Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 3

 

  Index      Manuals     Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

 

Search            copyright infringement  

 

   

 

   

 

Content      ..     1      2      3      4      ..

 

 

 

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 3

 

 

INSTRUCTION SET REFERENCE, A-L
Table 3-8. Information Returned by CPUID Instruction (Contd.)
Initial EAX
Value
Information Provided about the Processor
NOTES:
* L2 associativity field encodings:
00H - Disabled
08H - 16 ways
01H - 1 way (direct mapped)
09H - Reserved
02H - 2 ways
0AH - 32 ways
03H - Reserved
0BH - 48 ways
04H - 4 ways
0CH - 64 ways
05H - Reserved
0DH - 96 ways
06H - 8 ways
0EH - 128 ways
07H - See CPUID leaf 04H, sub-leaf 2**
0FH - Fully associative
** CPUID leaf 04H provides details of deterministic cache parameters, including the L2 cache in sub-leaf 2
80000007H
EAX
Reserved = 0.
EBX
Reserved = 0.
ECX
Reserved = 0.
EDX
Bits 07-00: Reserved = 0.
Bit 08: Invariant TSC available if 1.
Bits 31-09: Reserved = 0.
80000008H
EAX
Linear/Physical Address size.
Bits 07-00: #Physical Address Bits*.
Bits 15-08: #Linear Address Bits.
Bits 31-16: Reserved = 0.
EBX
Bits 08-00: Reserved = 0.
Bit 09: WBNOINVD is available if 1.
Bits 31-10: Reserved = 0.
ECX
Reserved = 0.
EDX
Reserved = 0.
NOTES:
* If CPUID.80000008H:EAX[7:0] is supported, the maximum physical address number supported should
come from this field. If TME-MK is enabled, the number of bits that can be used to address physical
memory is CPUID.80000008H:EAX[7:0] - IA32_TME_ACTIVATE[35:32].
INPUT EAX = 0: Returns CPUID’s Highest Value for Basic Processor Information and the Vendor Identification String
When CPUID executes with EAX set to 0, the processor returns the highest value the CPUID recognizes for
returning basic processor information. The value is returned in the EAX register and is processor specific.
A vendor identification string is also returned in EBX, EDX, and ECX. For Intel processors, the string is “Genu-
ineIntel” and is expressed:
EBX := 756e6547h (* “Genu”, with G in the low eight bits of BL *)
EDX := 49656e69h (* “ineI”, with i in the low eight bits of DL *)
ECX := 6c65746eh (* “ntel”, with n in the low eight bits of CL *)
INPUT EAX = 80000000H: Returns CPUID’s Highest Value for Extended Processor Information
When CPUID executes with EAX set to 80000000H, the processor returns the highest value the processor recog-
nizes for returning extended processor information. The value is returned in the EAX register and is processor
specific.
IA32_BIOS_SIGN_ID Returns Microcode Update Signature
For processors that support the microcode update facility, the IA32_BIOS_SIGN_ID MSR is loaded with the update
signature whenever CPUID executes. The signature is returned in the upper DWORD. For details, see Chapter 10 in
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.
3-240
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
INPUT EAX = 01H: Returns Model, Family, Stepping Information
When CPUID executes with EAX set to 01H, version information is returned in EAX (see Figure 3-6). For example:
model, family, and processor type for the Intel Xeon processor 5100 series is as follows:
Model - 1111B
Family - 0101B
Processor Type - 00B
See Table 3-9 for available processor type values. Stepping IDs are provided as needed.
31
28 27
20 19
16 15 14 13 12 11
8
7
4
3
0
Extended
Extended
Family
Stepping
EAX
Model
Family ID
Model ID
ID
ID
Extended Family ID (0)
Extended Model ID (0)
Processor Type
Family (0FH for the Pentium 4 Processor Family)
Model
Reserved
OM16525
Figure 3-6. Version Information Returned by CPUID in EAX
Table 3-9. Processor Type Field
Type
Encoding
Original OEM Processor
00B
Intel OverDrive® Processor
01B
Dual processor (not applicable to Intel486 processors)
10B
Intel reserved
11B
NOTE
See Chapter 20 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1,
for information on identifying earlier IA-32 processors.
The Extended Family ID needs to be examined only when the Family ID is 0FH. Integrate the fields into a display
using the following rule:
IF Family_ID 0FH
THEN DisplayFamily = Family_ID;
ELSE DisplayFamily = Extended_Family_ID + Family_ID;
FI;
(* Show DisplayFamily as HEX field. *)
CPUID-CPU Identification
Vol. 2A
3-241
INSTRUCTION SET REFERENCE, A-L
The Extended Model ID needs to be examined only when the Family ID is 06H or 0FH. Integrate the field into a
display using the following rule:
IF (Family_ID = 06H or Family_ID = 0FH)
THEN DisplayModel = (Extended_Model_ID « 4) + Model_ID;
(* Right justify and zero-extend 4-bit field; display Model_ID as HEX field.*)
ELSE DisplayModel = Model_ID;
FI;
(* Show DisplayModel as HEX field. *)
INPUT EAX = 01H: Returns Additional Information in EBX
When CPUID executes with EAX set to 01H, additional information is returned to the EBX register:
Brand index (low byte of EBX) - this number provides an entry into a brand string table that contains brand
strings for IA-32 processors. More information about this field is provided later in this section.
CLFLUSH instruction cache line size (second byte of EBX) - this number indicates the size of the cache line
flushed by the CLFLUSH and CLFLUSHOPT instructions in 8-byte increments. This field was introduced in the
Pentium 4 processor.
Local APIC ID (high byte of EBX) - this number is the 8-bit ID that is assigned to the local APIC on the
processor during power up. This field was introduced in the Pentium 4 processor.
INPUT EAX = 01H: Returns Feature Information in ECX and EDX
When CPUID executes with EAX set to 01H, feature information is returned in ECX and EDX.
Figure 3-7 and Table 3-10 show encodings for ECX.
Figure 3-8 and Table 3-11 show encodings for EDX.
For all feature flags, a 1 indicates that the feature is supported. Use Intel to properly interpret feature flags.
NOTE
Software must confirm that a processor feature is present using feature flags returned by CPUID
prior to using the feature. Software should not depend on future offerings retaining all features.
3-242
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10
9
8
7
6
5
4
3
2
1
0
ECX
0
RDRAND
F16C
AVX
OSXSAVE
XSAVE
AES
TSC-Deadline
POPCNT
MOVBE
x2APIC
SSE4_2 - SSE4.2
SSE4_1 - SSE4.1
DCA - Direct Cache Access
PCID - Process-context Identifiers
PDCM - Perf/Debug Capability MSR
xTPR Update Control
CMPXCHG16B
FMA - Fused Multiply Add
SDBG
CNXT-ID - L1 Context ID
SSSE3 - SSSE3 Extensions
TM2 - Thermal Monitor 2
EIST - Enhanced Intel SpeedStep® Technology
SMX - Safer Mode Extensions
VMX - Virtual Machine Extensions
DS-CPL - CPL Qualified Debug Store
MONITOR - MONITOR/MWAIT
DTES64 - 64-bit DS Area
PCLMULQDQ - Carryless Multiplication
SSE3 - SSE3 Extensions
OM16524b
Reserved
Figure 3-7. Feature Information Returned in the ECX Register
Table 3-10. Feature Information Returned in the ECX Register
Bit #
Mnemonic
Description
0
SSE3
Streaming SIMD Extensions 3 (SSE3). A value of 1 indicates the processor supports this
technology.
1
PCLMULQDQ
PCLMULQDQ. A value of 1 indicates the processor supports the PCLMULQDQ instruction.
2
DTES64
64-bit DS Area. A value of 1 indicates the processor supports DS area using 64-bit layout.
3
MONITOR
MONITOR/MWAIT. A value of 1 indicates the processor supports this feature.
4
DS-CPL
CPL Qualified Debug Store. A value of 1 indicates the processor supports the extensions to the
Debug Store feature to allow for branch message storage qualified by CPL.
5
VMX
Virtual Machine Extensions. A value of 1 indicates that the processor supports this technology.
6
SMX
Safer Mode Extensions. A value of 1 indicates that the processor supports this technology. See
Chapter 7, “Safer Mode Extensions Reference.”
7
EIST
Enhanced Intel SpeedStep® technology. A value of 1 indicates that the processor supports this
technology.
8
TM2
Thermal Monitor 2. A value of 1 indicates whether the processor supports this technology.
9
SSSE3
A value of 1 indicates the presence of the Supplemental Streaming SIMD Extensions 3 (SSSE3). A
value of 0 indicates the instruction extensions are not present in the processor.
CPUID-CPU Identification
Vol. 2A
3-243
INSTRUCTION SET REFERENCE, A-L
Table 3-10. Feature Information Returned in the ECX Register (Contd.)
Bit #
Mnemonic
Description
10
CNXT-ID
L1 Context ID. A value of 1 indicates the L1 data cache mode can be set to either adaptive mode
or shared mode. A value of 0 indicates this feature is not supported. See definition of the
IA32_MISC_ENABLE MSR Bit 24 (L1 Data Cache Context Mode) for details.
11
SDBG
A value of 1 indicates the processor supports IA32_DEBUG_INTERFACE MSR for silicon debug.
12
FMA
A value of 1 indicates the processor supports FMA extensions using YMM state.
13
CMPXCHG16B
CMPXCHG16B Available. A value of 1 indicates that the feature is available. See the
“CMPXCHG8B/CMPXCHG16B-Compare and Exchange Bytes” section in this chapter for a
description.
14
xTPR Update
xTPR Update Control. A value of 1 indicates that the processor supports changing
Control
IA32_MISC_ENABLE[bit 23].
15
PDCM
Perfmon and Debug Capability: A value of 1 indicates the processor supports the performance
and debug feature indication MSR IA32_PERF_CAPABILITIES.
16
Reserved
Reserved
17
PCID
Process-context identifiers. A value of 1 indicates that the processor supports PCIDs and that
software may set CR4.PCIDE to 1.
18
DCA
A value of 1 indicates the processor supports the ability to prefetch data from a memory mapped
device.
19
SSE4_1
A value of 1 indicates that the processor supports SSE4.1.
20
SSE4_2
A value of 1 indicates that the processor supports SSE4.2.
21
x2APIC
A value of 1 indicates that the processor supports x2APIC feature.
22
MOVBE
A value of 1 indicates that the processor supports MOVBE instruction.
23
POPCNT
A value of 1 indicates that the processor supports the POPCNT instruction.
24
TSC-Deadline
A value of 1 indicates that the processor’s local APIC timer supports one-shot operation using a
TSC deadline value.
25
AESNI
A value of 1 indicates that the processor supports the AESNI instruction extensions.
26
XSAVE
A value of 1 indicates that the processor supports the XSAVE/XRSTOR processor extended states
feature, the XSETBV/XGETBV instructions, and XCR0.
27
OSXSAVE
A value of 1 indicates that the OS has set CR4.OSXSAVE[bit 18] to enable XSETBV/XGETBV
instructions to access XCR0 and to support processor extended state management using
XSAVE/XRSTOR.
28
AVX
A value of 1 indicates the processor supports the AVX instruction extensions.
29
F16C
A value of 1 indicates that processor supports 16-bit floating-point conversion instructions.
30
RDRAND
A value of 1 indicates that processor supports RDRAND instruction.
31
Not Used
Always returns 0.
3-244
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
3130292827262524 23 22 21 20 19 18 17 16 15 14 13 12 1110 9
8
7
6
5 4
3
2
1
0
EDX
PBE-Pend. Brk. EN.
TM-Therm. Monitor
HTT-Multi-threading
SS-Self Snoop
SSE2-SSE2 Extensions
SSE-SSE Extensions
FXSR-FXSAVE/FXRSTOR
MMX-MMX Technology
ACPI-Thermal Monitor and Clock Ctrl
DS-Debug Store
CLFSH-CLFLUSH instruction
PSN-Processor Serial Number
PSE-36 - Page Size Extension
PAT-Page Attribute Table
CMOV-Conditional Move/Compare Instruction
MCA-Machine Check Architecture
PGE-PTE Global Bit
MTRR-Memory Type Range Registers
SEP-SYSENTER and SYSEXIT
APIC-APIC on Chip
CX8-CMPXCHG8B Inst.
MCE-Machine Check Exception
PAE-Physical Address Extensions
MSR-RDMSR and WRMSR Support
TSC-Time Stamp Counter
PSE-Page Size Extensions
DE-Debugging Extensions
VME-Virtual-8086 Mode Enhancement
FPU-x87 FPU on Chip
Reserved
OM16523
Figure 3-8. Feature Information Returned in the EDX Register
CPUID-CPU Identification
Vol. 2A
3-245
INSTRUCTION SET REFERENCE, A-L
Table 3-11. More on Feature Information Returned in the EDX Register
Bit #
Mnemonic
Description
0
FPU
Floating-Point Unit On-Chip. The processor contains an x87 FPU.
1
VME
Virtual 8086 Mode Enhancements. Virtual 8086 mode enhancements, including CR4.VME for controlling the
feature, CR4.PVI for protected mode virtual interrupts, software interrupt indirection, expansion of the TSS
with the software indirection bitmap, and EFLAGS.VIF and EFLAGS.VIP flags.
2
DE
Debugging Extensions. Support for I/O breakpoints, including CR4.DE for controlling the feature, and optional
trapping of accesses to DR4 and DR5.
3
PSE
Page Size Extension. Large pages of size 4 MByte are supported, including CR4.PSE for controlling the
feature, the defined dirty bit in PDE (Page Directory Entries), optional reserved bit trapping in CR3, PDEs, and
PTEs.
4
TSC
Time Stamp Counter. The RDTSC instruction is supported, including CR4.TSD for controlling privilege.
5
MSR
Model Specific Registers RDMSR and WRMSR Instructions. The RDMSR and WRMSR instructions are
supported. Some of the MSRs are implementation dependent.
6
PAE
Physical Address Extension. Physical addresses greater than 32 bits are supported: extended page table
entry formats, an extra level in the page translation tables is defined, 2-MByte pages are supported instead of
4 Mbyte pages if PAE bit is 1.
7
MCE
Machine Check Exception. Exception 18 is defined for Machine Checks, including CR4.MCE for controlling the
feature. This feature does not define the model-specific implementations of machine-check error logging,
reporting, and processor shutdowns. Machine Check exception handlers may have to depend on processor
version to do model specific processing of the exception, or test for the presence of the Machine Check feature.
8
CX8
CMPXCHG8B Instruction. The compare-and-exchange 8 bytes (64 bits) instruction is supported (implicitly
locked and atomic).
9
APIC
APIC On-Chip. The processor contains an Advanced Programmable Interrupt Controller (APIC), responding to
memory mapped commands in the physical address range FFFE0000H to FFFE0FFFH (by default - some
processors permit the APIC to be relocated).
10
Reserved
Reserved
11
SEP
SYSENTER and SYSEXIT Instructions. The SYSENTER and SYSEXIT and associated MSRs are supported.
12
MTRR
Memory Type Range Registers. MTRRs are supported. The MTRRcap MSR contains feature bits that describe
what memory types are supported, how many variable MTRRs are supported, and whether fixed MTRRs are
supported.
13
PGE
Page Global Bit. The global bit is supported in paging-structure entries that map a page, indicating TLB entries
that are common to different processes and need not be flushed. The CR4.PGE bit controls this feature.
14
MCA
Machine Check Architecture. A value of 1 indicates the Machine Check Architecture of reporting machine
errors is supported. The MCG_CAP MSR contains feature bits describing how many banks of error reporting
MSRs are supported.
15
CMOV
Conditional Move Instructions. The conditional move instruction CMOV is supported. In addition, if x87 FPU is
present as indicated by the CPUID.FPU feature bit, then the FCOMI and FCMOV instructions are supported
16
PAT
Page Attribute Table. Page Attribute Table is supported. This feature augments the Memory Type Range
Registers (MTRRs), allowing an operating system to specify attributes of memory accessed through a linear
address on a 4KB granularity.
17
PSE-36
36-Bit Page Size Extension. 4-MByte pages addressing physical memory beyond 4 GBytes are supported with
32-bit paging. This feature indicates that upper bits of the physical address of a 4-MByte page are encoded in
bits 20:13 of the page-directory entry. Such physical addresses are limited by MAXPHYADDR and may be up to
40 bits in size.
18
PSN
Processor Serial Number. The processor supports the 96-bit processor identification number feature and the
feature is enabled.
19
CLFSH
CLFLUSH Instruction. CLFLUSH Instruction is supported.
20
Reserved
Reserved
3-246
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-11. More on Feature Information Returned in the EDX Register (Contd.)
Bit #
Mnemonic
Description
21
DS
Debug Store. The processor supports the ability to write debug information into a memory resident buffer.
This feature is used by the branch trace store (BTS) and processor event-based sampling (PEBS) facilities (see
Chapter 24, “Introduction to Virtual Machine Extensions,” in the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 3C).
22
ACPI
Thermal Monitor and Software Controlled Clock Facilities. The processor implements internal MSRs that
allow processor temperature to be monitored and processor performance to be modulated in predefined duty
cycles under software control.
23
MMX
Intel MMX Technology. The processor supports the Intel MMX technology.
24
FXSR
FXSAVE and FXRSTOR Instructions. The FXSAVE and FXRSTOR instructions are supported for fast save and
restore of the floating-point context. Presence of this bit also indicates that CR4.OSFXSR is available for an
operating system to indicate that it supports the FXSAVE and FXRSTOR instructions.
25
SSE
SSE. The processor supports the SSE extensions.
26
SSE2
SSE2. The processor supports the SSE2 extensions.
27
SS
Self Snoop. The processor supports the management of conflicting memory types by performing a snoop of its
own cache structure for transactions issued to the bus.
28
HTT
Max APIC IDs reserved field is Valid. A value of 0 for HTT indicates there is only a single logical processor in
the package and software should assume only a single APIC ID is reserved. A value of 1 for HTT indicates the
value in CPUID.1.EBX[23:16] (the Maximum number of addressable IDs for logical processors in this package) is
valid for the package.
29
TM
Thermal Monitor. The processor implements the thermal monitor automatic thermal control circuitry (TCC).
30
Reserved
Reserved
31
PBE
Pending Break Enable. The processor supports the use of the FERR#/PBE# pin when the processor is in the
stop-clock state (STPCLK# is asserted) to signal the processor that an interrupt is pending and that the
processor should return to normal operation to handle the interrupt.
INPUT EAX = 02H: TLB/Cache/Prefetch Information Returned in EAX, EBX, ECX, EDX
When CPUID executes with EAX set to 02H, the processor returns information about the processor’s internal TLBs,
cache, and prefetch hardware in the EAX, EBX, ECX, and EDX registers. The information is reported in encoded
form and fall into the following categories:
The least-significant byte in register EAX (register AL) will always return 01H. Software should ignore this value
and not interpret it as an informational descriptor.
The most significant bit (bit 31) of each register indicates whether the register contains valid information (set
to 0) or is reserved (set to 1).
If a register contains valid information, the information is contained in 1 byte descriptors. There are four types
of encoding values for the byte descriptor, the encoding type is noted in the second column of Table 3-12. Table
3-12 lists the encoding of these descriptors. Note that the order of descriptors in the EAX, EBX, ECX, and EDX
registers is not defined; that is, specific bytes are not designated to contain descriptors for specific cache,
prefetch, or TLB types. The descriptors may appear in any order. Note also a processor may report a general
descriptor type (FFH) and not report any byte descriptor of “cache type” via CPUID leaf 2.
CPUID-CPU Identification
Vol. 2A
3-247
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors
Descriptor
Type
Cache or TLB Description
Value
00H
General
Null descriptor, this byte contains no information.
01H
TLB
Instruction TLB: 4 KByte pages, 4-way set associative, 32 entries.
02H
TLB
Instruction TLB: 4 MByte pages, fully associative, 2 entries.
03H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 64 entries.
04H
TLB
Data TLB: 4 MByte pages, 4-way set associative, 8 entries.
05H
TLB
Data TLB1: 4 MByte pages, 4-way set associative, 32 entries.
06H
Cache
1st-level instruction cache: 8 KBytes, 4-way set associative, 32 byte line size.
08H
Cache
1st-level instruction cache: 16 KBytes, 4-way set associative, 32 byte line size.
09H
Cache
1st-level instruction cache: 32KBytes, 4-way set associative, 64 byte line size.
0AH
Cache
1st-level data cache: 8 KBytes, 2-way set associative, 32 byte line size.
0BH
TLB
Instruction TLB: 4 MByte pages, 4-way set associative, 4 entries.
0CH
Cache
1st-level data cache: 16 KBytes, 4-way set associative, 32 byte line size.
0DH
Cache
1st-level data cache: 16 KBytes, 4-way set associative, 64 byte line size.
0EH
Cache
1st-level data cache: 24 KBytes, 6-way set associative, 64 byte line size.
1DH
Cache
2nd-level cache: 128 KBytes, 2-way set associative, 64 byte line size.
21H
Cache
2nd-level cache: 256 KBytes, 8-way set associative, 64 byte line size.
22H
Cache
3rd-level cache: 512 KBytes, 4-way set associative, 64 byte line size, 2 lines per sector.
23H
Cache
3rd-level cache: 1 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector.
24H
Cache
2nd-level cache: 1 MBytes, 16-way set associative, 64 byte line size.
25H
Cache
3rd-level cache: 2 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector.
29H
Cache
3rd-level cache: 4 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector.
2CH
Cache
1st-level data cache: 32 KBytes, 8-way set associative, 64 byte line size.
30H
Cache
1st-level instruction cache: 32 KBytes, 8-way set associative, 64 byte line size.
40H
Cache
No 2nd-level cache or, if processor contains a valid 2nd-level cache, no 3rd-level cache.
41H
Cache
2nd-level cache: 128 KBytes, 4-way set associative, 32 byte line size.
42H
Cache
2nd-level cache: 256 KBytes, 4-way set associative, 32 byte line size.
43H
Cache
2nd-level cache: 512 KBytes, 4-way set associative, 32 byte line size.
44H
Cache
2nd-level cache: 1 MByte, 4-way set associative, 32 byte line size.
45H
Cache
2nd-level cache: 2 MByte, 4-way set associative, 32 byte line size.
46H
Cache
3rd-level cache: 4 MByte, 4-way set associative, 64 byte line size.
47H
Cache
3rd-level cache: 8 MByte, 8-way set associative, 64 byte line size.
48H
Cache
2nd-level cache: 3MByte, 12-way set associative, 64 byte line size.
49H
Cache
3rd-level cache: 4MB, 16-way set associative, 64-byte line size (Intel Xeon processor MP, Family 0FH,
Model 06H);
2nd-level cache: 4 MByte, 16-way set associative, 64 byte line size.
4AH
Cache
3rd-level cache: 6MByte, 12-way set associative, 64 byte line size.
4BH
Cache
3rd-level cache: 8MByte, 16-way set associative, 64 byte line size.
4CH
Cache
3rd-level cache: 12MByte, 12-way set associative, 64 byte line size.
4DH
Cache
3rd-level cache: 16MByte, 16-way set associative, 64 byte line size.
4EH
Cache
2nd-level cache: 6MByte, 24-way set associative, 64 byte line size.
4FH
TLB
Instruction TLB: 4 KByte pages, 32 entries.
3-248
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.)
Descriptor
Type
Cache or TLB Description
Value
50H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 64 entries.
51H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 128 entries.
52H
TLB
Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 256 entries.
55H
TLB
Instruction TLB: 2-MByte or 4-MByte pages, fully associative, 7 entries.
56H
TLB
Data TLB0: 4 MByte pages, 4-way set associative, 16 entries.
57H
TLB
Data TLB0: 4 KByte pages, 4-way associative, 16 entries.
59H
TLB
Data TLB0: 4 KByte pages, fully associative, 16 entries.
5AH
TLB
Data TLB0: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries.
5BH
TLB
Data TLB: 4 KByte and 4 MByte pages, 64 entries.
5CH
TLB
Data TLB: 4 KByte and 4 MByte pages,128 entries.
5DH
TLB
Data TLB: 4 KByte and 4 MByte pages,256 entries.
60H
Cache
1st-level data cache: 16 KByte, 8-way set associative, 64 byte line size.
61H
TLB
Instruction TLB: 4 KByte pages, fully associative, 48 entries.
63H
TLB
Data TLB: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries and a separate array with 1 GByte
pages, 4-way set associative, 4 entries.
64H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 512 entries.
66H
Cache
1st-level data cache: 8 KByte, 4-way set associative, 64 byte line size.
