Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 87
INSTRUCTION SET REFERENCE, M-U
VPUNPCKLBW (EVEX.512 encoded instruction)
(KL, VL) = (16, 128), (32, 256), (64, 512)
IF VL = 128
TMP_DEST[VL-1:0] := INTERLEAVE_BYTES(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
IF VL = 256
TMP_DEST[VL-1:0] := INTERLEAVE_BYTES_256b(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
IF VL = 512
TMP_DEST[VL-1:0] := INTERLEAVE_BYTES_512b(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
FOR j := 0 TO KL-1
i := j * 8
IF k1[j] OR *no writemask*
THEN DEST[i+7:i] := TMP_DEST[i+7:i]
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+7:i] remains unchanged*
ELSE *zeroing-masking*
; zeroing-masking
DEST[i+7:i] := 0
FI
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
DEST[511:0] := INTERLEAVE_BYTES_512b(SRC1, SRC2)
PUNPCKLWD
DEST[127:0] := INTERLEAVE_WORDS(DEST, SRC)
DEST[255:127] (Unmodified)
VPUNPCKLWD (VEX.128 encoded instruction)
DEST[127:0] := INTERLEAVE_WORDS(SRC1, SRC2)
DEST[MAXVL-1:127] := 0
VPUNPCKLWD (VEX.256 encoded instruction)
DEST[255:0] := INTERLEAVE_WORDS_256b(SRC1, SRC2)
DEST[MAXVL-1:256] := 0
VPUNPCKLWD (EVEX.512 encoded instruction)
(KL, VL) = (8, 128), (16, 256), (32, 512)
IF VL = 128
TMP_DEST[VL-1:0] := INTERLEAVE_WORDS(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
IF VL = 256
TMP_DEST[VL-1:0] := INTERLEAVE_WORDS_256b(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
IF VL = 512
TMP_DEST[VL-1:0] := INTERLEAVE_WORDS_512b(SRC1[VL-1:0], SRC2[VL-1:0])
FI;
FOR j := 0 TO KL-1
i := j * 16
IF k1[j] OR *no writemask*
PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PUNPCKLQDQ—Unpack Low Data
Vol. 2B
4-517
INSTRUCTION SET REFERENCE, M-U
THEN DEST[i+15:i] := TMP_DEST[i+15:i]
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+15:i] remains unchanged*
ELSE *zeroing-masking*
; zeroing-masking
DEST[i+15:i] := 0
FI
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
DEST[511:0] := INTERLEAVE_WORDS_512b(SRC1, SRC2)
PUNPCKLDQ
DEST[127:0] := INTERLEAVE_DWORDS(DEST, SRC)
DEST[MAXVL-1:128] (Unmodified)
VPUNPCKLDQ (VEX.128 encoded instruction)
DEST[127:0] := INTERLEAVE_DWORDS(SRC1, SRC2)
DEST[MAXVL-1:128] := 0
VPUNPCKLDQ (VEX.256 encoded instruction)
DEST[255:0] := INTERLEAVE_DWORDS_256b(SRC1, SRC2)
DEST[MAXVL-1:256] := 0
VPUNPCKLDQ (EVEX encoded instructions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j := 0 TO KL-1
i := j * 32
IF (EVEX.b = 1) AND (SRC2 *is memory*)
THEN TMP_SRC2[i+31:i] := SRC2[31:0]
ELSE TMP_SRC2[i+31:i] := SRC2[i+31:i]
FI;
ENDFOR;
IF VL = 128
TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
IF VL = 256
TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
IF VL = 512
TMP_DEST[VL-1:0] := INTERLEAVE_DWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
FOR j := 0 TO KL-1
i := j * 32
IF k1[j] OR *no writemask*
THEN DEST[i+31:i] := TMP_DEST[i+31:i]
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+31:i] remains unchanged*
