareable. 0b11 Inner Shareable. Fetches to the GPT are made to the shareability domain configured in this field. If both ORGN and IRGN are configured with Non-cacheable attributes, it is invalid to configure this field to values other than Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. ORGN, bits [11:10] GPT fetch Outer cacheability attribute. ORGN Meaning 0b00 Normal memory, Outer Non-cacheable. 0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. Fetches of GPT information are made with the Outer cacheability attributes configured in this field. The reset behavior of this field is: • This field resets to an UNKNOWN value. IRGN, bits [9:8] GPT fetch Inner cacheability attribute. IRGN Meaning 0b00 Normal memory, Inner Non-cacheable. 0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 768

Chapter 6. Memory map and registers 6.3. Register formats IRGN Meaning 0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. Fetches of GPT information are made with the Inner cacheability attributes configured in this field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [7:4] Reserved, RES0. PPS3, bit [3] When SMMU_ROOT_IDR0.GPTS == 1: Bit 3 of PPS. This field extends SMMU_ROOT_GPT_BASE_CFG.PPS[2:0], thus creating a SMMU_ROOT_GPT_BASE_CFG.PPS[3:0] field. For a description of the values derived by evaluating PPS, see SMMU_ROOT_GPT_BASE_CFG.PPS[2:0]. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. PPS, bits [2:0] When SMMU_ROOT_IDR0.GPTS == 1: The bit width of the memory region protected by the GPT. This field is evaluated with PPS3, as {PPS3, PPS} to give PPS[3:0], interpreted as: PPS[3:0] Meaning 0b0000 32 bits, 4GB protected address space. 0b0001 36 bits, 64GB protected address space. 0b0010 40 bits, 1TB protected address space. 0b0011 42 bits, 4TB protected address space. 0b0100 44 bits, 16TB protected address space. 0b1000 46 bits, 64TB protected address space. 0b1001 47 bits, 128TB protected address space. 0b0101 48 bits, 256TB protected address space. 0b0110 52 bits, 4PB protected address space. 0b0111 56 bits, 64PB protected address space. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 769

Chapter 6. Memory map and registers 6.3. Register formats Values exceeding the implemented physical address size, advertised in SMMU_IDR5.OAS, are invalid. Other values are Reserved. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Protected physical address size. PPS Meaning 0b000 32 bits, 4GB protected address space. 0b001 36 bits, 64GB protected address space. 0b010 40 bits, 1TB protected address space. 0b011 42 bits, 4TB protected address space. 0b100 44 bits, 16TB protected address space. 0b101 48 bits, 256TB protected address space. 0b110 52 bits, 4PB protected address space. 0b111 Reserved. The bit width of the memory region protected by the GPT. Values exceeding the implemented physical address size, advertised in SMMU_IDR5.OAS, are invalid. Other values are Reserved. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_ROOT_GPT_BASE_CFG Accesses to this register use the following encodings: Accessible at offset 0x0030 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • When SMMU_ROOT_CR0.GPCEN == ‘1’ or SMMU_ROOT_CR0ACK.GPCEN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 770

Chapter 6. Memory map and registers 6.3. Register formats 6.3.172 SMMU_ROOT_GPF_FAR The SMMU_ROOT_GPF_FAR characteristics are: Purpose This register reports details of the originating access that experienced a GPF. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPF_FAR is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions FPAS 63 62 61 RES0 60 56 FADDR[55:12] 55 32 FPASE FADDR[55:12] 31 12 FAULTCODE 11 4 REASON 3 1 0 FAULT FPAS, bits [63:62] When SMMU_ROOT_IDR0.GDI == 1: The physical address space of the access that failed. Together with FPASE specifies the physical address space of the access that failed as follows: FPASE FPAS[1:0] Meaning 0 00 Secure 0 01 Non-secure 0 10 Root 0 11 Realm 1 00 System Agent (SA) 1 01 Non-secure Protected (NSP) 1 10 Reserved 1 11 Reserved If FAULT == 0, the value of this field is 0b00. Note: The encodings for Root and System Agent are only applicable for NoStreamID devices. Access to this field is RO. Otherwise: The physical address space of the access that failed. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 771

Chapter 6. Memory map and registers 6.3. Register formats FPAS Meaning 0b00 Secure 0b01 Non-secure 0b10 Root 0b11 Realm If FAULT == 0, the value of this field is 0b00. Note: The encoding for Root is only applicable for NoStreamID devices. Access to this field is RO. FPASE, bit [61] When SMMU_ROOT_IDR0.GDI == 1: FPAS Extension. Together with FPAS specifies the physical address space of the access that failed. For a description of the values derived by evaluating FPASE and FPAS together, see SMMU_ROOT_GPF_FAR.FPAS. If FAULT == 0, the value of this field is 0b0. If SMMU_ROOT_IDR0.GDI is 1, this field is updated when SMMU_ROOT_GPF_FAR is updated. Otherwise: Reserved, RES0. Bits [60:56] Reserved, RES0. FADDR, bits [55:12] The physical address input to the Granule Protection Check that failed. If FAULT == 0, the value of this field is zero. Access to this field is RO. FAULTCODE, bits [11:4] If REASON == TRANSACTION, then the value of this field is zero. If REASON == TRANSLATION, then: Value Name Meaning 0x03 GPF_STE_FETCH STE fetch experienced GPF 0x09 GPF_CD_FETCH CD fetch experienced GPF 0x0B GPF_WALK_EABT Translation table access experienced GPF 0x25 GPF_VMS_FETCH VMS fetch experienced GPF 0x27 GPF_CIT_FETCH A CIT fetch experienced GPF 0x30 GPF_VSTT_FETCH A VSTT fetch experienced GPF ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 772

Chapter 6. Memory map and registers 6.3. Register formats If REASON == GERROR, then: Value Name Meaning 0x00 CMDQ_GPF Command queue read experienced a GPF 0x02 EVENTQ_GPF Event queue write experienced a GPF 0x03 PRIQ_GPF PRI queue write experienced a GPF 0x04 MSI_CMDQ_GPF Command queue MSI experienced a GPF 0x05 MSI_EVENTQ_GPF Event queue MSI experienced a GPF 0x06 MSI_PRIQ_GPF PRI queue MSI experienced a GPF 0x07 MSI_GERROR_GPF GERROR reporting MSI experienced a GPF 0x08 DCMDQ_GPF A DCMDQ fetch experienced GPF 0x09 HDBSS_GPF An access to an HDBSS experienced a GPF 0x10 OTHER_GPF An unknown SMMU-originated access experienced a GPF 0x0A MSI_HDBSS_GPF An HDBSS MSI experienced a GPF 0x0B HACDBS_GPF An access to HACDBS experienced a GPF 0x0C MSI_HACDBS_GPF A HACDBS MSI experienced a GPF If FAULT == 0, the value of this field is 0x00. Access to this field is RO. REASON, bits [3:1] Reports the originator of the access. REASON Meaning 0b001 TRANSLATION, GPF on an SMMU-originated access required for translation of a client request. 0b010 GERROR, GPF on an SMMU-originated access not relating to a client translation. 0b011 TRANSACTION, GPF on the output address of a client translation. If FAULT == 0, the value of this field is 0b000. Access to this field is RO. FAULT, bit [0] FAULT Meaning 0b0 There have been zero GPFs since this register was last cleared to 0. 0b1 There have been one or more GPFs since this register was last cleared to 0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 773

Chapter 6. Memory map and registers 6.3. Register formats A write of 1 to this bit is IGNORED, does not trigger the GPF_FAR interrupt, and does not make this fault active. The reset behavior of this field is: • This field resets to '0'. Additional Information It is IMPLEMENTATION DEFINED which of the following encodings is used to report GPFs on MSI accesses from a PMCG or a RAS record interrupt: • REASON = GERROR and FAULTCODE = OTHER_GPF • REASON = TRANSACTION Accessing SMMU_ROOT_GPF_FAR All writes to this register are IGNORED unless the write clears the FAULT bit. When a write clears the FAULT bit, the whole register is cleared to zero. Accesses to this register use the following encodings: Accessible at offset 0x0038 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 774

Chapter 6. Memory map and registers 6.3. Register formats 6.3.173 SMMU_ROOT_GPT_CFG_FAR The SMMU_ROOT_GPT_CFG_FAR characteristics are: Purpose Reports details of the originating access that experienced a GPT lookup error. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPT_CFG_FAR is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions FPAS 63 62 61 60 CFG_ERR 59 56 FADDR[55:12] 55 32 FPASE RES0 FADDR[55:12] 31 12 FAULTCODE 11 4 REASON 3 1 0 FAULT FPAS, bits [63:62] When SMMU_ROOT_IDR0.GDI == 1: The physical address space of the access that failed. Together with FPASE specifies the physical address space of the access that failed as follows: FPASE FPAS[1:0] Meaning 0 00 Secure 0 01 Non-secure 0 10 Root 0 11 Realm 1 00 System Agent (SA) 1 01 Non-secure Protected (NSP) 1 10 Reserved 1 11 Reserved If FAULT == 0, the value of this field is 0b00. Note: The encodings for Root and System Agent are only applicable for NoStreamID devices. Access to this field is RO. Otherwise: The physical address space of the access that failed. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 775

Chapter 6. Memory map and registers 6.3. Register formats FPAS Meaning 0b00 Secure 0b01 Non-secure 0b10 Root 0b11 Realm If FAULT == 0, the value of this field is 0b00. Note: The encoding for Root is only applicable for NoStreamID devices. Access to this field is RO. FPASE, bit [61] When SMMU_ROOT_IDR0.GDI == 1: FPAS Extension. Together with FPAS specifies the physical address space of the access that failed. For a description of the values derived by evaluating FPASE and FPAS together, see SMMU_ROOT_GPF_FAR.FPAS. If FAULT == 0, the value of this field is 0b0. If SMMU_ROOT_IDR0.GDI is 1, this field is updated when SMMU_ROOT_GPF_FAR is updated. Otherwise: Reserved, RES0. Bit [60] Reserved, RES0. CFG_ERR, bits [59:56] Value Meaning 0x0 Invalid configuration of GPT configuration registers (SMMU_ROOT_GPT_BASE_CFG, SMMU_ROOT_GPCBW). This corresponds to GPT walk fault at Level 0 arising from invalid configuration in the RME specification. 0x1 SMMU_ROOT_GPT_BASE.ADDR exceeds the address size configured in SMMU_ROOT_GPT_BASE_CFG.PPS. This corresponds to GPT address size fault at Level 0 in the RME specification. 0x2 External abort on GPT entry fetch. This corresponds to Synchronous External abort on GPT fetch in the RME specification. 0x3 Invalid configuration of GPT entry. This corresponds to GPT walk fault arising from an invalid GPT entry in the RME specification. 0x4 Next-level address in GPT entry exceeds the address size configured in SMMU_ROOT_GPT_BASE_CFG.PPS. This corresponds to GPT address size fault at Level 0 in the RME specification. If FAULT == 0, the value of this field is 0x0. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 776

Chapter 6. Memory map and registers 6.3. Register formats FADDR, bits [55:12] The physical address input to the Granule Protection Check that failed. If FAULT == 0, the value of this field is zero. Access to this field is RO. FAULTCODE, bits [11:4] If REASON == TRANSACTION, then the value of this field is zero. If REASON == TRANSLATION, then: Value Name Meaning 0x03 GPF_STE_FETCH STE fetch experienced GPF 0x09 GPF_CD_FETCH CD fetch experienced GPF 0x0B GPF_WALK_EABT Translation table access experienced GPF 0x25 GPF_VMS_FETCH VMS fetch experienced GPF 0x27 GPF_CIT_FETCH A CIT fetch experienced GPF 0x30 GPF_VSTT_FETCH A VSTT fetch experienced GPF If REASON == GERROR, then: Value Name Meaning 0x00 CMDQ_GPF Command queue read experienced a GPF 0x02 EVENTQ_GPF Event queue write experienced a GPF 0x03 PRIQ_GPF PRI queue write experienced a GPF 0x04 MSI_CMDQ_GPF Command queue MSI experienced a GPF 0x05 MSI_EVENTQ_GPF Event queue MSI experienced a GPF 0x06 MSI_PRIQ_GPF PRI queue MSI experienced a GPF 0x07 MSI_GERROR_GPF GERROR reporting MSI experienced a GPF 0x08 DCMDQ_GPF A DCMDQ fetch experienced GPF 0x09 HDBSS_GPF An access to an HDBSS experienced a GPF 0x10 OTHER_GPF An unknown SMMU-originated access experienced a GPF 0x0A MSI_HDBSS_GPF An HDBSS MSI experienced a GPF 0x0B HACDBS_GPF An access to HACDBS experienced a GPF 0x0C MSI_HACDBS_GPF A HACDBS MSI experienced a GPF If FAULT == 0, the value of this field is 0x00. Access to this field is RO. REASON, bits [3:1] Reports the originator of the access. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 777

Chapter 6. Memory map and registers 6.3. Register formats REASON Meaning 0b001 TRANSLATION, GPF on an SMMU-originated access required for translation of a client request. 0b010 GERROR, GPF on an SMMU-originated access not relating to a client translation. 0b011 TRANSACTION, GPF on the output address of a client translation. If FAULT == 0, the value of this field is 0b000. Access to this field is RO. FAULT, bit [0] FAULT Meaning 0b0 There have been zero GPT lookup errors since this register was last cleared to 0. 0b1 There have been one or more GPT lookup errors since this register was last cleared to 0. A write of 1 to this bit is IGNORED, does not trigger the GPT_CFG_FAR interrupt, and does not make this fault active. The reset behavior of this field is: • This field resets to '0'. Additional Information It is IMPLEMENTATION DEFINED which of the following encodings is used to report GPFs on MSI accesses from a PMCG or a RAS record interrupt: • REASON = GERROR and FAULTCODE = OTHER_GPF • REASON = TRANSACTION Accessing SMMU_ROOT_GPT_CFG_FAR All writes to this register are IGNORED unless the write clears the FAULT bit. When a write clears the FAULT bit, the whole register is cleared to zero. Accesses to this register use the following encodings: Accessible at offset 0x0040 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 778

Chapter 6. Memory map and registers 6.3. Register formats 6.3.174 SMMU_ROOT_TLBI The SMMU_ROOT_TLBI characteristics are: Purpose TLBI by PA attributes register. Configuration This register is present only when SMMU_ROOT_IDR0.RGPTM == 1. Otherwise, direct accesses to SMMU_ROOT_TLBI are RES0. Attributes SMMU_ROOT_TLBI is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 63 52 Address 51 32 Address 31 12 RES0 11 8 SIZE 7 4 RES0 3 2 L 1 ALL 0 Bits [63:52] Reserved, RES0. Address, bits [51:12] Base address from which to start invalidation. Bits [11:0] of the base address are taken to be zero. If ALL == 1, this field is IGNORED. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [11:8] Reserved, RES0. SIZE, bits [7:4] Range of addresses to be invalidated. SIZE Meaning 0b0000 4KB. 0b0001 16KB. 0b0010 64KB. 0b0011 2MB. 0b0100 32MB. 0b0101 512MB. 0b0110 1GB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 779

Chapter 6. Memory map and registers 6.3. Register formats SIZE Meaning 0b0111 16GB. 0b1000 64GB. 0b1001 512GB. All other values are reserved. If ALL == 1, this field is IGNORED. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [3:2] Reserved, RES0. L, bit [1] GPT Last-level only. L Meaning 0b0 Invalidate GPT information from all levels of the GPT walk. 0b1 Invalidate GPT information from only the last level of the GPT walk. If ALL == 1, this field is IGNORED. The reset behavior of this field is: • This field resets to an UNKNOWN value. ALL, bit [0] GPT All. ALL Meaning 0b0 Invalidate GPT information from TLBs based on other fields. 0b1 Invalidate all GPT information from TLBs. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_ROOT_TLBI Accesses to this register use the following encodings: Accessible at offset 0x0050 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • When SMMU_ROOT_TLBI_CTRL.RUN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 780

Chapter 6. Memory map and registers 6.3. Register formats 6.3.175 SMMU_ROOT_TLBI_CTRL The SMMU_ROOT_TLBI_CTRL characteristics are: Purpose TLBI by PA control register. Configuration This register is present only when SMMU_ROOT_IDR0.RGPTM == 1. Otherwise, direct accesses to SMMU_ROOT_TLBI_CTRL are RES0. Attributes SMMU_ROOT_TLBI_CTRL is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 31 1 RUN 0 Bits [31:1] Reserved, RES0. RUN, bit [0] RUN Meaning 0b0 Invalidation not in progress. 0b1 Invalidation in progress. Writes to this register only have an effect if both of the following are true: • The value of RUN in the register before the write is 0. • The value of RUN in the write data payload is 1. Any write that does not satisfy both these conditions is IGNORED. When the requirements for RUN are met for a given write, the following all apply: • The values provided for ALL, L, SIZE, and Address are taken from SMMU_ROOT_TLBI. • The SMMU performs the TLBI by PA operation, interpreted as follows: – If ALL == 1, the operation behaves as TLBI PAALL as issued on a PE. – If ALL == 0 and L == 0, the operation behaves as TLBI RPAOS as issued on a PE, with SIZE and Address interpreted in the same manner as for TLBI RPAOS. – If ALL == 0 and L == 1, the operation behaves as TLBI RPALOS as issued on a PE, with SIZE and Address interpreted in the same manner as for TLBI RPALOS. • A TLBI by PA operation is complete when all the following requirements are met: – All matching GPT information in TLB entries has been invalidated. – All SMMU-originated and client-originated accesses that were in progress to physical addresses targeted by the TLBI by PA operation, are globally observable to their Shareability domain. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 781

Chapter 6. Memory map and registers 6.3. Register formats • Once the TLBI by PA operation is complete, the SMMU clears the whole register to 0. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_ROOT_TLBI_CTRL Accesses to this register use the following encodings: Accessible at offset 0x0058 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 782

Chapter 6. Memory map and registers 6.3. Register formats 6.3.176 SMMU_ROOT_GPT_BASE2 The SMMU_ROOT_GPT_BASE2 characteristics are: Purpose Shadow register for updating SMMU_ROOT_GPT_BASE, in systems that do not support 64-bit single-copy-atomic register accesses. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPT_BASE2 is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 63 52 ADDR[51:12] 51 32 ADDR[51:12] 31 12 RES0 11 0 Bits [63:52] Reserved, RES0. ADDR, bits [51:12] The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [11:0] Reserved, RES0. Additional Information See also: SMMU_ROOT_GPT_BASE_UPDATE. Accessing SMMU_ROOT_GPT_BASE2 Accesses to this register use the following encodings: Accessible at offset 0x0060 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 783

Chapter 6. Memory map and registers 6.3. Register formats 6.3.177 SMMU_ROOT_GPT_BASE_UPDATE The SMMU_ROOT_GPT_BASE_UPDATE characteristics are: Purpose Control register to trigger an update of the Granule Protection Table base address. Configuration There are no configuration notes. Attributes SMMU_ROOT_GPT_BASE_UPDATE is a 32-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 31 1 0 Update Bits [31:1] Reserved, RES0. Update, bit [0] The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_ROOT_GPT_BASE_UPDATE A write to this register that does not set Update to 1 is IGNORED. A write to this register that sets Update to 1 causes the SMMU to perform the following sequence in an atomic manner: 1. The value of SMMU_ROOT_GPT_BASE2 is copied into SMMU_ROOT_GPT_BASE, in an atomic manner. 2. The value of Update is set to 0. Accesses to this register use the following encodings: Accessible at offset 0x0068 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 784

