ARM64 Instruction Set – Branches and exceptions

Introduction

Every A64 instruction is four bytes long and aligned on four bytes, so branch offsets count in units of 4. There are no delay slots. A branch that needs a return address writes it to x30, the link register, and nothing saves it automatically. Register x30 is also the default target of ret.

Except for eret and drps, which restore PSTATE from the SPSR, none of these instructions changes the flags. The branches with a condition read them.

Condition codes

A condition is four bits. The same codes are used by b.cond, bc.cond, the conditional selects and the conditional compares. Each pair differs in its lowest bit and tests the opposite case, apart from al and nv. The signed and unsigned comparisons assume a preceding cmp or subs.

Code	Bits	Meaning	Flags tested
`eq`	`0000`	Equal, or zero	Z = 1
`ne`	`0001`	Not equal, or not zero	Z = 0
`cs`, also written `hs`	`0010`	Carry set; unsigned greater than or equal	C = 1
`cc`, also written `lo`	`0011`	Carry clear; unsigned less than	C = 0
`mi`	`0100`	Minus, negative	N = 1
`pl`	`0101`	Plus, positive or zero	N = 0
`vs`	`0110`	Overflow set	V = 1
`vc`	`0111`	Overflow clear	V = 0
`hi`	`1000`	Unsigned greater than	C = 1 and Z = 0
`ls`	`1001`	Unsigned less than or equal	C = 0 or Z = 1
`ge`	`1010`	Signed greater than or equal	N = V
`lt`	`1011`	Signed less than	N ≠ V
`gt`	`1100`	Signed greater than	Z = 0 and N = V
`le`	`1101`	Signed less than or equal	Z = 1 or N ≠ V
`al`	`1110`	Always	None
`nv`	`1111`	Also always. The name does not mean “never”: in A64 this code behaves as `al`.	None

The disassembler prints hs and lo, as LLVM does.

The instructions

Unconditional branches

Mnemonic	Syntax	What it does	Flags
`b`	`b label`	Branches to a label within ±128 MiB.	–
`bl`	`bl label`	Branches to a label within ±128 MiB and writes the address of the next instruction to `x30`.	–
`br`	`br Xn`	Branches to the address in a register. It hints that this is not a call or a return.	–
`blr`	`blr Xn`	Calls the address in a register and writes the address of the next instruction to `x30`.	–
`ret`	`ret`; `ret Xn`	Branches to the address in a register, `x30` if none is given. It hints that this is a return from a subroutine.	–

The versions with pointer authentication are on the Pointer authentication page.

Conditional branches

Mnemonic	Syntax	What it does	Flags
`b.cond`	`b.eq label`, and so on for every condition code	Branches to a label within ±1 MiB if the condition holds.	–
`bc.cond`	`bc.eq label`, and so on for every condition code	The same branch, with a hint that its direction is very unlikely to change.	–
`cbz`	`cbz Rt, label`	Branches within ±1 MiB if the register is 0.	–
`cbnz`	`cbnz Rt, label`	Branches within ±1 MiB if the register is not 0.	–
`tbz`	`tbz Rt, #bit, label`	Branches within ±32 KiB if the numbered bit is 0.	–
`tbnz`	`tbnz Rt, #bit, label`	Branches within ±32 KiB if the numbered bit is 1.	–

In tbz and tbnz, the disassembler shows a W register for a bit number below 32 and an X register above.

Compare and branch (CMPBR)

These come with FEAT_CMPBR. They compare and branch in one instruction, within ±1 KiB, and they do not change the flags. hi, hs and lo are unsigned. gt, ge and lt are signed. cbb compares the low bytes of two registers and cbh the low halfwords. The immediate forms take a value from 0 to 63.

Mnemonic	Syntax	What it does	Flags
`cbeq`, `cbne`	`cbeq Rt, Rm, label`; `cbeq Rt, #imm, label`	Branches if equal, or if not equal.	–
`cbgt`, `cblt`	`cbgt Rt, Rm, label`; `cbgt Rt, #imm, label`; `cblt Rt, #imm, label`	Branches if signed greater than or signed less than. `cblt` takes only an immediate.	–
`cbge`	`cbge Rt, Rm, label`	Branches if signed greater than or equal.	–
`cbhi`, `cblo`	`cbhi Rt, Rm, label`; `cbhi Rt, #imm, label`; `cblo Rt, #imm, label`	Branches if unsigned greater than or unsigned less than. `cblo` takes only an immediate.	–
`cbhs`	`cbhs Rt, Rm, label`	Branches if unsigned greater than or equal.	–
`cbbeq`, `cbbne`, `cbbgt`, `cbbge`, `cbbhi`, `cbbhs`	`cbbeq Wt, Wm, label`	Compare the low bytes, with the conditions above.	–
`cbheq`, `cbhne`, `cbhgt`, `cbhge`, `cbhhi`, `cbhhs`	`cbheq Wt, Wm, label`	Compare the low halfwords, with the conditions above.	–

Exceptions and returns

Code runs at an exception level from EL0, the least privileged, to EL3. These instructions ask to move up a level or return to a lower one. The 16-bit immediate on svc, hvc, smc, brk and hlt does not change what the instruction does. On svc, hvc, smc and brk it is reported to the handler in the syndrome register.

Mnemonic	Syntax	What it does	Flags
`svc`	`svc #imm`	Supervisor call: raises an exception to EL1 (or to EL2 under some settings of the hypervisor registers). This is how a program calls the operating system.	–
`hvc`	`hvc #imm`	Hypervisor call: raises an exception to EL2.	–
`smc`	`smc #imm`	Secure monitor call: raises an exception to EL3. It is undefined at EL0.	–
`brk`	`brk #imm`	Breakpoint: raises a Breakpoint Instruction exception, usually for a debugger.	–
`hlt`	`hlt #imm`	Halting software breakpoint: enters Debug state when halting is enabled, otherwise it is undefined.	–
`udf`	`udf #imm`	Always undefined. Its encoding has the top 16 bits zero, so a word of zeros disassembles as `udf #0x0`.	–
`eret`	`eret`	Returns from an exception: restores PSTATE from SPSR_ELx and branches to the address in ELR_ELx. It is undefined at EL0.	NZCV, restored from the SPSR
`drps`	`drps`	Restores PSTATE from the SPSR in Debug state. It is undefined at EL0 and outside Debug state.	NZCV, restored from the SPSR
`dcps1`, `dcps2`, `dcps3`	`dcps1`; `dcps1 #imm`	In Debug state, changes the exception level to EL1, EL2 or EL3.	–
`tcancel`	`tcancel #imm`	Cancels the current memory transaction and discards its changes. The immediate is passed to the code that started it.	Unclear: the state a cancelled transaction discards may include the flags