[PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

[PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

[Usama Arif]

Commit 68674f94ffc9 ("x86: don't use REP_GOOD or ERMS for small
memory copies") stopped selecting REP MOVSB from ERMS alone because it
is not suitable for short copies. Consequently, ordinary out-of-line
__memcpy() calls on CPUs with ERMS but without FSRM use memcpy_orig()
for every length. Its main loop copies 32 bytes per iteration and can be
slower than REP MOVSB for large copies, as measured below on Cooper Lake.

This matters for btrfs zstd decompression. The btrfs-tree commit
e27a6e4823f3 ("btrfs: zstd: avoid a copy in zstd_decompress_bio()")
removes btrfs' copy from a scratch buffer into the page cache by letting
zstd write there directly. It does not remove the copies inside
streaming zstd. ZSTD_decompressStream() still uses memcpy() to flush
decompressed data from its internal output buffer to the supplied page
(zdss_flush), and to stage compressed input when the next block crosses
an input folio supplied by btrfs (zdss_load). In Meta's fleet profile
of x86 kernels, these two btrfs/zstd call sites accounted for about 34%
of the sampled profile weight attributed to memcpy_orig().

On CPUs without FSRM, select REP MOVSB for copies of 512 bytes and above
when ERMS is present. Keep memcpy_orig() below 512 bytes. The later FSRM
alternative continues to select REP MOVSB for all sizes, including when
ERMS is not exposed.

Userspace replicas of the original and patched entry paths were run on
a turbo-disabled Xeon Platinum 8321HC (Cooper Lake), capped at
1.401 GHz. Results average two runs and scale the per-call time to
65,536 4 KB calls, or 256 MB in aggregate.

Here "hot" means cache-resident. The rows model zdss_flush() from
zstd's L2-resident output buffer, zdss_load() from a cold compressed
folio into zstd's hot input buffer, and a page copy into a cold
destination.

                                    orig  REP MOVSB  reduction
  zdss_flush: L2 -> hot page     28.0 ms   11.9 ms      57.5%
  zdss_load: cold -> hot buffer  46.1 ms   28.9 ms      37.3%
  page copy: hot -> cold page    29.8 ms   22.5 ms      24.5%

REP MOVSB was faster in every tested scenario at 512 bytes and above.
Copies below 512 bytes showed no consistent performance change across the
possible function alignments.

Signed-off-by: Usama Arif <usama.arif@linux.dev>
---
The above benchmarks to model copies in zstd were created using LLM:
https://gist.github.com/uarif1/8409ccd34284f128dbea5822ec628ef3
---
 arch/x86/lib/memcpy_64.S | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 12a23fa7c44c5..a7b3ce4fae0b4 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -31,7 +31,9 @@
  * which the compiler could/should do much better anyway.
  */
 SYM_TYPED_FUNC_START(__memcpy)
-	ALTERNATIVE "jmp memcpy_orig", "", X86_FEATURE_FSRM
+	ALTERNATIVE_2 "jmp memcpy_orig", \
+		      "cmpq $512, %rdx; jb memcpy_orig", X86_FEATURE_ERMS, \
+		      "", X86_FEATURE_FSRM
 
 	movq %rdi, %rax
 	movq %rdx, %rcx
-- 
2.53.0-Meta

Re: [PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

[Kiryl Shutsemau]

On Tue, Oct 13, 2026 at 03:04:42AM -0700, Usama Arif wrote:
>  SYM_TYPED_FUNC_START(__memcpy)
> -	ALTERNATIVE "jmp memcpy_orig", "", X86_FEATURE_FSRM
> +	ALTERNATIVE_2 "jmp memcpy_orig", \
> +		      "cmpq $512, %rdx; jb memcpy_orig", X86_FEATURE_ERMS, \
> +		      "", X86_FEATURE_FSRM

This grows the patch site from 2 bytes to 13. On FSRM the replacement is
empty, and 13 bytes is more than ASM_NOP_MAX, so add_nop() puts an
unconditional jump here, executed on every memcpy() call on FSRM
machines. :/

Maybe it is worth moving the patch site into memcpy_orig()? It already
has a 32-byte check. Which brings me to the other question:

Why 512? memmove() uses REP MOVSB from 32 bytes on ERMS. Can we do the
same here? Then we don't need a new branch at all.

