Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 27
INSTRUCTION SET REFERENCE, A-L
LODS/LODSB/LODSW/LODSD/LODSQ-Load String
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
AC
LODS m8
ZO
Valid
Valid
For legacy mode, Load byte at address DS:(E)SI
into AL. For 64-bit mode load byte at address
(R)SI into AL.
AD
LODS m16
ZO
Valid
Valid
For legacy mode, Load word at address
DS:(E)SI into AX. For 64-bit mode load word at
address (R)SI into AX.
AD
LODS m32
ZO
Valid
Valid
For legacy mode, Load dword at address
DS:(E)SI into EAX. For 64-bit mode load dword
at address (R)SI into EAX.
REX.W + AD
LODS m64
ZO
Valid
N.E.
Load qword at address (R)SI into RAX.
AC
LODSB
ZO
Valid
Valid
For legacy mode, Load byte at address DS:(E)SI
into AL. For 64-bit mode load byte at address
(R)SI into AL.
AD
LODSW
ZO
Valid
Valid
For legacy mode, Load word at address
DS:(E)SI into AX. For 64-bit mode load word at
address (R)SI into AX.
AD
LODSD
ZO
Valid
Valid
For legacy mode, Load dword at address
DS:(E)SI into EAX. For 64-bit mode load dword
at address (R)SI into EAX.
REX.W + AD
LODSQ
ZO
Valid
N.E.
Load qword at address (R)SI into RAX.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
Loads a byte, word, or doubleword from the source operand into the AL, AX, or EAX register, respectively. The
source operand is a memory location, the address of which is read from the DS:ESI or the DS:SI registers
(depending on the address-size attribute of the instruction, 32 or 16, respectively). The DS segment may be over-
ridden with a segment override prefix.
At the assembly-code level, two forms of this instruction are allowed: the “explicit-operands” form and the “no-
operands” form. The explicit-operands form (specified with the LODS mnemonic) allows the source operand to be
specified explicitly. Here, the source operand should be a symbol that indicates the size and location of the source
value. The destination operand is then automatically selected to match the size of the source operand (the AL
register for byte operands, AX for word operands, and EAX for doubleword operands). This explicit-operands form
is provided to allow documentation; however, note that the documentation provided by this form can be
misleading. That is, the source operand symbol must specify the correct type (size) of the operand (byte, word, or
doubleword), but it does not have to specify the correct location. The location is always specified by the DS:(E)SI
registers, which must be loaded correctly before the load string instruction is executed.
The no-operands form provides “short forms” of the byte, word, and doubleword versions of the LODS instructions.
Here also DS:(E)SI is assumed to be the source operand and the AL, AX, or EAX register is assumed to be the desti-
nation operand. The size of the source and destination operands is selected with the mnemonic: LODSB (byte
loaded into register AL), LODSW (word loaded into AX), or LODSD (doubleword loaded into EAX).
After the byte, word, or doubleword is transferred from the memory location into the AL, AX, or EAX register, the
(E)SI register is incremented or decremented automatically according to the setting of the DF flag in the EFLAGS
register. (If the DF flag is 0, the (E)SI register is incremented; if the DF flag is 1, the ESI register is decremented.)
The (E)SI register is incremented or decremented by 1 for byte operations, by 2 for word operations, or by 4 for
doubleword operations.
LODS/LODSB/LODSW/LODSD/LODSQ-Load String
Vol. 2A
3-611
INSTRUCTION SET REFERENCE, A-L
In 64-bit mode, use of the REX.W prefix promotes operation to 64 bits. LODS/LODSQ load the quadword at address
(R)SI into RAX. The (R)SI register is then incremented or decremented automatically according to the setting of
the DF flag in the EFLAGS register.
The LODS, LODSB, LODSW, and LODSD instructions can be preceded by the REP prefix for block loads of ECX bytes,
words, or doublewords. More often, however, these instructions are used within a LOOP construct because further
processing of the data moved into the register is usually necessary before the next transfer can be made. See
“REP/REPE/REPZ /REPNE/REPNZ-Repeat String Operation Prefix” in Chapter 4 of the Intel® 64 and IA-32 Archi-
tectures Software Developer’s Manual, Volume 2B, for a description of the REP prefix.
