Intel ITANIUM ARCHITECTURE - SOFTWARE DEVELOPERS MANUAL VOLUME 1 REV 2.3 Manual page 1590

MOV—Move to/from Control Registers
Opcode
0F 22 / r
0F 22 / r
0F 22 / r
0F 22 / r
0F 20 / r
0F 20 / r
0F 20 / r
0F 20 / r
Description
Moves the contents of a control register (CR0, CR2, CR3, or CR4) to a general-purpose
register or vice versa. The operand size for these instructions is always 32 bits,
regardless of the operand-size attribute. (See the Intel Architecture Software
Developer's Manual, Volume 3 for a detailed description of the flags and fields in the
control registers.)
When loading a control register, a program should not attempt to change any of the
reserved bits; that is, always set reserved bits to the value previously read.
At the opcode level, the reg field within the ModR/M byte specifies which of the control
registers is loaded or read. The 2 bits in the mod field are always 11B. The r/m field
specifies the general-purpose register loaded or read.
These instructions have the following side effects:
• When writing to control register CR3, all non-global TLB entries are flushed (see the
Intel Architecture Software Developer's Manual, Volume 3.
• When modifying any of the paging flags in the control registers (PE and PG in
register CR0 and PGE, PSE, and PAE in register CR4), all TLB entries are flushed,
including global entries. This operation is implementation specific for the Pentium
Pro processor. Software should not depend on this functionality in future Intel
architecture processors.
• If the PG flag is set to 1 and control register CR4 is written to set the PAE flag to 1
(to enable the physical address extension mode), the pointers (PDPTRs) in the
page-directory pointers table will be loaded into the processor (into internal,
non-architectural registers).
• If the PAE flag is set to 1 and the PG flag set to 1, writing to control register CR3
will cause the PDPTRs to be reloaded into the processor.
• If the PAE flag is set to 1 and control register CR0 is written to set the PG flag, the
PDPTRs are reloaded into the processor.
Operation
IF Itanium System Environment AND Move To CR Form THEN IA-32_Intercept(INST,MOVCR);
DEST  SRC;
4:288
Instruction
MOV CR0, r32
MOV CR2, r32
MOV CR3, r32
MOV CR4, r32
MOV r32, CR0
MOV r32, CR2
MOV r32, CR3
MOV r32, CR4
Description
Move r32 to CR0
Move r32 to CR2
Move r32 to CR3
Move r32 to CR4
Move CR0 to r32
Move CR2 to r32
Move CR3 to r32
Move CR4 to r32
Volume 4: Base IA-32 Instruction Reference