RDPMC

RDPMC reads a performance-monitoring counter, chosen by ECX, into EDX:EAX. The counters count events that the operating system selects in their control MSRs, such as core cycles, retired instructions, cache misses or mispredicted branches; RDPMC only reads them, and reads them without a system call, which makes it the cheap way to measure a piece of code from inside a program. Like RDTSC it returns the value split, and GCC 14 and Clang 23 at -O2 compile the __rdpmc() intrinsic, which needs no option, to RDPMC followed by a shift of RDX and an OR.

Who may read#

At CPL 0 RDPMC always works; at CPL 3 only while CR4.PCE is set, which the operating system controls. Otherwise it raises #GP(0), as it does for a counter number the processor lacks. Zen 5 recorded #GP at CPL 3 for counters 0 and 1 and for 40000000H, the first fixed counter in Intel’s numbering, and left RAX and RDX alone. At CPL 0 RDMSR reads the same counters by their MSR numbers.

Numbering the counters#

The vendors number them differently:

• Intel, with architectural performance monitoring: ECX[31:16] gives the kind, 0 for the general-purpose counters, 4000H for the fixed ones (such as core cycles) and 2000H for the performance metrics; ECX[15:0] the counter within it. CPUID leaf 0AH says how many there are and how wide.
• AMD: 0 to 5 for the core’s counters, then 6 to 27 for the northbridge and L3 cache counters, each range behind its own CPUID bit.

Intel’s manual zeroes the bits above a counter’s width.

Not serializing#

RDPMC waits for nothing: earlier instructions may not have finished counting their events, and later ones may already have started. Both manuals say so, and Intel’s suggests a serializing instruction such as CPUID before or after it when an exact count matters; on processors that have it, SERIALIZE does that without clobbering registers. AMD’s Zen 5 guide lists RDPMC as microcoded.

In the optimization guide

What the optimization guide says about RDPMC, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Measuring

• Performance counters: RDPMC numbers the counters in ECX differently on Intel’s and AMD’s processors.
• Performance counters: RDPMC works in user code only while CR4.PCE is set, which Linux by default allows only to a program with a perf event mapped.
• Performance counters: RDPMC is not ordered with its neighbours, and counts of very short sequences are unreliable.
• Top-down analysis: Intel’s cores from Ice Lake on keep the top-down shares in PERF_METRICS, which RDPMC reads with ECX 2000_0000H.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

n = ecx                          # bits 63:32 of RCX do not count
if CPL > 0 and not cr4 >> 8 & 1:
    fault(GP, 0)                 # CR4.PCE, which the OS sets or
                                 # clears, opens them to every CPL
if not pmc_exists(n):
    fault(GP, 0)
v = pmc(n)                       # the counter's bits; those above its
eax = v                          # width are 0. Bits 63:32 of RAX and
edx = v >> 32                    # RDX cleared
# Intel: ECX[31:16] the kind (0 general-purpose, 4000H fixed, 2000H
# performance metrics), ECX[15:0] the counter; AMD: ECX 0 to 5 the
# core's counters, 6 to 27 those of the northbridge and L3 cache

Operands

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDMSR
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR