9 Address Translation Operations

Chapter 9 Address Translation Operations The SMMU optionally supports a software-accessible Address Translation Operations (ATOS) facility. The presence of this facility is reported by SMMU_IDR0.ATOS. The ATOS facility allows software to perform an address lookup to determine the output address that a transaction would take, given an input address, stream, substream and access properties. The requested lookup can be the full end-to-end, with all configured stages, or only a part of the configuration for the stream. The result of the request is either the output address or a fault status code, if a translation is unable to complete. Unlike transactions, ATOS requests are not affected by fault configuration bits in the STE or CD, and do not record fault events or stall. If ATOS is supported, an optional virtual ATOS (VATOS) page might also be supported. This is reported by SMMU_IDR0.VATOS. The VATOS page can be mapped through to a chosen software entity so that it might perform a limited set of stage 1-only ATOS lookups directly. The VATOS interface can make stage 1-only ATOS lookups for stage 1 and stage 2 nested configurations, or for stage 1-only configurations. The VATOS interface can only make lookups for configurations associated with the NS-EL1 StreamWorld. Note: Arm expects VATOS to be used with stage 1 and stage 2 nested configurations. Note: Apart from differences in scope the groups of registers are equivalent and are referred to generically using ATOS_ prefixes in this chapter. The difference in scope between the ATOS registers is that the VATOS registers can only access stage 1 translations, the GATOS registers cannot access Secure stream information, and the S_GATOS registers can access Secure stream information. When ATOS is supported, a group of SMMU_GATOS_SID, SMMU_GATOS_ADDR and SMMU_GATOS_PAR registers are available in the memory map. When SMMU_S_IDR1.SECURE_IMPL == 1, a second group is present in SMMU_S_GATOS_SID, SMMU_S_GATOS_ADDR, SMMU_S_GATOS_PAR. If VATOS is supported, a third group, SMMU_VATOS_SID, SMMU_VATOS_ADDR and SMMU_VATOS_PAR, are present in a distinct VATOS page, see Chapter 6 Memory map and registers. If both VATOS and Secure stage 2 are supported, a fourth group SMMU_S_VATOS_SID, SMMU_S_VATOS_ADDR and SMMU_S_VATOS_PAR, are present in a distinct S_VATOS page. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 978

Chapter 9. Address Translation Operations When Secure stage 2 is supported, the SMMU_S_GATOS interface can be used to issue stage 1+2 and stage 2 ATOS lookups to Secure streams, that is, when SMMU_S_GATOS_SID.SSEC == 1. These lookups are subject to the same validity checks with respect to configured and enabled stages of translation as would be performed using the Non-secure GATOS interface. Each group of registers might perform one lookup at a time, but all implemented sets of registers might perform independent lookups simultaneously. Access to a register that affects ATOS behavior only affects the group that is accessed, and programming of the registers (whether correct or incorrect) does not affect other groups. The ATOS registers might perform address lookups with the following properties as though a transaction were received through a given StreamID and SubstreamID: • Read/Write. • Unprivileged/Privileged. • Instruction/Data. The types of translations available are: • VA to PA for a stage 1 and stage 2 configuration. • VA to IPA for a stage 1 of a stage 1 and stage 2 configuration. • VA to IPA or PA for a stage 1-only configuration. • IPA to PA for a configuration with stage 2. The lookup procedure is: 1. Ensure the ATOS interface is idle (ATOS_CTRL.RUN == 0) and claimed for exclusive use in case several agents share the interface. 2. Ensure ATOS_SID identifies the StreamID and SubstreamID that will be used for the lookup. 3. Write the source address and lookup action to ATOS_ADDR. 4. Ensure the prior register writes are observed by the SMMU before the following write. 5. Write ATOS_CTRL.RUN == 1 to initiate the lookup. 6. Poll ATOS_CTRL.RUN; the SMMU clears the RUN flag when the result is ready. 7. The result appears in ATOS_PAR. This might be a result address or a fault code, determined in the same way as for an ordinary input transaction. The translation process for an ATOS request is not required to begin immediately when ATOS_CTRL.RUN is written to 1, and will begin in finite time. Arm expects that any delay will be small. An ATOS translation interacts with configuration and TLB invalidation in the same way as a translation that is performed for a transaction. The result of an ATOS translation that completes after an invalidation completes is not based on any stale data that was targeted by the invalidation. See section 3.21 Structure access rules and update procedures for more information. Note: A CMD_SYNC depends upon the visibility of HTTU updates performed by completed ATOS translations. The completion of an invalidation operation is permitted, but not required, to depend on either of the following: • The completion of an ATOS translation that has been requested by writing RUN to 1 but has not begun before the invalidation completion operation was observed. • The completion of an ATOS translation that is unaffected by the invalidation. The domain of the lookup, in Secure, Non-secure, hypervisor, EL3 or Monitor terms, is determined by the stream configuration. Translations from a Secure stream are only returned through the S_ATOS interface. A Non-secure stream might be queried by either interface. The S_GATOS interface contains a SSEC flag to indicate whether the requested StreamID is to be treated as Secure or Non-secure. The lookup action provided in the write to ATOS_ADDR determines the read/write, instruction/data and privilege attributes of the request. The treatment of the input address that is provided by ATOS_ADDR is governed by the same rules that affect an ordinary translation, in terms of range checks according to TxSZ, IPS, and PS SMMU properties. See section 3.4 Address sizes. *ATOS_ADDR.ADDR provides an input 64-bit address. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 979

Chapter 9. Address Translation Operations Note: As the full address is provided, a translation lookup could fail with a Translation fault because it is outside the configured input range for the initial stage or stages of lookup. This includes consideration of the Top Byte Ignore (TBI) configuration. With respect to memory attributes, responses to ATOS requests reflect the attributes assigned in the translation table descriptors and STE memory attribute overrides do not have an effect on ATOS requests. See 13.1.4 Replace. The permissions model used by an ATOS translation is the same as is used for an ordinary transaction, except that the read/write, instruction/data and privileged/unprivileged properties of the translation are taken directly from ATOS_ADDR instead of coming from an input transaction or overrides in STE.{INSTCFG, PRIVCFG}. See Table 13.4. Note: The permission attributes are not affected by the STE.INSTCFG or STE.PRIVCFG overrides. In the case where an ATOS operation explicitly performs translation at only one stage when a stream is configured for stage 1 and stage 2 translation, only the permission configuration that is applicable to the requested translation stage is used. Note: This means that CD-based permission controls such as PAN, UWXN and WXN are not used when an ATOS translation does not translate using stage 1. When stage 1 is in use, all of the CD-based permission controls are used by ATOS translations, in the same way as would be done for an ordinary transaction. These are CD.PAN, CD.UWXN, CD.WXN and CD.HAD{0,1}. When ATOS_ADDR.HTTUI == 0, ATOS operations perform HTTU when supported by the SMMU and configured for any of the translation regimes used to perform the lookup, in the same way as would occur for a read or write transaction to the same address of the same StreamID/SubstreamID, including fetch of CD and Stage 1 translation table descriptors through stage 2 translations. When ATOS_ADDR.HTTUI == 1, the request inhibits HTTU and the behavior is as follows: • When an Access flag update is enabled for a stage of translation, the SMMU is permitted but not required to set the Access flags in translation table descriptors for the requested address. If AF == 0, then the ATOS translation behaves as though AF == 1, even if the Access flag is not updated. If a translation-related fault or external abort occurs as a result of performing the Access flag update, it is IMPLEMENTATION DEFINED whether the ATOS operation reports the fault or whether the operation continues as though the Access flag was successfully updated. Note: This applies to AF updates to Page and