POP

POP restores what PUSH saved: a function’s epilogue pops its callee-saved registers in the reverse order of the prologue’s pushes, just before RET. Clang 23 may also drop an 8-byte alignment slot that way, popping it into a scratch register such as RCX, where GCC 14 adds 8 to RSP.

In 64-bit mode a POP moves 8 bytes, or 2 with a 66 prefix; no prefix gives a 32-bit POP. A 16-bit POP into a register writes only its low 16 bits, and bits 63:16 keep their old value, as Zen 5 recorded.

The order of the two steps, reading the slot and moving RSP, shows in two cases:

• POP RSP loads the value from the top of the stack into RSP, and the increment is lost. Zen 5 recorded this, as Intel’s manual describes it.
• POP into memory addressed through RSP, such as pop qword [rsp+8], computes the address after RSP has moved up, by Intel’s manual, so it writes 8 bytes higher than the same operand names before the instruction. AMD’s manual does not say.

POP DS, POP ES and POP SS are invalid in 64-bit mode. POP FS and POP GS remain: the selector must name a usable data segment (#GP or #NP otherwise), and a null selector is allowed. Loading any other selector also replaces the segment’s base address with the 32-bit base of its descriptor (Intel’s Volume 3A, Section 3.4.4). In 64-bit code, where the base of FS is usually the 64-bit address of the thread’s local storage, set with arch_prctl or WRFSBASE (see the Linux documentation on FS and GS), a POP FS loses that address.

Unlike POPF, POP changes no flag. APX adds POP2, which restores two registers at once, and POPP, which pairs with PUSHP.

In the optimization guide

What the optimization guide says about POP, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Renaming and the window: A stack engine lets PUSH, POP, CALL and RET change RSP with no execution unit and no wait, though an explicit use of RSP between them can cost an extra micro-op.

Jaguar and Puma

• Front end: A sideband stack optimizer in the decoder tracks the stack pointer, so a chain of PUSH and POP instructions does not wait on each update of rSP.

Silvermont to Goldmont Plus

• Out-of-order and in-order execution: Goldmont tracks the stack pointer of push, pop, call and ret without spending allocation or execution slots on it, and runs push and pop three a cycle where Silvermont runs one.

Tremont

• Integer execution: LLVM’s tuning treats push, pop and call with a memory operand as slow on this core and loads the operand into a register first.

Zen and Zen+

• Integer execution: The decoder tracks RSP, so chains of PUSH and POP do not wait for each other; Agner Fog found PUSH, POP and RET to be one macro-op each, with no latency on RSP.

Zen 2

• Integer execution: A stack engine tracks RSP, so chains of PUSH and POP do not wait for each other; Agner Fog found PUSH, POP and RET to be one macro-op each with no latency on RSP.

Zen 3

• Integer execution: PUSH, POP, CALL and RET update RSP without a dependency, and loads, stores, lea and mov from RSP can use the tracked value.

Zen 4

• Integer execution: PUSH, POP, CALL and RET update RSP without a dependency, and loads, stores, lea and mov from RSP can use the tracked value.

Zen 5

• Integer execution: PUSH, POP, CALL and RET update RSP without a dependency, and loads, stores, lea and add or sub of a small immediate through RSP can use the tracked value.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = load(rsp, OSIZE)
rsp = rsp + OSIZE // 8
dest.write(v)                    # after RSP: POP RSP loads the value
                                 # popped; a memory operand's address
                                 # that uses RSP uses the new one

sel = load(rsp, OSIZE)           # the low 16 bits are the selector
load_segment(dest, sel)          # checks the descriptor it names;
                                 # FS and GS take its base, or 0
                                 # with a null selector (Zen 5)
rsp = rsp + OSIZE // 8
# after POP SS, interrupts wait until the next instruction is done

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

POP ES not in 64-bit mode POP SS not in 64-bit mode POP DS not in 64-bit mode POP FS POP GS

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD
• SHR
• SHRD
• STC

All 109 General-purpose instructions