JMP (x86 instruction)
This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
In the x86 assembly language, the JMP
instruction performs an unconditional jump. Such an instruction transfers the flow of execution by changing the program counter. There are a number of different opcodes that perform a jump; depending on whether the processor is in real mode or protected mode, and an override instruction is used, the instructions may take 16-bit, 32-bit, or segment:offset pointers.[1]
There are many different forms of jumps: relative, conditional, absolute and register-indirect jumps.
The following examples illustrate:
- a relative jump with a 16-bit pointer;
- a long jump (inter-segment), a relative jump with a 32-bit pointer;
- and a register-indirect absolute jump using the EAX register.
(Note that although the first and second jumps are relative, commonly the destination address is shown instead of the relative offset as encoded in the opcode.)
Example one: Load IP with the new value 0x89AB
, then load CS with 0xACDC
and IP with 0x5578
.
JMP 0x89AB
JMP 0xACDC:0x5578
Example two: Load EIP with the value 0x56789AB1
, only in protected mode or unreal mode.
JMP 0x56789AB1
Example three: Jump to the value stored in the EAX register, only in protected mode.
JMP EAX
The JMP
(Jump) instruction transfers the program's control to a specified location in the code. Unlike function calls, it doesn’t save return information. Instead, it directs execution to a target address, which can be:
- An immediate value,
- A general-purpose register, or
- A memory location.
Types of Jumps
[edit]The JMP
instruction supports four types of jumps:
- Short Jump
- A jump within the range of -128 to +127 bytes relative to the current instruction pointer (
EIP
).
- A jump within the range of -128 to +127 bytes relative to the current instruction pointer (
- Near Jump
- A jump within the current code segment (pointed to by the
CS
register). - The target can be an absolute offset (address within the segment) or a relative offset (distance from the current
EIP
).
- A jump within the current code segment (pointed to by the
- Far Jump
- A jump to a different code segment, but at the same privilege level.
- Typically used in intersegment jumps.
- Task Switch
- A jump to a different task, used in protected mode.
- The
JMP
instruction can reference a task gate or directly specify a Task State Segment (TSS).
Short and Near Jumps
[edit]Short Jump
[edit]- The relative offset is an 8-bit signed value (
rel8
), specifying the distance from the currentEIP
. - The
CS
register remains unchanged.
Near Jump
[edit]- The target is within the current code segment and can be:
- An absolute offset (loaded directly into
EIP
). - A relative offset (
rel16
orrel32
), calculated from the currentEIP
.
- An absolute offset (loaded directly into
Operand Size
- For absolute offsets:
- 16-bit mode clears the upper two bytes of
EIP
. - 32-bit mode allows the full offset range.
- 16-bit mode clears the upper two bytes of
- For relative offsets, the size (
8, 16, or 32 bits
) depends on the instruction opcode and operand size attribute.
Far Jumps
[edit]Real-Address or Virtual-8086 Mode
[edit]- The target address includes both:
- A segment selector (loaded into
CS
), and - An offset (loaded into
EIP
).
- A segment selector (loaded into
The target can be specified:
- Directly: Encoded as a pointer (
ptr16:16
orptr16:32
) in the instruction. - Indirectly: Stored in memory (
m16:16
orm16:32
) and fetched by the instruction.
Protected Mode
[edit]In protected mode, far jumps can be used for:
- Switching Code Segments
- A jump to a conforming or non-conforming code segment.
- The
CS
register is updated with the target segment selector, andEIP
is updated with the offset.
- Using a Call Gate
- The target operand specifies a call gate descriptor, which defines the segment and offset to jump to.
- This approach allows indirect jumps and is preferred for transitions between 16-bit and 32-bit segments.
- Performing a Task Switch
- The target specifies a task gate or directly references a TSS.
- The task's segment selectors (code and stack) and the
EIP
are loaded from the TSS.
Special Notes on Task Switching
[edit]- When using
JMP
for task switches:- The Nested Task (NT) flag in the
EFLAGS
register is not set. - The previous task link in the new TSS is not updated.
- As a result, you cannot return to the previous task using the
IRET
instruction. - This differs from the
CALL
instruction, which enables task returns by setting theNT
flag and saving task link information.
- The Nested Task (NT) flag in the
References
[edit]- ^ "Intel Architecture Software Developer's Manual, Volume 2: Instruction Set Reference Manual (6.5MB)" (PDF). Archived from the original (PDF) on 2009-02-19. Retrieved 2009-11-03.