rep movs

Repeat Move String

REP MOVS m, m

Moves ECX bytes/words from [ESI] to [EDI].

Details

Copies ECX/RCX bytes or words from the memory location at DS:[ESI/RSI] to ES:[EDI/RDI], decrementing or incrementing the pointers based on the Direction Flag (DF), and decrementing the counter. Repeats until RCX=0 or an interrupt occurs. No flags are modified by the instruction itself, though DF controls direction. The REP prefix causes automatic looping at the microarchitectural level.

Pseudocode Operation

while (RCX != 0) {
  if (OperandSize == 8) {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 1; RDI ← RDI + 1; } else { RSI ← RSI - 1; RDI ← RDI - 1; }
  } else if (OperandSize == 16) {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 2; RDI ← RDI + 2; } else { RSI ← RSI - 2; RDI ← RDI - 2; }
  } else {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 4; RDI ← RDI + 4; } else { RSI ← RSI - 4; RDI ← RDI - 4; }
  }
  RCX ← RCX - 1;
}

Example

REP MOVS m, [rbp-8]

Encoding

Binary Layout

Format Legacy

Opcode F3 A4

Extension Base

Operands

dest
Implicit memory for MOVS: ES:[DI] destination, DS:[SI] source
src
Memory operand

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 6C	REP INS m8, DX	ZO	Valid Valid		Input (count) bytes from port DX to (dest).
F3 6D	REP INS m16, DX	ZO	Valid Valid		Input (count) words from port DX to (dest).
F3 6D	REP INS m32, DX	ZO	Valid Valid		Input (count) doublewords from port DX to (dest).
F3 AC	REP LODS AL	ZO	Valid Valid		Load (count) bytes from (src) to AL.
F3 AD	REP LODS AX	ZO	Valid Valid		Load (count) words from (src) to AX.
F3 AD	REP LODS EAX	ZO	Valid Valid		Load (count) doublewords from (src) to EAX.
F3 REX.W AD	REP LODS RAX	ZO	Valid N.E.		Load (count) quadwords from (src) to RAX.
F3 A4	REP MOVS m8, m8	ZO	Valid Valid		Move (count) bytes from (src) to (dest).
F3 A5	REP MOVS m16, m16	ZO	Valid Valid		Move (count) words from (src) to (dest).
F3 A5	REP MOVS m32, m32	ZO	Valid Valid		Move (count) doublewords from (src) to (dest).
F3 REX.W A5	REP MOVS m64, m64	ZO	Valid N.E.		Move (count) quadwords from (src) to (dest).
F3 6E	REP OUTS DX, m8	ZO	Valid Valid		Output (count) bytes from (src) to port DX.
F3 6F	REP OUTS DX, m16	ZO	Valid Valid		Output (count) words from (src) to port DX.
F3 6F	REP OUTS DX, m32	ZO	Valid Valid	DX.	Output (count) doublewords from (src) to port
F3 AA	REP STOS m8	ZO	Valid Valid		Fill (count) bytes at (dest) with AL.
F3 AB	REP STOS m16	ZO	Valid Valid		Fill (count) words at (dest) with AX.
F3 AB	REP STOS m32	ZO	Valid Valid		Fill (count) doublewords at (dest) with EAX.
F3 REX.W AB	REP STOS m64	ZO	Valid N.E.		Fill (count) quadwords at (dest) with RAX.

Description

Repeats a string instruction the number of times specified in the count register. The count register is CX, ECX, or RCX, depending on the instruction’s address size. The REP (repeat) mnemonic is a prefix that can be added to the INS, OUTS, MOVS, LODS, and STOS instructions. The REP prefixes apply only to one string instruction at a time. To repeat a block of instructions, use the LOOP instruction or another looping construct. The REP prefixes causes the associated instruction to be repeated until the count in register is decremented to 0. Each of the string instructions uses a source address, a destination address, or both. The source address is DS:SI, DS:ESI, or DS:RSI, depending on the instruction’s address size; the DS segment may be overridden by an instruction prefix. The destination address is ES:DI, ES:EDI, or ES:RDI, depending on the instruction's address size; the ES segment may not be overridden. (Note that, in 64-bit mode, the base addresses of the CS, DS, ES, and SS segments are treated as zero.) Similarly, the size of the count register is the instruction’s address size. Thus, the default count register in 64-bit mode is RCX; REX.W has no effect on the address size and the count register. If 67H is used to override the default address size, the size of the count register is also overridden. REP—Repeat String Operation (Prefix) Vol. 2B 4-563 A repeating string operation can be suspended by an exception or interrupt. When this happens, the state of the registers is preserved to allow the string operation to be resumed upon a return from the exception or interrupt handler. The source and destination registers point to the next string elements to be operated on, the EIP register points to the string instruction, and the ECX register has the value it held following the last successful iteration of the instruction. This mechanism allows long string operations to proceed without affecting the interrupt response time of the system. Use the REP INS and REP OUTS instructions with caution. Not all I/O ports can handle the rate at which these instructions execute. Note that a REP STOS instruction is the fastest way to initialize a large block of memory. REP INS may read from the I/O port without writing to the memory location if an exception or VM exit occurs due to the write (e.g., #PF). If this would be problematic, for example because the I/O port read has side-effects, software should ensure the write to the memory location does not cause an exception or VM exit.

Operation

IF AddressSize = 16
THEN
Use CX for CountReg;
Implicit Source/Dest operand for memory use of SI/DI;
ELSE IF AddressSize = 64
THEN Use RCX for CountReg;
Implicit Source/Dest operand for memory use of RSI/RDI;
ELSE
Use ECX for CountReg;
Implicit Source/Dest operand for memory use of ESI/EDI;
FI;
WHILE CountReg ≠ 0
DO
Service pending interrupts (if any);
Execute associated string instruction;
CountReg := (CountReg – 1);
OD;

Flags Affected

None. Exceptions (All Operating Modes) Exceptions may be generated by an instruction associated with the prefix. REP—Repeat String Operation (Prefix) Vol. 2B 4-564