In 'The Computer Organization and design book' it illustrates the call instruction as

  1. Decrementing the stack pointer by 4.
  2. saving the EIP+5 into the stack.
  3. Jumps to the new address specified.

What I know already is the instructions in this architecture are not typically all 4 byte in length, Hence.

How do we standardize the EIP to be added by 5 to the next instruction ?

normally in the MIPS architecture throughout the rest of the book the EIP is incremented by 4 which is intuitive as all the instructions are 32 bits.

  • $\begingroup$ I'm not sure this is the best place for this question, since it involves a particular ISA. Not sure what the most appropriate place would be, though. $\endgroup$ Mar 28, 2020 at 13:06
  • 1
    $\begingroup$ x86 is not MIPS. x86 instructions are from 1 byte to somewhere over ten bytes. $\endgroup$
    – gnasher729
    Mar 28, 2020 at 17:09

1 Answer 1


Not sure which book you are referring to (isn't that book talks only about MIPS and not on x86?)

In any case, I think that the answer is the following: EIP+5 is the address of the next instruction. That is, in x86 the next instruction after a (near32) call is 5 bytes away. This is because the call takes 5 bytes:
1byte = the call opcode (E8, for a (near)rel32 call)
4bytes = the 32bit offset to the call target from current EIP.

That is, the new EIP (after the call) is computed by taking the current EIP and adding to it the 4bytes relative offset.

So, if the call instruction itself takes 5 bytes, then the next instruction (the return address) is at EIP+5.

See also https://c9x.me/x86/html/file_module_x86_id_26.html for all possible calls (I described the rel32 one).

  • $\begingroup$ It has a several sections in chapter 2 for scratching the surface for other ISAs , and thanks so much . $\endgroup$ Mar 28, 2020 at 15:07
  • 1
    $\begingroup$ Since there are many different "call" instructions, they will all store the address of the next instruction. Since different "call" instructions have different lengths, it will be different numbers of bytes from the "call" instruction. $\endgroup$
    – gnasher729
    Mar 28, 2020 at 17:11
  • 2
    $\begingroup$ Even the E8 call instruction can have different length depending on the mode and prefixes. E.g. you'll get 3 bytes for 16-bit near call in 16-bit mode (E8 XX XX), 4 bytes for a 16-bit call in 32-bit mode (66 E8 XX XX), 5 bytes for 32-bit call in 32-bit mode (E8 XX XX XX XX) and 6 bytes for 32-bit call in 16-bit mode (66 E8 XX XX XX XX). $\endgroup$
    – Ruslan
    Mar 28, 2020 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.