You copied the Doc URL to your clipboard.

RETAA, RETAB

Return from subroutine, with pointer authentication. This instruction authenticates the address that is held in LR, using SP as the modifier and the specified key, branches to the authenticated address, with a hint that this instruction is a subroutine return.

Key A is used for RETAA, and key B is used for RETAB.

If the authentication passes, the PE continues execution at the target of the branch. If the authentication fails, a Translation fault is generated.

The authenticated address is not written back to LR.

Integer
(Armv8.3)

313029282726252423222120191817161514131211109876543210
110101100101111100001M1111111111
ZopARnRm

RETAA (M == 0)

RETAA

RETAB (M == 1)

RETAB

integer n = UInt(Rn);
BranchType branch_type;
integer m = UInt(Rm);
boolean pac = (A == '1');
boolean use_key_a = (M == '0');
boolean source_is_sp = ((Z == '1') && (m == 31));

if !pac && m != 0 then 
    UNDEFINED;
elsif pac && !HavePACExt() then 
    UNDEFINED;

case op of
    when '00' branch_type = BranchType_INDIR;
    when '01' branch_type = BranchType_INDCALL;
    when '10' branch_type = BranchType_RET;
    otherwise UNDEFINED;

if pac then
    if Z == '0' && m != 31 then
        UNDEFINED;

    if branch_type == BranchType_RET then
        if n != 31 then UNDEFINED;
        n = 30;
        source_is_sp = TRUE;

Operation

bits(64) target = X[n];
boolean auth_then_branch = TRUE;

if pac then
    bits(64) modifier = if source_is_sp then SP[] else X[m];

    if use_key_a then
        target = AuthIA(target, modifier, auth_then_branch);
    else
        target = AuthIB(target, modifier, auth_then_branch);

if branch_type == BranchType_INDCALL then X[30] = PC[] + 4;

// Value in BTypeNext will be used to set PSTATE.BTYPE
case branch_type of
    when BranchType_INDIR           // BR, BRAA, BRAB, BRAAZ, BRABZ
        if InGuardedPage then
            if n == 16 || n == 17 then
                BTypeNext = '01';
            else
                BTypeNext = '11';
        else
            BTypeNext = '01';
    when BranchType_INDCALL         // BLR, BLRAA, BLRAB, BLRAAZ, BLRABZ
        BTypeNext = '10';
    when BranchType_RET             // RET, RETAA, RETAB 
        BTypeNext = '00';

BranchTo(target, branch_type);