range of BL instruction in arm state

That comes back to the earlier post.  2^24 gives you 16MB, but as we can branch forwards or backwards this becomes +/- 8MB (total of 16MB).

This would be true if we needed to encode a BYTE offset, but we don't.  ARM instructions are ALWAYS four bytes, and must always be 4-byte aligned.  A 4-byte aligned address has bits [1:0]=b00.  So we when look at encoding the offset, we don't have worry about these bottom two bits - they are always going to be b00.  Effectively this gives two "free" bits of offset, taking the range from +/-8MB to +/-32MB.

That comes back to the earlier post.  2^24 gives you 16MB, but as we can branch forwards or backwards this becomes +/- 8MB (total of 16MB).

This would be true if we needed to encode a BYTE offset, but we don't.  ARM instructions are ALWAYS four bytes, and must always be 4-byte aligned.  A 4-byte aligned address has bits [1:0]=b00.  So we when look at encoding the offset, we don't have worry about these bottom two bits - they are always going to be b00.  Effectively this gives two "free" bits of offset, taking the range from +/-8MB to +/-32MB.