CALL

Call a near target

Push the following instruction address and branch to a target.

x86-64

Instruction forms

2 in this sample
FormBitsRequiresEncoding
CALL rel32—x86-64E8 cd
CALL r6464x86-64FF /2
No fixed data width

Operation

Pseudo-C · selected form
target = next_RIP + sign_extend(displacement, 64)
RSP = RSP - 8
Store64(RSP, next_RIP)
RIP = target

Simplified pseudocode for the selected form.

Exact upstream semantics

Standard variant

Source: intel/CALL-Call-Procedure.xml/1

let new_rip :=
if is_relative then
Relative_Branch_Wrap(context.operand_size, Next_IP + Sign_Extend(src, 64))
else
Zero_Extend(src, 64);

let update_shadow_stack := CET::Is_Shadow_Stack_Enabled(CPL) and (not is_relative or not Is_Zero(src));

if not update_shadow_stack then
Check_New_RIP?(CS, new_rip);
endif;

let new_rsp := Push_Stack?(SS, RSP, CS, operand_size, operand_size, Next_IP[0 +: operand_size]);

if update_shadow_stack then
Check_New_RIP?(CS, new_rip);
SSP := CET::Shadow_Stack_Push?(SSP, Next_IP[0 +: Max(operand_size, 32)]);
endif;

RSP := new_rsp;
Branch_Near(new_rip);

if is_indirect and Is_End_Branch_Enabled_And_Not_Suppressed(CPL) then
if IA32_CET[CPL].NO_TRACK_EN == 0b0 or not is_no_track then
CET::Set_Tracker_Status(CPL);
endif;
endif;

Parameterized by register and element size; from the pinned upstream definition.

What to watch for

  • Only near control transfers in 64-bit mode are selected. Far transfers, compatibility mode and CET shadow-stack/indirect-branch state are outside the simplified operation.
  • Targets must meet architectural fetch and canonical-address requirements. Stack accesses can fault for CALL/RET.
  • The signed byte displacement is relative to the end of this instruction (next RIP).

Architectural details

Flags
RFLAGS unchanged.
Destination
Writes RIP and RSP; pushes eight return-address bytes.
Encoding
E8 cd
Operands
  • rel32read · 32 bits
Coverage
Selected near control transfers in 64-bit execution mode, using a 64-bit stack address size.
rel32
-2147483648 to 2147483647.
Exception information & execution requirements
  • #UD

Imported exceptions are checks exposed by this XML form; memory, stack, instruction-fetch and called architectural helpers can introduce additional faults.

Feature availability alone does not guarantee execution: OS state and execution-level controls also apply. Use the linked architecture documentation for the full exception conditions.

Performance measurements are not included in this preview. Latency and throughput depend on the exact form and microarchitecture. Measured data on uops.info ↗

Sources & provenance

Technical fields are imported from pinned upstream files. Explanations and explorer behavior are maintained separately.

Intel · CALL-Call-Procedure.xml
Revision
4ebe7f0ac1bd00f46244c49bb72c503ce368def7
SHA-256
b507320a58777c06b58b9dac87c16c587a82063186f45cd8342700535decd785
Terms
Intel SDM terms; see License.md
View pinned upstream file ↗

Intel sources are a documentation preview. Arm ACLE mappings are adapted under CC BY-SA 4.0 with an additional patent license. Arm MRS encoding data is distributed under BSD-3-Clause. © Arm Limited and contributors. Coverage and attribution.