ELSE *zeroing-masking*
; zeroing-masking
DEST[i+31:i] := 0
FI
FI;
4-518
Vol. 2B
PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PUNPCKLQDQ—Unpack Low Data
INSTRUCTION SET REFERENCE, M-U
ENDFOR
DEST511:0] := INTERLEAVE_DWORDS_512b(SRC1, SRC2)
DEST[MAXVL-1:VL] := 0
PUNPCKLQDQ
DEST[127:0] := INTERLEAVE_QWORDS(DEST, SRC)
DEST[MAXVL-1:128] (Unmodified)
VPUNPCKLQDQ (VEX.128 encoded instruction)
DEST[127:0] := INTERLEAVE_QWORDS(SRC1, SRC2)
DEST[MAXVL-1:128] := 0
VPUNPCKLQDQ (VEX.256 encoded instruction)
DEST[255:0] := INTERLEAVE_QWORDS_256b(SRC1, SRC2)
DEST[MAXVL-1:256] := 0
VPUNPCKLQDQ (EVEX encoded instructions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j := 0 TO KL-1
i := j * 64
IF (EVEX.b = 1) AND (SRC2 *is memory*)
THEN TMP_SRC2[i+63:i] := SRC2[63:0]
ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i]
FI;
ENDFOR;
IF VL = 128
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
IF VL = 256
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS_256b(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
IF VL = 512
TMP_DEST[VL-1:0] := INTERLEAVE_QWORDS_512b(SRC1[VL-1:0], TMP_SRC2[VL-1:0])
FI;
FOR j := 0 TO KL-1
i := j * 64
IF k1[j] OR *no writemask*
THEN DEST[i+63:i] := TMP_DEST[i+63:i]
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+63:i] remains unchanged*
ELSE *zeroing-masking*
; zeroing-masking
DEST[i+63:i] := 0
FI
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
Intel C/C++ Compiler Intrinsic Equivalents
VPUNPCKLBW __m512i _mm512_unpacklo_epi8(__m512i a, __m512i b);
VPUNPCKLBW __m512i _mm512_mask_unpacklo_epi8(__m512i s, __mmask64 k, __m512i a, __m512i b);
VPUNPCKLBW __m512i _mm512_maskz_unpacklo_epi8( __mmask64 k, __m512i a, __m512i b);
VPUNPCKLBW __m256i _mm256_mask_unpacklo_epi8(__m256i s, __mmask32 k, __m256i a, __m256i b);
PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PUNPCKLQDQ—Unpack Low Data
Vol. 2B
4-519
INSTRUCTION SET REFERENCE, M-U
VPUNPCKLBW __m256i _mm256_maskz_unpacklo_epi8( __mmask32 k, __m256i a, __m256i b);
VPUNPCKLBW __m128i _mm_mask_unpacklo_epi8(v s, __mmask16 k, __m128i a, __m128i b);
VPUNPCKLBW __m128i _mm_maskz_unpacklo_epi8( __mmask16 k, __m128i a, __m128i b);
VPUNPCKLWD __m512i _mm512_unpacklo_epi16(__m512i a, __m512i b);
VPUNPCKLWD __m512i _mm512_mask_unpacklo_epi16(__m512i s, __mmask32 k, __m512i a, __m512i b);
VPUNPCKLWD __m512i _mm512_maskz_unpacklo_epi16( __mmask32 k, __m512i a, __m512i b);
VPUNPCKLWD __m256i _mm256_mask_unpacklo_epi16(__m256i s, __mmask16 k, __m256i a, __m256i b);
VPUNPCKLWD __m256i _mm256_maskz_unpacklo_epi16( __mmask16 k, __m256i a, __m256i b);
VPUNPCKLWD __m128i _mm_mask_unpacklo_epi16(v s, __mmask8 k, __m128i a, __m128i b);
VPUNPCKLWD __m128i _mm_maskz_unpacklo_epi16( __mmask8 k, __m128i a, __m128i b);
VPUNPCKLDQ __m512i _mm512_unpacklo_epi32(__m512i a, __m512i b);
VPUNPCKLDQ __m512i _mm512_mask_unpacklo_epi32(__m512i s, __mmask16 k, __m512i a, __m512i b);