Operation
IF AL := SRC; (* Byte load *)
THEN AL := SRC; (* Byte load *)
IF DF = 0
THEN (E)SI := (E)SI + 1;
ELSE (E)SI := (E)SI - 1;
FI;
ELSE IF AX := SRC; (* Word load *)
THEN IF DF = 0
THEN (E)SI := (E)SI + 2;
ELSE (E)SI := (E)SI - 2;
IF;
FI;
ELSE IF EAX := SRC; (* Doubleword load *)
THEN IF DF = 0
THEN (E)SI := (E)SI + 4;
ELSE (E)SI := (E)SI - 4;
FI;
FI;
ELSE IF RAX := SRC; (* Quadword load *)
THEN IF DF = 0
THEN (R)SI := (R)SI + 8;
ELSE (R)SI := (R)SI - 8;
FI;
FI;
FI;
Flags Affected
None.
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used.
3-612
Vol. 2A
LODS/LODSB/LODSW/LODSD/LODSQ-Load String
INSTRUCTION SET REFERENCE, A-L
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
LODS/LODSB/LODSW/LODSD/LODSQ-Load String
Vol. 2A
3-613
INSTRUCTION SET REFERENCE, A-L
LOOP/LOOPcc-Loop According to ECX Counter
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
E2 cb
LOOP rel8
D
Valid
Valid
Decrement count; jump short if count ≠ 0.
E1 cb
LOOPE rel8
D
Valid
Valid
Decrement count; jump short if count ≠ 0 and
ZF = 1.
E0 cb
LOOPNE rel8
D
Valid
Valid
Decrement count; jump short if count ≠ 0 and
ZF = 0.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
D
Offset
N/A
N/A
N/A
Description
Performs a loop operation using the RCX, ECX or CX register as a counter (depending on whether address size is 64
bits, 32 bits, or 16 bits). Note that the LOOP instruction ignores REX.W; but 64-bit address size can be over-ridden
using a 67H prefix.
Each time the LOOP instruction is executed, the count register is decremented, then checked for 0. If the count is
0, the loop is terminated and program execution continues with the instruction following the LOOP instruction. If
the count is not zero, a near jump is performed to the destination (target) operand, which is presumably the
instruction at the beginning of the loop.
The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc-
tion pointer in the IP/EIP/RIP register). This offset is generally specified as a label in assembly code, but at the
machine code level, it is encoded as a signed, 8-bit immediate value, which is added to the instruction pointer.
Offsets of -128 to +127 are allowed with this instruction.
Some forms of the loop instruction (LOOPcc) also accept the ZF flag as a condition for terminating the loop before
the count reaches zero. With these forms of the instruction, a condition code (cc) is associated with each instruction
to indicate the condition being tested for. Here, the LOOPcc instruction itself does not affect the state of the ZF flag;
the ZF flag is changed by other instructions in the loop.
Operation
IF (AddressSize = 32)
THEN Count is ECX;
ELSE IF (AddressSize = 64)
Count is RCX;
ELSE Count is CX;
FI;
Count := Count - 1;
IF Instruction is not LOOP
THEN
IF (Instruction := LOOPE) or (Instruction := LOOPZ)
THEN IF (ZF = 1) and (Count ≠ 0)
THEN BranchCond := 1;
ELSE BranchCond := 0;
FI;
ELSE (Instruction = LOOPNE) or (Instruction = LOOPNZ)
IF (ZF = 0 ) and (Count ≠ 0)
THEN BranchCond := 1;
ELSE BranchCond := 0;
FI;
3-614
Vol. 2A
LOOP/LOOPcc-Loop According to ECX Counter
INSTRUCTION SET REFERENCE, A-L
FI;
ELSE (* Instruction = LOOP *)
IF (Count ≠ 0)
THEN BranchCond := 1;
ELSE BranchCond := 0;
FI;
FI;
IF BranchCond = 1
THEN
IF in 64-bit mode (* OperandSize = 64 *)
THEN
tempRIP := RIP + SignExtend(DEST);
IF tempRIP is not canonical
THEN #GP(0);
ELSE RIP := tempRIP;
FI;
ELSE
tempEIP := EIP SignExtend(DEST);
IF OperandSize
16
THEN tempEIP := tempEIP AND 0000FFFFH;
FI;
IF tempEIP is not within code segment limit
THEN #GP(0);
ELSE EIP := tempEIP;
FI;
FI;
ELSE
Terminate loop and continue program execution at (R/E)IP;
FI;
Flags Affected
None.
Protected Mode Exceptions
#GP(0)
If the offset being jumped to is beyond the limits of the CS segment.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP
If the offset being jumped to is beyond the limits of the CS segment or is outside of the effec-
tive address space from 0 to FFFFH. This condition can occur if a 32-bit address size override
prefix is used.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
LOOP/LOOPcc-Loop According to ECX Counter
Vol. 2A
3-615
INSTRUCTION SET REFERENCE, A-L
64-Bit Mode Exceptions
#GP(0)
If the offset being jumped to is in a non-canonical form.
#UD
If the LOCK prefix is used.
3-616
Vol. 2A
LOOP/LOOPcc-Loop According to ECX Counter
INSTRUCTION SET REFERENCE, A-L
LSL-Load Segment Limit
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
0F 03 /r
LSL r16, r16/m16
RM
Valid
Valid
Load: r16 := segment limit, selector r16/m16.
0F 03 /r
LSL r32, r32/m161
RM
Valid
Valid
Load: r32 := segment limit, selector r32/m16.
REX.W + 0F 03 /r
LSL r64, r32/m161
RM
Valid
Valid
Load: r64 := segment limit, selector r32/m16
NOTES:
1. For all loads (regardless of destination sizing), only bits 16-0 are used. Other bits are ignored.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Loads the unscrambled segment limit from the segment descriptor specified with the second operand (source
operand) into the first operand (destination operand) and sets the ZF flag in the EFLAGS register. The source
operand (which can be a register or a memory location) contains the segment selector for the segment descriptor
being accessed. The destination operand is a general-purpose register.
The processor performs access checks as part of the loading process. Once loaded in the destination register, soft-
ware can compare the segment limit with the offset of a pointer.
The segment limit is a 20-bit value contained in bytes 0 and 1 and in the first 4 bits of byte 6 of the segment
descriptor. If the descriptor has a byte granular segment limit (the granularity flag is set to 0), the destination
operand is loaded with a byte granular value (byte limit). If the descriptor has a page granular segment limit (the
granularity flag is set to 1), the LSL instruction will translate the page granular limit (page limit) into a byte limit
before loading it into the destination operand. The translation is performed by shifting the 20-bit “raw” limit left 12
bits and filling the low-order 12 bits with 1s.
When the operand size is 32 bits, the 32-bit byte limit is stored in the destination operand. When the operand size
is 16 bits, a valid 32-bit limit is computed; however, the upper 16 bits are truncated and only the low-order 16 bits
are loaded into the destination operand.
This instruction performs the following checks before it loads the segment limit into the destination register:
• Checks that the segment selector is not NULL.
• Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being
accessed
• Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for
(can be accessed with) the LSL instruction. The valid special segment and gate descriptor types are given in the
following table.
• If the segment is not a conforming code segment, the instruction checks that the specified segment descriptor
is visible at the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of
the segment selector).
If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no
value is loaded in the destination operand.