67H
Cache
1st-level data cache: 16 KByte, 4-way set associative, 64 byte line size.
68H
Cache
1st-level data cache: 32 KByte, 4-way set associative, 64 byte line size.
6AH
Cache
uTLB: 4 KByte pages, 8-way set associative, 64 entries.
6BH
Cache
DTLB: 4 KByte pages, 8-way set associative, 256 entries.
6CH
Cache
DTLB: 2M/4M pages, 8-way set associative, 128 entries.
6DH
Cache
DTLB: 1 GByte pages, fully associative, 16 entries.
70H
Cache
Trace cache: 12 K-μop, 8-way set associative.
71H
Cache
Trace cache: 16 K-μop, 8-way set associative.
72H
Cache
Trace cache: 32 K-μop, 8-way set associative.
76H
TLB
Instruction TLB: 2M/4M pages, fully associative, 8 entries.
78H
Cache
2nd-level cache: 1 MByte, 4-way set associative, 64byte line size.
79H
Cache
2nd-level cache: 128 KByte, 8-way set associative, 64 byte line size, 2 lines per sector.
7AH
Cache
2nd-level cache: 256 KByte, 8-way set associative, 64 byte line size, 2 lines per sector.
7BH
Cache
2nd-level cache: 512 KByte, 8-way set associative, 64 byte line size, 2 lines per sector.
7CH
Cache
2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size, 2 lines per sector.
7DH
Cache
2nd-level cache: 2 MByte, 8-way set associative, 64byte line size.
7FH
Cache
2nd-level cache: 512 KByte, 2-way set associative, 64-byte line size.
80H
Cache
2nd-level cache: 512 KByte, 8-way set associative, 64-byte line size.
82H
Cache
2nd-level cache: 256 KByte, 8-way set associative, 32 byte line size.
83H
Cache
2nd-level cache: 512 KByte, 8-way set associative, 32 byte line size.
84H
Cache
2nd-level cache: 1 MByte, 8-way set associative, 32 byte line size.
85H
Cache
2nd-level cache: 2 MByte, 8-way set associative, 32 byte line size.
86H
Cache
2nd-level cache: 512 KByte, 4-way set associative, 64 byte line size.
87H
Cache
2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size.
CPUID-CPU Identification
Vol. 2A
3-249
INSTRUCTION SET REFERENCE, A-L
Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.)
Descriptor
Type
Cache or TLB Description
Value
A0H
DTLB
DTLB: 4k pages, fully associative, 32 entries.
B0H
TLB
Instruction TLB: 4 KByte pages, 4-way set associative, 128 entries.
B1H
TLB
Instruction TLB: 2M pages, 4-way, 8 entries or 4M pages, 4-way, 4 entries.
B2H
TLB
Instruction TLB: 4KByte pages, 4-way set associative, 64 entries.
B3H
TLB
Data TLB: 4 KByte pages, 4-way set associative, 128 entries.
B4H
TLB
Data TLB1: 4 KByte pages, 4-way associative, 256 entries.
B5H
TLB
Instruction TLB: 4KByte pages, 8-way set associative, 64 entries.
B6H
TLB
Instruction TLB: 4KByte pages, 8-way set associative, 128 entries.
BAH
TLB
Data TLB1: 4 KByte pages, 4-way associative, 64 entries.
C0H
TLB
Data TLB: 4 KByte and 4 MByte pages, 4-way associative, 8 entries.
C1H
STLB
Shared 2nd-Level TLB: 4 KByte/2MByte pages, 8-way associative, 1024 entries.
C2H
DTLB
DTLB: 4 KByte/2 MByte pages, 4-way associative, 16 entries.
C3H
STLB
Shared 2nd-Level TLB: 4 KByte /2 MByte pages, 6-way associative, 1536 entries. Also 1GBbyte pages, 4-
way, 16 entries.
C4H
DTLB
DTLB: 2M/4M Byte pages, 4-way associative, 32 entries.
CAH
STLB
Shared 2nd-Level TLB: 4 KByte pages, 4-way associative, 512 entries.
D0H
Cache
3rd-level cache: 512 KByte, 4-way set associative, 64 byte line size.
D1H
Cache
3rd-level cache: 1 MByte, 4-way set associative, 64 byte line size.
D2H
Cache
3rd-level cache: 2 MByte, 4-way set associative, 64 byte line size.
D6H
Cache
3rd-level cache: 1 MByte, 8-way set associative, 64 byte line size.
D7H
Cache
3rd-level cache: 2 MByte, 8-way set associative, 64 byte line size.
D8H
Cache
3rd-level cache: 4 MByte, 8-way set associative, 64 byte line size.
DCH
Cache
3rd-level cache: 1.5 MByte, 12-way set associative, 64 byte line size.
DDH
Cache
3rd-level cache: 3 MByte, 12-way set associative, 64 byte line size.
DEH
Cache
3rd-level cache: 6 MByte, 12-way set associative, 64 byte line size.
E2H
Cache
3rd-level cache: 2 MByte, 16-way set associative, 64 byte line size.
E3H
Cache
3rd-level cache: 4 MByte, 16-way set associative, 64 byte line size.
E4H
Cache
3rd-level cache: 8 MByte, 16-way set associative, 64 byte line size.
EAH
Cache
3rd-level cache: 12MByte, 24-way set associative, 64 byte line size.
EBH
Cache
3rd-level cache: 18MByte, 24-way set associative, 64 byte line size.
ECH
Cache
3rd-level cache: 24MByte, 24-way set associative, 64 byte line size.
F0H
Prefetch
64-Byte prefetching.
F1H
Prefetch
128-Byte prefetching.
FEH
General
CPUID leaf 2 does not report TLB descriptor information; use CPUID leaf 18H to query TLB and other
address translation parameters.
FFH
General
CPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters.
3-250
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Example 3-1. Example of Cache and TLB Interpretation
The first member of the family of Pentium 4 processors returns the following information about caches and TLBs
when the CPUID executes with an input value of 2:
EAX
66 5B 50 01H
EBX
0H
ECX
0H
EDX
00 7A 70 00H
Which means:
The least-significant byte (byte 0) of register EAX is set to 01H. This value should be ignored.
The most-significant bit of all four registers (EAX, EBX, ECX, and EDX) is set to 0, indicating that each register
contains valid 1-byte descriptors.
Bytes 1, 2, and 3 of register EAX indicate that the processor has:
- 50H - a 64-entry instruction TLB, for mapping 4-KByte and 2-MByte or 4-MByte pages.
- 5BH - a 64-entry data TLB, for mapping 4-KByte and 4-MByte pages.
- 66H - an 8-KByte 1st level data cache, 4-way set associative, with a 64-Byte cache line size.
The descriptors in registers EBX and ECX are valid, but contain NULL descriptors.
Bytes 0, 1, 2, and 3 of register EDX indicate that the processor has:
- 00H - NULL descriptor.
- 70H - Trace cache: 12 K-μop, 8-way set associative.
- 7AH - a 256-KByte 2nd level cache, 8-way set associative, with a sectored, 64-byte cache line size.
- 00H - NULL descriptor.
INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level
When CPUID executes with EAX set to 04H and ECX contains an index value, the processor returns encoded data
that describe a set of deterministic cache parameters (for the cache level associated with the input in ECX). Valid
index values start from 0.
Software can enumerate the deterministic cache parameters for each level of the cache hierarchy starting with an
index value of 0, until the parameters report the value associated with the cache type field is 0. The architecturally
defined fields reported by deterministic cache parameters are documented in Table 3-8.
This Cache Size in Bytes
= (Ways + 1) * (Partitions + 1) * (Line_Size + 1) * (Sets + 1)
= (EBX[31:22] + 1) * (EBX[21:12] + 1) * (EBX[11:0] + 1) * (ECX + 1)
The CPUID leaf 04H also reports data that can be used to derive the topology of processor cores in a physical
package. This information is constant for all valid index values. Software can query the raw data reported by
executing CPUID with EAX=04H and ECX=0 and use it as part of the topology enumeration algorithm described in
Chapter 9, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 3A.
INPUT EAX = 05H: Returns MONITOR and MWAIT Features
When CPUID executes with EAX set to 05H, the processor returns information about features available to
MONITOR/MWAIT instructions. The MONITOR instruction is used for address-range monitoring in conjunction with
MWAIT instruction. The MWAIT instruction optionally provides additional extensions for advanced power manage-
ment. See Table 3-8.
INPUT EAX = 06H: Returns Thermal and Power Management Features
When CPUID executes with EAX set to 06H, the processor returns information about thermal and power manage-
ment features. See Table 3-8.
CPUID-CPU Identification
Vol. 2A
3-251
INSTRUCTION SET REFERENCE, A-L
INPUT EAX = 07H: Returns Structured Extended Feature Enumeration Information
When CPUID executes with EAX set to 07H and ECX = 0, the processor returns information about the maximum
input value for sub-leaves that contain extended feature flags. See Table 3-8.
When CPUID executes with EAX set to 07H and the input value of ECX is invalid (see leaf 07H entry in Table 3-8),
the processor returns 0 in EAX/EBX/ECX/EDX. In subleaf 0, EAX returns the maximum input value of the highest
leaf 7 sub-leaf, and EBX, ECX & EDX contain information of extended feature flags.
INPUT EAX = 09H: Returns Direct Cache Access Information
When CPUID executes with EAX set to 09H, the processor returns information about Direct Cache Access capabili-
ties. See Table 3-8.
INPUT EAX = 0AH: Returns Architectural Performance Monitoring Features
When CPUID executes with EAX set to 0AH, the processor returns information about support for architectural
performance monitoring capabilities. Architectural performance monitoring is supported if the version ID (see Table
3-8) is greater than Pn 0. See Table 3-8.
For each version of architectural performance monitoring capability, software must enumerate this leaf to discover
the programming facilities and the architectural performance events available in the processor. The details are
described in Chapter 24, “Introduction to Virtual Machine Extensions,” in the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3C.
INPUT EAX = 0BH: Returns Extended Topology Information
CPUID leaf 1FH is a preferred superset to leaf 0BH. Intel recommends first checking for the existence of Leaf 1FH
before using leaf 0BH.
When CPUID executes with EAX set to 0BH, the processor returns information about extended topology enumera-
tion data. Software must detect the presence of CPUID leaf 0BH by verifying (a) the highest leaf index supported
by CPUID is >= 0BH, and (b) CPUID.0BH:EBX[15:0] reports a non-zero value. See Table 3-8.
INPUT EAX = 0DH: Returns Processor Extended States Enumeration Information
When CPUID executes with EAX set to 0DH and ECX = 0, the processor returns information about the bit-vector
representation of all processor state extensions that are supported in the processor and storage size requirements
of the XSAVE/XRSTOR area. See Table 3-8.
When CPUID executes with EAX set to 0DH and ECX = n (n > 1, and is a valid sub-leaf index), the processor returns
information about the size and offset of each processor extended state save area within the XSAVE/XRSTOR area.
See Table 3-8. Software can use the forward-extendable technique depicted below to query the valid sub-leaves
and obtain size and offset information for each processor extended state save area:
For i = 2 to 62 // sub-leaf 1 is reserved
IF (CPUID.(EAX=0DH, ECX=0H):VECTOR[i] = 1 ) // VECTOR is the 64-bit value of EDX:EAX
Execute CPUID.(EAX=0DH, ECX = i) to examine size and offset for sub-leaf i;
FI;
INPUT EAX = 0FH: Returns Intel Resource Director Technology (Intel RDT) Monitoring Enumeration Information
When CPUID executes with EAX set to 0FH and ECX = 0, the processor returns information about the bit-vector
representation of QoS monitoring resource types that are supported in the processor and maximum range of RMID
values the processor can use to monitor of any supported resource types. Each bit, starting from bit 1, corresponds
to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or ResID) that soft-
ware must use to query QoS monitoring capability available for that type. See Table 3-8.
When CPUID executes with EAX set to 0FH and ECX = n (n >= 1, and is a valid ResID), the processor returns infor-
mation software can use to program IA32_PQR_ASSOC, IA32_QM_EVTSEL MSRs before reading QoS data from the
IA32_QM_CTR MSR.
3-252
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
INPUT EAX = 10H: Returns Intel Resource Director Technology (Intel RDT) Allocation Enumeration Information
When CPUID executes with EAX set to 10H and ECX = 0, the processor returns information about the bit-vector
representation of QoS Enforcement resource types that are supported in the processor. Each bit, starting from bit
1, corresponds to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or
ResID) that software must use to query QoS enforcement capability available for that type. See Table 3-8.
When CPUID executes with EAX set to 10H and ECX = n (n >= 1, and is a valid ResID), the processor returns infor-
mation about available classes of service and range of QoS mask MSRs that software can use to configure each
class of services using capability bit masks in the QoS Mask registers, IA32_resourceType_Mask_n.
INPUT EAX = 12H: Returns Intel SGX Enumeration Information
When CPUID executes with EAX set to 12H and ECX = 0H, the processor returns information about Intel SGX capa-
bilities. See Table 3-8.
When CPUID executes with EAX set to 12H and ECX = 1H, the processor returns information about Intel SGX attri-
butes. See Table 3-8.
When CPUID executes with EAX set to 12H and ECX = n (n > 1), the processor returns information about Intel SGX
Enclave Page Cache. See Table 3-8.
INPUT EAX = 14H: Returns Intel Processor Trace Enumeration Information
When CPUID executes with EAX set to 14H and ECX = 0H, the processor returns information about Intel Processor
Trace extensions. See Table 3-8.
When CPUID executes with EAX set to 14H and ECX = n (n > 0 and less than the number of non-zero bits in
CPUID.(EAX=14H, ECX= 0H).EAX), the processor returns information about packet generation in Intel Processor
Trace. See Table 3-8.
INPUT EAX = 15H: Returns Time Stamp Counter and Nominal Core Crystal Clock Information
When CPUID executes with EAX set to 15H and ECX = 0H, the processor returns information about Time Stamp
Counter and Core Crystal Clock. See Table 3-8.
INPUT EAX = 16H: Returns Processor Frequency Information
When CPUID executes with EAX set to 16H, the processor returns information about Processor Frequency Informa-
tion. See Table 3-8.
INPUT EAX = 17H: Returns System-On-Chip Information
When CPUID executes with EAX set to 17H, the processor returns information about the System-On-Chip Vendor
Attribute Enumeration. See Table 3-8.
INPUT EAX = 18H: Returns Deterministic Address Translation Parameters Information
When CPUID executes with EAX set to 18H, the processor returns information about the Deterministic Address
Translation Parameters. See Table 3-8.
INPUT EAX = 19H: Returns Key Locker Information
When CPUID executes with EAX set to 19H, the processor returns information about Key Locker. See Table 3-8.
INPUT EAX = 1AH: Returns Native Model ID Information
When CPUID executes with EAX set to 1AH, the processor returns information about Native Model Identification.
See Table 3-8.
INPUT EAX = 1BH: Returns PCONFIG Information
When CPUID executes with EAX set to 1BH, the processor returns information about PCONFIG capabilities. This
information is enumerated in sub-leaves selected by the value of ECX (starting with 0).
CPUID-CPU Identification
Vol. 2A
3-253
INSTRUCTION SET REFERENCE, A-L
Each sub-leaf of CPUID function 1BH enumerates its sub-leaf type in EAX. If a sub-leaf type is 0, the sub-leaf is
invalid and zero is returned in EBX, ECX, and EDX. In this case, all subsequent sub-leaves (selected by larger input
values of ECX) are also invalid.
The only valid sub-leaf type currently defined is 1, indicating that the sub-leaf enumerates target identifiers for the
PCONFIG instruction. Any non-zero value returned in EBX, ECX, or EDX indicates a valid target identifier of the
PCONFIG instruction (any value of zero should be ignored). The only target identifier currently defined is 1, indi-
cating TME-MK. See the “PCONFIG-Platform Configuration” instruction in Chapter 4 of the Intel® 64 and IA-32
Architectures Software Developer’s Manual, Volume 2B, for more information.
INPUT EAX = 1CH: Returns Last Branch Record Information
When CPUID executes with EAX set to 1CH, the processor returns information about LBRs (the architectural
feature). See Table 3-8.
INPUT EAX = 1DH: Returns Tile Information
When CPUID executes with EAX set to 1DH and ECX = 0H, the processor returns information about tile
architecture. See Table 3-8.
When CPUID executes with EAX set to 1DH and ECX = 1H, the processor returns information about tile palette 1.
See Table 3-8.
INPUT EAX = 1EH: Returns TMUL Information
When CPUID executes with EAX set to 1EH and ECX = 0H, the processor returns information about TMUL
capabilities. See Table 3-8.
INPUT EAX = 1FH: Returns V2 Extended Topology Information
When CPUID executes with EAX set to 1FH, the processor returns information about extended topology enumera-
tion data. Software must detect the presence of CPUID leaf 1FH by verifying (a) the highest leaf index supported
by CPUID is >= 1FH, and (b) CPUID.1FH:EBX[15:0] reports a non-zero value. See Table 3-8.
INPUT EAX = 20H: Returns History Reset Information
When CPUID executes with EAX set to 20H, the processor returns information about History Reset. See Table 3-8.
METHODS FOR RETURNING BRANDING INFORMATION
Use the following techniques to access branding information:
1. Processor brand string method.
2. Processor brand index; this method uses a software supplied brand string table.
These two methods are discussed in the following sections. For methods that are available in early processors, see
Section: “Identification of Earlier IA-32 Processors” in Chapter 20 of the Intel® 64 and IA-32 Architectures Soft-
ware Developer’s Manual, Volume 1.
The Processor Brand String Method
Figure 3-9 describes the algorithm used for detection of the brand string. Processor brand identification software
should execute this algorithm on all Intel 64 and IA-32 processors.
This method (introduced with Pentium 4 processors) returns an ASCII brand identification string and the Processor
Base frequency of the processor to the EAX, EBX, ECX, and EDX registers.
3-254
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Input: EAX=
0x80000000
CPUID
False
Processor Brand
IF (EAX & 0x80000000)
String Not
Supported
CPUID
True ≥
Function
Extended
Supported
EAX Return Value =
Max. Extended CPUID
Function Index
True
IF (EAX Return Value
Processor Brand
String Supported
≥ 0x80000004)
OM15194
Figure 3-9. Determination of Support for the Processor Brand String
How Brand Strings Work
To use the brand string method, execute CPUID with EAX input of 8000002H through 80000004H. For each input
value, CPUID returns 16 ASCII characters using EAX, EBX, ECX, and EDX. The returned string will be NULL-termi-
nated.
Table 3-13 shows the brand string that is returned by the first processor in the Pentium 4 processor family.
Table 3-13. Processor Brand String Returned with Pentium 4 Processor
EAX Input Value
Return Values
ASCII Equivalent
80000002H
EAX = 20202020H
EBX = 20202020H
ECX = 20202020H
EDX = 6E492020H
“nI ”
80000003H
EAX = 286C6574H
“(let”
EBX = 50202952H
“P )R”
ECX = 69746E65H
“itne”
EDX = 52286D75H
“R(mu”
CPUID-CPU Identification
Vol. 2A
3-255
INSTRUCTION SET REFERENCE, A-L
Table 3-13. Processor Brand String Returned with Pentium 4 Processor (Contd.)
EAX Input Value
Return Values
ASCII Equivalent
80000004H
EAX = 20342029H
“ 4 )”
EBX = 20555043H
“ UPC”
ECX = 30303531H
“0051”
EDX = 007A484DH
“\0zHM”
Extracting the Processor Frequency from Brand Strings
Figure 3-10 provides an algorithm which software can use to extract the Processor Base frequency from the
processor brand string.
Scan "Brand String" in
Reverse Byte Order
"zHM", or
Match
"zHG", or
Substring
"zHT"
False
IF Substring Matched
Report Error
Determine "Freq"
If "zHM"
True
and "Multiplier"
Multiplier = 1 x 106
If "zHG"
Multiplier = 1 x 109
Determine "Multiplier"
If "zHT"
Multiplier = 1 x 1012
Scan Digits
Until Blank
Reverse Digits
Determine "Freq"
In Reverse Order
To Decimal Value
Processor Base
Frequency =
"Freq" = X.YZ if
"Freq" x "Multiplier"
Digits = "ZY.X"
Figure 3-10. Algorithm for Extracting Processor Frequency
The Processor Brand Index Method
The brand index method (introduced with Pentium® III Xeon® processors) provides an entry point into a brand
identification table that is maintained in memory by system software and is accessible from system- and user-level
code. In this table, each brand index is associate with an ASCII brand identification string that identifies the official
Intel family and model number of a processor.
When CPUID executes with EAX set to 1, the processor returns a brand index to the low byte in EBX. Software can
then use this index to locate the brand identification string for the processor in the brand identification table. The
first entry (brand index 0) in this table is reserved, allowing for backward compatibility with processors that do not
support the brand identification feature. Starting with processor signature family ID = 0FH, model = 03H, brand
index method is no longer supported. Use brand string method instead.
Table 3-14 shows brand indices that have identification strings associated with them.
3-256
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
Table 3-14. Mapping of Brand Indices; and Intel 64 and IA-32 Processor Brand Strings
Brand Index
Brand String
00H
This processor does not support the brand identification feature
01H
Intel(R) Celeron(R) processor1
02H
Intel(R) Pentium(R) III processor1
03H
Intel(R) Pentium(R) III Xeon(R) processor; If processor signature = 000006B1h, then Intel(R) Celeron(R)
processor
04H
Intel(R) Pentium(R) III processor
06H
Mobile Intel(R) Pentium(R) III processor-M
07H
Mobile Intel(R) Celeron(R) processor1
08H
Intel(R) Pentium(R) 4 processor
09H
Intel(R) Pentium(R) 4 processor
0AH
Intel(R) Celeron(R) processor1
0BH
Intel(R) Xeon(R) processor; If processor signature = 00000F13h, then Intel(R) Xeon(R) processor MP
0CH
Intel(R) Xeon(R) processor MP
0EH
Mobile Intel(R) Pentium(R) 4 processor-M; If processor signature = 00000F13h, then Intel(R) Xeon(R) processor
0FH
Mobile Intel(R) Celeron(R) processor1
11H
Mobile Genuine Intel(R) processor
12H
Intel(R) Celeron(R) M processor
13H
Mobile Intel(R) Celeron(R) processor1
14H
Intel(R) Celeron(R) processor
15H
Mobile Genuine Intel(R) processor
16H
Intel(R) Pentium(R) M processor
17H
Mobile Intel(R) Celeron(R) processor1
18H - 0FFH
RESERVED
NOTES:
1. Indicates versions of these processors that were introduced after the Pentium III
IA-32 Architecture Compatibility
CPUID is not supported in early models of the Intel486 processor or in any IA-32 processor earlier than the
Intel486 processor.
Operation
IA32_BIOS_SIGN_ID MSR := Update with installed microcode revision number;
CASE (EAX) OF
EAX = 0:
EAX := Highest basic function input value understood by CPUID;
EBX := Vendor identification string;
EDX := Vendor identification string;
ECX := Vendor identification string;
BREAK;
EAX = 1H:
EAX[3:0] := Stepping ID;
EAX[7:4] := Model;
EAX[11:8] := Family;
CPUID-CPU Identification
Vol. 2A
3-257
INSTRUCTION SET REFERENCE, A-L
EAX[13:12] := Processor type;
EAX[15:14] := Reserved;
EAX[19:16] := Extended Model;
EAX[27:20] := Extended Family;
EAX[31:28] := Reserved;
EBX[7:0] := Brand Index; (* Reserved if the value is zero. *)
EBX[15:8] := CLFLUSH Line Size;
EBX[16:23] := Reserved; (* Number of threads enabled = 2 if MT enable fuse set. *)
EBX[24:31] := Initial APIC ID;
ECX := Feature flags; (* See Figure 3-7. *)
EDX := Feature flags; (* See Figure 3-8. *)
BREAK;
EAX = 2H:
EAX := Cache and TLB information;
EBX := Cache and TLB information;
ECX := Cache and TLB information;
EDX := Cache and TLB information;
BREAK;
EAX = 3H:
EAX := Reserved;
EBX := Reserved;
ECX := ProcessorSerialNumber[31:0];
(* Pentium III processors only, otherwise reserved. *)
EDX := ProcessorSerialNumber[63:32];
(* Pentium III processors only, otherwise reserved. *
BREAK
EAX = 4H:
EAX := Deterministic Cache Parameters Leaf; (* See Table 3-8. *)
EBX := Deterministic Cache Parameters Leaf;
ECX := Deterministic Cache Parameters Leaf;
EDX := Deterministic Cache Parameters Leaf;
BREAK;
EAX = 5H:
EAX := MONITOR/MWAIT Leaf; (* See Table 3-8. *)
EBX := MONITOR/MWAIT Leaf;
ECX := MONITOR/MWAIT Leaf;
EDX := MONITOR/MWAIT Leaf;
BREAK;
EAX = 6H:
EAX := Thermal and Power Management Leaf; (* See Table 3-8. *)
