Content      ..     1      2      3      4      ..

Intel 64 and IA-32 Architectures. Software Developer’s Manual (2026) - page 3

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Stack Segment

Bottom of Stack

(Initial ESP Value)

Local Variables

for Calling

The Stack Can Be

Procedure

16 or 32 Bits Wide

Parameters

Passed to

The EBP register is

Called

typically set to point

Procedure

to the return

instruction pointer.

Frame Boundary

Return Instruction

EBP Register

Pointer

ESP Register

Top of Stack

Pushes Move the

Pops Move the

Top Of Stack to

Top Of Stack to

Lower Addresses

Higher Addresses

Figure 6-1. Stack Structure

The processor references the SS register automatically for all stack operations. For example, when the ESP register

is used as a memory address, it automatically points to an address in the current stack. Also, the CALL, RET, PUSH,

POP, ENTER, and LEAVE instructions all perform operations on the current stack.

6.2.1

Setting Up a Stack

To set a stack and establish it as the current stack, the program or operating system/executive must do the

following:

1. Establish a stack segment.

2. Load the segment selector for the stack segment into the SS register using a MOV, POP, or LSS instruction.

3. Load the stack pointer for the stack into the ESP register using a MOV, POP, or LSS instruction. The LSS

instruction can be used to load the SS and ESP registers in one operation.

See “Segment Descriptors” in Chapter 3, “Protected-Mode Memory Management,” of the Intel^® 64 and IA-32 Archi-

tectures Software Developer’s Manual, Volume 3A, for information on how to set up a segment descriptor and

segment limits for a stack segment.

6.2.2

Stack Alignment

The stack pointer for a stack segment should be aligned on 16-bit (word) or 32-bit (double-word) boundaries,

depending on the width of the stack segment. The D flag in the segment descriptor for the current code segment

sets the stack-segment width (see “Segment Descriptors” in Chapter 3, “Protected-Mode Memory Management,” of

the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). The PUSH and POP instructions

use the D flag to determine how much to decrement or increment the stack pointer on a push or pop operation,

respectively. When the stack width is 16 bits, the stack pointer is incremented or decremented in 16-bit increments;

when the width is 32 bits, the stack pointer is incremented or decremented in 32-bit increments. Pushing a 16-bit

value onto a 32-bit wide stack can result in stack misaligned (that is, the stack pointer is not aligned on a double-

6-2

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Stack During

Stack During

Near Call

Far Call

Stack

Frame

Param 1

Before

Param 1

Call

Param 2

Param 2

Param 3

ESP Before Call

Param 3

ESP Before Call

Calling EIP

ESP After Call

Calling CS

Stack

Frame

Stack

Calling EIP

ESP After Call

After

Frame

Call

After

Call

Stack During

Stack During

Near Return

Far Return

ESP After Return

ESP After Return

Param 1

Param 1

Param 2

Param 2

Param 3

Param 3

Calling EIP

ESP Before Return

Calling CS

Calling EIP

ESP Before Return

Note: On a near or far return, parameters are released from the stack based

on the optional n operand in the RET n instruction.

Figure 6-2. Stack on Near and Far Calls

Shadow Stack

Shadow Stack

During Near Call

During Far Call

SSP Before Call

SSP Before Call

Calling EIP

SSP After Call

Calling CS

Calling LIP

Calling SSP

SSP After Call

SSP After Return

SSP After Return

Calling EIP

SSP Before Return

Calling CS

Calling LIP

Calling SSP

SSP Before Return

Note: There are no parameters on the shadow stack. RET and RET n operate identically on

the shadow stack.

Figure 6-3. Shadow Stack on Near and Far Calls

6-6

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Protection Rings

Operating

System

Kernel

Level 0

Operating System

Services (Device

Drivers, Etc.)

Level 1

Applications

Level 2

Level 3

Highest

Lowest

0

1

2

3

Privilege Levels

Figure 6-4. Protection Rings

In this example, the highest privilege level 0 (at the center of the diagram) is used for segments that contain the

most critical code modules in the system, usually the kernel of an operating system. The outer rings (with progres-

sively lower privileges) are used for segments that contain code modules for less critical software.

Code modules in lower privilege segments can only access modules operating at higher privilege segments by

means of a tightly controlled and protected interface called a gate. Attempts to access higher privilege segments

without going through a protection gate and without having sufficient access rights causes a general-protection

exception (#GP) to be generated.

If an operating system or executive uses this multilevel protection mechanism, a call to a procedure that is in a

more privileged protection level than the calling procedure is handled in a similar manner as a far call (see Section

6.4.2, “Far CALL and RET Operation”). The differences are as follows:

• The segment selector provided in the CALL instruction references a special data structure called a call gate

descriptor. Among other things, the call gate descriptor provides the following:

- Access rights information.

- The segment selector for the code segment of the called procedure.

- An offset into the code segment (that is, the instruction pointer for the called procedure).

• The processor switches to a new stack to execute the called procedure. Each privilege level has its own stack.

The segment selector and stack pointer for the privilege level 3 stack are stored in the SS and ESP registers,

respectively, and are automatically saved when a call to a more privileged level occurs. The segment selectors

and stack pointers for the privilege level 2, 1, and 0 stacks are stored in a system segment called the task state

segment (TSS).

The use of a call gate and the TSS during a stack switch are transparent to the calling procedure, except when a

general-protection exception is raised.

Flexible return and event delivery (FRED) defines new mechanisms for changing privilege levels. See Chapter 8,

“Flexible Return and Event Delivery (FRED)‚” in the Intel® 64 and IA-32 Architectures Software Developer’s

Manual, Volume 3. When FRED transitions are enabled, call gates cannot be used to change privilege level. An

execution of CALL causes a general-protection exception (#GP) if it accesses a call gate. Similarly, an execution of

RET causes a #GP if it would change privilege level. In any of these cases, the fault identifies the relevant selector

in its error code.

