x86 Instruction Set Reference



Opcode Mnemonic Description
88 /r MOV r/m8,r8 Move r8 to r/m8.
89 /r MOV r/m16,r16 Move r16 to r/m16.
89 /r MOV r/m32,r32 Move r32 to r/m32.
8A /r MOV r8,r/m8 Move r/m8 to r8.
8B /r MOV r16,r/m16 Move r/m16 to r16.
8B /r MOV r32,r/m32 Move r/m32 to r32.
8C /r MOV r/m16,Sreg** Move segment register to r/m16.
8E /r MOV Sreg,r/m16** Move r/m16 to segment register.
A0 MOV AL,moffs8* Move byte at (seg:offset) to AL.
A1 MOV AX,moffs16* Move word at (seg:offset) to AX.
A1 MOV EAX,moffs32* Move doubleword at (seg:offset) to EAX.
A2 MOV moffs8*,AL Move AL to (seg:offset).
A3 MOV moffs16*,AX Move AX to (seg:offset).
A3 MOV moffs32*,EAX Move EAX to (seg:offset).
B0+ rb MOV r8,imm8 Move imm8 to r8.
B8+ rw MOV r16,imm16 Move imm16 to r16.
B8+ rd MOV r32,imm32 Move imm32 to r32.
C6 /0 MOV r/m8,imm8 Move imm8 to r/m8.
C7 /0 MOV r/m16,imm16 Move imm16 to r/m16.
C7 /0 MOV r/m32,imm32 Move imm32 to r/m32.

* The moffs8, moffs16, and moffs32 operands specify a simple offset relative to the segment base, where 8, 16, and 32 refer to the size of the data. The address-size attribute of the instruction determines the size of the offset, either 16 or 32 bits.

** In 32-bit mode, the assembler may insert the 16-bit operand-size prefix with this instruction.

Copies the second operand (source operand) to the first operand (destination operand). The source operand can be an immediate value, general-purpose register, segment register, or memory location; the destination register can be a general-purpose register, segment register, or memory location. Both operands must be the same size, which can be a byte, a word, or a doubleword.

The MOV instruction cannot be used to load the CS register. Attempting to do so results in an invalid opcode exception (#UD). To load the CS register, use the far JMP, CALL, or RET instruction.

If the destination operand is a segment register (DS, ES, FS, GS, or SS), the source operand must be a valid segment selector. In protected mode, moving a segment selector into a segment register automatically causes the segment descriptor information associated with that segment selector to be loaded into the hidden (shadow) part of the segment register. While loading this information, the segment selector and segment descriptor information is validated (see the "Operation" algorithm below). The segment descriptor data is obtained from the GDT or LDT entry for the specified segment selector.

A null segment selector (values 0000-0003) can be loaded into the DS, ES, FS, and GS registers without causing a protection exception. However, any subsequent attempt to reference a segment whose corresponding segment register is loaded with a null value causes a general protection exception (#GP) and no memory reference occurs.

Loading the SS register with a MOV instruction inhibits all interrupts until after the execution of the next instruction. This operation allows a stack pointer to be loaded into the ESP register with the next instruction (MOV ESP, stack-pointer value) before an interrupt occurs1. Be aware that the LSS instruction offers a more efficient method of loading the SS and ESP registers.

When operating in 32-bit mode and moving data between a segment register and a generalpurpose register, the 32-bit IA-32 processors do not require the use of the 16-bit operand-size prefix (a byte with the value 66H) with this instruction, but most assemblers will insert it if the standard form of the instruction is used (for example, MOV DS, AX). The processor will execute this instruction correctly, but it will usually require an extra clock. With most assemblers, using the instruction form MOV DS, EAX will avoid this unneeded 66H prefix. When the processor executes the instruction with a 32-bit general-purpose register, it assumes that the 16 least-significant bits of the general-purpose register are the destination or source operand. If the register is a destination operand, the resulting value in the two high-order bytes of the register is implementation dependent. For the Pentium 4, Intel Xeon, and P6 family processors, the two high-order bytes are filled with zeros; for earlier 32-bit IA-32 processors, the two high order bytes are undefined.

Destination = Source;

Loading a segment register while in protected mode results in special checks and actions,
as described in the following listing. These checks are performed on the segment selector
and the segment descriptor it points to. If a code instruction breakpoint (for debug)
is placed on an instruction located immediately after a MOV SS instruction,
the breakpoint may not be triggered. Note that in a sequence of instructions that
individually delay interrupts past the following instruction, only the first instruction
in the sequence is guaranteed to delay the interrupt, but subsequent interrupt-delaying
instructions may not delay the interrupt. Thus, in the following instruction sequence:
Interrupts may be recognized before MOV ESP, EBP executes, because STI also delays interrupts for one instruction.

if(IsLoaded(SS)) {
	if(SegmentSelector == 0) Exception(GP(0));
	if(!IsWithinDescriptorTableLimits(SegmentSelector) || SegmentSelector.RPL != CPL || !IsWritableDataSegment(SegmentSelector) || DPL != CPL) Exception(GP(Selector));
	if(!IsPresent(Segment)) Exception(GP(Selector));
	SS = SegmentSelector;
	SS = SegmentDescriptor;

if((IsLoaded(DS) || IsLoaded(ES) || IsLoaded(FS) || IsLoaded(GS)) && Selector != 0) {
	SS = SegmentSelector;
	SS = SegmentDescriptor;
Flags affected


Real-Address Mode Exceptions
#GPIf a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#GPIf a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SSIf a memory operand effective address is outside the SS segment limit.
Virtual-8086 Mode Exceptions
#GP(0)If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#GP(0)If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)If a page fault occurs.
#AC(0)If alignment checking is enabled and an unaligned memory reference is made.
Instruction Latency Throughput Execution Unit