LSL-Load Segment Limit
Vol. 2A
3-617
INSTRUCTION SET REFERENCE, A-L
Table 3-56. Segment and Gate Descriptor Types
Type
Protected Mode
IA-32e Mode
Name
Valid
Name
Valid
0
Reserved
No
Reserved
No
1
Available 16-bit TSS
Yes
Reserved
No
2
LDT
Yes
LDT1
Yes
3
Busy 16-bit TSS
Yes
Reserved
No
4
16-bit call gate
No
Reserved
No
5
16-bit/32-bit task gate
No
Reserved
No
6
16-bit interrupt gate
No
Reserved
No
7
16-bit trap gate
No
Reserved
No
8
Reserved
No
Reserved
No
9
Available 32-bit TSS
Yes
64-bit TSS1
Yes
A
Reserved
No
Reserved
No
B
Busy 32-bit TSS
Yes
Busy 64-bit TSS1
Yes
C
32-bit call gate
No
64-bit call gate
No
D
Reserved
No
Reserved
No
E
32-bit interrupt gate
No
64-bit interrupt gate
No
F
32-bit trap gate
No
64-bit trap gate
No
NOTES:
1. In this case, the descriptor comprises 16 bytes; bits 12:8 of the upper 4 bytes must be 0.
Operation
IF SRC(Offset) > descriptor table limit
THEN ZF := 0; FI;
Read segment descriptor;
IF SegmentDescriptor(Type) ≠ conforming code segment
and (CPL > DPL) OR (RPL > DPL)
or Segment type is not valid for instruction
THEN
ZF := 0;
ELSE
temp := SegmentLimit([SRC]);
IF (SegmentDescriptor(G) = 1)
THEN temp := (temp << 12) OR 00000FFFH;
ELSE IF OperandSize = 32
THEN DEST := temp; FI;
ELSE IF OperandSize = 64 (* REX.W used *)
THEN DEST := temp(* Zero-extended *); FI;
ELSE (* OperandSize = 16 *)
DEST := temp AND FFFFH;
FI;
FI;
Flags Affected
The ZF flag is set to 1 if the segment limit is loaded successfully; otherwise, it is set to 0.
3-618
Vol. 2A
LSL-Load Segment Limit
INSTRUCTION SET REFERENCE, A-L
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and the memory operand effective address is unaligned while
the current privilege level is 3.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#UD
The LSL instruction cannot be executed in real-address mode.
Virtual-8086 Mode Exceptions
#UD
The LSL instruction cannot be executed in virtual-8086 mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If the memory operand effective address referencing the SS segment is in a non-canonical
form.
#GP(0)
If the memory operand effective address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and the memory operand effective address is unaligned while
the current privilege level is 3.
#UD
If the LOCK prefix is used.
LSL-Load Segment Limit
Vol. 2A
3-619
INSTRUCTION SET REFERENCE, A-L
LTR-Load Task Register
Opcode
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
0F 00 /3
LTR r/m16
M
Valid
Valid
Load r/m16 into task register.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
M
ModRM:r/m (r)
N/A
N/A
N/A
Description
Loads the source operand into the segment selector field of the task register. The source operand (a general-
purpose register or a memory location) contains a segment selector that points to a task state segment (TSS).
After the segment selector is loaded in the task register, the processor uses the segment selector to locate the
segment descriptor for the TSS in the global descriptor table (GDT). It then loads the segment limit and base
address for the TSS from the segment descriptor into the task register. The task pointed to by the task register is
marked busy, but a switch to the task does not occur.
The LTR instruction is provided for use in operating-system software; it should not be used in application programs.
It can only be executed in protected mode when the CPL is 0. It is commonly used in initialization code to establish
the first task to be executed.
The operand-size attribute has no effect on this instruction.
In 64-bit mode, the operand size is still fixed at 16 bits. The instruction references a 16-byte descriptor to load the
64-bit base.
Operation
IF SRC is a NULL selector
THEN #GP(0);
IF SRC(Offset) > descriptor table limit OR IF SRC(type) ≠ global
THEN #GP(segment selector); FI;
Read segment descriptor;
IF segment descriptor is not for an available TSS
THEN #GP(segment selector); FI;
IF segment descriptor is not present
THEN #NP(segment selector); FI;
TSSsegmentDescriptor(busy) := 1;
(* Locked read-modify-write operation on the entire descriptor when setting busy flag *)
TaskRegister(SegmentSelector) := SRC;
TaskRegister(SegmentDescriptor) := TSSSegmentDescriptor;
Flags Affected
None.
