ARM64 Instruction Set – System instructions

Introduction

This page covers the instructions that control the processor rather than calculate values. Many are privileged and are undefined at EL0, the level where programs run, unless a control register allows them.

A hint is an encoding in a reserved space that does nothing on a processor that does not know it. That lets new features, such as branch target identification and pointer authentication of return addresses, be added to software that still runs on older hardware. Encodings with no name print as hint #imm.

Most of these instructions leave the condition flags alone. The exceptions are the flag instructions, msr when it writes nzcv, and the cases noted in the tables.

The instructions

General hints

Mnemonic	Syntax	What it does	Flags
`nop`	`nop`	Does nothing.	–
`hint`	`hint #imm`	A hint with no assigned name. It runs as a no-operation.	–
`yield`	`yield`	Tells the processor that this thread can give way, as in a spin loop.	–
`wfe`	`wfe`	Wait for event: may enter a low-power state until a wakeup event.	–
`wfi`	`wfi`	Wait for interrupt: may enter a low-power state until an interrupt or other wakeup event.	–
`sev`	`sev`	Sends an event to all processors in the system, waking any in `wfe`.	–
`sevl`	`sevl`	Sends an event locally, to this processor only.	–
`dgh`	`dgh`	Data gathering hint: accesses before it should not be merged with those after it into one bus transaction.	–
`stshh`	`stshh keep`; `stshh strm`	Store shared hint: says that the next write will be watched by other threads, and that it should reach them quickly.	–
`wfet`, `wfit`	`wfet Xt`	The same as `wfe` and `wfi`, with a timeout read from `Xt`.	–

Branch target and feature hints

Mnemonic	Syntax	What it does	Flags
`bti`, `bti c`, `bti j`, `bti jc`	`bti`; `bti c`; `bti j`; `bti jc`	Branch target identification. Marks a landing place for indirect branches in a guarded memory region: `c` for calls, `j` for jumps, and `jc` for both. Outside a guarded region it is a no-operation.	–
`chkfeat x16`	`chkfeat x16`	Checks the status of features and reports the result in `x16`. Without the feature it is a no-operation.	–
`pacm`	`pacm`	Sets PSTATE.PACM to 1, so that some of the following return-address instructions take a second modifier. Without FEAT_PAuth_LR it is a no-operation.	–

Pointer authentication hints

These work with fixed registers and need no operands. See the Pointer authentication page for the keys and the method. a or b in the name is the key.

Mnemonic	Syntax	What it does	Flags
`paciasp`, `pacibsp`	`paciasp`	Signs `x30`, with `sp` as the modifier. These have an implicit `bti`.	–
`autiasp`, `autibsp`	`autiasp`	Authenticates `x30` with `sp` as the modifier.	–
`paciaz`, `pacibz`	`paciaz`	Signs `x30` with a modifier of zero.	–
`autiaz`, `autibz`	`autiaz`	Authenticates `x30` with a modifier of zero.	–
`pacia1716`, `pacib1716`	`pacia1716`	Signs `x17` with `x16` as the modifier.	–
`autia1716`, `autib1716`	`autia1716`	Authenticates `x17` with `x16` as the modifier.	–
`xpaclri`	`xpaclri`	Removes the authentication code from `x30` without checking it.	–

Barriers

dmb and dsb take an option that says what to order and which processors it affects: sy for the full system, ish for the inner shareable domain, nsh for this processor only, and osh for the outer shareable domain. A ld or st suffix limits it to loads or stores, as in ishld and ishst. dmb ld and dmb st mean the full system with that limit.