6-8

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

6.4.6

CALL and RET Operation Between Privilege Levels

When making a call to a more privileged protection level, the processor does the following (see Figure 6-5):

1. Performs an access rights check (privilege check).

2. Temporarily saves (internally) the current contents of the SS, ESP, CS, and EIP registers.

Stack for Calling

Stack for Called

Procedure

Procedure

Calling SS

Calling ESP

Param 1

Param 1

Stack

Stack

Frame

Param 2

Param 2

Frame

Before Call

After Call

Param 3

ESP Before Call

Param 3

Calling CS

ESP After Call

Calling EIP

Calling SS

ESP After Return

Calling ESP

Param 1

Param 1

Param 2

Param 2

Param 3

Param 3

Calling CS

ESP

Before Return

Calling EIP

Note: On a return, parameters are released on both stacks based on the optional n

operand in the RET n instruction.

Figure 6-5. Stack Switch on a Call to a Different Privilege Level

Vol. 1

6-9

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Calling to Procedure at Higher Privilege Level from Privilege Level 3

Shadow Stack for

Handler’s Shadow

Calling Procedure

Stack

SSP Before Call

Supervisor

and After Return

Shadow Stack

Token

SSP After Call and

Before Return

Calling to Procedure at Higher Privilege Level from Privilege Level 2 or 1

Interrupted Procedure’s

Handler’s Shadow

Shadow Stack

Stack

SSP Before Call

Supervisor

and After Return

Shadow Stack

Token

CS

LIP

SSP After Call and

SSP

Before Return

Note: There are no parameters on the shadow stack. RET and RET n operate

identically on the shadow stack.

Figure 6-6. Shadow Stack Switch on a Call to a Different Privilege Level

3. Loads the segment selector and stack pointer for the new stack (that is, the stack for the privilege level being

called) from the TSS into the SS and ESP registers and switches to the new stack.

4. Pushes the temporarily saved SS and ESP values for the calling procedure’s stack onto the new stack.

5. Copies the parameters from the calling procedure’s stack to the new stack. A value in the call gate descriptor

determines how many parameters to copy to the new stack.

6. Pushes the temporarily saved CS and EIP values for the calling procedure to the new stack.

If shadow stack is enabled at the privilege level of the calling procedure, then the processor temporarily saves

the SSP of the calling procedure internally. If the calling procedure is at privilege level 3, the SSP of the calling

procedure is also saved into the IA32_PL3_SSP MSR.

6-10

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

The operating system, executive, and/or device drivers normally handle interrupts and exceptions independently

from application programs or tasks. Application programs can, however, access the interrupt and exception

handlers incorporated in an operating system or executive through assembly-language calls. The remainder of this

section gives a brief overview of the processor’s interrupt and exception handling mechanism. See Chapter 7,

“Interrupt and Exception Handling,” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume

3A, for a description of this mechanism.

The IA-32 Architecture defines 18 predefined interrupts and exceptions and 224 user defined interrupts, which are

associated with entries in the IDT. Each interrupt and exception in the IDT is identified with a number, called a

vector. Table 6-1 lists the interrupts and exceptions with entries in the IDT and their respective vectors. Vectors 0

through 8, 10 through 14, and 16 through 19 are the predefined interrupts and exceptions; vectors 32 through 255

are for software-defined interrupts, which are for either software interrupts or maskable hardware inter-

rupts.

When FRED transitions are enabled, the processor does not use the IDT. Instead, interrupts and exceptions are

delivered using FRED event delivery. FRED event delivery saves an event’s vector on the stack, along with the

event type (e.g., interrupt or exception). The event type allows software to distinguish interrupts and exceptions

with the same vector.

Note that the processor defines several additional interrupts that do not point to entries in the IDT and are not

delivered using FRED event delivery; the most notable of these interrupts is the SMI interrupt. See Chapter 7,

“Interrupt and Exception Handling,” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume

3A, for more information about the interrupts and exceptions.

When the processor detects an interrupt or exception, it does one of the following things:

• Executes an implicit call to a handler procedure.

• Executes an implicit call to a handler task.

6.5.1

Call and Return Operation for Interrupt or Exception Handling Procedures

This section describes IDT event delivery, a method for calling OS handlers for interrupts and exceptions. When

FRED transitions are enabled, FRED event delivery is used instead. FRED event delivery is detailed in Section 8.3,

“FRED Event Delivery” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3.

A call to an interrupt or exception handler procedure is similar to a procedure call to another protection level (see

Section 6.4.6, “CALL and RET Operation Between Privilege Levels”). Here, the vector references one of two kinds

of gates in the IDT: an interrupt gate or a trap gate. Interrupt and trap gates are similar to call gates in that they

provide the following information:

• Access rights information

• The segment selector for the code segment that contains the handler procedure

• An offset into the code segment to the first instruction of the handler procedure

The difference between an interrupt gate and a trap gate is as follows. If an interrupt or exception handler is called

through an interrupt gate, the processor clears the interrupt enable (IF) flag in the EFLAGS register to prevent

subsequent interrupts from interfering with the execution of the handler. When a handler is called through a trap

gate, the state of the IF flag is not changed.

Table 6-1. Exceptions and Interrupts

Vector

Mnemonic

Description

Source

0

#DE

Divide Error

DIV and IDIV instructions.

1

#DB

Debug

Any code or data reference.

2

NMI Interrupt

Non-maskable external interrupt.

3

#BP

Breakpoint

INT3 instruction.

4

#OF

Overflow

INTO instruction.

5

#BR

BOUND Range Exceeded

BOUND instruction.

6

#UD

Invalid Opcode (Undefined Opcode)

UD instruction or reserved opcode.

Vol. 1

6-13

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Table 6-1. Exceptions and Interrupts (Contd.)

Vector

Mnemonic

Description

Source

7

#NM

Device Not Available (No Math Coprocessor)

Floating-point or WAIT/FWAIT instruction.

8

#DF

Double Fault

Any instruction that can generate an exception, an NMI, or

an INTR.

9

#MF

CoProcessor Segment Overrun (reserved)

Floating-point instruction.¹

10

#TS

Invalid TSS

Task switch or TSS access.

11

#NP

Segment Not Present

Loading segment registers or accessing system segments.

12

#SS

Stack Segment Fault

Stack operations and SS register loads.

