ARM TLB

Timeline

Timeline

2025-10-26

init

This article introduces the working principle and maintenance mechanism of TLB under the ARMv8 architecture, discussing in detail the background knowledge of TLB, multi-level design, entry attributes, and solutions to the alias and synonym problems. Additionally, it summarizes the application of ASID technology in process switching and the Linux kernel, the contiguous block caching feature, the usage scenarios and formats of TLBI instructions, and explains the correct process for TLB invalidation after modifying page tables along with related control registers.

Reference documents:

Arm Architecture Reference Manual Armv8

https://developer.arm.com/documentation/ddi0487/fc/

• ARMv8.6 chip manual and TLB-related content

  • Chapter D5.9Translation Lookaside Buffers（TLBs）

  • Chapter D5.10 TLB maintenance requirements and the TLB maintenance instructions

TLB background knowledge

TLB

• TLB iscachea type of
• TLB entries:Records the most recently used VA to PA translation results
• The TLB base address is specified in the translation table base registers (TTBR0_EL1) and (TTBR1_EL1). When the upper bits of the VA are all 0, TTBR0
  The mapping table pointed to is selected. When the upper bits of the VA are all set to 1, TTBR1 is selected.
• EL2 and EL3 have one TTBR0, but no TTBR1. This means:
  • If EL2 uses AArch64, it can only use the range from 0x0 to 0x0000FFFF_FFFFFFFF.
  • If EL3 uses AArch64, it can only use the range from 0x0 to 0x0000FFFF_FFFFFFFF.

TTBR0_EL1 and TTBR1_EL1

• The TLB also supports three mapping methods: fully associative, direct-mapped, and set-associative.
• The Cortex-A72 uses a two-level TLB design, similar to the design concept of a two-level cache.
  • L1 instruction and data TLBs (fully associative)
    • 48-entry fully-associative L1 I-TLB
    • 32-entry fully-associative L1 D-TLB
  • L2 unified TLB. 4-way set-associative of 1024-entry L2 TLB (set-associative)

Set-associative TLB

Each TLB entry typically contains not only the physical address and virtual address, but also attributes such as memory type, cache policy, access permissions, address space ID,
(ASID) and virtual machine ID (VMID) and other attributes.

Using the TLB

TLB aliasing problem

TLB aliasing problem

Although VP1 and VP2 cache two different TLB entries in the TLB, the PFNs in the TLB entries both point to the physical page, sono alias problem occurs

TLB synonym problem

same virtual address mapping to different physical addresses

When process A switches to process B, the TLB used by the old process is useless data for the new process and may cause synonym problems. If the TLB is invalidated directly during process switching, there will be a significant performance loss. The solution is to use**ASID（Address Space Identifier）**technology

ASID（Address Space Identifier）

• global type TLB：kernel space is the space shared by all processes

• process-specific type TLB: user address space is the independent address space of each process

• The ASID mechanism is used to implement process-specific type TLB

• ARMv8’s ASID is stored in TTBR0_EL1 or TTBR1_in EL1. The A1 field of the TCR register can be used for selection

• ASID supports 8-bit or 16-bit

  • 8-bit wide ASID, supporting up to 256 IDs
  • 16-bit wide ASID, supporting 65536 IDs

ASID

TCR_El1.A1 filed selects TTBR0_EL1.ASID or TTBR1_EL1.ASID

TCR_EL1Defined in:

TCR_EL1.A1

The TLB can identify which TLB entry belongs to which process, which is the core idea for solving the TLB homonym problem. This way, during a process switch, only the TLB entries of the switched-out process need to be flushed

Operating systems often use a bitmap to manage ASIDs, and generally do not use the process PID

Use the ASID to look up process-specific TLB entries

Additionally, the ARMv8-A architecture provides thread ID registers for use by operating system software. These registershave no hardware significance, and are typically used by threading libraries
as base pointers for per-thread data. This is commonly known as Thread Local Storage (TLS). For example, the pthreads library uses this feature, including
the following registers:

• User read-write thread ID register (TPIDR_EL0).
• User read-only thread ID register (TPIDRRO_EL0).
• Thread ID register, privileged access only (TPIDR_EL1)

ASID in the Linux kernel

• In the Linux kernel, each process is assigned two ASIDs, forming a pair of odd and even numbers

  • When a process runs in user mode, the odd ASID is used to query the TLB
  • When a program traps into kernel mode, the even ASID is used to query the TLB

Assigning two ASIDs per process mainly addresses the Meltdown vulnerability

• Hardware ASID allocation is managed via a bitmap

• During a process switch, the hardware ASID held by the process needs to be written into the TTBR1_EL1 register

• When the total number of hardware ASIDs in the system exceeds the hardware maximum, an overflow occurs, requiring a full TLB flush and reallocation of hardware ASIDs

ASID in the Linux kernel

The nG attribute in page table entries

The nG attribute in page table entries

Bit 11 nG:

• 1：Indicates that the TLB page table entry for this page is process-specific

• 0：Indicates the use of a global TLB

TLB caches a block

The ARMv8-A architecture provides a feature called contiguous block entries to efficiently use TLB space.

Each page table block entry contains a contiguous bit. When set, this bit signals the TLB that it can cache a single entry covering a mapping of multiple blocks. A lookup can index anywhere within the address range covered by the contiguous block. Therefore, the TLB can cache one entry for a defined address range, making it possible to store a larger range of virtual addresses in the TLB.

To use a contiguous bit, the contiguous blocks must be adjacent, meaning they must correspond to a contiguous virtual address range. They must start from an aligned boundary, have consistent attributes, and point to a contiguous output address range at the same translation level.

TLBI instruction

If the operating system modifies mapping entries that may have been cached in the TLB, it is responsible for invalidating these stale TLB entries using the TLBI instruction.

• ARMv8 provides the TLBI instruction
• Instruction format:

TLBI <type><level>{IS} {,Xt}

• Type:
  • ALLEntire TLB
  • VMALLAll TLB entries (stage 1, for current guest OS)
  • VMALLS12All TLB entries (stage 1&2 for current guest OS)
  • ASIDTLB entries matching ASID, xt specifies virtual address and ASID
  • VATLB entry specified by virtual address, xt specifies virtual address and ASID
  • VAATLB entry specified by virtual address, xt specifies virtual address but not ASID
• Level: En = Exception level (n can be 3, 2, or 1)
• IS: Indicates inner shareable
• Xt: Parameter composed of virtual address and ASID
  • Bit[63:48]：ASID
  • Bit[47:44]: TTL, used to indicate which level of page table’s saved address to invalidate. If 0, it means all levels of page tables need to be invalidated (usually set to 0)
  • Bit[43:0]: Bits[55:12] of the virtual address

Operand of the TLBI instruction

Example: Flushing the TLB after modifying page tables

// Writes to Translation Tables
DSB ISHST            // ensure write has completed
TLBI ALLE1           // invalidate all TLB entries
DSB ISH              // ensure completion of TLB invalidation
ISB                  // synchronize context so no old translations are used

Execution scenario: You modified the page table mapping (e.g., changed the virtual-to-physical address mapping), the CPU may still use the old TLB translation cache, so:

1. MustFirst ensure the page table write is complete →DSB ISHST
2. Invalidate the old TLB →TLBI ALLE1
3. Ensure the invalidation action is truly complete →DSB ISH
4. Flush the CPU instruction execution context →ISB

Related registers

TCR_EL1

TCR_EL1 controls other memory management functions for EL1 and EL0.

TCR_EL1 register

Bit assignment

TCR_EL1

Field	Bit Range	Meaning	Used For
T0SZ	[5:0]	Controls the virtual address space size of TTBR0	User space or low address mapping
TG0	[15:14]	TTBR0 page size (Granule Size)	4KB/16KB/64KB pages
T1SZ	[21:16]	Controls the virtual address space size of TTBR1	Kernel space or high address mapping
TG1	[31:30]	TTBR1 page size (Granule Size)	4KB/16KB/64KB pages
IPA size	[34:32]	Controls the intermediate physical address size	Used for virtualization or physical address upper limit setting