EBX := Thermal and Power Management Leaf;
ECX := Thermal and Power Management Leaf;
EDX := Thermal and Power Management Leaf;
BREAK;
EAX = 7H:
EAX := Structured Extended Feature Flags Enumeration Leaf; (* See Table 3-8. *)
EBX := Structured Extended Feature Flags Enumeration Leaf;
ECX := Structured Extended Feature Flags Enumeration Leaf;
EDX := Structured Extended Feature Flags Enumeration Leaf;
BREAK;
EAX = 8H:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Reserved = 0;
3-258
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
EDX := Reserved = 0;
BREAK;
EAX = 9H:
EAX := Direct Cache Access Information Leaf; (* See Table 3-8. *)
EBX := Direct Cache Access Information Leaf;
ECX := Direct Cache Access Information Leaf;
EDX := Direct Cache Access Information Leaf;
BREAK;
EAX = AH:
EAX := Architectural Performance Monitoring Leaf; (* See Table 3-8. *)
EBX := Architectural Performance Monitoring Leaf;
ECX := Architectural Performance Monitoring Leaf;
EDX := Architectural Performance Monitoring Leaf;
BREAK
EAX = BH:
EAX := Extended Topology Enumeration Leaf; (* See Table 3-8. *)
EBX := Extended Topology Enumeration Leaf;
ECX := Extended Topology Enumeration Leaf;
EDX := Extended Topology Enumeration Leaf;
BREAK;
EAX = CH:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Reserved = 0;
EDX := Reserved = 0;
BREAK;
EAX = DH:
EAX := Processor Extended State Enumeration Leaf; (* See Table 3-8. *)
EBX := Processor Extended State Enumeration Leaf;
ECX := Processor Extended State Enumeration Leaf;
EDX := Processor Extended State Enumeration Leaf;
BREAK;
EAX = EH:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Reserved = 0;
EDX := Reserved = 0;
BREAK;
EAX = FH:
EAX := Intel Resource Director Technology Monitoring Enumeration Leaf; (* See Table 3-8. *)
EBX := Intel Resource Director Technology Monitoring Enumeration Leaf;
ECX := Intel Resource Director Technology Monitoring Enumeration Leaf;
EDX := Intel Resource Director Technology Monitoring Enumeration Leaf;
BREAK;
EAX = 10H:
EAX := Intel Resource Director Technology Allocation Enumeration Leaf; (* See Table 3-8. *)
EBX := Intel Resource Director Technology Allocation Enumeration Leaf;
ECX := Intel Resource Director Technology Allocation Enumeration Leaf;
EDX := Intel Resource Director Technology Allocation Enumeration Leaf;
BREAK;
EAX = 12H:
EAX := Intel SGX Enumeration Leaf; (* See Table 3-8. *)
EBX := Intel SGX Enumeration Leaf;
ECX := Intel SGX Enumeration Leaf;
CPUID-CPU Identification
Vol. 2A
3-259
INSTRUCTION SET REFERENCE, A-L
EDX := Intel SGX Enumeration Leaf;
BREAK;
EAX = 14H:
EAX := Intel Processor Trace Enumeration Leaf; (* See Table 3-8. *)
EBX := Intel Processor Trace Enumeration Leaf;
ECX := Intel Processor Trace Enumeration Leaf;
EDX := Intel Processor Trace Enumeration Leaf;
BREAK;
EAX = 15H:
EAX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; (* See Table 3-8. *)
EBX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf;
ECX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf;
EDX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf;
BREAK;
EAX = 16H:
EAX := Processor Frequency Information Enumeration Leaf; (* See Table 3-8. *)
EBX := Processor Frequency Information Enumeration Leaf;
ECX := Processor Frequency Information Enumeration Leaf;
EDX := Processor Frequency Information Enumeration Leaf;
BREAK;
EAX = 17H:
EAX := System-On-Chip Vendor Attribute Enumeration Leaf; (* See Table 3-8. *)
EBX := System-On-Chip Vendor Attribute Enumeration Leaf;
ECX := System-On-Chip Vendor Attribute Enumeration Leaf;
EDX := System-On-Chip Vendor Attribute Enumeration Leaf;
BREAK;
EAX = 18H:
EAX := Deterministic Address Translation Parameters Enumeration Leaf; (* See Table 3-8. *)
EBX := Deterministic Address Translation Parameters Enumeration Leaf;
ECX := Deterministic Address Translation Parameters Enumeration Leaf;
EDX := Deterministic Address Translation Parameters Enumeration Leaf;
BREAK;
EAX = 19H:
EAX := Key Locker Enumeration Leaf; (* See Table 3-8. *)
EBX := Key Locker Enumeration Leaf;
ECX := Key Locker Enumeration Leaf;
EDX := Key Locker Enumeration Leaf;
BREAK;
EAX = 1AH:
EAX := Native Model ID Enumeration Leaf; (* See Table 3-8. *)
EBX := Native Model ID Enumeration Leaf;
ECX := Native Model ID Enumeration Leaf;
EDX := Native Model ID Enumeration Leaf;
BREAK;
EAX = 1BH:
EAX := PCONFIG Information Enumeration Leaf; (* See “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-253. *)
EBX := PCONFIG Information Enumeration Leaf;
ECX := PCONFIG Information Enumeration Leaf;
EDX := PCONFIG Information Enumeration Leaf;
BREAK;
EAX = 1CH:
EAX := Last Branch Record Information Enumeration Leaf; (* See Table 3-8. *)
EBX := Last Branch Record Information Enumeration Leaf;
ECX := Last Branch Record Information Enumeration Leaf;
3-260
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
EDX := Last Branch Record Information Enumeration Leaf;
BREAK;
EAX = 1DH:
EAX := Tile Information Enumeration Leaf; (* See Table 3-8. *)
EBX := Tile Information Enumeration Leaf;
ECX := Tile Information Enumeration Leaf;
EDX := Tile Information Enumeration Leaf;
BREAK;
EAX = 1EH:
EAX := TMUL Information Enumeration Leaf; (* See Table 3-8. *)
EBX := TMUL Information Enumeration Leaf;
ECX := TMUL Information Enumeration Leaf;
EDX := TMUL Information Enumeration Leaf;
BREAK;
EAX = 1FH:
EAX := V2 Extended Topology Enumeration Leaf; (* See Table 3-8. *)
EBX := V2 Extended Topology Enumeration Leaf;
ECX := V2 Extended Topology Enumeration Leaf;
EDX := V2 Extended Topology Enumeration Leaf;
BREAK;
EAX = 20H:
EAX := Processor History Reset Sub-leaf; (* See Table 3-8. *)
EBX := Processor History Reset Sub-leaf;
ECX := Processor History Reset Sub-leaf;
EDX := Processor History Reset Sub-leaf;
BREAK;
EAX = 80000000H:
EAX := Highest extended function input value understood by CPUID;
EBX := Reserved;
ECX := Reserved;
EDX := Reserved;
BREAK;
EAX = 80000001H:
EAX := Reserved;
EBX := Reserved;
ECX := Extended Feature Bits (* See Table 3-8.*);
EDX := Extended Feature Bits (* See Table 3-8. *);
BREAK;
EAX = 80000002H:
EAX := Processor Brand String;
EBX := Processor Brand String, continued;
ECX := Processor Brand String, continued;
EDX := Processor Brand String, continued;
BREAK;
EAX = 80000003H:
EAX := Processor Brand String, continued;
EBX := Processor Brand String, continued;
ECX := Processor Brand String, continued;
EDX := Processor Brand String, continued;
BREAK;
EAX = 80000004H:
EAX := Processor Brand String, continued;
EBX := Processor Brand String, continued;
ECX := Processor Brand String, continued;
CPUID-CPU Identification
Vol. 2A
3-261
INSTRUCTION SET REFERENCE, A-L
EDX := Processor Brand String, continued;
BREAK;
EAX = 80000005H:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Reserved = 0;
EDX := Reserved = 0;
BREAK;
EAX = 80000006H:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Cache information;
EDX := Reserved = 0;
BREAK;
EAX = 80000007H:
EAX := Reserved = 0;
EBX := Reserved = 0;
ECX := Reserved = 0;
EDX := Reserved = Misc Feature Flags;
BREAK;
EAX = 80000008H:
EAX := Address Size Information;
EBX := Misc Feature Flags;
ECX := Reserved = 0;
EDX := Reserved = 0;
BREAK;
EAX >= 40000000H and EAX <= 4FFFFFFFH:
DEFAULT: (* EAX = Value outside of recognized range for CPUID. *)
(* If the highest basic information leaf data depend on ECX input value, ECX is honored.*)
EAX := Reserved; (* Information returned for highest basic information leaf. *)
EBX := Reserved; (* Information returned for highest basic information leaf. *)
ECX := Reserved; (* Information returned for highest basic information leaf. *)
EDX := Reserved; (* Information returned for highest basic information leaf. *)
BREAK;
ESAC;
Flags Affected
None.
Exceptions (All Operating Modes)
#UD
If the LOCK prefix is used.
In earlier IA-32 processors that do not support the CPUID instruction, execution of the instruc-
tion results in an invalid opcode (#UD) exception being generated.
3-262
Vol. 2A
CPUID-CPU Identification
INSTRUCTION SET REFERENCE, A-L
INVD-Invalidate Internal Caches
Opcode1
Instruction
Op/
64-Bit
Compat/
Description
En
Mode
Leg Mode
0F 08
INVD
ZO
Valid
Valid
Flush internal caches; initiate flushing of
external caches.
NOTES:
1. See the IA-32 Architecture Compatibility section below.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
ZO
N/A
N/A
N/A
N/A
Description
Invalidates (flushes) the processor’s internal caches and issues a special-function bus cycle that directs external
caches to also flush themselves. Data held in internal caches is not written back to main memory.
After executing this instruction, the processor does not wait for the external caches to complete their flushing oper-
ation before proceeding with instruction execution. It is the responsibility of hardware to respond to the cache flush
signal.
The INVD instruction is a privileged instruction. When the processor is running in protected mode, the CPL of a
program or procedure must be 0 to execute this instruction.
The INVD instruction may be used when the cache is used as temporary memory and the cache contents need to
be invalidated rather than written back to memory. When the cache is used as temporary memory, no external
device should be actively writing data to main memory.
Use this instruction with care. Data cached internally and not written back to main memory will be lost. Note that
any data from an external device to main memory (for example, via a PCIWrite) can be temporarily stored in the
caches; these data can be lost when an INVD instruction is executed. Unless there is a specific requirement or
benefit to flushing caches without writing back modified cache lines (for example, temporary memory, testing, or
fault recovery where cache coherency with main memory is not a concern), software should instead use the
WBINVD instruction.
On processors that support processor reserved memory, the INVD instruction cannot be executed when processor
reserved memory protections are activated. See Section 36.5, “EPC and Management of EPC Pages,” in the Intel®
64 and IA-32 Architectures Software Developer’s Manual, Volume 3D.
Some processors prevent execution of INVD after BIOS execution is complete. They report this by enumerating
CPUID.(EAX=07H,ECX=1H):EAX[bit 30] as 1. On such processors, INVD cannot be executed if bit 0 of
SR_BIOS_DONE (MSR address 151H) is 1.
This instruction’s operation is the same in non-64-bit modes and 64-bit mode.
IA-32 Architecture Compatibility
The INVD instruction is implementation dependent; it may be implemented differently on different families of Intel
64 or IA-32 processors. This instruction is not supported on IA-32 processors earlier than the Intel486 processor.
Operation
Flush(InternalCaches);
SignalFlush(ExternalCaches);
Continue (* Continue execution *)
Flags Affected
None.
3-532
Vol. 2A
INVD-Invalidate Internal Caches
INSTRUCTION SET REFERENCE, A-L
Protected Mode Exceptions
#GP(0)
If the current privilege level is not 0.
If the processor reserved memory protections are activated.
If CPUID.(EAX=07H, ECX=1H):EAX[30] = 1 and bit 0 is set in MSR_BIOS_DONE (MSR
address 151H).
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP(0)
If CPUID.(EAX=07H, ECX=1H):EAX[30] = 1 and bit 0 is set in MSR_BIOS_DONE (MSR
address 151H).
If the processor reserved memory protections are activated.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
The INVD instruction cannot be executed in virtual-8086 mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
Same exceptions as in protected mode.
INVD-Invalidate Internal Caches
Vol. 2A
3-533
6. Updates to Chapter 4, Volume 2B
Change bars and violet text show changes to Chapter 4 of the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 2B: Instruction Set Reference, M-U.
------------------------------------------------------------------------------------------
Changes to this chapter:
• Updated the PREFETCHW instruction table to match the “Op/En” column value to the correct value in the
Instruction Operand Encoding table. Previously, this table erroneously listed a value of ‘A’ instead of the
correct value of ‘M.’
Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes
13
INSTRUCTION SET REFERENCE, M-U
PREFETCHW-Prefetch Data Into Caches in Anticipation of a Write
Opcode/
Op/
64/32 bit
CPUID
Description
Instruction
En
Mode
Feature Flag
Support
0F 0D /1
M
V/V
PREFETCHW
Move data from m8 closer to the processor in anticipation of a
PREFETCHW m8
write.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
M
ModRM:r/m (r)
N/A
N/A
N/A
Description
Fetches the cache line of data from memory that contains the byte specified with the source operand to a location
in the 1st or 2nd level cache and invalidates other cached instances of the line.
The source operand is a byte memory location. If the line selected is already present in the lowest level cache and
is already in an exclusively owned state, no data movement occurs. Prefetches from non-writeback memory are
ignored.
The PREFETCHW instruction is merely a hint and does not affect program behavior. If executed, this instruction
moves data closer to the processor and invalidates other cached copies in anticipation of the line being written to
in the future.
The characteristic of prefetch locality hints is implementation-dependent, and can be overloaded or ignored by a
processor implementation. The amount of data prefetched is also processor implementation-dependent. It will,
however, be a minimum of 32 bytes. Additional details of the implementation-dependent locality hints are
described in Section 7.4 of Intel® 64 and IA-32 Architectures Optimization Reference Manual.
It should be noted that processors are free to speculatively fetch and cache data with exclusive ownership from
system memory regions that permit such accesses (that is, the WB memory type). A PREFETCHW instruction is
considered a hint to this speculative behavior. Because this speculative fetching can occur at any time and is not
tied to instruction execution, a PREFETCHW instruction is not ordered with respect to the fence instructions
(MFENCE, SFENCE, and LFENCE) or locked memory references. A PREFETCHW instruction is also unordered with
respect to CLFLUSH and CLFLUSHOPT instructions, other PREFETCHW instructions, or any other general instruction
It is ordered with respect to serializing instructions such as CPUID, WRMSR, OUT, and MOV CR.
This instruction's operation is the same in non-64-bit modes and 64-bit mode.
Operation
FETCH_WITH_EXCLUSIVE_OWNERSHIP (m8);
Flags Affected
None.
C/C++ Compiler Intrinsic Equivalent
void _m_prefetchw( void * );
Protected Mode Exceptions
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used.
4-410
Vol. 2B
PREFETCHW-Prefetch Data Into Caches in Anticipation of a Write
INSTRUCTION SET REFERENCE, M-U
Virtual-8086 Mode Exceptions
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
#UD
If the LOCK prefix is used.
64-Bit Mode Exceptions
#UD
If the LOCK prefix is used.
PREFETCHW-Prefetch Data Into Caches in Anticipation of a Write
Vol. 2B
4-411
7. Updates to Chapter 5, Volume 2C
Change bars and violet text show changes to Chapter 5 of the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 2C: Instruction Set Reference, V.
------------------------------------------------------------------------------------------
Changes to this chapter:
• Updated the VPBLENDD instruction to use “dword” instead of “word” since the instruction operates on dwords.
• Updated the VGETMANTSS instruction to change “Vector” to “Scalar” in the instruction title.
• Updated the VFCMADDCPH/VFMADDCPH instructions to correct the description box for both the normal and
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change.
• Updated the VFCMADDCSH/VFMADDCSH instructions to correct the description box for both the normal and
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change.
Removed two duplicate intrinsics for the VFCMADDCSH instruction and added two missing intrinsics for the
VFMADDCSH instruction.
• Updated the VFCMULCPH/VFMULCPH instructions to correct the description box for both the normal and
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change.
• Updated the VFCMULCSH/VFMULCSH instructions to correct the description box for both the normal and
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change.
Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes
23
INSTRUCTION SET REFERENCE, V
VFCMADDCPH/VFMADDCPH-Complex Multiply and Accumulate FP16 Values
Opcode/
Op/
64/32
CPUID Feature
Description
Instruction
En
Bit Mode
Flag
Support
EVEX.128.F2.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMADDCPH xmm1{k1}{z}, xmm2,
AVX512VL
xmm2 and complex conjugate of
xmm3/m128/m32bcst
xmm3/m128/m32bcst, add to xmm1 and store
the result in xmm1 subject to writemask k1.
EVEX.256.F2.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMADDCPH ymm1{k1}{z}, ymm2,
AVX512VL
ymm2 and complex conjugate of
ymm3/m256/m32bcst
ymm3/m256/m32bcst, add to ymm1 and store
the result in ymm1 subject to writemask k1.
EVEX.512.F2.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMADDCPH zmm1{k1}{z}, zmm2,
zmm2 and complex conjugate of
zmm3/m512/m32bcst {er}
zmm3/m512/m32bcst, add to zmm1 and store
the result in zmm1 subject to writemask k1.
EVEX.128.F3.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMADDCPH xmm1{k1}{z}, xmm2,
AVX512VL
xmm2 and xmm3/m128/m32bcst, add to xmm1
xmm3/m128/m32bcst
and store the result in xmm1 subject to
writemask k1.
EVEX.256.F3.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMADDCPH ymm1{k1}{z}, ymm2,
AVX512VL
ymm2 and ymm3/m256/m32bcst, add to ymm1
ymm3/m256/m32bcst
and store the result in ymm1 subject to
writemask k1.
EVEX.512.F3.MAP6.W0 56 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMADDCPH zmm1{k1}{z}, zmm2,
zmm2 and zmm3/m512/m32bcst, add to zmm1
zmm3/m512/m32bcst {er}
and store the result in zmm1 subject to
writemask k1.
Instruction Operand Encoding
Op/En
Tuple
Operand 1
Operand 2
Operand 3
Operand 4
A
Full
ModRM:reg (r, w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
This instruction performs a complex multiply and accumulate operation. There are normal and complex conjugate
forms of the operation.
The broadcasting and masking for this operation is done on 32-bit quantities representing a pair of FP16 values.
Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep-
tions are masked. MXCSR status bits are updated to reflect exceptional conditions.
5-170
Vol. 2C
VFCMADDCPH/VFMADDCPH-Complex Multiply and Accumulate FP16 Values
INSTRUCTION SET REFERENCE, V
Operation
VFCMADDCPH dest{k1}, src1, src2 (AVX512)
VL = 128, 256, 512
KL := VL / 32
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
IF broadcasting and src2 is memory:
tsrc2.fp16[2*i+0] := src2.fp16[0]
tsrc2.fp16[2*i+1] := src2.fp16[1]
ELSE:
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0]
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
tmp[2*i+0] := dest.fp16[2*i+0] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+0]
tmp[2*i+1] := dest.fp16[2*i+1] + src1.fp16[2*i+1] * tsrc2.fp16[2*i+0]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
// conjugate version subtracts odd final term
dest.fp16[2*i+0] := tmp[2*i+0] + src1.fp16[2*i+1] * tsrc2.fp16[2*i+1]
dest.fp16[2*i+1] := tmp[2*i+1] - src1.fp16[2*i+0] * tsrc2.fp16[2*i+1]
ELSE IF *zeroing*:
dest.fp16[2*i+0] := 0
dest.fp16[2*i+1] := 0
DEST[MAXVL-1:VL] := 0
VFMADDCPH dest{k1}, src1, src2 (AVX512)
VL = 128, 256, 512
KL := VL / 32
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
IF broadcasting and src2 is memory:
tsrc2.fp16[2*i+0] := src2.fp16[0]
tsrc2.fp16[2*i+1] := src2.fp16[1]
ELSE:
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0]
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
tmp[2*i+0] := dest.fp16[2*i+0] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+0]
tmp[2*i+1] := dest.fp16[2*i+1] + src1.fp16[2*i+1] * tsrc2.fp16[2*i+0]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
// non-conjugate version subtracts even term
dest.fp16[2*i+0] := tmp[2*i+0] - src1.fp16[2*i+1] * tsrc2.fp16[2*i+1]
dest.fp16[2*i+1] := tmp[2*i+1] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+1]
ELSE IF *zeroing*:
VFCMADDCPH/VFMADDCPH-Complex Multiply and Accumulate FP16 Values
Vol. 2C
5-171
INSTRUCTION SET REFERENCE, V
dest.fp16[2*i+0] := 0
dest.fp16[2*i+1] := 0
DEST[MAXVL-1:VL] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VFCMADDCPH __m128h _mm_fcmadd_pch (__m128h a, __m128h b, __m128h c);
VFCMADDCPH __m128h _mm_mask_fcmadd_pch (__m128h a, __mmask8 k, __m128h b, __m128h c);
VFCMADDCPH __m128h _mm_mask3_fcmadd_pch (__m128h a, __m128h b, __m128h c, __mmask8 k);
VFCMADDCPH __m128h _mm_maskz_fcmadd_pch (__mmask8 k, __m128h a, __m128h b, __m128h c);
VFCMADDCPH __m256h _mm256_fcmadd_pch (__m256h a, __m256h b, __m256h c);
VFCMADDCPH __m256h _mm256_mask_fcmadd_pch (__m256h a, __mmask8 k, __m256h b, __m256h c);
VFCMADDCPH __m256h _mm256_mask3_fcmadd_pch (__m256h a, __m256h b, __m256h c, __mmask8 k);
VFCMADDCPH __m256h _mm256_maskz_fcmadd_pch (__mmask8 k, __m256h a, __m256h b, __m256h c);
VFCMADDCPH __m512h _mm512_fcmadd_pch (__m512h a, __m512h b, __m512h c);
VFCMADDCPH __m512h _mm512_mask_fcmadd_pch (__m512h a, __mmask16 k, __m512h b, __m512h c);
VFCMADDCPH __m512h _mm512_mask3_fcmadd_pch (__m512h a, __m512h b, __m512h c, __mmask16 k);
VFCMADDCPH __m512h _mm512_maskz_fcmadd_pch (__mmask16 k, __m512h a, __m512h b, __m512h c);
VFCMADDCPH __m512h _mm512_fcmadd_round_pch (__m512h a, __m512h b, __m512h c, const int rounding);
VFCMADDCPH __m512h _mm512_mask_fcmadd_round_pch (__m512h a, __mmask16 k, __m512h b, __m512h c, const int rounding);
VFCMADDCPH __m512h _mm512_mask3_fcmadd_round_pch (__m512h a, __m512h b, __m512h c, __mmask16 k, const int rounding);
VFCMADDCPH __m512h _mm512_maskz_fcmadd_round_pch (__mmask16 k, __m512h a, __m512h b, __m512h c, const int rounding);
VFMADDCPH __m128h _mm_fmadd_pch (__m128h a, __m128h b, __m128h c);
VFMADDCPH __m128h _mm_mask_fmadd_pch (__m128h a, __mmask8 k, __m128h b, __m128h c);
VFMADDCPH __m128h _mm_mask3_fmadd_pch (__m128h a, __m128h b, __m128h c, __mmask8 k);
VFMADDCPH __m128h _mm_maskz_fmadd_pch (__mmask8 k, __m128h a, __m128h b, __m128h c);
VFMADDCPH __m256h _mm256_fmadd_pch (__m256h a, __m256h b, __m256h c);
VFMADDCPH __m256h _mm256_mask_fmadd_pch (__m256h a, __mmask8 k, __m256h b, __m256h c);
VFMADDCPH __m256h _mm256_mask3_fmadd_pch (__m256h a, __m256h b, __m256h c, __mmask8 k);
VFMADDCPH __m256h _mm256_maskz_fmadd_pch (__mmask8 k, __m256h a, __m256h b, __m256h c);
VFMADDCPH __m512h _mm512_fmadd_pch (__m512h a, __m512h b, __m512h c);
VFMADDCPH __m512h _mm512_mask_fmadd_pch (__m512h a, __mmask16 k, __m512h b, __m512h c);
VFMADDCPH __m512h _mm512_mask3_fmadd_pch (__m512h a, __m512h b, __m512h c, __mmask16 k);
VFMADDCPH __m512h _mm512_maskz_fmadd_pch (__mmask16 k, __m512h a, __m512h b, __m512h c);
VFMADDCPH __m512h _mm512_fmadd_round_pch (__m512h a, __m512h b, __m512h c, const int rounding);
VFMADDCPH __m512h _mm512_mask_fmadd_round_pch (__m512h a, __mmask16 k, __m512h b, __m512h c, const int rounding);
VFMADDCPH __m512h _mm512_mask3_fmadd_round_pch (__m512h a, __m512h b, __m512h c, __mmask16 k, const int rounding);
VFMADDCPH __m512h _mm512_maskz_fmadd_round_pch (__mmask16 k, __m512h a, __m512h b, __m512h c, const int rounding);
SIMD Floating-Point Exceptions
Invalid, Underflow, Overflow, Precision, Denormal.
Other Exceptions
EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions.”
Additionally:
#UD
If (dest_reg == src1_reg) or (dest_reg == src2_reg).
5-172
Vol. 2C
VFCMADDCPH/VFMADDCPH-Complex Multiply and Accumulate FP16 Values
INSTRUCTION SET REFERENCE, V
VFCMADDCSH/VFMADDCSH-Complex Multiply and Accumulate Scalar FP16 Values
Opcode/
Op/
64/32
CPUID Feature
Description
Instruction
En
Bit Mode
Flag
Support
EVEX.LLIG.F2.MAP6.W0 57 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMADDCSH xmm1{k1}{z}, xmm2,
xmm2 and complex conjugate of xmm3/m32, add
xmm3/m32 {er}
