Logic POP eIP if FAR return (inter-segment) POP CS endif eSP ← eSP + optional_pop_value (if specified)
RET transfers control to a return address located on the stack. The address is usually placed on the stack by a CALL instruction, and the return is made to the instruction that follows the CALL.
For a near (intrasegment) return, the address on the stack is a segment offset, which is popped into the instruction pointer (eIP). The CS register is unchanged. For a far (intersegment) return, the address on the stack is a long pointer; the offset is popped first, followed by the segment value.
The optional numeric parameter to RET gives the number of stack bytes (operand-size 16) or words (operand-size 32) to be released after the return address is popped. These items are typically used as input parameters to the procedure called (the Pascal calling convention).
Note Strictly speaking, RET is not an instruction, but a macro. It is always translated by the assembler into a RETN or a RETF instruction.
Protected mode In real mode, CS and IP are loaded directly. In protected mode, an intersegment return causes the processor to check the descriptor addressed by the return selector. The Access Rights (AR) byte of the descriptor must indicate a code segment of equal or lesser privilege than the current privilege level (CPL). Returns to a lesser privilege level cause the stack to be reloaded from the value saved beyond the parameter block.
The DS, ES, FS, and GS segment registers can be set to zero by the RET instruction during an interlevel transfer. If these registers refer to segments that cannot be used by the new privilege level, they are set to zero to prevent unauthorized access from the new privilege level.
Opcode Format C2 iw RETN imm16 C3 RETN CA iw RETF imm16 CB RETF