Chapter 6. Memory map and registers 6.3. Register formats 6.3.178 SMMU_ROOT_GPCBW The SMMU_ROOT_GPCBW characteristics are: Purpose Control register for Granule Protection Check Bypass Windows. Configuration of reserved or invalid values leads to a GPT lookup error, reported as Invalid configuration of GPT configuration registers. Configuration This register is present only when SMMU_ROOT_IDR0.GPTS == 1. Otherwise, direct accesses to SMMU_ROOT_GPCBW are RES0. Attributes SMMU_ROOT_GPCBW is a 64-bit register. This register is part of the SMMUv3_ROOT block. Field descriptions RES0 63 40 BWSIZE 39 37 BWSTRIDE 36 32 RES0 31 26 BWADDR 25 0 Bits [63:40] Reserved, RES0. BWSIZE, bits [39:37] GPC Bypass Window size. BWSIZE Meaning 0b000 30 bits. 1GB window size. 0b001 31 bits. 2GB window size. 0b010 32 bits. 4GB window size. 0b100 34 bits. 16GB window size. 0b110 36 bits. 64GB window size. BWSIZE defines the size of the GPC bypass memory region. This field is permitted to be cached in a TLB. Other values are reserved. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 785

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to an UNKNOWN value. BWSTRIDE, bits [36:32] GPC Bypass Window Stride. BWSTRIDE Meaning 0b00000 1TB. 0b00010 4TB. 0b00100 16TB. 0b00110 64TB. 0b00111 128TB. 0b01000 256TB. 0b01001 512TB. 0b01010 1PB. 0b10000 64PB (No stride). This field allows the creation of multiple GPC bypass memory regions in the memory map across a specific stride. This field is permitted to be cached in a TLB. Other values are reserved. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [31:26] Reserved, RES0. BWADDR, bits [25:0] GPC Bypass window address. This field represents bits [55:30] of the GPC bypass window base address. It is invalid to configure this field to a value that provides a base address that is either: • Not aligned to the size programmed in BWSIZE. • Greater than or equal to the stride value programmed in BWSTRIDE. This field is permitted to be cached in a TLB. The GPC bypass window is: • Located within the protected physical space defined by SMMU_ROOT_GPT_BASE_CFG.PPS. • Aligned in memory to the size of the window as specified by GPCBW_EL3.BWSIZE. • Duplicated in PA space across a stride specified using GPCBW_EL3.BWSTRIDE. This means that only bits [gpcbwu:gpcbwl] of a PA are compared against bits [gpcbwu:gpcbwl] of the window base address derived from BWADDR when checking if a PA falls within the range of a window, where gpcbwl is derived from GPCBW_EL3.BWSIZE as follows: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 786

Chapter 6. Memory map and registers 6.3. Register formats BWSIZE gpcbwl 0b000 30 0b001 31 0b010 32 0b100 34 0b110 36 gpcbwu is derived from GPCBW_EL3.BWSTRIDE as follows: BWSTRIDE gpcbwl 0b00000 39 0b00010 41 0b00100 43 0b00110 45 0b00111 46 0b01000 47 0b01001 48 0b01010 49 0b10000 55 The following pseudocode provides the required calculation. An access to a PA falls within a GPC bypass window if COND is evaluated as TRUE: 1. MASK_LSB = 0xFFFFFFFFFFFFFF << gpcbwl 2. MASK_MSB = 0xFFFFFFFFFFFFFF >> (55-gpcbwu) 3. MASK = MASK_MSB & MASK_LSB 4. COND = (PA[55:0] & MASK)== ((BWADDR:Zeros(30))& MASK) The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_ROOT_GPCBW Accesses to this register use the following encodings: Accessible at offset 0x0070 from SMMUv3_ROOT • When an access is not Root, accesses to this register are RAZ/WI. • When SMMU_ROOT_CR0.GPCEN == ‘1’ or SMMU_ROOT_CR0ACK.GPCEN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 787

Chapter 6. Memory map and registers 6.3. Register formats 6.3.179 SMMU_R_IDR0 The SMMU_R_IDR0 characteristics are: Purpose Provides information about the features implemented for the SMMU Realm state programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR0 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 31 RES0 30 26 25 24 RES0 23 17 PRI 16 RES0 15 14 MSI 13 RES0 12 11 ATS 10 RES0 9 0 ECMDQ STALL_MODEL ECMDQ, bit [31] Indicates support for Enhanced Command queue interface for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ Meaning 0b0 Enhanced CMDQ for Realm state not supported. 0b1 Enhanced CMDQ for Realm state support is advertised in SMMU_R_IDR6. If this field is 1, then all of the following are true: • SMMU_IDR1.ECMDQ == 1. • SMMU_R_IDR0.MSI == 1. See section 3.5.6 Enhanced Command queue interfaces. Access to this field is RO. Bits [30:26] Reserved, RES0. STALL_MODEL, bits [25:24] Stall model support for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: STALL_MODEL Meaning 0b00 Stall and Terminate models supported. 0b01 Stall is not supported, all faults terminate transaction and STE.S2S and CD.S must be 0. • CMD_RESUME and CMD_STALL_TERM are not available. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 788

Chapter 6. Memory map and registers 6.3. Register formats STALL_MODEL Meaning 0b10 Stall is forced (all faults eligible to stall cause stall), STE.S2S and CD.S must be 1. All other values are reserved. In this revision of the architecture, the only permitted value is 0b01. Access to this field is RO. Bits [23:17] Reserved, RES0. PRI, bit [16] Page Request Interface supported for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: PRI Meaning 0b0 Page Request Interface not supported for Realm state. • All SMMU_R_PRIQ_* registers are Reserved. 0b1 Page Request Interface supported for Realm state. This field has the same value as SMMU_IDR0.PRI. Access to this field is RO. Bits [15:14] Reserved, RES0. MSI, bit [13] Indicates support for the SMMU-originated MSIs for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: MSI Meaning 0b0 SMMU-originated MSIs for Realm state not supported. 0b1 SMMU-originated MSIs for Realm state are supported. This field has the same value as SMMU_IDR0.MSI. Access to this field is RO. Bits [12:11] Reserved, RES0. ATS, bit [10] PCIe ATS supported for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 789

Chapter 6. Memory map and registers 6.3. Register formats ATS Meaning 0b0 PCIe ATS not supported for Realm state. 0b1 PCIe ATS supported for Realm state. This field has the same value as SMMU_IDR0.ATS. Access to this field is RO. Bits [9:0] Reserved, RES0. Accessing SMMU_R_IDR0 Accesses to this register use the following encodings: Accessible at offset 0x0000 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 790

Chapter 6. Memory map and registers 6.3. Register formats 6.3.180 SMMU_R_IDR1 The SMMU_R_IDR1 characteristics are: Purpose Provides information about the features implemented for the SMMU Realm state programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 31 RES0 30 0 RME_DA_IMPL RME_DA_IMPL, bit [31] Indicates support for the Realm programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: RME_DA_IMPL Meaning 0b0 Realm programming interface is not present. 0b1 Realm programming interface is present. This field reads as one. Access to this field is RO. Bits [30:0] Reserved, RES0. Accessing SMMU_R_IDR1 Accesses to this register use the following encodings: Accessible at offset 0x0004 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 791

Chapter 6. Memory map and registers 6.3. Register formats 6.3.181 SMMU_R_IDR2 The SMMU_R_IDR2 characteristics are: Purpose Provides information about the features implemented for the SMMU Realm state programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 31 30 29 28 27 26 25 24 RES0 23 0 ECMDQ_C MD_CFGI ECMDQ_CMD_ TLBI ECMDQ_CMD_ATC ECMDQ_CMD_PRI RECMDQ RES0 ECMDQ_CMD_FAULT ECMDQ_CMD_DPTI ECMDQ_CMD_CFGI, bit [31] When SMMU_R_IDR2.RECMDQ == 1: Support for Realm state CMD_CFGI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_CFGI Meaning 0b0 Configuration invalidations are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 Configuration invalidations are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_TLBI, bit [30] When SMMU_R_IDR2.RECMDQ == 1: Support for Realm state CMD_TLBI_ on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 792

Chapter 6. Memory map and registers 6.3. Register formats ECMDQ_CMD_TLBI Meaning 0b0 Only CMD_TLBI_NH_ and CMD_TLBI_NSNH_ALL are supported on the RECMDQs. Other CMD_TLBI_ commands lead to CERROR_ILL when issued to the RECMDQs. 0b1 All TLBI commands which are supported by the implementation are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_ATC, bit [29] When SMMU_R_IDR2.RECMDQ == 1 and SMMU_IDR0.ATS == 1: Support for Realm state CMD_ATC_INV on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_ATC Meaning 0b0 CMD_ATC_INV is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_ATC_INV is supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_PRI, bit [28] When SMMU_R_IDR2.RECMDQ == 1 and SMMU_IDR0.PRI == 1: Support for Realm state CMD_PRI_RESP on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_PRI Meaning 0b0 CMD_PRI_RESP is not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_PRI_RESP is supported on the RECMDQs. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 793

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. ECMDQ_CMD_DPTI, bit [27] When SMMU_R_IDR2.RECMDQ == 1 and SMMU_R_IDR3.DPT == 1: Support for Realm state CMD_DPTI* on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_DPTI Meaning 0b0 DPT maintenance commands are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 DPT maintenance commands are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. ECMDQ_CMD_FAULT, bit [26] When SMMU_R_IDR2.RECMDQ == 1: Support for Realm state fault response command on RECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ECMDQ_CMD_FAULT Meaning 0b0 CMD_RESUME and CMD_STALL_TERM are not supported on the RECMDQs and leads to CERROR_ILL when issued to the RECMDQs. 0b1 CMD_RESUME and CMD_STALL_TERM are supported on the RECMDQs. Access to this field is RO. Otherwise: Reserved, RES0. Bit [25] Reserved, RES0. RECMDQ, bit [24] Support for Restricted ECMDQs. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 794

Chapter 6. Memory map and registers 6.3. Register formats RECMDQ Meaning 0b0 Restricted ECMDQs are not supported. 0b1 Restricted ECMDQs are supported. If this field is 1, then SMMU_IDR2.RECMDQ must be 1. Access to this field is RO. Bits [23:0] Reserved, RES0. Accessing SMMU_R_IDR2 Accesses to this register use the following encodings: Accessible at offset 0x0008 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 795

Chapter 6. Memory map and registers 6.3. Register formats 6.3.182 SMMU_R_IDR3 The SMMU_R_IDR3 characteristics are: Purpose Provides information about the features implemented for the SMMU Realm state programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR3 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 28 27 26 RES0 25 18 XT 17 MEC 16 DPT 15 RES0 14 0 HACDBS HDBSS Bits [31:28] Reserved, RES0. HACDBS, bit [27] Indicates support for hardware accelerator for cleaning Dirty state for the Realm programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HACDBS Meaning 0b0 Hardware accelerator for cleaning Dirty state is not supported for the Realm programming interface. 0b1 Hardware accelerator for cleaning Dirty state is supported for the Realm programming interface. If SMMU_IDR3.HACDBS is 0, then this field is RES0. If this field is 1, then SMMU_R_IDR3.HDBSS must be 1. Access to this field is RO. HDBSS, bit [26] Support for hardware Dirty state tracking Structure for the Realm programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: HDBSS Meaning 0b0 Hardware Dirty state tracking Structure is not supported for the Realm programming interface. 0b1 Hardware Dirty state tracking Structure is supported for the Realm programming interface. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 796

Chapter 6. Memory map and registers 6.3. Register formats If SMMU_IDR3.HDBSS is 0, then this field is RES0. If SMMU_IDR3.HDBSS is 1, then this field must be 1. Access to this field is RO. Bits [25:18] Reserved, RES0. XT, bit [17] When SMMU_R_IDR0.ATS == 1: Support for both: • The XT encoding in all of the following: – Untranslated transactions. – ATS Translation requests. – Translated transactions. • The TE encoding in ATS Translation Completions. The value of this field is an IMPLEMENTATION DEFINED choice of: XT Meaning 0b0 XT and TE encodings are not supported. 0b1 XT and TE encodings are supported. See also: • 3.9.4.3 XT bit on Untranslated transactions, Translation requests and Translated transactions. • 3.9.4.2 TE bit on ATS Translation Completions. Access to this field is RO. Otherwise: Reserved, RES0. MEC, bit [16] Support for Memory Encryption Contexts for the Realm programming interface. The value of this field is an IMPLEMENTATION DEFINED choice of: MEC Meaning 0b0 Memory Encryption Contexts are not supported. 0b1 Memory Encryption Contexts are supported. If this field is 1, then SMMU_R_MECIDR and SMMU_R_GMECID are present. See also: • Chapter 18 Support for Memory Encryption Contexts. Access to this field is RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 797

Chapter 6. Memory map and registers 6.3. Register formats DPT, bit [15] Support for Device Permission Table and EATS encoding 0b11. The value of this field is an IMPLEMENTATION DEFINED choice of: DPT Meaning 0b0 DPT is not supported. 0b1 DPT is supported. If this bit is 1, then SMMU_R_IDR0.ATS is 1. See also: • STE.EATS • Section 3.9.1.3 Handling of ATS Translated transactions. • 3.24 Device Permission Table. Access to this field is RO. Bits [14:0] Reserved, RES0. Accessing SMMU_R_IDR3 Accesses to this register use the following encodings: Accessible at offset 0x000C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 798

Chapter 6. Memory map and registers 6.3. Register formats 6.3.183 SMMU_R_IDR4 The SMMU_R_IDR4 characteristics are: Purpose This register is zero and there is no IMPLEMENTATION DEFINED behavior for the Realm programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR4 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 0 Bits [31:0] Reserved, RES0. Accessing SMMU_R_IDR4 Accesses to this register use the following encodings: Accessible at offset 0x0010 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 799

Chapter 6. Memory map and registers 6.3. Register formats 6.3.184 SMMU_R_AIDR The SMMU_R_AIDR characteristics are: Purpose This register indicates which revision of the SMMU architecture for Realm Management Extension for Device Assignment to which the implementation conforms. Configuration There are no configuration notes. Attributes SMMU_R_AIDR is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 8 0 0 0 0 7 4 0 0 0 0 3 0 ArchMajorRev ArchMinorRev Bits [31:8] Reserved, RES0. ArchMajorRev, bits [7:4] Major Architecture revision. ArchMajorRev Meaning 0b0000 Realm Management Extension for SMMU. All other values are reserved. Access to this field is RO. ArchMinorRev, bits [3:0] Minor Architecture revision. ArchMinorRev Meaning 0b0000 Realm Management Extension for SMMU. All other values are reserved. Access to this field is RO. Additional Information All other values are reserved. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 800

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_AIDR Accesses to this register use the following encodings: Accessible at offset 0x001C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 801

Chapter 6. Memory map and registers 6.3. Register formats 6.3.185 SMMU_R_CR0 The SMMU_R_CR0 characteristics are: Purpose SMMU Realm state programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_R_CR0 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 VMW 8 6 5 4 3 2 1 0 VSIDEN DPT_WALK_EN RES0 RES0 SMMUEN PRIQEN EVENTQEN CMDQEN ATSCHK Bits [31:12] Reserved, RES0. VSIDEN, bit [11] When SMMU_R_IDR6.VSID == 1: Enable access to the CIT and VSTT structures for DCMDQs that have SID translation enabled. VSIDEN Meaning 0b0 The CIT and VSTT structures cannot be accessed: • Commands requiring SID translation return HERROR_SID_CONFIG. • The SMMU does not access the CIT and VSTT structures and ignores the contents of the SMMU_R_CITAB_BASE and SMMU_R_CITAB_BASE_CFG registers. • The SMMU does not access, insert or modify any translation or configuration cache entries which hold information from the CIT or VSTTs except for invalidation by maintenance commands. 0b1 The CIT and VSTT structures required for SID translation can be accessed. Completion of an Update to this field guarantees all of the following: • For any DCMDQ that was disabled or empty during the Update, all later commands consumed when the queue is enabled and non-empty are guaranteed to observe the new value of this field. • For any DCMDQ that was enabled and non-empty during the Update: – Any commands subsequently submitted to that DCMDQ are guaranteed to observe the new value of this field. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 802

Chapter 6. Memory map and registers 6.3. Register formats – For any other commands, it is CONSTRAINED UNPREDICTABLE whether the value used is the old or new value of this field. Software is expected to disable all DCMDQs before Updating this field. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When SMMU_R_CR0.VSIDEN != SMMU_R_CR0ACK.VSIDEN, access to this field is RO. • Otherwise, access to this field is RW. Otherwise: Reserved, RES0. DPT_WALK_EN, bit [10] When SMMU_R_IDR3.DPT == 1: Enable DPT walks for Realm state. DPT_WALK_EN Meaning 0b0 Realm DPT walks are disabled. 0b1 Realm DPT walks are enabled. This field has similar Update behavior to other CR0 fields, in that: When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_R_CR0ACK.DPT_WALK_EN to the new value. Completion of an Update from 0 to 1 means that: • The SMMU may make fetches of DPT information, and cache DPT entries where permitted. • Transactions for a stream with STE.EATS configured to 0b11 do not result in a DPT_DISABLED DPT lookup fault. Completion of an Update from 1 to 0 means that: • The SMMU has completed all outstanding fetches of DPT information and will not make subsequent fetches. • Previously-cached last-level DPT information in TLBs might continue to be used until completion of appropriate CMD_DPTI_* commands. Note: Completion of a CMD_DPTI_ALL command is guaranteed to be sufficient to remove all DPT information cached in TLBs. Note: Completion of a CMD_DPTI_ALL command is also sufficient to guarantee observability of all Events resulting from the prior DPT_WALK_EN = 1 configuration. • Previously-cached STEs configured with STE.EATS = 0b11 might continue to be used until completion of appropriate Configuration invalidation commands. See also: • STE.EATS • 3.24 Device Permission Table. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 803

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_R_CR0.DPT_WALK_EN != SMMU_R_CR0ACK.DPT_WALK_EN, access to this field is RO. • Otherwise, access to this field is RW. Otherwise: Reserved, RES0. Bit [9] Reserved, RES0. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: VMID Wildcard. VMW Meaning 0b000 TLB invalidations match VMID tags exactly. 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • All other values are reserved, and behave as 0b000. – N == upper bit of VMID as determined by SMMU_IDR0.VMID16. • This field has no effect on VMID matching on translation lookup. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. Bit [5] Reserved, RES0. ATSCHK, bit [4] When SMMU_R_IDR0.ATS == 1: Realm state ATS behavior. ATSCHK Meaning 0b1 Safe mode, all ATS Translated traffic is checked against the corresponding STE.EATS field to determine whether the StreamID is allowed to produce Translated transactions. Access to this field is RO. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 804

Chapter 6. Memory map and registers 6.3. Register formats CMDQEN, bit [3] Enable Realm state Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Realm state Command queue is disabled. 0b1 Processing of commands from the Realm state Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Realm state Event queue writes. EVENTQEN Meaning 0b0 Writes to the Realm state Event queue are disabled. 0b1 Writes to the Realm state Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQEN, bit [1] When SMMU_R_IDR0.PRI == 1: Enable Realm state PRI queue writes. PRIQEN Meaning 0b0 Writes to the Realm state PRI queue are disabled. 0b1 Writes to the Realm state PRI queue are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SMMUEN, bit [0] Realm state SMMU enable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 805

