STOS

STOS stores AL, AX, EAX or RAX at [RDI] and moves RDI to the next element, up or down as the direction flag says. A REP prefix repeats it RCX times, so rep stosb is a memset with RDI, AL and RCX as its arguments, and rep stosq fills quadwords.

In compiled code#

GCC 14 at -O2 uses it for blocks whose size it knows:

• A 4 KiB local array initialized to zeros becomes xor eax, eax, mov ecx, 512, mov rdi, rsp and rep stosq.
• memset(p, 0, 256), with p a char *, stores the first and the last quadword with MOVs, moves RDI up to the next multiple of 8 and leaves the rest to rep stosq, so the ends overlap instead of needing byte stores.
• Any value but 0 must first be repeated in every byte of RAX: memset(p, 7, 300) starts with movabs rax, 0x0707070707070707.

Clang 23 uses none of it: it clears the 256 bytes with sixteen MOVUPS of a zeroed XMM register and calls memset for the others, as GCC also does for a 64 KiB array.

Things to know#

• Destination. STOS always writes through ES:RDI; a segment prefix cannot redirect it, unlike the source of MOVS and LODS. In 64-bit mode ES has base 0, so RDI is the address.
• Shared with MOVS. The direction flag, which the ABIs want clear, the resumption after an interrupt or fault, the 67 prefix and the F2 prefix, which Zen 5 also ran as REP, work as the MOVS page describes.
• Count 0. With RCX = 0, REP STOS stores nothing and leaves RDI as it was.

Fast strings#

The stores of one REP STOS may become visible to other processors out of order, but not before older stores or after younger ones (Intel’s Volume 3A, Section 11.2.4, and AMD’s Zen 5 guide, Section 2.13.6). On Zen 5, a fill at least as large as the L3 cache uses streaming stores, and in some system configurations smaller fills skip reading the cache lines they overwrite whole. Intel’s processors report fast fills of 0 to 128 bytes, from Golden Cove on, in CPUID.(EAX=7,ECX=1):EAX[11] (optimization manual, Section 3.8.2). On Ivy Bridge, by the same manual, a REP STOSB memset to a misaligned destination runs about 20% slower than to an aligned one (Section 3.7.6.4).

In the optimization guide

What the optimization guide says about STOS, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Memory

• REP MOVS and STOS: Intel’s cores made rep movsb and rep stosb fast from Ivy Bridge, and short strings fast from Ice Lake and Golden Cove, as CPUID reports.

Bulldozer to Excavator

• Integer execution: rep movs and rep stos have a fast microcode path that moves 16 bytes at a time when the direction flag is clear, the blocks do not overlap and the addresses are aligned to the operand size.

Golden Cove and Raptor Cove

• Loads, stores and caches: Short rep movsb, rep stosb, rep cmpsb and rep scasb are fast: with the data in the L1 cache, any length up to 128 bytes takes a flat 9, 12, 15 and 15 cycles, zero included except for the compares.

Haswell and Broadwell

• Loads, stores and strings: rep movsb copies more than 20 bytes a cycle when the copy is long, using the 256-bit store path, but loses to SIMD code below a few hundred bytes; rep stosb fills up to 32 bytes a cycle when the count is large.

Sandy Bridge and Ivy Bridge

• What Ivy Bridge changed: Ivy Bridge is the first core with enhanced REP MOVSB and STOSB, flagged by CPUID leaf 7’s EBX bit 9, which make a byte-granularity REP string fast as well as flexible for memory copies and fills; on Ivy Bridge itself, though, Intel’s manual notes they may still not reach the throughput of a hand-written 128-bit or 256-bit AVX copy.

Silvermont to Goldmont Plus

• Loads, stores and caches: rep movsb and rep stosb are enhanced from Silvermont on, but rep movs suffers from line splits.

Zen 5

• Loads, stores and caches: rep movs and rep stos of at least the size of the L3 store with streaming stores that bypass the caches, and on some systems smaller ones skip reading the lines they overwrite whole.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

step = -(OSIZE // 8) if df else OSIZE // 8
store(aDI, OSIZE, rAX)
aDI = low(aDI + step, ASIZE)

step = -(OSIZE // 8) if df else OSIZE // 8
d = aDI
for i in range(aCX):
    store(d, OSIZE, rAX)
    d = low(d + step, ASIZE)
aDI = d
aCX = 0

Operands

Flags

Attributes

What else XED records about the forms. How to read.

REP forms

repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD
• SHR
• SHRD
• STC
• STD
• STI
• SUB
• TEST
• UD0
• UD1
• UD2
• UDB
• XADD
• XCHG
• XLAT
• XOR

All 109 General-purpose instructions