--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -50,6 +50,8 @@
 	cmpq $0x20, %rdx
 	jb .Lhandle_tail
 
+	ALTERNATIVE "", __stringify(movq %rdx, %rcx; rep movsb; RET), X86_FEATURE_ERMS
+
 	/*
 	 * We check whether memory false dependence could occur,
 	 * then jump to corresponding copy mode.
-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

[Usama Arif]

On Thu, 15 Oct 2026 11:39:10 +0100 Kiryl Shutsemau <kas@kernel.org> wrote:

> On Tue, Oct 13, 2026 at 03:04:42AM -0700, Usama Arif wrote:
> >  SYM_TYPED_FUNC_START(__memcpy)
> > -	ALTERNATIVE "jmp memcpy_orig", "", X86_FEATURE_FSRM
> > +	ALTERNATIVE_2 "jmp memcpy_orig", \
> > +		      "cmpq $512, %rdx; jb memcpy_orig", X86_FEATURE_ERMS, \
> > +		      "", X86_FEATURE_FSRM
> 
> This grows the patch site from 2 bytes to 13. On FSRM the replacement is
> empty, and 13 bytes is more than ASM_NOP_MAX, so add_nop() puts an
> unconditional jump here, executed on every memcpy() call on FSRM
> machines. :/
> 

Thanks for the review and catching the FSRM padding jump! You're right,
the 13-byte empty replacement introduces an unconditional jump on every call.

> Maybe it is worth moving the patch site into memcpy_orig()? It already
> has a 32-byte check. Which brings me to the other question:

I tested the 32-byte cutoff on Cooper Lake, which has ERMS without FSRM.
With warmed, aligned buffers, 32-byte copies took 10.906 ns with the
parent and 23.148 ns with the proposal (+112%). The increases at 64, 128 and
256 bytes were about 66%, 65% and 22%. These regressions reproduced across
five process runs and all four tested entry placements.
 
I found 2K to be the spot where REP MOVSB is better. For the entry, I moved
the destination save into the FSRM alternative:

ALTERNATIVE_2 "jmp memcpy_orig", "jmp memcpy_erms", X86_FEATURE_ERMS, \
              "movq %rdi, %rax", X86_FEATURE_FSRM

The ordinary entry then only needs MOV to RCX, REP MOVSB and RET. This gives
FSRM a destination move plus one two-byte NOP, without a padding jump, and
keeps the entry size and scalar layout. A separate memcpy_erms helper checks
2048 and falls back to memcpy_orig below that size. Returns stay in normal
text.

Below is the current state of my patch. What do you think?

From cff8b5af45ec9ed10a6884e9c251f0e58147b40e Mon Sep 17 00:00:00 2001
From: Usama Arif <usama.arif@linux.dev>
Date: Thu, 1 Oct 2026 14:15:12 -0700
Subject: [PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

Commit 68674f94ffc9 ("x86: don't use REP_GOOD or ERMS for small
memory copies") stopped selecting REP MOVSB from ERMS alone because it
is not suitable for short copies. Consequently, ordinary out-of-line
__memcpy() calls on CPUs with ERMS but without FSRM such as Cooper Lakes
and Skylakes use memcpy_orig() for every length. Its main loop copies
32 bytes per iteration and can be slower than REP MOVSB for large copies,
as measured below on Cooper Lake.

This matters for btrfs zstd decompression. The btrfs-tree commit
e27a6e4823f3 ("btrfs: zstd: avoid a copy in zstd_decompress_bio()")
removes btrfs' copy from a scratch buffer into the page cache by letting
zstd write there directly. It does not remove the copies inside
streaming zstd. ZSTD_decompressStream() still uses memcpy() to flush
decompressed data from its internal output buffer to the supplied page
(zdss_flush), and to stage compressed input when the next block crosses
an input folio supplied by btrfs (zdss_load). In Meta's fleet profile
of x86 kernels, these two btrfs/zstd call sites accounted for about 34%
of the sampled profile weight attributed to memcpy_orig().