Chapter 6. Memory map and registers 6.3. Register formats SMMUEN Meaning 0b0 All Realm streams are terminated with an abort, according to SMMU_R_GBPA. 0b1 All Realm streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. Additional Information The Update procedure, with respect to flags reflected into SMMU_R_CR0ACK, is the same as for SMMU_CR0. The Update side effects of CMDQEN, EVENTQEN, and SMMUEN fields are similar to their respective equivalents in SMMU_CR0. Accessing SMMU_R_CR0 Accesses to this register use the following encodings: Accessible at offset 0x0020 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. Additional information For more information, see the additional information section in SMMU_CR0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 806

Chapter 6. Memory map and registers 6.3. Register formats 6.3.186 SMMU_R_CR0ACK The SMMU_R_CR0ACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls in the Realm state SMMU programming interface, SMMU_R_CR0. Configuration There are no configuration notes. Attributes SMMU_R_CR0ACK is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 VMW 8 6 5 4 3 2 1 0 VSIDEN DPT_WALK_EN RES0 RES0 SMMUEN PRIQEN EVENTQEN CMDQEN ATSCHK Bits [31:12] Reserved, RES0. VSIDEN, bit [11] When SMMU_R_IDR6.VSID == 1: Enable access to the CIT and VSTT structures for DCMDQs that have SID translation enabled. VSIDEN Meaning 0b0 The CIT and VSTT structures cannot be accessed: • Commands requiring SID translation return HERROR_SID_CONFIG. • The SMMU does not access the CIT and VSTT structures and ignores the contents of the SMMU_R_CITAB_BASE and SMMU_R_CITAB_BASE_CFG registers. • The SMMU does not access, insert or modify any translation or configuration cache entries which hold information from the CIT or VSTTs except for invalidation by maintenance commands. 0b1 The CIT and VSTT structures required for SID translation can be accessed. See SMMU_R_CR0.VSIDEN. The reset behavior of this field is: • This field resets to '0'. Accessing this field has the following behavior: • When SMMU_R_CR0.VSIDEN != SMMU_R_CR0ACK.VSIDEN, access to this field is RO. • Otherwise, access to this field is RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 807

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. DPT_WALK_EN, bit [10] When SMMU_R_IDR3.DPT == 1: Enable DPT walks for Realm state. DPT_WALK_EN Meaning 0b0 Realm DPT walks are disabled. 0b1 Realm DPT walks are enabled. See SMMU_R_CR0.DPT_WALK_EN. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [9] Reserved, RES0. VMW, bits [8:6] When SMMU_IDR0.VMW == 1: VMID Wildcard. VMW Meaning 0b000 TLB invalidations match VMID tags exactly. 0b001 TLB invalidations match VMID[N:1]. 0b010 TLB invalidations match VMID[N:2]. 0b011 TLB invalidations match VMID[N:3]. 0b100 TLB invalidations match VMID[N:4]. • All other values are reserved, and behave as 0b000. – N == upper bit of VMID as determined by SMMU_IDR0.VMID16. • This field has no effect on VMID matching on translation lookup. The reset behavior of this field is: • This field resets to '000'. Otherwise: Reserved, RES0. Bit [5] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 808

Chapter 6. Memory map and registers 6.3. Register formats ATSCHK, bit [4] When SMMU_R_IDR0.ATS == 1: Realm state ATS behavior. ATSCHK Meaning 0b1 Safe mode, all ATS Translated traffic is checked against the corresponding STE.EATS field to determine whether the StreamID is allowed to produce Translated transactions. Access to this field is RO. Otherwise: Reserved, RES0. CMDQEN, bit [3] Enable Realm state Command queue processing. CMDQEN Meaning 0b0 Processing of commands from the Realm state Command queue is disabled. 0b1 Processing of commands from the Realm state Command queue is enabled. The reset behavior of this field is: • This field resets to '0'. EVENTQEN, bit [2] Enable Realm state Event queue writes. EVENTQEN Meaning 0b0 Writes to the Realm state Event queue are disabled. 0b1 Writes to the Realm state Event queue are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQEN, bit [1] When SMMU_R_IDR0.PRI == 1: Enable Realm state PRI queue writes. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 809

Chapter 6. Memory map and registers 6.3. Register formats PRIQEN Meaning 0b0 Writes to the Realm state PRI queue are disabled. 0b1 Writes to the Realm state PRI queue are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. SMMUEN, bit [0] Realm state SMMU enable. SMMUEN Meaning 0b0 All Realm stream accesses are terminated. 0b1 All Realm streams are checked against configuration structures, and might undergo translation. The reset behavior of this field is: • This field resets to '0'. Additional Information Undefined bits read as zero. Fields in this register are RAZ if their corresponding SMMU_R_CR0 field is IGNORED. An Update to a field in SMMU_R_CR0 is considered complete, along with any side effects, when the respective field in this register is observed to take the new value. The Update procedure, with respect to flags reflected in SMMU_R_CR0ACK, is the same as for SMMU_CR0 and SMMU_CR0ACK. Accessing SMMU_R_CR0ACK Accesses to this register use the following encodings: Accessible at offset 0x0024 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 810

Chapter 6. Memory map and registers 6.3. Register formats 6.3.187 SMMU_R_CR1 The SMMU_R_CR1 characteristics are: Purpose Realm state SMMU programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_R_CR1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 12 11 10 9 8 7 6 5 4 3 2 1 0 TABLE_SH TABLE_OC TABLE_IC QUEUE_IC QUEUE_OC QUEUE_SH Bits [31:12] Reserved, RES0. TABLE_SH, bits [11:10] Realm state table access Shareability. TABLE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • Note: When SMMU_R_CR1.TABLE_OC == 0b00 and SMMU_R_CR1.TABLE_IC == 0b00, this field is IGNORED and behaves as Outer Shareable. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.SMMUEN == ‘0’ – SMMU_R_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. TABLE_OC, bits [9:8] Realm state table access Outer Cacheability. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 811

Chapter 6. Memory map and registers 6.3. Register formats TABLE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.SMMUEN == ‘0’ – SMMU_R_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. TABLE_IC, bits [7:6] Realm state table access Inner Cacheability. TABLE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.SMMUEN == ‘0’ – SMMU_R_CR0ACK.SMMUEN == ‘0’ • Otherwise, access to this field is RO. QUEUE_SH, bits [5:4] Realm state Queue access Shareability. QUEUE_SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 812

Chapter 6. Memory map and registers 6.3. Register formats QUEUE_SH Meaning 0b10 Outer Shareable. 0b11 Inner Shareable. • When SMMU_R_CR1.QUEUE_OC == 0b00 and SMMU_R_CR1.QUEUE_IC == 0b00, this field is IGNORED and behaves as Outer Shareability. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.EVENTQEN == ‘0’ – SMMU_R_CR0ACK.EVENTQEN == ‘0’ – SMMU_R_CR0.CMDQEN == ‘0’ – SMMU_R_CR0ACK.CMDQEN == ‘0’ – SMMU_R_CR0.PRIQEN == ‘0’ – SMMU_R_CR0ACK.PRIQEN == ‘0’ – SMMU_R_HDBSS_BASE0.V == ‘0’ – SMMU_R_HDBSS_PROD0.VACK == ‘0’ – SMMU_R_HDBSS_BASE1.V == ‘0’ – SMMU_R_HDBSS_PROD1.VACK == ‘0’ – SMMU_R_HACDBS_BASE.EN == ‘0’ – SMMU_R_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_R_IDR0.ECMDQ == 0 · SMMU_R_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Realm state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_R_ECMDQ_PRODn.EN == SMMU_R_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_OC, bits [3:2] Realm state Queue access Outer Cacheability. QUEUE_OC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 813

Chapter 6. Memory map and registers 6.3. Register formats Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.EVENTQEN == ‘0’ – SMMU_R_CR0ACK.EVENTQEN == ‘0’ – SMMU_R_CR0.CMDQEN == ‘0’ – SMMU_R_CR0ACK.CMDQEN == ‘0’ – SMMU_R_CR0.PRIQEN == ‘0’ – SMMU_R_CR0ACK.PRIQEN == ‘0’ – SMMU_R_HDBSS_BASE0.V == ‘0’ – SMMU_R_HDBSS_PROD0.VACK == ‘0’ – SMMU_R_HDBSS_BASE1.V == ‘0’ – SMMU_R_HDBSS_PROD1.VACK == ‘0’ – SMMU_R_HACDBS_BASE.EN == ‘0’ – SMMU_R_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_R_IDR0.ECMDQ == 0 · SMMU_R_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Realm state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_R_ECMDQ_PRODn.EN == SMMU_R_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. QUEUE_IC, bits [1:0] Realm state Queue access Inner Cacheability. QUEUE_IC Meaning 0b00 Non-cacheable. 0b01 Write-Back Cacheable. 0b10 Write-Through Cacheable. 0b11 Reserved, treated as 0b00. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Accessing this field has the following behavior: • Access to this field is RW if all of the following are true: – SMMU_R_CR0.EVENTQEN == ‘0’ – SMMU_R_CR0ACK.EVENTQEN == ‘0’ – SMMU_R_CR0.CMDQEN == ‘0’ – SMMU_R_CR0ACK.CMDQEN == ‘0’ – SMMU_R_CR0.PRIQEN == ‘0’ – SMMU_R_CR0ACK.PRIQEN == ‘0’ – SMMU_R_HDBSS_BASE0.V == ‘0’ – SMMU_R_HDBSS_PROD0.VACK == ‘0’ – SMMU_R_HDBSS_BASE1.V == ‘0’ – SMMU_R_HDBSS_PROD1.VACK == ‘0’ – SMMU_R_HACDBS_BASE.EN == ‘0’ ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 814

Chapter 6. Memory map and registers 6.3. Register formats – SMMU_R_HACDBS_CONS.ENACK == ‘0’ – Any of the following are true: * All of the following are true: · SMMU_R_IDR0.ECMDQ == 0 · SMMU_R_IDR2.RECMDQ == 0 * All ECMDQ interfaces in the Realm state are disabled (i.e. the following condition applies for all ECMDQ interfaces: SMMU_R_ECMDQ_PRODn.EN == SMMU_R_ECMDQ_CONSn.ENACK == 0) • Otherwise, access to this field is RO. Additional Information The TABLE_ fields set the attributes for access to memory through the SMMU_R_STRTAB_BASE.ADDR pointer and any accesses made to a VMS through STE.VMSPtr in an STE. The QUEUE_ fields set the attributes for access to memory through SMMU_R_CMDQ_BASE.ADDR, SMMU_R_EVENTQ_BASE.ADDR and SMMU_R_PRIQ_BASE.ADDR pointers. When SMMU_R_IDR0.ECMDQ is 1 or SMMU_R_IDR2.RECMDQ is 1, QUEUE_* fields set the attributes for access to memory through SMMU_R_ECMDQ_BASEn.ADDR pointers. Cache allocation hints are present in each _BASE register and are ignored unless a cacheable type is used for the table or queue to which the register corresponds. The transient attribute is IMPLEMENTATION DEFINED for each _BASE register. See section 13.1.2 Attribute support; use of an unsupported memory type for structure or queue access might cause the access to be treated as an external abort. For example, in the case of SMMU_R_STRTAB_BASE, an F_STE_FETCH fault is raised. Accessing SMMU_R_CR1 Accesses to this register use the following encodings: Accessible at offset 0x0028 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 815

Chapter 6. Memory map and registers 6.3. Register formats 6.3.188 SMMU_R_CR2 The SMMU_R_CR2 characteristics are: Purpose Realm state SMMU programming interface control and configuration register. Configuration There are no configuration notes. Attributes SMMU_R_CR2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 4 3 PTM 2 1 E2H 0 REC_CFG_ATS RECINVSID Bits [31:4] Reserved, RES0. REC_CFG_ATS, bit [3] When SMMU_R_IDR0.ATS == 1 and SMMU_IDR0.ATSRECERR == 1: Record ATS Translation Request errors for Realm state in the Event queue. REC_CFG_ATS Meaning 0b0 SMMU records only the base set of Events for Realm state ATS-related and PRI requests. 0b1 SMMU records an extended set of Events for Realm state ATS-related and PRI requests. See section 3.9.1.2 Responses to ATS Translation Requests and section 8.1 PRI queue overflow for details of which events are recorded or not. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. PTM, bit [2] When SMMU_IDR0.BTM == 1: Realm state Private TLB Maintenance. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 816

Chapter 6. Memory map and registers 6.3. Register formats PTM Meaning 0b0 The SMMU participates in broadcast TLB maintenance for Realm state, if implemented. See SMMU_IDR0.BTM. 0b1 The SMMU is not required to invalidate any local TLB entries on receipt of broadcast TLB maintenance operations for Realm translation regimes. • Broadcast invalidation for Non-secure and Secure EL1, Non-secure and Secure EL2, Non-secure and Secure EL2-E2H or EL3 translation regimes are not affected by this flag, see SMMU_S_CR2.PTM. • This field resets to an IMPLEMENTATION SPECIFIC value. Arm recommends SMMU_R_CR2.PTM is reset to 1 where it is supported, but software cannot rely on this value. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. RECINVSID, bit [1] Record event C_BAD_STREAMID from invalid input StreamIDs for Realm state. RECINVSID Meaning 0b0 C_BAD_STREAMID events are not recorded for the Realm state programming interface. 0b1 C_BAD_STREAMID events are permitted to be recorded for the Realm state programming interface. The reset behavior of this field is: • This field resets to an UNKNOWN value. E2H, bit [0] Enable Realm state EL2-E2H translation regime. E2H Meaning 0b0 EL2 translation regime, without ASIDs or VMIDs. 0b1 EL2-E2H translation regime used, with ASID. • This field affects the STE.STRW encoding 0b10, which selects a hypervisor translation regime for the resulting translations. The translations are tagged without ASID in EL2 mode, or with ASID in EL2-E2H mode. Note: Arm expects software to set this bit to match HCR_EL2.E2H in host PEs. • This bit is permitted to be cached in configuration caches and TLBs. Changes to this bit must be accompanied by invalidation of configuration and translations associated with streams configured with StreamWorld == Realm-EL2 or Realm-EL2-E2H. • This bit affects the StreamWorld of Realm streams only. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 817

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_CR2 This register is made read-only when the associated SMMU_R_CR0.SMMUEN is Updated to 1. This register must only be changed when SMMU_R_CR0.SMMUEN == 0. A write to this register after SMMU_R_CR0.SMMUEN has been changed but before its Update completes is IGNORED. Accesses to this register use the following encodings: Accessible at offset 0x002C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.SMMUEN == ‘0’ and SMMU_R_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 818

Chapter 6. Memory map and registers 6.3. Register formats 6.3.189 SMMU_R_S2PII The SMMU_R_S2PII characteristics are: Purpose Configuration of stage 2 permission indirection interpretation for Realm state. Configuration This register is present only when SMMU_IDR3.S2PI == 1. Otherwise, direct accesses to SMMU_R_S2PII are RES0. Attributes SMMU_R_S2PII is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions S2PII15 63 60 S2PII14 59 56 S2PII13 55 52 S2PII12 51 48 S2PII11 47 44 S2PII10 43 40 S2PII9 39 36 S2PII8 35 32 S2PII7 31 28 S2PII6 27 24 S2PII5 23 20 S2PII4 19 16 S2PII3 15 12 S2PII2 11 8 S2PII1 7 4 S2PII0 3 0 S2PII

, bits [4p+3:4p], for p = 15 to 0 The set of 16 stage 2 base permission interpretations. This field is indexed by the PIIndex value derived from a stage 2 Block or Page descriptor, as S2PII[PIIndex4+3 : PIIndex4] to give a permission interpretation. S2PII

Meaning 0b0000 No Access 0b0001 Reserved, treated as No Access 0b0010 MRO 0b0011 MRO-TL1 0b0100 WO 0b0101 Reserved, treated as No Access 0b0110 MRO-TL0 0b0111 MRO-TL01 0b1000 RO 0b1001 RO+uX 0b1010 RO+pX 0b1011 RO+puX 0b1100 RW 0b1101 RW+uX 0b1110 RW+pX ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 819

Chapter 6. Memory map and registers 6.3. Register formats S2PII

Meaning 0b1111 RW+puX This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_S2PII Arm strongly recommends that this register is not written if SMMUEN is 1 and there are any STEs for which STE.S2PIE is 1. Accesses to this register use the following encodings: Accessible at offset 0x0030 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 820

Chapter 6. Memory map and registers 6.3. Register formats 6.3.190 SMMU_R_GBPA The SMMU_R_GBPA characteristics are: Purpose Global ByPass Attribute for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_GBPA is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 21 1 20 RES0 19 0 ABORT Bits [31:21] Reserved, RES0. ABORT, bit [20] Abort all incoming transactions for Realm state. ABORT Meaning 0b1 Abort all incoming transactions. Note: Consistent with the behavior of SMMU_GBPA.ABORT for Non-secure state, configuration of SMMU_CR0.SMMUEN = 0 might result in F_BAD_ATS_TREQ and F_TRANSL_FORBIDDEN for ATS translation requests and ATS-translated transactions respectively. Access to this field is RO. Bits [19:0] Reserved, RES0. Accessing SMMU_R_GBPA Accesses to this register use the following encodings: Accessible at offset 0x0044 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 821

Chapter 6. Memory map and registers 6.3. Register formats 6.3.191 SMMU_R_AGBPA The SMMU_R_AGBPA characteristics are: Purpose Alternate Global ByPass Attribute for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_AGBPA is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions IMPLEMENTATION DEFINED 31 0 IMPLEMENTATION DEFINED, bits [31:0] IMPLEMENTATION DEFINED attributes to assign. The reset behavior of this field is: • This field resets to an IMPLEMENTATION DEFINED value. Additional Information • This register allows an implementation to apply an additional non-architected attributes or tag to bypassing transactions. • If this field is unsupported by an implementation it is RES0. • Note: Arm does not recommend that this register further modifies existing architected bypass attributes. The process used to change contents of this register is IMPLEMENTATION DEFINED. Accessing SMMU_R_AGBPA Accesses to this register use the following encodings: Accessible at offset 0x0048 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 822

Chapter 6. Memory map and registers 6.3. Register formats 6.3.192 SMMU_R_IRQ_CTRL The SMMU_R_IRQ_CTRL characteristics are: Purpose Realm state Interrupt control and configuration register. Configuration There are no configuration notes. Attributes SMMU_R_IRQ_CTRL is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN PRIQ_IRQEN EVENTQ_IRQEN Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_R_IDR3.HACDBS == 1: Realm state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing for Realm state are disabled. 0b1 Interrupts related to the completion of HACDBS processing for Realm state are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_R_IDR3.HDBSS == 1: Realm state HDBSS interrupt enable. HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Realm state HDBSS table are disabled. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 823

Chapter 6. Memory map and registers 6.3. Register formats HDBSS_IRQEN Meaning 0b1 Interrupts related to a full Realm state HDBSS table are enabled. Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Event queue interrupt enable for Realm state. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Event queue for Realm state are disabled. 0b1 Interrupts from the Event queue for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQ_IRQEN, bit [1] When SMMU_R_IDR0.PRI == 1: PRI queue interrupt enable for Realm state. PRIQ_IRQEN Meaning 0b0 Interrupts from PRI queue for Realm state are disabled. 0b1 Interrupts from PRI queue for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. GERROR_IRQEN, bit [0] GERROR interrupt enable for Realm state. GERROR_IRQEN Meaning 0b0 Interrupts from Global errors for Realm state are disabled. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 824

Chapter 6. Memory map and registers 6.3. Register formats GERROR_IRQEN Meaning 0b1 Interrupts from Global errors for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. Additional Information Each field in this register has a corresponding field in the SMMU_R_IRQ_CTRLACK, with the same Update observability semantics as fields in SMMU_R_CR0 versus SMMU_R_CR0ACK. This register contains IRQ enable flags for GERROR, PRI queue and Event queue interrupt sources for Realm state. These enables allow or inhibit both edge-triggered wired outputs if implemented and MSI writes if implemented. IRQ enable flags Guard the MSI address and payload registers when MSIs supported, SMMU_R_IDR0.MSI == 1, which must only be changed when their respective enable flag is 0. See SMMU_R_GERROR_IRQ_CFG0 for details. Accessing SMMU_R_IRQ_CTRL Accesses to this register use the following encodings: Accessible at offset 0x0050 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 825

Chapter 6. Memory map and registers 6.3. Register formats 6.3.193 SMMU_R_IRQ_CTRLACK The SMMU_R_IRQ_CTRLACK characteristics are: Purpose Provides acknowledgment of changes to configurations and controls of Realm state interrupts in SMMU_R_IRQ_CTRL. Configuration There are no configuration notes. Attributes SMMU_R_IRQ_CTRLACK is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 5 4 3 2 1 0 HACDBS_IRQEN HDBSS_IRQEN GERROR_ IRQEN PRIQ_IRQEN EVENTQ_IRQEN Bits [31:5] Reserved, RES0. HACDBS_IRQEN, bit [4] When SMMU_R_IDR3.HACDBS == 1: Realm state event queue interrupt enable. HACDBS_IRQEN Meaning 0b0 Interrupts related to the completion of HACDBS processing for Realm state are disabled. 0b1 Interrupts related to the completion of HACDBS processing for Realm state are enabled. Otherwise: Reserved, RES0. HDBSS_IRQEN, bit [3] When SMMU_R_IDR3.HDBSS == 1: Realm state HDBSS interrupt enable. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 826

Chapter 6. Memory map and registers 6.3. Register formats HDBSS_IRQEN Meaning 0b0 Interrupts related to a full Realm state HDBSS table are disabled. 0b1 Interrupts related to a full Realm state HDBSS table are enabled. Otherwise: Reserved, RES0. EVENTQ_IRQEN, bit [2] Event queue interrupt enable for Realm state. EVENTQ_IRQEN Meaning 0b0 Interrupts from the Event Queue for Realm state are disabled. 0b1 Interrupts from the Event Queue for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. PRIQ_IRQEN, bit [1] When SMMU_R_IDR0.PRI == 1: PRI queue interrupt enable for Realm state. PRIQ_IRQEN Meaning 0b0 Interrupts from PRI Queue for Realm state are disabled. 0b1 Interrupts from PRI Queue for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. GERROR_IRQEN, bit [0] GERROR interrupt enable for Realm state. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 827

Chapter 6. Memory map and registers 6.3. Register formats GERROR_IRQEN Meaning 0b0 Interrupts from Global errors for Realm state are disabled. 0b1 Interrupts from Global errors for Realm state are enabled. The reset behavior of this field is: • This field resets to '0'. Additional Information Undefined bits read as zero. Fields in this register are RAZ if their corresponding SMMU_R_IRQ_CTRL field is reserved. Accessing SMMU_R_IRQ_CTRLACK Accesses to this register use the following encodings: Accessible at offset 0x0054 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 828

Chapter 6. Memory map and registers 6.3. Register formats 6.3.194 SMMU_R_GERROR The SMMU_R_GERROR characteristics are: Purpose Reporting of Global Error conditions for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_GERROR is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR DPT_ERR CMDQP_ERR RES0 CMDQ_ER R RES0 EVENTQ_ABT_ER R PRIQ_ABT_ERR MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR MSI_PRIQ_ABT_ERR MSI_GERROR_ABT_ERR This register, in conjunction with SMMU_R_GERRORN, indicates whether global error conditions for Realm state exist. See section 7.5 Global error recording. An error is active if the value of SMMU_R_GERROR[x] is different to the corresponding SMMU_R_GERRORN[x] bit. The SMMU toggles SMMU_R_GERROR[x] when an error becomes active. An external agent acknowledges the error by toggling the corresponding SMMU_GERRORN[x], making the GERRORN[x] bit the same value as the corresponding GERROR[x] bit. Acknowledging an error deactivates the error, allowing a new occurrence to be reported at a later time. The SMMU does not toggle a bit when an error is already active. An error is only activated if it is in an inactive state. Note: Software is not intended to trigger interrupts by arranging for GERRORN[x] to differ from GERROR[x]. See SMMU_R_GERRORN. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] When SMMU_R_IDR6.DCMDQ == 1: Realm state error on a DCMDQ control page. When this bit is different to SMMU_R_GERRORN.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 829

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. MSI_HACDBS_ABT_ERR, bit [14] When SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR0.MSI == 1: HACDBS processing completed MSI abort. When this bit is different from SMMU_R_GERRORN.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_R_IDR3.HACDBS == 1: HACDBS error. When this bit is different from SMMU_R_GERRORN.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_R_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR0.MSI == 1: Realm state HDBSS table full MSI abort. When this bit is different from SMMU_R_GERRORN.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_R_IDR3.HDBSS == 1: Realm state HDBSS update error. When this bit is different from SMMU_R_GERRORN.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_R_HDBSS_PRODn.ERR_REASON. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 830

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Otherwise: Reserved, RES0. DPT_ERR, bit [10] When SMMU_R_IDR3.DPT == 1: DPT Lookup fault. When this bit is different from SMMU_R_GERRORN.DPT_ERR, it indicates that one or more DPT lookup faults have occurred, and that syndrome information is available in SMMU_R_DPT_CFG_FAR. For more information see 3.24.4 DPT lookup errors The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQP_ERR, bit [9] When SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1: When this bit is different to SMMU_R_GERRORN.CMDQP_ERR, it indicates that one or more errors have been encountered on a Command queue control page interface of the Realm state. See section 3.5.6.3 Errors relating to an ECMDQ interface. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [8] Reserved, RES0. MSI_GERROR_ABT_ERR, bit [7] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERRORN[7], a GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_PRIQ_ABT_ERR, bit [6] When SMMU_R_IDR0.MSI == 1 and SMMU_R_IDR0.PRI == 1: • When this bit is different to SMMU_R_GERRORN[6], a Realm state PRI queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 831

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. Otherwise: Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERRORN[5], a Realm state Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERRORN[4], a CMD_SYNC Realm state MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. PRIQ_ABT_ERR, bit [3] When SMMU_R_IDR0.PRI == 1: • When this bit is different to SMMU_R_GERRORN[3], an access to the Realm state PRI queue was terminated with abort. – Page Request records might have been lost. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. EVENTQ_ABT_ERR, bit [2] • When this bit is different to SMMU_R_GERRORN[2], an access to the Realm state Event queue was terminated with abort. – Event records might have been lost. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 832

Chapter 6. Memory map and registers 6.3. Register formats CMDQ_ERR, bit [0] • When this bit is different to SMMU_R_GERRORN[0], a Realm state command has been encountered that cannot be processed. – SMMU_R_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. – Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_R_GERROR Accesses to this register use the following encodings: Accessible at offset 0x0060 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 833

Chapter 6. Memory map and registers 6.3. Register formats 6.3.195 SMMU_R_GERRORN The SMMU_R_GERRORN characteristics are: Purpose Acknowledgement of Global Error conditions for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_GERRORN is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMDQP_ERR MSI_HACDBS_ABT_ERR HACDBS_ERR MSI_HDBSS_ABT_ERR HDBSS_ERR DPT_ERR CMDQP_ERR RES0 CMDQ_ER R RES0 EVENTQ_ABT_ER R PRIQ_ABT_ERR MSI_CMDQ_ABT_ERR MSI_EVENTQ_ABT_ERR MSI_PRIQ_ABT_ERR MSI_GERROR_ABT_ERR This register has the same fields as SMMU_R_GERROR. Software must not toggle fields in this register that correspond to errors that are inactive. It is CONSTRAINED UNPREDICTABLE whether or not an SMMU activates errors if this is done. The SMMU does not alter fields in this register. A read of this register returns the values that were last written to the defined fields of the register. Note: Software might maintain an internal copy of the last value written to this register, for comparison against values read from SMMU_R_GERROR when probing for errors. Bits [31:16] Reserved, RES0. DCMDQP_ERR, bit [15] When SMMU_R_IDR6.DCMDQ == 1: Realm state error on a DCMDQ control page. When this bit is different to SMMU_R_GERROR.DCMDQP_ERR, one or more errors have been encountered on a DCMDQ control page. See 3.5.7.7 DCMDQ Errors and Faults. The status of SMMU_R_GERROR.DCMDQP_ERR and SMMU_R_GERRORN.DCMDQP_ERR does not affect command consumption on a DCMDQ: command consumption on the erroneous queue restarts once the error has been acknowledged, either by the guest via the SMMU_R_DCMDQ_PRODn.ERRACK register field or by the hypervisor via the SMMU_R_ECMDQ_PRODn.HS_ERRACK register field, depending on the error type. Errors on a DCMDQ are always reported and acknowledged through SMMU_R_GERROR.DCMDQP_ERR and SMMU_R_GERRORN.DCMDQP_ERR respectively. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 834

Chapter 6. Memory map and registers 6.3. Register formats SMMU_R_GERROR.CMDQP_ERR and SMMU_R_GERRORN.CMDQP_ERR are only used to report and acknowledge errors on an ECMDQ which is not in direct-mode. Otherwise: Reserved, RES0. MSI_HACDBS_ABT_ERR, bit [14] When SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR0.MSI == 1: Realm state HACDBS processing completed MSI abort. When this bit is different from SMMU_R_GERROR.MSI_HACDBS_ABT_ERR, it indicates that a HACDBS processing completed MSI was terminated with abort. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HACDBS_ERR, bit [13] When SMMU_R_IDR3.HACDBS == 1: Realm state HACDBS error. When this bit is different from SMMU_R_GERROR.HACDBS_ERR, it indicates that one or more HACDBS errors have occurred. The details of the type of error are captured in SMMU_R_HACDBS_CONS.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_HDBSS_ABT_ERR, bit [12] When SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR0.MSI == 1: Realm state HDBSS table full MSI abort. When this bit is different from SMMU_R_GERROR.MSI_HDBSS_ABT_ERR, it indicates that an HDBSS table full MSI was terminated with abort. Note: Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. HDBSS_ERR, bit [11] When SMMU_R_IDR3.HDBSS == 1: Realm state HDBSS update error. When this bit is different from SMMU_R_GERROR.HDBSS_ERR, it indicates that one or more HDBSS errors have occurred. The details about the type of error are captured in SMMU_R_HDBSS_PRODn.ERR_REASON. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 835

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. DPT_ERR, bit [10] When SMMU_R_IDR3.DPT == 1: DPT Lookup fault. See SMMU_R_GERROR.DPT_ERR. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. CMDQP_ERR, bit [9] When SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1: See SMMU_R_GERROR.CMDQP_ERR. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. Bit [8] Reserved, RES0. MSI_GERROR_ABT_ERR, bit [7] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERROR[7], a Realm state GERROR MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_PRIQ_ABT_ERR, bit [6] When SMMU_R_IDR0.MSI == 1 and SMMU_R_IDR0.PRI == 1: • When this bit is different to SMMU_R_GERROR[6], a Realm state PRI queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 836

Chapter 6. Memory map and registers 6.3. Register formats Otherwise: Reserved, RES0. MSI_EVENTQ_ABT_ERR, bit [5] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERROR[5], a Realm state Event queue MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. MSI_CMDQ_ABT_ERR, bit [4] When SMMU_R_IDR0.MSI == 1: • When this bit is different to SMMU_R_GERROR[4], a Realm state CMD_SYNC MSI was terminated with abort. – Activation of this error does not affect future MSIs. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. PRIQ_ABT_ERR, bit [3] When SMMU_R_IDR0.PRI == 1: • When this bit is different to SMMU_R_GERROR[3], an access to the Realm state PRI queue was terminated with abort. – Page Request records might have been lost. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. EVENTQ_ABT_ERR, bit [2] • When this bit is different to SMMU_R_GERROR[2], an access to the Realm state Event queue was terminated with abort. – Event records might have been lost. The reset behavior of this field is: • This field resets to '0'. Bit [1] Reserved, RES0. CMDQ_ERR, bit [0] ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 837

Chapter 6. Memory map and registers 6.3. Register formats • When this bit is different to SMMU_R_GERROR[0], a Realm state command has been encountered that cannot be processed. – SMMU_R_CMDQ_CONS.ERR has been updated with a reason code and command processing has stopped. – Commands are not processed while this error is active. The reset behavior of this field is: • This field resets to '0'. Accessing SMMU_R_GERRORN Accesses to this register use the following encodings: Accessible at offset 0x0064 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 838

Chapter 6. Memory map and registers 6.3. Register formats 6.3.196 SMMU_R_GERROR_IRQ_CFG0 The SMMU_R_GERROR_IRQ_CFG0 characteristics are: Purpose Global Error interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_GERROR_IRQ_CFG0 are RES0. Attributes SMMU_R_GERROR_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions NS 63 RES0 62 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 NS, bit [63] MSI targets either the Realm physical address space or the Non-secure physical address space. NS Meaning 0b0 MSIs are issued to Realm physical address space. 0b1 MSIs are issued to the Non-secure physical address space. Bits [62:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_R_IRQ_CTRL.GERROR_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 839

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_GERROR_IRQ_CFG0 SMMU_R_GERROR_IRQ_CFG0 is Guarded by SMMU_R_IRQ_CTRL.GERROR_IRQEN and must only be modified when SMMU_R_IRQ_CTRL.GERROR_IRQEN == 0. These update conditions are common for all SMMU_R__IRQ_CFG{0,1,2} register sets in the SMMU with respect to their corresponding SMMU_R_IRQ_CTRL._IRQEN flag. Accesses to this register use the following encodings: Accessible at offset 0x0068 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 840

Chapter 6. Memory map and registers 6.3. Register formats 6.3.197 SMMU_R_GERROR_IRQ_CFG1 The SMMU_R_GERROR_IRQ_CFG1 characteristics are: Purpose Global Error interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_GERROR_IRQ_CFG1 are RES0. Attributes SMMU_R_GERROR_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_GERROR_IRQ_CFG1 SMMU_R_GERROR_IRQ_CFG1 is Guarded by SMMU_R_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0070 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 841

Chapter 6. Memory map and registers 6.3. Register formats 6.3.198 SMMU_R_GERROR_IRQ_CFG2 The SMMU_R_GERROR_IRQ_CFG2 characteristics are: Purpose Global Error interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_GERROR_IRQ_CFG2 are RES0. Attributes SMMU_R_GERROR_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 842

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_GERROR_IRQ_CFG2 SMMU_R_GERROR_IRQ_CFG2 is Guarded by SMMU_R_IRQ_CTRL.GERROR_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.GERROR_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x0074 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.GERROR_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.GERROR_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 843

Chapter 6. Memory map and registers 6.3. Register formats 6.3.199 SMMU_R_STRTAB_BASE The SMMU_R_STRTAB_BASE characteristics are: Purpose Configuration of Stream table base address for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_STRTAB_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:6] 55 32 RES0 ADDR[55:6] 31 6 RES0 5 0 Access attributes of the Stream table are set using the SMMU_R_CR1.TABLE_* fields, a Read-Allocate hint is provided for Stream table accesses with the RA field. Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:6] Physical address of Stream table base, bits [55:6]. Address bits above and below this field range are implied as zero. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 844

Chapter 6. Memory map and registers 6.3. Register formats Note: An implementation is not required to store these bits. When a Linear Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b00, the effective base address is aligned by the SMMU to the table size, ignoring the least-significant bits in the ADDR range as required to do so: ADDR[LOG2SIZE + 5:0] = 0. When a 2-level Stream table is used, that is when SMMU_STRTAB_BASE_CFG.FMT == 0b01, the effective base address is aligned by the SMMU to the larger of 64 bytes or the first-level table size: ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0. The alignment of ADDR is affected by the literal value of the respective SMMU_STRTAB_BASE_CFG.LOG2SIZE field and is not limited by SIDSIZE. Note: This means that configuring a table that is larger than required by the incoming StreamID span results in some entries being unreachable, but the table is still aligned to the configured size. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [5:0] Reserved, RES0. Accessing SMMU_R_STRTAB_BASE This register is Guarded by SMMU_R_CR0.SMMUEN and must only be written when SMMU_R_CR0.SMMUEN == 0. These update conditions are common for all SMMU_R_STRTAB_* registers in the SMMU with respect to their corresponding SMMUEN. Accesses to this register use the following encodings: Accessible at offset 0x0080 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_R_CR0.SMMUEN == ‘0’ and SMMU_R_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 845

Chapter 6. Memory map and registers 6.3. Register formats 6.3.200 SMMU_R_STRTAB_BASE_CFG The SMMU_R_STRTAB_BASE_CFG characteristics are: Purpose Configuration of Stream table for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_STRTAB_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 18 FMT 17 16 RES0 15 11 SPLIT 10 6 LOG2SIZE 5 0 Bits [31:18] Reserved, RES0. FMT, bits [17:16] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Format of Stream table. FMT Meaning 0b00 Linear - ADDR points to an array of STEs. 0b01 2-level - ADDR points to an array of Level 1 Stream Table Descriptors. Other values are reserved, behave as 0b00. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [15:11] Reserved, RES0. SPLIT, bits [10:6] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: StreamID split point for multi-level table. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 846

Chapter 6. Memory map and registers 6.3. Register formats SPLIT Meaning 0b00110 6 bits - 4KB leaf tables. 0b01000 8 bits - 16KB leaf tables. 0b01010 10 bits - 64KB leaf tables. This field determines the split point of a 2-level Stream table, selected by the number of bits at the bottom level. This field is IGNORED if FMT == 0b00. Other values are reserved, behave as 0b0110. The upper-level L1STD is located using StreamID[LOG2SIZE - 1:SPLIT] and this indicates the lowest-level table which is indexed by StreamID[SPLIT - 1:0]. For example, selecting SPLIT == 6 (0b0110) causes StreamID[5:0] to be used to index the lowest level Stream table and StreamID[LOG2SIZE - 1:6] to index the upper level table. Note: If SPLIT >= LOG2SIZE, a single upper-level descriptor indicates one bottom-level Stream table with 2LOG2SIZE usable entries. The L1STD.Span value’s valid range is up to SPLIT + 1, but not all of this Span is accessible, as it is not possible to use a StreamID >= 2LOG2SIZE. Note: Arm recommends that a Linear table, FMT == 0b00, is used instead of programming SPLIT >= LOG2SIZE. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Otherwise: Reserved, RES0. LOG2SIZE, bits [5:0] Table size as log2(entries). The maximum StreamID value that can be used to index into the Stream table is 2LOG2SIZE - 1. The StreamID range is equal to the number of STEs in a linear Stream table or the maximum sum of the STEs in all second-level tables. The number of L1STDs in the upper level of a 2-level table is MAX(1, 2LOG2SIZE-SPLIT). Except for readback of a written value, the effective LOG2SIZE is MIN(LOG2SIZE, SMMU_IDR1.SIDSIZE) for the purposes of input StreamID range checking and upper/lower/linear Stream table index address calculation. The reset behavior of this field is: • When SMMU_IDR1.TABLES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information A transaction having a StreamID >= 2LOG2SIZE is out of range. Such a transaction is terminated with abort and a C_BAD_STREAMID event is recorded if permitted by SMMU_CR2.RECINVSID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 847

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_STRTAB_BASE_CFG This register is Guarded by SMMU_R_CR0.SMMUEN and must only be written when SMMU_R_CR0.SMMUEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x0088 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.TABLES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_R_CR0.SMMUEN == ‘0’ and SMMU_R_CR0ACK.SMMUEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 848

Chapter 6. Memory map and registers 6.3. Register formats 6.3.201 SMMU_R_CMDQ_BASE The SMMU_R_CMDQ_BASE characteristics are: Purpose Configuration of the Command queue base address for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_CMDQ_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] Address of Command queue base, bits [55:5]. • Address bits above and below this field range are treated as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ADDR bits [4:0] are treated as zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 849

Chapter 6. Memory map and registers 6.3. Register formats – Note: For example, a queue with 28 entries is 4096 bytes in size so software must align an allocation, and therefore ADDR, to a 4KB boundary. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE must be less than or equal to SMMU_IDR1.CMDQS. Except for the purposes of readback of this register, any use of the value of this field is capped at the maximum, SMMU_IDR1.CMDQS. • The minimum size is 0, for one entry, but this must be aligned to a 32-byte (2 entry) boundary as above. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information Upon initialization, if SMMU_IDR1.QUEUES_PRESET == 0 then the SMMU_R_CMDQ_BASE.LOG2SIZE field might affect which bits of SMMU_R_CMDQ_CONS.RD and SMMU_R_CMDQ_PROD.WR can be written upon initialization. The registers must be initialized in this order: 1. Write SMMU_R_CMDQ_BASE to set the queue base and size. 2. Write initial values to SMMU_R_CMDQ_CONS and SMMU_R_CMDQ_PROD. 3. Enable the queue with an Update of the respective SMMU_R_CR0.CMDQEN to 1. This also applies to the initialization of Event queue and PRI queue registers. Access attributes of the Command queue are set using the SMMU_R_CR1.QUEUE_ fields. A Read-Allocate hint is provided for Command queue accesses with the RA field. Accessing SMMU_R_CMDQ_BASE SMMU_R_CMDQ_BASE is Guarded by SMMU_R_CR0.CMDQEN and must only be modified when SMMU_R_CR0.CMDQEN == 0 These update conditions are common for all SMMU_()CMDQ{BASE, CONS} registers in the SMMU with respect to their corresponding CMDQEN. Accesses to this register use the following encodings: Accessible at offset 0x0090 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_R_CR0.CMDQEN == ‘0’ and SMMU_R_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 850

Chapter 6. Memory map and registers 6.3. Register formats 6.3.202 SMMU_R_CMDQ_PROD The SMMU_R_CMDQ_PROD characteristics are: Purpose Allows Command queue producer to update the write index for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_CMDQ_PROD is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 20 WR 19 0 Bits [31:20] Reserved, RES0. WR, bits [19:0] Command queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Command queue write index wrap flag. Bits [QS-1:0]: WR - Command queue write index. • Updated by the host PE (producer) indicating the next empty space in the queue after new data. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_CMDQ_BASE.LOG2SIZE, see SMMU_R_CMDQ_CONS. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.CMDQS < 19, bits [19:CMDQS+1] are UNKNOWN on read. If QS == 0 the queue has one entry. Zero bits of WR index are present and WR_WRAP is bit zero. When software increments WR, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and WR_WRAP toggled. Note: In the degenerate case of a one-entry queue, an increment of WR consists solely of a toggle of WR_WRAP. There is space in the queue for additional commands if: SMMU_R_CMDQ_CONS.RD != SMMU_R_CMDQ_PROD.WR || SMMU_R_CMDQ_CONS.RD_WRAP == SMMU_R_CMDQ_PROD.WR_WRAP ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 851

Chapter 6. Memory map and registers 6.3. Register formats The value written to this register must only move the pointer in a manner consistent with adding N consecutive entries to the Command queue, updating WR_WRAP when appropriate. When SMMU_R_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_R_CR0.CMDQEN is transitioned from 0 to 1. A write to this register causes the SMMU to consider the Command queue for processing if SMMU_R_CR0.CMDQEN == 1 and SMMU_R_GERROR.CMDQ_ERR is not active. Accessing SMMU_R_CMDQ_PROD Accesses to this register use the following encodings: Accessible at offset 0x0098 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 852

Chapter 6. Memory map and registers 6.3. Register formats 6.3.203 SMMU_R_CMDQ_CONS The SMMU_R_CMDQ_CONS characteristics are: Purpose Command queue consumer read index for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_CMDQ_CONS is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 31 ERR 30 24 RES0 23 20 RD 19 0 RES0 Bit [31] Reserved, RES0. ERR, bits [30:24] Error reason code. • When a command execution error is detected, ERR is set to a reason code and then the SMMU_R_GERROR.CMDQ_ERR global error becomes active. • The value in this field is UNKNOWN when the CMDQ_ERR global error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [23:20] Reserved, RES0. RD, bits [19:0] Command queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Queue read index wrap flag. Bits [QS-1:0]: RD - Queue read index. • Updated by the SMMU (consumer) to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_CMDQ_BASE.LOG2SIZE and SMMU_R_CMDQ_BASE.LOG2SIZE <= SMMU_IDR1.CMDQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 853

Chapter 6. Memory map and registers 6.3. Register formats If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the RD index is always wrapped to the current queue size given by SMMU_R_CMDQ_BASE.LOG2SIZE. If QS == 0 the queue has one entry. Zero bits of RD index are present and RD_WRAP is bit zero. When SMMU_R_CMDQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_R_CR0.CMDQEN is transitioned from 0 to 1. Upon a write to this register, when SMMU_R_CR0.CMDQEN == 0, the ERR field is permitted to either take the written value or ignore the written value. Note: There is no requirement for the SMMU to update this value after every command consumed. It might be updated only after an IMPLEMENTATION SPECIFIC number of commands have been consumed. However, an SMMU must ultimately update RD in finite time to indicate free space to software. When a command execution error is detected, ERR is set to a reason code and then the respective SMMU_R_GERROR.CMDQ_ERR error becomes active. RD remains pointing at the infringing command for debug. The SMMU resumes processing commands after the CMDQ_ERR error is acknowledged, if the Command queue is enabled at that time. SMMU_R_GERROR.CMDQ_ERR has no other interaction with SMMU_R_CR0.CMDQEN than that a Command queue error can only be detected when the queue is enabled and therefore consuming commands. A change to SMMU_R_CR0.CMDQEN does not affect, or acknowledge, SMMU_R_GERROR.CMDQ_ERR which must be explicitly acknowledged. See section 7.1 Command queue errors. Accessing SMMU_R_CMDQ_CONS This register is Guarded by SMMU_R_CR0.CMDQEN and must only be modified when SMMU_R_CR0.CMDQEN == 0. See SMMU_R_CMDQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x009C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.CMDQEN == ‘0’ and SMMU_R_CR0ACK.CMDQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 854

Chapter 6. Memory map and registers 6.3. Register formats 6.3.204 SMMU_R_EVENTQ_BASE The SMMU_R_EVENTQ_BASE characteristics are: Purpose Event queue base address register for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_EVENTQ_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 WA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. WA, bit [62] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] PA of queue base, bits [55:5]. • Address bits above and below this field range are treated as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 855

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE is less than or equal to SMMU_IDR1.EVENTQS. Except for the purposes of readback of this register, any use of the value of this field is capped at the maximum, SMMU_IDR1.EVENTQS. The reset behavior of this field is: • When SMMU_IDR1.QUEUES_PRESET == ‘1’, this field resets to an IMPLEMENTATION DEFINED value. • Otherwise, this field resets to an UNKNOWN value. Additional Information See SMMU_R_CMDQ_BASE for initialization order with respect to the PROD and CONS registers. Events destined for the Realm Event queue are delivered into the queue if SMMU_R_CR0.EVENTQEN == 1 and the queue is writable. If SMMU_R_CR0.EVENTQEN == 0, no events are delivered into the queue. See section 7.2 Event queue recorded faults and events; some events might be lost in these situations. Access attributes of the Realm Event queue are set using the SMMU_R_CR1.QUEUE_* fields. A Write-Allocate hint is provided for Event queue accesses with the WA field. Accessing SMMU_R_EVENTQ_BASE SMMU_R_EVENTQ_BASE is Guarded by SMMU_R_CR0.EVENTQEN and must only be modified when SMMU_R_CR0.EVENTQEN == 0 These update conditions are common for all SMMU_R_EVENTQ_{BASE, PROD} registers in the SMMU with respect to their corresponding EVENTQEN. Accesses to this register use the following encodings: Accessible at offset 0x00A0 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_R_CR0.EVENTQEN == ‘0’ and SMMU_R_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 856

Chapter 6. Memory map and registers 6.3. Register formats 6.3.205 SMMU_R_EVENTQ_IRQ_CFG0 The SMMU_R_EVENTQ_IRQ_CFG0 characteristics are: Purpose Event queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_EVENTQ_IRQ_CFG0 are RES0. Attributes SMMU_R_EVENTQ_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions NS 63 RES0 62 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 NS, bit [63] MSI targets either the Realm physical address space or the Non-secure physical address space. NS Meaning 0b0 MSIs are issued to Realm physical address space. 0b1 MSIs are issued to the Non-secure physical address space. Bits [62:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 857

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_EVENTQ_IRQ_CFG0 SMMU_R_EVENTQ_IRQ_CFG0 is Guarded by SMMU_R_IRQ_CTRL.EVENTQ_IRQEN and must only be modified when SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00B0 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 858

Chapter 6. Memory map and registers 6.3. Register formats 6.3.206 SMMU_R_EVENTQ_IRQ_CFG1 The SMMU_R_EVENTQ_IRQ_CFG1 characteristics are: Purpose Event queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_EVENTQ_IRQ_CFG1 are RES0. Attributes SMMU_R_EVENTQ_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_EVENTQ_IRQ_CFG1 SMMU_R_EVENTQ_IRQ_CFG1 is Guarded by SMMU_R_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00B8 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 859

Chapter 6. Memory map and registers 6.3. Register formats 6.3.207 SMMU_R_EVENTQ_IRQ_CFG2 The SMMU_R_EVENTQ_IRQ_CFG2 characteristics are: Purpose Event queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_EVENTQ_IRQ_CFG2 are RES0. Attributes SMMU_R_EVENTQ_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. • When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. • Encoded in the same way as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 860

Chapter 6. Memory map and registers 6.3. Register formats Note: The encodings of all of the SMMU_*_IRQ_CFG2 MemAttr and SH fields are the same. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. Accessing SMMU_R_EVENTQ_IRQ_CFG2 SMMU_R_EVENTQ_IRQ_CFG2 is Guarded by SMMU_R_IRQ_CTRL.EVENTQ_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00BC from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.EVENTQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.EVENTQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 861

Chapter 6. Memory map and registers 6.3. Register formats 6.3.208 SMMU_R_PRIQ_BASE The SMMU_R_PRIQ_BASE characteristics are: Purpose Configuration of the PRI queue base address for Realm state. Configuration This register is present only when SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_BASE are RES0. Attributes SMMU_R_PRIQ_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 WA 62 RES0 61 56 ADDR[55:5] 55 32 RES0 ADDR[55:5] 31 5 LOG2SIZE 4 0 Bit [63] Reserved, RES0. WA, bit [62] Write allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:5] PA of queue base, bits [55:5]. • Address bits above and below this field range are implied as zero. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. – Note: An implementation is not required to store these bits. • The effective base address is aligned by the SMMU to the larger of the queue size in bytes or 32 bytes, ignoring the least-significant bits of ADDR as required. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 862

Chapter 6. Memory map and registers 6.3. Register formats The reset behavior of this field is: • This field resets to an UNKNOWN value. LOG2SIZE, bits [4:0] Queue size as log2(entries). • LOG2SIZE <= SMMU_IDR1.PRIQS (which has a maximum value of 19). Except for the purposes of readback of this register, any use of this field’s value is capped at SMMU_IDR1.PRIQS. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information See SMMU_R_CMDQ_BASE for initialization order with respect to the PROD and CONS registers. Access attributes of the PRI queue are set using the SMMU_R_CR1.QUEUE_* fields. A Write-Allocate hint is provided for PRI queue accesses with the WA field. Accessing SMMU_R_PRIQ_BASE SMMU_R_PRIQ_BASE is Guarded by SMMU_R_CR0.PRIQEN and must only be modified when SMMU_R_CR0.PRIQEN == 0 These update conditions are common for both SMMU_R_PRIQ_{BASE, PROD} registers in the SMMU with respect to PRIQEN. Accesses to this register use the following encodings: Accessible at offset 0x00C0 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_IDR1.QUEUES_PRESET == ‘1’, accesses to this register are RO. • When SMMU_R_CR0.PRIQEN == ‘0’ and SMMU_R_CR0ACK.PRIQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 863

Chapter 6. Memory map and registers 6.3. Register formats 6.3.209 SMMU_R_PRIQ_IRQ_CFG0 The SMMU_R_PRIQ_IRQ_CFG0 characteristics are: Purpose PRI queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1 and SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_IRQ_CFG0 are RES0. Attributes SMMU_R_PRIQ_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions NS 63 RES0 62 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 NS, bit [63] MSI targets either the Realm physical address space or the Non-secure physical address space. NS Meaning 0b0 MSIs are issued to Realm physical address space. 0b1 MSIs are issued to the Non-secure physical address space. Bits [62:56] Reserved, RES0. ADDR, bits [55:2] Physical address of MSI target register, bits [55:2]. • High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Note: An implementation is not required to store these bits. • Bits [1:0] of the effective address that results from this field are zero. • If ADDR == 0, no MSI is sent. This allows a wired IRQ, if implemented, to be used when SMMU_R_IRQ_CTRL.PRIQ_IRQEN == 1 instead of an MSI. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 864

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_PRIQ_IRQ_CFG0 SMMU_R_PRIQ_IRQ_CFG0 is Guarded by SMMU_R_IRQ_CTRL.PRIQ_IRQEN and must only be modified when SMMU_R_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00D0 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 865

Chapter 6. Memory map and registers 6.3. Register formats 6.3.210 SMMU_R_PRIQ_IRQ_CFG1 The SMMU_R_PRIQ_IRQ_CFG1 characteristics are: Purpose PRI queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1 and SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_IRQ_CFG1 are RES0. Attributes SMMU_R_PRIQ_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_PRIQ_IRQ_CFG1 SMMU_R_PRIQ_IRQ_CFG1 is Guarded by SMMU_R_IRQ_CTRL.PRIQ_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00D8 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 866

Chapter 6. Memory map and registers 6.3. Register formats 6.3.211 SMMU_R_PRIQ_IRQ_CFG2 The SMMU_R_PRIQ_IRQ_CFG2 characteristics are: Purpose PRI queue interrupt configuration register for Realm state. Configuration This register is present only when SMMU_R_IDR0.MSI == 1 and SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_IRQ_CFG2 are RES0. Attributes SMMU_R_PRIQ_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions LO 31 RES0 30 6 SH 5 4 MemAttr 3 0 Similar to SMMU_R_GERROR_IRQ_CFG2 but for PRI queue MSIs. LO, bit [31] Last Only. LO Meaning 0b0 Send PRI queue interrupt when PRI queue transitions from empty to non-empty. 0b1 Send PRI queue interrupt when PRI message received with L bit set. • When the message is written to PRI queue, the interrupt is visible after the queue entry becomes visible. See section 3.18 Interrupts and notifications • When the message is discarded because of a PRI queue overflow, the interrupt is generated. When the message is discarded for any other reason, the interrupt is not generated. An interrupt is generated only if a PRI message is received with the L bit set. Note: This field applies to wired and MSI interrupts. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:6] Reserved, RES0. SH, bits [5:4] When SMMU_IDR0.MSI == 1: Shareability. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 867

Chapter 6. Memory map and registers 6.3. Register formats SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. MemAttr, bits [3:0] When SMMU_IDR0.MSI == 1: Memory type. Encoded the same as the STE.MemAttr field. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Additional Information MemAttr and SH allow the memory type and Shareability of the MSI to be configured, see section 3.18 Interrupts and notifications. The encodings of all of the SMMU_*_IRQ_CFG2 MemAttr and SH fields are the same. When a cacheable type is specified in MemAttr, the allocation and transient hints are IMPLEMENTATION DEFINED. Accessing SMMU_R_PRIQ_IRQ_CFG2 SMMU_R_PRIQ_IRQ_CFG2 is Guarded by SMMU_R_IRQ_CTRL.PRIQ_IRQEN, and must only be modified when SMMU_R_IRQ_CTRL.PRIQ_IRQEN == 0. See SMMU_R_GERROR_IRQ_CFG0 for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00DC from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.PRIQ_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.PRIQ_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 868

Chapter 6. Memory map and registers 6.3. Register formats 6.3.212 SMMU_R_MPAMIDR The SMMU_R_MPAMIDR characteristics are: Purpose MPAM capability identification register for Realm state. Configuration This register is present only when SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_R_MPAMIDR are RES0. Attributes SMMU_R_MPAMIDR is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 26 25 24 PMG_MAX 23 16 PARTID_MAX 15 0 HAS_MPAM_NS RES0 Bits [31:26] Reserved, RES0. HAS_MPAM_NS, bit [25] Support for MPAM_NS configuration for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: HAS_MPAM_NS Meaning 0b0 No support for MPAM_NS configuration for Realm state. 0b1 Support for MPAM_NS configuration for Realm state. If Secure state is implemented this field has the same value as SMMU_S_MPAMIDR.HAS_MPAM_NS. If Secure state is not implemented this field is permitted to be zero or one. Access to this field is RO. Bit [24] Reserved, RES0. PMG_MAX, bits [23:16] This field has an IMPLEMENTATION DEFINED value. • This field has the same value as SMMU_MPAMIDR.PMG_MAX. • The maximum PMG value that is permitted to be used in Realm state. Access to this field is RO. PARTID_MAX, bits [15:0] This field has an IMPLEMENTATION DEFINED value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 869

Chapter 6. Memory map and registers 6.3. Register formats • This field has the same value as SMMU_MPAMIDR.PARTID_MAX. • The maximum PARTID value that is permitted to be used in Realm state. Access to this field is RO. Additional Information This register has the same behavior as the SMMU_MPAMIDR register. Accessing SMMU_R_MPAMIDR Accesses to this register use the following encodings: Accessible at offset 0x0130 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 870

Chapter 6. Memory map and registers 6.3. Register formats 6.3.213 SMMU_R_GMPAM The SMMU_R_GMPAM characteristics are: Purpose Global MPAM configuration register for SMMU-originated transactions relating to the Realm state programming interface. Configuration This register is present only when SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_R_GMPAM are RES0. Attributes SMMU_R_GMPAM is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 31 RES0 30 25 24 SO_PMG 23 16 SO_PARTID 15 0 Update MPAM_NS Update, bit [31] Update completion flag. For more information see below. The reset behavior of this field is: • This field resets to '0'. Bits [30:25] Reserved, RES0. MPAM_NS, bit [24] When SMMU_R_MPAMIDR.HAS_MPAM_NS == 1: MPAM_NS Meaning 0b0 Accesses controlled by this register use Realm PARTID space. 0b1 Accesses controlled by this register use Non-secure PARTID space. PARTID and PMG values for accesses for Realm state are determined according to Chapter 17 Memory System Resource Partitioning and Monitoring. The reset behavior of this field is: • This field resets to '0'. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 871