VPUNPCKLDQ __m512i _mm512_maskz_unpacklo_epi32( __mmask16 k, __m512i a, __m512i b);
VPUNPCKLDQ __m256i _mm256_mask_unpacklo_epi32(__m256i s, __mmask8 k, __m256i a, __m256i b);
VPUNPCKLDQ __m256i _mm256_maskz_unpacklo_epi32( __mmask8 k, __m256i a, __m256i b);
VPUNPCKLDQ __m128i _mm_mask_unpacklo_epi32(v s, __mmask8 k, __m128i a, __m128i b);
VPUNPCKLDQ __m128i _mm_maskz_unpacklo_epi32( __mmask8 k, __m128i a, __m128i b);
VPUNPCKLQDQ __m512i _mm512_unpacklo_epi64(__m512i a, __m512i b);
VPUNPCKLQDQ __m512i _mm512_mask_unpacklo_epi64(__m512i s, __mmask8 k, __m512i a, __m512i b);
VPUNPCKLQDQ __m512i _mm512_maskz_unpacklo_epi64( __mmask8 k, __m512i a, __m512i b);
VPUNPCKLQDQ __m256i _mm256_mask_unpacklo_epi64(__m256i s, __mmask8 k, __m256i a, __m256i b);
VPUNPCKLQDQ __m256i _mm256_maskz_unpacklo_epi64( __mmask8 k, __m256i a, __m256i b);
VPUNPCKLQDQ __m128i _mm_mask_unpacklo_epi64(__m128i s, __mmask8 k, __m128i a, __m128i b);
VPUNPCKLQDQ __m128i _mm_maskz_unpacklo_epi64( __mmask8 k, __m128i a, __m128i b);
PUNPCKLBW:__m64 _mm_unpacklo_pi8 (__m64 m1, __m64 m2)
(V)PUNPCKLBW:__m128i _mm_unpacklo_epi8 (__m128i m1, __m128i m2)
VPUNPCKLBW:__m256i _mm256_unpacklo_epi8 (__m256i m1, __m256i m2)
PUNPCKLWD:__m64 _mm_unpacklo_pi16 (__m64 m1, __m64 m2)
(V)PUNPCKLWD:__m128i _mm_unpacklo_epi16 (__m128i m1, __m128i m2)
VPUNPCKLWD:__m256i _mm256_unpacklo_epi16 (__m256i m1, __m256i m2)
PUNPCKLDQ:__m64 _mm_unpacklo_pi32 (__m64 m1, __m64 m2)
(V)PUNPCKLDQ:__m128i _mm_unpacklo_epi32 (__m128i m1, __m128i m2)
VPUNPCKLDQ:__m256i _mm256_unpacklo_epi32 (__m256i m1, __m256i m2)
(V)PUNPCKLQDQ:__m128i _mm_unpacklo_epi64 (__m128i m1, __m128i m2)
VPUNPCKLQDQ:__m256i _mm256_unpacklo_epi64 (__m256i m1, __m256i m2)
Flags Affected
None.
Numeric Exceptions
None.
Other Exceptions
Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions”.
EVEX-encoded VPUNPCKLDQ/QDQ, see Table 2-50, “Type E4NF Class Exception Conditions”.
EVEX-encoded VPUNPCKLBW/WD, see Exceptions Type E4NF.nb in Table 2-50, “Type E4NF Class Exception Condi-
tions”.
4-520
Vol. 2B
PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PUNPCKLQDQ—Unpack Low Data
INSTRUCTION SET REFERENCE, M-U
PUSH—Push Word, Doubleword, or Quadword Onto the Stack
Opcode1
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
FF /6
PUSH r/m16
M
Valid
Valid
Push r/m16.
FF /6
PUSH r/m32
M
N.E.
Valid
Push r/m32.
FF /6
PUSH r/m64
M
Valid
N.E.
Push r/m64.
50+rw
PUSH r16
O
Valid
Valid
Push r16.
50+rd
PUSH r32
O
N.E.
Valid
Push r32.
50+rd
PUSH r64
O
Valid
N.E.
Push r64.
6A ib
PUSH imm8
I
Valid
Valid
Push imm8.
68 iw
PUSH imm16
I
Valid
Valid
Push imm16.
68 id
PUSH imm32
I
Valid
Valid
Push imm32.
0E
PUSH CS
ZO
Invalid
Valid
Push CS.
16
PUSH SS
ZO
Invalid
Valid
Push SS.
1E
PUSH DS
ZO
Invalid
Valid
Push DS.
06
PUSH ES
ZO
Invalid
Valid
Push ES.
0F A0
PUSH FS
ZO
Valid
Valid
Push FS.
0F A8
PUSH GS
ZO
Valid
Valid
Push GS.
