x86 system instructions

These are the instructions that XED files in its system categories: what an operating system, a hypervisor or firmware uses to set up and run the processor. Most of them run only at privilege level 0.

Descriptor tables and segments. LGDT, LIDT, LLDT and LTR load the tables of segment and interrupt descriptors and the task register; SGDT, SIDT, SLDT, STR and SMSW store them, and CR4.UMIP keeps them from user code. LAR, LSL, VERR and VERW inspect a descriptor without loading it.
Control and model-specific registers. RDMSR and WRMSR read and write MSRs; CLTS and LMSW change bits of CR0. Moves to and from control and debug registers are forms of MOV, which XED counts as data movement.
Caches and TLBs. WBINVD writes back and invalidates the caches, INVD invalidates them without writing back, and INVLPG drops the TLB entries of a page.
Counters. RDTSC reads the time-stamp counter and RDPMC a performance counter; CR4.TSD and CR4.PCE decide whether user code may.
The rest. HLT stops the processor until an interrupt, RSM leaves system-management mode, and SWAPGS gives a 64-bit kernel its own GS base on entry.

The fast system calls have pages of their own: SYSCALL/SYSRET and SYSENTER/SYSEXIT, and FRED replaces both on processors that have it.

Instructions

Mnemonics with at least one form in System. Each page lists all forms of the mnemonic, including those of other extensions.

Mnemonic	Summary	Forms
ARPL	Raises the requested privilege level of a segment selector to that of another, setting ZF if it changed; not in 64-bit mode, where 63 is MOVSXD.	2
CLTS	Clears the task-switched flag (TS) in CR0, which trapped the first x87 or SSE use after a task switch; ring 0 only.	1
HLT	Stops the processor until an interrupt, NMI or reset arrives, as an idle loop does; ring 0 only.	1
INVD	Invalidates the caches without writing modified lines back, so their data is lost; ring 0 only.	1
INVLPG	Invalidates the TLB entries of the page that holds a memory address, after the kernel changed its mapping; ring 0 only.	1
LAR	Loads the access rights of the segment descriptor that a selector names and sets ZF, if the descriptor is visible at this privilege level.	2
LGDT	Loads the base and limit of the global descriptor table into GDTR from memory; ring 0 only.	2
LIDT	Loads the base and limit of the interrupt descriptor table into IDTR from memory; ring 0 only.	2
LLDT	Loads the local descriptor table register from a selector of an LDT descriptor in the GDT; ring 0 only.	2
LMSW	Loads the low four bits of CR0 (PE, MP, EM and TS) from a word, the 80286's way into protected mode; ring 0 only.	2
LSL	Loads the limit of the segment descriptor that a selector names and sets ZF, if the descriptor is visible at this privilege level.	2
LTR	Loads the task register from a selector of a TSS descriptor in the GDT and marks that TSS busy; ring 0 only.	2
RDMSR	Reads a model-specific register into EDX:EAX, or with MSR_IMM into any 64-bit register from an MSR number given as an immediate; allowed only in ring 0.	1
RDPMC	Reads the performance counter that ECX selects into EDX:EAX; user code may run it only where the kernel set CR4.PCE.	1
RDTSC	Reads the time-stamp counter into EDX:EAX, unordered with nearby instructions; user code may run it unless CR4.TSD is set.	1
RSM	Returns from system-management mode to the interrupted program and restores its state; valid only in SMM.	1
SGDT	Stores the base and limit of the global descriptor table to memory; user code may run it unless CR4.UMIP is set.	2
SIDT	Stores the base and limit of the interrupt descriptor table to memory; user code may run it unless CR4.UMIP is set.	2
SLDT	Stores the selector in the local descriptor table register to a register or memory; CR4.UMIP keeps it from user code.	2
SMSW	Stores the machine status word, the low bits of CR0, to a register or memory; CR4.UMIP keeps it from user code.	2
STR	Stores the selector in the task register to a register or memory; CR4.UMIP keeps it from user code.	2
SWAPGS	Exchanges the GS base with IA32_KERNEL_GS_BASE, so that a kernel entered by SYSCALL finds its per-CPU data; 64-bit mode, ring 0.	1
VERR	Sets ZF if the segment that a selector names can be read at this privilege level, without loading it.	2
VERW	Sets ZF if the segment that a selector names can be written at this privilege level, without loading it.	2
WBINVD	Writes every modified line of the caches back to memory and invalidates the caches; ring 0 only.	1
WRMSR	Writes EDX:EAX to the model-specific register that ECX selects; ring 0 only and, unlike WRMSRNS, serializing.	1

CPUID and processors

XED splits System into 8 ISA sets. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.

XED ISA sets of System. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I286PROTECTED` System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I286REAL` System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I486` System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I486REAL` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`I86` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`LONGMODE` General-purpose System SYSCALL/SYSRET	LM `CPUID.80000001H:EDX[29]` LM	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`PENTIUMREAL` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6
`RDPMC` System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

Instructions

CPUID and processors

Sources