to xmm1 and store the result in xmm1 subject to
writemask k1. Bits 127:32 of xmm2 are copied
to xmm1[127:32].
EVEX.LLIG.F3.MAP6.W0 57 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMADDCSH xmm1{k1}{z}, xmm2,
xmm2 and xmm3/m32, add to xmm1 and store
xmm3/m32 {er}
the result in xmm1 subject to writemask k1. Bits
127:32 of xmm2 are copied to xmm1[127:32].
Instruction Operand Encoding
Op/En
Tuple
Operand 1
Operand 2
Operand 3
Operand 4
A
Scalar
ModRM:reg (r, w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
This instruction performs a complex multiply and accumulate operation. There are normal and complex conjugate
forms of the operation.
The masking for this operation is done on 32-bit quantities representing a pair of FP16 values.
Bits 127:32 of the destination operand are copied from the corresponding bits of the first source operand. Bits
MAXVL-1:128 of the destination operand are zeroed. The low FP16 element of the destination is updated according
to the writemask.
Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep-
tions are masked. MXCSR status bits are updated to reflect exceptional conditions.
Operation
VFCMADDCSH dest{k1}, src1, src2 (AVX512)
IF k1[0] or *no writemask*:
tmp[0] := dest.fp16[0] + src1.fp16[0] * src2.fp16[0]
tmp[1] := dest.fp16[1] + src1.fp16[1] * src2.fp16[0]
// conjugate version subtracts odd final term
dest.fp16[0] := tmp[0] + src1.fp16[1] * src2.fp16[1]
dest.fp16[1] := tmp[1] - src1.fp16[0] * src2.fp16[1]
ELSE IF *zeroing*:
dest.fp16[0] := 0
dest.fp16[1] := 0
DEST[127:32] := src1[127:32] // copy upper part of src1
DEST[MAXVL-1:128] := 0
VFCMADDCSH/VFMADDCSH-Complex Multiply and Accumulate Scalar FP16 Values
Vol. 2C
5-173
INSTRUCTION SET REFERENCE, V
VFMADDCSH dest{k1}, src1, src2 (AVX512)
IF k1[0] or *no writemask*:
tmp[0] := dest.fp16[0] + src1.fp16[0] * src2.fp16[0]
tmp[1] := dest.fp16[1] + src1.fp16[1] * src2.fp16[0]
// non-conjugate version subtracts last even term
dest.fp16[0] := tmp[0] - src1.fp16[1] * src2.fp16[1]
dest.fp16[1] := tmp[1] + src1.fp16[0] * src2.fp16[1]
ELSE IF *zeroing*:
dest.fp16[0] := 0
dest.fp16[1] := 0
DEST[127:32] := src1[127:32] // copy upper part of src1
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VFCMADDCSH __m128h _mm_fcmadd_round_sch (__m128h a, __m128h b, __m128h c, const int rounding);
VFCMADDCSH __m128h _mm_mask_fcmadd_round_sch (__m128h a, __mmask8 k, __m128h b, __m128h c, const int rounding);
VFCMADDCSH __m128h _mm_mask3_fcmadd_round_sch (__m128h a, __m128h b, __m128h c, __mmask8 k, const int rounding);
VFCMADDCSH __m128h _mm_maskz_fcmadd_round_sch (__mmask8 k, __m128h a, __m128h b, __m128h c, const int rounding);
VFCMADDCSH __m128h _mm_fcmadd_sch (__m128h a, __m128h b, __m128h c);
VFCMADDCSH __m128h _mm_mask_fcmadd_sch (__m128h a, __mmask8 k, __m128h b, __m128h c);
VFCMADDCSH __m128h _mm_mask3_fcmadd_sch (__m128h a, __m128h b, __m128h c, __mmask8 k);
VFCMADDCSH __m128h _mm_maskz_fcmadd_sch (__mmask8 k, __m128h a, __m128h b, __m128h c);
VFMADDCSH __m128h _mm_fmadd_round_sch (__m128h a, __m128h b, __m128h c, const int rounding);
VFMADDCSH __m128h _mm_mask_fmadd_round_sch (__m128h a, __mmask8 k, __m128h b, __m128h c, const int rounding);
VFMADDCSH __m128h _mm_mask3_fmadd_round_sch (__m128h a, __m128h b, __m128h c, __mmask8 k, const int rounding);
VFMADDCSH __m128h _mm_maskz_fmadd_round_sch (__mmask8 k, __m128h a, __m128h b, __m128h c, const int rounding);
VFMADDCSH __m128h _mm_fmadd_sch (__m128h a, __m128h b, __m128h c);
VFMADDCSH __m128h _mm_mask_fmadd_sch (__m128h a, __mmask8 k, __m128h b, __m128h c);
VFMADDCSH __m128h _mm_mask3_fmadd_sch (__m128h a, __m128h b, __m128h c, __mmask8 k);
VFMADDCSH __m128h _mm_maskz_fmadd_sch (__mmask8 k, __m128h a, __m128h b, __m128h c);
SIMD Floating-Point Exceptions
Invalid, Underflow, Overflow, Precision, Denormal.
Other Exceptions
EVEX-encoded instructions, see Table 2-58, “Type E10 Class Exception Conditions.”
Additionally:
#UD
If (dest_reg == src1_reg) or (dest_reg == src2_reg).
5-174
Vol. 2C
VFCMADDCSH/VFMADDCSH-Complex Multiply and Accumulate Scalar FP16 Values
INSTRUCTION SET REFERENCE, V
VFCMULCPH/VFMULCPH-Complex Multiply FP16 Values
Opcode/
Op/
64/32
CPUID Feature
Description
Instruction
En
Bit Mode
Flag
Support
EVEX.128.F2.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMULCPH xmm1{k1}{z}, xmm2,
AVX512VL
xmm2 and complex conjugate of
xmm3/m128/m32bcst
xmm3/m128/m32bcst, and store the result in
xmm1 subject to writemask k1.
EVEX.256.F2.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMULCPH ymm1{k1}{z}, ymm2,
AVX512VL
ymm2 and complex conjugate of
ymm3/m256/m32bcst
ymm3/m256/m32bcst, and store the result in
ymm1 subject to writemask k1.
EVEX.512.F2.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMULCPH zmm1{k1}{z}, zmm2,
zmm2 and complex conjugate of
zmm3/m512/m32bcst {er}
zmm3/m512/m32bcst, and store the result in
zmm1 subject to writemask k1.
EVEX.128.F3.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMULCPH xmm1{k1}{z}, xmm2,
AVX512VL
xmm2 and xmm3/m128/m32bcst, and store the
xmm3/m128/m32bcst
result in xmm1 subject to writemask k1.
EVEX.256.F3.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMULCPH ymm1{k1}{z}, ymm2,
AVX512VL
ymm2 and ymm3/m256/m32bcst, and store the
ymm3/m256/m32bcst
result in ymm1 subject to writemask k1.
EVEX.512.F3.MAP6.W0 D6 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMULCPH zmm1{k1}{z}, zmm2,
zmm2 and zmm3/m512/m32bcst, and store the
zmm3/m512/m32bcst {er}
result in zmm1 subject to writemask k1.
Instruction Operand Encoding
Op/En
Tuple
Operand 1
Operand 2
Operand 3
Operand 4
A
Full
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
This instruction performs a complex multiply operation. There are normal and complex conjugate forms of the oper-
ation. The broadcasting and masking for this operation is done on 32-bit quantities representing a pair of FP16
values.
Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep-
tions are masked. MXCSR status bits are updated to reflect exceptional conditions.
Operation
VFCMULCPH dest{k1}, src1, src2 (AVX512)
VL = 128, 256 or 512
KL := VL/32
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
IF broadcasting and src2 is memory:
tsrc2.fp16[2*i+0] := src2.fp16[0]
tsrc2.fp16[2*i+1] := src2.fp16[1]
ELSE:
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0]
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1]
FOR i := 0 to KL-1:
VFCMULCPH/VFMULCPH-Complex Multiply FP16 Values
Vol. 2C
5-175
INSTRUCTION SET REFERENCE, V
IF k1[i] or *no writemask*:
tmp.fp16[2*i+0] := src1.fp16[2*i+0] * tsrc2.fp16[2*i+0]
tmp.fp16[2*i+1] := src1.fp16[2*i+1] * tsrc2.fp16[2*i+0]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
// conjugate version subtracts odd final term
dest.fp16[2*i] := tmp.fp16[2*i+0] +src1.fp16[2*i+1] * tsrc2.fp16[2*i+1]
dest.fp16[2*i+1] := tmp.fp16[2*i+1] - src1.fp16[2*i+0] * tsrc2.fp16[2*i+1]
ELSE IF *zeroing*:
dest.fp16[2*i+0] := 0
dest.fp16[2*i+1] := 0
DEST[MAXVL-1:VL] := 0
VFMULCPH dest{k1}, src1, src2 (AVX512)
VL = 128, 256 or 512
KL := VL/32
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
IF broadcasting and src2 is memory:
tsrc2.fp16[2*i+0] := src2.fp16[0]
tsrc2.fp16[2*i+1] := src2.fp16[1]
ELSE:
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0]
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1]
FOR i := 0 to kl-1:
IF k1[i] or *no writemask*:
tmp.fp16[2*i+0] := src1.fp16[2*i+0] * tsrc2.fp16[2*i+0]
tmp.fp16[2*i+1] := src1.fp16[2*i+1] * tsrc2.fp16[2*i+0]
FOR i := 0 to KL-1:
IF k1[i] or *no writemask*:
// non-conjugate version subtracts last even term
dest.fp16[2*i+0] := tmp.fp16[2*i+0] - src1.fp16[2*i+1] * tsrc2.fp16[2*i+1]
dest.fp16[2*i+1] := tmp.fp16[2*i+1] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+1]
ELSE IF *zeroing*:
dest.fp16[2*i+0] := 0
dest.fp16[2*i+1] := 0
DEST[MAXVL-1:VL] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VFCMULCPH __m128h _mm_cmul_pch (__m128h a, __m128h b);
VFCMULCPH __m128h _mm_mask_cmul_pch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFCMULCPH __m128h _mm_maskz_cmul_pch (__mmask8 k, __m128h a, __m128h b);
VFCMULCPH __m256h _mm256_cmul_pch (__m256h a, __m256h b);
VFCMULCPH __m256h _mm256_mask_cmul_pch (__m256h src, __mmask8 k, __m256h a, __m256h b);
VFCMULCPH __m256h _mm256_maskz_cmul_pch (__mmask8 k, __m256h a, __m256h b);
VFCMULCPH __m512h _mm512_cmul_pch (__m512h a, __m512h b);
VFCMULCPH __m512h _mm512_mask_cmul_pch (__m512h src, __mmask16 k, __m512h a, __m512h b);
VFCMULCPH __m512h _mm512_maskz_cmul_pch (__mmask16 k, __m512h a, __m512h b);
5-176
Vol. 2C
VFCMULCPH/VFMULCPH-Complex Multiply FP16 Values
INSTRUCTION SET REFERENCE, V
VFCMULCPH __m512h _mm512_cmul_round_pch (__m512h a, __m512h b, const int rounding);
VFCMULCPH __m512h _mm512_mask_cmul_round_pch (__m512h src, __mmask16 k, __m512h a, __m512h b, const int rounding);
VFCMULCPH __m512h _mm512_maskz_cmul_round_pch (__mmask16 k, __m512h a, __m512h b, const int rounding);
VFCMULCPH __m128h _mm_fcmul_pch (__m128h a, __m128h b);
VFCMULCPH __m128h _mm_mask_fcmul_pch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFCMULCPH __m128h _mm_maskz_fcmul_pch (__mmask8 k, __m128h a, __m128h b);
VFCMULCPH __m256h _mm256_fcmul_pch (__m256h a, __m256h b);
VFCMULCPH __m256h _mm256_mask_fcmul_pch (__m256h src, __mmask8 k, __m256h a, __m256h b);
VFCMULCPH __m256h _mm256_maskz_fcmul_pch (__mmask8 k, __m256h a, __m256h b);
VFCMULCPH __m512h _mm512_fcmul_pch (__m512h a, __m512h b);
VFCMULCPH __m512h _mm512_mask_fcmul_pch (__m512h src, __mmask16 k, __m512h a, __m512h b);
VFCMULCPH __m512h _mm512_maskz_fcmul_pch (__mmask16 k, __m512h a, __m512h b);
VFCMULCPH __m512h _mm512_fcmul_round_pch (__m512h a, __m512h b, const int rounding);
VFCMULCPH __m512h _mm512_mask_fcmul_round_pch (__m512h src, __mmask16 k, __m512h a, __m512h b, const int rounding);
VFCMULCPH __m512h _mm512_maskz_fcmul_round_pch (__mmask16 k, __m512h a, __m512h b, const int rounding);
VFMULCPH __m128h _mm_fmul_pch (__m128h a, __m128h b);
VFMULCPH __m128h _mm_mask_fmul_pch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFMULCPH __m128h _mm_maskz_fmul_pch (__mmask8 k, __m128h a, __m128h b);
VFMULCPH __m256h _mm256_fmul_pch (__m256h a, __m256h b);
VFMULCPH __m256h _mm256_mask_fmul_pch (__m256h src, __mmask8 k, __m256h a, __m256h b);
VFMULCPH __m256h _mm256_maskz_fmul_pch (__mmask8 k, __m256h a, __m256h b);
VFMULCPH __m512h _mm512_fmul_pch (__m512h a, __m512h b);
VFMULCPH __m512h _mm512_mask_fmul_pch (__m512h src, __mmask16 k, __m512h a, __m512h b);
VFMULCPH __m512h _mm512_maskz_fmul_pch (__mmask16 k, __m512h a, __m512h b);
VFMULCPH __m512h _mm512_fmul_round_pch (__m512h a, __m512h b, const int rounding);
VFMULCPH __m512h _mm512_mask_fmul_round_pch (__m512h src, __mmask16 k, __m512h a, __m512h b, const int rounding);
VFMULCPH __m512h _mm512_maskz_fmul_round_pch (__mmask16 k, __m512h a, __m512h b, const int rounding);
VFMULCPH __m128h _mm_mask_mul_pch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFMULCPH __m128h _mm_maskz_mul_pch (__mmask8 k, __m128h a, __m128h b);
VFMULCPH __m128h _mm_mul_pch (__m128h a, __m128h b);
VFMULCPH __m256h _mm256_mask_mul_pch (__m256h src, __mmask8 k, __m256h a, __m256h b);
VFMULCPH __m256h _mm256_maskz_mul_pch (__mmask8 k, __m256h a, __m256h b);
VFMULCPH __m256h _mm256_mul_pch (__m256h a, __m256h b);
VFMULCPH __m512h _mm512_mask_mul_pch (__m512h src, __mmask16 k, __m512h a, __m512h b);
VFMULCPH __m512h _mm512_maskz_mul_pch (__mmask16 k, __m512h a, __m512h b);
VFMULCPH __m512h _mm512_mul_pch (__m512h a, __m512h b);
VFMULCPH __m512h _mm512_mask_mul_round_pch (__m512h src, __mmask16 k, __m512h a, __m512h b, const int rounding);
VFMULCPH __m512h _mm512_maskz_mul_round_pch (__mmask16 k, __m512h a, __m512h b, const int rounding);
VFMULCPH __m512h _mm512_mul_round_pch (__m512h a, __m512h b, const int rounding);
SIMD Floating-Point Exceptions
Invalid, Underflow, Overflow, Precision, Denormal.
Other Exceptions
EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions.”
Additionally:
#UD
If (dest_reg == src1_reg) or (dest_reg == src2_reg).
VFCMULCPH/VFMULCPH-Complex Multiply FP16 Values
Vol. 2C
5-177
INSTRUCTION SET REFERENCE, V
VFCMULCSH/VFMULCSH-Complex Multiply Scalar FP16 Values
Opcode/
Op/
64/32
CPUID Feature
Description
Instruction
En
Bit Mode
Flag
Support
EVEX.LLIG.F2.MAP6.W0 D7 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFCMULCSH xmm1{k1}{z}, xmm2,
xmm2 and complex conjugate of xmm3/m32, and
xmm3/m32 {er}
store the result in xmm1 subject to writemask k1.
Bits 127:32 of xmm2 are copied to
xmm1[127:32].
EVEX.LLIG.F3.MAP6.W0 D7 /r
A
V/V
AVX512-FP16
Complex multiply a pair of FP16 values from
VFMULCSH xmm1{k1}{z}, xmm2,
xmm2 and xmm3/m32, and store the result in
xmm3/m32 {er}
xmm1 subject to writemask k1. Bits 127:32 of
xmm2 are copied to xmm1[127:32].
Instruction Operand Encoding
Op/En
Tuple
Operand 1
Operand 2
Operand 3
Operand 4
A
Scalar
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
This instruction performs a complex multiply operation. There are normal and complex conjugate forms of the oper-
ation. The masking for this operation is done on 32-bit quantities representing a pair of FP16 values.
Bits 127:32 of the destination operand are copied from the corresponding bits of the first source operand. Bits
MAXVL-1:128 of the destination operand are zeroed. The low FP16 element of the destination is updated according
to the writemask.
Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep-
tions are masked. MXCSR status bits are updated to reflect exceptional conditions.
Operation
VFCMULCSH dest{k1}, src1, src2 (AVX512)
KL := VL / 32
IF k1[0] or *no writemask*:
tmp.fp16[0] := src1.fp16[0] * src2.fp16[0]
tmp.fp16[1] := src1.fp16[1] * src2.fp16[0]
// conjugate version subtracts odd final term
dest.fp16[0] := tmp.fp16[0] + src1.fp16[1] * src2.fp16[1]
dest.fp16[1] := tmp.fp16[1] - src1.fp16[0] * src2.fp16[1]
ELSE IF *zeroing*:
dest.fp16[0] := 0
dest.fp16[1] := 0
DEST[127:32] := src1[127:32] // copy upper part of src1
DEST[MAXVL-1:128] := 0
5-178
Vol. 2C
VFCMULCSH/VFMULCSH-Complex Multiply Scalar FP16 Values
INSTRUCTION SET REFERENCE, V
VFMULCSH dest{k1}, src1, src2 (AVX512)
KL := VL / 32
IF k1[0] or *no writemask*:
// non-conjugate version subtracts last even term
tmp.fp16[0] := src1.fp16[0] * src2.fp16[0]
tmp.fp16[1] := src1.fp16[1] * src2.fp16[0]
dest.fp16[0] := tmp.fp16[0] - src1.fp16[1] * src2.fp16[1]
dest.fp16[1] := tmp.fp16[1] + src1.fp16[0] * src2.fp16[1]
ELSE IF *zeroing*:
dest.fp16[0] := 0
dest.fp16[1] := 0
DEST[127:32] := src1[127:32] // copy upper part of src1
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VFCMULCSH __m128h _mm_cmul_round_sch (__m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_mask_cmul_round_sch (__m128h src, __mmask8 k, __m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_maskz_cmul_round_sch (__mmask8 k, __m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_cmul_sch (__m128h a, __m128h b);
VFCMULCSH __m128h _mm_mask_cmul_sch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFCMULCSH __m128h _mm_maskz_cmul_sch (__mmask8 k, __m128h a, __m128h b);
VFCMULCSH __m128h _mm_fcmul_round_sch (__m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_mask_fcmul_round_sch (__m128h src, __mmask8 k, __m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_maskz_fcmul_round_sch (__mmask8 k, __m128h a, __m128h b, const int rounding);
VFCMULCSH __m128h _mm_fcmul_sch (__m128h a, __m128h b);
VFCMULCSH __m128h _mm_mask_fcmul_sch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFCMULCSH __m128h _mm_maskz_fcmul_sch (__mmask8 k, __m128h a, __m128h b);
VFMULCSH __m128h _mm_fmul_round_sch (__m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_mask_fmul_round_sch (__m128h src, __mmask8 k, __m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_maskz_fmul_round_sch (__mmask8 k, __m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_fmul_sch (__m128h a, __m128h b);
VFMULCSH __m128h _mm_mask_fmul_sch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFMULCSH __m128h _mm_maskz_fmul_sch (__mmask8 k, __m128h a, __m128h b);
VFMULCSH __m128h _mm_mask_mul_round_sch (__m128h src, __mmask8 k, __m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_maskz_mul_round_sch (__mmask8 k, __m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_mul_round_sch (__m128h a, __m128h b, const int rounding);
VFMULCSH __m128h _mm_mask_mul_sch (__m128h src, __mmask8 k, __m128h a, __m128h b);
VFMULCSH __m128h _mm_maskz_mul_sch (__mmask8 k, __m128h a, __m128h b);
VFMULCSH __m128h _mm_mul_sch (__m128h a, __m128h b);
SIMD Floating-Point Exceptions
Invalid, Underflow, Overflow, Precision, Denormal.
Other Exceptions
EVEX-encoded instructions, see Table 2-58, “Type E10 Class Exception Conditions.”
Additionally:
#UD
If (dest_reg == src1_reg) or (dest_reg == src2_reg).
VFCMULCSH/VFMULCSH-Complex Multiply Scalar FP16 Values
Vol. 2C
5-179
INSTRUCTION SET REFERENCE, V
VGETMANTSS-Extract Float32 Vector of Normalized Mantissa From Float32 Scalar
Opcode/
Op/
64/32
CPUID
Description
Instruction
En
Bit Mode
Feature
Support
Flag
EVEX.LLIG.66.0F3A.W0 27 /r ib
A
V/V
AVX512F
Extract the normalized mantissa from the low float32
VGETMANTSS xmm1 {k1}{z}, xmm2,
element of xmm3/m32 using imm8 for sign control and
xmm3/m32{sae}, imm8
mantissa interval normalization, store the mantissa to
xmm1 under the writemask k1 and merge with the
other elements of xmm2.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
Tuple1 Scalar
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Convert the single-precision floating values in the low doubleword element of the second source operand (the third
operand) to single-precision floating-point value with the mantissa normalization and sign control specified by the
imm8 byte, see Figure 5-15. The converted result is written to the low doubleword element of the destination
operand (the first operand) using writemask k1. Bits (127:32) of the XMM register destination are copied from
corresponding bits in the first source operand. The normalized mantissa is specified by interv (imm8[1:0]) and the
sign control (sc) is specified by bits 3:2 of the immediate byte.
The conversion operation is:
GetMant(x) = ±2k|x.significand|
where:
1 <= |x.significand| < 2
Unbiased exponent k can be either 0 or -1, depending on the interval range defined by interv, the range of the
significand and whether the exponent of the source is even or odd. The sign of the final result is determined by sc
and the source sign. The encoded value of imm8[1:0] and sign control are shown in Figure 5-15.
The converted single-precision floating-point result is encoded according to the sign control, the unbiased expo-
nent k (adding bias) and a mantissa normalized to the range specified by interv.
The GetMant() function follows Table 5-8 when dealing with floating-point special numbers.
If writemasking is used, the low doubleword element of the destination operand is conditionally updated depending
on the value of writemask register k1. If writemasking is not used, the low doubleword element of the destination
operand is unconditionally updated.
5-384
Vol. 2C
VGETMANTSS-Extract Float32 Vector of Normalized Mantissa From Float32 Scalar
INSTRUCTION SET REFERENCE, V
Operation
// getmant_fp32(src, sign_control, normalization_interval) is defined in the operation section of VGETMANTPS
VGETMANTSS (EVEX encoded version)
SignCtrl[1:0] := IMM8[3:2];
Interv[1:0] := IMM8[1:0];
IF k1[0] OR *no writemask*
THEN DEST[31:0] :=
getmant_fp32(src, sign_control, normalization_interval)
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[31:0] remains unchanged*
ELSE
; zeroing-masking
DEST[31:0] := 0
FI
FI;
DEST[127:32] := SRC1[127:32]
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VGETMANTSS __m128 _mm_getmant_ss( __m128 a, __m128 b, enum intv, enum sgn);
VGETMANTSS __m128 _mm_mask_getmant_ss(__m128 s, __mmask8 k, __m128 a, __m128 b, enum intv, enum sgn);
VGETMANTSS __m128 _mm_maskz_getmant_ss( __mmask8 k, __m128 a, __m128 b, enum intv, enum sgn);
VGETMANTSS __m128 _mm_getmant_round_ss( __m128 a, __m128 b, enum intv, enum sgn, int r);
VGETMANTSS __m128 _mm_mask_getmant_round_ss(__m128 s, __mmask8 k, __m128 a, __m128 b, enum intv, enum sgn, int r);
VGETMANTSS __m128 _mm_maskz_getmant_round_ss( __mmask8 k, __m128 a, __m128 b, enum intv, enum sgn, int r);
SIMD Floating-Point Exceptions
Denormal, Invalid
Other Exceptions
See Table 2-47, “Type E3 Class Exception Conditions.”
VGETMANTSS-Extract Float32 Vector of Normalized Mantissa From Float32 Scalar
Vol. 2C
5-385
INSTRUCTION SET REFERENCE, V
VPBLENDD-Blend Packed Dwords
Opcode/
Op/
64/32
CPUID
Description
Instruction
En
-bit
Feature
Mode
Flag
VEX.128.66.0F3A.W0 02 /r ib
RVMI
V/V
AVX2
Select dwords from xmm2 and xmm3/m128 from
VPBLENDD xmm1, xmm2, xmm3/m128, imm8
mask specified in imm8 and store the values into
xmm1.
VEX.256.66.0F3A.W0 02 /r ib
RVMI
V/V
AVX2
Select dwords from ymm2 and ymm3/m256 from
VPBLENDD ymm1, ymm2, ymm3/m256, imm8
mask specified in imm8 and store the values into
ymm1.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RVMI
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8
Description
Dword elements from the source operand (second operand) are conditionally written to the destination operand
(first operand) depending on bits in the immediate operand (third operand). The immediate bits (bits 7:0) form a
mask that determines whether the corresponding dword in the destination is copied from the source. If a bit in the
mask, corresponding to a dword, is “1", then the dword is copied, else the dword is unchanged.
VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register
are zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register.
Operation
VPBLENDD (VEX.256 encoded version)
IF (imm8[0] == 1) THEN DEST[31:0] := SRC2[31:0]
ELSE DEST[31:0] := SRC1[31:0]
IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32]
ELSE DEST[63:32] := SRC1[63:32]
IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64]
ELSE DEST[95:64] := SRC1[95:64]
IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96]
ELSE DEST[127:96] := SRC1[127:96]
IF (imm8[4] == 1) THEN DEST[159:128] := SRC2[159:128]
ELSE DEST[159:128] := SRC1[159:128]
IF (imm8[5] == 1) THEN DEST[191:160] := SRC2[191:160]
ELSE DEST[191:160] := SRC1[191:160]
IF (imm8[6] == 1) THEN DEST[223:192] := SRC2[223:192]
ELSE DEST[223:192] := SRC1[223:192]
IF (imm8[7] == 1) THEN DEST[255:224] := SRC2[255:224]
ELSE DEST[255:224] := SRC1[255:224]
5-412
Vol. 2C
VPBLENDD-Blend Packed Dwords
INSTRUCTION SET REFERENCE, V
VPBLENDD (VEX.128 encoded version)
IF (imm8[0] == 1) THEN DEST[31:0] := SRC2[31:0]
ELSE DEST[31:0] := SRC1[31:0]
IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32]
ELSE DEST[63:32] := SRC1[63:32]
IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64]
ELSE DEST[95:64] := SRC1[95:64]
IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96]
ELSE DEST[127:96] := SRC1[127:96]
DEST[MAXVL-1:128] := 0
Intel C/C++ Compiler Intrinsic Equivalent
VPBLENDD:
__m128i _mm_blend_epi32 (__m128i v1, __m128i v2, const int mask)
VPBLENDD:
__m256i _mm256_blend_epi32 (__m256i v1, __m256i v2, const int mask)
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions.”
Additionally:
#UD
If VEX.W = 1.
VPBLENDD-Blend Packed Dwords
Vol. 2C
5-413
8. Updates to Chapter 1, Volume 3A
Change bars and violet text show changes to Chapter 1 of the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 3A: System Programming Guide, Part 1.
------------------------------------------------------------------------------------------
Changes to this chapter:
• Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processors to
the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.”
Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes
23
CHAPTER 1
ABOUT THIS MANUAL
The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A: System Programming Guide, Part
1 (order number 253668), the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B: System
