Understanding the LEA x86 instruction
I could not for the life of me understand what x86 LEA ("Load Effective Address") was for after reading
at least a dozen descriptions. Most of them say something like,
"a MOV puts the value of foo in a register, while LEA puts the address of foo in a register."
But the thing I couldn’t get past was: foo is an address!
That’s like saying "it puts the address of the address in a register."
I can already do that with mov.
Here’s what I mean in NASM:
mov eax, foo ; move address of foo into eax mov eax, [foo] ; move value of foo into eax
That second line is doing what lea claims to do, right?
So I wrote a little NASM program to see how lea would disassemble:
global _start
section .data
foo:
dd 0x777
section .text
_start:
mov eax, foo
mov eax, [foo]
lea eax, [foo]
And here’s what the GDB disassembly looks like:
(gdb) disass /r _start 0x08048080 <+0>: b8 90 90 04 08 mov $0x8049090,%eax 0x08048085 <+5>: a1 90 90 04 08 mov 0x8049090,%eax 0x0804808a <+10>: 8d 05 90 90 04 08 lea 0x8049090,%eax
Sure enough, both mov eax, foo and lea eax, [foo] are functionally doing the same
thing, but lea takes an extra byte to describe the instruction! Yay?!
Thankfully, Wikipedia cleared this up for me once and for all:
It may also be a clever way of doing more calculations than normal in one instruction; for example, using such an instruction with the addressing mode "base+index+offset" (detailed below) allows one to add two registers and a constant together in one instruction.
(Emphasis mine)
That’s it!!! That’s the part everybody’s leaving out!
LEA can do address math in a single instruction. So my example above was a very poor use of LEA.
Like this:
lea eax, [eax + ebx + 1337]
Done. Now I know why it exists. Thank you, Wikipedia.
Bonus!
If you search for information about the LEA instruction, one of the top hits is a Stack Overflow question titled, "What’s the purpose of the LEA instruction?"
One of the answers attributes a quote to 'the "Zen of Assembly" by Abrash':
LEA, the only instruction that performs memory addressing calculations but doesn’t actually address memory. LEA accepts a standard memory addressing operand, but does nothing more than store the calculated memory offset in the specified register, which may be any general purpose register.
It turns out, this quote is slightly mis-attributed. Abrash did write it, but it’s from his Graphics Programming BLack Book. (Which, to be fair, happened to include a full copy of Zen of Assembly Language on CD-ROM!)
Michael Abrash, perhaps best known for working on Quake for id Software in the 1990s, indeed once wrote a book titled Zen of Assembly Language. The publishing history of this book is a whole story of its own, but just know that due to the efforts of a series of people over three decades, we can read his explanation of LEA from Zen circa 1989:
"`lea` is something of an odd bird, as the only mod-reg-rm memory-addressing instruction that doesn’t access memory. lea calculates the offset of the memory operand… and then loads that offset into one of the 8 general-purpose registers, without accessing memory at all. Basically, lea is nothing more than a means by which to load the result of an EA calculation into a register."
For example,
lea bx,[MemVar]loads the offset of MemVar into BX. Now, we wouldn’t generally want to useleato load simple offsets, since mov can do that more efficiently; mov bx,offset MemVar is 1 byte shorter and 4 cycles faster thanlea bx,[MemVar]. (Sinceleainvolves EA calculation, it’s not particularly fast; however, it’s faster than any mod-reg-rm memory-accessing instruction, taking only 2 cycles plus the EA calculation time.)
leashines when you need to load a register with a complex memory address, preferably without disturbing any of the registers that make up the memory address.
Between the two Abrash treatments of LEA, perhaps it’s already much clearer what you can do with the instruction.
If that’s not enough, or you want to dig deeper, the Black Book, in particular, goes on for 5 full pages about LEA and includes diagrams. And it’s really well written. Highly recommended.
But the book is long out of print, very expensive on the second-hand market, and the publisher is out of business, so I feel fine about sharing this chapter in its entirety:
abrash_black_book_chapter6.pdf (3.5Mb PDF)
Hope that was helpful!