INS instruction (General-purpose)

INS reads one element, a byte, word or doubleword, from the I/O port in DX and stores it at [RDI], then moves RDI to the next element: up while the direction flag is clear, down while it is set. With a REP prefix it repeats RCX times, so rep insw fills a buffer from a device’s data port, the job IN would do one element at a time. OUTS is the reverse, from [RSI] to a port.

Things that differ from the other string instructions

Fixed segment. The destination is always ES:rDI, and no prefix overrides ES; in 64-bit mode the segment adds nothing. The port is always DX.
No quadword. INSD with REX.W still moves a doubleword, AMD’s manual says, and steps RDI by 4.
The port first. The permission check of IN comes first: at CPL 3 with IOPL 0, Zen 5 raised #GP for INSB, INSW, INSD and their REP forms, also with RCX = 0, where the REP forms would do nothing else, and with RDI = 8, in page 0, which the probe leaves unmapped, where a page fault might have been expected. Memory and RDI were left alone.
A read without a write. Intel’s manual warns that REP INS may read the port and then fail to store the element, when the store takes a page fault or a VM exit, so that the value read is lost. A driver whose port reads have side effects must make sure that the buffer is present and writable first.
Speed. Intel’s manual also cautions that not every device keeps up with the rate at which REP INS and REP OUTS run.

From C

glibc’s <sys/io.h> has insb, insw and insl, which take a port, a buffer and a count. At -O2, GCC 14 and Clang 23 load the count into RCX, the buffer into RDI and the port into EDX, then emit CLD followed by REP INSW: the inline assembly clears the direction flag itself rather than rely on the calling convention, which already requires it clear (see CLD).

AMD’s Zen 5 guide lists INS as microcoded.

Forms

Every encoding of INS that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`INSB` INSB	`6C`	Base instruction set
`INSW` INSW	`66 6D`	Base instruction set
`INSD` INSD	`6D` `REX.W 6D`	Base instruction set
`REP INSB` REP_INSB	`F3 6C` `F2 6C`	Base instruction set
`REP INSW` REP_INSW	`66 F3 6D` `66 F2 6D`	Base instruction set
`REP INSD` REP_INSD	`F3 6D` `F3 REX.W 6D` `F2 6D` `F2 REX.W 6D`	Base instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`INSB` `INSW` `INSB` `INSW`	`INSD` `INSD`
Sandy Bridge	100 / 0.33p015	100 / 0.33p015
Haswell	21 / 1.25p01234567	21 / 1.25p01234567
Broadwell, Skylake, Skylake-SP	20 / 1.25p01234567	20 / 1.25p01234567
Ice Lake	20 / 1.25p0123456789	20 / 1.25p0123456789
Alder Lake, Sapphire Rapids	20 / 19p0 p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11	20 / 21p0 p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11
Lunar Lake	100 / 0.17p012345	100 / 0.17p012345
Bonnell	59 / 29.5p01	59 / 29.5p01
Silvermont	100 / 1FPC0	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

All forms but the REP forms

n = min(OSIZE, 32)               # REX.W: still a doubleword
if CPL > iopl and not io_allowed(dx, n):
    fault(GP, 0)                 # as in the probe's cases: CPL 3,
                                 # IOPL 0, the port not allowed
store(aDI, n, io_read(dx, n))    # ES:rDI; no prefix overrides ES
step = -(n // 8) if df else n // 8
aDI = low(aDI + step, ASIZE)

Run on AMD Zen 5 (EPYC 9645): 9 cases. Every one raised an exception, at CPL 3, where the probe runs.

REP forms

n = min(OSIZE, 32)               # REX.W: still a doubleword
if CPL > iopl and not io_allowed(dx, n):
    fault(GP, 0)                 # even when aCX is 0 (Zen 5)
step = -(n // 8) if df else n // 8
d = aDI
for i in range(aCX):             # one port read per element
    store(d, n, io_read(dx, n))
    d = low(d + step, ASIZE)
aDI = d
aCX = 0

Run on AMD Zen 5 (EPYC 9645): 10 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`INSB` `INSW` `INSD`
`m8/16/32 at ES:[rDI]`	implicit	write
`rDI`	implicit	read, write
`DX`	implicit	read
`RFLAGS`	implicit	read
`REP INSB` `REP INSW` `REP INSD`
`m8/16/32 at ES:[rDI]`	implicit	conditional write
`rDI`	implicit	read, conditional write
`DX`	implicit	read
`rCX`	implicit	read, conditional write
`RFLAGS`	implicit	read

Flags

T tested; blank: not affected. How to read.

DF	IOPL
All forms
T	T

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction
REP forms: repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I186` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I386` General-purpose	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

Things that differ from the other string instructions#

From C#