Subroutine call convention (AAPCS) in ARM Architecture - Step-by-Step Execution

Concept Flow - Subroutine call convention (AAPCS)

Caller prepares arguments in registers R0-R3

↓

Caller pushes extra arguments on stack if >4

↓

Caller executes BL (branch with link) to subroutine

↓

Subroutine saves LR (R14) if needed

↓

Subroutine uses R0-R3 for parameters

↓

Subroutine uses R4-R11 as callee-saved registers

↓

Subroutine executes instructions

↓

Subroutine places return value in R0

↓

Subroutine restores saved registers and returns with BX LR

↓

Caller resumes, uses return value from R0

Shows the step-by-step flow of how arguments are passed, subroutine is called, registers saved/restored, and return value passed back following AAPCS.

Execution Sample

ARM Architecture

MOV R0, #5
MOV R1, #10
BL add_two_numbers
; result in R0

Caller sets two arguments in R0 and R1, calls subroutine add_two_numbers, which returns sum in R0.

Analysis Table

Step	Action	Registers/Stack State	Notes
1	Caller sets R0=5, R1=10	R0=5, R1=10	First two arguments in registers
2	Caller executes BL add_two_numbers	LR=return_address	Link register stores return address
3	Subroutine saves LR if needed	Stack: push LR	Preserve return address if subroutine calls others
4	Subroutine uses R0=5, R1=10 as parameters	R0=5, R1=10	Parameters ready for use
5	Subroutine computes sum: R0=R0+R1	R0=15	Return value placed in R0
6	Subroutine restores LR from stack	Stack: pop LR	Restore return address
7	Subroutine returns with BX LR	PC=LR	Return to caller
8	Caller resumes, reads result from R0	R0=15	Result available in R0

💡 Subroutine returns to caller with result in R0, completing the call.

State Tracker

Register	Start	After Step 1	After Step 4	After Step 5	After Step 8
R0	undefined	5	5	15	15
R1	undefined	10	10	10	10
LR	undefined	return_address	saved on stack	saved on stack	return_address restored

Key Insights - 3 Insights

Why are only registers R0 to R3 used for passing arguments initially?

Because AAPCS defines that the first four arguments go into R0-R3 for efficiency; extra arguments go on the stack (see execution_table step 1 and 2).

What happens if the subroutine calls another subroutine? How is the return address preserved?

The subroutine saves the LR (link register) on the stack before calling another subroutine (step 3), then restores it before returning (step 6).

Where is the return value placed after the subroutine finishes?

The return value is placed in R0 register (step 5 and 8), so the caller can read it immediately after return.

Visual Quiz - 3 Questions

Look at the execution_table at step 5, what is the value of R0?

A 15

B 5

C 10

D undefined

💡 Hint

Check the 'Registers/Stack State' column at step 5 in execution_table.

At which step does the subroutine save the return address (LR) on the stack?

A Step 2

B Step 6

C Step 3

D Step 7

💡 Hint

Look for 'push LR' in the 'Registers/Stack State' column in execution_table.

If the caller had 5 arguments instead of 2, where would the 5th argument be placed?

A In R3 register

B On the stack

C In R4 register

D In LR register

💡 Hint

Recall that only R0-R3 hold first 4 arguments; extras go on stack (see key_moments question 1).

Concept Snapshot

AAPCS subroutine call:
- First 4 args in R0-R3 registers
- Extra args pushed on stack
- Caller uses BL to call subroutine
- Subroutine saves LR if calls others
- Return value in R0
- Return with BX LR
- Callee-saved registers R4-R11 preserved by subroutine

Full Transcript

This visual execution trace shows the ARM AAPCS subroutine call convention. The caller places up to four arguments in registers R0 to R3. If there are more than four arguments, the extras are pushed onto the stack. The caller then calls the subroutine using the BL instruction, which saves the return address in the link register (LR). The subroutine saves LR on the stack if it calls other subroutines to preserve the return address. The subroutine uses R0-R3 to access parameters and places the return value in R0. Before returning, it restores LR from the stack and returns using BX LR. The caller then resumes execution and reads the result from R0. This convention ensures efficient parameter passing and return value handling while preserving necessary registers.