SRS, SRSDA, SRSDB, SRSIA, SRSIB Store Return State Store Return State stores the LR_<current_mode> and SPSR_<current_mode> to the stack of a specified mode. For information about memory accesses see Memory accesses. SRS is UNDEFINED in Hyp mode. SRS is CONSTRAINED UNPREDICTABLE if it is executed in User or System mode, or if the specified mode is any of the following: Not implemented. A mode that AArch32 PE modes does not show. Hyp mode. Monitor mode, if the SRS instruction is executed in Non-secure state. If EL3 is using AArch64 and an SRS instruction that is executed in a Secure EL1 mode specifies Monitor mode, it is trapped to EL3. For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Architectural Constraints on UNPREDICTABLE behaviors, and particularly SRS (T32) and SRS (A32). SRSFA, SRSEA, SRSFD, and SRSED are pseudo-instructions for SRSIB, SRSIA, SRSDB, and SRSDA respectively, referring to their use for pushing data onto Full Ascending, Empty Ascending, Full Descending, and Empty Descending stacks. It has encodings from the following instruction sets: A32 ( A1 ) and T32 ( T1 and T2 ) . 1 1 1 1 1 0 0 1 0 (1) (1) (0) (1) (0) (0) (0) (0) (0) (1) (0) (1) (0) (0) (0) 0 0 SRSDA{<c>}{<q>} SP{!}, #<mode> 1 0 SRSDB{<c>}{<q>} SP{!}, #<mode> 0 1 SRS{IA}{<c>}{<q>} SP{!}, #<mode> 1 1 SRSIB{<c>}{<q>} SP{!}, #<mode> let wback : boolean = (W == '1'); let increment : boolean = (U == '1'); let wordhigher : boolean = (P == U); 1 1 1 0 1 0 0 0 0 0 0 (1) (1) (0) (1) (1) (1) (0) (0) (0) (0) (0) (0) (0) (0) (0) SRSDB{<c>}{<q>} SP{!}, #<mode> let wback : boolean = (W == '1'); let increment : boolean = FALSE; let wordhigher : boolean = FALSE; 1 1 1 0 1 0 0 1 1 0 0 (1) (1) (0) (1) (1) (1) (0) (0) (0) (0) (0) (0) (0) (0) (0) SRS{IA}{<c>}{<q>} SP{!}, #<mode> let wback : boolean = (W == '1'); let increment : boolean = TRUE; let wordhigher : boolean = FALSE; <c> For the "Decrement After", "Decrement Before", "Increment After", and "Increment Before" variants: see Standard assembler syntax fields. <c> must be AL or omitted. <c> For the "T1" and "T2" variants: see Standard assembler syntax fields. <q> See Standard assembler syntax fields. ! The address adjusted by the size of the data loaded is written back to the base register. If specified, it is encoded in the "W" field as 1, otherwise this field defaults to 0. <mode> Is the number of the mode whose Banked SP is used as the base register, encoded in the "mode" field. For details of PE modes and their numbers see AArch32 state PE modes. IA For the "Increment After" variant: is an optional suffix to indicate the Increment After variant. IA For the "T2" variant: is an optional suffix for the Increment After form. if CurrentInstrSet() == InstrSet_A32 then if ConditionPassed() then EncodingSpecificOperations(); if PSTATE.EL == EL2 then // UNDEFINED at EL2 Undefined(); end; // Check for UNPREDICTABLE cases. The definition of UNPREDICTABLE does not permit these // to be security holes if PSTATE.M IN {M32_User,M32_System} then UnpredictableProcedure(); elsif mode == M32_Hyp then // Check for attempt to access Hyp mode SP UnpredictableProcedure(); elsif mode == M32_Monitor then // Check for attempt to access Monitor mode SP if !HaveEL(EL3) || CurrentSecurityState() != SS_Secure then UnpredictableProcedure(); elsif !ELUsingAArch32(EL3) then AArch64_MonitorModeTrap(); end; elsif BadMode(mode) then UnpredictableProcedure(); end; let base : bits(32) = Rmode(13,mode); var address : bits(32) = if increment then base else base-8; if wordhigher then address = address+4; end; MemA{32}(address) = LR(); MemA{32}(address+4) = SPSR_curr(); if wback then Rmode(13,mode) = if increment then base+8 else base-8; end; end; else if ConditionPassed() then EncodingSpecificOperations(); if PSTATE.EL == EL2 then // UNDEFINED at EL2 Undefined(); end; // Check for UNPREDICTABLE cases. The definition of UNPREDICTABLE does not permit these // to be security holes if PSTATE.M IN {M32_User,M32_System} then UnpredictableProcedure(); elsif mode == M32_Hyp then // Check for attempt to access Hyp mode SP UnpredictableProcedure(); elsif mode == M32_Monitor then // Check for attempt to access Monitor mode SP if !HaveEL(EL3) || CurrentSecurityState() != SS_Secure then UnpredictableProcedure(); elsif !ELUsingAArch32(EL3) then AArch64_MonitorModeTrap(); end; elsif BadMode(mode) then UnpredictableProcedure(); end; let base : bits(32) = Rmode(13,mode); var address : bits(32) = if increment then base else base-8; if wordhigher then address = address+4; end; MemA{32}(address) = LR(); MemA{32}(address+4) = SPSR_curr(); if wback then Rmode(13,mode) = if increment then base+8 else base-8; end; end; end; PSTATE.M IN {M32_User,M32_System} mode == M32_Hyp mode == M32_Monitor && (!HaveEL(EL3) || CurrentSecurityState() != SS_Secure) BadMode(mode) The instruction stores to the stack of the mode in which it is executed. The instruction stores to an UNKNOWN address, and if the instruction specifies writeback then any general-purpose register that can be accessed from the current Exception level without a privilege violation becomes UNKNOWN. 2026-03-26 20:27:25 2026-03_rel