13

#GP

General Protection

Any memory reference and other protection checks.

14

#PF

Page Fault

Any memory reference.

15

Reserved

16

#MF

Floating-Point Error (Math Fault)

Floating-point or WAIT/FWAIT instruction.

17

#AC

Alignment Check

Any data reference in memory.²

18

#MC

Machine Check

Error codes (if any) and source are model dependent.³

19

#XM

SIMD Floating-Point Exception

SIMD Floating-Point Instruction⁴

20

#VE

Virtualization Exception

EPT violations⁵

21

#CP

Control Protection Exception

The RET, IRET, RSTORSSP, and SETSSBSY instructions can

generate this exception. When CET indirect branch tracking

is enabled, this exception can be generated due to a

missing ENDBRANCH instruction at the target of an indirect

call or jump.

22-31

Reserved

32-255

Maskable Interrupts

External interrupt from INTR pin or INT n instruction.

NOTES:

1. IA-32 processors after the Intel386 processor do not generate this exception.

2. This exception was introduced in the Intel486 processor.

3. This exception was introduced in the Pentium processor and enhanced in the P6 family processors.

4. This exception was introduced in the Pentium III processor.

5. This exception can occur only on processors that support the 1-setting of the “EPT-violation #VE” VM-execution control.

If the code segment for the handler procedure has the same privilege level as the currently executing program or

task, the handler procedure uses the current stack; if the handler executes at a more privileged level, the processor

switches to the stack for the handler’s privilege level.

If no stack switch occurs, the processor does the following when calling an interrupt or exception handler (see

Figure 6-7):

1. Pushes the current contents of the EFLAGS, CS, and EIP registers (in that order) on the stack.

If shadow stack is enabled:

a. Temporarily saves the current value of the SSP register internally.

b. Pushes the current value of the CS register on the shadow stack.

c. Pushes the current value of LIP (CS.base + EIP) on the shadow stack.

d. Pushes the temporarily saved SSP value on the shadow stack.

2. Pushes an error code (if appropriate) on the stack.

3. Loads the segment selector for the new code segment and the new instruction pointer (from the interrupt gate

or trap gate) into the CS and EIP registers, respectively.

4. If the call is through an interrupt gate, clears the IF flag in the EFLAGS register.

6-14

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

5. Begins execution of the handler procedure.

Stack Usage with No Privilege-Level Change

Interrupted Procedure’s

and Handler’s Stack

ESP Before

Transfer to Handler

EFLAGS

CS

EIP

Error Code

ESP After

Transfer to Handler

Stack Usage with Privilege-Level Change

Interrupted Procedure’s

Handler’s Stack

Stack

ESP Before

Transfer to Handler

SS

ESP

EFLAGS

CS

EIP

ESP After

Error Code

Transfer to Handler

Figure 6-7. Stack Usage on Transfers to Interrupt and Exception Handling Routines

Vol. 1

6-15

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Shadow Stack Usage with No Privilege-Level Change

Interrupted Procedure’s

and Handler’s Shadow Stack

SSP Before

Transfer to Handler

CS

LIP

SSP

SSP After

Transfer to Handler

Shadow Stack Usage with Privilege-Level Change from Level 3

Interrupted Procedure’s

Handler’s Shadow Stack

Shadow Stack

SSP Before

Transfer to Handler

Supervisor

Shadow Stack

SSP After

Token

Transfer to Handler

Shadow Stack Usage with Privilege-Level Change from Level 2 or 1

Interrupted Procedure’s

Handler’s Shadow Stack

Shadow Stack

SSP Before

Transfer to Handler

Supervisor

Shadow Stack

Token

CS

LIP

SSP After

SSP

Transfer to Handler

Figure 6-8. Shadow Stack Usage on Transfers to Interrupt and Exception Handling Routines

6-16

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

PUSH EBP;

FRAME_PTR := ESP;

IF LEVEL > 0

THEN

DO (LEVEL - 1) times

EBP := EBP - 4;

PUSH Pointer(EBP); (* doubleword pointed to by EBP *)

OD;

PUSH FRAME_PTR;

FI;

EBP := FRAME_PTR;

ESP := ESP - STORAGE;

The main procedure (in which all other procedures are nested) operates at the highest lexical level, level 1. The

first procedure it calls operates at the next deeper lexical level, level 2. A level 2 procedure can access the variables

of the main program, which are at fixed locations specified by the compiler. In the case of level 1, the ENTER

instruction allocates only the requested dynamic storage on the stack because there is no previous display to copy.

A procedure that calls another procedure at a lower lexical level gives the called procedure access to the variables

of the caller. The ENTER instruction provides this access by placing a pointer to the calling procedure's stack frame

in the display.

A procedure that calls another procedure at the same lexical level should not give access to its variables. In this

case, the ENTER instruction copies only that part of the display from the calling procedure which refers to previ-

ously nested procedures operating at higher lexical levels. The new stack frame does not include the pointer for

addressing the calling procedure’s stack frame.

The ENTER instruction treats a re-entrant procedure as a call to a procedure at the same lexical level. In this case,

each succeeding iteration of the re-entrant procedure can address only its own variables and the variables of the

procedures within which it is nested. A re-entrant procedure always can address its own variables; it does not

require pointers to the stack frames of previous iterations.

By copying only the stack frame pointers of procedures at higher lexical levels, the ENTER instruction makes

certain that procedures access only those variables of higher lexical levels, not those at parallel lexical levels (see

Figure 6-9).

Main (Lexical Level 1)

Procedure A (Lexical Level 2)

Procedure B (Lexical Level 3)

Procedure C (Lexical Level 3)

Procedure D (Lexical Level 4)

Figure 6-9. Nested Procedures

Block-structured languages can use the lexical levels defined by ENTER to control access to the variables of nested

procedures. In Figure 6-9, for example, if procedure A calls procedure B which, in turn, calls procedure C, then

procedure C will have access to the variables of the MAIN procedure and procedure A, but not those of procedure

B because they are at the same lexical level. The following definition describes the access to variables for the

nested procedures in Figure 6-9.

