You copied the Doc URL to your clipboard.

5.2.1. Return stack predictions

The return stack stores the address and the ARM or Thumb state of the instruction after a function-call type branch instruction. This address is equal to the link register value stored in r14.

The following instructions cause a return stack push if predicted:

  • BL immediate

  • BLX(1) immediate

  • BLX(2) register

  • HBL (ThumbEE state)

  • HBLP (ThumbEE state).

The following instructions cause a return stack pop if predicted:

  • BX r14

  • MOV pc, r14

  • LDM r13, {…pc}

  • LDR pc, [r13]

  • LDM r9, {..pc} (ThumbEE state only)

  • LDR pc, [r9] (ThumbEE state only).

The LDR instruction can use any of the addressing modes, as long as r13 is the base register. Additionally, in ThumbEE state you can also use r9 as a stack pointer so the LDR and LDM instructions with pc as a destination and r9 as a base register are also treated as a return stack pop.

Because return-from-exception instructions can change processor privilege mode and security state, they are not predicted. This includes the LDM(3) instruction, and the MOVS pc, r14 instruction.