Mnemonic	Syntax	What it does	Flags
`dmb`	`dmb ish`	Data memory barrier: orders accesses before it against accesses after it.	–
`dsb`	`dsb ish`; `dsb ishnxs`	Data synchronisation barrier: waits until earlier accesses have completed. The `nxs` forms, from FEAT_XS, do not wait for accesses to memory with the XS attribute.	–
`isb`	`isb`	Instruction synchronisation barrier: flushes the pipeline, so later instructions see the effect of earlier context changes.	–
`sb`	`sb`	Speculation barrier: limits speculative execution past this point.	–
`ssbb`	`ssbb`	Stops speculative loads from bypassing earlier stores to the same virtual address.	–
`pssbb`	`pssbb`	The same for the same physical address.	–
`csdb`	`csdb`	Consumption of speculative data barrier: limits speculation that uses predicted data values or flags.	–
`esb`	`esb`	Error synchronisation barrier, for the RAS extensions.	–
`psb csync`	`psb csync`	Profiling synchronisation barrier, for the Statistical Profiling Extension.	–
`tsb csync`	`tsb csync`	Trace synchronisation barrier.	–
`gcsb dsync`	`gcsb dsync`	Guarded control stack barrier. It orders accesses to the guarded control stack.	–
`clrbhb`	`clrbhb`	Clears the branch history, as a defence against attacks on branch prediction.	–
`dfb`	`dfb`	The name LLVM gives to the barrier encoding that is otherwise `dsb #12` when the Armv8-R architecture is selected.	–
`clrex`	`clrex`; `clrex #imm`	Clears the local exclusive monitor, so the next store-exclusive fails. The immediate is ignored.	–

Flags

Mnemonic	Syntax	What it does	Flags
`cfinv`	`cfinv`	Inverts the carry flag.	C
`axflag`	`axflag`	Converts the flags from an Arm floating-point compare to the form that some other software expects.	NZCV
`xaflag`	`xaflag`	Converts the flags back to the Arm floating-point compare form.	NZCV

System registers

System registers configure the processor and report its state. A register is named by five numbers, written Sop0_op1_CCRn_CCRm_op2 when no name is known: for example S3_0_C0_C0_0. Each has its own rules about which exception level can read or write it. Reading or writing one that is not permitted is undefined or traps to a higher level.

Mnemonic	Syntax	What it does	Flags
`mrs`	`mrs Xt, sysreg`	Reads a system register into `Xt`.	–
`msr`	`msr sysreg, Xt`; `msr pstatefield, #imm`	Writes a system register. The immediate form writes a PSTATE field: `DAIFSet`, `DAIFClr`, `SPSel`, `UAO`, `PAN`, `SSBS`, `DIT`, `TCO`, `ALLINT` or `PM`.	NZCV if the register written is `nzcv`, otherwise –
`mrrs`, `msrr`	`mrrs Xt, Xt+1, sysreg`; `msrr sysreg, Xt, Xt+1`	Reads or writes a 128-bit system register using two adjacent general-purpose registers. `Xt` is even.	–

System instructions and their aliases

sys, sysl and sysp are the general forms. The names below are aliases of them for particular operations, and the disassembler prints the name when it knows the operation.

Mnemonic	Syntax	What it does	Flags
`sys`	`sys #op1, Cn, Cm, #op2, Xt`	A system instruction with an optional input register.	–
`sysl`	`sysl Xt, #op1, Cn, Cm, #op2`	A system instruction that returns a value.	–
`sysp`	`sysp #op1, Cn, Cm, #op2, Xt, Xt+1`	A 128-bit system instruction with a pair of registers.	–
`at`	`at s1e1r, Xt`	Address translate: translates the address in `Xt` and writes the result to PAR_EL1.	–
`dc`	`dc civac, Xt`	Data cache operation on the address in `Xt`, or on a set and way.	–
`ic`	`ic ivau, Xt`; `ic iallu`	Instruction cache operation.	–
`tlbi`	`tlbi vae1is, Xt`; `tlbi vmalle1`	Invalidates entries in the translation lookaside buffers.	–
`tlbip`	`tlbip vae1is, Xt, Xt+1`	TLB invalidate with a 128-bit operand in a pair of registers.	–
`brb`	`brb iall`; `brb inj`	Branch record buffer operations: invalidates all the records, or injects a record.	–
`cfp`, `dvp`, `cpp`, `cosp`	`cfp rctx, Xt`	Restrict speculation by context. They limit control flow prediction, data value prediction, cache prefetch prediction and other predictions, based on what code in the context named by `Xt` did earlier.	–
`apas`	`apas Xt`	Associates a physical address space with a memory-mapped location, for the Realm Management Extension.	–
`trcit`	`trcit Xt`	Writes an instrumentation trace packet holding the value in `Xt`.	–

