CMOVcc

CMOVcc copies its source to a register only when a condition on the flags holds, so code can pick one of two values without a branch. The condition codes are those of Jcc and SETcc, and the CMP page shows which to use for signed and unsigned comparisons. GCC 14 and Clang 23 at -O2 compile a < b ? c : a to a MOV, a CMP and a CMOVL or CMOVGE (depending on which value each moves first), and both round a signed division by 8 toward zero with lea rax, [rdi + 7], test rdi, rdi, cmovns rax, rdi and sar rax, 3.

Branch or CMOVcc#

A branch lets the processor guess the outcome and go on; CMOVcc instead makes its result wait for both values and the flags. Intel’s optimization manual therefore recommends CMOVcc only for branches that are hard to predict, and advises against it for predictable ones (Section 3.4.1.1, Coding Rule 2).

What it cannot do#

• Skip a memory access. The source is read whether or not the condition holds, so a load that is only safe when the condition is true still faults when it is false. Both compilers therefore compile c ? *p : 0 to a branch around the load. APX’s CFCMOVcc suppresses the access and its faults.
• Store. The destination is always a register; a conditional store needs a branch, or CFCMOVcc again.
• Bytes and constants. The forms are 16, 32 and 64 bits wide, and the source is a register or memory, so choosing between two constants first puts one of them in a register.
• Leave a 32-bit register alone. A 32-bit CMOVcc clears bits 63:32 of its destination even when the condition is false, so it is never a no-op on a 64-bit value.

Availability and APX#

CMOV arrived with Intel’s P6 family and has its own CPUID bit, but every x86-64 processor has it, so 64-bit code uses it without a check. APX adds a form with a new destination, CMOVcc r1, r2, r3/m, which writes r3 to r1 when the condition holds and r2 otherwise: a select that keeps both sources. Its memory operand, too, is read either way.

In the optimization guide

What the optimization guide says about CMOVcc, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Branches

• CMOV and branchless code: CMOVcc and SETcc replace a branch with a data dependence: nothing can be mispredicted, but the result waits for the condition and for both inputs, and the core can no longer run ahead on a guessed path.
• CMOV and branchless code: Branchless code wins when the work it adds costs fewer cycles than the branch it removes costs on average.
• CMOV and branchless code: A CMOV with a memory source always reads it, and may fault on it, even when the condition is false, so it cannot replace a branch that guards a load from a pointer that may be invalid.
• CMOV and branchless code: LLVM 23.1.2 turns CMOVs back into branches where a branch is likely faster.

Haswell and Broadwell

• What Broadwell changed: A micro-op of Haswell’s reads three inputs only for FMA, so ADC, SBB and CMOV, which read two registers and the flags, are two micro-ops each; Broadwell makes them one, though stores and blends stay at two.

Vulnerability mitigations

Mitigations of these processor vulnerabilities use CMOVcc:

• CVE-2021-0086: Floating Point Value Injection

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = src.read()                   # memory is read, and can fault, even
                                 # when the condition is false
r = v if cond(CC) else dest
dest.write(r)                    # a 32-bit register gets bits 63:32
                                 # cleared either way

a = src1.read()
b = src2.read()                  # memory is read, and can fault, even
                                 # when the condition is false
r = b if cond(CC) else a
dest.write(r)                    # the new destination: bits 63:OSIZE
                                 # cleared, even for 16 bits

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More APX instructions

• AADD
• AAND
• ADC
• ADCX
• ADD
• ADOX
• AND
• ANDN
• AOR
• AXOR
• BEXTR
• BLSI
• BLSMSK
• BLSR
• BZHI
• CCMPscc
• CFCMOVcc
• CMPccXADD
• CRC32
• CTESTscc
• DEC
• DIV
• ENQCMD
• ENQCMDS
• IDIV
• IMUL
• INC
• INVEPT
• INVPCID
• INVVPID
• JMPABS
• KMOVB
• KMOVD
• KMOVQ
• KMOVW
• LDTILECFG
• LZCNT
• MOVBE
• MOVDIR64B
• MOVDIRI

All 88 APX instructions