image/svg+xmlMOV—MoveOpcodeInstructionOp/ En64-Bit ModeCompat/Leg ModeDescription88 /rMOV r/m8,r8MRValidValidMove r8 to r/m8.REX + 88 /rMOV r/m8***,r8***MRValidN.E.Move r8 to r/m8.89 /rMOV r/m16,r16MRValidValidMove r16 to r/m16.89 /rMOV r/m32,r32MRValidValidMove r32 to r/m32.REX.W + 89 /rMOV r/m64,r64MRValidN.E.Move r64 to r/m64.8A /rMOV r8,r/m8RMValidValidMove r/m8 to r8.REX + 8A /rMOV r8***,r/m8***RMValidN.E.Move r/m8 to r8.8B /rMOV r16,r/m16RMValidValidMove r/m16 to r16.8B /rMOV r32,r/m32RMValidValidMove r/m32 to r32.REX.W + 8B /rMOV r64,r/m64RMValidN.E.Move r/m64 to r64.8C /rMOV r/m16,Sreg**MRValidValidMove segment register to r/m16.8C /rMOV r16/r32/m16, Sreg**MRValidValidMove zero extended 16-bit segment register to r16/r32/m16.REX.W + 8C /rMOV r64/m16, Sreg**MRValidValidMove zero extended 16-bit segment register to r64/m16.8E /rMOV Sreg,r/m16**RMValidValidMove r/m16 to segment register.REX.W + 8E /rMOV Sreg,r/m64**RMValidValidMove lower 16 bits of r/m64 to segment register.A0MOV AL,moffs8*FDValidValidMove byte at (seg:offset) to AL.REX.W + A0MOV AL,moffs8*FD ValidN.E.Move byte at (offset) to AL.A1MOV AX,moffs16*FDValidValidMove word at (seg:offset) to AX.A1MOV EAX,moffs32*FDValidValidMove doubleword at (seg:offset) to EAX.REX.W + A1MOV RAX,moffs64*FDValidN.E.Move quadword at (offset) to RAX.A2MOV moffs8,ALTD ValidValidMove AL to (seg:offset).REX.W + A2MOV moffs8***,ALTDValidN.E.Move AL to (offset).A3MOV moffs16*,AXTDValidValidMove AX to (seg:offset).A3MOV moffs32*,EAXTDValidValidMove EAX to (seg:offset).REX.W + A3MOV moffs64*,RAXTDValidN.E.Move RAX to (offset).B0+ rb ibMOV r8, imm8OIValidValidMove imm8 to r8.REX + B0+ rb ibMOV r8***, imm8OIValidN.E.Move imm8 to r8.B8+ rw iwMOV r16, imm16OIValidValidMove imm16 to r16.B8+ rd idMOV r32, imm32OIValidValidMove imm32 to r32.REX.W + B8+ rd ioMOV r64, imm64OIValidN.E.Move imm64 to r64.C6 /0 ibMOV r/m8, imm8MIValidValidMove imm8 to r/m8.REX + C6 /0 ibMOV r/m8***, imm8MIValidN.E.Move imm8 to r/m8.C7 /0 iwMOV r/m16, imm16MIValidValidMove imm16 to r/m16.C7 /0 idMOV r/m32, imm32MIValidValidMove imm32 to r/m32.REX.W + C7 /0 idMOV r/m64, imm32MIValid N.E.Move imm32 sign extended to 64-bits to r/m64.