1. MAIN has variables at fixed locations.

2. Procedure A can access only the variables of MAIN.

Vol. 1

6-21

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

3. Procedure B can access only the variables of procedure A and MAIN. Procedure B cannot access the variables of

procedure C or procedure D.

4. Procedure C can access only the variables of procedure A and MAIN. Procedure C cannot access the variables of

procedure B or procedure D.

5. Procedure D can access the variables of procedure C, procedure A, and MAIN. Procedure D cannot access the

variables of procedure B.

In Figure 6-10, an ENTER instruction at the beginning of the MAIN procedure creates three doublewords of dynamic

storage for MAIN, but copies no pointers from other stack frames. The first doubleword in the display holds a copy

of the last value in the EBP register before the ENTER instruction was executed. The second doubleword holds a

copy of the contents of the EBP register following the ENTER instruction. After the instruction is executed, the EBP

register points to the first doubleword pushed on the stack, and the ESP register points to the last doubleword in

the stack frame.

When MAIN calls procedure A, the ENTER instruction creates a new display (see Figure 6-11). The first doubleword

is the last value held in MAIN's EBP register. The second doubleword is a pointer to MAIN's stack frame which is

copied from the second doubleword in MAIN's display. This happens to be another copy of the last value held in

MAIN’s EBP register. Procedure A can access variables in MAIN because MAIN is at level 1.

Therefore the base address for the dynamic storage used in MAIN is the current address in the EBP register, plus

four bytes to account for the saved contents of MAIN’s EBP register. All dynamic variables for MAIN are at fixed,

positive offsets from this value.

EBP

Old EBP

Display

Main’s EBP

Dynamic

Storage

ESP

Figure 6-10. Stack Frame After Entering the MAIN Procedure

Old EBP

Main’s EBP

Main’s EBP

EBP

Display

Main’s EBP

Procedure A’s EBP

Dynamic

Storage

ESP

Figure 6-11. Stack Frame After Entering Procedure A

6-22

Vol. 1

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

When procedure A calls procedure B, the ENTER instruction creates a new display (see Figure 6-12). The first

doubleword holds a copy of the last value in procedure A’s EBP register. The second and third doublewords are

copies of the two stack frame pointers in procedure A’s display. Procedure B can access variables in procedure A

and MAIN by using the stack frame pointers in its display.

When procedure B calls procedure C, the ENTER instruction creates a new display for procedure C (see

Figure 6-13). The first doubleword holds a copy of the last value in procedure B’s EBP register. This is used by the

LEAVE instruction to restore procedure B’s stack frame. The second and third doublewords are copies of the two

stack frame pointers in procedure A’s display. If procedure C were at the next deeper lexical level from procedure

B, a fourth doubleword would be copied, which would be the stack frame pointer to procedure B’s local variables.

Note that procedure B and procedure C are at the same level, so procedure C is not intended to access procedure

B’s variables. This does not mean that procedure C is completely isolated from procedure B; procedure C is called

by procedure B, so the pointer to the returning stack frame is a pointer to procedure B’s stack frame. In addition,

procedure B can pass parameters to procedure C either on the stack or through variables global to both procedures

(that is, variables in the scope of both procedures).

Old EBP

Main’s EBP

Main’s EBP

Main’s EBP

Procedure A’s EBP

Procedure A’s EBP

EBP

Main’s EBP

Display

Procedure A’s EBP

Procedure B’s EBP

Dynamic

Storage

ESP

Figure 6-12. Stack Frame After Entering Procedure B

Vol. 1

6-23

PROCEDURE CALLS, INTERRUPTS, AND EXCEPTIONS

Old EBP

Main’s EBP

Main’s EBP

Main’s EBP

Procedure A’s EBP

Procedure A’s EBP

Main’s EBP

Procedure A’s EBP

Procedure B’s EBP

Procedure B’s EBP

EBP

Main’s EBP

Display

Procedure A’s EBP

Procedure C’s EBP

Dynamic

Storage

ESP

Figure 6-13. Stack Frame After Entering Procedure C

6.6.2

LEAVE Instruction

The LEAVE instruction, which does not have any operands, reverses the action of the previous ENTER instruction.

The LEAVE instruction copies the contents of the EBP register into the ESP register to release all stack space allo-

cated to the procedure. Then it restores the old value of the EBP register from the stack. This simultaneously

restores the ESP register to its original value. A subsequent RET instruction then can remove any arguments and

the return address pushed on the stack by the calling program for use by the procedure.

6-24

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

• Exchange.

• Stack manipulation.

• Type conversion.

7.3.1.1

General Data Movement Instructions

Move instructions - The MOV (move) and CMOVcc (conditional move) instructions transfer data between

memory and registers or between registers.

The MOV instruction performs basic load data and store data operations between memory and the processor’s

registers and data movement operations between registers. It handles data transfers along the paths listed in Table

7-1. (See “MOV-Move to/from Control Registers” and “MOV-Move to/from Debug Registers” in Chapter 4,

“Instruction Set Reference, M-U,” of the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume

2A, for information on moving data to and from the control and debug registers.)

The MOV instruction cannot move data from one memory location to another or from one segment register to

another segment register. Memory-to-memory moves are performed with the MOVS (string move) instruction (see

Section 7.3.9, “String Operations”).

Conditional move instructions - The CMOVcc instructions are a group of instructions that check the state of the

status flags in the EFLAGS register and perform a move operation if the flags are in a specified state. These instruc-

tions can be used to move a 16-bit or 32-bit value from memory to a general-purpose register or from one general-

purpose register to another. The flag state being tested is specified with a condition code (cc) associated with the

instruction. If the condition is not satisfied, a move is not performed and execution continues with the instruction

following the CMOVcc instruction.

Table 7-1. Move Instruction Operations

Type of Data Movement

Source → Destination

From memory to a register

Memory location → General-purpose register

Memory location → Segment register

From a register to memory

General-purpose register → Memory location

Segment register → Memory location

Between registers

General-purpose register → General-purpose register

General-purpose register → Segment register

Segment register → General-purpose register

General-purpose register → Control register

Control register → General-purpose register

General-purpose register → Debug register

Debug register → General-purpose register

Immediate data to a register

Immediate → General-purpose register

Immediate data to memory

Immediate → Memory location

Table 7-2 shows mnemonics for CMOVcc instructions and the conditions being tested for each instruction. The

condition code mnemonics are appended to the letters “CMOV” to form the mnemonics for CMOVcc instructions.

