POPF instruction (General-purpose)

POPF loads the flags register from the top of the stack, the reverse of PUSHF. In 64-bit mode it is POPFQ and takes 8 bytes; with a 66 prefix it takes 2 and loads only bits 15:0, FLAGS, leaving the upper bits as they were. POPFD, the 4-byte form, cannot be encoded there. C code reaches it through __builtin_ia32_writeeflags_u64(), which GCC 14 and Clang 23 compile to a PUSH of the argument and a POPF.

What it may not change

POPF does not load every bit it pops, and which bits it skips depends on the privilege level:

IF changes only where CPL is at most IOPL, as for CLI and STI.
IOPL changes only at CPL 0.
VM, VIF and VIP never change, and RF is always cleared.
The reserved bits keep their values: bit 1 stays 1.

The six status flags, TF, DF, NT, and in the 8-byte form AC and ID, are loaded at any privilege. Unlike CLI and STI, POPF never raises #GP for the bits it may not change in protected or 64-bit mode: it leaves them alone in silence, so code that pops an image with IF clear cannot assume that interrupts are now off.

Zen 5 showed this at CPL 3 with IOPL 0. Popping 0 with either form left IF set; popping FFFFFFFFFFFFFEFFH with POPFQ loaded the status flags, DF, NT, AC and ID but left IOPL at 0 and RF, VM, VIF and VIP clear. None of the twenty recorded cases faulted.

TF and AC

Setting TF with POPF is how a program single-steps itself: the first debug trap comes after the instruction that follows the POPF, not after the POPF itself (Intel’s Volume 3). Setting AC, bit 18, enables alignment checking of user-mode accesses where the operating system has set CR0.AM; the PUSHF page shows the sequence.

Cost

AMD’s Zen 5 guide lists POPF, like PUSHF, as microcoded. To restore only SF, ZF, AF, PF and CF, SAHF from AH is a single macro-op.

Forms

Every encoding of POPF that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`POPF` POPF	`66 9D`	Base instruction set
`POPFD` not in 64-bit mode POPFD	`9D`	Base instruction set
`POPFQ` 64-bit mode only POPFQ	`9D` `REX.W 9D`	LM

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`POPFQ`
Sandy Bridge, Haswell, Skylake, Skylake-SP, Ice Lake	5 / 0.5p23
Broadwell	22 / 4.25p012356
Alder Lake, Sapphire Rapids	5 / 1p0 p1 p2 p3 p6 p10
Lunar Lake	5 / 0.67p0 p1 p2 p3 p4 p5 p20 p21 p22
Bonnell	26 / 13p01
Silvermont	3 / 1MEC
Piledriver	5 / 1AGLU01 Load
Zen	4 / 0.5AGU0 AGU1
Zen 2	4 / 0.33AGU0 AGU1 AGU2
Zen 3, Zen 4	5 / 0.33AGU0 AGU1 AGU2 LSU Load
Jaguar	3 / 1LAGU

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = load(rsp, OSIZE)             # POPF: 16 bits, bits 15:0 of RFLAGS
rsp = rsp + OSIZE // 8
pl = iopl
cf = v & 1
pf = v >> 2 & 1
af = v >> 4 & 1
zf = v >> 6 & 1
sf = v >> 7 & 1
tf = v >> 8 & 1                  # a trap after the next instruction
df = v >> 10 & 1
of = v >> 11 & 1
nt = v >> 14 & 1
if CPL == 0:
    iopl = v >> 12 & 3
if CPL <= pl:
    if_ = v >> 9 & 1             # else IF stays, and nothing faults
if OSIZE != 16:
    ac = v >> 18 & 1
    id = v >> 21 & 1
rf = 0
# VM, VIF, VIP and the reserved bits stay as they were

Run on AMD Zen 5 (EPYC 9645): 20 cases. The forms that 64-bit mode lacks were not run: the probe runs in 64-bit mode.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`POPF` `POPFQ` 64-bit mode only
`stack`	implicit	read
`rSP`	implicit	read, write
`RFLAGS`	implicit	read, write
`POPFD` not in 64-bit mode
`stack`	implicit	read
`rSP`	implicit	read, write
`EFLAGS`	implicit	read, write

Flags

T tested, M modified, 0 cleared, P loaded from the stack; blank: not affected. How to read.

OF	SF	ZF	AF	PF	CF	DF	IF	TF	AC	IOPL	NT	RF	VM	VIF	VIP	ID
All forms
P	P	P	P	P	P	P	P	P	P	TP	P	0	T	M	T	P

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I86` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I386` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`LONGMODE` General-purpose System SYSCALL/SYSRET	LM `CPUID.80000001H:EDX[29]` LM	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions