LEA

LEA does the address arithmetic of a memory operand, base + index * scale + displacement or RIP + displacement, and puts the result in a register without accessing memory. Nothing is checked, so an address that would fault as an operand, such as a non-canonical one, is just a number; the only exception is #UD, for a LOCK prefix or a register in place of the memory operand (ModRM mod = 11).

The result is the offset within the segment: a segment prefix adds no base, so lea rax, fs:[0] gives 0. Code that needs the address of thread-local data reads the thread pointer, which the x86-64 TLS layout keeps at fs:0, with a MOV and adds the offset to it (see thread-local storage).

Addresses and arithmetic#

GCC 14 at -O2 compiles &a[i + 2], for 8-byte elements, to lea rax, [rdi + 8*rsi + 16], and position-independent code takes the address of a global with a RIP-relative LEA such as lea rax, [rip + msg].

The same arithmetic makes LEA an addition of two registers and a constant, the index scaled by 1, 2, 4 or 8, into a third register and without touching the flags. GCC 14 and Clang 23 use it to multiply by small constants: x * 5 becomes lea rax, [rdi + 4*rdi], x * 25 two such LEAs, x * 7 an LEA of 8*rdi and a SUB. For a + b + 3 on ints, GCC emits lea eax, [rdi + rsi + 3], Clang an LEA without the 3 and an ADD. The vendors’ optimization manuals explain the split: an LEA with all three parts costs more than one with two. Intel’s describes it taking longer on fewer execution ports in the Sandy Bridge microarchitecture (Section 3.5.1.2), and AMD’s has Zen 5 run it as two macro-ops instead of one (Section 2.10.2).

Operand and address size#

The two sizes are independent: the sum is formed at the address size, 64 bits or, with a 67h prefix, 32, and then cut or zero-extended to the operand size. A 32-bit destination with a 64-bit address is what makes the int example above work. Carries only move upward, so the low 32 bits of the sum are right whatever bits 63:32 of RDI and RSI hold, and writing EAX clears the rest of RAX, as any 32-bit write does.

In the optimization guide

What the optimization guide says about LEA, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Latency, throughput and dependency chains: On the critical path, two simpler lea instructions or an add beat an lea with a base, an index and a displacement on Sandy Bridge, Skylake, Zen 4 and Zen 5.

Bulldozer to Excavator

• Integer execution: An lea with one or two address parts takes one cycle; one with base, index and displacement is a double instruction of 2 cycles, and the 16-bit form is slower still. sources differ

Crestmont and Gracemont

• Integer execution: An lea with two of base, index and displacement and no scale runs on any ALU port in one cycle; one with all three is two micro-ops and a cycle longer; a scaled index with no displacement keeps it one micro-op, but on port 02 only.

Haswell and Broadwell

• Integer execution and bypass: An LEA with one or two inputs runs on port 1 or 5 in a cycle.

Ice Lake to Rocket Lake

• Integer execution: Each of the four integer ports has an LEA unit, against two on Skylake, where three-operand forms ran on port 1 only; LLVM’s tuning for these cores no longer counts any lea form as slow. sources differ

Jaguar and Puma

• Integer execution: An lea with one or two inputs is a one-cycle ALU op; with base, index and displacement it runs in the store address unit in 2 cycles. sources differ

Sandy Bridge and Ivy Bridge

• Integer and vector execution: An LEA with one or two sources runs on port 1 or 5, doubling the throughput earlier cores gave it; a three-operand LEA (two registers plus a displacement, say) is limited to port 1 and needs two cycles there to read all its inputs.

Silvermont to Goldmont Plus

• Out-of-order and in-order execution: On Silvermont and Goldmont, use lea only to keep a source or to scale an index; otherwise add is as fast or faster. sources differ

Skylake to Cooper Lake

• Integer execution: An lea with a base, an index and a displacement runs on port 1 only; the simpler forms run on ports 1 and 5.

Tremont

• Integer execution: An lea with two of base, index and displacement and no scaled index runs on any ALU port in one micro-op; one with all three is two micro-ops, the one using the index on port 02, and a cycle longer; a scaled index without displacement keeps it one micro-op, but on port 02 only.

Zen and Zen+

• Integer execution: An lea with two operands takes one cycle on any ALU; one with three goes to an address unit and takes two cycles, its result coming back through ALU 2 or 3. sources differ

Zen 2

• Integer execution: An lea with two operands takes one cycle on any ALU; one with three, a base, an index and a displacement, goes to an address unit and takes two cycles, with its result returning through ALU 2 or 3. sources differ

Zen 3

• Integer execution: An lea with a base, an index and a displacement is two macro-ops, where one with two of them is one. sources differ

Zen 4

• Integer execution: An lea with a base, an index and a displacement is two macro-ops, where one with two of them is one. sources differ

Zen 5

• Integer execution: An lea with a base, an index and a displacement is two macro-ops, where one with two of them is one.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

a = src.address                  # base + index * scale + displacement, the
                                 # registers and the sum at ASIZE bits: 64,
                                 # or 32 with a 67h prefix
dest.write(a)                    # cut to OSIZE: a 16-bit register keeps
                                 # bits 63:16, a 32-bit one gets bits 63:32
                                 # cleared
# memory is not accessed; [RIP + disp] is the address of the next
# instruction plus disp

Operands

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• DAS
• DEC
• DIV
• ENTER
• IDIV
• IMUL
• IN
• INC
• INS
• INT
• INT1
• INT3
• INTO
• IRET
• Jcc
• JCXZ
• JECXZ
• JMP
• JRCXZ
• LDS
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUT

All 109 General-purpose instructions