Page 716

MOV—Move

INSTRUCTION SET REFERENCE, M-U

4-36 Vol. 2B

Instruction Operand Encoding

Description

Copies the second operand (source operand) to the first operand (destination operand). The source operand can be
an immediate value, general-purpose register, segment register, or memory location; the destination register can
be a general-purpose register, segment register, or memory location. Both operands must be the same size, which
can be a byte, a word, a doubleword, or a quadword.
The MOV instruction cannot be used to load the CS register. Attempting to do so results in an invalid opcode excep-
tion (#UD). To load the CS register, use the far JMP, CALL, or RET instruction.
If the destination operand is a segment register (DS, ES, FS, GS, or SS), the source operand must be a valid
segment selector. In protected mode, moving a segment selector into a segment register automatically causes the
segment descriptor information associated with that segment selector to be loaded into the hidden (shadow) part
of the segment register. While loading this information, the segment selector and segment descriptor information
is validated (see the “Operation” algorithm below). The segment descriptor data is obtained from the GDT or LDT
entry for the specified segment selector.
A NULL segment selector (values 0000-0003) can be loaded into the DS, ES, FS, and GS registers without causing
a protection exception. However, any subsequent attempt to reference a segment whose corresponding segment
register is loaded with a NULL value causes a general protection exception (#GP) and no memory reference occurs.
Loading the SS register with a MOV instruction inhibits all interrupts until after the execution of the next instruc-
tion. This operation allows a stack pointer to be loaded into the ESP register with the next instruction (MOV ESP,
stack-pointer value) before an interrupt occurs

. Be aware that the LSS instruction offers a more efficient

method of loading the SS and ESP registers.
When executing MOV Reg, Sreg, the processor copies the content of Sreg to the 16 least significant bits of the
general-purpose register. The upper bits of the destination register are zero for most IA-32 processors (Pentium

NOTES:

* The moffs8, moffs16, moffs32 and moffs64 operands specify a simple offset relative to the segment base, where 8, 16, 32 and 64

refer to the size of the data. The address-size attribute of the instruction determines the size of the offset, either 16, 32 or 64

bits.

** In 32-bit mode, the assembler may insert the 16-bit operand-size prefix with this instruction (see the following “Description” sec-

tion for further information).

***In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

ModRM:reg (r)

ModRM:reg (w)

ModRM:r/m (r)

AL/AX/EAX/RAX

Moffs

Moffs (w)

AL/AX/EAX/RAX

opcode + rd (w)

imm8/16/32/64

ModRM:r/m (w)

imm8/16/32/64

1. If a code instruction breakpoint (for debug) is placed on an instruction located immediately after a MOV SS instruction, the break-

point may not be triggered. However, in a sequence of instructions that load the SS register, only the first instruction in the

sequence is guaranteed to delay an interrupt.
In the following sequence, interrupts may be recognized before MOV ESP, EBP executes:
MOV SS, EDX

MOV SS, EAX

MOV ESP, EBP