leave

High Level Procedure Exit

LEAVE

Releases stack frame (MOV ESP, EBP; POP EBP).

Details

Releases the current stack frame by copying the base pointer (EBP/RBP) to the stack pointer (ESP/RSP), then pops the saved base pointer from the stack. This is the inverse of ENTER and restores the caller's frame pointer. No flags are affected. Valid in 16/32/64-bit modes; in 64-bit mode it operates on RBP/RSP.

Pseudocode Operation

if (OperandSize == 64) {
  RSP ← RBP;
  RBP ← [RSP];
  RSP ← RSP + 8;
} else if (OperandSize == 32) {
  ESP ← EBP;
  EBP ← [ESP];
  ESP ← ESP + 4;
} else {
  SP ← BP;
  BP ← [SP];
  SP ← SP + 2;
}

Example

LEAVE

Encoding

Binary Layout

Format Legacy

Opcode C9

Extension Base

Operands

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	Description
C9	LEAVE	ZO	Valid Valid	Set SP to BP, then pop BP.
C9	LEAVE	ZO	N.E. Valid	Set ESP to EBP, then pop EBP.
C9	LEAVE	ZO	Valid N.E.	Set RSP to RBP, then pop RBP.

Description

Releases the stack frame set up by an earlier ENTER instruction. The LEAVE instruction copies the frame pointer (in the EBP register) into the stack pointer register (ESP), which releases the stack space allocated to the stack frame. The old frame pointer (the frame pointer for the calling procedure that was saved by the ENTER instruction) is then popped from the stack into the EBP register, restoring the calling procedure’s stack frame. A RET instruction is commonly executed following a LEAVE instruction to return program control to the calling procedure. See “Procedure Calls for Block-Structured Languages” in Chapter 6 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for detailed information on the use of the ENTER and LEAVE instructions. In 64-bit mode, the instruction’s default operation size is 64 bits; 32-bit operation cannot be encoded. See the summary chart at the beginning of this section for encoding data and limits.

Operation

IF StackAddressSize = 32
THEN
ESP := EBP;
ELSE IF StackAddressSize = 64
THEN RSP := RBP; FI;
ELSE IF StackAddressSize = 16
THEN SP := BP; FI;
FI;
IF OperandSize = 32
THEN EBP := Pop();
ELSE IF OperandSize = 64
THEN RBP := Pop(); FI;
ELSE IF OperandSize = 16
THEN BP := Pop(); FI;
FI;

Flags Affected

None. LEAVE—High Level Procedure Exit Vol. 2A 3-550

Exceptions

Protected Mode Exceptions

#SS(0) If the EBP register points to a location that is not within the limits of the current stack segment. #PF(fault-code) If a page fault occurs. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. #UD If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP If the EBP register points to a location outside of the effective address space from 0 to FFFFH. #UD If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0) If the EBP register points to a location outside of the effective address space from 0 to FFFFH. #PF(fault-code) If a page fault occurs. #AC(0) If alignment checking is enabled and an unaligned memory reference is made. #UD If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0) If the stack address is in a non-canonical form. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. #UD If the LOCK prefix is used. LEAVE—High Level Procedure Exit Vol. 2A 3-551