flat assembler
Message board for the users of flat assembler.

Index > Main > Confused by the size of near jumps in Intel 64-bit mode

Author
Thread Post new topic Reply to topic
MazeGen



Joined: 06 Oct 2003
Posts: 977
Location: Czechoslovakia
MazeGen 29 Jan 2007, 08:25
In 32-bit protected mode, default operand size for short or near jumps is 32 bits, because they uses 32-bit EIP:
Code:
00401000 E9 FBFFFFFF    jmp 00401000 ; JMP rel32
    

Operand-size prefix truncates the target address to 16 bits
(truncates new EIP to 16 bits and zero-extends the result):
Code:
00401000 66:E9 FCFF     jmp 00001000 ; JMP rel16
    

Note that address-size prefix has no effect because there is no memory operand and is therefore ignored by the processor:
Code:
00401000 67:E9 FAFFFFFF jmp 00401000 ; JMP rel32
    

(These can be easily tested, for instance, in OllyDbg)

I expected similar behavior also in 64-bit mode and some testings on my Turion (AMD brand) confirmed the effect of the operand-size prefix:
(note that short and near jumps default to 64 bits in 64-bit mode)
Code:
0000000000401000 E9 FBFFFFFF    jmp 0000000000401000 ; JMP rel32
    

Code:
0000000000401000 66:E9 FCFF     jmp 0000000000001000 ; JMP rel16
    

This behavior is also documented in AMD manuals.

As for address-size prefix, it is not important for now, but it surely doesn't work same way like operand-size prefix.

What a surprise came with the Intel manual. As for opcode 0xE9 cw (jmp rel16), it says "N.S." in 64-bit mode. "N.S." means:
N.S. wrote:
Indicates an instruction syntax that requires an address override prefix in
64-bit mode and is not supported. Using an address override prefix in 64-bit
mode may result in model-specific execution behavior."

In other words, Intel says that address-size prefix (67h) is needed to truncate the address to 16 bits, while AMD says (and works) this way using operand-size prefix (66h) :S

There are two explanations (I don't have an Intel 64 bit processor to test it):
1. Intel manual is wrong. I found pretty many misleading informations regarding 64-bit mode in its manuals. However, this doesn't seem to be such a case and it is not a typo, so
2. Intel really implemented it in different way than AMD. This is possible probably because no one needs to override the jump address to 16 bits so it won't cause any incompatibilities.

To confuse it even more, I found the following here. It was posted by someone using e-mail at intel.com:
jun.nakajima () intel ! com wrote:

Near branch with 66H prefix:
As documented in PRM the behavior is implementation specific and should avoid using 66H prefix on near branches.


Anyone knows something about it? Can anyone test it on Intel 64 bit processor?

(BTW, FDBG disassembles those jmps wrong, but they can be run to get new RIP. Feryno, if you read this, please fix it.)
Post 29 Jan 2007, 08:25
View user's profile Send private message Visit poster's website Reply with quote
Raedwulf



Joined: 13 Jul 2005
Posts: 375
Location: United Kingdom
Raedwulf 29 Jan 2007, 08:59
IMO, why on earth does Intel have to be incompatible Neutral lol. Buy me a 64-bit Intel PC and I will gladly test for you Very Happy

Sounds interesting, sorry no 64-bit CPUs here at all.
Post 29 Jan 2007, 08:59
View user's profile Send private message MSN Messenger Reply with quote
MazeGen



Joined: 06 Oct 2003
Posts: 977
Location: Czechoslovakia
MazeGen 29 Jan 2007, 11:29
I have found some new informations in the meantime:

http://www.sandpile.org/aa64/opc_1.htm
Quote:

EM64T processors don't support a 66h prefix.


http://en.wikipedia.org/wiki/AMD64
Quote:

Near branches with the 66H (operand size) prefix behave differently. One type of CPU clears only the top 32 bits, while the other type clears the top 48 bits.

(AMD64 clears the top 48 bits, as I wrote in my first post)

It really seems that operand-size prefix (66h) should be the one which is implementation-specific rather than address-size prefix on Intel.

The best still would be native test on EM64T architecture though.
Post 29 Jan 2007, 11:29
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.