MOVZX

MOVZX reads a byte or a word and writes it to a wider register with zeros above it. It is how code loads unsigned char and unsigned short values and widens them: GCC 14 at -O2 compiles a read of *p, with p an unsigned char *, to movzx eax, byte ptr [rdi]. MOVSX fills the upper bits with copies of the sign bit instead.

Which destination size#

Writing a 32-bit register already clears bits 63:32, so movzx eax, byte ptr [rdi] leaves the same 64-bit value in RAX as the REX.W form movzx rax, byte ptr [rdi], in one byte less, and compilers use the 32-bit form for 64-bit results too. No MOVZX takes a 32-bit source: the zero-extension from 32 to 64 bits is a 32-bit MOV. A 16-bit destination is the odd one out, keeping bits 63:16 of its register like any other 16-bit write.

Instead of a byte or word MOV#

mov al, [rdi] replaces only the low byte of RAX, so afterwards the register mixes the new byte with what it held before, and every later reader of RAX depends on both. MOVZX into a 32-bit register writes all 64 bits and leaves nothing of the old value.

The high-byte registers#

MOVZX can read AH, CH, DH and BH, which makes bits 15:8 of a value two instructions away: GCC 14 and Clang 23 both compile (x >> 8) & 0xff to mov eax, edi and movzx eax, ah. Those four registers exist only in instructions without a REX prefix; with one, the same register numbers name SPL, BPL, SIL and DIL. So a MOVZX that reads AH must write one of the eight original registers, and the 64-bit form, which needs REX.W, cannot read them at all.

AT&T names#

GNU’s AT&T syntax spells MOVZX with two size letters, source first: movzbl (byte to 32 bits), movzwl (word to 32 bits), movzbw, movzbq and movzwq. GCC writes movzbl and movzwl even for 64-bit results.

In the optimization guide

What the optimization guide says about MOVZX, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Move elimination: Intel’s list of moves eliminated from Ivy Bridge on includes movzx from an 8-bit register other than AH, BH, CH and DH into a 32-bit or 64-bit one, which Agner Fog confirmed on Ivy Bridge, and LLVM’s Alder Lake model gives that movzx a latency of zero. sources differ
• Partial register and flag writes: Writing whole registers avoids the question on every core: Intel advises working on 32-bit registers rather than 8-bit or 16-bit ones, loading bytes and words with movzx, and choosing zero extension over sign extension where the value allows.

Skylake to Cooper Lake

• Integer execution: xor, sub and the vector pxor, xorps, pandn, psub and pcmpgt of a register with itself zero it without an execution unit, four a cycle, for 32-bit and 64-bit and all vector registers.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

dest.write(src)                  # zero-extended to OSIZE: a 16-bit register
                                 # keeps bits 63:16, a 32-bit one gets
                                 # bits 63:32 cleared

Operands

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• Jcc
• JCXZ
• JECXZ
• JMP
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MUL
• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC

All 109 General-purpose instructions