retfw

Far return, 16-bit

Makes a far return using a 16-bit offset and an optional unsigned cleanup byte count.

8086 and later

Intel's reference: RET

CFPFAFZFSFDFOF –––––––
  • Changes no flag

Forms

  • retfw
  • retfw

Operands

imm16
An unsigned 16-bit byte count, 0 to 65535, added to the stack pointer after the return address is popped.

The w, d and q suffixes select 16-, 32- and 64-bit offsets; retf defaults to a 32-bit offset in 64-bit mode, so a 64-bit far return requires retfq. Stack slots follow the selected operand size, rather than the packed layout of a far pointer in memory.

The optional sole operand is an unsigned 16-bit additional stack-cleanup byte count. Segment and privilege checks apply, and a privilege-changing return can also restore the stack pointer and stack segment. This is not the return used for an ordinary Linux function call; use near ret for that.

global _start

section .text
_start:
        mov rax, 12
        mov rbx, 5
        mov rcx, 3
        mov rsi, 9

        retfw 5

        mov rax, 60         ; syscall 60: exit
        xor rdi, rdi
        syscall