Chapter 6. Memory map and registers 6.3. Register formats SO_PMG, bits [23:16] PMG for SMMU-originated accesses. • This field determines the PMG of the SMMU-originated transactions described below. • Bits above the supported PMG bit width, as indicated by SMMU_R_MPAMIDR.PMG_MAX, are RES0. • If a value is programmed that is greater than the corresponding PMG_MAX, an UNKNOWN PMG is used. The reset behavior of this field is: • This field resets to 0x00. SO_PARTID, bits [15:0] PARTID for SMMU-originated accesses. • This field determines the PARTID of the SMMU-originated transactions described below. • Bits above the supported PARTID bit width, as indicated by SMMU_R_MPAMIDR.PARTID_MAX, are RES0. • If a value is programmed that is greater than SMMU_R_MPAMIDR.PARTID_MAX, an UNKNOWN PARTID is used. The reset behavior of this field is: • This field resets to 0x0000. Additional Information The SO_PMG and SO_PARTID values determine the MPAM attributes applied to the following SMMU-originated accesses that are associated with the Realm programming interface: • L1STD, STE and VMS accesses. • Queue accesses. • SMMU core MSIs. The Update flag behaves the same as the SMMU_GBPA.Update mechanism. It indicates that a change to this register has been accepted and when the Update flag is observed to be zero after a correct update procedure, the new values are guaranteed to be applied to future SMMU-originated accesses. Accessing SMMU_R_GMPAM This register must only be written when Update == 0 (prior updates are complete). A write when an Update == 1, that is when a prior update is underway, is IGNORED. A write of new values that does not set Update == 1 is IGNORED. When this register is written, correctly observing the requirements in this section, the new value is observable to future reads of the register even if they occur before the Update has completed. Accesses to this register use the following encodings: Accessible at offset 0x0138 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_GMPAM.Update == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 872

Chapter 6. Memory map and registers 6.3. Register formats 6.3.214 SMMU_R_IDR6 The SMMU_R_IDR6 characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Realm state programming interface. Configuration There are no configuration notes. Attributes SMMU_R_IDR6 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 28 27 24 23 20 19 16 15 11 RES0 10 9 VSIDSIZE 8 4 VSID 3 2 DCMDQ 1 0 CMDQ_CONTROL_PAGE_LOG2NU MP DCMDQ_CONTROL_PAGE_LOG2NUMQ DCMDQ_CONTROL_PAGE_LOG2NUMP CMDQ_CONTROL_PAGE_LOG2NUMQ The values of all SMMU_R_CMDQ_CONTROL_PAGE_BASEn.ADDR are such that the pages occupy a contiguous region of address space within the SMMU register file, and they are arranged in ascending value of n. Bits [31:28] Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMP, bits [27:24] When SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1: Number of Realm Command queue control pages supported. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b0000..0b1000 Number of Command queue control pages supported as log2(pages). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Realm Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMQ, bits [23:20] ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 873

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_R_IDR6.DCMDQ == 1: Number of Realm state DCMDQ interfaces per control page. DCMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000 Number of queues supported per DCMDQ control page as log2(queues). All other values are reserved. In this version of the architecture, the only allowed value for this field is 0b0000, meaning the SMMU supports a single DCMDQ interface per control page The hypervisor can reserve ECMDQs for its own usage. The number of ECMDQs reserved in such a manner needs to be a multiple of the number of DCMDQ interfaces per DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. CMDQ_CONTROL_PAGE_LOG2NUMQ, bits [19:16] When SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1: Number of queues per Realm Command queue control page. The value of this field is an IMPLEMENTATION DEFINED choice of: CMDQ_CONTROL_PAGE_LOG2NUMQ Meaning 0b0000..0b1000 Number of queues supported per Command queue control page as log2(queues). All other values are reserved. Note: 0b0000 is a legal value. In this case, the SMMU supports a single Command queue per Realm Command queue control page. Access to this field is RO. Otherwise: Reserved, RES0. DCMDQ_CONTROL_PAGE_LOG2NUMP, bits [15:11] When SMMU_R_IDR6.DCMDQ == 1: Number of Realm state DCMDQ control pages. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 874

Chapter 6. Memory map and registers 6.3. Register formats DCMDQ_CONTROL_PAGE_LOG2NUMP Meaning 0b00000..0b10000 Number of DCMDQ control pages supported as log2(pages). All other values are reserved. The number of DCMDQ control pages cannot be larger than: • The total number of ECMDQs implemented across all ECMDQ control pages. • The StreamID size. The number of DCMDQ control pages in SMMU_R_IDR6 is therefore an upper limit: the number of active DCMDQ control pages is determined by the number of ECMDQs the hypervisor has reserved for its own usage. Note: 0b00000 is a legal value. In this case, the SMMU supports a single Realm DCMDQ control page. Access to this field is RO. Otherwise: Reserved, RES0. Bits [10:9] Reserved, RES0. VSIDSIZE, bits [8:4] When SMMU_R_IDR6.VSID == 1: Maximum bits of vSID in Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: VSIDSIZE Meaning 0b00000..0b10000 Maximum number of bits representing the vSID. All other values are reserved. The value 0b00000 means the SMMU supports the translation of 1 vSID. The value of this field must be smaller than or equal to SMMU_IDR1.SIDSIZE. The hypervisor must present an emulated SMMU to the guest with a maximal SID length which is equal to the vSID length supported by the hardware implementation. That is, in the emulated SMMU the hypervisor sets SMMU_IDR1.SIDSIZE to the value of this field in the hardware implementation or smaller. Access to this field is RO. Otherwise: Reserved, RES0. VSID, bits [3:2] Support for virtual to physical StreamID translation for Realm state. The value of this field is an IMPLEMENTATION DEFINED choice of: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 875

Chapter 6. Memory map and registers 6.3. Register formats VSID Meaning 0b00 Translation of virtual to physical StreamIDs is not supported. 0b01 Translation of virtual to physical StreamIDs is supported. All other values are reserved. This field is RES0 if any of the following are true: • SMMU_R_IDR6.DCMDQ == 0. • SMMU_R_IDR0.ATS == 0. Access to this field is RO. DCMDQ, bits [1:0] Indicates support for Realm state Direct Enhanced Command Queues. The value of this field is an IMPLEMENTATION DEFINED choice of: DCMDQ Meaning 0b00 Direct Enhanced Command Queues are not supported. 0b01 Direct Enhanced Command Queues are supported. All other values are reserved. If this field is 1 then all of the following are true: • SMMU_IDR6.DCMDQ == 1. • SMMU_R_IDR0.ECMDQ == 1. • SMMU_IDR0.S1P == 1. • SMMU_IDR0.S2P == 1. • SMMU_R_IDR0.STALL_MODEL != 0b10. Access to this field is RO. Additional Information See section 3.5.6 Enhanced Command queue interfaces. Accessing SMMU_R_IDR6 Accesses to this register use the following encodings: Accessible at offset 0x0190 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 876

Chapter 6. Memory map and registers 6.3. Register formats 6.3.215 SMMU_R_IDR7 The SMMU_R_IDR7 characteristics are: Purpose Provides information on the qSID base for Realm state. Configuration This register is present only when SMMU_R_IDR6.DCMDQ == 1. Otherwise, direct accesses to SMMU_R_IDR7 are RES0. Attributes SMMU_R_IDR7 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions QSID_BASE 31 0 QSID_BASE, bits [31:0] Offset in StreamID space to block of StreamIDs assigned to be used as qSIDs in Realm state. This field has an IMPLEMENTATION DEFINED value. Bits above the StreamID size, advertised in SMMU_IDR1.SIDSIZE, are RES0. Bits below the number of DCMDQ control pages, advertised in SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP, are RES0. The qSID is the concatenation of the value of this field and the DCMDQ control page index, where log2nump is SMMU_R_IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP: qSID = {SMMU_R_IDR7[31:log2nump], DCMDQ control page index [log2nump - 1:0]}. For more information, see 3.5.7.3.1 Queue StreamID (qSID). Access to this field is RO. Accessing SMMU_R_IDR7 Accesses to this register use the following encodings: Accessible at offset 0x0194 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 877

Chapter 6. Memory map and registers 6.3. Register formats 6.3.216 SMMU_R_IDR8 The SMMU_R_IDR8 characteristics are: Purpose Provides information on the offsets for the Realm DCMDQ control pages and Realm DCMDQ global page. Configuration There are no configuration notes. Attributes SMMU_R_IDR8 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions BA_DCMDQ 31 14 RES0 13 10 BA_DCMDQ_GLOBAL 9 0 BA_DCMDQ, bits [31:14] When SMMU_R_IDR6.DCMDQ == 1: Offset to the first DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of DCMDQ control page m can be calculated as follows: O_DCMDQCPm = SMMU_BASE + 0x20000 + BA_DCMDQ * 0x10000 + m * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. Bits [13:10] Reserved, RES0. BA_DCMDQ_GLOBAL, bits [9:0] When SMMU_R_IDR6.DCMDQ == 1: Offset to the global DCMDQ control page associated with this security state. This field has an IMPLEMENTATION DEFINED value. The base address of the DCMDQ global control page can be calculated as follows: O_DCMDQCP_GLOBAL = SMMU_BASE + 0x20000 + BA_DCMDQ_GLOBAL * 0x10000 Access to this field is RO. Otherwise: Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 878

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_IDR8 Accesses to this register use the following encodings: Accessible at offset 0x0198 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 879

Chapter 6. Memory map and registers 6.3. Register formats 6.3.217 SMMU_R_DPT_BASE The SMMU_R_DPT_BASE characteristics are: Purpose Provides the base address for the Device Permission Table for Realm state. Configuration This register is present only when SMMU_R_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_R_DPT_BASE are RES0. Attributes SMMU_R_DPT_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 BADDR[55:12] 55 32 RES0 BADDR[55:12] 31 12 RES0 11 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint. RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. BADDR, bits [55:12] Base address of level 0 DPT. This is a Realm physical address. The address is aligned by the SMMU to the greater of 4KB and the size of the table. Least-significant bits that are unused because of alignment are treated as zero by the SMMU, and are RES0. Bits above the implemented output address size, advertised in SMMU_IDR5.OAS, are RES0, an SMMU implementation is not required to provide storage for these bits, and they are treated as zero by the SMMU. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 880

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to an UNKNOWN value. Bits [11:0] Reserved, RES0. Accessing SMMU_R_DPT_BASE Accesses to this register use the following encodings: Accessible at offset 0x0200 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.DPT_WALK_EN == ‘1’ or SMMU_R_CR0ACK.DPT_WALK_EN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 881

Chapter 6. Memory map and registers 6.3. Register formats 6.3.218 SMMU_R_DPT_BASE_CFG The SMMU_R_DPT_BASE_CFG characteristics are: Purpose Provides the configuraton for the Device Permission Table for Realm state. Configuration This register is present only when SMMU_R_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_R_DPT_BASE_CFG are RES0. Attributes SMMU_R_DPT_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 24 L0DPTSZ 23 20 RES0 19 16 DPTGS 15 14 RES0 13 3 DPTPS 2 0 Bits [31:24] Reserved, RES0. L0DPTSZ, bits [23:20] This field advertises the number of least-significant address bits protected by each entry in the level 0 DPT. L0DPTSZ Meaning 0b0000 30-bits. Each entry covers 1GB of address space. 0b0100 34-bits. Each entry covers 16GB of address space. 0b0110 36-bits. Each entry covers 64GB of address space. 0b1001 39-bits. Each entry covers 512GB of address space. All other values are reserved. It is invalid to configure this field to any of the following: • A reserved encoding. • An address size that exceeds the implemented physical address size advertised in SMMU_IDR5.OAS. • An address size that exceeds the DPT region size configured in SMMU_R_DPT_BASE_CFG.DPTPS. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [19:16] Reserved, RES0. DPTGS, bits [15:14] DPT Granule size. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 882

Chapter 6. Memory map and registers 6.3. Register formats DPTGS Meaning 0b00 4KB Invalid if SMMU_IDR5.GRAN4K == 0. 0b01 64KB Invalid if SMMU_IDR5.GRAN64K == 0. 0b10 16KB Invalid if SMMU_IDR5.GRAN16K == 0. 0b11 Reserved This field is permitted to be cached in a TLB. Note: Software should program this field to the mininal value that could be returned as the size of an ATS Translation Completion. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [13:3] Reserved, RES0. DPTPS, bits [2:0] The size of the memory region protected by the DPT, in terms of an encoded number of least-significant address bits. DPTPS Meaning 0b000 32-bits 4GB. 0b001 36-bits 64GB. 0b010 40-bits 1TB. 0b011 42-bits 4TB. 0b100 44-bits 16TB. 0b101 48-bits 256TB. 0b110 52-bits 4PB. 0b111 56-bits 64PB. Values exceeding the implemented physical address size, advertised in SMMU_IDR5.OAS are invalid. This field is permitted to be cached in a TLB. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_DPT_BASE_CFG Accesses to this register use the following encodings: Accessible at offset 0x0208 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.DPT_WALK_EN == ‘1’ or SMMU_R_CR0ACK.DPT_WALK_EN == ‘1’, accesses to this register are RO. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 883

Chapter 6. Memory map and registers 6.3. Register formats 6.3.219 SMMU_R_DPT_CFG_FAR The SMMU_R_DPT_CFG_FAR characteristics are: Purpose This register reports details of the Realm state Device Permission Table lookup error. Configuration This register is present only when SMMU_R_IDR3.DPT == 1. Otherwise, direct accesses to SMMU_R_DPT_CFG_FAR are RES0. Attributes SMMU_R_DPT_CFG_FAR is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 63 56 FADDR[55:12] 55 32 FADDR[55:12] 31 12 RES0 11 8 7 4 RES0 3 2 1 0 DPT_FAULTCODE FAULT LEVEL Bits [63:56] Reserved, RES0. FADDR, bits [55:12] The physical address input to the DPT check that caused the DPT lookup error. If FAULT == 0, the value of this field is zero. Access to this field is RO. Bits [11:8] Reserved, RES0. DPT_FAULTCODE, bits [7:4] DPT_FAULTCODE Meaning 0b0000 DPT_DISABLED SMMU_R_CR0.DPT_WALK_EN is zero. 0b0001 DPT_WALK_FAULT Invalid DPT configuration or descriptor. 0b0010 DPT_GPC_FAULT GPC fault on DPT fetch. 0b0011 DPT_EABT External abort on DPT fetch. If FAULT == 0, the value of this field is zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 884

Chapter 6. Memory map and registers 6.3. Register formats Access to this field is RO. Bits [3:2] Reserved, RES0. LEVEL, bit [1] Reports the level of the fault. LEVEL Meaning 0b0 Level 0 0b1 Level 1 If FAULT == 0, the value of this field is zero. Access to this field is RO. FAULT, bit [0] FAULT Meaning 0b0 There have been zero DPT lookup faults since this register was last cleared to 0. 0b1 There have been one or more DPT lookup faults since this register was last cleared to 0. A write of one to this field is IGNORED and does not trigger an update of SMMU_R_GERROR, and does not make this fault active. The reset behavior of this field is: • This field resets to '0'. Additional Information Note: If A DPT lookup resolves to an entry that marks “No access”, that is not a DPT lookup fault and it is not reported in this register. See also: • Section 3.24.4 DPT lookup errors. Accessing SMMU_R_DPT_CFG_FAR This register is read-write, with the following constraints: • Any write to this register is IGNORED unless the write clears the FAULT bit. • When a write clears the FAULT bit, the entire register is cleared to zero. Accesses to this register use the following encodings: Accessible at offset 0x0210 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 885

Chapter 6. Memory map and registers 6.3. Register formats 6.3.220 SMMU_R_MECIDR The SMMU_R_MECIDR characteristics are: Purpose Provides information about the number of bits of MECID supported by the SMMU. Configuration This register is present only when SMMU_R_IDR3.MEC == 1. Otherwise, direct accesses to SMMU_R_MECIDR are RES0. Attributes SMMU_R_MECIDR is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 4 MECIDSIZE 3 0 Bits [31:4] Reserved, RES0. MECIDSIZE, bits [3:0] The number of bits minus one of MECID supported by the SMMU. The value of this field is an IMPLEMENTATION DEFINED choice of: MECIDSIZE Meaning 0b0000..0b1111 The number of bits minus one of MECID supported by the SMMU. All other values are reserved. The value 0b0000 is a valid encoding and indicates that one bit of MECID is supported. Access to this field is RO. Additional Information Arm strongly recommends that the MECID bit width supported by the SMMU matches or exceeds the width supported by the PEs in the system. Accessing SMMU_R_MECIDR Accesses to this register use the following encodings: Accessible at offset 0x0220 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 886

Chapter 6. Memory map and registers 6.3. Register formats 6.3.221 SMMU_R_GMECID The SMMU_R_GMECID characteristics are: Purpose Configures the MECID value for global SMMU-originated accesses to the Realm PA space. Configuration This register is present only when SMMU_R_IDR3.MEC == 1. Otherwise, direct accesses to SMMU_R_GMECID are RES0. Attributes SMMU_R_GMECID is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 16 GMECID 15 0 Bits [31:16] Reserved, RES0. GMECID, bits [15:0] MECID for SMMU-originated access to Realm PA space for: • Fetches of L1STD, STE and VMS structures. • Access to Command queues, other than DCMDQ. • Access to Event queue and PRI queue. • SMMU-originated MSIs, other than DCMDQ-related. • Fetches of DPT information. For information on the MECID used for: • DCMDQ fetches and DCMDQ-related MSIs, see STE.MECID. • HDBSS updates, see SMMU_R_HDBSS_MECID. • HACDBS fetches, see SMMU_R_HACDBS_MECID. Bits above the supported MECID size, indicated in SMMU_R_MECIDR.MECIDSIZE are RES0. If MECIDSIZE is less than 0xF, the SMMU treats bits [15:MECIDSIZE+1] of this field as zero. The reset behavior of this field is: • This field resets to 0x0000. Accessing SMMU_R_GMECID Note: Accesses to SMMU_R_GMECID are not guarded by SMMU_R_CR0.PRIQEN or any of the SMMU_R_IRQ_CTRL bits. PRIQEN has an Effective value of 0 if SMMUEN is 0. Software must not change the global MECID value in situations where generation of an MSI with an unknown MECID value could cause the target location contents to become UNKNOWN. For an MSI that targets a GIC ITS, the MECID might be IGNORED by the GIC and therefore use of an unknown MECID would not lead to a loss of correctness. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 887

Chapter 6. Memory map and registers 6.3. Register formats Accesses to this register use the following encodings: Accessible at offset 0x0228 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When ((((((SMMU_R_CR0.SMMUEN == ‘0’) && (SMMU_R_CR0.EVENTQEN == ‘0’)) && (SMMU_R_CR0.CMDQEN == ‘0’)) && (SMMU_R_CR0ACK.SMMUEN == ‘0’)) && (SMMU_R_CR0ACK.EVENTQEN == ‘0’)) && (SMMU_R_CR0ACK.CMDQEN == ‘0’)) && (((SMMU_R_IDR0.ECMDQ == ‘0’) && (SMMU_R_IDR2.RECMDQ == ‘0’)) || ((SMMU_R_ECMDQ_PROD.EN == ‘0’) && (SMMU_R_ECMDQ_CONS.ENACK == ‘0’))), accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 888