The names of the operations follow a pattern:

AT. s1e1r translates through stage 1 at EL1 as a read and s1e1w as a write. e0, e1, e2 and e3 are the exception levels used for the translation, and s12 means stages 1 and 2. rp and wp also take PSTATE.PAN into account.
DC. i invalidates, c cleans and ci does both. va works by virtual address and sw by set and way. The point of the clean follows: cvac to the point of coherency, cvau to the point of unification, cvap to the point of persistence, and cvadp to the point of deep persistence. zva zeroes a block of memory. The forms with g, such as cgvac and gva, also work on Allocation Tags, and those with gd work on tags and data. gzva writes tags and zeroes data. Other operations go to the point of outer cache (cvaoc, civaoc) or act on physical addresses (cipae, cipapa).
IC. iallu invalidates all instruction caches to the point of unification, ialluis does so across the inner shareable domain, and ivau invalidates by virtual address.
TLBI. vmalle1 invalidates all stage 1 entries for the current virtual machine at EL1, and vmalls12e1 stages 1 and 2. vae1 works by virtual address and aside1 by ASID. vaae1 ignores the ASID. vale1 and vaale1 affect only last-level entries. alle1, alle2 and alle3 invalidate everything at a level. ipas2e1 works by intermediate physical address. paall, rpaos and rpalos are for Realm Management and act on physical address information. vmallws2e1 is a further stage 2 operation. An r prefix (rvae1) means a range of addresses. A suffix is broadcasts to the inner shareable domain, os to the outer shareable domain, and nxs gives the form that does not wait for XS memory accesses.

Guarded control stack

A guarded control stack is a separate stack for return addresses, protected by the hardware. FEAT_GCS adds these instructions. The current pointer is in the register GCSPR_ELx.

Mnemonic	Syntax	What it does	Flags
`gcspushm`	`gcspushm Xt`	Pushes a return record onto the current stack.	–
`gcspopm`	`gcspopm`; `gcspopm Xt`	Pops a return record into `Xt`.	–
`gcsss1`, `gcsss2`	`gcsss1 Xt`; `gcsss2 Xt`	The two steps of switching to another stack. `gcsss1` checks the new stack and makes it current. `gcsss2` finishes the switch and returns the old pointer.	–
`gcsstr`, `gcssttr`	`gcsstr Xt, [Xn]`	Stores a doubleword as a guarded control stack access. `gcssttr` is the unprivileged form.	–
`gcspushx`, `gcspopx`, `gcspopcx`	`gcspushx`	Push or pop an exception return record. `gcspopcx` also compares the record with the current exception return state.	–

Streaming mode and transactional memory

smstart and smstop are the SME controls. The transactional instructions belong to the Transactional Memory Extension, FEAT_TME. Its fourth instruction, tcancel, is on the Branches and exceptions page. A failed or cancelled transaction discards its changes.

Mnemonic	Syntax	What it does	Flags
`smstart`, `smstop`	`smstart`; `smstart sm`; `smstart za`	Enter or leave Streaming SVE mode with `sm`, enable or disable the ZA storage with `za`, or do both with no operand.	–
`tstart`	`tstart Xt`	Starts a transaction. `Xt` is 0 when it begins. If the transaction fails, execution resumes here with a non-zero reason in `Xt`.	–
`tcommit`	`tcommit`	Commits the current transaction.	–
`ttest`	`ttest Xt`	Writes the current transaction depth to `Xt`, or 0 outside a transaction.	–