Armv8-A / Armv9-A Architecture

• The Arm ISA is defined in one massive document — the Arm Architecture Reference Manual (ARM ARM, DDI 0487, ~9000 pages).
• It splits by profile:
  • A-profile — application; full MMU, four ELs, virtualization.
  • R-profile — real-time; MPU, deterministic.
  • M-profile — microcontroller; no AArch64, NVIC.
• This deck covers the A-profile: Armv8-A (2011 spec, 2014 silicon) and its "v9" rebrand (2021).

• EL0 — user mode. Can execute only unprivileged instructions. Traps to EL1 on syscall (SVC).
• EL1 — OS. Full MMU control (TTBR0/1_EL1, SCTLR_EL1). Traps to EL2 via HVC.
• EL2 — hypervisor. Stage-2 translation. VTTBR_EL2, HCR_EL2. VHE (Armv8.1-A) lets Linux run directly in EL2.
• EL3 — secure monitor + world switch. Only level that can change SCR_EL3.NS (Non-secure bit). Runs TF-A or equivalent.
• Higher EL = more privilege. Exception return via ERET uses ELR_ELx / SPSR_ELx.

• Exceptions take the PE from a lower EL to a higher EL (or same EL). They cannot lower privilege.
• On entry, hardware writes:
  • ELR_ELx ← preferred return address
  • SPSR_ELx ← saved PSTATE (NZCV + D,A,I,F + EL + nRW)
  • ESR_ELx ← exception syndrome (class + IL + ISS)
  • FAR_ELx ← faulting virtual address (if relevant)
• PC jumps to VBAR_ELx + offset. Offsets are fixed (0x000, 0x080, 0x100, 0x180 × same-EL / lower-EL × sync/IRQ/FIQ/SError).
• Return: ERET restores PC from ELR and PSTATE from SPSR.

• Fixed 32-bit encoding. No Thumb, no mixed length. Every instruction is 4 bytes.
• 31 × 64-bit general registers X0–X30; access as 32-bit via W0–W30.
• Register 31 is context-dependent: either the Zero Register (XZR/WZR) or the Stack Pointer (SP).
• PC is not a general register (lesson learned from Armv7). Only reachable via branch + ADR/ADRP PC-relative generation.
• Instructions are grouped by top bits — branch, load/store, data-processing-immediate, data-processing-register, SIMD/FP, system.

// Canonical A64 function prologue
stp  x29, x30, [sp, #-16]!   // push FP,LR
mov  x29, sp                 // set FP

// LDAR / STLR — release consistency
ldar  w0, [x1]               // acquire-load
stlr  w2, [x3]               // release-store

// LSE atomics (Armv8.1-A) — ACE scalability
cas   w4, w5, [x6]           // CAS, acquire+release
ldadd w7, w8, [x9]           // atomic add, return old

// PC-relative addressing
adrp  x0, sym                // 4 KB-page PC-rel
add   x0, x0, :lo12:sym      // page offset

// ERET — return from exception
eret                         // ELR_ELx -> PC, SPSR -> PSTATE

• AArch64 replaces CPSR with PSTATE — a logical collection of fields, not a single register.
• Core fields:
  • NZCV — condition flags (Negative, Zero, Carry, Overflow). Read via MRS x0, NZCV.
  • DAIF — interrupt masks (Debug, SError, IRQ, FIQ).
  • EL[1:0] — current Exception Level.
  • SP — 0 ⇒ SP_EL0, 1 ⇒ SP_ELx.
  • nRW — 0 ⇒ AArch64, 1 ⇒ AArch32.
• Armv8.5-A adds SSBS (Speculative Store Bypass Safe) and PAN (Privileged Access Never) to PSTATE.

Synchronous

• Directly caused by an executing instruction. Precise.
• SVC (EL0→EL1 syscall), HVC (EL1→EL2), SMC (EL1/2→EL3).
• Data/instruction aborts (MMU faults, permission violations).
• Illegal execution state, illegal PSTATE, PAC auth failure.
• MTE synchronous tag check fault (if configured).

Asynchronous

• External event, not caused by any particular instruction.
• IRQ — maskable external interrupt (via GIC).
• FIQ — higher-priority interrupt (historically "fast"; in AArch64 signalled separately from IRQ).
• SError — SError (System Error) — catastrophic bus error / RAS event. Routed per HCR_EL2.AMO / SCR_EL3.EA.
• Masked by PSTATE.DAIF bits.

• X0–X7 — argument + return registers. Up to 8 integer args passed in registers.
• X8 — indirect result register (struct return pointer), or syscall number in Linux.
• X9–X15 — caller-saved temporaries.
• X16 / X17 — IP0 / IP1 — intra-procedure-call scratch (for PLT thunks).
• X18 — platform register (TLS on macOS/iOS, reserved on Linux).
• X19–X28 — callee-saved.
• X29 (FP) — frame pointer.
• X30 (LR) — link register.
• SP — 16-byte aligned at public function entry/exit.

