Volume 3: General-Purpose and System Instructions - Stanford ...

24594 Rev. 3.10 February 2005 AMD64 TechnologyCALL (Far)Far Procedure CallPushes procedure linking information onto the stack and branches to the targetaddress, which contains the first instruction of the called procedure. The operandspecifies a target selector and offset.The instruction can specify the target directly, by including the far pointer in theCALL (Far) opcode itself, or indirectly, by referencing a far pointer in memory. In 64-bit mode, only indirect far calls are allowed, executing a direct far call (opcode 9A)generates an undefined opcode exception.The target selector used by the instruction can be a code selector in all modes.Additionally, the target selector can reference a call gate in protected mode, or a taskgate or TSS selector in legacy protected mode.• Target is a code selector—The CS:rIP of the next instruction is pushed to the stack,using operand-size stack pushes. Then code is executed from the target CS:rIP. Inthis case, the target offset can only be a 16- or 32-bit value, depending on operandsize,and is zero-extended to 64 bits. No CPL change is allowed.• Target is a call gate—The call gate specifies the actual target code segment and offset.Call gates allow calls to the same or more privileged code. If the target segmentis at the same CPL as the current code segment, the CS:rIP of the nextinstruction is pushed to the stack.If the CALL (Far) changes privilege level, then a stack-switch occurs, using aninner-level stack pointer from the TSS. The CS:rIP of the next instruction ispushed to the new stack. If the mode is legacy mode and the param-count field inthe call gate is non-zero, then up to 31 operands are copied from the caller's stackto the new stack. Finally, the caller's SS:rSP is pushed to the new stack.When calling through a call gate, the stack pushes are 16-, 32-, or 64-bits, dependingon the size of the call gate. The size of the target rIP is also 16, 32, or 64 bits,depending on the size of the call gate. If the target rIP is less than 64 bits, it iszero-extended to 64 bits. Long mode only allows 64-bit call gates that must point to64-bit code segments.• Target is a task gate or a TSS—If the mode is legacy protected mode, then a taskswitch occurs. See “Hardware Task-Management in Legacy Mode” in volume 2 fordetails about task switches. Hardware task switches are not supported in longmode.See CALL (Near) for information on near calls—calls to procedures located inside thecurrent code segment. For details about control-flow instructions, see “ControlTransfers” in Volume 1, and “Control-Transfer Privilege Checks” in Volume 2.CALL (Far) 89