Block descriptors, if either (STE.S2HA == 1 or CD.HA == 1), as well as to Table descriptors, if either (STE.S2HAFT == 1 or CD.HAFT == 1). • When update of the dirty state of a page is enabled for a stage of translation (STE.S2HD == 1 or CD.HD == 1), a translation table descriptor that is writable-clean is considered to be writable by the ATOS mechanism but the descriptor is not updated to writable-dirty. Setting ATOS_ADDR.HTTUI == 1 has no effect when updates to both the Access flag and dirty state of the page are disabled. Note: The behavior of an ATOS operation with HTTUI == 1 matches that of address translation operations in the PE, with respect to AF and dirty state of the page permissions. Note: If HTTU is inhibited in order to translate without changing the translation table state, this inhibition includes stage 2 translation tables that back the stage 1 translation table in nested configurations. An implementation is allowed to update stage 1 AF when ATOS_ADDR.HTTUI == 1 only if the associated stage 2 descriptor is already marked as writable-dirty. When HTTU is enabled at stage 2 in a nested stage 1 and stage 2 configuration, and ATOS performs a stage 1-only VA to IPA translation and HTTU is enabled for ATOS, the SMMU does not mark the final IPA’s page as dirty and is permitted but not required to mark the final IPA’s page as accessed. ATOS requests using SMMU_GATOS_ or SMMU_VATOS_ require SMMU_CR0.SMMUEN == 1 and ATOS requests using SMMU_S_GATOS_ or SMMU_S_VATOS_ require SMMU_S_CR0.SMMUEN == 1. When a GATOS request is issued on the Secure SMMU_S_GATOS_* interface and SMMU_S_GATOS_SID.SSEC == 0, the translation also requires SMMU_CR0.SMMUEN == 1. See SMMU_GATOS_CTRL and SMMU_S_GATOS_CTRL for more information. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 980

Chapter 9. Address Translation Operations An ATOS request is permitted to use and insert cached configuration structures and translations, consistent with any caches that are provided for transaction translation. Regardless of the value of ATOS_ADDR.HTTUI , an ATOS request that uses a configuration that has HTTU enabled, that is a configuration with STE.S2HA == 1, CD.HA == 1, STE.S2HD == 1, or CD.HD == 1, does not insert or update TLB entries that would be marked as Accessed or Dirty when their associated translation table descriptors in memory are not. When SMMU_S_IDR1.SECURE_IMPL == 1, the SMMU does not allow: • Secure information to be used to form a Non-secure ATOS_PAR result • A Non-secure ATOS request to affect SMMU_S_GATOS_ OR SMMU_S_VATOS_ register values, including PAR, or active Secure ATOS translation requests. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 981

Chapter 9. Address Translation Operations 9.1. Register usage 9.1 Register usage 9.1.1 ATOS_CTRL Software writes ATOS_CTRL.RUN to 1 to request a translation. The bit is cleared back to 0 by the SMMU when ATOS_PAR has been updated with the result. Software must not write any register in the ATOS group when ATOS_CTRL.RUN == 1. SMMUEN must not be cleared while one or more ATOS requests are in progress for the programming interface, otherwise ongoing requests might be terminated. ATOS_CTRL.RUN is cleared by an Update of SMMUEN to 0. Note: An ATOS request that is made through the Secure programming interface for a Non-secure StreamID might be affected by Non-secure software simultaneously clearing SMMU_CR0.SMMUEN from another PE, so must accept spurious ATOS translation failures which might result. See SMMU_GATOS_CTRL and SMMU_VATOS_CTRL for more information on ATOS_CTRL.RUN and alteration of the SMMUEN flags. 9.1.2 ATOS_SID The StreamID and optional SubstreamID are written to ATOS_SID.STREAMID, ATOS_SID.SUBSTREAMID and ATOS_SID.SSID_VALID in preparation for a subsequent ATOS lookup. When ATOS_CTRL.RUN is written to 1, the value of this register is used as input to the process. The SMMU_S_GATOS_SID register contains a SSEC flag that selects between Secure and Non-secure StreamID lookup for an ATOS request that is issued from the Secure interface. The SSEC flag is RES1 in the SMMU_S_VATOS_SID register. A Secure VATOS request can only access Secure StreamIDs. Note: Non-secure ATOS interfaces have no SSEC flag, so they can only look up Non-secure StreamIDs. 