A.5.263 PUSH: Push Data on Stack
PUSH reg16 ; o16 50+r [8086]
PUSH reg32 ; o32 50+r [386]
PUSH r/m16 ; o16 FF /6 [8086]
PUSH r/m32 ; o32 FF /6 [386]
PUSH CS ; 0E [8086]
PUSH DS ; 1E [8086]
PUSH ES ; 06 [8086]
PUSH SS ; 16 [8086]
PUSH FS ; 0F A0 [386]
PUSH GS ; 0F A8 [386]
PUSH imm8 ; 6A ib [186]
PUSH imm16 ; o16 68 iw [186]
PUSH imm32 ; o32 68 id [386]
PUSH decrements the stack pointer (SP or ESP) by 2 or 4, and then stores
the given value at [SS:SP] or [SS:ESP].
The address-size attribute of the instruction determines whether SP or
ESP is used as the stack pointer: to deliberately override the default
given by the BITS setting, you can use an "a16" or "a32" prefix.
The operand-size attribute of the instruction determines whether the
stack pointer is decremented by 2 or 4: this means that segment register
pushes in BITS 32 mode will push 4 bytes on the stack, of which the
upper two are undefined. If you need to override that, you can use an
"o16" or "o32" prefix.
The above opcode listings give two forms for general-purpose register
push instructions: for example, PUSH BX has the two forms 53 and FF F3.
NASM will always generate the shorter form when given PUSH BX. NDISASM
will disassemble both.
Unlike the undocumented and barely supported POP CS, PUSH CS is a
perfectly valid and sensible instruction, supported on all processors.
The instruction PUSH SP may be used to distinguish an 8086 from later
processors: on an 8086, the value of SP stored is the value it has
_after_ the push instruction, whereas on later processors it is the
value _before_ the push instruction.