MOVS

MOVS copies one element, a byte, word, doubleword or quadword, from [RSI] to [RDI] and moves both pointers to the next element: up while the direction flag is clear, down while it is set. A REP prefix repeats it RCX times, counting RCX down to 0, so rep movsb is a whole memcpy in two bytes, with RDI, RSI and RCX as its arguments. GCC 14 at -O2 copies a 512-byte struct with mov ecx, 64 and rep movsq, where Clang 23 calls memcpy.

The doubleword form shares its name with SSE2’s MOVSD, a move of one double; assemblers tell them apart by the operands.

Things to know#

• Direction. System V and Microsoft x64 require the direction flag clear at calls and returns (see the registers), so code can use MOVS without a CLD; code that sets the flag with STD must clear it again.
• Overlap. The copy is defined element by element, so a destination one element above the source repeats the first element all along, as Zen 5 recorded. Copying such buffers downward, with DF set, works but is much slower on Intel’s processors, whose optimization manual suggests copying the overlapping tail first instead (Section 3.7.6.3).
• Interruptions. A REP MOVS can stop between elements for an interrupt or a page fault, with RCX, RSI and RDI describing the work left and RIP still at the instruction, which then resumes.
• Address size. With a 67 prefix it uses ESI, EDI and, under REP, ECX, and writes them as 32-bit registers, clearing their upper halves.
• F2. Neither manual lists REPNE with MOVS, but XED decodes F2 A4 as REP MOVSB, and Zen 5 repeated it the same way.

Fast strings#

Processors may run a REP MOVS in groups of several elements, which Intel calls fast-string operation. The stores of one instruction may then reach other processors out of order, or repeated (Intel’s Volume 3A, Section 11.2.4). On Zen 5 too they may arrive out of order, and copies at least the size of the L3 cache use streaming stores (AMD’s guide, Section 2.13.6). Both vendors keep the instruction’s stores after older stores and before younger ones, so a flag written after the copy still publishes it. Intel’s processors report enhanced REP MOVSB and STOSB in CPUID.(EAX=7,ECX=0):EBX[9], and faster copies of 1 to 128 bytes in EDX[4] (optimization manual, Section 3.7.6).

In the optimization guide

What the optimization guide says about MOVS, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Memory

• REP MOVS and STOS: Intel’s cores made rep movsb and rep stosb fast from Ivy Bridge, and short strings fast from Ice Lake and Golden Cove, as CPUID reports.
• REP MOVS and STOS: rep movs is not always the fastest copy: short or misaligned copies can be faster with vector registers.

Bulldozer to Excavator

• Integer execution: rep movs and rep stos have a fast microcode path that moves 16 bytes at a time when the direction flag is clear, the blocks do not overlap and the addresses are aligned to the operand size.

Golden Cove and Raptor Cove

• Loads, stores and caches: Short rep movsb, rep stosb, rep cmpsb and rep scasb are fast: with the data in the L1 cache, any length up to 128 bytes takes a flat 9, 12, 15 and 15 cycles, zero included except for the compares.

Haswell and Broadwell

• Loads, stores and strings: rep movsb copies more than 20 bytes a cycle when the copy is long, using the 256-bit store path, but loses to SIMD code below a few hundred bytes; rep stosb fills up to 32 bytes a cycle when the count is large.

Ice Lake to Rocket Lake

• Loads, stores and caches: rep movsb is fast for 1 to 128 bytes, reported by CPUID leaf 7, EDX bit 4, while rep stosb is unchanged. sources differ

Sandy Bridge and Ivy Bridge

• What Ivy Bridge changed: Ivy Bridge is the first core with enhanced REP MOVSB and STOSB, flagged by CPUID leaf 7’s EBX bit 9, which make a byte-granularity REP string fast as well as flexible for memory copies and fills; on Ivy Bridge itself, though, Intel’s manual notes they may still not reach the throughput of a hand-written 128-bit or 256-bit AVX copy.

Silvermont to Goldmont Plus

• Loads, stores and caches: rep movsb and rep stosb are enhanced from Silvermont on, but rep movs suffers from line splits.

Skylake to Cooper Lake

• Loads, stores and caches: rep movs reaches full speed only with source and destination both aligned to 32 bytes; otherwise a copy with YMM or ZMM registers is faster.

Zen 5

• Loads, stores and caches: rep movs and rep stos of at least the size of the L3 store with streaming stores that bypass the caches, and on some systems smaller ones skip reading the lines they overwrite whole.

Vulnerability mitigations

Mitigations of these processor vulnerabilities use MOVS:

• CVE-2023-23583: Redundant Prefix Issue

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

n = OSIZE // 8
step = -n if df else n           # DF set: down
store(aDI, OSIZE, load(aSI, OSIZE))
aSI = low(aSI + step, ASIZE)
aDI = low(aDI + step, ASIZE)

n = OSIZE // 8
step = -n if df else n
s = aSI
d = aDI
for i in range(aCX):             # nothing at all when aCX is 0
    # one element after the other: a destination one element
    # ahead of the source repeats the first element all along
    store(d, OSIZE, load(s, OSIZE))
    s = low(s + step, ASIZE)
    d = low(d + step, ASIZE)
aSI = s                          # 67 prefix: bits 63:32 cleared
aDI = d
aCX = 0

Operands

Flags

Attributes

What else XED records about the forms. How to read.

REP forms

repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• INT3
• INTO
• IRET
• Jcc
• JCXZ
• JECXZ
• JMP
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET

All 109 General-purpose instructions