ARMv8

Exception levels

Determines the level of privilege. In general, a piece of software, such as an application, the kernel of an operating system, or a hypervisor, occupies a single Exception level. An exception to this rule is in-kernel hypervisors such as KVM, which operate across both EL2 and EL1. => EL0 ; Normal user application => EL1 ; Operating system kernel typically described as privileged => EL2 ; Hypervisor => EL3 ; Low-level firmware, including the secure monitor

Two Execution States

=> AArch64 => AArch 32

Exception return state

=> Exception Link Register (ELR) => Saved Processor State Register (SPSR)

Normal world privileged components

=> Gust OS kernels ; Such kernels include Linux and Windows running in Non-secure EL1 => Hypervisor ; This runs at EL2, which is always Non-secure. This provides virtualization services to rich OS kernels

Secure world privileged components

=> Secure firmware ; On an application processor, this firmware must be the first thing that runs at boot time. It provides several services, including platform initialization, the installation of the trusted OS, and routing of Secure monitor calls. => Trusted OS ; Trusted OS provides Secure services to the Normal world and provides a runtime environment for executing Secure or trusted applications.

AArch64 special registers

=> WZR ; 32 bits ; Zero register => XZR ; 64 bits ; Zero register => WSP ; 32 bits; Current stack pointer => SP ; 64 bits ; Current stack pointer => PC ; 64 bits ; Program counter

AArch64 64-bit general-purpose register

=> X0 - X30 Each is 64 bits. They also have a 32 bit form, W0 - W30 Reads from W registers disregard the higher 32 bits of the corresponding X register and leave them unchanged. Writes to W registers set the higher 32 bits of the X register to zero. That is, writing 0xFFFFFFFF into W0 sets X0 to 0x00000000FFFFFFFF

Processor state

AArch64 does not have a direct equivalent of the ARMv7 Current Program Status Register (CPSR). In AArch64, the components of the traditional CPSR are supplied as fields that can be made accessible independently. These are referred to collectively as Processor State (PSTATE). In AArch64, you return from an exception by executing the ERET instruction, and this causes the SPSR_ELn to be copied into PSTATE. This restores the ALU flags, execution state, Exception level, and the processor branches. From here, you continue execution from the address in ELR_ELn. The PSTATE.{N, Z, C, V} fields can be accessed at EL0. All other PSTATE fields can be executed at EL1 or higher and are UNDEFINED at EL0.

System registers

In AArch64, system configuration is controlled through system registers, and accessed using MSR and MRS instructions. This contrasts with ARMv7-A, where such registers were typically accessed through coprocessor 15 (CP15) operations. The name of a register tells you the lowest Exception level that it can be accessed from. For example: => TTBR0_EL1 is accessible from EL1, EL2, and EL3. => TTBR0_EL2 is accessible from EL2 and EL3. Registers that have the suffix _ELn have a separate, banked copy in some or all of the levels, though usually not EL0. Few system registers are accessible from EL0, although the Cache Type Register (CTR_EL0) is an example of one that can be accessible. Code to access system registers takes the following form: MRS x0, TTBR0_EL1 // Move TTBR0_EL1 into x0 MSR TTBR0_EL1, x0 // Move x0 into TTBR0_EL1

NEON and floating-point registers

In addition to the general-purpose registers, ARMv8 also has 32 128-bit floating-point registers labeled V0-V31. The 32 registers are used to hold floating-point operands for scalar floating-point instructions and both scalar and vector operands for NEON operations

Stack pointer

In the ARMv8 architecture, the choice of stack pointer to use is separated to some extent from the Exception level. By default, taking an exception selects the stack pointer for the target Exception level, SP_ELn. For example, taking an exception to EL1 selects SP_EL1. Each Exception level has its own stack pointer, SP_EL0, SP_EL1, SP_EL2, and SP_EL3. The SP cannot be referenced by most instructions. However, some forms of arithmetic instructions, for example, the ADD instruction, can read and write to the current stack pointer to adjust the stack pointer in a function. For example: ADD SP, SP, #0x10 // Adjust SP to be 0x10 bytes before its current value

Program counter

One feature of the original ARMv7 instruction set was the use of R15, the Program Counter (PC) as a general-purpose register. The PC enabled some clever programming tricks, but it introduced complications for compilers and the design of complex pipelines. Removing direct access to the PC in ARMv8 makes return prediction easier and simplifies the ABI specification. The PC is never accessible as a named register. Its use is implicit in certain instructions such as PC-relative load and address generation. The PC cannot be specified as the destination of a data processing instruction or load instruction.

Exception link register (ELR)

The Exception Link Register holds the exception return address.

The system control register (SCTLR)

The System Control Register (SCTLR) is a register that controls standard memory, system facilities and provides status information for functions that are implemented in the core. To access the SCTLR_ELn, use: => MRS <Xt>, SCTLR_ELn // Read SCTLR_ELn into Xt => MSR SCTLR_ELn, <Xt> // Write Xt to SCTLR_ELn For example: => MRS X0, SCTLR_EL1 // Read System Control Register configuration data => ORR X0, X0, #(1 << 2) // Set [C] bit and enable data caching => ORR X0, X0, #(1 << 12) // Set [I] bit and enable instruction caching => MSR SCTLR_EL1, X0 // Write System Control Register configuration data

Zero register

The zero register reads as zero when used as a source register and discards the result when used as a destination register. You can use the zero register in most, but not all, instructions. When accessing the zero register, all writes are ignored and all reads return 0. Note that the 64-bit form of the SP register does not use an X prefix

Endianness

There are two basic ways of viewing bytes in memory, either as Little-Endian (LE) or Big-Endian (BE). On big-endian machines, the most significant byte of an object in memory is stored at the lowest address, that is the address closest to zero. On little-endian machines, the least significant byte is stored at the lowest address. The term byte-ordering can also be used rather than endianness.

Security states

Two states => Secure => Non-secure The Non-secure state is also referred to as the "Normal World"

Saved process status register

When taking an exception, the processor state is stored in the relevant Saved Program Status Register (SPSR), in a similar way to the CPSR in ARMv7. The SPSR holds the value of PSTATE before taking an exception and is used to restore the value of PSTATE when executing an exception return