NOTES:
1. See the IA-32 Architecture Compatibility section below.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
M
ModRM:r/m (r)
N/A
N/A
N/A
O
opcode + rd (r)
N/A
N/A
N/A
I
imm8/16/32
N/A
N/A
N/A
ZO
N/A
N/A
N/A
N/A
Description
Decrements the stack pointer and then stores the source operand on the top of the stack. Address and operand
sizes are determined and used as follows:
• Address size. The D flag in the current code-segment descriptor determines the default address size; it may be
overridden by an instruction prefix (67H).
The address size is used only when referencing a source operand in memory.
• Operand size. The D flag in the current code-segment descriptor determines the default operand size; it may
be overridden by instruction prefixes (66H or REX.W).
The operand size (16, 32, or 64 bits) determines the amount by which the stack pointer is decremented (2, 4
or 8).
If the source operand is an immediate of size less than the operand size, a sign-extended value is pushed on
the stack. If the source operand is a segment register (16 bits) and the operand size is 64-bits, a zero-
extended value is pushed on the stack; if the operand size is 32-bits, either a zero-extended value is pushed
on the stack or the segment selector is written on the stack using a 16-bit move. For the last case, all recent
Intel Core and Intel Atom processors perform a 16-bit move, leaving the upper portion of the stack location
unmodified.
PUSH—Push Word, Doubleword, or Quadword Onto the Stack
Vol. 2B
4-521
INSTRUCTION SET REFERENCE, M-U
• Stack-address size. Outside of 64-bit mode, the B flag in the current stack-segment descriptor determines the
size of the stack pointer (16 or 32 bits); in 64-bit mode, the size of the stack pointer is always 64 bits.
The stack-address size determines the width of the stack pointer when writing to the stack in memory and
when decrementing the stack pointer.
(As stated above, the amount by which the stack pointer is
decremented is determined by the operand size.)
If the operand size is less than the stack-address size, the PUSH instruction may result in a misaligned stack
pointer (a stack pointer that is not aligned on a doubleword or quadword boundary).
The PUSH ESP instruction pushes the value of the ESP register as it existed before the instruction was executed. If
a PUSH instruction uses a memory operand in which the ESP register is used for computing the operand address,
the address of the operand is computed before the ESP register is decremented.
If the ESP or SP register is 1 when the PUSH instruction is executed in real-address mode, a stack-fault exception
(#SS) is generated (because the limit of the stack segment is violated). Its delivery encounters a second stack-
fault exception (for the same reason), causing generation of a double-fault exception (#DF). Delivery of the
double-fault exception encounters a third stack-fault exception, and the logical processor enters shutdown mode.
See the discussion of the double-fault exception in Chapter 6 of the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 3A.
IA-32 Architecture Compatibility
For IA-32 processors from the Intel 286 on, the PUSH ESP instruction pushes the value of the ESP register as it
existed before the instruction was executed. (This is also true for Intel 64 architecture, real-address and virtual-
8086 modes of IA-32 architecture.) For the Intel® 8086 processor, the PUSH SP instruction pushes the new value
of the SP register (that is the value after it has been decremented by 2).
Operation
(* See Description section for possible sign-extension or zero-extension of source operand and for *)
(* a case in which the size of the memory store may be smaller than the instruction’s operand size *)
IF StackAddrSize = 64
THEN
IF OperandSize = 64
THEN
RSP := RSP - 8;
Memory[SS:RSP] := SRC;
(* push quadword *)
ELSE IF OperandSize = 32
THEN
RSP := RSP - 4;
Memory[SS:RSP] := SRC;
(* push dword *)
ELSE (* OperandSize = 16 *)
RSP := RSP - 2;
Memory[SS:RSP] := SRC;
(* push word *)
FI;
ELSE IF StackAddrSize = 32
THEN
IF OperandSize = 64
THEN
ESP := ESP - 8;
Memory[SS:ESP] := SRC;
(* push quadword *)
ELSE IF OperandSize = 32
THEN
ESP := ESP - 4;
Memory[SS:ESP] := SRC;
(* push dword *)
ELSE (* OperandSize = 16 *)
ESP := ESP - 2;
Memory[SS:ESP] := SRC;
(* push word *)
4-522
Vol. 2B
PUSH—Push Word, Doubleword, or Quadword Onto the Stack
INSTRUCTION SET REFERENCE, M-U
FI;
ELSE (* StackAddrSize = 16 *)
IF OperandSize = 32
THEN
SP := SP - 4;
Memory[SS:SP] := SRC;
(* push dword *)
ELSE (* OperandSize = 16 *)
SP := SP - 2;
Memory[SS:SP] := SRC;
(* push word *)
FI;
FI;
Flags Affected
None.
