RDPKRU

RDPKRU copies PKRU into EAX and clears EDX; as with other 32-bit writes, bits 63:32 of RAX and RDX become 0. ECX must be 0, or it raises #GP, and it raises #UD unless the kernel has set CR4.PKE. The register and how protection keys guard pages are described under WRPKRU; this page is about reading it.

Read before writing#

WRPKRU replaces the rights of all 16 keys at once, so code that changes one key reads the register first, changes that key’s two bits and writes the result back. With -mpku, GCC 14 and Clang 23 at -O2 compile _rdpkru_u32() to xor ecx, ecx and RDPKRU, and a function that closes key k to writes to RDPKRU, two shifts of the key’s bit pair by 2k, a NOT, an AND and an OR, then zeroed ECX and EDX and WRPKRU. A guarded access saves the value RDPKRU returned and writes it back afterwards, which restores whatever rights the caller had rather than a fixed set.

Checking for keys#

CPUID leaf 7, ECX bit 3 (PKU) says the processor has protection keys; bit 4 (OSPKE) says the kernel has set CR4.PKE, and only then do RDPKRU and WRPKRU run. AMD’s manual names the same bits. PKRU is also state component 9 of XSAVE, through which a kernel switches it between threads when XCR0 bit 9 is set (see XGETBV); that bit governs only XSAVE, not whether these instructions run (Intel’s manual, volume 1).

On Zen 5#

The probe’s cases started from PKRU 55555554H, the value Linux 7.3 gives a new process, and from AAAAAAA8H, which closes keys 1 to 15 to writes alone: RDPKRU returned each in EAX with random bits 63:32 of RAX and RDX cleared and the flags unchanged, accepted ECX = 0 under random bits 63:32, and raised #GP for ECX = 1. AMD’s manual adds that the operand size does not matter. With an F3 prefix these bytes are CLUI on Intel’s processors with user interrupts. AMD’s Zen 5 guide lists RDPKRU as microcoded.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if ecx != 0:                         # bits 63:32 of RCX do not count
    fault(GP, 0)
eax = pkru                           # RAX and RDX: bits 63:32 cleared
edx = 0
# Intel's manual allows no 66, F2 or F3 prefix here: with F3 the
# bytes are CLUI on its processors with user interrupts

Operands

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More PKU instructions

• WRPKRU