Link register (R14/LR) in ARM Architecture - Deep Dive

Overview - Link register (R14/LR)

What is it?

The Link Register (LR), also known as R14 in ARM architecture, is a special-purpose register that stores the return address when a function or subroutine is called. It holds the address to which the program should return after completing the called function. This register helps manage the flow of execution in programs by keeping track of where to continue after a function finishes.

Why it matters

Without the Link Register, the processor would not know where to return after a function call, making it impossible to execute programs with reusable code blocks or subroutines efficiently. This would lead to complex and error-prone code, as programmers would have to manually manage return addresses. The LR simplifies function calls and returns, enabling structured and maintainable programming.

Where it fits

Before understanding the Link Register, learners should know basic ARM registers and how function calls work in assembly language. After this, learners can explore stack usage for saving registers, exception handling, and advanced function call optimizations like tail calls and interrupt handling.

Mental Model

Core Idea

The Link Register temporarily holds the address to return to after a function call, acting as a bookmark for the program's next step.

Think of it like...

Imagine reading a book and using a bookmark to save your place before flipping to a new chapter; the Link Register is like that bookmark, remembering where to come back after exploring a different section.

┌───────────────┐
│   Function    │
│    Call       │
└──────┬────────┘
       │
       ▼
┌───────────────┐      ┌───────────────┐
│ Link Register │─────▶│ Return Address│
│     (LR)      │      └───────────────┘
└───────────────┘
       │
       ▼
┌───────────────┐
│ Called        │
│ Function      │
└───────────────┘

Build-Up - 7 Steps

1

Foundation

Basic ARM Registers Overview

Concept: Introduce the general-purpose registers and special registers in ARM, including R0-R15.

ARM processors have 16 registers named R0 to R15. Most are general-purpose, used for calculations and data storage. Some have special roles: R15 is the Program Counter (PC), R14 is the Link Register (LR), and R13 is the Stack Pointer (SP). Understanding these helps grasp how ARM manages program flow.

Result

Learners recognize the Link Register as R14 among other ARM registers.

Knowing the special roles of certain registers is essential to understanding how ARM controls program execution and function calls.

2

Foundation

Function Calls and Return Addresses

Concept: Explain how function calls work and why return addresses are needed.

When a program calls a function, it must remember where to return afterward. This return address is usually the instruction after the call. Without saving this address, the program wouldn't know where to continue after the function finishes.

Result

Learners understand the need to save return addresses during function calls.

Recognizing the importance of return addresses clarifies why special registers like the Link Register exist.

3

Intermediate

Role of the Link Register in ARM Calls

🤔Before reading on: do you think the Link Register stores the function's input parameters or the return address? Commit to your answer.

Concept: The Link Register (R14) stores the return address automatically during a function call instruction.

In ARM, the 'BL' (Branch with Link) instruction calls a function and saves the return address (the next instruction's address) into the Link Register (R14). This means the processor knows where to return after the function completes without extra instructions.

Result

Learners see that the LR holds the return address immediately after a function call.

Understanding that the LR automatically saves the return address simplifies how function calls are managed in ARM.

4

Intermediate

Using the Link Register to Return

🤔Before reading on: do you think the return from a function uses the Link Register directly or a memory location? Commit to your answer.

Concept: The Link Register is used to return from a function by branching back to the stored address.

After a function finishes, the 'BX LR' instruction branches to the address stored in the Link Register, effectively returning control to the caller. This avoids needing to store the return address in memory unless the function calls another function.

Result

Learners understand how the LR is used to return control after a function call.

Knowing that the LR enables quick returns without memory access improves appreciation for ARM's efficient call/return mechanism.

5

Intermediate

Saving and Restoring the Link Register

🤔Before reading on: do you think the Link Register must always be saved on the stack during nested calls? Commit to your answer.

Concept: When a function calls another function, the LR must be saved to avoid losing the return address.

If a function calls another function, the LR will be overwritten by the new call's return address. To preserve the original return address, the LR is saved (usually on the stack) at the start of the function and restored before returning.

Result

Learners see why and how the LR is saved/restored during nested calls.

Understanding LR saving prevents bugs where return addresses get lost during nested function calls.

6

Advanced

Link Register in Interrupt and Exception Handling

🤔Before reading on: do you think the Link Register is used during interrupts or is it bypassed? Commit to your answer.

Concept: The LR also stores return addresses during interrupts and exceptions, but with special modes and values.

When an interrupt or exception occurs, the processor saves the current PC in a special LR variant depending on the mode. This allows the system to return to the interrupted code correctly. The LR's role extends beyond normal function calls to system-level control flow.

Result

Learners understand the LR's role in handling interrupts and exceptions.

Knowing LR's use in system control flow reveals its critical role in ARM's architecture beyond simple function calls.

7

Expert

Link Register and Tail Call Optimization

🤔Before reading on: do you think the Link Register is always preserved in tail calls or can it be reused? Commit to your answer.

Concept: Tail call optimization can reuse the Link Register to avoid extra stack operations.

