x86 Instruction Set – Control transfer

Introduction

These instructions change the instruction pointer (IP, EIP or RIP), and with it where the processor runs next. A near transfer stays in the current code segment; a far one also loads CS. Calls push the return address on the stack, and returns pop it. Conditional jumps read the status flags.

A relative branch holds a signed displacement, 8, 16 or 32 bits, counted from the end of the instruction: a 74 FE at 0x1000 jumps to 0x1000 + 2 − 2 = 0x1000, itself. The disassembler shows the target address, and in the explorer selecting a branch offers to go to its target, which may be in the middle of another instruction; see the overview.

Most of these came with the 8086 in 1978. The 80186 added ENTER, LEAVE and BOUND, the 80386 the conditional jumps with a 16- or 32-bit displacement, and x86-64 the 64-bit forms. Intel’s APX adds jmpabs, a jump to a 64-bit absolute address. A program checks for APX with CPUID leaf 7, sub-leaf 1, EDX bit 21. The system calls (syscall, sysenter and their returns) are on the System instructions page.

The instructions

In the forms, rel8, rel16 and rel32 are relative displacements, and ptr16:16 and ptr16:32 a far address written in the instruction (offset, then selector). In the encodings, cb, cw and cd are displacements of 1, 2 and 4 bytes, and cp a 6-byte far pointer. The rest of the notation is as on the Data transfer page.

Jumps

Instruction	Forms	Encoding	What it does	Set
`jmp`	`rel8` `rel16/32` `r/m16/32/64`	`EB cb` `E9 cw/cd` `FF /4`	Jumps to the target. The register or memory form is an indirect jump to the address it holds. In 64-bit mode the operand size is always 64 bits: `E9` takes a 32-bit displacement and `FF /4` a 64-bit address.	8086 (Intel 8086, 1978)
`ljmp`	`ptr16:16`, `ptr16:32` `m16:16/32/64`	`EA cd/cp` `FF /5`	LLVM’s name for the far JMP: loads CS and the instruction pointer, either from the instruction or from memory. In protected mode the selector may name a call gate or a task. `EA` is invalid in 64-bit mode.	8086 (Intel 8086, 1978)
`jmpabs`	`imm64`	`REX2 A1 io` (REX2.M0 = 0, REX2.W = 0)	Jumps to a 64-bit absolute address held in the instruction. It is the only instruction REX2 allows in row A of the one-byte map, where `A1` is otherwise a MOV. 64-bit mode only.	APX (announced for Intel Nova Lake and Diamond Rapids)

Conditional jumps

Jcc jumps if its condition holds and otherwise goes on. The short form (70 + cc) takes an 8-bit displacement; the near form (0F 80 + cc) a 16- or 32-bit one, and 32-bit in 64-bit mode. The conditions are in the condition code table. Assemblers also accept jz, jc, jnae and the other names.