Chapter 6. Memory map and registers 6.3. Register formats 6.3.222 SMMU_R_HDBSS_BASE0 The SMMU_R_HDBSS_BASE0 characteristics are: Purpose Configuration of Realm state HDBSS table 0 base address. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_R_HDBSS_BASE0 are RES0. Attributes SMMU_R_HDBSS_BASE0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_R_HDBSS_PROD0.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_R_CR1. For each table that was written, SMMU_R_HDBSS_PROD0.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_R_HDBSS_PROD0.ERR_REASON. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 889

Chapter 6. Memory map and registers 6.3. Register formats WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE0.V == ‘1’ and SMMU_R_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE0.V == ‘1’ and SMMU_R_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 890

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE0.V == ‘1’ and SMMU_R_HDBSS_PROD0.VACK == ‘1’, access to this field is RO. Accessing SMMU_R_HDBSS_BASE0 Accesses to this register use the following encodings: Accessible at offset 0x0240 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HDBSS_BASE0.V == ‘0’ and SMMU_R_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • When SMMU_R_HDBSS_BASE0.V == ‘1’ and SMMU_R_HDBSS_PROD0.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 891

Chapter 6. Memory map and registers 6.3. Register formats 6.3.223 SMMU_R_HDBSS_PROD0 The SMMU_R_HDBSS_PROD0 characteristics are: Purpose Index register that allows producer to offset into Realm state HDBSS table 0. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_R_HDBSS_PROD0 are RES0. Attributes SMMU_R_HDBSS_PROD0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_R_HDBSS_BASE0.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_R_HDBSS_BASE0.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason Code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 892

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HDBSS_PROD0 Accesses to this register use the following encodings: Accessible at offset 0x0248 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HDBSS_BASE0.V == ‘0’ and SMMU_R_HDBSS_PROD0.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 893

Chapter 6. Memory map and registers 6.3. Register formats 6.3.224 SMMU_R_HDBSS_BASE1 The SMMU_R_HDBSS_BASE1 characteristics are: Purpose Configuration of Realm state HDBSS table 1 base address. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_R_HDBSS_BASE1 are RES0. Attributes SMMU_R_HDBSS_BASE1 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions V 63 62 WA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 V, bit [63] HDBSS table valid. V Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. This field has similar Update behavior to fields in SMMU_CR0. When it is writable and its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_R_HDBSS_PROD1.VACK to the new value. Completion of an Update from 1 to 0 guarantees that any HDBSS updates resulting from client transactions and ATOS translations that completed before the start of the Update have been performed to either table, provided the HDBSS tables were not full, and are observable to the configured Shareability domain (as programmed in SMMU_R_CR1. For each table that was written, SMMU_R_HDBSS_PROD1.INDEX is updated accordingly. Completion of an Update from 1 to 0 guarantees observability of any errors to be reported in SMMU_R_HDBSS_PROD1.ERR_REASON, with the exception of SMMU_R_HDBSS_PROD1.ERR_REASON == 0b11. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 894

Chapter 6. Memory map and registers 6.3. Register formats • This field resets to '0'. WA, bit [61] Write Allocate hint. WA Meaning 0b0 No Write-Allocate. 0b1 Write-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE1.V == ‘1’ and SMMU_R_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HDBSS table base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HDBSS table is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE1.V == ‘1’ and SMMU_R_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HDBSS table. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 895

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HDBSS_BASE1.V == ‘1’ and SMMU_R_HDBSS_PROD1.VACK == ‘1’, access to this field is RO. Accessing SMMU_R_HDBSS_BASE1 Accesses to this register use the following encodings: Accessible at offset 0x0250 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HDBSS_BASE1.V == ‘0’ and SMMU_R_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • When SMMU_R_HDBSS_BASE1.V == ‘1’ and SMMU_R_HDBSS_PROD1.VACK == ‘1’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 896

Chapter 6. Memory map and registers 6.3. Register formats 6.3.225 SMMU_R_HDBSS_PROD1 The SMMU_R_HDBSS_PROD1 characteristics are: Purpose Index register that allows producer to offset into Realm state HDBSS table 1. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1. Otherwise, direct accesses to SMMU_R_HDBSS_PROD1 are RES0. Attributes SMMU_R_HDBSS_PROD1 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 ERR 62 61 60 RES0 59 32 VACK ERR_REASON RES0 31 24 INDEX 23 0 VACK, bit [63] HDBSS table valid acknowledge. VACK Meaning 0b0 The HDBSS table cannot be used for tracking dirty pages. 0b1 The HDBSS table can be used for tracking dirty pages. See SMMU_R_HDBSS_BASE1.V. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_R_HDBSS_BASE1.ERRACK, then one or more HDBSS entries have been lost. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:60] Error reason Code. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 897

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b00 No error. 0b01 External abort on write to HDBSS table. 0b10 Granule Protection Check fault on write to HDBSS table. 0b11 HDBSS halted. Software was unable to service the demands of the mechanisms in time. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [59:24] Reserved, RES0. INDEX, bits [23:0] Next empty entry in the HDBSS table. This field indicates the index of the HDBSS table entry that will be written to next. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HDBSS_PROD1 Accesses to this register use the following encodings: Accessible at offset 0x0258 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HDBSS_BASE1.V == ‘0’ and SMMU_R_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 898

Chapter 6. Memory map and registers 6.3. Register formats 6.3.226 SMMU_R_HDBSS_IRQ_CFG0 The SMMU_R_HDBSS_IRQ_CFG0 characteristics are: Purpose Realm state HDBSS interrupt configuration register 0. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HDBSS_IRQ_CFG0 are RES0. Attributes SMMU_R_HDBSS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions NS 63 RES0 62 56 ADDR[55:2] 55 32 ADDR[55:2] 31 2 RES0 1 0 NS, bit [63] MSI targets either the Realm physical address space or the Non-secure physical address space. NS Meaning 0b0 MSIs are issued to Realm physical address space. 0b1 MSIs are issued to the Non-secure physical address space. Bits [62:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits[55:2]. High-order bits of ADDR above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits[1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 899

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_HDBSS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x0260 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 900

Chapter 6. Memory map and registers 6.3. Register formats 6.3.227 SMMU_R_HDBSS_IRQ_CFG1 The SMMU_R_HDBSS_IRQ_CFG1 characteristics are: Purpose Realm state HDBSS interrupt configuration register 1. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HDBSS_IRQ_CFG1 are RES0. Attributes SMMU_R_HDBSS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HDBSS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x0268 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 901

Chapter 6. Memory map and registers 6.3. Register formats 6.3.228 SMMU_R_HDBSS_IRQ_CFG2 The SMMU_R_HDBSS_IRQ_CFG2 characteristics are: Purpose Realm state HDBSS interrupt configuration register 2. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HDBSS_IRQ_CFG2 are RES0. Attributes SMMU_R_HDBSS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 902

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_HDBSS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x026C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HDBSS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HDBSS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 903

Chapter 6. Memory map and registers 6.3. Register formats 6.3.229 SMMU_R_HDBSS_MPAM The SMMU_R_HDBSS_MPAM characteristics are: Purpose MPAM configuration register for accesses to a Realm HDBSS table. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_R_HDBSS_MPAM are RES0. Attributes SMMU_R_HDBSS_MPAM is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 25 24 PMG 23 16 PARTID 15 0 MPAM_NS Bits [31:25] Reserved, RES0. MPAM_NS, bit [24] MPAM_NS for accesses to an HDBSS table. For a description of MPAM_NS, see SMMU_R_GMPAM.MPAM_NS. The reset behavior of this field is: • This field resets to an UNKNOWN value. PMG, bits [23:16] PMG for accesses to an HDBSS table. For a description of PMG, see SMMU_R_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to an HDBSS table. For a description of PARTID, see SMMU_R_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HDBSS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x0270 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 904

Chapter 6. Memory map and registers 6.3. Register formats • When SMMU_R_HDBSS_BASE0.V == ‘0’, SMMU_R_HDBSS_PROD0.VACK == ‘0’, SMMU_R_HDBSS_BASE1.V == ‘0’, and SMMU_R_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 905

Chapter 6. Memory map and registers 6.3. Register formats 6.3.230 SMMU_R_HDBSS_MECID The SMMU_R_HDBSS_MECID characteristics are: Purpose MECID configuration register for accesses to an HDBSS table. Configuration This register is present only when SMMU_R_IDR3.HDBSS == 1 and SMMU_R_IDR3.MEC == 1. Otherwise, direct accesses to SMMU_R_HDBSS_MECID are RES0. Attributes SMMU_R_HDBSS_MECID is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 16 MECID 15 0 Bits [31:16] Reserved, RES0. MECID, bits [15:0] MECID for accesses to an HDBSS table. Bits above the supported MECID size, indicated in SMMU_R_MECIDR.MECIDSIZE are RES0. If MECIDSIZE is less than 0xF, the SMMU treats bits [15:MECIDSIZE+1] of this field as zero. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HDBSS_MECID Accesses to this register use the following encodings: Accessible at offset 0x0274 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HDBSS_BASE0.V == ‘0’, SMMU_R_HDBSS_PROD0.VACK == ‘0’, SMMU_R_HDBSS_BASE1.V == ‘0’, and SMMU_R_HDBSS_PROD1.VACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 906

Chapter 6. Memory map and registers 6.3. Register formats 6.3.231 SMMU_R_HACDBS_BASE The SMMU_R_HACDBS_BASE characteristics are: Purpose Control register for Realm state HACDBS base address. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_R_HACDBS_BASE are RES0. Attributes SMMU_R_HACDBS_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions EN 63 62 RA 61 RES0 60 56 BADDR[55:12] 55 32 ERRACK BADDR[55:12] 31 12 RES0 11 4 SZ 3 0 EN, bit [63] Enable use of the HACDBS. EN Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. This field has similar Update behavior to fields in SMMU_CR0, such that when its value is changed by a write, the SMMU begins a transition which is then acknowledged by updating SMMU_R_HACDBS_CONS.ENACK to the new value. Completion of an Update from 1 to 0 ensures that all outstanding walks, including the update of descriptors from writable-dirty to writable-clean, have completed. The reset behavior of this field is: • This field resets to '0'. ERRACK, bit [62] Error status acknowledge. The reset behavior of this field is: • This field resets to '0'. RA, bit [61] Read Allocate hint. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 907

Chapter 6. Memory map and registers 6.3. Register formats RA Meaning 0b0 No Read-Allocate. 0b1 Read-Allocate. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HACDBS_BASE.EN == ‘1’ and SMMU_R_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [60:56] Reserved, RES0. BADDR, bits [55:12] HACDBS base address, bits [55:12]. Bits[55:12] of the base address are the value of this field. Bits[11:0] of the base address are zero. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. Based on the value of the SZ field of this register, for encodings of the SZ field greater than 4KB, bits[(SZ+12-1):12] of this field are RES0, such that the base address of the HACDBS is aligned to its size. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HACDBS_BASE.EN == ‘1’ and SMMU_R_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Bits [11:4] Reserved, RES0. SZ, bits [3:0] Size of the HACDBS. SZ Meaning 0b0000 4KB. 0b0001 8KB. 0b0010 16KB. 0b0011 32KB. 0b0100 64KB. 0b0101 128KB. 0b0110 256KB. 0b0111 512KB. 0b1000 1MB. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 908

Chapter 6. Memory map and registers 6.3. Register formats SZ Meaning 0b1001 2MB. 0b1010 4MB. 0b1011 8MB. 0b1100 16MB. 0b1101 32MB. 0b1110 64MB. 0b1111 Reserved, behaves as 0b1110. The reset behavior of this field is: • This field resets to an UNKNOWN value. When SMMU_R_HACDBS_BASE.EN == ‘1’ and SMMU_R_HACDBS_CONS.ENACK == ‘1’, access to this field is RO. Accessing SMMU_R_HACDBS_BASE Accesses to this register use the following encodings: Accessible at offset 0x0440 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HACDBS_BASE.EN == ‘1’ and SMMU_R_HACDBS_CONS.ENACK == ‘1’, accesses to this register are RW. • When SMMU_R_HACDBS_BASE.EN == ‘0’ and SMMU_R_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 909

Chapter 6. Memory map and registers 6.3. Register formats 6.3.232 SMMU_R_HACDBS_CONS The SMMU_R_HACDBS_CONS characteristics are: Purpose Index register that allows consumer to offset into Realm state HACBDS. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1. Otherwise, direct accesses to SMMU_R_HACDBS_CONS are RES0. Attributes SMMU_R_HACDBS_CONS is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 ERR 62 61 59 RES0 58 56 INDEX 55 32 ENACK ERR_REASON STREAMID 31 0 ENACK, bit [63] Enable use of the HACDBS acknowledge. ENACK Meaning 0b0 Hardware accelerator for cleaning Dirty state is disabled. 0b1 Hardware accelerator for cleaning Dirty state is enabled. See SMMU_R_HACDBS_BASE.EN. The reset behavior of this field is: • This field resets to '0'. Access to this field is RO. ERR, bit [62] Error status. If this field is different than SMMU_R_HACDBS_BASE.ERRACK, then an error has occurred while processing a HACDBS entry. The reset behavior of this field is: • This field resets to '0'. ERR_REASON, bits [61:59] HACDBS error. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 910

Chapter 6. Memory map and registers 6.3. Register formats ERR_REASON Meaning 0b000 No error. 0b001 STRUCTF - A read of an entry from the HACDBS has experienced an error. 0b010 IPAF - A stage 2 walk of an IPA from a HACDBS entry has experienced a translation-related fault or an external abort. 0b011 IPAHACF - Processing of an entry from the HACDBS experienced an error that is not a translation-related fault or an external abort. 0b100 STEF - An error occured while fetching or interpreting the STE, or any associated structures. This field is UNKNOWN if an error is not active. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [58:56] Reserved, RES0. INDEX, bits [55:32] Next entry to read from HACDBS. This field indicates the index of the HACDBS entry that the SMMU will read next. The reset behavior of this field is: • This field resets to an UNKNOWN value. STREAMID, bits [31:0] StreamID required for stage 2 table walks for HACDBS entries. The StreamID is used to locate the STE which contains the stage 2 table walk configuration required to process HACDBS entries. If SMMU_IDR1.SID_SIZE < 32, bits [31:SMMU_IDR1.SID_SIZE] are RES0. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HACDBS_CONS Accesses to this register use the following encodings: Accessible at offset 0x0448 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HACDBS_BASE.EN == ‘0’ and SMMU_R_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 911

Chapter 6. Memory map and registers 6.3. Register formats 6.3.233 SMMU_R_HACDBS_IRQ_CFG0 The SMMU_R_HACDBS_IRQ_CFG0 characteristics are: Purpose Realm state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HACDBS_IRQ_CFG0 are RES0. Attributes SMMU_R_HACDBS_IRQ_CFG0 is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions NS 63 RES0 62 56 ADDR 55 32 ADDR 31 2 RES0 1 0 NS, bit [63] MSI targets either the Realm physical address space or the Non-secure physical address space. NS Meaning 0b0 MSIs are issued to Realm physical address space. 0b1 MSIs are issued to the Non-secure physical address space. Bits [62:56] Reserved, RES0. ADDR, bits [55:2] Physical address of the target MSI register, bits [55:2]. High-order bits of the ADDR field above the system physical address size, as reported by SMMU_IDR5.OAS, are RES0. Bits [1:0] of the effective address that results from this field are zero. If ADDR == 0, no MSI is sent. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [1:0] Reserved, RES0. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 912

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_HACDBS_IRQ_CFG0 Accesses to this register use the following encodings: Accessible at offset 0x0450 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 913

Chapter 6. Memory map and registers 6.3. Register formats 6.3.234 SMMU_R_HACDBS_IRQ_CFG1 The SMMU_R_HACDBS_IRQ_CFG1 characteristics are: Purpose Realm state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HACDBS_IRQ_CFG1 are RES0. Attributes SMMU_R_HACDBS_IRQ_CFG1 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions DATA 31 0 DATA, bits [31:0] MSI Data Payload. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HACDBS_IRQ_CFG1 Accesses to this register use the following encodings: Accessible at offset 0x0458 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 914

Chapter 6. Memory map and registers 6.3. Register formats 6.3.235 SMMU_R_HACDBS_IRQ_CFG2 The SMMU_R_HACDBS_IRQ_CFG2 characteristics are: Purpose Realm state HACDBS interrupt configuration register. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR0.MSI == 1. Otherwise, direct accesses to SMMU_R_HACDBS_IRQ_CFG2 are RES0. Attributes SMMU_R_HACDBS_IRQ_CFG2 is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 6 SH 5 4 MemAttr 3 0 Bits [31:6] Reserved, RES0. SH, bits [5:4] Shareability. SH Meaning 0b00 Non-shareable. 0b01 Reserved, treated as 0b00. 0b10 Outer Shareable. 0b11 Inner Shareable. When MemAttr specifies a Device memory type, the contents of this field are IGNORED and the Shareability is effectively Outer Shareable. The reset behavior of this field is: • This field resets to an UNKNOWN value. MemAttr, bits [3:0] Memory type. Encoded the same as STE.MemAttr. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 915

Chapter 6. Memory map and registers 6.3. Register formats Accessing SMMU_R_HACDBS_IRQ_CFG2 Accesses to this register use the following encodings: Accessible at offset 0x045C from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_IRQ_CTRL.HACDBS_IRQEN == ‘0’ and SMMU_R_IRQ_CTRLACK.HACDBS_IRQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 916

Chapter 6. Memory map and registers 6.3. Register formats 6.3.236 SMMU_R_HACDBS_MPAM The SMMU_R_HACDBS_MPAM characteristics are: Purpose MPAM configuration register for accesses to the Realm HACDBS. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1 and SMMU_IDR3.MPAM == 1. Otherwise, direct accesses to SMMU_R_HACDBS_MPAM are RES0. Attributes SMMU_R_HACDBS_MPAM is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 25 24 PMG 23 16 PARTID 15 0 MPAM_NS Bits [31:25] Reserved, RES0. MPAM_NS, bit [24] MPAM_NS for accesses to the HACDBS. For a description of MPAM_NS, see SMMU_R_GMPAM.MPAM_NS. The reset behavior of this field is: • This field resets to an UNKNOWN value. PMG, bits [23:16] PMG for accesses to the HACDBS. For a description of PMG, see SMMU_R_GMPAM.SO_PMG. The reset behavior of this field is: • This field resets to an UNKNOWN value. PARTID, bits [15:0] PARTID for accesses to the HACDBS. For a description of PARTID, see SMMU_R_GMPAM.SO_PARTID. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HACDBS_MPAM Accesses to this register use the following encodings: Accessible at offset 0x0460 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HACDBS_BASE.EN == ‘0’ and SMMU_R_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 917

Chapter 6. Memory map and registers 6.3. Register formats • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 918

Chapter 6. Memory map and registers 6.3. Register formats 6.3.237 SMMU_R_HACDBS_MECID The SMMU_R_HACDBS_MECID characteristics are: Purpose MECID configuration register for accesses to the HACDBS. Configuration This register is present only when SMMU_R_IDR3.HACDBS == 1 and SMMU_R_IDR3.MEC == 1. Otherwise, direct accesses to SMMU_R_HACDBS_MECID are RES0. Attributes SMMU_R_HACDBS_MECID is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 16 MECID 15 0 Bits [31:16] Reserved, RES0. MECID, bits [15:0] MECID for accesses to the HACDBS. Bits above the supported MECID size, indicated in SMMU_R_MECIDR.MECIDSIZE are RES0. If MECIDSIZE is less than 0xF, the SMMU treats bits [15:MECIDSIZE+1] of this field as zero. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_HACDBS_MECID Accesses to this register use the following encodings: Accessible at offset 0x0464 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_HACDBS_BASE.EN == ‘0’ and SMMU_R_HACDBS_CONS.ENACK == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 919