In tail call optimization, a function call is the last action before returning. ARM can reuse the LR without saving it to the stack, branching directly to the next function. This reduces overhead and improves performance but requires careful management of the LR.

Result

Learners discover how advanced compilers optimize function calls using the LR.

Understanding LR reuse in tail calls highlights ARM's efficiency and the subtlety needed in low-level programming.

Under the Hood

The Link Register (R14) is a dedicated CPU register that the ARM processor writes to automatically during a 'Branch with Link' (BL) instruction. When BL executes, it stores the address of the next instruction (PC + 4 or PC + 8 depending on pipeline and architecture version) into LR. This allows the processor to branch to the target function while remembering where to return. The LR can then be used by a 'Branch Exchange' (BX) instruction to jump back. Internally, the LR is just a general-purpose register with a special role assigned by convention and instruction behavior.

Why designed this way?

ARM designers chose a dedicated register for return addresses to speed up function calls and returns by avoiding memory access for storing return addresses. This design reduces instruction count and latency compared to architectures that push return addresses onto the stack by default. Alternatives like using the stack exclusively were slower and more complex. The LR approach balances speed and flexibility, allowing saving to stack only when needed.

┌───────────────┐
│  BL Instruction│
│ (Branch with  │
│    Link)      │
└──────┬────────┘
       │
       ▼
┌───────────────┐      ┌───────────────┐
│ Program Counter│─────▶│ Next Instr Addr│
│     (PC)       │      └───────────────┘
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Link Register │
│     (LR)      │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Branch to     │
│ Function Addr │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does the Link Register store function input parameters? Commit to yes or no.

Common Belief: The Link Register holds function input parameters during calls.

Reality: The Link Register only stores the return address, not input parameters.

Why it matters: Confusing LR with parameter storage leads to incorrect assumptions about calling conventions and can cause bugs in assembly programming.

Quick: Is the Link Register automatically saved on the stack during every function call? Commit to yes or no.

Common Belief: The Link Register is always saved on the stack during function calls.

Reality: The LR is only saved on the stack if the function calls another function or needs to preserve it; otherwise, it remains in the register.

Why it matters: Assuming automatic saving wastes resources and can lead to inefficient code or incorrect stack management.

Quick: Does the Link Register hold the return address after an interrupt? Commit to yes or no.

Common Belief: The Link Register always holds the return address, even during interrupts.

Reality: During interrupts, special LR variants in different CPU modes hold return addresses, not the standard LR register.

Why it matters: Misunderstanding this can cause errors in interrupt handling and system stability.

Quick: Can the Link Register be used as a general-purpose register without consequences? Commit to yes or no.

Common Belief: The Link Register can be freely used as a general-purpose register anytime.

Reality: Using LR without saving its value before function calls can overwrite the return address, causing program crashes.

Why it matters: Ignoring LR's special role risks losing return addresses and breaking program flow.

Expert Zone

1

The Link Register's value is often off by a few bytes due to ARM's pipeline and instruction prefetching, requiring careful adjustment when using it as a return address.

2

In Thumb mode, the least significant bit of the LR indicates the instruction set state (ARM or Thumb) to return to, which must be preserved during returns.

3

Some ARM calling conventions use the LR to pass a hidden parameter or for other purposes in leaf functions that do not call others.

When NOT to use

The Link Register should not be relied upon as a permanent storage location for return addresses in deeply nested or recursive functions without saving it to the stack. For complex call chains or interrupt handlers, using the stack or dedicated frame pointers is safer. Alternatives include using the stack pointer (SP) and frame pointer (FP) for managing return addresses and local variables.

Production Patterns

In real-world ARM software, compilers generate prologues and epilogues that save and restore the LR on the stack when needed. Interrupt service routines use special LR variants to manage return addresses. Tail call optimizations reuse LR to reduce stack usage. Debuggers and exception handlers rely on LR to trace call stacks and recover program state.

Connections

Call Stack

The Link Register works alongside the call stack to manage function returns.

Understanding LR clarifies how return addresses can be stored in registers or on the stack, showing two complementary methods of managing program flow.

Program Counter (PC)

The Link Register stores addresses related to the Program Counter's position during calls.

Knowing how LR relates to PC helps understand branching and instruction flow control in ARM.

Interrupt Handling

LR variants store return addresses during interrupts, linking function call mechanics to system-level control.

Recognizing LR's role in interrupts bridges application-level programming with low-level system operations.

Common Pitfalls

#1 Overwriting the Link Register without saving it before a nested function call.

Wrong approach:

BL some_function
BL another_function
BX LR

Correct approach:

PUSH {LR}
BL some_function
BL another_function
POP {LR}
BX LR

Root cause:

Not saving LR causes the return address to be lost when a second function call overwrites it.

#2 Using LR as a general-purpose register without preserving its value.

Wrong approach:

MOV LR, R0
BL function
BX LR

Correct approach:

PUSH {LR}
MOV LR, R0
BL function
POP {LR}
BX LR

Root cause:

Misunderstanding LR's special role leads to overwriting the return address.