Instruction	Forms	Encoding	What it does	Set
`jo`	`rel8` `rel16/32`	`70 cb` `0F 80 cw/cd`	Jumps if OF = 1.	8086 (Intel 8086, 1978); the near form 80386
`jno`	`rel8` `rel16/32`	`71 cb` `0F 81 cw/cd`	Jumps if OF = 0.	8086 (Intel 8086, 1978); the near form 80386
`jb`	`rel8` `rel16/32`	`72 cb` `0F 82 cw/cd`	Jumps if CF = 1 (below, unsigned).	8086 (Intel 8086, 1978); the near form 80386
`jae`	`rel8` `rel16/32`	`73 cb` `0F 83 cw/cd`	Jumps if CF = 0 (above or equal).	8086 (Intel 8086, 1978); the near form 80386
`je`	`rel8` `rel16/32`	`74 cb` `0F 84 cw/cd`	Jumps if ZF = 1 (equal, zero).	8086 (Intel 8086, 1978); the near form 80386
`jne`	`rel8` `rel16/32`	`75 cb` `0F 85 cw/cd`	Jumps if ZF = 0 (not equal).	8086 (Intel 8086, 1978); the near form 80386
`jbe`	`rel8` `rel16/32`	`76 cb` `0F 86 cw/cd`	Jumps if CF = 1 or ZF = 1 (below or equal).	8086 (Intel 8086, 1978); the near form 80386
`ja`	`rel8` `rel16/32`	`77 cb` `0F 87 cw/cd`	Jumps if CF = 0 and ZF = 0 (above).	8086 (Intel 8086, 1978); the near form 80386
`js`	`rel8` `rel16/32`	`78 cb` `0F 88 cw/cd`	Jumps if SF = 1.	8086 (Intel 8086, 1978); the near form 80386
`jns`	`rel8` `rel16/32`	`79 cb` `0F 89 cw/cd`	Jumps if SF = 0.	8086 (Intel 8086, 1978); the near form 80386
`jp`	`rel8` `rel16/32`	`7A cb` `0F 8A cw/cd`	Jumps if PF = 1 (parity even).	8086 (Intel 8086, 1978); the near form 80386
`jnp`	`rel8` `rel16/32`	`7B cb` `0F 8B cw/cd`	Jumps if PF = 0.	8086 (Intel 8086, 1978); the near form 80386
`jl`	`rel8` `rel16/32`	`7C cb` `0F 8C cw/cd`	Jumps if SF ≠ OF (less, signed).	8086 (Intel 8086, 1978); the near form 80386
`jge`	`rel8` `rel16/32`	`7D cb` `0F 8D cw/cd`	Jumps if SF = OF.	8086 (Intel 8086, 1978); the near form 80386
`jle`	`rel8` `rel16/32`	`7E cb` `0F 8E cw/cd`	Jumps if ZF = 1 or SF ≠ OF.	8086 (Intel 8086, 1978); the near form 80386
`jg`	`rel8` `rel16/32`	`7F cb` `0F 8F cw/cd`	Jumps if ZF = 0 and SF = OF (greater, signed).	8086 (Intel 8086, 1978); the near form 80386
`jcxz`	`rel8`	`E3 cb` (16-bit address size)	Jumps if CX is 0. The address size, not the operand size, picks the register. Invalid in 64-bit mode, which has no 16-bit addresses.	8086 (Intel 8086, 1978)
`jecxz`	`rel8`	`E3 cb` (32-bit address size)	Jumps if ECX is 0. In 64-bit mode this is `67 E3`.	80386 (Intel 80386, 1985)
`jrcxz`	`rel8`	`E3 cb` (64-bit address size)	Jumps if RCX is 0. 64-bit mode only.	x86-64 (AMD Opteron, 2003, and Intel EM64T, 2004)

Loops

These count down CX, ECX or RCX, by the address size, and jump while it is not zero. They change no flags and take only an 8-bit displacement.

Instruction	Forms	Encoding	What it does	Set
`loop`	`rel8`	`E2 cb`	Decrements the count and jumps if it is not 0.	8086 (Intel 8086, 1978)
`loope`	`rel8`	`E1 cb`	Decrements the count and jumps if it is not 0 and ZF = 1. Also called LOOPZ.	8086 (Intel 8086, 1978)
`loopne`	`rel8`	`E0 cb`	Decrements the count and jumps if it is not 0 and ZF = 0. Also called LOOPNZ.	8086 (Intel 8086, 1978)

