LEAVE instruction (General-purpose)

LEAVE ends a function that keeps a frame pointer: it copies RBP to RSP, dropping everything the function put below its frame, and then pops the caller’s RBP. It is mov rsp, rbp followed by pop rbp in one byte, C9, and it is usually followed by RET. It belongs to ENTER, but undoes the hand-written prologue push rbp, mov rbp, rsp just as well, and that is where it appears today.

In compiled code

Because LEAVE restores RSP from RBP rather than from a known offset, it suits frames whose size is only known at run time. GCC 14 at -O2 ends functions with LEAVE whenever they have a frame pointer: with a variable-length array or alloca, and, with -fno-omit-frame-pointer, in functions that keep locals on the stack. Clang 23 never emitted it in our builds; it writes out mov rsp, rbp and pop rbp. Neither compiler emits ENTER for the prologue.

Callee-saved registers pushed after the frame pointer lie below RBP, so LEAVE would skip them: GCC reloads such a register from its slot relative to RBP, for example mov rbx, [rbp-8], before the LEAVE.

The instruction table of AMD’s Zen 5 guide lists LEAVE as microcoded, and the guide’s stack-pointer tracking, which spares PUSH, POP, CALL and RET from waiting on each other’s RSP updates, does not cover it: an instruction that writes RSP outside the listed forms costs an extra operation and restarts the tracking. Intel’s optimization manual names LEAVE, with ENTER, among the complex instructions to avoid in favour of simple sequences (Assembly/Compiler Coding Rule 28).

Details

The load comes from the address in RBP, which need not be aligned: Zen 5 ran LEAVE with RBP at an odd address. A fault there leaves RSP and RBP as they were.
In 64-bit mode LEAVE is 64-bit by default and 32 bits cannot be encoded. With a 66 prefix it pops 2 bytes into BP alone, keeping bits 63:16 of RBP, while RSP is still set from all of RBP, plus 2: Zen 5 recorded both.
No flags change.

In the optimization guide

What the optimization guide says about LEAVE, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

Front end: On Silvermont these instructions come from the microcode ROM; Goldmont decodes them directly, except an indirect call through memory.

Forms

Every encoding of LEAVE that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`LEAVE` LEAVE	`C9`	Base instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`LEAVE`
Sandy Bridge	7 / 0.67p0 p1 p5 p23
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake	7 / 0.5p012356
Alder Lake, Sapphire Rapids	6 / 0.4p0 p1 p2 p3 p5 p6 p10 p11
Lunar Lake	1 / 0.33p135
Bonnell	2 / 1p01
Silvermont	1 / 0.5IEC0 IEC1
Piledriver	1 / 1EX0 EX1
Zen	8 / 0.5AGU0 AGU1 ALU0 ALU1 ALU2 ALU3
Zen 2	8 / 0.33AGU0 AGU1 AGU2 ALU0 ALU1 ALU2 ALU3
Zen 3, Zen 4	1 / 0.25ALU0 ALU1 ALU2 ALU3
Jaguar	1 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = load(rbp, OSIZE)
rsp = rbp + OSIZE // 8           # RSP whole, from RBP whole
rBP = v                          # BP alone with a 66 prefix

Run on AMD Zen 5 (EPYC 9645): 8 cases.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`LEAVE`
`m16/32/64 at SS:[rBP]`	implicit	read
`rBP`	implicit	read, write
`rSP`	implicit	read, write

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I186` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

In compiled code#

Details#