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
If the new value of the SP or ESP register is outside the stack segment limit.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#GP(0)
If the memory address is in a non-canonical form.
#SS(0)
If the stack address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
If the PUSH is of CS, SS, DS, or ES.
PUSH—Push Word, Doubleword, or Quadword Onto the Stack
Vol. 2B
4-523
INSTRUCTION SET REFERENCE, M-U
PUSHA/PUSHAD—Push All General-Purpose Registers
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
60
PUSHA
ZO
Invalid
Valid
Push AX, CX, DX, BX, original SP, BP, SI, and DI.
60
PUSHAD
ZO
Invalid
Valid
Push EAX, ECX, EDX, EBX, original ESP, EBP,
ESI, and EDI.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
Pushes the contents of the general-purpose registers onto the stack. The registers are stored on the stack in the
following order: EAX, ECX, EDX, EBX, ESP (original value), EBP, ESI, and EDI (if the current operand-size attribute
is 32) and AX, CX, DX, BX, SP (original value), BP, SI, and DI (if the operand-size attribute is 16). These instruc-
tions perform the reverse operation of the POPA/POPAD instructions. The value pushed for the ESP or SP register is
its value before prior to pushing the first register (see the “Operation” section below).
The PUSHA (push all) and PUSHAD (push all double) mnemonics reference the same opcode. The PUSHA instruc-
tion is intended for use when the operand-size attribute is 16 and the PUSHAD instruction for when the operand-
size attribute is 32. Some assemblers may force the operand size to 16 when PUSHA is used and to 32 when
PUSHAD is used. Others may treat these mnemonics as synonyms (PUSHA/PUSHAD) and use the current setting
of the operand-size attribute to determine the size of values to be pushed from the stack, regardless of the
mnemonic used.
In the real-address mode, if the ESP or SP register is 1, 3, or 5 when PUSHA/PUSHAD executes: an #SS exception
is generated but not delivered (the stack error reported prevents #SS delivery). Next, the processor generates a
#DF exception and enters a shutdown state as described in the #DF discussion in Chapter 6 of the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 3A.
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.
Operation
IF 64-bit Mode
THEN #UD
FI;
IF OperandSize = 32 (* PUSHAD instruction *)
THEN
Temp := (ESP);
Push(EAX);
Push(ECX);
Push(EDX);
Push(EBX);
Push(Temp);
Push(EBP);
Push(ESI);
Push(EDI);
ELSE (* OperandSize = 16, PUSHA instruction *)
Temp := (SP);
Push(AX);
Push(CX);
Push(DX);
4-524
Vol. 2B
PUSHA/PUSHAD—Push All General-Purpose Registers
INSTRUCTION SET REFERENCE, M-U
Push(BX);
Push(Temp);
Push(BP);
Push(SI);
Push(DI);
FI;
Flags Affected
None.
Protected Mode Exceptions
#SS(0)
If the starting or ending stack address is outside the stack segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If an unaligned memory reference is made while the current privilege level is 3 and alignment
checking is enabled.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP
If the ESP or SP register contains 7, 9, 11, 13, or 15.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If the ESP or SP register contains 7, 9, 11, 13, or 15.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If an unaligned memory reference is made while alignment checking is enabled.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If in 64-bit mode.
PUSHA/PUSHAD—Push All General-Purpose Registers
Vol. 2B
4-525
INSTRUCTION SET REFERENCE, M-U
PUSHF/PUSHFD/PUSHFQ—Push EFLAGS Register Onto the Stack
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
9C
PUSHF
ZO
Valid
Valid
Push lower 16 bits of EFLAGS.
9C
PUSHFD
ZO
N.E.
Valid
Push EFLAGS.
9C
PUSHFQ
ZO
Valid
N.E.
Push RFLAGS.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
Decrements the stack pointer by 4 (if the current operand-size attribute is 32) and pushes the entire contents of
the EFLAGS register onto the stack, or decrements the stack pointer by 2 (if the operand-size attribute is 16) and
pushes the lower 16 bits of the EFLAGS register (that is, the FLAGS register) onto the stack. These instructions
reverse the operation of the POPF/POPFD instructions.
