CALL
Call a near target
Push the following instruction address and branch to a target.
| Form | Bits | Requires | Encoding |
|---|---|---|---|
CALL rel32 | — | x86-64 | E8 cd |
CALL r64 | 64 | x86-64 | FF /2 |
Operation#
Pseudo-C · selected form
target = next_RIP + sign_extend(displacement, 64)
RSP = RSP - 8
Store64(RSP, next_RIP)
RIP = targetExact upstream semantics
Standard variant
let new_rip :=
if is_relative then
Relative_Branch_Wrap(context.operand_size, Next_IP + Sign_Extend(src, 64))
else
Zero_Extend(src, 64);
let update_shadow_stack := CET::Is_Shadow_Stack_Enabled(CPL) and (not is_relative or not Is_Zero(src));
if not update_shadow_stack then
Check_New_RIP?(CS, new_rip);
endif;
let new_rsp := Push_Stack?(SS, RSP, CS, operand_size, operand_size, Next_IP[0 +: operand_size]);
if update_shadow_stack then
Check_New_RIP?(CS, new_rip);
SSP := CET::Shadow_Stack_Push?(SSP, Next_IP[0 +: Max(operand_size, 32)]);
endif;
RSP := new_rsp;
Branch_Near(new_rip);
if is_indirect and Is_End_Branch_Enabled_And_Not_Suppressed(CPL) then
if IA32_CET[CPL].NO_TRACK_EN == 0b0 or not is_no_track then
CET::Set_Tracker_Status(CPL);
endif;
endif;What to watch for
- Only near control transfers in 64-bit mode are selected. Far transfers, compatibility mode and CET shadow-stack/indirect-branch state are outside the simplified operation.
- Targets must meet architectural fetch and canonical-address requirements. Stack accesses can fault for CALL/RET.
- The signed byte displacement is relative to the end of this instruction (next RIP).
Architectural details#
- Flags
- RFLAGS unchanged.
- Destination
- Writes RIP and RSP; pushes eight return-address bytes.
- Encoding
E8 cd- Operands
rel32read · 32 bits
- Coverage
- Selected near control transfers in 64-bit execution mode, using a 64-bit stack address size.
- rel32
- -2147483648 to 2147483647.
Exception information & execution requirements
#UD
Imported exceptions are checks exposed by this XML form; memory, stack, instruction-fetch and called architectural helpers can introduce additional faults.
Feature availability alone does not guarantee execution: OS state and execution-level controls also apply. Use the linked architecture documentation for the full exception conditions.
Sources & provenance#
Technical fields are imported from pinned upstream files. Explanations and explorer behavior are maintained separately.
Intel · CALL-Call-Procedure.xml
- Revision
4ebe7f0ac1bd00f46244c49bb72c503ce368def7- SHA-256
b507320a58777c06b58b9dac87c16c587a82063186f45cd8342700535decd785- Terms
- Intel SDM terms; see License.md