ARM TLB

Timeline

Timeline

2025-10-26

init

This article introduces the basic concepts, working principles, and implementation of the TLB (Translation Lookaside Buffer) in the ARM architecture, specifically in ARMv8-A processors. It first explains the role of the TLB as a cache for page table translation results, as well as the page table base address register TTBR0_EL1 and TTBR1_It covers the addressing rules for EL1 and TTBR1_EL1, and introduces TLB mapping methods (fully-associative and set-associative) as well as the two-level TLB design of the Cortex-A72. Subsequently, the article discusses the TLB aliasing and homonym problems, focusing on how the ASID (Address Space Identifier) mechanism solves the homonym problem during process switching by distinguishing TLB entries of different processes, and explains the storage, width, and management of ASIDs in the Linux kernel (including bitmap allocation and overflow handling). In addition, the article describes the nG attribute in page table entries used to identify global or process-specific TLB entries, and how the contiguous block entry feature improves TLB caching efficiency. Finally, the article summarizes the purpose and format of TLBI instructions, which are used to invalidate stale TLB entries after the operating system modifies mappings. The overall content covers key TLB technologies.

Reference documents:

Arm Architecture Reference Manual Armv8

https://developer.arm.com/documentation/ddi0487/fc/

• ARMv8.6 chip manual and TLB-related content

  • Chapter D5.9 Translation Lookaside Buffers（TLBs）

  • Chapter D5.10: TLB maintenance requirements and the TLB maintenance instructions

TLB background knowledge

TLB

• TLB iscachea type of
• TLB entries:Records the most recently used VA-to-PA translation results.
• The page table base address is specified in the Translation Table Base Register (TTBR0_EL1 and TTBR1_EL1). When the high bits of the VA are all 0, the page table pointed to by TTBR0 is used for traversal; when the high bits of the VA are all 1, TTBR1 is used. The TLB itself has no base address; it is a hardware unit used to cache page table translation results.
• EL2 and EL3 have only TTBR0, not TTBR1. By default (TCR_ELx.T0SZ = 16) the addressable range is 0x0 to 0x0000FFFF_FFFFFFFF, but this range can be adjusted via the T0SZ field.

TTBR0_EL1 and TTBR1_EL1

• The TLB supports mapping methods such as fully-associative and set-associative.
• The Cortex-A72 uses a two-level TLB design, similar to the design approach of a two-level cache.
  • L1 instruction and data TLBs (fully-associative)
    • 48-entry fully-associative L1 I-TLB
    • 32-entry fully-associative L1 D-TLB
  • L2 unified TLB: 4-way set-associative, 1024-entry L2 TLB (set-associative)

Set-associative TLB

Each TLB entry typically contains not only the physical address and virtual address, but also attributes such as memory type, cache policy, access permissions, and address space ID
(ASID) and virtual machine ID (VMID) and other attributes.

Using TLB

TLB synonym (alias) problem

TLB synonym problem

Although VP1 and VP2 cache two different TLB entries in the TLB, the PFNs in the TLB entries both point to the same physical page (Phys Page), sono aliasing problem arises

TLB homonym problem

Same virtual address maps to different physical addresses

When process A switches to process B, the TLB used by the old process is useless data for the new process and may cause homonym problems. If the TLB is invalidated directly during process switching, there will be a significant performance loss. The solution is to use ASID（Address Space Identifier） technology

ASID（Address Space Identifier）

• Global TLB：Kernel space is shared by all processes

• Process-specific TLB: the user address space is an independent address space for each process

• The ASID mechanism is used to implement process-specific TLBs

• In ARMv8, the ASID is stored in TTBR0_EL1 or TTBR1_In EL1, the A1 field of the TCR register can select which TTBR’s ASID to use

• ASID supports 8-bit or 16-bit

  • An 8-bit ASID supports up to 256 IDs
  • A 16-bit ASID supports 65536 IDs

ASID

TCR_El1.A1 filed selects TTBR0_EL1.ASID or TTBR1_EL1.ASID

TCR_EL1 defined in:

TCR_EL1.A1

The TLB can identify which TLB entry belongs to which process(via the ASID field), which is the core idea for solving the TLB homonym problem. In this way, when a process switch occurs, only the TLB entries of the switched-out process need to be flushed, while the TLB entries of other processes can be retained

Operating systems often use a bitmap to manage ASIDs, and generally do not use the process PID

Use the ASID to look up process-specific TLB entries

In addition, the ARMv8-A architecture provides thread ID registers for use by operating system software. These registershave no hardware significance, usually used by thread libraries as
the base pointer for per-thread data. This is commonly called Thread Local Storage (TLS). For example, the pthreads library uses this feature, including
the following registers:

• User read/write Thread ID Register (TPIDR_EL0).
• User read-only Thread ID Register (TPIDRRO_EL0).
• Thread ID Register, privileged access only (TPIDR_EL1)

ASID in the Linux kernel

• Early versions of the Linux kernel (ARM64 architecture) allocated two ASIDs per process, with an odd and an even ASID forming a pair.

