The AAPCS, the ARM Architecture Procedure Call Standard, is the agreed convention for how functions call each other on ARM: which registers carry arguments and return values, which registers a called function must preserve, how the stack is used and how values larger than a register are passed. Following it lets code from different files, compilers and languages link and interoperate.

Which registers hold function arguments in ARM?

Under the AAPCS, the first four arguments are passed in registers r0, r1, r2 and r3, and the return value comes back in r0 (with r1 for a 64-bit result). Any further arguments are passed on the stack. r0 to r3 are also scratch (caller-saved) registers.

What is the difference between caller-saved and callee-saved registers?

Caller-saved (scratch) registers, r0 to r3 and r12, may be freely overwritten by a called function, so the caller must save them if it needs them after the call. Callee-saved registers, r4 to r11, must be preserved by the called function, which pushes them on entry and pops them before returning. This split divides the saving responsibility cleanly.

How do you call and return from a function in ARM?

You call with BL target, which jumps to the function and saves the return address in the link register (LR). The function returns with BX LR, or by popping the saved LR into the PC. For nested calls the function must save LR on the stack first, because a further BL would overwrite it.

DAY 15 · THE INSTRUCTION SET

Subroutines & the AAPCS Calling Convention

By EcrioniX · Updated Jun 6, 2026

A function call sounds simple — jump there, jump back. But how does the caller pass arguments, get a result, and trust its registers survive? The answer is a shared rulebook: the AAPCS. Master it and your assembly can call C, and C can call yours.

1. Call and return

From Day 12: BL calls (jump + save return address in LR), and you return with BX LR (or by popping LR into PC):

BL myfunc ; call: LR = address of next instruction, then jump ; ... execution continues here after myfunc returns ... myfunc: ; ... do work ... BX lr ; return to wherever we were called from

2. The problem a convention solves

If everyone invented their own way to pass arguments and use registers, no two pieces of code could call each other. So ARM defines the AAPCS (ARM Architecture Procedure Call Standard) — the contract every compiler and library follows. Obey it and your code interoperates with the whole ecosystem.

3. The register roles

Registers	Role	Who preserves
r0–r3	arguments 1–4; r0 (& r1) = return value; scratch	caller-saved
r4–r11	local variables	callee-saved
r12 (IP)	scratch / intra-call temp	caller-saved
r13 (SP)	stack pointer	special
r14 (LR)	return address	special
r15 (PC)	program counter	special

Caller-saved vs callee-saved

Caller-saved (r0–r3, r12) — a called function may freely clobber these. If the caller needs their values after the call, the caller must save them first.
Callee-saved (r4–r11) — the called function must leave these exactly as it found them, so it pushes any it uses on entry and pops them before returning.

💡 Why two kinds?

It splits the work fairly. Scratch registers (r0–r3) are for quick throwaway use — no one saves them, so calls are cheap. Long-lived values go in r4–r11, which the callee promises to protect, so the caller can rely on them surviving any call.

4. Passing arguments & returning values

; int sum = add(10, 20); MOV r0, #10 ; arg1 in r0 MOV r1, #20 ; arg2 in r1 BL add ; call ; result now in r0 add: ADD r0, r0, r1 ; r0 = r0 + r1 BX lr ; return value is in r0

First four args → r0, r1, r2, r3. More than four → passed on the stack.
Return value → r0 (a 64-bit result uses r0:r1).

5. Nested calls — save LR!

Here's the catch that bites beginners. BL overwrites LR. So if your function calls another function, the second BL destroys your own return address — unless you save LR on the stack first (Day 14):

outer: PUSH {r4, lr} ; save LR (and any callee regs we use) BL inner ; this would clobber LR — but we saved it ; ... more work ... POP {r4, pc} ; restore and return (saved LR → PC)

A leaf function (one that calls nothing) can skip this and just BX LR. Any function that makes a call must preserve LR. This is the single most common cause of "my function returns to the wrong place."

6. The complete function template

func: PUSH {r4-r6, lr} ; prologue: save callee-saved regs + LR ; r0-r3 = args; use r4-r6 for locals; call others freely ; ... body ... ; put result in r0 POP {r4-r6, pc} ; epilogue: restore + return

✅ The mental model

The AAPCS is the handshake between functions: r0–r3 carry args, r0 returns the result, r4–r11 are protected by the callee, and LR holds the return address — which you must save on the stack before any nested call. Follow it and your assembly and C interoperate perfectly.

🎯 Day 15 takeaways

BL calls (saves LR); BX LR / POP {…,pc} returns.
AAPCS is the standard that lets all ARM code interoperate.
r0–r3 = args + return (caller-saved); r4–r11 = callee-saved; r12 scratch.
>4 args go on the stack; 64-bit result in r0:r1.
Save LR before nested calls or your return address is lost.

Quick check

Where does the first argument go, and where does the return value come back?
Which registers must a called function preserve?
Why must a non-leaf function push LR?

FAQ

What is the AAPCS?

The ARM Architecture Procedure Call Standard — the convention for argument/return registers, register preservation and stack use that lets ARM code interoperate.

Caller-saved vs callee-saved?

Caller-saved (r0–r3, r12) can be clobbered by the callee; callee-saved (r4–r11) must be preserved by the called function.

Why save LR?

BL overwrites LR, so a function that calls another must push LR first or it loses its own return address.

← Back to the full course roadmap