Programming Guide, Part 2 (order number 253669), the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 3C: System Programming Guide, Part 3 (order number 326019), and the Intel® 64 and IA-32
Architectures Software Developer’s Manual, Volume 3D:System Programming Guide, Part 4 (order number
332831) are part of a set that describes the architecture and programming environment of Intel 64 and IA-32
Architecture processors. The other volumes in this set are:
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (order number
253665).
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D: Instruction Set
Reference (order numbers 253666, 253667, 326018, and 334569).
The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers
(order number 335592).
The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describe the instruction set of the processor and the opcode struc-
ture. These volumes apply to application programmers and to programmers who write operating systems or exec-
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describe
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating-
system and BIOS designers. In addition, Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume
3B, and Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C, address the programming
environment for classes of software that host operating systems. The Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 4, describes the model-specific registers of Intel 64 and IA-32 processors.
1.1
INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL
This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which
include:
Pentium® processors
P6 family processors
Pentium® 4 processors
Pentium® M processors
Intel® Xeon® processors
Pentium® D processors
Pentium® processor Extreme Editions
64-bit Intel® Xeon® processors
Intel® Core™ Duo processor
Intel® Core™ Solo processor
Dual-Core Intel® Xeon® processor LV
Intel® Core™ 2 Duo processor
Intel® Core™ 2 Quad processor Q6000 series
Intel® Xeon® processor 3000, 3200 series
Intel® Xeon® processor 5000 series
Intel® Xeon® processor 5100, 5300 series
Vol. 3A
1-1
ABOUT THIS MANUAL
Intel® Core™ 2 Extreme processor X7000 and X6800 series
Intel® Core™ 2 Extreme QX6000 series
Intel® Xeon® processor 7100 series
Intel® Pentium® Dual-Core processor
Intel® Xeon® processor 7200, 7300 series
Intel® Core™ 2 Extreme QX9000 series
Intel® Xeon® processor 5200, 5400, 7400 series
Intel® Core™ 2 Extreme processor QX9000 and X9000 series
Intel® Core™ 2 Quad processor Q9000 series
Intel® Core™ 2 Duo processor E8000, T9000 series
Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000,
C1000 series are built from 45 nm and 32 nm processes.
Intel® Core™ i7 processor
Intel® Core™ i5 processor
Intel® Xeon® processor E7-8800/4800/2800 product families
Intel® Core™ i7-3930K processor
2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series
Intel® Xeon® processor E3-1200 product family
Intel® Xeon® processor E5-2400/1400 product family
Intel® Xeon® processor E5-4600/2600/1600 product family
3rd generation Intel® Core™ processors
Intel® Xeon® processor E3-1200 v2 product family
Intel® Xeon® processor E5-2400/1400 v2 product families
Intel® Xeon® processor E5-4600/2600/1600 v2 product families
Intel® Xeon® processor E7-8800/4800/2800 v2 product families
4th generation Intel® Core™ processors
The Intel® Core™ M processor family
Intel® Core™ i7-59xx Processor Extreme Edition
Intel® Core™ i7-49xx Processor Extreme Edition
Intel® Xeon® processor E3-1200 v3 product family
Intel® Xeon® processor E5-2600/1600 v3 product families
5th generation Intel® Core™ processors
Intel® Xeon® processor D-1500 product family
Intel® Xeon® processor E5 v4 family
Intel Atom® processor X7-Z8000 and X5-Z8000 series
Intel Atom® processor Z3400 series
Intel Atom® processor Z3500 series
6th generation Intel® Core™ processors
Intel® Xeon® processor E3-1500m v5 product family
7th generation Intel® Core™ processors
Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series
Intel® Xeon® Scalable Processor Family
8th generation Intel® Core™ processors
Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series
1-2
Vol. 3A
ABOUT THIS MANUAL
Intel® Xeon® E processors
9th generation Intel® Core™ processors
2nd generation Intel® Xeon® Scalable Processor Family
10th generation Intel® Core™ processors
11th generation Intel® Core™ processors
3rd generation Intel® Xeon® Scalable Processor Family
12th generation Intel® Core™ processors
13th generation Intel® Core™ processors
4th generation Intel® Xeon® Scalable Processor Family
5th generation Intel® Xeon® Scalable Processor Family
Intel® Core™ Ultra 7 processors
P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium®
Pro, Pentium® II, Pentium® III, and Pentium® III Xeon® processors.
The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® micro-
architecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture.
The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved
Pentium® M processor microarchitecture.
The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel®
Core™ 2 Duo, Intel® Core™ 2 Quad, and Intel® Core™ 2 Extreme processors are based on Intel® Core™ microar-
chitecture.
The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™ 2 Quad processor Q9000 series, and Intel®
Core™ 2 Extreme processors QX9000, X9000 series, Intel® Core™ 2 processor E8000 series are based on
Enhanced Intel® Core™ microarchitecture.
The Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000,
C1000 series are based on the Intel Atom® microarchitecture and supports Intel 64 architecture.
P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV,
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® AtomTM
processor Z5xx series support IA-32 architecture.
The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel®
Core™ 2 Duo, Intel® Core™ 2 Extreme, Intel® Core™ 2 Quad processors, Pentium® D processors, Pentium® Dual-
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture.
The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel®
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the
Westmere microarchitecture. These processors support Intel 64 architecture.
The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7-
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx,
Intel® CoreTM i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and
support Intel 64 architecture.
The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support
Intel 64 architecture.
The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec-
ture and support Intel 64 architecture.
The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on
the Haswell microarchitecture and support Intel 64 architecture.
Vol. 3A
1-3
ABOUT THIS MANUAL
The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture.
The Intel Atom® processor Z8000 series is based on the Airmont microarchitecture.
The Intel Atom® processor Z3400 series and the Intel Atom® processor Z3500 series are based on the Silvermont
microarchitecture.
The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and
support Intel 64 architecture.
The Intel® Xeon® Scalable Processor Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener-
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture.
The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64
architecture.
The Intel Atom® processor C series, the Intel Atom® processor X series, the Intel® Pentium® processor J series,
the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Goldmont
microarchitecture.
The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and
supports Intel 64 architecture.
The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron®
processor N series are based on the Goldmont Plus microarchitecture.
The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces-
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture.
The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and
supports Intel 64 architecture.
The 2nd generation Intel® Xeon® Scalable Processor Family is based on the Cascade Lake product and supports
Intel 64 architecture.
Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based
on the Comet Lake microarchitecture; both support Intel 64 architecture.
Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are
based on the Rocket Lake microarchitecture; both support Intel 64 architecture.
Some 3rd generation Intel® Xeon® Scalable Processor Family processors are based on the Cooper Lake product,
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture.
The 12th generation Intel® Core™ processors supporting Alder Lake performance hybrid architecture support Intel
64 architecture.
The 13th generation Intel® Core™ processors are based on the Raptor Lake performance hybrid architecture and
support Intel 64 architecture.
The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and
supports Intel 64 architecture.
The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and
supports Intel 64 architecture.
The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and supports Intel 64 architecture.
IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces-
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture.
1.2
OVERVIEW OF THE SYSTEM PROGRAMMING GUIDE
A description of this manual’s content follows1:
1-4
Vol. 3A
ABOUT THIS MANUAL
Chapter 1 - About This Manual. Gives an overview of all volumes of the Intel® 64 and IA-32 Architectures Soft-
ware Developer’s Manual. It also describes the notational conventions in these manuals and lists related Intel
manuals and documentation of interest to programmers and hardware designers.
Chapter 2 - System Architecture Overview. Describes the modes of operation used by Intel 64 and IA-32
processors and the mechanisms provided by the architectures to support operating systems and executives,
including the system-oriented registers and data structures and the system-oriented instructions. The steps neces-
sary for switching between real-address and protected modes are also identified.
Chapter 3 - Protected-Mode Memory Management. Describes the data structures, registers, and instructions
that support segmentation and paging. The chapter explains how they can be used to implement a “flat” (unseg-
mented) memory model or a segmented memory model.
Chapter 4 - Paging. Describes the paging modes supported by Intel 64 and IA-32 processors.
Chapter 5 - Protection. Describes the support for page and segment protection provided in the Intel 64 and IA-
32 architectures. This chapter also explains the implementation of privilege rules, stack switching, pointer valida-
tion, user mode, and supervisor mode.
Chapter 6 - Interrupt and Exception Handling. Describes the basic interrupt mechanisms defined in the Intel
64 and IA-32 architectures, shows how interrupts and exceptions relate to protection, and describes how the archi-
tecture handles each exception type. Reference information for each exception is given in this chapter. Includes
programming the LINT0 and LINT1 inputs and gives an example of how to program the LINT0 and LINT1 pins for
specific interrupt vectors.
Chapter 7 - User Interrupts. Describes user interrupts supported by Intel 64 and IA-32 processors.
Chapter 8 - Task Management. Describes mechanisms the Intel 64 and IA-32 architectures provide to support
multitasking and inter-task protection.
Chapter 9 - Multiple-Processor Management. Describes the instructions and flags that support multiple
processors with shared memory, memory ordering, and Intel® Hyper-Threading Technology. Includes MP initializa-
tion for P6 family processors and gives an example of how to use the MP protocol to boot P6 family processors in
an MP system.
Chapter 10 - Processor Management and Initialization. Defines the state of an Intel 64 or IA-32 processor
after reset initialization. This chapter also explains how to set up an Intel 64 or IA-32 processor for real-address
mode operation and protected- mode operation, and how to switch between modes.
Chapter 11 - Advanced Programmable Interrupt Controller (APIC). Describes the programming interface
to the local APIC and gives an overview of the interface between the local APIC and the I/O APIC. Includes APIC bus
message formats and describes the message formats for messages transmitted on the APIC bus for P6 family and
Pentium processors.
Chapter 12 - Memory Cache Control. Describes the general concept of caching and the caching mechanisms
supported by the Intel 64 or IA-32 architectures. This chapter also describes the memory type range registers
(MTRRs) and how they can be used to map memory types of physical memory. Information on using the new cache
control and memory streaming instructions introduced with the Pentium III, Pentium 4, and Intel Xeon processors
is also given.
Chapter 13 - Intel® MMX™ Technology System Programming. Describes those aspects of the Intel® MMX™
technology that must be handled and considered at the system programming level, including: task switching,
exception handling, and compatibility with existing system environments.
Chapter 14 - System Programming For Instruction Set Extensions And Processor Extended States.
Describes the operating system requirements to support SSE/SSE2/SSE3/SSSE3/SSE4 extensions, including task
switching, exception handling, and compatibility with existing system environments. The latter part of this chapter
describes the extensible framework of operating system requirements to support processor extended states.
Processor extended state may be required by instruction set extensions beyond those of
SSE/SSE2/SSE3/SSSE3/SSE4 extensions.
Chapter 15 - Power and Thermal Management. Describes facilities of Intel 64 and IA-32 architecture used for
power management and thermal monitoring.
1. Model-Specific Registers have been moved out of this volume and into a separate volume: Intel® 64 and IA-32 Architectures Soft-
ware Developer’s Manual, Volume 4.
Vol. 3A
1-5
ABOUT THIS MANUAL
Chapter 16 - Machine-Check Architecture. Describes the machine-check architecture and machine-check
exception mechanism found in the Pentium 4, Intel Xeon, and P6 family processors. Additionally, a signaling mech-
anism for software to respond to hardware corrected machine check error is covered.
Chapter 17 - Interpreting Machine-Check Error Codes. Gives an example of how to interpret the error codes
for a machine-check error that occurred on a P6 family processor.
Chapter 18 - Debug, Branch Profile, TSC, and Resource Monitoring Features. Describes the debugging
registers and other debug mechanism provided in Intel 64 or IA-32 processors. This chapter also describes the
time-stamp counter.
Chapter 19 - Last Branch Records. Describes the Last Branch Records (architectural feature).
Chapter 20 - Performance Monitoring. Describes the Intel 64 and IA-32 architectures’ facilities for monitoring
performance.
Chapter 21 - 8086 Emulation. Describes the real-address and virtual-8086 modes of the IA-32 architecture.
Chapter 22 - Mixing 16-Bit and 32-Bit Code. Describes how to mix 16-bit and 32-bit code modules within the
same program or task.
Chapter 23 - IA-32 Architecture Compatibility. Describes architectural compatibility among IA-32 proces-
sors.
Chapter 24 - Introduction to Virtual Machine Extensions. Describes the basic elements of virtual machine
architecture and the virtual machine extensions for Intel 64 and IA-32 Architectures.
Chapter 25 - Virtual Machine Control Structures. Describes components that manage VMX operation. These
include the working-VMCS pointer and the controlling-VMCS pointer.
Chapter 26 - VMX Non-Root Operation. Describes the operation of a VMX non-root operation. Processor oper-
ation in VMX non-root mode can be restricted programmatically such that certain operations, events or conditions
can cause the processor to transfer control from the guest (running in VMX non-root mode) to the monitor software
(running in VMX root mode).
Chapter 27 - VM Entries. Describes VM entries. VM entry transitions the processor from the VMM running in VMX
root-mode to a VM running in VMX non-root mode. VM-Entry is performed by the execution of VMLAUNCH or VMRE-
SUME instructions.
Chapter 28 - VM Exits. Describes VM exits. Certain events, operations or situations while the processor is in VMX
non-root operation may cause VM-exit transitions. In addition, VM exits can also occur on failed VM entries.
Chapter 29 - VMX Support for Address Translation. Describes virtual-machine extensions that support
address translation and the virtualization of physical memory.
Chapter 30 - APIC Virtualization and Virtual Interrupts. Describes the VMCS including controls that enable
the virtualization of interrupts and the Advanced Programmable Interrupt Controller (APIC).
Chapter 31 - VMX Instruction Reference. Describes the virtual-machine extensions (VMX). VMX is intended
for a system executive to support virtualization of processor hardware and a system software layer acting as a host
to multiple guest software environments.
Chapter 32 - System Management Mode. Describes Intel 64 and IA-32 architectures’ system management
mode (SMM) facilities.
Chapter 33 - Intel® Processor Trace. Describes details of Intel® Processor Trace.
Chapter 34 - Introduction to Intel® Software Guard Extensions. Provides an overview of the Intel® Soft-
ware Guard Extensions (Intel® SGX) set of instructions.
Chapter 35 - Enclave Access Control and Data Structures. Describes Enclave Access Control procedures and
defines various Intel SGX data structures.
Chapter 36 - Enclave Operation. Describes enclave creation and initialization, adding pages and measuring an
enclave, and enclave entry and exit.
Chapter 37 - Enclave Exiting Events. Describes enclave-exiting events (EEE) and asynchronous enclave exit
(AEX).
Chapter 38 - SGX Instruction References. Describes the supervisor and user level instructions provided by
Intel SGX.
1-6
Vol. 3A
ABOUT THIS MANUAL
Chapter 39 - Intel® SGX Interactions with IA32 and Intel® 64 Architecture. Describes the Intel SGX
collection of enclave instructions for creating protected execution environments on processors supporting IA32 and
Intel 64 architectures.
Chapter 40 - Enclave Code Debug and Profiling. Describes enclave code debug processes and options.
Appendix A - VMX Capability Reporting Facility. Describes the VMX capability MSRs. Support for specific VMX
features is determined by reading capability MSRs.
Appendix B - Field Encoding in VMCS. Enumerates all fields in the VMCS and their encodings. Fields are
grouped by width (16-bit, 32-bit, etc.) and type (guest-state, host-state, etc.).
Appendix C - VM Basic Exit Reasons. Describes the 32-bit fields that encode reasons for a VM exit. Examples
of exit reasons include, but are not limited to: software interrupts, processor exceptions, software traps, NMIs,
external interrupts, and triple faults.
1.3
NOTATIONAL CONVENTIONS
This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for
hexadecimal and binary numbers. A review of this notation makes the manual easier to read.
1.3.1
Bit and Byte Order
In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to
two raised to the power of the bit position. Intel 64 and IA-32 processors are “little endian” machines; this means
the bytes of a word are numbered starting from the least significant byte. Figure 1-1 illustrates these conventions.
1.3.2
Reserved Bits and Software Compatibility
In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as
reserved, it is essential for compatibility with future processors that software treat these bits as having a future,
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict-
able. Software should follow these guidelines in dealing with reserved bits:
Do not depend on the states of any reserved bits when testing the values of registers which contain such bits.
Mask out the reserved bits before testing.
Do not depend on the states of any reserved bits when storing to memory or to a register.
Do not depend on the ability to retain information written into any reserved bits.
When loading a register, always load the reserved bits with the values indicated in the documentation, if any,
or reload them with values previously read from the same register.
NOTE
Avoid any software dependence upon the state of reserved bits in Intel 64 and IA-32 registers.
Depending upon the values of reserved register bits will make software dependent upon the
unspecified manner in which the processor handles these bits. Programs that depend upon
reserved values risk incompatibility with future processors.
Vol. 3A
1-7
ABOUT THIS MANUAL
Data Structure
Highest
31
24 23
16 15
8 7
0
Bit offset
Address
28
24
20
16
12
8
4
Lowest
Byte 3
Byte 2
Byte 1
Byte 0
0
Address
Byte Offset
Figure 1-1. Bit and Byte Order
1.3.3
Instruction Operands
When instructions are represented symbolically, a subset of assembly language is used. In this subset, an instruc-
tion has the following format:
label: mnemonic argument1, argument2, argument3
where:
A label is an identifier which is followed by a colon.
A mnemonic is a reserved name for a class of instruction opcodes which have the same function.
The operands argument1, argument2, and argument3 are optional. There may be from zero to three
operands, depending on the opcode. When present, they take the form of either literals or identifiers for data
items. Operand identifiers are either reserved names of registers or are assumed to be assigned to data items
declared in another part of the program (which may not be shown in the example).
When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left
operand is the destination.
For example:
LOADREG: MOV EAX, SUBTOTAL
In this example LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand,
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order.
1.3.4
Hexadecimal and Binary Numbers
Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for
example, F82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D,
E, and F.
Base 2 (binary) numbers are represented by a string of 1s and 0s, sometimes followed by the character B (for
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might
arise.
1.3.5
Segmented Addressing
The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes.
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes memory. The
range of memory that can be addressed is called an address space.
1-8
Vol. 3A
ABOUT THIS MANUAL
The processor also supports segmented addressing. This is a form of addressing where a program may have many
independent address spaces, called segments. For example, a program can keep its code (instructions) and stack
in separate segments. Code addresses would always refer to the code space, and stack addresses would always
refer to the stack space. The following notation is used to specify a byte address within a segment:
Segment-register:Byte-address
For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS
register:
DS:FF79H
The following segment address identifies an instruction address in the code segment. The CS register points to the
code segment and the EIP register contains the address of the instruction.
CS:EIP
1.3.6
Syntax for CPUID, CR, and MSR Values
Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register
bits, and by reading model-specific registers. We are moving toward a single syntax to represent this type of infor-
mation. See Figure 1-2.
CPUID Input and Output
CPUID.01H:EDX.SSE[bit 25] = 1
Input value for EAX register
Output register and feature flag or field
name with bit position(s)
Value (or range) of output
Control Register Values
CR4.OSFXSR[bit 9] = 1
Example CR name
Feature flag or field name
with bit position(s)
Value (or range) of output
Model-Specific Register Values
IA32_MISC_ENABLE.ENABLEFOPCODE[bit 2] = 1
Example MSR name
Feature flag or field name with bit position(s)
Value (or range) of output
Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation
Vol. 3A
1-9
ABOUT THIS MANUAL
1.3.7