On CPUs without FSRM, select REP MOVSB for copies of 2048 bytes and above
when ERMS is present. Keep memcpy_orig() below 2048 bytes. The later FSRM
alternative continues to select REP MOVSB for all sizes, including when
ERMS is not exposed. Copies below 2048 bytes were showing regression
with REP MOVSB as seen below (medians from five runs):

  bytes          orig    REP MOVSB   increase
     32       10.9 ns      23.1 ns     112.3%
     64       13.9 ns      23.1 ns      66.3%
    128       17.5 ns      28.9 ns      65.2%
    256       26.0 ns      31.7 ns      22.1%

Dispatch ERMS through a separate helper and put the destination save in
the FSRM replacement. This keeps the entry alternative at five bytes and
preserves memcpy_orig()'s instructions and placement. FSRM executes the
destination move and one two-byte NOP before its direct REP MOVSB path.

Userspace replicas of the original and patched entry paths were run on
a turbo-disabled Xeon Platinum 8321HC (Cooper Lake, ERMS without FSRM),
at 1.4 GHz. Results below are median times per call from five process
runs of aligned 4 KiB copies at entry offset zero. The replicas use
plain RET; these are assembly microbenchmark results.

Here "warmed" means repeatedly using both buffers. The other rows flush
every cache line intersecting the source or destination before timing.

                                    orig    patched  reduction
  warmed                        371.6 ns   123.4 ns      66.8%
  source flushed                706.5 ns   400.8 ns      43.3%
  destination flushed           457.7 ns   350.0 ns      23.5%

Signed-off-by: Usama Arif <usama.arif@linux.dev>
---
 arch/x86/lib/memcpy_64.S | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 12a23fa7c44c5..6b3e203b6087c 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -31,9 +31,10 @@
  * which the compiler could/should do much better anyway.
  */
 SYM_TYPED_FUNC_START(__memcpy)
-	ALTERNATIVE "jmp memcpy_orig", "", X86_FEATURE_FSRM
+	/* The FSRM destination move shares the space used by the ERMS jump. */
+	ALTERNATIVE_2 "jmp memcpy_orig", "jmp memcpy_erms", X86_FEATURE_ERMS, \
+		      "movq %rdi, %rax", X86_FEATURE_FSRM
 
-	movq %rdi, %rax
 	movq %rdx, %rcx
 	rep movsb
 	RET
@@ -171,3 +172,11 @@ SYM_FUNC_START_LOCAL(memcpy_orig)
 	RET
 SYM_FUNC_END(memcpy_orig)
 
+SYM_FUNC_START_LOCAL(memcpy_erms)
+	cmpq $2048, %rdx
+	jb memcpy_orig
+	movq %rdi, %rax
+	movq %rdx, %rcx
+	rep movsb
+	RET
+SYM_FUNC_END(memcpy_erms)
-- 
2.53.0-Meta


> 
> Why 512? memmove() uses REP MOVSB from 32 bytes on ERMS. Can we do the
> same here? Then we don't need a new branch at all.
> 
> --- a/arch/x86/lib/memcpy_64.S
> +++ b/arch/x86/lib/memcpy_64.S
> @@ -50,6 +50,8 @@
>  	cmpq $0x20, %rdx
>  	jb .Lhandle_tail
>  
> +	ALTERNATIVE "", __stringify(movq %rdx, %rcx; rep movsb; RET), X86_FEATURE_ERMS
> +
>  	/*
>  	 * We check whether memory false dependence could occur,
>  	 * then jump to corresponding copy mode.
> -- 
>   Kiryl Shutsemau / Kirill A. Shutemov
> 

Re: [PATCH] x86/lib: Use REP MOVSB for large memcpy() on ERMS CPUs without FSRM

[David Laight]

On Tue, 13 Oct 2026 03:04:42 -0700
Usama Arif <usama.arif@linux.dev> wrote:

> Commit 68674f94ffc9 ("x86: don't use REP_GOOD or ERMS for small
> memory copies") stopped selecting REP MOVSB from ERMS alone because it
> is not suitable for short copies. Consequently, ordinary out-of-line
> __memcpy() calls on CPUs with ERMS but without FSRM use memcpy_orig()
> for every length. Its main loop copies 32 bytes per iteration and can be
> slower than REP MOVSB for large copies, as measured below on Cooper Lake.

