LSS instruction (General-purpose)

LSS, 0F B2, loads a far pointer from memory, an offset and then a 16-bit selector, into a general register and SS. It is LFS with SS as the segment register, and that page covers the pointer’s sizes, the merge of a 16-bit offset into the low word and the zero-extension of a 32-bit one, which Zen 5 also showed for LSS, and the REX.W form: Intel’s manual reads an 80-bit pointer, AMD’s supports none. Given 2Bh at byte 4 and 0003h at byte 8, where an 80-bit pointer keeps its selector, Zen 5 loaded 2Bh with REX.W: it read 48 bits, as for LFS.

A stack in one instruction

Both vendors’ manuals point to LSS for setting up a stack: it loads SS and the stack pointer in one instruction. A MOV to SS followed by a MOV to ESP relies instead on the processor holding off interrupts for one instruction after the MOV to SS, which AMD’s manual describes, so that none arrives between the two.

Stricter than LFS

A selector for SS must point to a writable data segment whose DPL and RPL both equal the CPL, and a null selector is refused at CPL 3. Zen 5, at CPL 3, loaded only 2Bh, the user data segment of Linux’s GDT, among the selectors that LFS accepted. It raised #GP, with SS unchanged, for the null selector 0003h, 28h (the same segment with RPL 0), the code segments 33h and 23h, 7Bh, a read-only segment, the kernel’s 18h, an empty TLS entry 63h, 83h past the GDT’s end, and 2Fh in a missing LDT.

Forms

Every encoding of LSS that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`LSS r16/32/64, m16:16/32/64` LSS_GPRv_MEMp2	`0F B2 /r`	Base instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`r16, m16:16/32/64` `r32, m16:16/32/64` `r64, m16:16/32/64`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Lunar Lake	100 / 0.17p012345
Bonnell	100 / 0.5p1
Silvermont	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

n = OSIZE                        # the offset's size
if OSIZE == 64:                  # REX.W: m16:64 on Intel's (SDM
                                 # Volume 2A, LDS/LES/LFS/LGS/LSS,
                                 # rev. 093)
    if AMD:
        n = 32                   # no m16:64, but m16:32 (APM Volume
                                 # 3, LFS and Table B-1, rev. 3.36;
                                 # Zen 5)
off = load(src.address, n)       # the offset, then the selector
sel = load(src.address + n // 8, 16)
load_segment(ss, sel)            # a writable data segment of DPL and
                                 # RPL = CPL: at CPL 3, never null
dest.write(off)                  # REX.W on AMD's: bits 63:32 cleared

Run on AMD Zen 5 (EPYC 9645): 15 cases. Its branches for Intel's processors were not run: no Intel processor ran these forms.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`LSS r16/32/64, m16:16/32/64`
`r16/32/64`	explicit	write
`m16:16/32/64`	explicit	read
`SS`	implicit	write

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I386` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

A stack in one instruction#

Stricter than LFS#