Exceptions
An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi-
tions. Some types of exceptions may provide error codes. An error code reports additional information about the
error. An example of the notation used to show an exception and error code is shown below:
#PF(fault code)
This example refers to a page-fault exception under conditions where an error code naming a type of fault is
reported. Under some conditions, exceptions which produce error codes may not be able to report an accurate
code. In this case, the error code is zero, as shown below for a general-protection exception:
#GP(0)
1.4
RELATED LITERATURE
Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at:
See also:
The latest security information on Intel® products:
Software developer resources, guidance, and insights for security advisories:
The data sheet for a particular Intel 64 or IA-32 processor
The specification update for a particular Intel 64 or IA-32 processor
Intel® C++ Compiler documentation and online help:
Intel® Fortran Compiler documentation and online help:
Intel® Software Development Tools:
Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four or ten volumes):
Intel® 64 and IA-32 Architectures Optimization Reference Manual:
Intel® Trusted Execution Technology Measured Launched Environment Programming Guide:
Intel® Software Guard Extensions (Intel® SGX) Information
Developing Multi-threaded Applications: A Platform Consistent Approach:
tions.pdf
Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor:
Performance Monitoring Unit Sharing Guide
Literature related to select features in future Intel processors are available at:
Intel® Architecture Instruction Set Extensions Programming Reference
More relevant links are:
1-10
Vol. 3A
ABOUT THIS MANUAL
Intel® Developer Zone:
Developer centers:
Processor support general link:
Intel® Hyper-Threading Technology (Intel® HT Technology):
Vol. 3A
1-11
ABOUT THIS MANUAL
1-12
Vol. 3A
9. Updates to Chapter 2, Volume 3A
Change bars and violet text show changes to Chapter 2 of the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 3A: System Programming Guide, Part 1.
------------------------------------------------------------------------------------------
Changes to this chapter:
• Updated Figure 2-7, “Control Registers,” to add the LA57 bit to the CR4 register (bit 12).
Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes
23
CHAPTER 2
SYSTEM ARCHITECTURE OVERVIEW
IA-32 architecture (beginning with the Intel386 processor family) provides extensive support for operating-system
and system-development software. This support offers multiple modes of operation, which include:
Real mode, protected mode, virtual 8086 mode, and system management mode. These are sometimes
referred to as legacy modes.
Intel 64 architecture supports almost all the system programming facilities available in IA-32 architecture and
extends them to a new operating mode (IA-32e mode) that supports a 64-bit programming environment. IA-32e
mode allows software to operate in one of two sub-modes:
64-bit mode supports 64-bit OS and 64-bit applications
Compatibility mode allows most legacy software to run; it co-exists with 64-bit applications under a 64-bit OS.
The IA-32 system-level architecture includes features to assist in the following operations:
Memory management.
Protection of software modules.
Multitasking.
Exception and interrupt handling.
Multiprocessing.
Cache management.
Hardware resource and power management.
Debugging and performance monitoring.
This chapter provides a description of each part of this architecture. It also describes the system registers that are
used to set up and control the processor at the system level and gives a brief overview of the processor’s system-
level (operating system) instructions.
Many features of the system-level architecture are used only by system programmers. However, application
programmers may need to read this chapter and the following chapters in order to create a reliable and secure
environment for application programs.
This overview and most subsequent chapters of this book focus on protected-mode operation of the IA-32 architec-
ture. IA-32e mode operation of the Intel 64 architecture, as it differs from protected mode operation, is also
described.
All Intel 64 and IA-32 processors enter real-address mode following a power-up or reset (see Chapter 10,
“Processor Management and Initialization”). Software then initiates the switch from real-address mode to
protected mode. If IA-32e mode operation is desired, software also initiates a switch from protected mode to IA-
32e mode.
2.1
OVERVIEW OF THE SYSTEM-LEVEL ARCHITECTURE
System-level architecture consists of a set of registers, data structures, and instructions designed to support basic
system-level operations such as memory management, interrupt and exception handling, task management, and
control of multiple processors.
Figure 2-1 provides a summary of system registers and data structures that applies to 32-bit modes. System regis-
ters and data structures that apply to IA-32e mode are shown in Figure 2-2.
Vol. 3A
2-1
SYSTEM ARCHITECTURE OVERVIEW
EFLAGS Register
Physical Address
Code, Data or
Stack Segment
Linear Address
Control Registers
Task-State
CR4
Segment Selector
Segment (TSS)
Task
CR3
Code
CR2
Register
Data
CR1
CR0
Stack
Global Descriptor
Task Register
Table (GDT)
Interrupt Handler
Segment Sel.
Seg. Desc.
Code
Current
TSS Seg. Sel.
TSS Desc.
Stack
Interrupt
TSS
Vector
Seg. Desc.
Interrupt Descriptor
Task-State
Table (IDT)
Segment (TSS)
TSS Desc.
Task
Code
Interrupt Gate
LDT Desc.
Data
Stack
Task Gate
GDTR
Trap Gate
Local Descriptor
Exception Handler
Table (LDT)
Code
Current
Stack
Call-Gate
TSS
IDTR
Seg. Desc.
Segment Selector
Call Gate
Protected Procedure
Code
XCR0 (XFEM)
Current
LDTR
TSS
Stack
Linear Address Space
Linear Address
Dir
Table
Offset
Linear Addr.
Page Directory
Page Table
Page
Physical Addr.
Pg. Dir. Entry
Pg. Tbl. Entry
0
This page mapping example is for 4-KByte pages
CR3*
and 32-bit paging.
*Physical Address
Figure 2-1. IA-32 System-Level Registers and Data Structures
2-2
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
RFLAGS
Physical Address
Code, Data or Stack
Control Register
Segment (Base =0)
Linear Address
CR8
Task-State
CR4
Segment Selector
Segment (TSS)
CR3
CR2
Register
CR1
CR0
Global Descriptor
Task Register
Table (GDT)
Interrupt Handler
Segment Sel.
Seg. Desc.
Code
NULL
Interrupt
TR
TSS Desc.
Stack
Vector
Seg. Desc.
Interrupt Descriptor
Table (IDT)
Interr. Handler
Seg. Desc.
Code
Interrupt Gate
LDT Desc.
Current TSS
Stack
Interrupt Gate
GDTR
IST
Trap Gate
Local Descriptor
Exception Handler
Table (LDT)
Code
NULL
Stack
IDTR
Call-Gate
Seg. Desc.
Segment Selector
Call Gate
Protected Procedure
XCR0 (XFEM)
Code
LDTR
NULL
Stack
PKRU
Linear Address Space
Linear Address
PML4
Dir. Pointer
Directory
T
able
Offset
Linear Addr.
PML4
Pg. Dir
. Ptr.
Page Dir.
Page Table
Page
Physical
PML4.
Pg. Dir.
Page Tbl
Addr.
Entry
Entry
Entry
0
This page mapping example is for 4-KByte pages
CR3*
and 4-level paging.
*Physical Address
Figure 2-2. System-Level Registers and Data Structures in IA-32e Mode and 4-Level Paging
2.1.1
Global and Local Descriptor Tables
When operating in protected mode, all memory accesses pass through either the global descriptor table (GDT) or
an optional local descriptor table (LDT) as shown in Figure 2-1. These tables contain entries called segment
descriptors. Segment descriptors provide the base address of segments well as access rights, type, and usage
information.
Vol. 3A
2-3
SYSTEM ARCHITECTURE OVERVIEW
Each segment descriptor has an associated segment selector. A segment selector provides the software that uses
it with an index into the GDT or LDT (the offset of its associated segment descriptor), a global/local flag (deter-
mines whether the selector points to the GDT or the LDT), and access rights information.
To access a byte in a segment, a segment selector and an offset must be supplied. The segment selector provides
access to the segment descriptor for the segment (in the GDT or LDT). From the segment descriptor, the processor
obtains the base address of the segment in the linear address space. The offset then provides the location of the
byte relative to the base address. This mechanism can be used to access any valid code, data, or stack segment,
provided the segment is accessible from the current privilege level (CPL) at which the processor is operating. The
CPL is defined as the protection level of the currently executing code segment.
See Figure 2-1. The solid arrows in the figure indicate a linear address, dashed lines indicate a segment selector,
and the dotted arrows indicate a physical address. For simplicity, many of the segment selectors are shown as
direct pointers to a segment. However, the actual path from a segment selector to its associated segment is always
through a GDT or LDT.
The linear address of the base of the GDT is contained in the GDT register (GDTR); the linear address of the LDT is
contained in the LDT register (LDTR).
2.1.1.1
Global and Local Descriptor Tables in IA-32e Mode
GDTR and LDTR registers are expanded to 64-bits wide in both IA-32e sub-modes (64-bit mode and compatibility
mode). For more information: see Section 3.5.2, “Segment Descriptor Tables in IA-32e Mode.”
Global and local descriptor tables are expanded in 64-bit mode to support 64-bit base addresses, (16-byte LDT
descriptors hold a 64-bit base address and various attributes). In compatibility mode, descriptors are not
expanded.
2.1.2
System Segments, Segment Descriptors, and Gates
Besides code, data, and stack segments that make up the execution environment of a program or procedure, the
architecture defines two system segments: the task-state segment (TSS) and the LDT. The GDT is not considered
a segment because it is not accessed by means of a segment selector and segment descriptor. TSSs and LDTs have
segment descriptors defined for them.
The architecture also defines a set of special descriptors called gates (call gates, interrupt gates, trap gates, and
task gates). These provide protected gateways to system procedures and handlers that may operate at a different
privilege level than application programs and most procedures. For example, a CALL to a call gate can provide
access to a procedure in a code segment that is at the same or a numerically lower privilege level (more privileged)
than the current code segment. To access a procedure through a call gate, the calling procedure1 supplies the
selector for the call gate. The processor then performs an access rights check on the call gate, comparing the CPL
with the privilege level of the call gate and the destination code segment pointed to by the call gate.
If access to the destination code segment is allowed, the processor gets the segment selector for the destination
code segment and an offset into that code segment from the call gate. If the call requires a change in privilege
level, the processor also switches to the stack for the targeted privilege level. The segment selector for the new
stack is obtained from the TSS for the currently running task. Gates also facilitate transitions between 16-bit and
32-bit code segments, and vice versa.
2.1.2.1
Gates in IA-32e Mode
In IA-32e mode, the following descriptors are 16-byte descriptors (expanded to allow a 64-bit base): LDT descrip-
tors, 64-bit TSSs, call gates, interrupt gates, and trap gates.
Call gates facilitate transitions between 64-bit mode and compatibility mode. Task gates are not supported in IA-
32e mode. On privilege level changes, stack segment selectors are not read from the TSS. Instead, they are set to
NULL.
1. The word “procedure” is commonly used in this document as a general term for a logical unit or block of code (such as a program, pro-
cedure, function, or routine).
2-4
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.1.3
Task-State Segments and Task Gates
The TSS (see Figure 2-1) defines the state of the execution environment for a task. It includes the state of general-
purpose registers, segment registers, the EFLAGS register, the EIP register, and segment selectors with stack
pointers for three stack segments (one stack for each privilege level). The TSS also includes the segment selector
for the LDT associated with the task and the base address of the paging-structure hierarchy.
All program execution in protected mode happens within the context of a task (called the current task). The
segment selector for the TSS for the current task is stored in the task register. The simplest method for switching
to a task is to make a call or jump to the new task. Here, the segment selector for the TSS of the new task is given
in the CALL or JMP instruction. In switching tasks, the processor performs the following actions:
1. Stores the state of the current task in the current TSS.
2. Loads the task register with the segment selector for the new task.
3. Accesses the new TSS through a segment descriptor in the GDT.
4. Loads the state of the new task from the new TSS into the general-purpose registers, the segment registers,
the LDTR, control register CR3 (base address of the paging-structure hierarchy), the EFLAGS register, and the
EIP register.
5. Begins execution of the new task.
A task can also be accessed through a task gate. A task gate is similar to a call gate, except that it provides access
(through a segment selector) to a TSS rather than a code segment.
2.1.3.1
Task-State Segments in IA-32e Mode
Hardware task switches are not supported in IA-32e mode. However, TSSs continue to exist. The base address of
a TSS is specified by its descriptor.
A 64-bit TSS holds the following information that is important to 64-bit operation:
Stack pointer addresses for each privilege level.
Pointer addresses for the interrupt stack table.
Offset address of the IO-permission bitmap (from the TSS base).
The task register is expanded to hold 64-bit base addresses in IA-32e mode. See also: Section 8.7, “Task Manage-
ment in 64-bit Mode.”
2.1.4
Interrupt and Exception Handling
External interrupts, software interrupts and exceptions are handled through the interrupt descriptor table (IDT).
The IDT stores a collection of gate descriptors that provide access to interrupt and exception handlers. Like the
GDT, the IDT is not a segment. The linear address for the base of the IDT is contained in the IDT register (IDTR).
Gate descriptors in the IDT can be interrupt, trap, or task gate descriptors. To access an interrupt or exception
handler, the processor first receives an interrupt vector from internal hardware, an external interrupt controller, or
from software by means of an INT n, INTO, INT3, INT1, or BOUND instruction. The interrupt vector provides an
index into the IDT. If the selected gate descriptor is an interrupt gate or a trap gate, the associated handler proce-
dure is accessed in a manner similar to calling a procedure through a call gate. If the descriptor is a task gate, the
handler is accessed through a task switch.
2.1.4.1
Interrupt and Exception Handling IA-32e Mode
In IA-32e mode, interrupt gate descriptors are expanded to 16 bytes to support 64-bit base addresses. This is true
for 64-bit mode and compatibility mode.
The IDTR register is expanded to hold a 64-bit base address. Task gates are not supported.
Vol. 3A
2-5
SYSTEM ARCHITECTURE OVERVIEW
2.1.5
Memory Management
System architecture supports either direct physical addressing of memory or virtual memory (through paging).
When physical addressing is used, a linear address is treated as a physical address. When paging is used: all code,
data, stack, and system segments (including the GDT and IDT) can be paged with only the most recently accessed
pages being held in physical memory.
The location of pages (sometimes called page frames) in physical memory is contained in the paging structures.
These structures reside in physical memory (see Figure 2-1 for the case of 32-bit paging).
The base physical address of the paging-structure hierarchy is contained in control register CR3. The entries in the
paging structures determine the physical address of the base of a page frame, access rights and memory manage-
ment information.
To use this paging mechanism, a linear address is broken into parts. The parts provide separate offsets into the
paging structures and the page frame. A system can have a single hierarchy of paging structures or several. For
example, each task can have its own hierarchy.
2.1.5.1
Memory Management in IA-32e Mode
In IA-32e mode, physical memory pages are managed by a set of system data structures. In both compatibility
mode and 64-bit mode, four or five levels of system data structures are used (see Chapter 4, “Paging”). These
include the following:
The page map level 5 (PML5) - An entry in the PML5 table contains the physical address of the base of a
PML4 table, access rights, and memory management information. The base physical address of the PML5 table
is stored in CR3. The PML5 table is used only with 5-level paging.
A page map level 4 (PML4) - An entry in a PML4 table contains the physical address of the base of a page
directory pointer table, access rights, and memory management information. With 4-level paging, there is only
one PML4 table and its base physical address is stored in CR3.
A set of page directory pointer tables - An entry in a page directory pointer table contains the physical
address of the base of a page directory table, access rights, and memory management information.
Sets of page directories - An entry in a page directory table contains the physical address of the base of a
page table, access rights, and memory management information.
Sets of page tables - An entry in a page table contains the physical address of a page frame, access rights,
and memory management information.
2.1.6
System Registers
To assist in initializing the processor and controlling system operations, the system architecture provides system
flags in the EFLAGS register and several system registers:
The system flags and IOPL field in the EFLAGS register control task and mode switching, interrupt handling,
instruction tracing, and access rights. See also: Section 2.3, “System Flags and Fields in the EFLAGS Register.”
The control registers (CR0, CR2, CR3, and CR4) contain a variety of flags and data fields for controlling system-
level operations. Other flags in these registers are used to indicate support for specific processor capabilities
within the operating system or executive. See also: Chapter 2, “Control Registers,” and Section 2.6, “Extended
Control Registers (Including XCR0).”
The debug registers (not shown in Figure 2-1) allow the setting of breakpoints for use in debugging programs
and systems software. See also: Chapter 18, “Debug, Branch Profile, TSC, and Intel® Resource Director
Technology (Intel® RDT) Features.”
The GDTR, LDTR, and IDTR registers contain the linear addresses and sizes (limits) of their respective tables.
See also: Section 2.4, “Memory-Management Registers.”
The task register contains the linear address and size of the TSS for the current task. See also: Section 2.4,
“Memory-Management Registers.”
Model-specific registers (not shown in Figure 2-1).
2-6
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
The model-specific registers (MSRs) are a group of registers available primarily to operating-system or executive
procedures (that is, code running at privilege level 0). These registers control items such as the debug extensions,
the performance-monitoring counters, the machine- check architecture, and the memory type ranges (MTRRs).
The number and function of these registers varies among different members of the Intel 64 and IA-32 processor
families. See also: Section 10.4, “Model-Specific Registers (MSRs),” and Chapter 2, “Model-Specific Registers
(MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4.
Most systems restrict access to system registers (other than the EFLAGS register) by application programs.
Systems can be designed, however, where all programs and procedures run at the most privileged level (privilege
level 0). In such a case, application programs would be allowed to modify the system registers.
2.1.6.1
System Registers in IA-32e Mode
In IA-32e mode, the four system-descriptor-table registers (GDTR, IDTR, LDTR, and TR) are expanded in hardware
to hold 64-bit base addresses. EFLAGS becomes the 64-bit RFLAGS register. CR0-CR4 are expanded to 64 bits.
CR8 becomes available. CR8 provides read-write access to the task priority register (TPR) so that the operating
system can control the priority classes of external interrupts.
In 64-bit mode, debug registers DR0-DR7 are 64 bits. In compatibility mode, address-matching in DR0-DR3 is
also done at 64-bit granularity.
On systems that support IA-32e mode, the extended feature enable register (IA32_EFER) is available. This model-
specific register controls activation of IA-32e mode and other IA-32e mode operations. In addition, there are
several model-specific registers that govern IA-32e mode instructions:
IA32_KERNEL_GS_BASE - Used by SWAPGS instruction.
IA32_LSTAR - Used by SYSCALL instruction.
IA32_FMASK - Used by SYSCALL instruction.
IA32_STAR - Used by SYSCALL and SYSRET instruction.
2.1.7
Other System Resources
Besides the system registers and data structures described in the previous sections, system architecture provides
the following additional resources:
Operating system instructions (see also: Section 2.8, “System Instruction Summary”).
Performance-monitoring counters (not shown in Figure 2-1).
Internal caches and buffers (not shown in Figure 2-1).
Performance-monitoring counters are event counters that can be programmed to count processor events such as
the number of instructions decoded, the number of interrupts received, or the number of cache loads.
The processor provides several internal caches and buffers. The caches are used to store both data and instruc-
tions. The buffers are used to store things like decoded addresses to system and application segments and write
operations waiting to be performed. See also: Chapter 12, “Memory Cache Control.”
2.2
MODES OF OPERATION
The IA-32 architecture supports three operating modes and one quasi-operating mode:
Protected mode - This is the native operating mode of the processor. It provides a rich set of architectural
features, flexibility, high performance and backward compatibility to existing software base.
Real-address mode - This operating mode provides the programming environment of the Intel 8086
processor, with a few extensions (such as the ability to switch to protected or system management mode).
System management mode (SMM) - SMM is a standard architectural feature in all IA-32 processors,
beginning with the Intel386 SL processor. This mode provides an operating system or executive with a
transparent mechanism for implementing power management and OEM differentiation features. SMM is
entered through activation of an external system interrupt pin (SMI#), which generates a system management
Vol. 3A
2-7
SYSTEM ARCHITECTURE OVERVIEW
interrupt (SMI). In SMM, the processor switches to a separate address space while saving the context of the
currently running program or task. SMM-specific code may then be executed transparently. Upon returning
from SMM, the processor is placed back into its state prior to the SMI.
Virtual-8086 mode - In protected mode, the processor supports a quasi-operating mode known as virtual-
8086 mode. This mode allows the processor execute 8086 software in a protected, multitasking environment.
Intel 64 architecture supports all operating modes of IA-32 architecture and IA-32e modes:
IA-32e mode - In IA-32e mode, the processor supports two sub-modes: compatibility mode and 64-bit
mode. 64-bit mode provides 64-bit linear addressing and support for physical address space larger than 64