#3 Returning from a function without branching to LR.

Wrong approach:

BL function
MOV PC, #0x0 ; incorrect return

Correct approach:

BL function
BX LR ; correct return

Root cause:

Ignoring LR as the return address causes program flow to jump incorrectly.

Key Takeaways

The Link Register (R14) is a special ARM register that stores the return address during function calls.

ARM's 'Branch with Link' instruction automatically saves the return address in LR, enabling efficient function returns.

LR must be saved and restored when functions call other functions to avoid losing return addresses.

The Link Register also plays a critical role in interrupt and exception handling by storing return addresses in special modes.

Advanced optimizations like tail calls reuse LR to improve performance, but require careful management.

Practice

1. What is the primary purpose of the link register (R14/LR) in ARM architecture?

easy

A. To manage stack pointer operations

B. To hold the current instruction being executed

C. To store general-purpose data temporarily

D. To store the return address during function calls

Solution

1. Step 1: Understand the role of the link register

   The link register (R14/LR) is specifically designed to hold the return address when a function call is made.

2. Step 2: Differentiate from other registers

   Other registers like the program counter hold the current instruction, and the stack pointer manages the stack, but LR stores the return address.

3. Final Answer:

   To store the return address during function calls -> Option D

4. Quick Check:

   Link register = return address storage [OK]

Hint: LR always holds return address after a function call [OK]

Common Mistakes:

• Confusing LR with the program counter
• Thinking LR stores general data
• Mixing LR with stack pointer

2. Which ARM instruction saves the return address into the link register (LR)?

easy

A. BL

B. ADD

C. MOV

D. STR

Solution

1. Step 1: Identify the instruction for function calls

   The BL (Branch with Link) instruction branches to a function and saves the return address in LR.

2. Step 2: Understand other instructions

   MOV moves data, ADD adds values, and STR stores data to memory; none save return addresses.

3. Final Answer:

   BL -> Option A

4. Quick Check:

   BL saves return address in LR [OK]

Hint: BL means branch and link (save return) [OK]

Common Mistakes:

• Choosing MOV as it moves data
• Confusing STR with saving return address
• Thinking ADD saves addresses

3. Consider this ARM code snippet:
BL function
...
function:
MOV R0, #5
BX LR
What happens when the instruction BX LR executes?

medium

A. The program jumps back to the instruction after BL

B. The program jumps to the start of function

C. The program halts execution

D. The program jumps to an undefined address

Solution

1. Step 1: Understand what BL does

   BL saves the return address (next instruction after BL) into LR and jumps to 'function'.

2. Step 2: Analyze BX LR instruction

   BX LR branches to the address stored in LR, which is the return address after BL.

3. Final Answer:

   The program jumps back to the instruction after BL -> Option A

4. Quick Check:

   BX LR returns to caller address [OK]

Hint: BX LR returns to saved return address [OK]

Common Mistakes:

• Thinking BX LR jumps to function start
• Assuming program halts on BX LR
• Believing BX LR jumps to random address

4. In this ARM code, what is the error?
BL function
...
function:
MOV R0, #10
MOV PC, R0

medium

A. BL instruction is invalid

B. MOV PC, R0 does not return to caller correctly

C. MOV R0, #10 is not allowed

D. Function label is missing

Solution

1. Step 1: Check the return method

   To return from a function, the program must jump to the address in LR, not to a fixed value in R0.

2. Step 2: Identify the problem with MOV PC, R0

   MOV PC, R0 sets the program counter to 10, which is not a valid return address, causing incorrect behavior.

3. Final Answer:

   MOV PC, R0 does not return to caller correctly -> Option B

4. Quick Check:

   Return must use LR, not arbitrary register [OK]

Hint: Return by jumping to LR, not arbitrary register [OK]

Common Mistakes:

• Thinking BL is invalid
• Assuming MOV R0, #10 is wrong
• Ignoring the need to use LR for return

5. You want to write a function in ARM that calls another function and then returns correctly. Which sequence correctly uses the link register (LR)?

hard

A. Use B to call the function, then return with BX R14

B. Use B to call the function, then return with MOV PC, LR

C. Use BL to call the function, then return with BX LR

D. Use BL to call the function, then return with MOV PC, R0

Solution

1. Step 1: Understand function call with BL

   BL saves the return address in LR and branches to the called function.

2. Step 2: Understand correct return instruction

   Returning is done by branching to LR using BX LR, which jumps back to the saved return address.

3. Step 3: Evaluate other options

   B does not save return address in LR; MOV PC, R0 returns to wrong place; BX R14 is equivalent to BX LR but using B (not BL) means LR is not saved.

4. Final Answer:

   Use BL to call the function, then return with BX LR -> Option C

5. Quick Check:

   BL + BX LR = correct call and return [OK]

Hint: Call with BL, return with BX LR always [OK]

Common Mistakes:

• Using B instead of BL for calls
• Returning with MOV PC, R0 instead of BX LR
• Confusing BX R14 and BX LR usage