  • When the process runs in user mode, the odd ASID is used to look up the TLB.
  • When the program traps into kernel mode, the even ASID is used to look up the TLB.

  Allocating two ASIDs per process was mainly to address the Meltdown vulnerability, preventing side-channel attacks by isolating user-mode and kernel-mode TLB entries.

  Note: Newer Linux kernels have adopted a timestamp-based ASID reclamation strategy (ASID version number mechanism), and no longer use the odd-even pairing approach.

• Hardware ASIDs are allocated and managed through a bitmap.

• During a process switch, the hardware ASID held by the process needs to be written into the TTBR0_EL1 register.(User space uses the ASID field of TTBR0_EL1)

• When all hardware ASIDs in the system together exceed the hardware maximum, an overflow occurs, requiring a full TLB flush and then reallocation of hardware ASIDs.

The Linux kernel's ASID

The nG attribute in page table entries

The nG attribute in page table entries

Bit 11 nG:

• 1：Indicates that the TLB page table entry corresponding to this page is process-specific.

• 0：Indicates that a global TLB is used.

The TLB caches a block.

The ARMv8-A architecture provides a feature called contiguous block entries to use TLB space efficiently.

Each translation table block entry contains a contiguous bit. When set, this bit signals the TLB that it can cache a single entry covering mappings for multiple blocks. A lookup can index anywhere within the address range covered by the contiguous blocks. Therefore, the TLB can cache one entry for a defined address range, making it possible to store a larger range of virtual addresses in the TLB.

To use the contiguous bit, the contiguous blocks must be adjacent, that is, they must correspond to a contiguous virtual address range. They must start from an aligned boundary, have consistent attributes, and point to a contiguous output address range at the same level of translation.

TLBI instructions

If the operating system modifies a mapping entry that may have been cached in the TLB, the operating system is responsible for invalidating these stale TLB entries using TLBI instructions.

• ARMv8 provides TLBI instructions.
• Instruction format:

TLBI <type><level>{IS} {,Xt}

• Type:
  • ALL Entire TLB
  • VMALL All TLB entries (stage 1, for current guest OS)
  • VMALLS12 All TLB entries (stage 1 & 2 for current guest OS)
  • ASID TLBI instruction matching the ASID, with Xt specifying the ASID.
  • VA TLBI instruction specified by virtual address, with Xt specifying the virtual address and ASID.
  • VAA TLBI instruction specified by virtual address, with Xt specifying the virtual address but not the ASID.
• Level: En = Exception level (n can be 3, 2, or 1)
• IS: Indicates inner shareable.
• Xt: A parameter consisting of the virtual address and ASID.
  • Bit[63:48]：ASID
  • Bit[47:44]: TTL, used to indicate which level of page table cache address to invalidate. If 0, it means all levels of page table caches need to be invalidated (usually set to 0).
  • Bit[43:0]: Bits [55:12] of the virtual address (i.e., VA[55:12]).

Operands of TLBI instructions

Example: Flushing the TLB after modifying page tables

// Writes to Translation Tables
DSB ISHST            // ensure write has completed
TLBI ALLE1           // invalidate all TLB entries
DSB ISH              // ensure completion of TLB invalidation
ISB                  // synchronize context so no old translations are used

Execution scenario: You modified a page table mapping (e.g., changed the virtual-to-physical address mapping). The CPU may still use the old TLB translation cache, so:

1. MustFirst ensure the page table write has completed →DSB ISHST
2. Invalidate the old TLB →TLBI ALLE1
3. Ensure the invalidation operation has actually completed →DSB ISH
4. Flush the CPU instruction execution context →ISB

Related registers

TCR_EL1

TCR_EL1 controls other memory management functions for EL1 and EL0.

TCR_EL1 registers

Bit assignment

TCR_EL1

field	Bit range	meaning	used for
T0SZ	[5:0]	Controls the virtual address space size for TTBR0	User space or low address mapping
TG0	[15:14]	TTBR0 page size (Granule Size)	4KB/16KB/64KB pages
T1SZ	[21:16]	Controls the virtual address space size for TTBR1	Kernel space or high address mapping
TG1	[31:30]	TTBR1 page size (Granule Size)	4KB/16KB/64KB pages
IPA size	[34:32]	Controls the intermediate physical address width (Intermediate Physical Address Size)	Used for virtualization or setting the physical address upper limit