Indirect Branch
Branch to an address held in a register rather than encoded in the instruction.
Control Flow
Semantics
The mechanism behind virtual dispatch, switch tables and function pointers, and the reason control-flow integrity features exist.
| Architecture | Instructions | Expressed as | How this architecture does it |
|---|---|---|---|
| x86 | one instruction | The register and memory operand forms of JMP take the target from a register or from memory, the latter making a jump table a single instruction. | |
| ARM | one instruction | BR branches to a register and BLR links as well. Where Branch Target Identification is enabled, the target instruction must be a BTI landing pad or the branch faults, which is the architectural half of control-flow integrity. | |
| RISC-V | one instruction | One instruction covers both cases: JALR with x0 as the destination discards the return address and is a plain indirect jump. | |
| PowerISA | an idiom | The target is first moved into the Count Register or Link Register and then branched through, so an indirect call is at least two instructions. The upside is that the address can be placed in CTR long before the branch, giving the machine an unusually early hint about where control is going. |
Other operations
Add With Carry Atomic Compare and Swap Atomic Exchange Atomic Fetch and Add Breakpoint Trap Byte Swap (Endianness Reversal) CPU Feature Detection Cache Line Flush Cache Prefetch Hint Compare and Branch Conditional Select (Branchless Move) Count Leading Zeros Count Trailing Zeros Floating-Point Compare Floating-Point Square Root Function Call and Return Fused Multiply-Add Integer Addition Integer Divide Integer Multiply Integer and Floating-Point Conversion Load-Acquire Load-Linked / Store-Conditional Logical and Arithmetic Shift Memory Barrier / Fence No Operation Population Count Read Cycle Counter Rotate Left Sign Extend Byte Spin-Wait Hint System Call