x86-64.net

System

PKU

Protection keys for user pages: each page carries one of 16 keys, and RDPKRU and WRPKRU read and write the per-thread register that disables access or writes for each key.

CPUID
PKU + OSPKU
CPUID.(EAX=07H,ECX=0):ECX[3]
CPUID.(EAX=07H,ECX=0):ECX[4]
Instructions
2 mnemonics
Processors
Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6

Protection keys give each user page one of 16 keys, in four bits of its page-table entry, and let a thread change what each key allows without a system call. The 32-bit PKRU register holds two bits per key, access disable and write disable; RDPKRU reads it and WRPKRU writes it. Because PKRU is per thread, threads of one process can have different rights to the same memory. The keys apply only to data accesses in 64-bit mode, not to instruction fetches.

The operating system enables them with CR4.PKE, which CPUID reports as OSPKE, and saves PKRU as XSAVE component 9. On Linux a program gets a key with pkey_alloc() and assigns it to pages with pkey_mprotect().

Instructions

Mnemonics with at least one form in PKU. Each page lists all forms of the mnemonic, including those of other extensions.
MnemonicSummaryForms
RDPKRUReads PKRU, the access- and write-disable bits of the 16 protection keys, into EAX; ECX must be zero.1
WRPKRUWrites PKRU from EAX, changing which of the 16 protection keys allow access and writes, without a system call; ECX and EDX must be zero.1

CPUID and processors

XED splits PKU into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.

XED ISA sets of PKU. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
PKU

PKU + OSPKU
CPUID.(EAX=07H,ECX=0):ECX[3] PKU
CPUID.(EAX=07H,ECX=0):ECX[4] OSPKU

Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model.
  2. The CPU data of x86-64.net: Zen 3 to Zen 6, from GCC’s -march feature sets and AMD’s Processor Programming References, which the page of each processor cites.
  3. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026)
  4. Linux kernel documentation: Memory Protection Keys

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.