Armv8-A ISA
Overview
Armv8-A is an ARM architecture profile whose Instruction Set Architecture (ISA) defines the instructions executed by Armv8-A compliant processors. The Armv8-A ISA is composed of three instruction sets: A64, A32, and T32. A64 is the 64-bit instruction set executed in the AArch64 execution state, while A32 and T32 are 32-bit instruction sets executed in the AArch32 execution state, with T32 being the Thumb-encoded variant [1].
The limited size of these three instruction sets makes it feasible to enumerate the full instruction space for testing purposes, which is leveraged by hardware fuzzing and verification tools [1].
Tooling and Research Uses
Armv8-A ISA semantics have been the subject of foundational architecture research, including formal concurrency models that integrate with the full ISA semantics. An extended 2022 study developed an axiomatic-style concurrency model for relaxed virtual memory in Armv8-A, in collaboration with Arm, and validated the model against use cases drawn from the pKVM production hypervisor under development by Google [arxiv:2203.00642v1].
At the implementation level, Armv8-A processors and emulators have been analyzed with fuzzing tools such as armshaker, a processor fuzzer targeting the Armv8-A ISA. armshaker executes undefined instruction encodings and uses the presence or absence of a SIGILL (undefined instruction exception) signal to detect hidden or undocumented instructions in hardware processors or other ISA implementations such as emulators [1].
Execution State and Toolchain Mapping
The instruction set targeted by Armv8-A software depends on the execution state at runtime, which in turn is determined by the toolchain used to build the binary:
- A 64-bit (AArch64) toolchain produces binaries that execute the A64 instruction set [1].
- A 32-bit (AArch32) toolchain produces binaries that execute the A32 instruction set, or the T32 (Thumb) instruction set when compiled with Thumb code [1].
Cross-compilation is also possible: an AArch64 build host can build a 32-bit (AArch32) fuzzer binary and run it to fuzz A32 or T32 instructions [1].
Related Instruction Sets
- A64 instruction set — The 64-bit instruction set of the Armv8-A ISA, executed in AArch64 state.
- A32 instruction set — The 32-bit ARM instruction set of the Armv8-A ISA, executed in AArch32 state.
- T32 instruction set — The 32-bit Thumb instruction set of the Armv8-A ISA, executed in AArch32 state.
References
- Relaxed virtual memory in Armv8-A (extended version), ESOP 2022 extended version, arXiv:2203.00642v1.
- frestr/armshaker — Armv8-A ISA processor fuzzer, GitHub repository.
- HASP '20 paper on undocumented/hidden instructions in Armv8-A (10.1145/3458903.3458906).