MOV

MOV is the plain copy: register to register, memory to register, register or immediate to memory. No form copies memory to memory; MOVS does that, or two MOVs through a register.

Upper bits#

Writing a 32-bit register clears bits 63:32, while writing an 8- or 16-bit register keeps the bits above it. So a 32-bit MOV widens an unsigned 32-bit value to 64 bits (GCC 14 and Clang 23 at -O2 compile (uint64_t)x to mov eax, edi), and MOVZX has no 32-to-64-bit form; MOVSXD is the signed counterpart.

Constants#

A 64-bit register can take a constant in three encodings, and compilers pick the shortest that fits:

• B8+r without REX.W, 5 bytes: a 32-bit immediate, zero-extended, for 0 to 4,294,967,295 (mov eax, 1).
• C7 /0 with REX.W, 7 bytes: a 32-bit immediate, sign-extended, for -2,147,483,648 to -1 (mov rax, -1).
• B8+r with REX.W, 10 bytes: all 64 bits, the form GNU assemblers write as movabs.

The moffs forms, A0 to A3, also take an 8-byte constant: an absolute address in place of ModRM, with AL, AX, EAX or RAX only.

Atomicity and ordering#

An aligned load or store of 1, 2, 4 or 8 bytes is atomic on both vendors’ processors. For unaligned ones the manuals differ: Intel guarantees atomicity within a cache line (P6 and later), AMD only within an aligned quadword. Because x86 keeps loads in order with loads, and stores in order with stores and earlier loads, a plain MOV is already an acquire load or a release store, and both compilers emit MOV for C11’s atomic_load even in its sequentially consistent form. A later load may still pass an earlier store, so for a sequentially consistent atomic_store both emit XCHG, whose implicit lock forbids that.

System registers#

The forms for control and debug registers belong to the kernel (CPL 0), and the vendors differ again: on AMD processors that report CPUID Fn8000_0001_ECX[4] (AltMovCr8), a LOCK prefix turns MOV to or from CR0 into the same move for CR8, the task-priority register, which 32-bit code cannot otherwise name; Intel’s manual lists the LOCK prefix as #UD for these forms.

In the optimization guide

What the optimization guide says about MOV, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Front end

• Macro-fusion: Newer cores also fuse a register move with the operation after it, which gives the non-destructive three-operand form that the instruction set lacks: Zen 5 for operations on registers and immediates, and Intel’s Redwood Cove for a move or a load followed by an operation, though only when the code runs from the micro-op cache.

Out of order

• Move elimination: A register-to-register copy can be made at renaming, by pointing the destination at the physical register of the source; the move then has no latency and uses no execution unit.
• Move elimination: Moves into 8-bit, 16-bit and MMX registers are not eliminated, nor on Intel’s cores a register moved onto itself such as mov eax, eax, and on Intel’s cores elimination can fail when its resources run short.
• Partial register and flag writes: A write to AL, AH or AX, such as mov al, [rsi], keeps the rest of RAX, so its result must be merged with the old value.

Crestmont and Gracemont

• Integer execution: Moves, NOPs and zeroing idioms are handled at allocation and may never execute.

Golden Cove and Raptor Cove

• Integer execution: Register-to-register moves and zeroing idioms are handled when micro-ops are renamed, and adding a small constant to a register sometimes takes no cycle either.

Ice Lake to Rocket Lake

• Integer execution: On Ice Lake, moves between general registers are no longer removed at renaming, and zeroing idioms take an execution unit. sources differ

Redwood Cove

• Front end: A register-to-register mov followed by an operation that overwrites the moved-to register, as mov rax, rbx then sub rax, rcx, becomes one micro-op computing rbx - rcx into RAX: the three-operand form the instruction set lacks, with one slot from the queue to retirement.
• Front end: Redwood Cove fuses a load into a register with the operation on that register that follows it.
• Front end: Redwood Cove’s load-and-operate fusion takes only some loads, addresses and operations.

Skylake to Cooper Lake

• Integer execution: xor, sub and the vector pxor, xorps, pandn, psub and pcmpgt of a register with itself zero it without an execution unit, four a cycle, for 32-bit and 64-bit and all vector registers.

Zen and Zen+

• Integer execution: Register-to-register moves of 32-bit and 64-bit general registers and of XMM registers, and xchg of general registers, take no execution cycle, while a YMM move renames only its lower half and moves the upper one in a pipe. sources differ

Zen 2

• Integer execution: Register-to-register moves of general registers of 32 and 64 bits, xchg of them and moves of whole XMM and YMM registers take no execution cycle, where Zen 1 moves the upper half of a YMM register in a pipe. sources differ

Zen 3

• Integer execution: Register-to-register moves of general registers of 32 and 64 bits, xchg of them and moves of whole XMM and YMM registers take no execution cycle, nor do the zeroing idioms such as xor eax, eax and vpxor, which also break the dependency on the old value; sbb eax, eax depends only on the carry flag, and pcmpeqd xmm0, xmm0 sets all ones without waiting. sources differ

Zen 4

• Integer execution: Register-to-register moves of general registers of 32 and 64 bits, xchg of them and moves of whole vector registers take no execution cycle, nor do the zeroing idioms such as xor eax, eax and vpxor, which also break the dependency on the old value; sbb eax, eax depends only on the carry flag. sources differ

