x86 Instruction Set – Data transfer

Introduction

These instructions copy values: between general registers, between a register and memory, to and from the stack, into segment registers, and to and from I/O ports. They work on the general registers (AL to R31, by operand size), the segment registers and the stack pointer. Most leave the flags alone. The exceptions are xadd, cmpxchg, cmpxchg8b and cmpxchg16b, which set them, and the conditional moves, which read them.

Most of them are as old as the 8086. The 80386 added the sign- and zero-extending moves, the Pentium Pro the conditional moves, and x86-64 the 64-bit forms. Intel’s APX (Advanced Performance Extensions) adds two-register pushes and pops, a conditional-faulting move and EVEX forms of SETcc, which the disassembler files here. A program checks for CMOVcc with CPUID leaf 1, EDX bit 15; for CMPXCHG8B with leaf 1, EDX bit 8; for CMPXCHG16B with leaf 1, ECX bit 13; for MOVBE with leaf 1, ECX bit 22; and for APX with leaf 7, sub-leaf 1, EDX bit 21.

The string moves (movsb, stosd …) are on the String instructions page, and the moves to and from control and debug registers on the System instructions page.

The instructions

In the forms, r/m16/32/64 is a general register or memory in ModRM.r/m, of the operand size; r16/32/64 a general register in ModRM.reg; imm8 to imm64 an immediate; moffs a memory offset in the instruction. In the encodings, /r means a ModRM byte with a register in its reg field, /0 to /7 a ModRM byte whose reg field extends the opcode, +rb, +rw and +rd a register number added to the opcode, and ib, iw, id and io an immediate of 1, 2, 4 or 8 bytes. See Instruction encoding.

Notes

• Flags. MOV, MOVZX, MOVSX, MOVSXD, MOVBE, XCHG, BSWAP, CMOVcc, PUSH, POP, the far-pointer loads, IN and OUT leave the flags alone. XADD sets them as ADD, CMPXCHG as CMP, and CMPXCHG8B and CMPXCHG16B change only ZF.
• 64-bit mode. Writing a 32-bit register clears the upper half of its 64-bit register; writing an 8-bit or 16-bit one leaves the rest alone. The instructions marked invalid in 64-bit mode raise #UD there, and the disassembler shows their bytes as whatever they mean in 64-bit code (C4 and C5 as VEX, for instance).
• LOCK. XCHG with memory is always locked. XADD, CMPXCHG, CMPXCHG8B and CMPXCHG16B may take LOCK when their destination is memory; LOCK on any other instruction here raises #UD, which the explorer reports as an issue.
• Display. A 64-bit memory offset (moffs64) is shown unsigned, as an address, as LLVM shows it. A disp16 alone is shown unsigned as well.
• APX forms are for 64-bit mode only. The APX encodings here give the EVEX map and opcode; the APX specification gives the full field notation, and the Instruction encoding page explains ND, NF and the extended register fields.

Links