3-620
Vol. 2A
LTR-Load Task Register
INSTRUCTION SET REFERENCE, A-L
Protected Mode Exceptions
#GP(0)
If the current privilege level is not 0.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the source operand contains a NULL segment selector.
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
selector.
#GP(selector)
If the source selector points to a segment that is not a TSS or to one for a task that is already
busy.
If the selector points to LDT or is beyond the GDT limit.
#NP(selector)
If the TSS is marked not present.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#UD
The LTR instruction is not recognized in real-address mode.
Virtual-8086 Mode Exceptions
#UD
The LTR instruction is not recognized in virtual-8086 mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the current privilege level is not 0.
If the memory address is in a non-canonical form.
If the source operand contains a NULL segment selector.
#GP(selector)
If the source selector points to a segment that is not a TSS or to one for a task that is already
busy.
If the selector points to LDT or is beyond the GDT limit.
If the descriptor type of the upper 8-byte of the 16-byte descriptor is non-zero.
#NP(selector)
If the TSS is marked not present.
#PF(fault-code)
If a page fault occurs.
#UD
If the LOCK prefix is used.
LTR-Load Task Register
Vol. 2A
3-621
INSTRUCTION SET REFERENCE, A-L
LZCNT-Count the Number of Leading Zero Bits
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit Mode
Feature
Flag
F3 0F BD /r
RM
V/V
LZCNT
Count the number of leading zero bits in r/m16, return result in r16.
LZCNT r16, r/m16
F3 0F BD /r
RM
V/V
LZCNT
Count the number of leading zero bits in r/m32, return result in r32.
LZCNT r32, r/m32
F3 REX.W 0F BD /r
RM
V/N.E.
LZCNT
Count the number of leading zero bits in r/m64, return result in r64.
LZCNT r64, r/m64
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Counts the number of leading most significant zero bits in a source operand (second operand) returning the result
into a destination (first operand).
LZCNT differs from BSR. For example, LZCNT will produce the operand size when the input operand is zero. It
should be noted that on processors that do not support LZCNT, the instruction byte encoding is executed as BSR.
In 64-bit mode 64-bit operand size requires REX.W=1.
Operation
temp := OperandSize - 1
DEST := 0
WHILE (temp >= 0) AND (Bit(SRC, temp) = 0)
DO
temp := temp - 1
DEST := DEST+ 1
OD
IF DEST = OperandSize
CF := 1
ELSE
CF := 0
FI
IF DEST = 0
ZF := 1
ELSE
ZF := 0
FI
Flags Affected
ZF flag is set to 1 in case of zero output (most significant bit of the source is set), and to 0 otherwise, CF flag is set
to 1 if input was zero and cleared otherwise. OF, SF, PF, and AF flags are undefined.
Intel C/C++ Compiler Intrinsic Equivalent
LZCNT unsigned __int32 _lzcnt_u32(unsigned __int32 src);
LZCNT unsigned __int64 _lzcnt_u64(unsigned __int64 src);
3-622
Vol. 2A
LZCNT-Count the Number of Leading Zero Bits
INSTRUCTION SET REFERENCE, A-L
Protected Mode Exceptions
#GP(0)
For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
If the DS, ES, FS, or GS register is used to access memory and it contains a null segment
selector.
#SS(0)
For an illegal address in the SS segment.
#PF (fault-code)
For a page fault.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If LOCK prefix is used.
Real-Address Mode Exceptions
#GP(0)
If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.
#SS(0)
For an illegal address in the SS segment.
#UD
If LOCK prefix is used.
Virtual 8086 Mode Exceptions
#GP(0)
If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.
#SS(0)
For an illegal address in the SS segment.
#PF (fault-code)
For a page fault.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in Protected Mode.
64-Bit Mode Exceptions
#GP(0)
If the memory address is in a non-canonical form.
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#PF (fault-code)
For a page fault.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If LOCK prefix is used.
LZCNT-Count the Number of Leading Zero Bits
Vol. 2A
3-623
INSTRUCTION SET REFERENCE, A-L
3-624
Vol. 2A
LZCNT-Count the Number of Leading Zero Bits