9.1.3 ATOS_ADDR The address to be queried is written to ATOS_ADDR.ADDR. The type of lookup that is required is written to the ATOS_ADDR.TYPE field: TYPE Meaning 0b00 Reserved Generates ATOS error INV_REQ. 0b01 Stage 1 (Look up IPA/PA from VA) Only format available when SMMU supports only stage 1 translation. Only format available to VATOS interface. Note: It is permissible to make a stage 1 request for a StreamID with either a stage 1-only or a stage 1 and 2 configuration. Generates ATOS error INV_REQ when SMMU does not support stage 1 translation. Generates ATOS error INV_STAGE when stage 1 is supported but not configured to translate for the given StreamID. Note: This does not require a stage 1-only configuration for the StreamID. This lookup returns the stage 1 information from a nested configuration. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 982

Chapter 9. Address Translation Operations 9.1. Register usage TYPE Meaning 0b10 Stage 2 (look up PA from IPA) Generates ATOS error INV_REQ when used from the SMMU_VATOS_ADDR interface, or when the SMMU does not support stage 2 translation. Generates ATOS error INV_STAGE when stage 2 is supported but not configured to translate for the given StreamID. If SMMU_S_IDR1.SEL2 == 0, generates ATOS error INV_STAGE when issued from the Secure ATOS interface with SMMU_S_GATOS_SID.SSEC == 1. Generates ATOS error INV_REQ if ATOS_SID.SSID_VALID (because no stage 1 translation is requested). Note: This does not require a stage 2-only configuration for the StreamID. This lookup returns the stage 2 information from a nested configuration. 0b11 Stage 1 and stage 2 (Look up PA from VA) Generates ATOS error INV_REQ when used from SMMU_VATOS_ADDR interface, or when the SMMU does not support both stage 1 and stage 2. Generates ATOS error INV_STAGE when stage 1 and stage 2 are supported but not both configured to translate for the given StreamID. If SMMU_S_IDR1.SEL2 == 0, generates ATOS error INV_STAGE when issued from the Secure ATOS interface with SMMU_S_GATOS_SID.SSEC == 1. When TYPE == 0b01 or 0b11 (requesting stage 1), the generation of INV_STAGE is determined from whether stage 1 is configured to translate by STE.Config and is not caused by a STE.S1DSS == 0b01 configuration. A request that is incompatible with the ATOS interface is an invalid request, and results in INV_REQ. Note: For example, a stage 1 request to an SMMU that does not support stage 1, or a stage 2 request to a VATOS interface, will cause INV_REQ. A valid request through any ATOS interface for information about a stream that has an invalid STE results in C_BAD_STE, if a higher priority fault has not occurred. See section 9.1.4 ATOS_PAR. If an STE is fetched successfully and the STE is valid, then one of the following will apply: • A request through a GATOS interface for information about a stream that has STE.Config == 0b0xx or 0b100 results in INV_STAGE. • A request through a VATOS interface for information about a stream that has STE.Config == 0b0xx or 0b100 results in C_BAD_STE, because the STE.S2VMID field is not valid and cannot match the VATOS_SEL.VMID value. See section 9.1.6 SMMU_(S_)VATOS_SEL. A request with ATOS_SID.SSID_VALID == 0 on a stream with STE.S1DSS == 0b01 leads to one of the following: • A stage 1 lookup (TYPE == 0b01) behaves according to stage 1-bypass, which returns the address provided in ATOS_ADDR.ADDR without translation, or returns a stage 1 fault. If no fault occurs and a result is returned, the result contains the following properties: – ATOS_PAR.ADDR is the input address plus a translation size encoded in conjunction with ATOS_PAR.Size. The translation size is permitted to be any value between the minimum implemented granule size and the IAS. – ATOS_PAR.ATTR and ATOS_PAR.SH are IMPLEMENTATION DEFINED. – SMMU_S_GATOS_PAR.NS is IMPLEMENTATION DEFINED. Note: It is possible for an Address Size fault to result from stage 1 in bypass. It is also possible for the configuration of SMMU_S_CR0.SIF to cause a stage 1 permission fault on a Secure stream. • A stage 1 and stage 2 lookup (TYPE == 0b11) behaves according to stage 1-bypass, and stage 2-translates, returning the address provided in *ATOS_ADDR.ADDR translated at stage 2, or a stage 1 fault or a stage 2 ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 983

