range of BL instruction in arm state

The opcode for ARM's BL instruction accepts/requires a 24-bit immediate value, so the architecture knows how much to offset (i.e. add to) the PC (program counter) to allow it to jump to the specified label. These 24 bits allow us a jump range of 2^24 = 16,777,216 = 16 MB memory addresses. But since we want to be able to add to and subtract from the PC, we will need to have negative immediates available to us. In other words, we need the most significant bit (MSb) of the immediate to be the sign bit. In doing so, we lose jump range by one bit, i.e. a power of 2, yielding an actual jump range of ± 2^23 = ± 8,388,608 = ± 8 MB memory addresses. However, since each memory address is 4 byte-aligned, each memory address actually contains 4 bytes (since ARM instructions are always 4 bytes long). Thus, the actual number of bytes reachable by the BL instruction is ± 4 × 2^23 = ± 33,554,432 = ± 32 MB.

The opcode for ARM's BL instruction accepts/requires a 24-bit immediate value, so the architecture knows how much to offset (i.e. add to) the PC (program counter) to allow it to jump to the specified label. These 24 bits allow us a jump range of 2^24 = 16,777,216 = 16 MB memory addresses. But since we want to be able to add to and subtract from the PC, we will need to have negative immediates available to us. In other words, we need the most significant bit (MSb) of the immediate to be the sign bit. In doing so, we lose jump range by one bit, i.e. a power of 2, yielding an actual jump range of ± 2^23 = ± 8,388,608 = ± 8 MB memory addresses. However, since each memory address is 4 byte-aligned, each memory address actually contains 4 bytes (since ARM instructions are always 4 bytes long). Thus, the actual number of bytes reachable by the BL instruction is ± 4 × 2^23 = ± 33,554,432 = ± 32 MB.