Chapter 6. Memory map and registers 6.3. Register formats 6.3.238 SMMU_R_CITAB_BASE The SMMU_R_CITAB_BASE characteristics are: Purpose Configuration of Command Queue Information Table base address for Realm state. Configuration This register is present only when SMMU_R_IDR6.VSID == 1. Otherwise, direct accesses to SMMU_R_CITAB_BASE are RES0. Attributes SMMU_R_CITAB_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions 63 RA 62 RES0 61 56 ADDR 55 32 RES0 ADDR 31 4 RES0 3 0 Bit [63] Reserved, RES0. RA, bit [62] Read-Allocate hint for an access to the CIT and the VSTTs. For more information, see SMMU_STRTAB_BASE.RA. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [61:56] Reserved, RES0. ADDR, bits [55:4] Physical address of the Command Queue Information Table base, bits[55:4]. Bits above the implemented OA size, reported in SMMU_IDR5.OAS, are RES0. Address bits above and below the field range are treated as 0. Bits ADDR[N:0] are treated as 0 by the SMMU where: • N == LOG2SIZE + 3, when the CIT is linear. The address is therefore aligned to its size by the SMMU. • N == max(3, (LOG2SIZE - SPLIT - 1 + 3)), when the CIT has 2 levels. The address is therefore aligned to the larger of the CITE size or the L1 array size. For more information, see SMMU_STRTAB_BASE.ADDR. The reset behavior of this field is: • This field resets to an UNKNOWN value. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 920

Chapter 6. Memory map and registers 6.3. Register formats Bits [3:0] Reserved, RES0. Accessing SMMU_R_CITAB_BASE This register is Guarded by SMMU_R_CR0.VSIDEN, and must only be written when SMMU_R_CR0.VSIDEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x0540 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.VSIDEN == ‘0’ and SMMU_R_CR0ACK.VSIDEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 921

Chapter 6. Memory map and registers 6.3. Register formats 6.3.239 SMMU_R_CITAB_BASE_CFG The SMMU_R_CITAB_BASE_CFG characteristics are: Purpose Configuration of Command Queue Information Table for Realm state. Configuration This register is present only when SMMU_R_IDR6.VSID == 1. Otherwise, direct accesses to SMMU_R_CITAB_BASE_CFG are RES0. Attributes SMMU_R_CITAB_BASE_CFG is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 18 FMT 17 16 RES0 15 11 SPLIT 10 6 LOG2SIZE 5 0 Bits [31:18] Reserved, RES0. FMT, bits [17:16] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Format of the Command Queue Information Table. FMT Meaning 0b00 Linear Command Queue Information Table. 0b01 2-level Command Queue Information Table. Other values are reserved, behave as 0b00. For more information, see SMMU_STRTAB_BASE_CFG.FMT. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. Bits [15:11] Reserved, RES0. SPLIT, bits [10:6] When UInt(SMMUv3_PAGE_0.SMMU_IDR0.ST_LEVEL) != 0: Split point for multi-level table. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 922

Chapter 6. Memory map and registers 6.3. Register formats SPLIT Meaning 0b01000 8 bits, 4KB leaf tables. 0b01010 10 bits, 16KB leaf tables. 0b01100 12 bits, 64KB leaf tables. Other values are reserved and behave as 0b01000 If SMMU_CITAB_BASE_CFG.FMT == 0b00, this field is IGNORED. For more information, see SMMU_STRTAB_BASE_CFG.SPLIT. The reset behavior of this field is: • This field resets to an UNKNOWN value. Otherwise: Reserved, RES0. LOG2SIZE, bits [5:0] Table size as log2(entries) Except for readback of a written value, the effective LOG2SIZE is <= SMMU_(R_)IDR6.DCMDQ_CONTROL_PAGE_LOG2NUMP for the purpose of upper/lower/linear CIT index address calculation. For more information, see SMMU_STRTAB_BASE_CFG.LOG2SIZE. The reset behavior of this field is: • This field resets to an UNKNOWN value. Accessing SMMU_R_CITAB_BASE_CFG This register is Guarded by SMMU_R_CR0.VSIDEN, and must only be written when SMMU_R_CR0.VSIDEN == 0. Accesses to this register use the following encodings: Accessible at offset 0x0548 from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.VSIDEN == ‘0’ and SMMU_R_CR0ACK.VSIDEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 923

Chapter 6. Memory map and registers 6.3. Register formats 6.3.240 SMMU_R_CMDQ_CONTROL_PAGE_BASE, n = 0 - 255 The SMMU_R_CMDQ_CONTROL_PAGE_BASE characteristics are: Purpose Provides information about the Enhanced Command queue interface for the SMMU Realm state programming interface. Configuration This register is present only when SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_R_CMDQ_CONTROL_PAGE_BASE are RES0. Attributes SMMU_R_CMDQ_CONTROL_PAGE_BASE is a 64-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 63 56 ADDR[55:16] 55 32 ADDR[55:16] 31 16 RES0 15 3 CMDQGS 2 1 0 CMDQ_CO NTROL_P AGE_PRE SET Bits [63:56] Reserved, RES0. ADDR, bits [55:16] Base address of the Realm state Command queue control page, bits [55:16]. The bits [15:0] of the base address are 0. Bits above the system physical address size, as advertised in SMMU_IDR5.OAS, are RES0. The value of this field is an offset from the base address of SMMU Register Page 0, not an absolute address. The values of all SMMU_CMDQ_CONTROL_PAGE_BASEn.ADDR are such that the pages occupy a contiguous region of address space within the SMMU register file, and they are arranged in ascending value of n. Bits [15:3] Reserved, RES0. CMDQGS, bits [2:1] Granule size to use for the Realm state Command queue control page. CMDQGS Meaning 0b01 64KB ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 924

Chapter 6. Memory map and registers 6.3. Register formats CMDQ_CONTROL_PAGE_PRESET, bit [0] Indicates whether queue controls for this interface are stored in Normal memory or registers. CMDQ_CONTROL_PAGE_PRESET Meaning 0b1 The Realm state ECMDQ interfaces for this page are implemented as registers in the SMMU. This bit is 1 in this revision of the architecture. Accessing SMMU_R_CMDQ_CONTROL_PAGE_BASE Accesses to this register use the following encodings: Accessible at offset 0x4000 + (32 * n) from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 925

Chapter 6. Memory map and registers 6.3. Register formats 6.3.241 SMMU_R_CMDQ_CONTROL_PAGE_CFG, n = 0 - 255 The SMMU_R_CMDQ_CONTROL_PAGE_CFG characteristics are: Purpose Control for Enhanced Command queue interface for the SMMU Realm state programming interface. Configuration This register is present only when SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_R_CMDQ_CONTROL_PAGE_CFG are RES0. Attributes SMMU_R_CMDQ_CONTROL_PAGE_CFG is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 1 EN 0 Bits [31:1] Reserved, RES0. EN, bit [0] Realm state Command queue control page enable. EN Meaning 0b1 Realm state Command queue control page is enabled. This field is RES1. Accessing SMMU_R_CMDQ_CONTROL_PAGE_CFG Accesses to this register use the following encodings: Accessible at offset 0x4008 + (32 * n) from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 926

Chapter 6. Memory map and registers 6.3. Register formats 6.3.242 SMMU_R_CMDQ_CONTROL_PAGE_STATUS, n = 0 - 255 The SMMU_R_CMDQ_CONTROL_PAGE_STATUS characteristics are: Purpose Status of Enhanced Command queue interface for the SMMU Realm state programming interface. Configuration This register is present only when SMMU_R_IDR0.ECMDQ == 1 or SMMU_R_IDR2.RECMDQ == 1. Otherwise, direct accesses to SMMU_R_CMDQ_CONTROL_PAGE_STATUS are RES0. Attributes SMMU_R_CMDQ_CONTROL_PAGE_STATUS is a 32-bit register. This register is part of the SMMUv3_R_PAGE_0 block. Field descriptions RES0 31 1 0 ENACK Bits [31:1] Reserved, RES0. ENACK, bit [0] Realm state Command queue control page enable. ENACK Meaning 0b1 Realm state Command queue control page is enabled. This field is RES1. Accessing SMMU_R_CMDQ_CONTROL_PAGE_STATUS Accesses to this register use the following encodings: Accessible at offset 0x400C + (32 * n) from SMMUv3_R_PAGE_0 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 927

Chapter 6. Memory map and registers 6.3. Register formats 6.3.243 SMMU_R_EVENTQ_PROD The SMMU_R_EVENTQ_PROD characteristics are: Purpose Allows Event queue producer to update the read index for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_EVENTQ_PROD is a 32-bit register. This register is part of the SMMUv3_R_PAGE_1 block. Field descriptions 31 RES0 30 20 WR 19 0 OVFLG OVFLG, bit [31] Event queue overflowed flag. • An Event queue overflow is indicated using this flag. This flag is toggled by the SMMU when a queue overflow is detected, if OVFLG == SMMU_R_EVENTQ_CONS.OVACKFLG. • This flag will not be updated until a prior overflow is acknowledged by setting SMMU_R_EVENTQ_CONS.OVACKFLG equal to OVFLG. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. WR, bits [19:0] Event queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Queue write index wrap flag. Bits [QS-1:0]: WR - Queue write index. • Next space to be written by SMMU. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_EVENTQ_BASE.LOG2SIZE, see SMMU_R_EVENTQ_CONS. If QS < 19, bits [19:QS+1] are RAZ. When incremented by the SMMU, the WR index is always wrapped to the current queue size given by QS. If QS == 0 the queue has one entry. Zero bits of WR index are present and WR_WRAP is bit zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 928

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_R_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this registers that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_R_CR0.EVENTQEN is transitioned from 0 to 1. Note: See section 7.4 Event queue overflow for details on queue overflow. An overflow condition is entered when a record has been discarded due to a full enabled Event queue. The following conditions do not cause an overflow condition: • Event records discarded when the Event queue is disabled, that is when SMMU_R_CR0.EVENTQEN == 0. • A stalled faulting transaction, as stall event records do not get discarded when the Event queue is full or disabled. Accessing SMMU_R_EVENTQ_PROD This register is Guarded by SMMU_R_CR0.EVENTQEN and must only be modified when SMMU_R_CR0.EVENTQEN == 0. See SMMU_R_EVENTQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00A8 from SMMUv3_R_PAGE_1 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.EVENTQEN == ‘0’ and SMMU_R_CR0ACK.EVENTQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 929

Chapter 6. Memory map and registers 6.3. Register formats 6.3.244 SMMU_R_EVENTQ_CONS The SMMU_R_EVENTQ_CONS characteristics are: Purpose Event queue consumer read index for Realm state. Configuration There are no configuration notes. Attributes SMMU_R_EVENTQ_CONS is a 32-bit register. This register is part of the SMMUv3_R_PAGE_1 block. Field descriptions 31 RES0 30 20 RD 19 0 OVACKFLG OVACKFLG, bit [31] Overflow acknowledge flag. • Software must set this flag to the value of SMMU_R_EVENTQ_PROD.OVFLG when it is safe for the SMMU to report a future EVENT queue overflow. Arm recommends that this is done on initialization and after a previous Event queue overflow is handled by software. • See section 7.4 Event queue overflow. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. RD, bits [19:0] Event queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Event queue read index wrap flag. Bits [QS-1:0]: RD - Event queue read index. • Updated by the PE to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_EVENTQ_BASE.LOG2SIZE and SMMU_R_EVENTQ_BASE.LOG2SIZE <= SMMU_IDR1.EVENTQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.EVENTQS < 19, bits [19:EVENTQS + 1] are UNKNOWN on read. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 930

Chapter 6. Memory map and registers 6.3. Register formats If QS == 0 the queue has one entry. Zero bits of RD index are present and RD_WRAP is bit zero. When software increments RD, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and RD_WRAP toggled. Arm recommends that software initializes the register to a valid value before SMMU_R_CR0.EVENTQEN is transitioned from 0 to 1. When SMMU_R_EVENTQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Accessing SMMU_R_EVENTQ_CONS Accesses to this register use the following encodings: Accessible at offset 0x00AC from SMMUv3_R_PAGE_1 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 931

Chapter 6. Memory map and registers 6.3. Register formats 6.3.245 SMMU_R_PRIQ_PROD The SMMU_R_PRIQ_PROD characteristics are: Purpose PRI queue write index status for Realm state. Configuration This register is present only when SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_PROD are RES0. Attributes SMMU_R_PRIQ_PROD is a 32-bit register. This register is part of the SMMUv3_R_PAGE_1 block. Field descriptions 31 RES0 30 20 WR 19 0 OVFLG OVFLG, bit [31] • This flag is toggled by the SMMU when a queue overflow is detected, in which case one or more requests have been lost. • An overflow condition is present when this flag is different from SMMU_R_PRIQ_CONS.OVACKFLG. This flag is not updated until the overflow is acknowledged by setting SMMU_R_PRIQ_CONS.OVACKFLG equal to OVFLG. The reset behavior of this field is: • This field resets to '0'. Bits [30:20] Reserved, RES0. WR, bits [19:0] Queue write index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: WR_WRAP - Queue write index wrap flag. Bits [QS-1:0]: WR - Queue write index. • Next space to be written by SMMU. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_PRIQ_BASE.LOG2SIZE; see SMMU_R_PRIQ_CONS. If QS < 19, bits [19:QS + 1] are RAZ. When incremented by the SMMU, the WR index is always wrapped to the current queue size given by QS. If QS == 0 the queue has one entry: zero bits of WR index are present and WR_WRAP is bit zero. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 932

Chapter 6. Memory map and registers 6.3. Register formats When SMMU_R_PRIQ_BASE.LOG2SIZE is increased within its valid range, the value of the bits of this register that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before transitioning SMMU_R_CR0.PRIQEN from 0 to 1. Accessing SMMU_R_PRIQ_PROD SMMU_R_PRIQ_PROD is Guarded by SMMU_R_CR0.PRIQEN and must only be modified when PRIQEN == 0. See SMMU_R_PRIQ_BASE for detailed behavior. Accesses to this register use the following encodings: Accessible at offset 0x00C8 from SMMUv3_R_PAGE_1 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • When SMMU_R_CR0.PRIQEN == ‘0’ and SMMU_R_CR0ACK.PRIQEN == ‘0’, accesses to this register are RW. • Otherwise, accesses to this register are RO. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 933

Chapter 6. Memory map and registers 6.3. Register formats 6.3.246 SMMU_R_PRIQ_CONS The SMMU_R_PRIQ_CONS characteristics are: Purpose PRI queue consumer read index for Realm state. Configuration This register is present only when SMMU_R_IDR0.PRI == 1. Otherwise, direct accesses to SMMU_R_PRIQ_CONS are RES0. Attributes SMMU_R_PRIQ_CONS is a 32-bit register. This register is part of the SMMUv3_R_PAGE_1 block. Field descriptions 31 RES0 30 20 RD 19 0 OVACKFLG OVACKFLG, bit [31] Overflow acknowledge flag. • Note: Software sets this flag to the value of SMMU_R_PRIQ_PROD.OVFLG when it is ready for the SMMU to report a new PRI queue overflow. Arm expects this to be done on initialization and after a previous PRI queue overflow has been handled by software. The reset behavior of this field is: • This field resets to an UNKNOWN value. Bits [30:20] Reserved, RES0. RD, bits [19:0] Queue read index. This field is treated as two sub-fields, depending on the configured queue size: Bit [QS]: RD_WRAP - Queue read index wrap flag. Bits [QS-1:0]: RD - Queue read index. • Updated by the PE to point at the queue entry after the entry it has just consumed. The reset behavior of this field is: • This field resets to an UNKNOWN value. Additional Information QS == SMMU_R_PRIQ_BASE.LOG2SIZE and SMMU_R_PRIQ_BASE.LOG2SIZE <= SMMU_R_IDR1.PRIQS <= 19. This gives a configurable-sized index pointer followed immediately by the wrap bit. If QS < 19, bits [19:QS + 1] are RES0. If software writes a non-zero value to these bits, the value might be stored but has no other effect. In addition, if SMMU_IDR1.PRIQS < 19, bits [19:PRIQS + 1] are UNKNOWN on read. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 934

Chapter 6. Memory map and registers 6.3. Register formats If QS == 0 the queue has one entry: zero bits of RD index are present and RD_WRAP is bit zero. When software increments RD, if the index would pass off the end of the queue it must be correctly wrapped to the queue size given by QS and RD_WRAP toggled. When SMMU_R_PRIQ_BASE.LOG2SIZE is increased within its valid range, the value of this register’s bits that were previously above the old wrap flag position are UNKNOWN and when it is decreased, the value of the bits from the wrap flag downward are the effective truncation of the value in the old field. Arm recommends that software initializes the register to a valid value before SMMU_R_CR0.PRIQEN is transitioned from 0 to 1. Accessing SMMU_R_PRIQ_CONS Accesses to this register use the following encodings: Accessible at offset 0x00CC from SMMUv3_R_PAGE_1 • When an access is not Realm and an access is not Root, accesses to this register are RAZ/WI. • Otherwise, accesses to this register are RW. 6.3.247 ID_REGS Register offsets 0xFD0-0xFFC are defined as a read-only identification register space. For Arm implementations of the SMMU architecture the assignment of this register space, and naming of registers in this space, is consistent with the Arm identification scheme for Arm CoreLink and Arm CoreSight components. Arm strongly recommends that other implementers also use this scheme to provide a consistent software discovery model. For Arm implementations, the following assignment of fields, consistent with CoreSight ID registers [10], is used: Offset Name Field Value Meaning 0xFF0 SMMU_CIDR0, Component ID0 [7:0] 0x0D Preamble 0xFF4 SMMU_CIDR1, Component ID1 [7:4] 0xF CLASS [3:0] 0x0 Preamble 0xFF8 SMMU_CIDR2, Component ID2 [7:0] 0x05 Preamble 0xFFC SMMU_CIDR3, Component ID3 [7:0] 0xB1 Preamble 0xFE0 SMMU_PIDR0, Peripheral ID0 [7:0] IMPDEF PART_0: bits [7:0] of the Part number 0xFE4 SMMU_PIDR1, Peripheral ID1 [7:4] IMPDEF DES_0: bits [3:0] of the JEP106 Designer code [3:0] IMPDEF PART_1: bits [11:8] of the Part number 0xFE8 SMMU_PIDR2, Peripheral ID2 [7:4] IMPDEF REVISION [3] 1 JEDEC-assigned value for DES always used [2:0] IMPDEF DES_1: bits [6:4] bits of the JEP106 Designer code ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 935

Chapter 6. Memory map and registers 6.3. Register formats Offset Name Field Value Meaning 0xFEC SMMU_PIDR3, Peripheral ID3 [7:4] IMPDEF REVAND [3:0] IMPDEF CMOD 0xFD0 SMMU_PIDR4, Peripheral ID4 [7:4] 0 SIZE [3:0] IMPDEF DES_2: JEP106 Designer continuation code 0xFD4 SMMU_PIDR5, Peripheral ID5 RES0 Reserved 0xFD8 SMMU_PIDR6, Peripheral ID6 RES0 Reserved 0xFDC SMMU_PIDR7, Peripheral ID7 RES0 Reserved Fields outside of those defined in this table are RES0. Note: The Designer code fields (DES_*) fields for Arm-designed implementations use continuation code 0x4 and Designer code 0x3B. Note: Non-Arm implementations that follow this CoreSight ID register layout must set the Designer fields appropriate to the implementer. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 936