Specs for MOV op-codes

1
votes

In all the documentation I can find regarding op-codes for MOV mnemonic, each op-code is not documented individually. op-code B8h+ Is documented as moving 16- or 32-bit data to a 16- or 32-bit registry. What registry exactly is concerned, is determined by how far above B8h the op-code is. That is to say, to get the op-code for a MOV instruction of B8h type, you take B8h and add the number of the register. Problem is, I don't find any information about the number of each registry. The following is my guess, but I am not sure.

Destination registry. Op-code.

AX  B8

CX  B9

DX  BA

BX  BB

EAX BC

ECX BD

EDX BE

EBX BF
1
assemblymasmx86-16machine-code

1 Answers

7
votes

You have an error in your table: 16 and 32bit operand size have the same opcode, and are differentiated by an operand-size prefix byte to use the one that's not currently the default operand size. (So 16bit instructions take an extra byte in 32bit and 64bit mode.) This is true for all opcodes, not just mov.

You could have checked this yourself with an assembler, and a disassembler that includes the hex bytes of the instruction encoding in the output.

There are separate opcodes for 8 vs. 16/32/64 for most instructions, but I guess there wasn't enough opcode space to add another version of everything when the extension from 16 to 32bit happened.

  • mov r8, imm8 uses the opcode B0+rb (so, B0-B7).
  • mov r16/32/64, imm16/32/64 uses the opcode B8+rw/rd (so, B8-BF), with either an operand-size prefix, a REX prefix with the .W bit set), or no prefix.

Since we're on the topic, it's worth mentioning that mov r/m64, imm32 (sign-extended move-immediate) has to use an extra byte to encode the destination register or effective address, but is still shorter than mov r64, imm64. In AT&T syntax, you have to use the movabs mnemonic if you want it, otherwise the assembler truncates your constant to 32bits.

The actual binary encodings for register numbers appears to be specified in three places in Intel's ref manuals, Volume 2. (linked from the wiki).

Most relevant to this question (register encoded as the last 3 bits of the opcode), there's Table 3-1. Register Codes Associated With +rb, +rw, +rd, +ro, inside Section 3.1: INTERPRETING THE INSTRUCTION REFERENCE PAGES.

The encodings are the same as in Appendix B.1.3, which again points out that the 3-bit register field can be the last 3 bits of the opcode. (I guess all the opcodes that use +rb / +rd are multiples of 8, so adding 0-7 = setting the last 3 bits). B.1.4.1 has tables of which register each possible 3-bit value selects, for 16bit and 32bit operand-sizes (in non-64bit mode).

It goes:

encoding | 8bit reg | 32bit reg 
000  |       AL   |      EAX
001  |       CL   |      ECX
010  |       DL   |      EDX
011  |       BL   |      EBX
100  |       AH   |      ESP
101  |       CH   |      EBP
110  |       DH   |      ESI
111  |       BH   |      EDI

Tables for other operand sizes, and for 64bit mode, are nearby. (Instructions with a REX prefix normally can't address AH/BH/CH/DH, only the low-byte of the 16 GP registers. I guess this is because the encoding for ch collides with bpl, when used with a REX prefix.)

There's also a table of register encodings (for using in mod/rm fields) in chapter 2, with tables.

There's also a mention of encoding the dest register into the opcode, in the section for 64bit mode, after the tables.

Chapter 2.2.1.1: Encoding (inside the IA-32e section):

Intel 64 and IA-32 instruction formats specify up to three registers by using 3-bit fields in the encoding, depending on the format:

  • ModR/M: the reg and r/m fields of the ModR/M byte
  • ModR/M with SIB: the reg field of the ModR/M byte, the base and index fields of the SIB (scale, index, base) byte
  • Instructions without ModR/M: the reg field of the opcode