jmp instruction *%eax

user4099632 picture user4099632 · Jun 12, 2015 · Viewed 7k times · Source

In the paper for Google Native Client, the authors define a nacljmp as these two instructions:

and   $0xffffffe0, %eax   # Clears the 5 least significant bits in %eax.
jmp   *%eax

First, I can see they clear the 5 least significant bits to round the pointer down to a 32-byte alignment boundary before jumping to it. Perhaps for a tagged-pointer implementation using the low 5 bits for data.

However, what does the asterisk mean before %eax?

I've searched a number of tutorials on x86 assembly without much luck.

Answer

Michael picture Michael · Jun 12, 2015

jmp *%eax is AT&T syntax for jmp eax, which is one form of jmp r/m32. It will jump to the address contained in register eax:

Jump near, absolute indirect, address given in r/m32.

Another form of the same type of jump instruction is jmp *(%eax) which corresponds to jmp [eax] in Intel syntax. It would jump to the address stored at the 32-bit memory location pointed to by register eax.