But pretty much all the memcpy() in the kernel are small.
You are adding a conditional branch to all to of them.

If you have somewhere doing long copies then the code should probably
be calling a different function.

You also need to test on a variety of cpu, especially including older zen.
IIRC some of those don't behave as the cpu features might indicate.

Intel cpu going back to ivy bridge (and maybe sandy bridge) treat 'rep movsb'
and 'rep movsq' exactly the same, the only alignment that ever matter is
64 byte alignment (possibly less on ivy/sandy bridge) of the destination
buffer - the copies run twice as fast if 64 byte aligned.
After the initial overhead (which my tests didn't measure) the bytes/clock
was moderately constant across all buffer sizes.
Amd cpu are different, even zen-5 has a big performance hit if (IIRC)
the page offset of source in less than 128 bytes below that of the
destination (the byte alignment doesn't matter).

I need to redo those measurement having worked out hot to time the
instruction setup costs.

David

> 
> This matters for btrfs zstd decompression. The btrfs-tree commit
> e27a6e4823f3 ("btrfs: zstd: avoid a copy in zstd_decompress_bio()")
> removes btrfs' copy from a scratch buffer into the page cache by letting
> zstd write there directly. It does not remove the copies inside
> streaming zstd. ZSTD_decompressStream() still uses memcpy() to flush
> decompressed data from its internal output buffer to the supplied page
> (zdss_flush), and to stage compressed input when the next block crosses
> an input folio supplied by btrfs (zdss_load). In Meta's fleet profile
> of x86 kernels, these two btrfs/zstd call sites accounted for about 34%
> of the sampled profile weight attributed to memcpy_orig().
> 
> On CPUs without FSRM, select REP MOVSB for copies of 512 bytes and above
> when ERMS is present. Keep memcpy_orig() below 512 bytes. The later FSRM
> alternative continues to select REP MOVSB for all sizes, including when
> ERMS is not exposed.
> 
> Userspace replicas of the original and patched entry paths were run on
> a turbo-disabled Xeon Platinum 8321HC (Cooper Lake), capped at
> 1.401 GHz. Results average two runs and scale the per-call time to
> 65,536 4 KB calls, or 256 MB in aggregate.
> 
> Here "hot" means cache-resident. The rows model zdss_flush() from
> zstd's L2-resident output buffer, zdss_load() from a cold compressed
> folio into zstd's hot input buffer, and a page copy into a cold
> destination.
> 
>                                     orig  REP MOVSB  reduction
>   zdss_flush: L2 -> hot page     28.0 ms   11.9 ms      57.5%
>   zdss_load: cold -> hot buffer  46.1 ms   28.9 ms      37.3%
>   page copy: hot -> cold page    29.8 ms   22.5 ms      24.5%
> 
> REP MOVSB was faster in every tested scenario at 512 bytes and above.
> Copies below 512 bytes showed no consistent performance change across the
> possible function alignments.
> 
> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> ---
> The above benchmarks to model copies in zstd were created using LLM:
> https://gist.github.com/uarif1/8409ccd34284f128dbea5822ec628ef3
> ---
>  arch/x86/lib/memcpy_64.S | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
> index 12a23fa7c44c5..a7b3ce4fae0b4 100644
> --- a/arch/x86/lib/memcpy_64.S
> +++ b/arch/x86/lib/memcpy_64.S
> @@ -31,7 +31,9 @@
>   * which the compiler could/should do much better anyway.
>   */
>  SYM_TYPED_FUNC_START(__memcpy)
> -	ALTERNATIVE "jmp memcpy_orig", "", X86_FEATURE_FSRM
> +	ALTERNATIVE_2 "jmp memcpy_orig", \
> +		      "cmpq $512, %rdx; jb memcpy_orig", X86_FEATURE_ERMS, \
> +		      "", X86_FEATURE_FSRM
>  
>  	movq %rdi, %rax
>  	movq %rdx, %rcx