image/svg+xmlInstruction Operand EncodingDescriptionCopies the second operand (source operand) to the first operand (destination operand). The source operand can be an immediate value, general-purpose register, segment register, or memory location; the destination register can be a general-purpose register, segment register, or memory location. Both operands must be the same size, which can be a byte, a word, a doubleword, or a quadword.The MOV instruction cannot be used to load the CS register. Attempting to do so results in an invalid opcode excep-tion (#UD). To load the CS register, use the far JMP, CALL, or RET instruction.If the destination operand is a segment register (DS, ES, FS, GS, or SS), the source operand must be a valid segment selector. In protected mode, moving a segment selector into a segment register automatically causes the segment descriptor information associated with that segment selector to be loaded into the hidden (shadow) part of the segment register. While loading this information, the segment selector and segment descriptor information is validated (see the “Operation” algorithm below). The segment descriptor data is obtained from the GDT or LDT entry for the specified segment selector. A NULL segment selector (values 0000-0003) can be loaded into the DS, ES, FS, and GS registers without causing a protection exception. However, any subsequent attempt to reference a segment whose corresponding segment register is loaded with a NULL value causes a general protection exception (#GP) and no memory reference occurs.Loading the SS register with a MOV instruction suppresses or inhibits some debug exceptions and inhibits inter-rupts on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of the next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruc-tion (MOV ESP, stack-pointer value) before an event can be delivered. See Section 6.8.3, “Masking Exceptions and Interrupts When Switching Stacks,” in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. Intel recommends that software use the LSS instruction to load the SS register and ESP together.When executing MOV Reg, Sreg, the processor copies the content of Sreg to the 16 least significant bits of the general-purpose register. The upper bits of the destination register are zero for most IA-32 processors (Pentium Pro processors and later) and all Intel 64 processors, with the exception that bits 31:16 are undefined for Intel Quark X1000 processors, Pentium and earlier processors.In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi-tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the beginning of this section for encoding data and limits.NOTES:*The moffs8, moffs16, moffs32 and moffs64 operands specify a simple offset relative to the segment base, where 8, 16, 32 and 64 refer to the size of the data. The address-size attribute of the instruction determines the size of the offset, either 16, 32 or 64 bits.**In 32-bit mode, the assembler may insert the 16-bit operand-size prefix with this instruction (see the following “Description” sec-tion for further information).***In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH. Op/EnOperand 1Operand 2Operand 3Operand 4MRModRM:r/m (w)ModRM:reg (r)NANARMModRM:reg (w)ModRM:r/m (r)NANAFDAL/AX/EAX/RAXMoffsNANATDMoffs (w)AL/AX/EAX/RAXNANAOIopcode + rd (w)imm8/16/32/64NANAMIModRM:r/m (w)imm8/16/32/64NANA

image/svg+xmlOperationDEST := SRC;Loading a segment register while in protected mode results in special checks and actions, as described in the following listing. These checks are performed on the segment selector and the segment descriptor to which it points.IF SS is loadedTHENIF segment selector is NULLTHEN #GP(0); FI;IF segment selector index is outside descriptor table limits OR segment selector's RPL ≠ CPLOR segment is not a writable data segmentOR DPL ≠ CPLTHEN #GP(selector); FI;IF segment not marked present THEN #SS(selector); ELSESS := segment selector;SS := segment descriptor; FI;FI;IF DS, ES, FS, or GS is loaded with non-NULL selectorTHENIF segment selector index is outside descriptor table limitsOR segment is not a data or readable code segmentOR ((segment is a data or nonconforming code segment) AND ((RPL > DPL) or (CPL > DPL)))THEN #GP(selector); FI;IF segment not marked presentTHEN #NP(selector);ELSESegmentRegister := segment selector;SegmentRegister := segment descriptor; FI;FI;IF DS, ES, FS, or GS is loaded with NULL selectorTHENSegmentRegister := segment selector;SegmentRegister := segment descriptor;FI;Flags AffectedNone