The instructions listed in Table 7-2 as pairs (for example, CMOVA/CMOVNBE) are alternate names for the same

instruction. The assembler provides these alternate names to make it easier to read program listings.

CMOVcc instructions are useful for optimizing small IF constructions. They also help eliminate branching overhead

for IF statements and the possibility of branch mispredictions by the processor.

These conditional move instructions are supported in the P6 family, Pentium 4, and Intel Xeon processors. Software

can check if CMOVcc instructions are supported by checking the processor’s feature information with the CPUID

instruction.

Vol. 1

7-3

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

7.3.1.2

Exchange Instructions

The exchange instructions swap the contents of one or more operands and, in some cases, perform additional oper-

ations such as asserting the LOCK signal or modifying flags in the EFLAGS register.

The XCHG (exchange) instruction swaps the contents of two operands. This instruction takes the place of three

MOV instructions and does not require a temporary location to save the contents of one operand location while the

other is being loaded. When a memory operand is used with the XCHG instruction, the processor’s LOCK signal is

automatically asserted. This instruction is thus useful for implementing semaphores or similar data structures for

process synchronization. See “Bus Locking” in Chapter 11, “Multiple-Processor Management,”of the Intel^® 64 and

IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information on bus locking.

The BSWAP (byte swap) instruction reverses the byte order in a 32-bit register operand. Bit positions 0 through 7

are exchanged with 24 through 31, and bit positions 8 through 15 are exchanged with 16 through 23. Executing

this instruction twice in a row leaves the register with the same value as before. The BSWAP instruction is useful for

converting between “big-endian” and “little-endian” data formats. This instruction also speeds execution of decimal

arithmetic. (The XCHG instruction can be used to swap the bytes in a word.)

Table 7-2. Conditional Move Instructions

Instruction Mnemonic

Status Flag States

Condition Description

Unsigned Conditional Moves

CMOVA/CMOVNBE

(CF or ZF) = 0

Above/not below or equal

CMOVAE/CMOVNB

CF = 0

Above or equal/not below

CMOVNC

CF = 0

Not carry

CMOVB/CMOVNAE

CF = 1

Below/not above or equal

CMOVC

CF = 1

Carry

CMOVBE/CMOVNA

(CF or ZF) = 1

Below or equal/not above

CMOVE/CMOVZ

ZF = 1

Equal/zero

CMOVNE/CMOVNZ

ZF = 0

Not equal/not zero

CMOVP/CMOVPE

PF = 1

Parity/parity even

CMOVNP/CMOVPO

PF = 0

Not parity/parity odd

Signed Conditional Moves

CMOVGE/CMOVNL

(SF xor OF) = 0

Greater or equal/not less

CMOVL/CMOVNGE

(SF xor OF) = 1

Less/not greater or equal

CMOVLE/CMOVNG

((SF xor OF) or ZF) = 1

Less or equal/not greater

CMOVO

OF = 1

Overflow

CMOVNO

OF = 0

Not overflow

CMOVS

SF = 1

Sign (negative)

CMOVNS

SF = 0

Not sign (non-negative)

The XADD (exchange and add) instruction swaps two operands and then stores the sum of the two operands in the

destination operand. The status flags in the EFLAGS register indicate the result of the addition. This instruction can

be combined with the LOCK prefix (see “LOCK-Assert LOCK# Signal Prefix” in Chapter 3, “Instruction Set Refer-

ence, A-L,” of the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A) in a multiprocessing

system to allow multiple processors to execute one DO loop.

The CMPXCHG (compare and exchange) and CMPXCHG8B (compare and exchange 8 bytes) instructions are used

to synchronize operations in systems that use multiple processors. The CMPXCHG instruction requires three oper-

ands: a source operand in a register, another source operand in the EAX register, and a destination operand. If

the values contained in the destination operand and the EAX register are equal, the destination operand is

replaced with the value of the other source operand (the value not in the EAX register). Otherwise, the original

7-4

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

value of the destination operand is loaded in the EAX register. The status flags in the EFLAGS register reflect the

result that would have been obtained by subtracting the destination operand from the value in the EAX register.

The CMPXCHG instruction is commonly used for testing and modifying semaphores. It checks to see if a semaphore

is free. If the semaphore is free, it is marked allocated; otherwise it gets the ID of the current owner. This is all done

in one uninterruptible operation. In a single-processor system, the CMPXCHG instruction eliminates the need to

switch to protection level 0 (to disable interrupts) before executing multiple instructions to test and modify a sema-

phore.

For multiple processor systems, CMPXCHG can be combined with the LOCK prefix to perform the compare and

exchange operation atomically. (See “Locked Atomic Operations” in Chapter 11, “Multiple-Processor Management,”

of the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information on atomic

operations.)

The CMPXCHG8B instruction also requires three operands: a 64-bit value in EDX:EAX, a 64-bit value in ECX:EBX,

and a destination operand in memory. The instruction compares the 64-bit value in the EDX:EAX registers with the

destination operand. If they are equal, the 64-bit value in the ECX:EBX registers is stored in the destination

operand. If the EDX:EAX registers and the destination are not equal, the destination is loaded in the EDX:EAX

registers. The CMPXCHG8B instruction can be combined with the LOCK prefix to perform the operation atomically.

7.3.1.3

Exchange Instructions in 64-Bit Mode

The CMPXCHG16B instruction is available in 64-bit mode only. It is an extension of the functionality provided by

CMPXCHG8B that operates on 128-bits of data.

7.3.1.4

Stack Manipulation Instructions

The PUSH, POP, PUSHA (push all registers), and POPA (pop all registers) instructions move data to and from the

stack. The PUSH instruction decrements the stack pointer (contained in the ESP register), then copies the source

operand to the top of stack (see Figure 7-1). It operates on memory operands, immediate operands, and register

operands (including segment registers). The PUSH instruction is commonly used to place parameters on the stack

before calling a procedure. It can also be used to reserve space on the stack for temporary variables.