Calls and returns

Instruction	Forms	Encoding	What it does	Set
`call`	`rel16/32` `r/m16/32/64`	`E8 cw/cd` `FF /2`	Pushes the address of the next instruction and jumps to the target. In 64-bit mode the operand size is always 64 bits. `call qword ptr [rip + …]` through an import table is how Windows x64 programs usually call a DLL.	8086 (Intel 8086, 1978)
`lcall`	`ptr16:16`, `ptr16:32` `m16:16/32/64`	`9A cd/cp` `FF /3`	LLVM’s name for the far CALL: pushes CS and the return offset, then loads CS and the instruction pointer. In protected mode the selector may name a call gate, which can change privilege level. `9A` is invalid in 64-bit mode.	8086 (Intel 8086, 1978)
`ret`	– `imm16`	`C3` `C2 iw`	Near return: pops the return address into the instruction pointer. With an immediate, then adds that many bytes to the stack pointer, dropping the caller’s arguments (the stdcall and Pascal conventions).	8086 (Intel 8086, 1978)
`retf`	– `imm16`	`CB` `CA iw`	Far return: pops the instruction pointer, then CS. In protected mode a return to an outer privilege level also pops the stack pointer and SS.	8086 (Intel 8086, 1978)
`retfq`	– `imm16`	`REX.W CB` `REX.W CA iw`	Far return with a 64-bit operand size: pops an 8-byte RIP and an 8-byte slot holding CS. 64-bit mode.	x86-64 (AMD Opteron, 2003, and Intel EM64T, 2004); the decoder files it under 8086 RETF
`enter`	`imm16, imm8`	`C8 iw ib`	Makes a stack frame: pushes the frame pointer, copies the frame pointers of the enclosing procedures when the nesting level (imm8, taken mod 32) is above 0, sets the frame pointer to the stack, and reserves imm16 bytes of locals.	80186 (Intel 80186, 1982)
`leave`	–	`C9`	Undoes `enter`, or the usual `push ebp; mov ebp, esp`: copies the frame pointer to the stack pointer and pops the frame pointer.	80186 (Intel 80186, 1982)

Software interrupts and BOUND

Instruction	Forms	Encoding	What it does	Set
`int`	`imm8`	`CD ib`	Calls the interrupt or exception handler numbered by the immediate: in real mode through the interrupt vector table at address 0, in protected and long mode through the IDT. `int 0x21` was the MS-DOS call and `int 0x80` the 32-bit Linux one.	8086 (Intel 8086, 1978)
`int3`	–	`CC`	The one-byte breakpoint: raises #BP (vector 3). Debuggers write it over the first byte of an instruction. Unlike `CD 03`, it is not subject to the IOPL check in virtual-8086 mode.	8086 (Intel 8086, 1978)
`int1`	–	`F1`	Raises a debug trap (vector 1), for hardware debuggers; long known as ICEBP and undocumented, and now described in Intel’s manual.	80386 (Intel 80386, 1985)
`into`	–	`CE`	Raises #OF (vector 4) if OF = 1. Invalid in 64-bit mode.	8086 (Intel 8086, 1978)
`iret`	–	`CF` (16-bit operand size)	Returns from an interrupt handler: pops IP, CS and FLAGS, 2 bytes each. In protected mode a return to an outer privilege level also pops SP and SS.	8086 (Intel 8086, 1978)
`iretd`	–	`CF` (32-bit operand size)	The same with EIP, CS and EFLAGS, 4 bytes each.	80386 (Intel 80386, 1985)
`iretq`	–	`REX.W CF`	The 64-bit form, which always pops RIP, CS, RFLAGS, RSP and SS, 8 bytes each.	x86-64 (AMD Opteron, 2003, and Intel EM64T, 2004)
`bound`	`r16, m16&16` `r32, m32&32`	`62 /r`	Checks that a signed array index in the register lies between the two bounds stored in memory (lower, then upper); if not, raises #BR (vector 5). Invalid in 64-bit mode, where `62` starts an EVEX prefix; in 32-bit code a `62` followed by a byte with both top bits set is EVEX too. LLVM shows the memory operand at the size of one bound.	80186 (Intel 80186, 1982)

Notes

Operand size of near branches in 64-bit mode. The disassembler ignores a 66 prefix on near JMP, Jcc, CALL and RET in 64-bit mode, as Intel’s processors do: 66 E8 still takes a 32-bit displacement. AMD’s processors honour the prefix and truncate the target to 16 bits, and LLVM decodes it AMD’s way. This is a deliberate difference from LLVM.
BND. An F2 prefix on a near branch, call or return is MPX’s BND prefix, shown as bnd jmp and so on. MPX has been withdrawn; see the Security page. A 3E prefix on an indirect branch is CET’s NOTRACK.
Flags. Jumps, calls, returns and loops do not change the flags. INT clears TF, and IF too unless it goes through a trap gate; IRET restores the flags it pops.
Display. The immediates of RET and RETF are shown as LLVM shows them: unsigned with a 16-bit operand size and signed otherwise. A far pointer is shown as selector:offset, unsigned.