image/svg+xmlProtected Mode Exceptions#GP(0)If attempt is made to load SS register with NULL segment selector.If the destination operand is in a non-writable segment.If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.If the DS, ES, FS, or GS register contains a NULL segment selector.#GP(selector)If segment selector index is outside descriptor table limits. If the SS register is being loaded and the segment selector's RPL and the segment descriptor’s DPL are not equal to the CPL. If the SS register is being loaded and the segment pointed to is a non-writable data segment.If the DS, ES, FS, or GS register is being loaded and the segment pointed to is not a data or readable code segment.If the DS, ES, FS, or GS register is being loaded and the segment pointed to is a data or nonconforming code segment, and either the RPL or the CPL is greater than the DPL.#SS(0)If a memory operand effective address is outside the SS segment limit.#SS(selector)If the SS register is being loaded and the segment pointed to is marked not present.#NPIf the DS, ES, FS, or GS register is being loaded and the segment pointed to is marked not present.#PF(fault-code)If a page fault occurs.#AC(0)If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3.#UDIf attempt is made to load the CS register.If the LOCK prefix is used.Real-Address Mode Exceptions#GPIf a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.#SSIf a memory operand effective address is outside the SS segment limit.#UDIf attempt is made to load the CS register.If the LOCK prefix is used.Virtual-8086 Mode Exceptions#GP(0)If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.#SS(0)If a memory operand effective address is outside the SS segment limit.#PF(fault-code)If a page fault occurs.#AC(0)If alignment checking is enabled and an unaligned memory reference is made.#UDIf attempt is made to load the CS register.If the LOCK prefix is used.Compatibility Mode ExceptionsSame exceptions as in protected mode.

image/svg+xml64-Bit Mode Exceptions#GP(0)If the memory address is in a non-canonical form.If an attempt is made to load SS register with NULL segment selector when CPL = 3.If an attempt is made to load SS register with NULL segment selector when CPL < 3 and CPL ≠ RPL.#GP(selector)If segment selector index is outside descriptor table limits. If the memory access to the descriptor table is non-canonical.If the SS register is being loaded and the segment selector's RPL and the segment descriptor’s DPL are not equal to the CPL.If the SS register is being loaded and the segment pointed to is a nonwritable data segment.If the DS, ES, FS, or GS register is being loaded and the segment pointed to is not a data or readable code segment.If the DS, ES, FS, or GS register is being loaded and the segment pointed to is a data or nonconforming code segment, but both the RPL and the CPL are greater than the DPL.#SS(0)If the stack address is in a non-canonical form.#SS(selector)If the SS register is being loaded and the segment pointed to is marked not present.#PF(fault-code)If a page fault occurs.#AC(0)If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3.#UDIf attempt is made to load the CS register.If the LOCK prefix is used.

image/svg+xmlMOV—Move to/from Control RegistersInstruction Operand EncodingDescriptionMoves the contents of a control register (CR0, CR2, CR3, CR4, or CR8) to a general-purpose register or the contents of a general-purpose register to a control register. The operand size for these instructions is always 32 bits in non-64-bit modes, regardless of the operand-size attribute. On a 64-bit capable processor, an execution of MOV to CR outside of 64-bit mode zeros the upper 32 bits of the control register. (See “Control Registers” in Chapter 2 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for a detailed description of the flags and fields in the control registers.) This instruction can be executed only when the current privilege level is 0.At the opcode level, the reg field within the ModR/M byte specifies which of the control registers is loaded or read. The 2 bits in the mod field are ignored. The r/m field specifies the general-purpose register loaded or read. Some of the bits in CR0, CR3 and CR4 are reserved and must be written with zeros. Attempting to set any reserved bits in CR0[31:0] is ignored. Attempting to set any reserved bits in CR0[63:32] results in a general-protection excep-tion, #GP(0). When PCIDs are not enabled, bits 2:0 and bits 11:5 of CR3 are not used and attempts to set them are ignored. Attempting to set any reserved bits in CR3[63:MAXPHYADDR] results in #GP(0). Attempting to set any reserved bits in CR4 results in #GP(0). On Pentium 4, Intel Xeon and P6 family processors, CR0.ET remains set after any load of CR0; attempts to clear this bit have no impact.In certain cases, these instructions have the side effect of invalidating entries in the TLBs and the paging-structure caches. See Section 4.10.4.1, “Operations that Invalidate TLBs and Paging-Structure Caches,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A for details.The following side effects are implementation-specific for the Pentium 4, Intel Xeon, and P6 processor family: when modifying PE or PG in register CR0, or PSE or PAE in register CR4, all TLB entries are flushed, including global entries. Software should not depend on this functionality in all Intel64 or IA-32 processors.In 64-bit mode, the instruction’s default operation size is 64 bits. The REX.R prefix must be used to access CR8. Use of REX.B permits access to additional registers (R8-R15). Use of the REX.W prefix or 66H prefix is ignored. Use of Opcode/InstructionOp/ En64-Bit ModeCompat/Leg ModeDescription0F 20/rMOV r32, CR0–CR7MRN.E.ValidMove control register to r32.0F 20/rMOV r64, CR0–CR7MRValidN.E.Move extended control register to r64. REX.R + 0F 20 /0MOV r64, CR8MRValid N.E.Move extended CR8 to r64.10F 22 /rMOV CR0–CR7, r32RMN.E.ValidMove r32 to control register.0F 22 /rMOV CR0–CR7, r64RMValid N.E.Move r64 to extended control register.REX.R + 0F 22 /0MOV CR8, r64RMValidN.E.Move r64 to extended CR8.1NOTE:1. MOV CR* instructions, except for MOV CR8, are serializing instructions. MOV CR8 is not architecturally defined as a serializing instruction. For more information, see Chapter 8 in Intel® 64 and IA-32 Architectures Soft-ware Developer’s Manual, Volume 3A.Op/EnOperand 1Operand 2Operand 3Operand 4MRModRM:r/m (w)ModRM:reg (r)NANARMModRM:reg (w)ModRM:r/m (r)NANA

