Interrupt Function
Interrupt Function
October 3, 2023
Here’s what happens when you use the INT instruction to push on the stack:
- The CPU will query the interrupt vector table.
- Then push some context information onto the stack,like this:
Interrupt
- Then execute the interrupt handler function.
- Then return through
iret
. Things to note here are thatiret
is only prepared for 16-bit systems.iretd
should be used for 32-bit systems, andiretq
should be used for 64-bit systems.
IRET returns from an interrupt (hardware or software) by means of popping IP (or EIP), CS, and the flags off the stack and then continuing execution from the new CS:IP.
IRETW pops IP, CS and the flags as 2 bytes each, taking 6 bytes off the stack in total. IRETD pops EIP as 4 bytes, pops a further 4 bytes of which the top two are discarded and the bottom two go into CS, and pops the flags as 4 bytes as well, taking 12 bytes off the stack.
IRET is a shorthand for either IRETW or IRETD, depending on the default BITS setting at the time.
Last updated on