hw/i386.reference/RET.htm

   1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   2 <HTML>
   3 <HEAD>
   4 <TITLE>80386 Programmer's Reference Manual -- Opcode RET</TITLE>
   5 </HEAD>
   6 <BODY>
   7 <B>up:</B> <A HREF="c17.htm">
   8 Chapter 17 -- 80386 Instruction Set</A><BR>
   9 <B>prev:</B><A HREF="REP.htm"> REP/REPE/REPZ/REPNE/REPNZ Repeat Following String Operation</A><BR>
  10 <B>next:</B><A HREF="SAHF.htm"> SAHF Store AH into Flags</A>
  11 <P>
  12 <HR>
  13 <P>
  14 <H1>RET -- Return from Procedure</H1>
  15
  16 <PRE>
  17 Opcode     Instruction  Clocks         Description
  18
  19 C3         RET          10+m           Return (near) to caller
  20 CB         RET          18+m,pm=32+m   Return (far) to caller, same
  21                                        privilege
  22 CB         RET          pm=68          Return (far), lesser privilege,
  23                                        switch stacks
  24 C2  iw     RET imm16    10+m           Return (near), pop imm16 bytes of
  25                                        parameters
  26 CA  iw     RET imm16    18+m,pm=32+m   Return (far), same privilege, pop
  27                                        imm16 bytes
  28 CA  iw     RET imm16    pm=68          Return (far), lesser privilege, pop
  29                                        imm16 bytes
  30 </PRE>
  31
  32
  33 <H2>Operation</H2>
  34
  35 <PRE>
  36 IF instruction = near RET
  37 THEN;
  38    IF OperandSize = 16
  39    THEN
  40       IP := Pop();
  41       EIP := EIP AND 0000FFFFH;
  42    ELSE (* OperandSize = 32 *)
  43       EIP := Pop();
  44    FI;
  45    IF instruction has immediate operand THEN eSP := eSP + imm16; FI;
  46 FI;
  47
  48 IF (PE = 0 OR (PE = 1 AND VM = 1))
  49    (* real mode or virtual 8086 mode *)
  50    AND instruction = far RET
  51 THEN;
  52    IF OperandSize = 16
  53    THEN
  54       IP := Pop();
  55       EIP := EIP AND 0000FFFFH;
  56       CS := Pop(); (* 16-bit pop *)
  57    ELSE (* OperandSize = 32 *)
  58       EIP := Pop();
  59       CS := Pop(); (* 32-bit pop, high-order 16-bits discarded *)
  60    FI;
  61    IF instruction has immediate operand THEN eSP := eSP + imm16; FI;
  62 FI;
  63
  64 IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *)
  65    AND instruction = far RET
  66 THEN
  67    IF OperandSize=32
  68    THEN Third word on stack must be within stack limits else #SS(0);
  69    ELSE Second word on stack must be within stack limits else #SS(0);
  70    FI;
  71    Return selector RPL must be >= CPL ELSE #GP(return selector)
  72    IF return selector RPL = CPL
  73    THEN GOTO SAME-LEVEL;
  74    ELSE GOTO OUTER-PRIVILEGE-LEVEL;
  75    FI;
  76 FI;
  77
  78 SAME-LEVEL:
  79    Return selector must be non-null ELSE #GP(0)
  80    Selector index must be within its descriptor table limits ELSE
  81       #GP(selector)
  82    Descriptor AR byte must indicate code segment ELSE #GP(selector)
  83    IF non-conforming
  84    THEN code segment DPL must equal CPL;
  85    ELSE #GP(selector);
  86    FI;
  87    IF conforming
  88    THEN code segment DPL must be <= CPL;
  89    ELSE #GP(selector);
  90    FI;
  91    Code segment must be present ELSE #NP(selector);
  92    Top word on stack must be within stack limits ELSE #SS(0);
  93    IP must be in code segment limit ELSE #GP(0);
  94    IF OperandSize=32
  95    THEN
  96       Load CS:EIP from stack
  97       Load CS register with descriptor
  98       Increment eSP by 8 plus the immediate offset if it exists
  99    ELSE (* OperandSize=16 *)
 100       Load CS:IP from stack
 101       Load CS register with descriptor
 102       Increment eSP by 4 plus the immediate offset if it exists
 103    FI;
 104
 105 OUTER-PRIVILEGE-LEVEL:
 106    IF OperandSize=32
 107    THEN Top (16+immediate) bytes on stack must be within stack limits
 108       ELSE #SS(0);
 109    ELSE Top (8+immediate) bytes on stack must be within stack limits ELSE
 110       #SS(0);
 111    FI;
 112    Examine return CS selector and associated descriptor:
 113       Selector must be non-null ELSE #GP(0);
 114       Selector index must be within its descriptor table limits ELSE
 115          #GP(selector)
 116       Descriptor AR byte must indicate code segment ELSE #GP(selector);
 117       IF non-conforming
 118       THEN code segment DPL must equal return selector RPL
 119       ELSE #GP(selector);
 120       FI;
 121       IF conforming