image/svg+xmlthe REX.R prefix to specify a register other than CR8 causes an invalid-opcode exception. See the summary chart at the beginning of this section for encoding data and limits.If CR4.PCIDE= 1, bit63 of the source operand to MOV to CR3 determines whether the instruction invalidates entries in the TLBs and the paging-structure caches (see Section 4.10.4.1, “Operations that Invalidate TLBs and Paging-Structure Caches,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). The instruction does not modify bit63 of CR3, which is reserved and always 0.See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 25 of the Intel® 64 and IA-32 Archi-tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in VMX non-root operation.OperationDEST := SRC;Flags AffectedThe OF, SF, ZF, AF, PF, and CF flags are undefined.Protected Mode Exceptions#GP(0)If the current privilege level is not 0.If an attempt is made to write invalid bit combinations in CR0 (such as setting the PG flag to 1 when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1).If an attempt is made to write a 1 to any reserved bit in CR4.If an attempt is made to write 1 to CR4.PCIDE.If any of the reserved bits are set in the page-directory pointers table (PDPT) and the loading of a control register causes the PDPT to be loaded into the processor.#UD If the LOCK prefix is used.If an attempt is made to access CR1, CR5, CR6, CR7, or CR9–CR15.Real-Address Mode Exceptions#GPIf an attempt is made to write a 1 to any reserved bit in CR4.If an attempt is made to write 1 to CR4.PCIDE.If an attempt is made to write invalid bit combinations in CR0 (such as setting the PG flag to 1 when the PE flag is set to 0).#UD If the LOCK prefix is used.If an attempt is made to access CR1, CR5, CR6, CR7, or CR9–CR15.Virtual-8086 Mode Exceptions#GP(0)These instructions cannot be executed in virtual-8086 mode.Compatibility Mode Exceptions#GP(0)If the current privilege level is not 0.If an attempt is made to write invalid bit combinations in CR0 (such as setting the PG flag to 1 when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1).If an attempt is made to change CR4.PCIDE from 0 to 1 while CR3[11:0] ≠ 000H.If an attempt is made to clear CR0.PG[bit 31] while CR4.PCIDE= 1.If an attempt is made to leave IA-32e mode by clearing CR4.PAE[bit 5].#UD If the LOCK prefix is used.If an attempt is made to access CR1, CR5, CR6, CR7, or CR9–CR15.

image/svg+xml64-Bit Mode Exceptions#GP(0)If the current privilege level is not 0.If an attempt is made to write invalid bit combinations in CR0 (such as setting the PG flag to 1 when the PE flag is set to 0, or setting the CD flag to 0 when the NW flag is set to 1).If an attempt is made to change CR4.PCIDE from 0 to 1 while CR3[11:0] ≠ 000H.If an attempt is made to clear CR0.PG[bit 31].If an attempt is made to write a 1 to any reserved bit in CR4.If an attempt is made to write a 1 to any reserved bit in CR8.If an attempt is made to write a 1 to any reserved bit in CR3[63:MAXPHYADDR].If an attempt is made to leave IA-32e mode by clearing CR4.PAE[bit 5].#UD If the LOCK prefix is used.If an attempt is made to access CR1, CR5, CR6, CR7, or CR9–CR15.If the REX.R prefix is used to specify a register other than CR8.