Stack

Before Pushing Doubleword

After Pushing Doubleword

Stack

Growth

31

0

31

0

n

ESP

n - 4

Doubleword V

alue

ESP

n - 8

Figure 7-1. Operation of the PUSH Instruction

The PUSHA instruction saves the contents of the eight general-purpose registers on the stack (see Figure 7-2).

This instruction simplifies procedure calls by reducing the number of instructions required to save the contents of

the general-purpose registers. The registers are pushed on the stack in the following order: EAX, ECX, EDX, EBX,

the initial value of ESP before EAX was pushed, EBP, ESI, and EDI.

Vol. 1

7-5

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

Stack

Before Pushing Registers

After Pushing Registers

Stack

31

0

31

0

Growth

n

n - 4

ESP

n - 8

EAX

n - 12

ECX

n - 16

EDX

n - 20

EBX

n - 24

Old ESP

n - 28

EBP

n - 32

ESI

n - 36

EDI

ESP

Figure 7-2. Operation of the PUSHA Instruction

The POP instruction copies the word or doubleword at the current top of stack (indicated by the ESP register) to the

location specified with the destination operand. It then increments the ESP register to point to the new top of stack

(see Figure 7-3). The destination operand may specify a general-purpose register, a segment register, or a memory

location.

Stack

Before Popping Doubleword

After Popping Doubleword

Stack

31

0

31

0

Growth

n

n - 4

ESP

n - 8

Doubleword V

alue

ESP

Figure 7-3. Operation of the POP Instruction

The POPA instruction reverses the effect of the PUSHA instruction. It pops the top eight words or doublewords from

the top of the stack into the general-purpose registers, except for the ESP register (see Figure 7-4). If the operand-

size attribute is 32, the doublewords on the stack are transferred to the registers in the following order: EDI, ESI,

EBP, ignore doubleword, EBX, EDX, ECX, and EAX. The ESP register is restored by the action of popping the stack.

If the operand-size attribute is 16, the words on the stack are transferred to the registers in the following order: DI,

SI, BP, ignore word, BX, DX, CX, and AX.

7-6

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

Stack

Before Popping Registers

After Popping Registers

0

31

0

31

Stack

Growth

n

n - 4

ESP

n - 8

EAX

n - 12

ECX

n - 16

EDX

n - 20

EBX

n - 24

Ignored

n - 28

EBP

n - 32

ESI

n - 36

EDI

ESP

Figure 7-4. Operation of the POPA Instruction

7.3.1.5

Stack Manipulation Instructions in 64-Bit Mode

In 64-bit mode, the stack pointer size is 64 bits and cannot be overridden by an instruction prefix. In implicit stack

references, address-size overrides are ignored. Pushes and pops of 32-bit values on the stack are not possible in

64-bit mode. 16-bit pushes and pops are supported by using the 66H operand-size prefix. PUSHA, PUSHAD, POPA,

and POPAD are not supported.

7.3.1.6

Type Conversion Instructions

The type conversion instructions convert bytes into words, words into doublewords, and doublewords into quad-

words. These instructions are especially useful for converting integers to larger integer formats, because they

perform sign extension (see Figure 7-5).

Two kinds of type conversion instructions are provided: simple conversion and move and convert.

15

0

Before Sign

S

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Extension

31

15

0

After Sign

S

S

S

S

S

S

S

S

S

S

S

S

S

S

S

S

S

N

N

N

N

N

N

N

N

N

N

N

N

N

N

N

Extension

Figure 7-5. Sign Extension

Simple conversion - The CBW (convert byte to word), CWDE (convert word to doubleword extended), CWD

(convert word to doubleword), and CDQ (convert doubleword to quadword) instructions perform sign extension to

double the size of the source operand.

The CBW instruction copies the sign (bit 7) of the byte in the AL register into every bit position of the upper byte of

the AX register. The CWDE instruction copies the sign (bit 15) of the word in the AX register into every bit position

of the high word of the EAX register.

The CWD instruction copies the sign (bit 15) of the word in the AX register into every bit position in the DX register.

The CDQ instruction copies the sign (bit 31) of the doubleword in the EAX register into every bit position in the EDX

register. The CWD instruction can be used to produce a doubleword dividend from a word before a word division,

and the CDQ instruction can be used to produce a quadword dividend from a doubleword before doubleword divi-

sion.

Vol. 1

7-7

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

Initial State

CF

Operand

X

1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1 1

After 1-bit SHL/SAL Instruction

1

0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1 1 0

After 10-bit SHL/SAL Instruction

0

0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1 1 0 0 0 0 0 0 0 0 0 0

Figure 7-6. SHL/SAL Instruction Operation

The SHR instruction shifts the source operand right by from 1 to 31 bit positions (see Figure 7-7). As with the

SHL/SAL instruction, the empty bit positions are cleared and the CF flag is loaded with the last bit shifted out of the

operand.

Initial State

Operand

CF

1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1 1

X

After 1-bit SHR Instruction

0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1

1

After 10-bit SHR Instruction

0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0

0

Figure 7-7. SHR Instruction Operation

The SAR instruction shifts the source operand right by from 1 to 31 bit positions (see Figure 7-8). This instruction

differs from the SHR instruction in that it preserves the sign of the source operand by clearing empty bit positions

if the operand is positive or setting the empty bits if the operand is negative. Again, the CF flag is loaded with the

last bit shifted out of the operand.

The SAR and SHR instructions can also be used to perform division by powers of 2 (see “SAL/SAR/SHL/SHR-Shift

Instructions” in Chapter 4, “Instruction Set Reference, M-U,” of the Intel^® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 2B).

Vol. 1

7-11

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

Initial State (Positive Operand)

Operand

CF

0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1

X

After 1-bit SAR Instruction

0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1

1

Initial State (Negative Operand)

CF

1 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1 1

X

After 1-bit SAR Instruction

1 1 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 1 1

1

Figure 7-8. SAR Instruction Operation

7.3.6.2

Double-Shift Instructions

The SHLD (shift left double) and SHRD (shift right double) instructions shift a specified number of bits from one

operand to another (see Figure 7-9). They are provided to facilitate operations on unaligned bit strings. They can

also be used to implement a variety of bit string move operations.

