Return from subroutine, with pointer authentication
This instruction authenticates the address that is held in LR, using SP as the modifier and the specified key, and branches to the authenticated address.
Key A is used for RETAA. Key B is used for RETAB.
If the authentication passes, the PE continues execution at the target of the branch. For information on behavior if the authentication fails, see Faulting on pointer authentication.
The authenticated address is not written back to LR.
This instruction provides a hint that this is a subroutine return.
If FEAT_PAuth_LR is implemented and PSTATE.PACM is 1, then RETAA and RETAB include a second modifier that is in X16.
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
| 1 | 1 | 0 | 1 | 0 | 1 | 1 | 0 | 0 | 1 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 | M | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 |
| Z | op | op2 | A | Rn | Rm | ||||||||||||||||||||||||||
if !IsFeatureImplemented(FEAT_PAuth) then EndOfDecode(Decode_UNDEF); end; let use_key_a : boolean = (M == '0'); let auth_then_branch : boolean = TRUE;
var inst_type : GCSInstruction; var target : bits(64) = X{}(30); let modifier : bits(64) = SP{}(); var modifier2 : bits(64); var use_modifier2 : boolean = FALSE; if IsFeatureImplemented(FEAT_PAuth_LR) && PSTATE.PACM == '1' then modifier2 = X{64}(16); use_modifier2 = TRUE; end; if use_key_a then if use_modifier2 && IsFeatureImplemented(FEAT_PAuth_LR) then target = AuthIA2(target, modifier, modifier2, auth_then_branch); else target = AuthIA(target, modifier, auth_then_branch); end; else if use_modifier2 && IsFeatureImplemented(FEAT_PAuth_LR) then target = AuthIB2(target, modifier, modifier2, auth_then_branch); else target = AuthIB(target, modifier, auth_then_branch); end; end; if IsFeatureImplemented(FEAT_GCS) && GCSPCREnabled(PSTATE.EL) then inst_type = if use_key_a then GCSInstType_PRETAA else GCSInstType_PRETAB; target = LoadCheckGCSRecord(target, inst_type); SetCurrentGCSPointer(GetCurrentGCSPointer() + 8); end; // Value in BTypeNext will be used to set PSTATE.BTYPE BTypeNext = '00'; let branch_conditional : boolean = FALSE; BranchTo{64}(target, BranchType_RET, branch_conditional);
2026-03_rel 2026-03-26 20:48:11
Copyright © 2010-2026 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.