Chapter 9. Address Translation Operations 9.1. Register usage fault. The required read/write, instruction/data and privileged/unprivileged properties of the ATOS request are written to ATOS_ADDR.RnW, ATOS_ADDR.InD and ATOS_ADDR.PnU, respectively. These attributes are not affected by the STE.INSTCFG or STE.PRIVCFG overrides. The required NS attribute of the ATOS request is written to ATOS_ADDR.NS. The supplied NS attribute is not affected by the STE.NSCFG override. 9.1.4 ATOS_PAR ATOS_PAR contains the result of the translation request, which provides either a translated address and attributes or an error result. The content of ATOS_PAR is only valid when a translation has been both initiated and completed through the sequence of the corresponding RUN bit having been set to 1 by software, and then cleared to 0 by the SMMU. If ATOS_PAR.FAULT == 0, the translation was successful and ATOS_PAR.ADDR returns the translated address, in addition to the page size, and other fields provide the determined access attributes. See SMMU_GATOS_PAR and SMMU_VATOS_PAR for details of the fields. The attributes that are returned in ATOS_PAR.ATTR and ATOS_PAR.SH are those that are determined from the translation for a stage 1-only or a stage 2-only request or for a stage 1 and stage 2 request. See section 13.1.5 Combine for definition of attribute combination. Because the SH field in the descriptor only encodes a Shareability for Normal memory, a Shareability of OSH is always provided in ATOS_PAR.SH when a Device memory type is determined from this procedure. The memory attributes do not include STE.{SHCFG, MTCFG, MemAttr} overrides and are permitted to reflect the attributes that are stored in TLB entries. The attributes that are stored in the TLB entries might be an IMPLEMENTATION DEFINED subset of the architectural TTD/MAIR attributes/types, see SMMU_GATOS_PAR and SMMU_VATOS_PAR. Consistent with the rules for SMMU-originated accesses in a system that supports RME, configuration structure fetches and translation table walks arising from use of the ATOS registers are subject to granule protection checks. See 3.25.3 SMMU-originated accesses. If a configuration structure fetch or translation table walk fails with a granule protection check fault, this is reported in both: • The appropriate SMMU_ROOT_GPF_FAR or SMMU_ROOT_GPT_CFG_FAR register, if that register does not already contain an active fault. • The appropriate ATOS_PAR register, as though the failed access experienced an External abort. When performing an ATOS operation, the SMMU does not perform a granule protection check on the final output address of a successful translation. If ATOS_PAR.FAULT == 1, an error or fault occurred during translation. In this case, ATOS_PAR.FAULTCODE reports whether there was: • An error in invocation, which is INV_REQ or INV_STAGE, as described in section 9.1.3 ATOS_ADDR. • A fault or error during translation, corresponding to a standard SMMU event type, for example C_BAD_STE or F_TRANSLATION. • An internal error. For example, a RAS error that caused the translation to terminate, or the case where SMMUEN was cleared to 0, thereby terminating the translation. Other fields in ATOS_PAR determine the following: • REASON. This field determines whether the issue was encountered at stage 1, or at stage 2 because of the incoming IPA, or because of fetching a stage 1 translation or a CD through an IPA that caused a stage 2 fault. • FADDR. This field determines the IPA that caused a stage 2 fault. The validity of the REASON and FADDR fields changes depending on the type of request that is made and the kind of fault encountered. In the following table: ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 984

Chapter 9. Address Translation Operations 9.1. Register usage • TRF means any of the Translation Related Faults (F_TRANSLATION, F_ADDR_SIZE, F_ACCESS, F_PERMISSION). • MISC means all other faults, with the exception of F_WALK_EABT, F_CD_FETCH, INV_REQ and INV_STAGE. Note: MISC therefore represents: INTERNAL_ERR, C_BAD_STREAMID, F_STE_FETCH, F_VMS_FETCH, C_BAD_STE, F_STREAM_DISABLED, C_BAD_SUBSTREAMID, C_BAD_CD, F_TLB_CONFLICT, F_CFG_CONFLICT. Note: There are no ATOS changes arising from the introduction of the F_PERMISSION fields DirtyBit and AssuredOnly in SMMUv3.4. An ATOS operation that fails because of a Permission fault is reported using the existing ATOS_PAR encodings for Permission faults, regardless of whether the permission fault would be reported with DirtyBit set to 1 or AssuredOnly set to 1 in an F_PERMISSION event. ATOS_ADDR. TYPE Possible FAULTCODE values Possible PAR.REASON values FADDR