SHLD Instruction

31

0

CF

Destination (Memory or Register)

31

0

Source (Register)

SHRD Instruction

31

0

Source (Register)

31

0

Destination (Memory or Register)

CF

Figure 7-9. SHLD and SHRD Instruction Operations

The SHLD instruction shifts the bits in the destination operand to the left and fills the empty bit positions (in the

destination operand) with bits shifted out of the source operand. The destination and source operands must be the

same length (either words or doublewords). The shift count can range from 0 to 31 bits. The result of this shift

operation is stored in the destination operand, and the source operand is not modified. The CF flag is loaded with

the last bit shifted out of the destination operand.

The SHRD instruction operates the same as the SHLD instruction except bits are shifted to the right in the destina-

tion operand, with the empty bit positions filled with bits shifted out of the source operand.

7-12

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

7.3.6.3

Rotate Instructions

The ROL (rotate left), ROR (rotate right), RCL (rotate through carry left) and RCR (rotate through carry right)

instructions rotate the bits in the destination operand out of one end and back through the other end (see

Figure 7-10). Unlike a shift, no bits are lost during a rotation. The rotate count can range from 0 to 31.

ROL Instruction

31

0

CF

Destination (Memory or Register)

ROR Instruction

31

0

Destination (Memory or Register)

CF

RCL Instruction

31

0

CF

Destination (Memory or Register)

RCR Instruction

31

0

Destination (Memory or Register)

CF

Figure 7-10. ROL, ROR, RCL, and RCR Instruction Operations

The ROL instruction rotates the bits in the operand to the left (toward more significant bit locations). The ROR

instruction rotates the operand right (toward less significant bit locations).

The RCL instruction rotates the bits in the operand to the left, through the CF flag. This instruction treats the CF flag

as a one-bit extension on the upper end of the operand. Each bit that exits from the most significant bit location of

the operand moves into the CF flag. At the same time, the bit in the CF flag enters the least significant bit location

of the operand.

The RCR instruction rotates the bits in the operand to the right through the CF flag.

For all the rotate instructions, the CF flag always contains the value of the last bit rotated out of the operand, even

if the instruction does not use the CF flag as an extension of the operand. The value of this flag can then be tested

by a conditional jump instruction (JC or JNC).

7.3.7

Bit and Byte Instructions

These instructions operate on bit or byte strings. For the purpose of this discussion, they are further divided into

subordinate subgroups that:

• Test and modify a single bit.

• Scan a bit string.

• Set a byte given conditions.

• Test operands and report results.

Vol. 1

7-13

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

7.3.7.1

Bit Test and Modify Instructions

The bit test and modify instructions (see Table 7-3) operate on a single bit, which can be in an operand. The loca-

tion of the bit is specified as an offset from the least significant bit of the operand. When the processor identifies

the bit to be tested and modified, it first loads the CF flag with the current value of the bit. Then it assigns a new

value to the selected bit, as determined by the modify operation for the instruction.

Table 7-3. Bit Test and Modify Instructions

Instruction

Effect on CF Flag

Effect on Selected Bit

BT (Bit Test)

CF flag ← Selected Bit

No effect

BTS (Bit Test and Set)

CF flag ← Selected Bit

Selected Bit ← 1

BTR (Bit Test and Reset)

CF flag ← Selected Bit

Selected Bit ← 0

BTC (Bit Test and Complement)

CF flag ← Selected Bit

Selected Bit ← NOT (Selected Bit)

7.3.7.2

Bit Scan Instructions

The BSF (bit scan forward) and BSR (bit scan reverse) instructions scan a bit string in a source operand for a set bit

and store the bit index of the first set bit found in a destination register. The bit index is the offset from the least

significant bit (bit 0) in the bit string to the first set bit. The BSF instruction scans the source operand low-to-high

(from bit 0 of the source operand toward the most significant bit); the BSR instruction scans high-to-low (from the

most significant bit toward the least significant bit).

7.3.7.3

Byte Set on Condition Instructions

The SETcc (set byte on condition) instructions set a destination-operand byte to 0 or 1, depending on the state of

selected status flags (CF, OF, SF, ZF, and PF) in the EFLAGS register. The suffix (cc) added to the SET mnemonic

determines the condition being tested for.

For example, the SETO instruction tests for overflow. If the OF flag is set, the destination byte is set to 1; if OF is

clear, the destination byte is cleared to 0. Appendix B, “EFLAGS Condition Codes,” lists the conditions it is possible

to test for with this instruction.

7.3.7.4

Test Instruction

The TEST instruction performs a logical AND of two operands and sets the SF, ZF, and PF flags according to the

results. The flags can then be tested by the conditional jump or loop instructions or the SETcc instructions. The

TEST instruction differs from the AND instruction in that it does not alter either of the operands.

7.3.8

Control Transfer Instructions

The processor provides both conditional and unconditional control transfer instructions to direct the flow of

program execution. Conditional transfers are taken only for specified states of the status flags in the EFLAGS

register. Unconditional control transfers are always executed.

For the purpose of this discussion, these instructions are further divided into subordinate subgroups that process:

• Unconditional transfers.

• Conditional transfers.

• Software interrupts.

7.3.8.1

Unconditional Transfer Instructions

The JMP, CALL, RET, INT, and IRET instructions transfer program control to another location (destination address)

in the instruction stream. The destination can be within the same code segment (near transfer) or in a different

code segment (far transfer).