GBytes. Compatibility mode allows most legacy protected-mode applications to run unchanged.
Figure 2-3 shows how the processor moves between operating modes.
SMI#
Real-Address
Mode
Reset
or
Reset or
RSM
PE=1
PE=0
SMI#
Reset
Protected Mode
RSM
System
Management
LME=1, CR0.PG=1*
SMI#
Mode
See**
IA-32e
RSM
Mode
VM=0
VM=1
* See Section 10.8.5
SMI#
** See Section 10.8.5.4
Virtual-8086
Mode
RSM
Figure 2-3. Transitions Among the Processor’s Operating Modes
The processor is placed in real-address mode following power-up or a reset. The PE flag in control register CR0 then
controls whether the processor is operating in real-address or protected mode. See also: Section 10.9, “Mode
Switching,” and Section 4.1.2, “Paging-Mode Enabling.”
The VM flag in the EFLAGS register determines whether the processor is operating in protected mode or virtual-
8086 mode. Transitions between protected mode and virtual-8086 mode are generally carried out as part of a task
switch or a return from an interrupt or exception handler. See also: Section 21.2.5, “Entering Virtual-8086 Mode.”
The LMA bit (IA32_EFER.LMA[bit 10]) determines whether the processor is operating in IA-32e mode. When
running in IA-32e mode, 64-bit or compatibility sub-mode operation is determined by CS.L bit of the code segment.
The processor enters into IA-32e mode from protected mode by enabling paging and setting the LME bit
(IA32_EFER.LME[bit 8]). See also: Chapter 10, “Processor Management and Initialization.”
The processor switches to SMM whenever it receives an SMI while the processor is in real-address, protected,
virtual-8086, or IA-32e modes. Upon execution of the RSM instruction, the processor always returns to the mode
it was in when the SMI occurred.
2-8
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.2.1
Extended Feature Enable Register
The IA32_EFER MSR provides several fields related to IA-32e mode enabling and operation. It also provides one
field that relates to page-access right modification (see Section 4.6, “Access Rights”). The layout of the IA32_EFER
MSR is shown in Figure 2-4.
63
12 11 10 9
8
7
1
0
IA32_EFER
Execute Disable Bit Enable
IA-32e Mode Active
IA-32e Mode Enable
SYSCALL Enable
Reserved
Figure 2-4. IA32_EFER MSR Layout
Table 2-1. IA32_EFER MSR Information
Bit
Description
0
SYSCALL Enable: IA32_EFER.SCE (R/W)
Enables SYSCALL/SYSRET instructions in 64-bit mode.
7:1
Reserved.
8
IA-32e Mode Enable: IA32_EFER.LME (R/W)
Enables IA-32e mode operation.
9
Reserved.
10
IA-32e Mode Active: IA32_EFER.LMA (R)
Indicates IA-32e mode is active when set.
11
Execute Disable Bit Enable: IA32_EFER.NXE (R/W)
Enables page access restriction by preventing instruction fetches from PAE pages with the XD bit set (See Section 4.6).
63:12
Reserved.
2.3
SYSTEM FLAGS AND FIELDS IN THE EFLAGS REGISTER
The system flags and IOPL field of the EFLAGS register control I/O, maskable hardware interrupts, debugging, task
switching, and the virtual-8086 mode (see Figure 2-5). Only privileged code (typically operating system or execu-
tive code) should be allowed to modify these bits.
The system flags and IOPL are:
TF
Trap (bit 8) - Set to enable single-step mode for debugging; clear to disable single-step mode. In single-
step mode, the processor generates a debug exception after each instruction. This allows the execution
state of a program to be inspected after each instruction. If an application program sets the TF flag using a
Vol. 3A
2-9
SYSTEM ARCHITECTURE OVERVIEW
POPF, POPFD, or IRET instruction, a debug exception is generated after the instruction that follows the
POPF, POPFD, or IRET.
31
22 21 20 19 18 17 16
15 14 13 12 11 10 9
8
7
6
5
4
3
2
1
0
I
V
V
I
A
V
R
N
O
O
D
I
T
S
Z
A
P
C
Reserved (set to 0)
I
I
0
0
0
1
D
C
M
F
T
P
F
F
F
F
F
F
F
F
F
P
F
L
ID
- Identification Flag
VIP - Virtual Interrupt Pending
VIF - Virtual Interrupt Flag
AC - Alignment Check / Access Control
VM - Virtual-8086 Mode
RF - Resume Flag
NT - Nested Task Flag
IOPL- I/O Privilege Level
IF
- Interrupt Enable Flag
TF
- Trap Flag
Reserved
Figure 2-5. System Flags in the EFLAGS Register
IF
Interrupt enable (bit 9) - Controls the response of the processor to maskable hardware interrupt
requests (see also: Section 6.3.2, “Maskable Hardware Interrupts”). The flag is set to respond to maskable
hardware interrupts; cleared to inhibit maskable hardware interrupts. The IF flag does not affect the gener-
ation of exceptions or nonmaskable interrupts (NMI interrupts). The CPL, IOPL, and the state of the VME
flag in control register CR4 determine whether the IF flag can be modified by the CLI, STI, POPF, POPFD,
and IRET.
IOPL
I/O privilege level field (bits 12 and 13) - Indicates the I/O privilege level (IOPL) of the currently
running program or task. The CPL of the currently running program or task must be less than or equal to
the IOPL to access the I/O address space. The POPF and IRET instructions can modify this field only when
operating at a CPL of 0.
The IOPL is also one of the mechanisms that controls the modification of the IF flag and the handling of
interrupts in virtual-8086 mode when virtual mode extensions are in effect (when CR4.VME = 1). See also:
Chapter 19, “Input/Output,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume
1.
NT
Nested task (bit 14) - Controls the chaining of interrupted and called tasks. The processor sets this flag
on calls to a task initiated with a CALL instruction, an interrupt, or an exception. It examines and modifies
this flag on returns from a task initiated with the IRET instruction. The flag can be explicitly set or cleared
with the POPF/POPFD instructions; however, changing to the state of this flag can generate unexpected
exceptions in application programs.
See also: Section 8.4, “Task Linking.”
RF
Resume (bit 16) - Controls the processor’s response to instruction-breakpoint conditions. When set, this
flag temporarily disables debug exceptions (#DB) from being generated for instruction breakpoints
(although other exception conditions can cause an exception to be generated). When clear, instruction
breakpoints will generate debug exceptions.
The primary function of the RF flag is to allow the restarting of an instruction following a debug exception
that was caused by an instruction breakpoint condition. Here, debug software must set this flag in the
EFLAGS image on the stack just prior to returning to the interrupted program with IRETD (to prevent the
instruction breakpoint from causing another debug exception). The processor then automatically clears
this flag after the instruction returned to has been successfully executed, enabling instruction breakpoint
faults again.
See also: Section 18.3.1.1, “Instruction-Breakpoint Exception Condition.”
VM
Virtual-8086 mode (bit 17) - Set to enable virtual-8086 mode; clear to return to protected mode.
2-10
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
See also: Section 21.2.1, “Enabling Virtual-8086 Mode.”
AC
Alignment check or access control (bit 18) - If the AM bit is set in the CR0 register, alignment
checking of user-mode data accesses is enabled if and only if this flag is 1. An alignment-check exception
is generated when reference is made to an unaligned operand, such as a word at an odd byte address or a
doubleword at an address which is not an integral multiple of four. Alignment-check exceptions are gener-
ated only in user mode (privilege level 3). Memory references that default to privilege level 0, such as
segment descriptor loads, do not generate this exception even when caused by instructions executed in
user-mode.
The alignment-check exception can be used to check alignment of data. This is useful when exchanging
data with processors which require all data to be aligned. The alignment-check exception can also be used
by interpreters to flag some pointers as special by misaligning the pointer. This eliminates overhead of
checking each pointer and only handles the special pointer when used.
If the SMAP bit is set in the CR4 register, explicit supervisor-mode data accesses to user-mode pages are
allowed if and only if this bit is 1. See Section 4.6, “Access Rights.”
VIF
Virtual Interrupt (bit 19) - Contains a virtual image of the IF flag. This flag is used in conjunction with
the VIP flag. The processor only recognizes the VIF flag when either the VME flag or the PVI flag in control
register CR4 is set and the IOPL is less than 3. (The VME flag enables the virtual-8086 mode extensions;
the PVI flag enables the protected-mode virtual interrupts.)
See also: Section 21.3.3.5, “Method 6: Software Interrupt Handling,” and Section 21.4, “Protected-Mode
Virtual Interrupts.”
VIP
Virtual interrupt pending (bit 20) - Set by software to indicate that an interrupt is pending; cleared to
indicate that no interrupt is pending. This flag is used in conjunction with the VIF flag. The processor reads
this flag but never modifies it. The processor only recognizes the VIP flag when either the VME flag or the
PVI flag in control register CR4 is set and the IOPL is less than 3. The VME flag enables the virtual-8086
mode extensions; the PVI flag enables the protected-mode virtual interrupts.
See Section 21.3.3.5, “Method 6: Software Interrupt Handling,” and Section 21.4, “Protected-Mode Virtual
Interrupts.”
ID
Identification (bit 21) - The ability of a program or procedure to set or clear this flag indicates support
for the CPUID instruction.
2.3.1
System Flags and Fields in IA-32e Mode
In 64-bit mode, the RFLAGS register expands to 64 bits with the upper 32 bits reserved. System flags in RFLAGS
(64-bit mode) or EFLAGS (compatibility mode) are shown in Figure 2-5.
In IA-32e mode, the processor does not allow the VM bit to be set because virtual-8086 mode is not supported
(attempts to set the bit are ignored). Also, the processor will not set the NT bit. The processor does, however, allow
software to set the NT bit (note that an IRET causes a general protection fault in IA-32e mode if the NT bit is set).
In IA-32e mode, the SYSCALL/SYSRET instructions have a programmable method of specifying which bits are
cleared in RFLAGS/EFLAGS. These instructions save/restore EFLAGS/RFLAGS.
2.4
MEMORY-MANAGEMENT REGISTERS
The processor provides four memory-management registers (GDTR, LDTR, IDTR, and TR) that specify the locations
of the data structures which control segmented memory management (see Figure 2-6). Special instructions are
provided for loading and storing these registers.
Vol. 3A
2-11
SYSTEM ARCHITECTURE OVERVIEW
System Table Registers
47(79)
16 15
0
GDTR
32(64)-bit Linear Base Address
16-Bit Table Limit
IDTR
32(64)-bit Linear Base Address
16-Bit Table Limit
System Segment
Segment Descriptor Registers (Automatically Loaded)
Registers
15
0
Attributes
Task
Seg. Sel.
32(64)-bit Linear Base Address
Segment Limit
Register
LDTR
Seg. Sel.
32(64)-bit Linear Base Address
Segment Limit
Figure 2-6. Memory Management Registers
2.4.1
Global Descriptor Table Register (GDTR)
The GDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and the 16-bit table
limit for the GDT. The base address specifies the linear address of byte 0 of the GDT; the table limit specifies the
number of bytes in the table.
The LGDT and SGDT instructions load and store the GDTR register, respectively. On power up or reset of the
processor, the base address is set to the default value of 0 and the limit is set to 0FFFFH. A new base address must
be loaded into the GDTR as part of the processor initialization process for protected-mode operation.
See also: Section 3.5.1, “Segment Descriptor Tables.”
2.4.2
Local Descriptor Table Register (LDTR)
The LDTR register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e
mode), segment limit, and descriptor attributes for the LDT. The base address specifies the linear address of byte
0 of the LDT segment; the segment limit specifies the number of bytes in the segment. See also: Section 3.5.1,
“Segment Descriptor Tables.”
The LLDT and SLDT instructions load and store the segment selector part of the LDTR register, respectively. The
segment that contains the LDT must have a segment descriptor in the GDT. When the LLDT instruction loads a
segment selector in the LDTR: the base address, limit, and descriptor attributes from the LDT descriptor are auto-
matically loaded in the LDTR.
When a task switch occurs, the LDTR is automatically loaded with the segment selector and descriptor for the LDT
for the new task. The contents of the LDTR are not automatically saved prior to writing the new LDT information
into the register.
On power up or reset of the processor, the segment selector and base address are set to the default value of 0 and
the limit is set to 0FFFFH.
2.4.3
IDTR Interrupt Descriptor Table Register
The IDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and 16-bit table limit
for the IDT. The base address specifies the linear address of byte 0 of the IDT; the table limit specifies the number
of bytes in the table. The LIDT and SIDT instructions load and store the IDTR register, respectively. On power up or
reset of the processor, the base address is set to the default value of 0 and the limit is set to 0FFFFH. The base
address and limit in the register can then be changed as part of the processor initialization process.
See also: Section 6.10, “Interrupt Descriptor Table (IDT).”
2-12
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.4.4
Task Register (TR)
The task register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e
mode), segment limit, and descriptor attributes for the TSS of the current task. The selector references the TSS
descriptor in the GDT. The base address specifies the linear address of byte 0 of the TSS; the segment limit speci-
fies the number of bytes in the TSS. See also: Section 8.2.4, “Task Register.”
The LTR and STR instructions load and store the segment selector part of the task register, respectively. When the
LTR instruction loads a segment selector in the task register, the base address, limit, and descriptor attributes from
the TSS descriptor are automatically loaded into the task register. On power up or reset of the processor, the base
address is set to the default value of 0 and the limit is set to 0FFFFH.
When a task switch occurs, the task register is automatically loaded with the segment selector and descriptor for
the TSS for the new task. The contents of the task register are not automatically saved prior to writing the new TSS
information into the register.
2.5
CONTROL REGISTERS
Control registers (CR0, CR1, CR2, CR3, and CR4; see Figure 2-7) determine operating mode of the processor and
the characteristics of the currently executing task. These registers are 32 bits in all 32-bit modes and compatibility
mode.
In 64-bit mode, control registers are expanded to 64 bits. The MOV CRn instructions are used to manipulate the
register bits. Operand-size prefixes for these instructions are ignored. The following is also true:
The control registers can be read and loaded (or modified) using the move-to-or-from-control-registers forms
of the MOV instruction. In protected mode, the MOV instructions allow the control registers to be read or loaded
(at privilege level 0 only). This restriction means that application programs or operating-system procedures
(running at privilege levels 1, 2, or 3) are prevented from reading or loading the control registers.
Some of the bits in CR0 and CR4 are reserved and must be written with zeros. Attempting to set any reserved
bits in CR0[31:0] is ignored. Attempting to set any reserved bits in CR0[63:32] results in a general-protection
exception, #GP(0). Attempting to set any reserved bits in CR4 results in a general-protection exception,
#GP(0).
All 64 bits of CR2 are writable by software.
Reserved bits in CR3[63:MAXPHYADDR] must be zero. Attempting to set any of them results in #GP(0).
The MOV CR2 instruction does not check that address written to CR2 is canonical.
A 64-bit capable processor will retain the upper 32 bits of each control register when transitioning out of IA-32e
mode.
On a 64-bit capable processor, an execution of MOV to CR outside of 64-bit mode zeros the upper 32 bits of the
control register.
Register CR8 is available in 64-bit mode only.
The control registers are summarized below, and each architecturally defined control field in these control registers
is described individually. In Figure 2-7, the width of the register in 64-bit mode is indicated in parenthesis (except
for CR0).
CR0 - Contains system control flags that control operating mode and states of the processor.
CR1 - Reserved.
CR2 - Contains the page-fault linear address (the linear address that caused a page fault).
CR3 - Contains the physical address of the base of the paging-structure hierarchy and two flags (PCD and
PWT). Only the most-significant bits (less the lower 12 bits) of the base address are specified; the lower 12 bits
of the address are assumed to be 0. The first paging structure must thus be aligned to a page (4-KByte)
boundary. The PCD and PWT flags control caching of that paging structure in the processor’s internal data
caches (they do not control TLB caching of page-directory information).
When using the physical address extension, the CR3 register contains the base address of the page-directory-
pointer table. With 4-level paging and 5-level paging, the CR3 register contains the base address of the PML4
Vol. 3A
2-13
SYSTEM ARCHITECTURE OVERVIEW
table and PML5 table, respectively. If PCIDs are enabled, CR3 has a format different from that illustrated in
Figure 2-7. See Section 4.5, “4-Level Paging and 5-Level Paging.”
See also: Chapter 4, “Paging.”
CR4 - Contains a group of flags that enable several architectural extensions, and indicate operating system or
executive support for specific processor capabilities. Bits CR4[63:32] can only be used for IA-32e mode only
features that are enabled after entering 64-bit mode. Bits CR4[63:32] do not have any effect outside of IA-32e
mode.
CR8 - Provides read and write access to the Task Priority Register (TPR). It specifies the priority threshold
value that operating systems use to control the priority class of external interrupts allowed to interrupt the
processor. This register is available only in 64-bit mode. However, interrupt filtering continues to apply in
compatibility mode.
31 (63)
25
24
23
22
21
20
19
18
17
16
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
U
P
S
S
S
V
L
U
I
P
C
P
C
P
P
M
P
P
T
P
V
M
M
K
M
M
A
M
D
Reserved
N
K
E
K
I
C
G
C
A
S
S
V
M
CR4
A
E
L
X
X
5
I
E
T
S
T
E
D
E
E
E
E
E
D
I
E
P
P
E
E
7
P
R
E
OSFXSR
OSXSAVE
FSGSBASE
OSXMMEXCPT
31 (63)
12
11
5
4
3
2
0
P
P
Page-Directory Base
C
W
CR3
D
T
31 (63)
0
Page-Fault Linear Address
CR2
31 (63)
0
CR1
31
30
29
28
19
18
17
16
15
6
5
4
3
2
1
0
P
C
N
A
W
N
E
T
E
M
P
G
D
W
M
P
E
T
S
M
P
E
CR0
Reserved
Figure 2-7. Control Registers
2-14
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
The flags in control registers are:
CR0.PG
Paging (bit 31 of CR0) - Enables paging when set; disables paging when clear. When paging is
disabled, all linear addresses are treated as physical addresses. The PG flag has no effect if the PE flag (bit
0 of register CR0) is not also set; setting the PG flag when the PE flag is clear causes a general-protection
exception (#GP). See also: Chapter 4, “Paging.”
On Intel 64 processors, enabling and disabling IA-32e mode operation also requires modifying CR0.PG.
CR0.CD
Cache Disable (bit 30 of CR0) - When the CD and NW flags are clear, caching of memory locations for
the whole of physical memory in the processor’s internal (and external) caches is enabled. When the CD
flag is set, caching is restricted as described in Table 12-5. To prevent the processor from accessing and
updating its caches, the CD flag must be set and the caches must be invalidated so that no cache hits can
occur.
See also: Section 12.5.3, “Preventing Caching,” and Section 12.5, “Cache Control.”
CR0.NW
Not Write-through (bit 29 of CR0) - When the NW and CD flags are clear, write-back (for Pentium 4,
Intel Xeon, P6 family, and Pentium processors) or write-through (for Intel486 processors) is enabled for
writes that hit the cache and invalidation cycles are enabled. See Table 12-5 for detailed information about
the effect of the NW flag on caching for other settings of the CD and NW flags.
CR0.AM
Alignment Mask (bit 18 of CR0) - Enables automatic alignment checking when set; disables alignment
checking when clear. Alignment checking is performed only when the AM flag is set, the AC flag in the
EFLAGS register is set, CPL is 3, and the processor is operating in either protected or virtual-8086 mode.
CR0.WP
Write Protect (bit 16 of CR0) - When set, inhibits supervisor-level procedures from writing into read-
only pages; when clear, allows supervisor-level procedures to write into read-only pages (regardless of the
U/S bit setting; see Section 4.1.3 and Section 4.6). This flag facilitates implementation of the copy-on-
write method of creating a new process (forking) used by operating systems such as UNIX. This flag must
be set before software can set CR4.CET, and it cannot be cleared as long as CR4.CET = 1 (see below).
CR0.NE
Numeric Error (bit 5 of CR0) - Enables the native (internal) mechanism for reporting x87 FPU errors
when set; enables the PC-style x87 FPU error reporting mechanism when clear. When the NE flag is clear
and the IGNNE# input is asserted, x87 FPU errors are ignored. When the NE flag is clear and the IGNNE#
input is deasserted, an unmasked x87 FPU error causes the processor to assert the FERR# pin to generate
an external interrupt and to stop instruction execution immediately before executing the next waiting
floating-point instruction or WAIT/FWAIT instruction.
The FERR# pin is intended to drive an input to an external interrupt controller (the FERR# pin emulates the
ERROR# pin of the Intel 287 and Intel 387 DX math coprocessors). The NE flag, IGNNE# pin, and FERR#
pin are used with external logic to implement PC-style error reporting. Using FERR# and IGNNE# to handle
floating-point exceptions is deprecated by modern operating systems; this non-native approach also limits
newer processors to operate with one logical processor active.
See also: Section 8.7, “Handling x87 FPU Exceptions in Software,” in Chapter 8, “Programming with the
x87 FPU,” and Appendix A, “EFLAGS Cross-Reference,” in the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 1.
CR0.ET
Extension Type (bit 4 of CR0) - Reserved in the Pentium 4, Intel Xeon, P6 family, and Pentium proces-
sors. In the Pentium 4, Intel Xeon, and P6 family processors, this flag is hardcoded to 1. In the Intel386
and Intel486 processors, this flag indicates support of Intel 387 DX math coprocessor instructions when
set.
CR0.TS
Task Switched (bit 3 of CR0) - Allows the saving of the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4
context on a task switch to be delayed until an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction is
Vol. 3A
2-15
SYSTEM ARCHITECTURE OVERVIEW
actually executed by the new task. The processor sets this flag on every task switch and tests it when
executing x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
If the TS flag is set and the EM flag (bit 2 of CR0) is clear, a device-not-available exception (#NM) is
raised prior to the execution of any x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction; with the
exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT.
See the paragraph below for the special case of the WAIT/FWAIT instructions.
If the TS flag is set and the MP flag (bit 1 of CR0) and EM flag are clear, an #NM exception is not raised
prior to the execution of an x87 FPU WAIT/FWAIT instruction.
If the EM flag is set, the setting of the TS flag has no effect on the execution of x87
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