Zen 5

• Integer execution: New in Zen 5, a register-to-register mov fuses with a following ALU instruction that writes the same register and reads only registers or an immediate, as in mov eax, edi then add eax, esi.
• Integer execution: Register-to-register moves of 32-bit and 64-bit general registers and of whole vector registers take no execution cycle, nor do the zeroing idioms such as xor eax, eax and vpxor, which also break the dependency on the old value.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

v = sext(src)                    # only an imm32 to a 64-bit operand is
                                 # sign-extended; imm64 fills all 64 bits
dest.write(v)                    # a 32-bit register: bits 63:32 cleared

dest.write(src)                  # the 16-bit selector: m16 whatever the
                                 # operand size; a 32- or 64-bit register
                                 # gets it zero-extended, a 16-bit one
                                 # keeps bits 63:16

if dest.number == 1:
    fault(UD)                    # MOV cannot load CS
load_segment(dest, src)          # checks the descriptor the selector
                                 # names: #GP(sel), #SS(sel), #NP(sel)
# FS and GS also take its base, or 0 with a null selector (Zen 5,
# as AMD's NullSelectorClearsBase has it)
# after MOV SS, interrupts and most debug exceptions wait until
# the next instruction is done, so that it can load RSP

n = dest.number
if n not in (0, 2, 3, 4, 8):
    fault(UD)                    # CR1, CR5 to CR7 and CR9 to CR15
if CPL != 0:
    fault(GP, 0)
v = src.read()                   # MOV cr, r32 (outside 64-bit mode):
                                 # zero-extended to 64 bits
if n == 0:
    if v >> 32 != 0:
        fault(GP, 0)             # bits 63:32 are reserved
    if (v >> 29 & 3) == 1:
        fault(GP, 0)             # NW set with CD clear
    if v >> 31 == 0:
        fault(GP, 0)             # PG clear, which 64-bit mode forbids
    if cr4 >> 23 & 1 and (v >> 16 & 1) == 0:
        fault(GP, 0)             # WP clear while CR4.CET is set
if n == 3 and cr4 >> 17 & 1:
    v &= ~(1 << 63)              # with PCIDE, bit 63 set keeps the TLB
                                 # entries of the PCID; it is not stored
if n == 4:
    if (v >> 5 & 1) == 0:
        fault(GP, 0)             # PAE clear (64-bit mode)
    if (v ^ cr4) >> 12 & 1:
        fault(GP, 0)             # LA57 changed (64-bit mode)
    if (cr4 >> 17 & 1) == 0 and v >> 17 & 1:
        if cr3 & 0xFFF:
            fault(GP, 0)         # PCIDE set while CR3 names a PCID
    if v >> 23 & 1 and (cr0 >> 16 & 1) == 0:
        fault(GP, 0)             # CET set while CR0.WP is clear
if n == 8 and v >> 4 != 0:
    fault(GP, 0)                 # CR8 is the 4-bit task priority
# also #GP(0) for a 1 in a bit the processor reserves: CR3 bits
# from MAXPHYADDR up, CR4 bits of features it lacks
dest.write(v)                    # CR0, CR3 and CR4 writes can flush TLBs
of = sf = zf = af = pf = cf = UNDEFINED

if src.number not in (0, 2, 3, 4, 8):
    fault(UD)                    # CR1, CR5 to CR7 and CR9 to CR15
if CPL != 0:
    fault(GP, 0)
dest.write(src)                  # CR8 reads as the task priority, bits
                                 # 3:0; MOV r32, cr keeps bits 31:0
of = sf = zf = af = pf = cf = UNDEFINED

n = dest.number
if n > 7:
    fault(UD)                    # DR8 to DR15 do not exist
if CPL != 0:
    fault(GP, 0)
if n in (4, 5) and cr4 >> 3 & 1:
    fault(UD)                    # with CR4.DE, DR4 and DR5 do not exist
if dr7 >> 13 & 1:
    fault(DB)                    # DR7.GD guards the debug registers
v = src.read()
if n in (4, 5):
    n += 2                       # otherwise they are DR6 and DR7
if n >= 6 and v >> 32 != 0:
    fault(GP, 0)                 # bits 63:32 of DR6 and DR7 are reserved
if n == 6:
    dr6 = v
elif n == 7:
    dr7 = v
else:
    dest.write(v)
of = sf = zf = af = pf = cf = UNDEFINED

n = src.number
if n > 7:
    fault(UD)                    # DR8 to DR15 do not exist
if CPL != 0:
    fault(GP, 0)
if n in (4, 5) and cr4 >> 3 & 1:
    fault(UD)                    # with CR4.DE, DR4 and DR5 do not exist
if dr7 >> 13 & 1:
    fault(DB)                    # DR7.GD guards the debug registers
if n == 4:
    dest.write(dr6)              # without CR4.DE, DR4 and DR5 are DR6
elif n == 5:                     # and DR7
    dest.write(dr7)
else:
    dest.write(src)
of = sf = zf = af = pf = cf = UNDEFINED

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

MOV cr, r32 not in 64-bit mode MOV r32, cr not in 64-bit mode MOV dr, r32 not in 64-bit mode MOV r32, dr not in 64-bit mode MOV cr, r64 64-bit mode only MOV r64, cr 64-bit mode only MOV dr, r64 64-bit mode only MOV r64, dr 64-bit mode only

privileged: CPL 0 only

MOV sreg, r/m16 MOV cr, r32 not in 64-bit mode MOV dr, r32 not in 64-bit mode MOV cr, r64 64-bit mode only MOV dr, r64 64-bit mode only

may abort a TSX transaction

MOV m8, imm8 MOV m8, r8 MOV m16/32/64, imm16/32 MOV m16/32/64, r16/32/64

accepts XRELEASE

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• INT1
• INT3
• INTO
• IRET
• Jcc
• JCXZ
• JECXZ
• JMP
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR

All 109 General-purpose instructions