contents Notes Any INV_REQ, INV_STAGE 0b00 0 Error in invocation. See section 9.1.3 *ATOS_ADDR 0b01 (stage 1) on stage 1-only stream F_WALK_EABT 0b00 (S1) 0 descriptor fetch abort F_CD_FETCH CD fetch abort TRF, MISC 0b01 (stage 1) on stage 1 and 2 stream F_WALK_EABT 0b00 (S1) 0 Stage 1 descriptor fetch abort (actual bus abort) F_CD_FETCH CD fetch abort (actual bus abort) F_CD_FETCH, if stage 2 F_WALK_EABT or stage 2 TRF is caused by CD fetch CD fetch abort (synthetic, because of a stage 2 translation failure) F_WALK_EABT, if stage 2 F_WALK_EABT or stage 2 TRF is cased by stage 1 descriptor fetch. Stage 1 descriptor fetch abort (synthetic because of a stage 2 translation failure) ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 985

Chapter 9. Address Translation Operations 9.1. Register usage *ATOS_ADDR. TYPE Possible FAULTCODE values Possible PAR.REASON values FADDR contents Notes TRF, MISC Configuration or miscellaneous fault, or stage 1 TRF. Note: The IPA that is determined from a Stage 1 translation is not further translated to a PA, therefore stage 2 TRFs on an illegal IPA do not occur. 0b10 (stage 2) F_ADDR_SIZE 0b11 (S2, IN) 0 Stage 2 Address Size fault. F_ADDR_SIZE 0b00 (S1) 0 Stage 1 Address Size fault. It is IMPLEMENTATION DEFINED whether an SMMUv3.0 implementation reports this fault as REASON = 0b00 or 0b01 F_TRANSLATION, F_ACCESS, F_PERMISSION, F_WALK_EABT, MISC 0b11 (S2, IN) 0 0b11 (stage 1 and stage 2) TRF 0b00 (S1) 0 Stage 1 translation- related fault 0b01 (S2, CD fetch) IPA input to stage 2 (CD address) Stage 2 fault on CD fetch 0b10 (S2, TT fetch) IPA input to stage 2 (descriptor address) Stage 2 fault on stage 1 descriptor fetch 0b11 (S2, IN) IPA input to stage 2 (stage 1 output) Stage 2 fault on IPA F_WALK_EABT 0b00 0 Stage 1 descriptor fetch abort ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 986

Chapter 9. Address Translation Operations 9.1. Register usage ATOS_ADDR. TYPE Possible FAULTCODE values Possible PAR.REASON values FADDR contents Notes 0b01, 0b10, 0b11 0 Stage 2 descriptor fetch abort (for CD/TT/IN, as indicated by the REASON field) F_CD_FETCH 0b00 0 CD fetch abort MISC 0b00 0 9.1.5 ATOS_PAR.FAULTCODE encodings ATOS_PAR.FAULTCODE has the following values: Type Meaning Notes 0xFF INV_REQ Malformed ATOS request 0xFE INV_STAGE Request for stage of translation that is not present 0xFD INTERNAL_ERR Translation was terminated for miscellaneous reason. 0x02 C_BAD_STREAMID ATOS_SID.STREAMID out of range of configured Stream table. Note: ATOS_SID.STREAMID might not store bits above the implemented StreamID size. An implementation is permitted but not required to record this error if ATOS_SID.STREAMID is greater than the implemented StreamID size, or might truncate STREAMID to the implemented StreamID size. 0x03 F_STE_FETCH External abort or error on STE fetch 0x04 C_BAD_STE Selected STE invalid or illegal 0x06 F_STREAM_DISABLED Non-substream request was made (ATOS_SID.SSID_VALID == 0) on configuration with Config[0] == 1 and STE.S1CDMax > 0 and STE.S1DSS == 0b00, or a request with SubstreamID 0 was made on configuration with Config[0] == 1 and STE.S1CDMax > 0 and STE.S1DSS == 0b10. 0x08 C_BAD_SUBSTREAMID ATOS_SID.SSID out of range of configured CD table. Note: ATOS_SID.SUBSTREAMID might not store bits above the implemented SubstreamID size. An implementation is permitted but not required to record this error if ATOS_SID.SUBSTREAMID is greater than the implemented SubstreamID size, or might truncate SUBSTREAMID to the implemented SubstreamID size. 0x09 F_CD_FETCH External abort or error on CD fetch For a VATOS (or other stage 1-only) request, this is returned where the CD fetch caused a stage 2 fault. 0x0A C_BAD_CD Selected CD invalid or illegal ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 987