image/svg+xmlMOV—Move to/from Debug RegistersInstruction Operand EncodingDescriptionMoves the contents of a debug register (DR0, DR1, DR2, DR3, DR4, DR5, DR6, or DR7) to a general-purpose register or vice versa. The operand size for these instructions is always 32 bits in non-64-bit modes, regardless of the operand-size attribute. (See Section 17.2, “Debug Registers”, of the Intel® 64 and IA-32 Architectures Soft-ware Developer’s Manual, Volume 3A, for a detailed description of the flags and fields in the debug registers.)The instructions must be executed at privilege level 0 or in real-address mode.When the debug extension (DE) flag in register CR4 is clear, these instructions operate on debug registers in a manner that is compatible with Intel386 and Intel486 processors. In this mode, references to DR4 and DR5 refer to DR6 and DR7, respectively. When the DE flag in CR4 is set, attempts to reference DR4 and DR5 result in an undefined opcode (#UD) exception. (The CR4 register was added to the IA-32 Architecture beginning with the Pentium processor.)At the opcode level, the reg field within the ModR/M byte specifies which of the debug registers is loaded or read. The two bits in the mod field are ignored. The r/m field specifies the general-purpose register loaded or read.In 64-bit mode, the instruction’s default operation size is 64 bits. Use of the REX.B prefix permits access to addi-tional registers (R8–R15). Use of the REX.W or 66H prefix is ignored. Use of the REX.R prefix causes an invalid-opcode exception. See the summary chart at the beginning of this section for encoding data and limits. OperationIF ((DE = 1) and (SRC or DEST = DR4 or DR5))THEN#UD;ELSE DEST := SRC;FI;Flags AffectedThe OF, SF, ZF, AF, PF, and CF flags are undefined.Opcode/InstructionOp/ En64-Bit ModeCompat/Leg ModeDescription0F 21/rMOV r32, DR0–DR7MRN.E.ValidMove debug register to r32.0F 21/rMOV r64, DR0–DR7MRValidN.E.Move extended debug register to r64. 0F 23 /rMOV DR0–DR7, r32RMN.E.ValidMove r32 to debug register.0F 23 /rMOV DR0–DR7, r64RMValid N.E.Move r64 to extended debug register. Op/EnOperand 1Operand 2Operand 3Operand 4MRModRM:r/m (w)ModRM:reg (r)NANARMModRM:reg (w)ModRM:r/m (r)NANA

image/svg+xmlProtected Mode Exceptions#GP(0)If the current privilege level is not 0.#UDIf CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or DR5.If the LOCK prefix is used.#DBIf any debug register is accessed while the DR7.GD[bit 13] = 1.Real-Address Mode Exceptions#UDIf CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or DR5. If the LOCK prefix is used.#DBIf any debug register is accessed while the DR7.GD[bit 13] = 1.Virtual-8086 Mode Exceptions#GP(0)The debug registers cannot be loaded or read when in virtual-8086 mode.Compatibility Mode ExceptionsSame exceptions as in protected mode.64-Bit Mode Exceptions#GP(0)If the current privilege level is not 0.If an attempt is made to write a 1 to any of bits 63:32 in DR6.If an attempt is made to write a 1 to any of bits 63:32 in DR7.#UDIf CR4.DE[bit 3] = 1 (debug extensions) and a MOV instruction is executed involving DR4 or DR5.If the LOCK prefix is used.If the REX.R prefix is used.#DBIf any debug register is accessed while the DR7.GD[bit 13] = 1.

This UNOFFICIAL reference was generated from the official Intel® 64 and IA-32 Architectures Software Developer’s Manual by a dumb script. There is no guarantee that some parts aren't mangled or broken and is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.