When copying the entire EFLAGS register to the stack, the VM and RF flags (bits 16 and 17) are not copied; instead,
the values for these flags are cleared in the EFLAGS image stored on the stack. See Chapter 3 of the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 1, for more information about the EFLAGS register.
The PUSHF (push flags) and PUSHFD (push flags double) mnemonics reference the same opcode. The PUSHF
instruction is intended for use when the operand-size attribute is 16 and the PUSHFD instruction for when the
operand-size attribute is 32. Some assemblers may force the operand size to 16 when PUSHF is used and to 32
when PUSHFD is used. Others may treat these mnemonics as synonyms (PUSHF/PUSHFD) and use the current
setting of the operand-size attribute to determine the size of values to be pushed from the stack, regardless of the
mnemonic used.
In 64-bit mode, the instruction’s default operation is to decrement the stack pointer (RSP) by 8 and pushes RFLAGS
on the stack. 16-bit operation is supported using the operand size override prefix 66H. 32-bit operand size cannot
be encoded in this mode. When copying RFLAGS to the stack, the VM and RF flags (bits 16 and 17) are not copied;
instead, values for these flags are cleared in the RFLAGS image stored on the stack.
When operating in virtual-8086 mode (EFLAGS.VM = 1) without the virtual-8086 mode extensions (CR4.VME = 0),
the PUSHF/PUSHFD instructions can be used only if IOPL = 3; otherwise, a general-protection exception (#GP)
occurs. If the virtual-8086 mode extensions are enabled (CR4.VME = 1), PUSHF (but not PUSHFD) can be executed
in virtual-8086 mode with IOPL < 3.
(The protected-mode virtual-interrupt feature — enabled by setting CR4.PVI — affects the CLI and STI instructions
in the same manner as the virtual-8086 mode extensions. PUSHF, however, is not affected by CR4.PVI.)
In the real-address mode, if the ESP or SP register is 1 when PUSHF/PUSHFD instruction executes: an #SS excep-
tion is generated but not delivered (the stack error reported prevents #SS delivery). Next, the processor generates
a #DF exception and enters a shutdown state as described in the #DF discussion in Chapter 6 of the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 3A.
4-526
Vol. 2B
PUSHF/PUSHFD/PUSHFQ—Push EFLAGS Register Onto the Stack
INSTRUCTION SET REFERENCE, M-U
Operation
IF (PE = 0) or (PE = 1 and ((VM = 0) or (VM = 1 and IOPL = 3)))
(* Real-Address Mode, Protected mode, or Virtual-8086 mode with IOPL equal to 3 *)
THEN
IF OperandSize = 32
THEN
push (EFLAGS AND 00FCFFFFH);
(* VM and RF bits are cleared in image stored on the stack *)
ELSE
push (EFLAGS); (* Lower 16 bits only *)
FI;
ELSE IF 64-bit MODE (* In 64-bit Mode *)
IF OperandSize = 64
THEN
push (RFLAGS AND 00000000_00FCFFFFH);
(* VM and RF bits are cleared in image stored on the stack; *)
ELSE
push (EFLAGS); (* Lower 16 bits only *)
FI;
ELSE (* In Virtual-8086 Mode with IOPL less than 3 *)
IF (CR4.VME = 0) OR (OperandSize = 32)
THEN #GP(0); (* Trap to virtual-8086 monitor *)
ELSE
tempFLAGS = EFLAGS[15:0];
tempFLAGS[9] = tempFLAGS[19];
(* VIF replaces IF *)
tempFlags[13:12] = 3;
(* IOPL is set to 3 in image stored on the stack *)
push (tempFLAGS);
FI;
FI;
Flags Affected
None.
Protected Mode Exceptions
#SS(0)
If the new value of the ESP register is outside the stack segment boundary.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If an unaligned memory reference is made while CPL = 3 and alignment checking is enabled.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If the I/O privilege level is less than 3.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If an unaligned memory reference is made while alignment checking is enabled.
#UD
If the LOCK prefix is used.
PUSHF/PUSHFD/PUSHFQ—Push EFLAGS Register Onto the Stack
Vol. 2B
4-527