 122       THEN code segment DPL must be <= return selector RPL;
 123       ELSE #GP(selector);
 124       FI;
 125       Segment must be present ELSE #NP(selector)
 126    Examine return SS selector and associated descriptor:
 127       Selector must be non-null ELSE #GP(0);
 128       Selector index must be within its descriptor table limits
 129          ELSE #GP(selector);
 130       Selector RPL must equal the RPL of the return CS selector ELSE
 131          #GP(selector);
 132       Descriptor AR byte must indicate a writable data segment ELSE
 133          #GP(selector);
 134       Descriptor DPL must equal the RPL of the return CS selector ELSE
 135          #GP(selector);
 136       Segment must be present ELSE #NP(selector);
 137    IP must be in code segment limit ELSE #GP(0);
 138    Set CPL to the RPL of the return CS selector;
 139    IF OperandMode=32
 140    THEN
 141       Load CS:EIP from stack;
 142       Set CS RPL to CPL;
 143       Increment eSP by 8 plus the immediate offset if it exists;
 144       Load SS:eSP from stack;
 145    ELSE (* OperandMode=16 *)
 146       Load CS:IP from stack;
 147       Set CS RPL to CPL;
 148       Increment eSP by 4 plus the immediate offset if it exists;
 149       Load SS:eSP from stack;
 150    FI;
 151    Load the CS register with the return CS descriptor;
 152    Load the SS register with the return SS descriptor;
 153    For each of ES, FS, GS, and DS
 154    DO
 155       IF the current register setting is not valid for the outer level,
 156          set the register to null (selector := AR := 0);
 157       To be valid, the register setting must satisfy the following
 158          properties:
 159          Selector index must be within descriptor table limits;
 160          Descriptor AR byte must indicate data or readable code segment;
 161          IF segment is data or non-conforming code, THEN
 162             DPL must be >= CPL, or DPL must be >= RPL;
 163       FI;
 164    OD;
 165 </PRE>
 166
 167 <H2>Description</H2>
 168
 169 RET transfers control to a return address located on the stack. The
 170 address is usually placed on the stack by a
 171 <A HREF="CALL.htm">CALL</A> instruction, and the
 172 return is made to the instruction that follows the
 173 <A HREF="CALL.htm">CALL</A>.
 174 <P>
 175 The optional numeric parameter to RET gives the number of stack bytes
 176 (OperandMode=16) or words (OperandMode=32) to be released after the return
 177 address is popped. These items are typically used as input parameters to the
 178 procedure called.
 179 <P>
 180 For the intrasegment (near) return, the address on the stack is a segment
 181 offset, which is popped into the instruction pointer. The CS register is
 182 unchanged. For the intersegment (far) return, the address on the stack
 183 is a long pointer. The offset is popped first, followed by the selector.
 184 <P>
 185 In real mode, CS and IP are loaded directly. In Protected Mode, an
 186 intersegment return causes the processor to check the descriptor
 187 addressed by the return selector. The AR byte of the descriptor must
 188 indicate a code segment of equal or lesser privilege (or greater or equal
 189 numeric value) than the current privilege level. Returns to a lesser
 190 privilege level cause the stack to be reloaded from the value saved beyond
 191 the parameter block.
 192 <P>
 193 The DS, ES, FS, and GS segment registers can be set to 0 by the RET
 194 instruction during an interlevel transfer. If these registers refer to
 195 segments that cannot be used by the new privilege level, they are set to
 196 0 to prevent unauthorized access from the new privilege level.
 197
 198 <H2>Flags Affected</H2>
 199
 200 None
 201
 202 <H2>Protected Mode Exceptions</H2>
 203
 204 #GP, #NP, or #SS, as described under "<H2>Operation</H2>" above; #PF(fault-code) for
 205 a page fault
 206
 207 <H2>Real Address Mode Exceptions</H2>
 208
 209 Interrupt 13 if any part of the operand would be outside the effective
 210 address space from 0 to 0FFFFH
 211
 212 <H2>Virtual 8086 Mode Exceptions</H2>
 213
 214 Same exceptions as in Real Address Mode; #PF(fault-code) for a page
 215 fault
 216
 217
 218 <P>
 219 <HR>
 220 <P>
 221 <B>up:</B> <A HREF="c17.htm">
 222 Chapter 17 -- 80386 Instruction Set</A><BR>
 223 <B>prev:</B><A HREF="REP.htm"> REP/REPE/REPZ/REPNE/REPNZ Repeat Following String Operation</A><BR>
 224 <B>next:</B><A HREF="SAHF.htm"> SAHF Store AH into Flags</A>
 225 </BODY>