LFS instruction (General-purpose)

LFS loads a far pointer from memory: an offset, then a 16-bit selector that goes into FS. At the default operand size the pointer takes six bytes, m16:32; with a 66 prefix, four, m16:16. The selector is checked against its descriptor as a MOV to FS would check it, and only when it passes do FS and the destination register change. LDS and LES lost their opcodes, C5 and C4, to the VEX prefixes in 64-bit mode; LFS, LGS and LSS, two-byte opcodes, kept theirs. There, Zen 5 zero-extended a 32-bit offset into the full register and merged a 16-bit one into the low word.

The base comes with the selector

Loading a selector also loads FS’s base from the descriptor, a 32-bit base with bits 63:32 cleared. Zen 5, given a random 64-bit FS base, had a base of 0 after LFS loaded 2Bh, the user data segment of Linux’s GDT, and GS’s base did not change. A 64-bit program under Linux keeps its thread pointer in that base, set by arch_prctl() or WRFSBASE, so LFS would lose it. GCC 14 and Clang 23 do not use LFS for their __seg_fs address space: they add an FS prefix to the access, mov eax, dword ptr fs:[rdi], also with -m32.

Which selectors load

At CPL 3, Zen 5 loaded the null selector, with RPL 0 and 3, the user data segment with RPL 3 and 0 (2Bh, 28h), the readable 64-bit and 32-bit user code segments (33h, 23h) and 7Bh, Linux’s read-only segment for the CPU and node number. It raised #GP, with FS left as it was, for the kernel’s data segment, 18h, of DPL 0, for 63h, an empty TLS entry, for 83h, past the GDT’s 16 entries, and for 2Fh, in an LDT that the process does not have.

REX.W

Intel’s manual gives REX.W an 80-bit pointer, m16:64; AMD’s says that a 64-bit operand is not supported. Zen 5 read a 48-bit pointer, its selector at byte 4, and cleared bits 63:32 of the register. GNU as 2.44 accepts lfs rcx, tbyte ptr [rax] only with -mintel64; Clang 23 assembles it, as 48 0F B4, without being asked.

Forms

Every encoding of LFS that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`LFS r16/32/64, m16:16/32/64` LFS_GPRv_MEMp2	`0F B4 /r`	Base instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`r16, m16:16/32/64` `r32, m16:16/32/64` `r64, m16:16/32/64`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Lunar Lake	100 / 0.17p012345
Bonnell	100 / 0.5p1
Silvermont	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

n = OSIZE                        # the offset's size
if OSIZE == 64:                  # REX.W: m16:64 on Intel's (SDM
                                 # Volume 2A, LDS/LES/LFS/LGS/LSS,
                                 # rev. 093)
    if AMD:
        n = 32                   # no m16:64, but m16:32 (APM Volume
                                 # 3, LFS and Table B-1, rev. 3.36;
                                 # Zen 5)
off = load(src.address, n)       # the offset, then the selector
sel = load(src.address + n // 8, 16)
load_segment(fs, sel)            # checks the descriptor it names,
                                 # whose base FS takes
dest.write(off)                  # REX.W on AMD's: bits 63:32 cleared

Run on AMD Zen 5 (EPYC 9645): 18 cases. Its branches for Intel's processors were not run: no Intel processor ran these forms.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`LFS r16/32/64, m16:16/32/64`
`r16/32/64`	explicit	write
`m16:16/32/64`	explicit	read
`FS`	implicit	write

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I386` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

The base comes with the selector#

Which selectors load#

REX.W#