// add_two(int a, int b) — trivial example

add_two:
    add   w0, w0, w1         // w0 = a + b
    ret                      // branch to LR

// function that calls another
caller:
    stp   x29, x30, [sp,#-32]! // push FP, LR
    mov   x29, sp             // set up FP
    mov   w0, #42             // arg0
    mov   w1, #7              // arg1
    bl    add_two             // call
    // result in w0
    ldp   x29, x30, [sp],#32  // pop FP, LR
    ret

Note: stp/ldp pair-ops (load/store pair) are idiomatic in A64 — 2× density vs AArch32's push/pop.

• WFI — Wait For Interrupt. Core enters a low-power state until any pending asynchronous exception or debug event.
• WFE — Wait For Event. Enters low-power state until an event fires: SEV / SEVL, GIC wake-up request, STXR failure (lock contention), timer event.
• WFE is the cornerstone of spinlocks on AArch64 — spin loops do LDAXR / STXR / CBNZ → WFE so the hardware can park the core until the lock changes.
• Armv8.7-A added WFIT / WFET — Wait-For-Interrupt/Event with timeout. Avoids the OS having to arm an extra timer to bound sleep.

// Spin-lock using WFE (idiomatic AArch64)
acquire:
  prfm  pstl1keep, [x0]
1:
  ldaxr w1, [x0]      // acquire-load lock word
  cbnz  w1, wait      // if held, WFE
  stxr  w1, w2, [x0]  // try to take (w2=1)
  cbnz  w1, 1b        // retry if stxr failed
  ret
wait:
  wfe                 // park core until SEV
  b     1b

release:
  stlr  wzr, [x0]     // release-store clears it
  sev                 // wake any waiters
  ret

Mandated (was optional in v8)

• SVE2 — vectors in every v9-A PE. v8 shipped SVE only in Fujitsu A64FX.
• MTE — Memory Tagging. Must be implementable (allowed to be disabled, but architecture must support it).
• TRBE — Trace Buffer Extension.

New in v9-A

• RME — Realm Management Extension. Adds a fourth world (Realm) plus a Root world for EL3.
• CCA — Confidential Compute Architecture. Enables cloud tenant isolation from hypervisor.
• SME (v9.2) — Scalable Matrix Extension, streaming-mode tiles.

• "Why four ELs?" → EL0 user, EL1 OS, EL2 hypervisor, EL3 secure monitor. Matches the x86 ring model conceptually but with a clean entry/exit mechanism (ERET) and a secure-world bit that can only be flipped at EL3.
• "How is an AArch64 syscall different from an AArch32 SVC?" → AArch64 SVC #imm traps synchronously to EL1 at VBAR_EL1 + 0x400 (lower EL AArch64 sync offset). Syscall number is in X8 on Linux, args in X0-X5.
• "What does VHE do?" → Virtualization Host Extension (Armv8.1) lets Linux run in EL2 directly by re-mapping EL2 register names to alias EL1 — enables KVM without a split host/hypervisor.

• "Why is A64 fixed 32-bit?" → simpler fetch + decode, enables wider pipelines. Density loss is recovered by denser instructions (LDP/STP pair) and better IPC.
• "What's NZCV + DAIF?" → PSTATE condition flags + interrupt mask. DAIF = Debug, SError, IRQ, FIQ. Setting DAIFSet, #0xF disables all four. Clearing with DAIFClr.
• "Where does secure-world code live?" → EL3 (secure monitor / TF-A) and Secure EL1/0 (trusted OS like OP-TEE and trusted apps). EL3 is the only level that can toggle the NS bit.
• "v9 is v8.5 + what?" → + mandated SVE2, mandated MTE, + RME/CCA, + TRBE.

In this series

• Deck 03 — Memory System — VMSAv8, caches, ordering, LSE atomics
• Deck 04 — NEON / SVE / SVE2 / SME
• Deck 05 — PAC, BTI, MTE, TrustZone-A, RME / CCA
• Deck 06 — OoO, DynamIQ, PMU

Sibling decks

• Cortex-M Series — M-profile architecture
• AMBA Series — interconnect behind every Cortex-A SoC
• Neoverse Series — server A-profile cores

Primary sources

• DDI 0487 — Arm Architecture Reference Manual for A-profile — the canonical 9000-page spec. Search by exception class, register, or instruction.
• AAPCS64 — Procedure Call Standard for AArch64 — defines calling convention.
• ARM DEN 0024A — Programmer's Guide for Armv8-A — friendlier intro volume.
• ARM IHI 0069 — SBSA (Server Base System Architecture) — where EL assumptions tighten for servers.
• Learn the architecture — developer.arm.com/documentation — free tutorials keyed to each feature.