Table 2-2 shows the actions taken when the processor encounters an x87 FPU instruction based on the
settings of the TS, EM, and MP flags. Table 13-1 and 14-1 show the actions taken when the processor
encounters an MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction.
The processor does not automatically save the context of the x87 FPU, XMM, and MXCSR registers on a
task switch. Instead, it sets the TS flag, which causes the processor to raise an #NM exception whenever it
encounters an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction in the instruction stream for the
new task (with the exception of the instructions listed above).
The fault handler for the #NM exception can then be used to clear the TS flag (with the CLTS instruction)
and save the context of the x87 FPU, XMM, and MXCSR registers. If the task never encounters an x87
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction, the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4
context is never saved.
Table 2-2. Action Taken By x87 FPU Instructions for Different Combinations of EM, MP, and TS
CR0 Flags
x87 FPU Instruction Type
EM
MP
TS
Floating-Point
WAIT/FWAIT
0
0
0
Execute
Execute.
0
0
1
#NM Exception
Execute.
0
1
0
Execute
Execute.
0
1
1
#NM Exception
#NM exception.
1
0
0
#NM Exception
Execute.
1
0
1
#NM Exception
Execute.
1
1
0
#NM Exception
Execute.
1
1
1
#NM Exception
#NM exception.
CR0.EM
Emulation (bit 2 of CR0) - Indicates that the processor does not have an internal or external x87 FPU when set;
indicates an x87 FPU is present when clear. This flag also affects the execution of
MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
When the EM flag is set, execution of an x87 FPU instruction generates a device-not-available exception
(#NM). This flag must be set when the processor does not have an internal x87 FPU or is not connected to
an external math coprocessor. Setting this flag forces all floating-point instructions to be handled by soft-
ware emulation. Table 10-3 shows the recommended setting of this flag, depending on the IA-32 processor
and x87 FPU or math coprocessor present in the system. Table 2-2 shows the interaction of the EM, MP, and
TS flags.
Also, when the EM flag is set, execution of an MMX instruction causes an invalid-opcode exception (#UD)
to be generated (see Table 13-1). Thus, if an IA-32 or Intel 64 processor incorporates MMX technology, the
EM flag must be set to 0 to enable execution of MMX instructions.
Similarly for SSE/SSE2/SSE3/SSSE3/SSE4 extensions, when the EM flag is set, execution of most
SSE/SSE2/SSE3/SSSE3/SSE4 instructions causes an invalid opcode exception (#UD) to be generated (see
2-16
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
Table 14-1). If an IA-32 or Intel 64 processor incorporates the SSE/SSE2/SSE3/SSSE3/SSE4 extensions,
the EM flag must be set to 0 to enable execution of these extensions. SSE/SSE2/SSE3/SSSE3/SSE4
instructions not affected by the EM flag include: PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI,
CLFLUSH, CRC32, and POPCNT.
CR0.MP
Monitor Coprocessor (bit 1 of CR0) - Controls the interaction of the WAIT (or FWAIT) instruction with
the TS flag (bit 3 of CR0). If the MP flag is set, a WAIT instruction generates a device-not-available exception
(#NM) if the TS flag is also set. If the MP flag is clear, the WAIT instruction ignores the setting of the TS flag.
Table 10-3 shows the recommended setting of this flag, depending on the IA-32 processor and x87 FPU or
math coprocessor present in the system. Table 2-2 shows the interaction of the MP, EM, and TS flags.
CR0.PE
Protection Enable (bit 0 of CR0) - Enables protected mode when set; enables real-address mode when
clear. This flag does not enable paging directly. It only enables segment-level protection. To enable paging,
both the PE and PG flags must be set.
See also: Section 10.9, “Mode Switching.”
CR3.PCD
Page-level Cache Disable (bit 4 of CR3) - Controls the memory type used to access the first paging
structure of the current paging-structure hierarchy. See Section 4.9, “Paging and Memory Typing.” This bit
is not used if paging is disabled, with PAE paging, or with 4-level paging1 or 5-level paging if CR4.PCIDE=1.
CR3.PWT
Page-level Write-Through (bit 3 of CR3) - Controls the memory type used to access the first paging
structure of the current paging-structure hierarchy. See Section 4.9, “Paging and Memory Typing.” This bit
is not used if paging is disabled, with PAE paging, or with 4-level paging or 5-level paging if CR4.PCIDE=1.
CR4.VME
Virtual-8086 Mode Extensions (bit 0 of CR4) - Enables interrupt- and exception-handling extensions
in virtual-8086 mode when set; disables the extensions when clear. Use of the virtual mode extensions can
improve the performance of virtual-8086 applications by eliminating the overhead of calling the virtual-
8086 monitor to handle interrupts and exceptions that occur while executing an 8086 program and,
instead, redirecting the interrupts and exceptions back to the 8086 program’s handlers. It also provides
hardware support for a virtual interrupt flag (VIF) to improve reliability of running 8086 programs in multi-
tasking and multiple-processor environments.
See also: Section 21.3, “Interrupt and Exception Handling in Virtual-8086 Mode.”
CR4.PVI
Protected-Mode Virtual Interrupts (bit 1 of CR4) - Enables hardware support for a virtual interrupt
flag (VIF) in protected mode when set; disables the VIF flag in protected mode when clear.
See also: Section 21.4, “Protected-Mode Virtual Interrupts.”
CR4.TSD
Time Stamp Disable (bit 2 of CR4) - Restricts the execution of the RDTSC instruction to procedures
running at privilege level 0 when set; allows RDTSC instruction to be executed at any privilege level when
clear. This bit also applies to the RDTSCP instruction if supported (if CPUID.80000001H:EDX[27] = 1).
CR4.DE
Debugging Extensions (bit 3 of CR4) - References to debug registers DR4 and DR5 cause an unde-
fined opcode (#UD) exception to be generated when set; when clear, processor aliases references to regis-
ters DR4 and DR5 for compatibility with software written to run on earlier IA-32 processors.
See also: Section 18.2.2, “Debug Registers DR4 and DR5.”
CR4.PSE
Page Size Extensions (bit 4 of CR4) - Enables 4-MByte pages with 32-bit paging when set; restricts
32-bit paging to pages of 4 KBytes when clear.
See also: Section 4.3, “32-Bit Paging.”
1. Earlier versions of this manual used the term “IA-32e paging” to identify 4-level paging.
Vol. 3A
2-17
SYSTEM ARCHITECTURE OVERVIEW
CR4.PAE
Physical Address Extension (bit 5 of CR4) - When set, enables paging to produce physical addresses
with more than 32 bits. When clear, restricts physical addresses to 32 bits. PAE must be set before entering
IA-32e mode.
See also: Chapter 4, “Paging.”
CR4.MCE
Machine-Check Enable (bit 6 of CR4) - Enables the machine-check exception when set; disables the
machine-check exception when clear.
See also: Chapter 16, “Machine-Check Architecture.”
CR4.PGE
Page Global Enable (bit 7 of CR4) - (Introduced in the P6 family processors.) Enables the global page
feature when set; disables the global page feature when clear. The global page feature allows frequently
used or shared pages to be marked as global to all users (done with the global flag, bit 8, in a page-direc-
tory-pointer-table entry, a page-directory entry, or a page-table entry). Global pages are not flushed from
the translation-lookaside buffer (TLB) on a task switch or a write to register CR3.
When enabling the global page feature, paging must be enabled (by setting the PG flag in control register
CR0) before the PGE flag is set. Reversing this sequence may affect program correctness, and processor
performance will be impacted.
See also: Section 4.10, “Caching Translation Information.”
CR4.PCE
Performance-Monitoring Counter Enable (bit 8 of CR4) - Enables execution of the RDPMC instruc-
tion for programs or procedures running at any protection level when set; RDPMC instruction can be
executed only at protection level 0 when clear.
CR4.OSFXSR
Operating System Support for FXSAVE and FXRSTOR instructions (bit 9 of CR4) - When set, this
flag: (1) indicates to software that the operating system supports the use of the FXSAVE and FXRSTOR
instructions, (2) enables the FXSAVE and FXRSTOR instructions to save and restore the contents of the
XMM and MXCSR registers along with the contents of the x87 FPU and MMX registers, and (3) enables the
processor to execute SSE/SSE2/SSE3/SSSE3/SSE4 instructions, with the exception of the PAUSE,
PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT.
If this flag is clear, the FXSAVE and FXRSTOR instructions will save and restore the contents of the x87 FPU
and MMX registers, but they may not save and restore the contents of the XMM and MXCSR registers. Also,
the processor will generate an invalid opcode exception (#UD) if it attempts to execute any
SSE/SSE2/SSE3 instruction, with the exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE,
MOVNTI, CLFLUSH, CRC32, and POPCNT. The operating system or executive must explicitly set this flag.
NOTE
CPUID feature flag FXSR indicates availability of the FXSAVE/FXRSTOR instructions. The OSFXSR
bit provides operating system software with a means of enabling FXSAVE/FXRSTOR to save/restore
the contents of the X87 FPU, XMM, and MXCSR registers. Consequently OSFXSR bit indicates that
the operating system provides context switch support for SSE/SSE2/SSE3/SSSE3/SSE4.
CR4.OSXMMEXCPT
Operating System Support for Unmasked SIMD Floating-Point Exceptions (bit 10 of CR4) -
When set, indicates that the operating system supports the handling of unmasked SIMD floating-point
exceptions through an exception handler that is invoked when a SIMD floating-point exception (#XM) is
generated. SIMD floating-point exceptions are only generated by SSE/SSE2/SSE3/SSE4.1 SIMD floating-
point instructions.
The operating system or executive must explicitly set this flag. If this flag is not set, the processor will
generate an invalid opcode exception (#UD) whenever it detects an unmasked SIMD floating-point excep-
tion.
2-18
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
CR4.UMIP
User-Mode Instruction Prevention (bit 11 of CR4) - When set, the following instructions cannot be
executed if CPL > 0: SGDT, SIDT, SLDT, SMSW, and STR. An attempt at such execution causes a general-
protection exception (#GP).
CR4.LA57
57-bit linear addresses (bit 12 of CR4) - When set in IA-32e mode, the processor uses 5-level paging
to translate 57-bit linear addresses. When clear in IA-32e mode, the processor uses 4-level paging to
translate 48-bit linear addresses. This bit cannot be modified in IA-32e mode.
See also: Chapter 4, “Paging.”
CR4.VMXE
VMX-Enable Bit (bit 13 of CR4) - Enables VMX operation when set. See Chapter 24, “Introduction to
Virtual Machine Extensions.”
CR4.SMXE
SMX-Enable Bit (bit 14 of CR4) - Enables SMX operation when set. See Chapter 7, “Safer Mode Exten-
sions Reference,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D.
CR4.FSGSBASE
FSGSBASE-Enable Bit (bit 16 of CR4) - Enables the instructions RDFSBASE, RDGSBASE, WRFSBASE,
and WRGSBASE.
CR4.PCIDE
PCID-Enable Bit (bit 17 of CR4) - Enables process-context identifiers (PCIDs) when set. See Section
4.10.1, “Process-Context Identifiers (PCIDs).” Applies only in IA-32e mode (if IA32_EFER.LMA = 1).
CR4.OSXSAVE
XSAVE and Processor Extended States-Enable Bit (bit 18 of CR4) - When set, this flag: (1) indi-
cates (via CPUID.01H:ECX.OSXSAVE[bit 27]) that the operating system supports the use of the XGETBV,
XSAVE, and XRSTOR instructions by general software; (2) enables the XSAVE and XRSTOR instructions to
save and restore the x87 FPU state (including MMX registers), the SSE state (XMM registers and MXCSR),
along with other processor extended states enabled in XCR0; (3) enables the processor to execute XGETBV
and XSETBV instructions in order to read and write XCR0. See Section 2.6 and Chapter 14, “System
Programming for Instruction Set Extensions and Processor Extended States.”
CR4.KL
Key-Locker-Enable Bit (bit 19 of CR4) - When set, the LOADIWKEY instruction is enabled; in addition,
if support for the AES Key Locker instructions has been activated by system firmware,
CPUID.19H:EBX.AESKLE[bit 0] is enumerated as 1 and the AES Key Locker instructions are enabled.1
When clear, CPUID.19H:EBX.AESKLE[bit 0] is enumerated as 0 and execution of any Key Locker instruction
causes an invalid-opcode exception (#UD).
CR4.SMEP
SMEP-Enable Bit (bit 20 of CR4) - Enables supervisor-mode execution prevention (SMEP) when set.
See Section 4.6, “Access Rights.”
CR4.SMAP
SMAP-Enable Bit (bit 21 of CR4) - Enables supervisor-mode access prevention (SMAP) when set. See
Section 4.6, “Access Rights.”
CR4.PKE
Enable protection keys for user-mode pages (bit 22 of CR4) - 4-level paging and 5-level paging
associate each user-mode linear address with a protection key. When set, this flag indicates (via
CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4]) that the operating system supports use of the PKRU
register to specify, for each protection key, whether user-mode linear addresses with that protection key
can be read or written. This bit also enables access to the PKRU register using the RDPKRU and WRPKRU
instructions.
1. Software can check CPUID.19H:EBX.AESKLE[bit 0] after setting CR4.KL to determine whether the AES Key Locker instructions have
been enabled. Note that some processors may allow enabling of those instructions without activation by system firmware. Some
processors may not support use of the AES Key Locker instructions in system-management mode (SMM). Those processors enumer-
ate CPUID.19H:EBX.AESKLE[bit 0] as 0 in SMM regardless of the setting of CR4.KL.
Vol. 3A
2-19
SYSTEM ARCHITECTURE OVERVIEW
CR4.CET
Control-flow Enforcement Technology (bit 23 of CR4) - Enables control-flow enforcement tech-
nology when set. See Chapter 17, “Control-flow Enforcement Technology (CET)‚” of the IA-32 Intel® Archi-
tecture Software Developer’s Manual, Volume 1. This flag can be set only if CR0.WP is set, and it must be
clear before CR0.WP can be cleared (see below).
CR4.PKS
Enable protection keys for supervisor-mode pages (bit 24 of CR4) - 4-level paging and 5-level
paging associate each supervisor-mode linear address with a protection key. When set, this flag allows use
of the IA32_PKRS MSR to specify, for each protection key, whether supervisor-mode linear addresses with
that protection key can be read or written.
CR4.UINTR
User Interrupts Enable Bit (bit 25 of CR4) - Enables user interrupts when set, including user-interrupt
delivery, user-interrupt notification identification, and the user-interrupt instructions.
CR8.TPL
Task Priority Level (bit 3:0 of CR8) - This sets the threshold value corresponding to the highest-
priority interrupt to be blocked. A value of 0 means all interrupts are enabled. This field is available in 64-
bit mode. A value of 15 means all interrupts will be disabled.
2.5.1
CPUID Qualification of Control Register Flags
Not all flags in control register CR4 are implemented on all processors. With the exception of the PCE flag, they can
be qualified with the CPUID instruction to determine if they are implemented on the processor before they are
used.
The CR8 register is available on processors that support Intel 64 architecture.
2.6
EXTENDED CONTROL REGISTERS (INCLUDING XCR0)
If CPUID.01H:ECX.XSAVE[bit 26] is 1, the processor supports one or more extended control registers (XCRs).
Currently, the only such register defined is XCR0. This register specifies the set of processor state components for
which the operating system provides context management, e.g., x87 FPU state, SSE state, AVX state. The OS
programs XCR0 to reflect the features for which it provides context management.
2-20
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
63
18
17
10
9
8
7
6
5
4
3
2
1
0
1
Reserved for XCR0 bit vector expansion
Reserved / Future processor extended states
TILEDATA state
TILECONFIG state
PKRU state
Hi16_ZMM state
ZMM_Hi256 state
Opmask state
BNDCSR state
BNDREG state
AVX state
SSE state
X87 FPU/MMX state (must be 1)
Reserved (must be 0)
Figure 2-8. XCR0
Software can access XCR0 only if CR4.OSXSAVE[bit 18] = 1. (This bit is also readable as
CPUID.01H:ECX.OSXSAVE[bit 27].) Software can use CPUID leaf function 0DH to enumerate the bits in XCR0 that
the processor supports (see CPUID instruction in Intel® 64 and IA-32 Architectures Software Developer’s Manual,
Volume 2A). Each supported state component is represented by a bit in XCR0. System software enables state
components by loading an appropriate bit mask value into XCR0 using the XSETBV instruction.
As each bit in XCR0 (except bit 63) corresponds to a processor state component, XCR0 thus provides support for
up to 63 sets of processor state components. Bit 63 of XCR0 is reserved for future expansion and will not represent
a processor state component.
Currently, XCR0 defines support for the following state components:
XCR0.X87 (bit 0): This bit 0 must be 1. An attempt to write 0 to this bit causes a #GP exception.
XCR0.SSE (bit 1): If 1, the XSAVE feature set can be used to manage MXCSR and the XMM registers (XMM0-
XMM15 in 64-bit mode; otherwise XMM0-XMM7).
XCR0.AVX (bit 2): If 1, Intel AVX instructions can be executed and the XSAVE feature set can be used to
manage the upper halves of the YMM registers (YMM0-YMM15 in 64-bit mode; otherwise YMM0-YMM7).
XCR0.BNDREG (bit 3): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to
manage the bounds registers BND0-BND3.
XCR0.BNDCSR (bit 4): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to
manage the BNDCFGU and BNDSTATUS registers.
XCR0.opmask (bit 5): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be used
to manage the opmask registers k0-k7.
XCR0.ZMM_Hi256 (bit 6): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be
used to manage the upper halves of the lower ZMM registers (ZMM0-ZMM15 in 64-bit mode; otherwise ZMM0-
ZMM7).
XCR0.Hi16_ZMM (bit 7): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be
used to manage the upper ZMM registers (ZMM16-ZMM31, only in 64-bit mode).
XCR0.PKRU (bit 9): If 1, the XSAVE feature set can be used to manage the PKRU register (see Section 2.7).
XCR0.TILECFG (bit 17): If 1, and if XCR0.TILEDATA is also 1, Intel AMX instructions can be executed and the
XSAVE feature set can be used to manage TILECFG.
Vol. 3A
2-21
SYSTEM ARCHITECTURE OVERVIEW
XCR0.TILEDATA (bit 18): If 1, and if XCR0.TILECFG is also 1, Intel AMX instructions can be executed and the
XSAVE feature set can be used to manage TILEDATA.
An attempt to use XSETBV to write to XCR0 results in general-protection exceptions (#GP) if it would do any of the
following:
Set a bit reserved in XCR0 for a given processor (as determined by the contents of EAX and EDX after executing
CPUID with EAX=0DH, ECX= 0H).
Clear XCR0.x87.
Clear XCR0.SSE and set XCR0.AVX.
Clear XCR0.AVX and set any of XCR0.opmask, XCR0.ZMM_Hi256, or XCR0.Hi16_ZMM.
Set either XCR0.BNDREG or XCR0.BNDCSR while not setting the other.
Set any of XCR0.opmask, XCR0.ZMM_Hi256, and XCR0.Hi16_ZMM while not setting all of them.
Set either XCR0.TILECFG or XCR0.TILEDATA while not setting the other.
After reset, all bits (except bit 0) in XCR0 are cleared to zero; XCR0[0] is set to 1.
2.7
PROTECTION-KEY RIGHTS REGISTERS (PKRU AND IA32_PKRS)
Processors may support either or both of two protection-key rights registers: PKRU for user-mode pages and the
IA32_PKRS MSR (MSR index 6E1H) for supervisor-mode pages. 4-level paging and 5-level paging associate a 4-bit
protection key with each page. The protection-key rights registers determine accessibility based on a page’s
protection key.
If CPUID.(EAX=07H,ECX=0H):ECX.PKU [bit 3] = 1, the processor supports the protection-key feature for user-
mode pages. When CR4.PKE = 1, software can use the protection-key rights register for user pages (PKRU)
to specify the access rights for user-mode pages for each protection key.
If CPUID.(EAX=07H,ECX=0H):ECX.PKS [bit 31] = 1, the processor supports the protection-key feature for super-
visor-mode pages. When CR4.PKS = 1, software can use the protection-key rights register for supervisor
pages (the IA32_PKRS MSR) to specify the access rights for supervisor-mode pages for each protection key.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11
10 9
8
7
6
5
4
3
2
1
0
Bit Position
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
15
15
14
14
13
13
12
12
11
11
1010
9
9
8
8
7
7
6
6
5
5
4
4
3
3
2
2
1
1
0
0
Figure 2-9. Format of Protection-Key Rights Registers
The format of each protection-key rights register is given in Figure 2-9. Each contains 16 pairs of disable controls
to prevent data accesses to linear addresses (user-mode or supervisor-mode, depending on the register) based on
their protection keys. Each protection key i (0 i 15) is associated with two bits in each protection-key rights
register:
Bit 2i, shown as “ADi” (access disable): if set, the processor prevents any data accesses to linear addresses
(user-mode or supervisor-mode, depending on the register) with protection key i.
Bit 2i+1, shown as “WDi” (write disable): if set, the processor prevents write accesses to linear addresses
(user-mode or supervisor-mode, depending on the register) with protection key i.
(Bits 63:32 of the IA32_PKRS MSR are reserved and must be zero.)
See Section 4.6.2, “Protection Keys,” for details of how the processor uses the protection-key rights registers to
control accesses to linear addresses.
Software can read and write PKRU using the RDPKRU and WRPKRU instructions. The IA32_PKRS MSR can be read
and written with the RDMSR and WRMSR instructions. Writes to the IA32_PKRS MSR using WRMSR are not serial-
izing.
2-22
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.8
SYSTEM INSTRUCTION SUMMARY
System instructions handle system-level functions such as loading system registers, managing the cache,
managing interrupts, or setting up the debug registers. Many of these instructions can be executed only by oper-
ating-system or executive procedures (that is, procedures running at privilege level 0). Others can be executed at
any privilege level and are thus available to application programs.
Table 2-3 lists the system instructions and indicates whether they are available and useful for application
programs. These instructions are described in the Intel® 64 and IA-32 Architectures Software Developer’s Manual,
Volumes 2A, 2B, 2C, & 2D.
Table 2-3. Summary of System Instructions
Useful to
Protected from
Instruction
Description
Application?
Application?
LLDT
Load LDT Register
No
Yes
SLDT
Store LDT Register
No
If CR4.UMIP = 1
LGDT
Load GDT Register
No
Yes
SGDT
Store GDT Register
No
If CR4.UMIP = 1
LTR
Load Task Register
No
Yes
STR
Store Task Register
No
If CR4.UMIP = 1
LIDT
Load IDT Register
No
Yes
SIDT
Store IDT Register
No
If CR4.UMIP = 1
MOV CRn
Load and store control registers
No
Yes
SMSW
Store MSW
Yes
If CR4.UMIP = 1
LMSW
Load MSW
No
Yes
CLTS
Clear TS flag in CR0
No
Yes
ARPL
Adjust RPL
Yes1, 5
No
LAR
Load Access Rights
Yes
No
LSL
Load Segment Limit
Yes
No
VERR
Verify for Reading
Yes
No
VERW
Verify for Writing
Yes
No
MOV DRn
Load and store debug registers
No
Yes
INVD
Invalidate cache, no writeback
No
Yes
WBINVD
Invalidate cache, with writeback
No
Yes
INVLPG
Invalidate TLB entry
No
Yes
HLT
Halt Processor
No
Yes
LOCK (Prefix)
Bus Lock
Yes
No
RSM
Return from system management mode
No
Yes
RDMSR3
Read Model-Specific Registers
No
Yes
WRMSR3
Write Model-Specific Registers
No
Yes
RDPMC4
Read Performance-Monitoring Counter
Yes
Yes2
RDTSC3
Read Time-Stamp Counter
Yes
Yes2
RDTSCP7
Read Serialized Time-Stamp Counter
Yes
Yes2
XGETBV
Return the state of XCR0
Yes
No
XSETBV
Enable one or more processor extended states
No6
Yes
Vol. 3A
2-23

 

 

 

 

 

 

 

 

Content      ..     1      2      3      4      ..