Chapter 9. Address Translation Operations 9.1. Register usage Type Meaning Notes 0x0B F_WALK_EABT External abort or error on translation table walk For a VATOS (or other stage 1-only) request, this is returned where the stage 1 walk caused a stage 2 fault. 0x10 F_TRANSLATION Translation fault 0x11 F_ADDR_SIZE Address Size fault 0x12 F_ACCESS Access flag fault 0x13 F_PERMISSION Permission fault 0x20 F_TLB_CONFLICT Translation caused TLB conflict condition 0x21 F_CFG_CONLICT Translation caused configuration cache conflict condition 0x25 F_VMS_FETCH External abort or error on VMS fetch All other values are Reserved. The priority order of the C_ and F_ errors and faults follow the same order that is set out for Event queue events in 7.3.23 Event queue record priorities, with the relative priorities for INV_REQ and INV_STAGE as shown here: 1. INV_REQ a. Note: Whether INV_REQ is to be reported is determined statically before access of configuration structures. 2. INV_STAGE (point A, see below) 3. C_BAD_STREAMID 4. F_STE_FETCH 5. C_BAD_STE 6. F_VMS_FETCH a. Note: Relative priority of F_VMS_FETCH is defined below. 7. INV_STAGE (point B, see below) 8. C_BAD_SUBSTREAMID 9. F_STREAM_DISABLED 10. Translation faults (stage 2, for fetch of a CD) 11. F_CD_FETCH 12. C_BAD_CD 13. Translation-related faults (stage 1 or stage 2, for input address) INV_STAGE is reported after the STE is fetched and valid, at point B, after C_BAD_STREAMID, F_STE_FETCH and C_BAD_STE are checked, if the enabled set of stages of the STE are determined to be incompatible with the request. INV_STAGE takes precedence over C_BAD_SUBSTREAMID, F_STREAM_DISABLED, F_CD_FETCH, C_BAD_CD and all Translation-related faults. When SMMU_S_IDR1.SEL2 == 0 and a Secure GATOS request is made with SMMU_S_GATOS_SID.SSEC == 1, then INV_STAGE is permitted to be determined statically at point A prior to checking for C_BAD_STREAMID. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 988

Chapter 9. Address Translation Operations 9.1. Register usage Note: This is because a Secure stream cannot have stage 2 enabled when SMMU_S_IDR1.SEL2 == 0, so a GATOS request for stage 2 information from a Secure stream is always invalid. When SMMU_S_IDR1.SEL2 == 1, Secure stage 2 is supported which means that this check cannot be performed statically and must take the STE configuration into consideration at point B, in the same way as for a Non-secure stream. F_VMS_FETCH is reported after C_BAD_STE, but its priority relative to other events is IMPLEMENTATION DEFINED. 9.1.6 SMMU_(S_)VATOS_SEL The VATOS interface provides a mechanism to limit the scope of VATOS requests so that VATOS responses only provide information relating to the VMID of the Virtual Machine that is associated with that interface. Note: Arm expects the VATOS interface to be exposed to one virtual machine at a time. Note: Arm expects the VATOS interface to be used in scenarios where a Virtual Machine is able to make queries using a physical StreamID number and where a system-specific mechanism describes the presence of the VATOS page in the Virtual Machine address space. The scope of a VATOS interface is limited to STEs configured to tag translations with a VMID that matches the corresponding SMMU_(S_)VATOS_SEL.VMID field. If the values match, a VATOS request is permitted to return information using that STE. If the values do not match, or the STE does not contain a VMID, a request is denied with C_BAD_STE. A request made through a VATOS interface is checked using this procedure: 1. The VATOS_ADDR.TYPE of the request is checked, leading to INV_REQ if it is invalid for a VATOS interface. See section 9.1.3 *ATOS_ADDR. 2. The STE is fetched for the StreamID requested using SMMU_(S_)VATOS_SID. This process might lead to C_BAD_STREAMID, F_STE_FETCH or C_BAD_STE. 3. In some STE configurations, translations are not tagged with a VMID. This is described in the definition of STE.S2VMID. In this case, the result is C_BAD_STE. 4. If the configuration of the STE means that translations are tagged with a VMID, the effective STE.S2VMID value is compared against the corresponding SMMU_(S_)VATOS_SEL.VMID value. If the values do not match, the result is C_BAD_STE. 5. If the values match, the VATOS request is permitted to return StreamID-specific information. If the STE configuration is not appropriate for the request, the result is INV_STAGE. Note: For example, an STE with stage 2-only translation cannot be queried using VATOS. 6. Any other ATOS response is now possible, for example a fault or error with lower priority than C_BAD_STE, or a successful result. Note: For a Non-secure STE with an effective NS-EL1 StreamWorld, the STE.S2VMID field is used even when stage 1-only translation is used. For a Secure STE with an effective Secure StreamWorld and stage 1-only translation, an effective value of 0 is used for VMID tagging and STE.S2VMID is IGNORED. ARM IHI 0070 H.a Copyright © 2016-2026 Arm Limited or its affiliates. All rights reserved. Non-confidential 989