JMP

Compiled code uses JMP in three ways:

• Within a function, JMP rel8 (EB, 2 bytes, reaching 128 bytes back and 127 forward) or JMP rel32 (E9, 5 bytes). Assemblers pick the short form whenever the target is close enough.
• Tail calls. When a function ends by calling another, compilers emit a JMP to it instead of CALL and RET, so the callee returns straight to the original caller. Intel’s optimization manual recommends this: it saves the call, the return and an entry of the return-address predictor.
• Indirect jumps (FF /4) through a register or memory: a switch compiled to a table of targets, which GCC 14 and Clang 23 at -O2 both build for dense cases, a tail call through a function pointer, and the PLT stubs that reach functions in other shared libraries.

Things to know:

• Faults. A non-canonical target raises #GP(0) at the JMP itself, not at the target: Zen 5 raised #GP with RIP still at the JMP.
• CET. With Intel’s indirect branch tracking enabled, an indirect JMP must land on ENDBR64 or raise #CP. A 3E prefix (NOTRACK) exempts it when the OS enables that; GCC 14 and Clang 23 with -fcf-protection put it on the jump of a switch table, whose targets come from read-only data. Direct jumps are never checked.
• Speculation. Intel’s manual warns that the instructions after an indirect JMP, not only those at its target, may run speculatively, and suggests an INT3 or LFENCE after the JMP where that matters.
• 66 prefix. Intel’s manual fixes the operand size of near jumps at 64 bits in 64-bit mode. AMD’s lets a 66 prefix make it 16 bits: a 2-byte displacement for E9 and RIP cut to 16 bits. The same bytes thus have different lengths on the two; the forms table lists only Intel’s rel32 form for 64-bit mode.
• Far jumps take their target from memory only (EA is invalid in 64-bit mode). With REX.W, Intel’s processors read a 64-bit offset (m16:64); AMD’s manual allows only a 32-bit one.

Jcc is the conditional jump, and JMPABS (APX) a direct jump to a 64-bit absolute address.

In the optimization guide

What the optimization guide says about JMP, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Front end

• Decoded-instruction caches: Each unconditional jump or call ends a line of Intel’s decoded cache, so at most three of them in a 32-byte block can be cached.
• Code alignment and padding: On the Skylake family with the microcode update for its JCC erratum (Skylake), 32-byte boundaries matter for every jump: one that crosses such a boundary or ends on it is no longer cached and runs from the decoders.

Branches

• Indirect branches: An indirect jmp or call that always goes to the same place is predicted from its BTB entry like a direct one. sources differ
• Indirect branches: An indirect branch the predictor has no target for is assumed to fall through, so the bytes after it are fetched and may be decoded and run.
• Indirect branches: A switch compiles to a jump through a table, one indirect branch that depends on the indirect predictor, or to a tree of conditional branches, which takes more BTB entries and is dense with branches.
• Indirect branches: An indirect branch to a distant target is predicted worse: Zen 3 and Zen 4 track only a few targets beyond a 64 MB aligned boundary, and Intel’s cores mispredict more often beyond 2 GB.
• Indirect branches: LLVM’s retpoline options send indirect calls and jumps through a sequence that does not speculate on their target, and turn each switch into conditional branches rather than a jump table.

Crestmont and Gracemont

• Front end: The decoders split long runs of code without taken branches by themselves, so jumps inserted for Tremont are not needed.

Golden Cove and Raptor Cove

• Branches: An indirect jmp or call through a register or memory whose target lies more than 2 GB away takes more of the predictor and mispredicts more often.

Silvermont to Goldmont Plus

• Branches: Silvermont predicts an indirect branch from its last target alone, Goldmont from patterns.

Skylake to Cooper Lake

• The JCC erratum: Under rare conditions a jump that crosses a 64-byte line could make these cores misbehave (erratum SKX102).

Tremont

• Front end: Long runs of code without taken branches use one decode cluster on Tremont; a jump to the next instruction every 16 to 32 instructions lets both work.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

w = OSIZE                        # the size of the target
n = 0
if OSIZE == 16:                  # a 66 prefix
    if INTEL:
        w = 64                   # ignored: SDM
    else:
        if rel.bits == 32:
            n = 2                # a rel16, 2 bytes shorter than
                                 # XED decodes: APM, Zen 5
t = low(rip - n + signed(rel), w)    # from the next
                                     # instruction; with 66 on
                                     # AMD's, IP alone
if not canonical(t):
    fault(GP, 0)
rip = t

t = target.read()                # r/m64; with 66, r/m16 on AMD's
                                 # processors, zero-extended (APM,
                                 # Zen 5), where Intel's ignore the
                                 # prefix (SDM)
if not canonical(t):
    fault(GP, 0)
rip = t

v = target.read()                # the offset, then a 16-bit selector
cs = v >> OSIZE & 0xFFFF         # once the descriptor it names passes
                                 # the checks: a code segment or a gate
                                 # that CPL may use, present; else
                                 # #GP(sel) or #NP(sel)
rip = low(v, OSIZE)

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

JMP r/m16/32/64 JMP m16:16/32/64

indirect branch

JMP ptr16:16/32 not in 64-bit mode JMP m16:16/32/64

far transfer; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• CWD
• CWDE
• DAA
• DAS
• DEC
• DIV
• ENTER
• IDIV
• IMUL
• IN
• INC
• INS
• INT
• INT1
• INT3
• INTO
• IRET
• Jcc
• JCXZ
• JECXZ
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP

All 109 General-purpose instructions