SCAS

SCAS compares AL, AX, EAX or RAX with the element at [RDI], setting the flags as cmp al, [rdi] would, and moves RDI to the next element. With REPNE it searches for the value; with REPE it skips over a run of it.

REPNE SCASB as strlen and memchr#

The classic strlen sets AL to 0, RCX to -1, so that the count cannot run out, and RDI to the string, then runs repne scasb. It stops after the terminating zero, with RDI one byte past it. RCX has gone down once for every byte compared, the terminator included, so for a string of n bytes it ends at -(n + 2), and not rcx followed by dec rcx leaves n.

memchr sets RCX to the length instead, and the flags tell the two endings apart: ZF set means the byte was found, at RDI - 1; ZF clear means the count ran out first. A length of 0 compares nothing and changes no flag, so ZF must not be trusted without a test of RCX.

REPE SCAS stops at the first element that differs from rAX, which finds, for example, the first non-zero quadword of a buffer with RAX = 0.

Things to know#

• Only ES:RDI. The element is always read through ES:RDI, and a segment prefix cannot change that; in 64-bit mode ES has base 0.
• No source pointer. RSI is neither read nor changed.
• Faults. A fault partway through leaves RDI and RCX at the element that faulted and the flags as they were before the instruction, so it resumes cleanly. The direction flag and the 67 prefix work as on the MOVS page.

Speed#

GCC 14 and Clang 23 at -O2 call strlen and memchr rather than inline a REPNE SCASB. Intel’s optimization manual advises against REP SCAS and REP CMPS for performance and points to SIMD code instead (Section 3.7.5), such as PCMPEQB and PMOVMSKB over 16 bytes at a time. From Golden Cove on, its processors report faster REPE and REPNE SCASB and CMPSB, for 1 to 128 bytes in the first-level cache, in CPUID.(EAX=7,ECX=1):EAX[12] (Section 3.8.3). The instruction table of AMD’s Zen 5 guide lists SCASB as microcoded.

In the optimization guide

What the optimization guide says about SCAS, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Memory

• REP MOVS and STOS: Intel’s cores made rep movsb and rep stosb fast from Ivy Bridge, and short strings fast from Ice Lake and Golden Cove, as CPUID reports.

Golden Cove and Raptor Cove

• Loads, stores and caches: Short rep movsb, rep stosb, rep cmpsb and rep scasb are fast: with the data in the L1 cache, any length up to 128 bytes takes a flat 9, 12, 15 and 15 cycles, zero included except for the compares.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

step = -(OSIZE // 8) if df else OSIZE // 8
flags = sub_flags(rAX, load(aDI, OSIZE))   # as CMP rAX, [rDI]
aDI = low(aDI + step, ASIZE)

step = -(OSIZE // 8) if df else OSIZE // 8
d = aDI
c = aCX
for i in range(aCX):             # no flag changes when aCX is 0
    v = load(d, OSIZE)
    flags = sub_flags(rAX, v)
    d = low(d + step, ASIZE)
    c -= 1
    if v != rAX:
        break                    # ZF clear: the first difference
aDI = d
aCX = c

step = -(OSIZE // 8) if df else OSIZE // 8
d = aDI
c = aCX
for i in range(aCX):
    v = load(d, OSIZE)
    flags = sub_flags(rAX, v)
    d = low(d + step, ASIZE)
    c -= 1
    if v == rAX:
        break                    # ZF set: found
aDI = d
aCX = c

Operands

Flags

Attributes

What else XED records about the forms. How to read.

REP forms

repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SETcc
• SHL
• SHLD
• SHR
• SHRD
• STC
• STD
• STI
• STOS
• SUB
• TEST
• UD0
• UD1
• UD2
• UDB
• XADD
• XCHG
• XLAT
• XOR

All 109 General-purpose instructions