7-14

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

Table 7-4. Conditional Jump Instructions

Instruction Mnemonic

Condition (Flag States)

Description

Unsigned Conditional Jumps

JA/JNBE

(CF or ZF) = 0

Above/not below or equal

JAE/JNB

CF = 0

Above or equal/not below

JB/JNAE

CF = 1

Below/not above or equal

JBE/JNA

(CF or ZF) = 1

Below or equal/not above

JC

CF = 1

Carry

JE/JZ

ZF = 1

Equal/zero

JNC

CF = 0

Not carry

JNE/JNZ

ZF = 0

Not equal/not zero

JNP/JPO

PF = 0

Not parity/parity odd

JP/JPE

PF = 1

Parity/parity even

JCXZ

CX = 0

Register CX is zero

JECXZ

ECX = 0

Register ECX is zero

Signed Conditional Jumps

JG/JNLE

((SF xor OF) or ZF) = 0

Greater/not less or equal

JGE/JNL

(SF xor OF) = 0

Greater or equal/not less

JL/JNGE

(SF xor OF) = 1

Less/not greater or equal

JLE/JNG

((SF xor OF) or ZF) = 1

Less or equal/not greater

JNO

OF = 0

Not overflow

JNS

SF = 0

Not sign (non-negative)

JO

OF = 1

Overflow

JS

SF = 1

Sign (negative)

The destination operand specifies a relative address (a signed offset with respect to the address in the EIP register)

that points to an instruction in the current code segment. The Jcc instructions do not support far transfers;

however, far transfers can be accomplished with a combination of a Jcc and a JMP instruction (see “Jcc-Jump if

Condition Is Met” in Chapter 3, “Instruction Set Reference, A-L,” of the Intel^® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 2A).

Table 7-4 shows the mnemonics for the Jcc instructions and the conditions being tested for each instruction. The

condition code mnemonics are appended to the letter “J” to form the mnemonic for a Jcc instruction. The instruc-

tions are divided into two groups: unsigned and signed conditional jumps. These groups correspond to the results

of operations performed on unsigned and signed integers respectively. Those instructions listed as pairs (for

example, JA/JNBE) are alternate names for the same instruction. Assemblers provide alternate names to make it

easier to read program listings.

The JCXZ and JECXZ instructions test the CX and ECX registers, respectively, instead of one or more status flags.

See “Jump if zero instructions” on page 7-17 for more information about these instructions.

Loop instructions - The LOOP, LOOPE (loop while equal), LOOPZ (loop while zero), LOOPNE (loop while not

equal), and LOOPNZ (loop while not zero) instructions are conditional jump instructions that use the value of the

ECX register as a count for the number of times to execute a loop. All the loop instructions decrement the count in

the ECX register each time they are executed and terminate a loop when zero is reached. The LOOPE, LOOPZ,

LOOPNE, and LOOPNZ instructions also accept the ZF flag as a condition for terminating the loop before the count

reaches zero.

The LOOP instruction decrements the contents of the ECX register (or the CX register, if the address-size attribute

is 16), then tests the register for the loop-termination condition. If the count in the ECX register is non-zero,

program control is transferred to the instruction address specified by the destination operand. The destination

7-16

Vol. 1

PROGRAMMING WITH GENERAL-PURPOSE INSTRUCTIONS

7.3.12 Enter and Leave Instructions

The ENTER and LEAVE instructions provide machine-language support for procedure calls in block-structured

languages, such as C and Pascal. These instructions and the call and return mechanism that they support are

described in detail in Section 6.6, “Procedure Calls for Block-Structured Languages.”

7.3.13 Flag Control (EFLAG) Instructions

The Flag Control (EFLAG) instructions allow the state of selected flags in the EFLAGS register to be read or modi-

fied. For the purpose of this discussion, these instructions are further divided into subordinate subgroups of

instructions that manipulate:

• Carry and direction flags.

• The EFLAGS register.

• Interrupt flags.

7.3.13.1 Carry and Direction Flag Instructions

The STC (set carry flag), CLC (clear carry flag), and CMC (complement carry flag) instructions allow the CF flag in

the EFLAGS register to be modified directly. They are typically used to initialize the CF flag to a known state before

an instruction that uses the flag in an operation is executed. They are also used in conjunction with the rotate-with-

carry instructions (RCL and RCR).

The STD (set direction flag) and CLD (clear direction flag) instructions allow the DF flag in the EFLAGS register to

be modified directly. The DF flag determines the direction in which index registers ESI and EDI are stepped when

executing string processing instructions. If the DF flag is clear, the index registers are incremented after each iter-

ation of a string instruction; if the DF flag is set, the registers are decremented.

7.3.13.2 EFLAGS Transfer Instructions

The EFLAGS transfer instructions allow groups of flags in the EFLAGS register to be copied to a register or memory

or be loaded from a register or memory.

The LAHF (load AH from flags) and SAHF (store AH into flags) instructions operate on five of the EFLAGS status

flags (SF, ZF, AF, PF, and CF). The LAHF instruction copies the status flags to bits 7, 6, 4, 2, and 0 of the AH register,

respectively. The contents of the remaining bits in the register (bits 5, 3, and 1) are unaffected, and the contents

of the EFLAGS register remain unchanged. The SAHF instruction copies bits 7, 6, 4, 2, and 0 from the AH register

into the SF, ZF, AF, PF, and CF flags, respectively in the EFLAGS register.

The PUSHF (push flags), PUSHFD (push flags double), POPF (pop flags), and POPFD (pop flags double) instructions

copy the flags in the EFLAGS register to and from the stack. The PUSHF instruction pushes the lower word of the

EFLAGS register onto the stack (see Figure 7-11). The PUSHFD instruction pushes the entire EFLAGS register onto

the stack (with the RF and VM flags read as clear).

PUSHFD/POPFD

PUSHF/POPF

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16

15 14 13 12 11 10 9

8

7

6

5

4

3

2

1

0

I

V

V

I

A

V

R

N

O

O

D

I

T

S

Z

A

P

C

0

0

0

0

0

0

0

0

0

0

I

I

0

0

0

1

D

C

M

F

T

P

F

F

F

F

F

F

F

F

F

P

F

L

Figure 7-11. Flags Affected by the PUSHF, POPF, PUSHFD, and POPFD Instructions

The POPF instruction pops a word from the stack into the EFLAGS register. Only bits 11, 10, 8, 7, 6, 4, 2, and 0 of

the EFLAGS register are affected with all uses of this instruction. If the current privilege level (CPL) of the current

Vol. 1

7-21