How Many Registers Are In A Cpu

ENOSUCHBLOG

Programming, philosophy, pedaling.

How many registers does an x86-64 CPU have?

Nov 30, 2020 Tags: programming, x86

x86 is back in the general programmer soapbox, in part thanks to Apple'southward M1 and Rosetta 2. Every bit such, I figured I'd do yet another x86-64 post.

Just like the concluding one, I'm going to embrace a facet of the x86-64 ISA that sets information technology apart as unusually complex amongst modernistic ISAs: the number and diversity of registers available.

Like instruction counting, annals counting on x86-64 is subject to debates over methodology. In particular, for this blog post, I'g going to lay the following basis rules:

I will count sub-registers (e.chiliad., EAX for RAX) as distinct registers. My justification: they have different instruction encodings, and both Intel and AMD optimize/pessimize particular sub-register use patterns in their microcode.
I will count registers that are present on x86-64 CPUs, merely that tin can't be used in long mode.
I won't count registers that are but nowadays on older x86 CPUs, like the 80386 and 80486 examination registers.
I won't count microarchitectural implementation details, like shadow registers.
I will count registers that aren't directly addressable, similar MSRs that can only exist accessed through RDMSR. However, I won't (or will try non to) double-count registers that take multiple access mechanisms (like RDMSR and RDTSC).
I won't count model-specific registers that fall into these categories:
- MSRs that are only present on niche x86 vendors (Cyrix, Via)
- MSRs that aren't widely available on contempo-ish x86-64 CPUs
  - Errata: I accidentally included AVX-512 in some of the original counts below, not realizing that it hadn't been released on any AMD CPUs. The post has been updated.
- MSRs that are completely undocumented (both officially and unofficially)

In add-on to the rules higher up, I'grand going to use the post-obit considerations and methodology for grouping registers together:

Many sources, both official and unofficial, use "model-specific register" equally an umbrella term for any non-core or non-feature-set register supplied past an x86-64 CPU. Whenever possible, I'll try to avoid this in favor of more specific categories.
Both Intel and AMD provide synonyms for registers (e.g. CR8 equally the "task priority register," or TPR). Whenever possible, I'll try to use the more than generic/category befitting name (like CR8 in the case to a higher place).
In general, the individual cores of a multicore processor accept independent register states. Whenever this isn't the instance, I'll brand an attempt to document it.

General-purpose registers

The full general-purpose registers (or GPRs) are the primary registers in the x86-64 register model. Equally their name implies, they are the only registers that are full general purpose: each has a set of conventional uses¹, but programmers are generally free to ignore those conventions and employ them as they please².

Because x86-64 evolved from a 32-bit ISA which in turn evolved from a sixteen-bit ISA, each GPR has a set of subregisters that hold the lower 8, xvi and 32 bits of the total 64-bit register.

As a table:

64-scrap	32-bit	16-scrap	8-fleck (depression)
RAX	EAX	AX	AL
RBX	EBX	BX	BL
RCX	ECX	CX	CL
RDX	EDX	DX	DL
RSI	ESI	SI	SIL
RDI	EDI	DI	DIL
RBP	EBP	BP	BPL
RSP	ESP	SP	SPL
R8	R8D	R8W	R8B
R9	R9D	R9W	R9B
R10	R10D	R10W	R10B
R11	R11D	R11W	R11B
R12	R12D	R12W	R12B
R13	R13D	R13W	R13B
R14	R14D	R14W	R14B
R15	R15D	R15W	R15B

Some of the xvi-bit subregisters are also special: the original 8086 allowed the high byte of AX, BX, CX, and DX to be accessed indepenently, then x86-64 preserves this for some encodings:

16-bit	viii-bit (high)
AX	AH
BX	BH
CX	CH
DX	DH

So that'due south sixteen total-width GPRs, fanning out to another 52 subregisters.

Registers in this grouping: 68.

Running full: 68.

Special registers

This is sort of an artificial category: like every ISA, x86-64 has a few "special" registers that proceed things moving along. In particular:

The instruction pointer, or RIP.

x86-64 has 32- and sixteen-bit variants of RIP (EIP and IP), but I'm non going to count them every bit separate registers: they have identical encodings and can't be used in the aforementioned CPU mode³.
The status register, or RFLAGS.

Merely similar RIP, RFLAGS has 32- and 16-scrap counterparts (EFLAGS and FLAGS). Unlike RIP, these counterparts can be partially mixed: PUSHF and PUSHFQ are both valid in long fashion, and LAHF/SAHF can operate on the $.25 of FLAGS on some x86-64 CPUs outside of compatiblility style⁴. So I'm going to become ahead and count them.

Registers in this group: four.

Running total: 72.

Segment registers

x86-64 has a total of half dozen segment registers: CS, SS, DS, ES, FS, and GS. The operation varies with the CPU'south way:

In all modes except for long fashion, each segment register holds a selector, which indexes into either the GDT or LDT. That yields a segment descriptor which, among other things, supplies the base of operations address and extent of the segment.
In long fashion all but FS and GS are treated equally having a base address of zilch and a 64-bit extent, effectively producing a flat address infinite. FS and GS are retained as special cases, but no longer use the segment descriptor tables: instead, they admission base addresses that are stored in the FSBASE and GSBASE model-specific registers⁵. More than on those after.

Registers in this group: 6.

Running total: 78.

SIMD and FP registers

The x86 family has gone through several generations of SIMD and floating-betoken instruction groups, each of which has introduced, extended, or re-contextualized various registers:

x87
MMX
SSE (SSE2, SSE3, SSE4, SSE4, …)
AVX (AVX2, AVX512)

Let's do them in rough order.

x87

Originally a discrete coprocessor with its own instruction set up and annals file, the x87 instructions have been regularly baked into x86 cores themselves since the 80486.

Because of its coprocessor history, x87 defines both normal registers⁶ (alike to GPRs) and a diversity of special registers needed to control the FPU country:

ST0 through ST7: 8 80-bit floating-point registers
FPSW, FPCW, FPTW ^vii: Control, status, and tag-word registers
"Information operand pointer": I don't know what this one does, but the Intel SDM specifies it⁸
Instruction pointer: the x87 state machine apparently holds its own copy of the electric current x87 teaching
Last didactics opcode: this is apparently distinct from the x87 opcode, and has its own register

Registers in this group: 14.

Running total: 92.

MMX

MMX was Intel'south start endeavor at consumer SIMD in their x86 chips, released back in 1997.

For design reasons that are a complete mystery to me, the MMX registers are actually sub-registers of the x87 STn registers: each 64-bit MMn occupies the mantissa component of its respective STn. Consequently, x86 (and x86-64) CPUs cannot execute MMX and x87 instructions at the same fourth dimension.

Edit: This section incorrectly included MXCSR, which was really introduced with SSE. Thanks to /u/Skorezore for pointing out the error.

Registers in this group: 8.

Running total: 100.

SSE and AVX

For simplicity's sake, I'thou going to wrap SSE and AVX into a single section: they use the aforementioned sub-register pattern every bit the GPRs and x87/MMX practise, so they fit well into a single table:

AVX-512 (512-flake)	AVX-2 (256-chip)	SSE (128-bit)
ZMM0	YMM0	XMM0
ZMM1	YMM1	XMM1
ZMM2	YMM2	XMM2
ZMM3	YMM3	XMM3
ZMM4	YMM4	XMM4
ZMM5	YMM5	XMM5
ZMM6	YMM6	XMM6
ZMM7	YMM7	XMM7
ZMM8	YMM8	XMM8
ZMM9	YMM9	XMM9
ZMM10	YMM10	XMM10
ZMM11	YMM11	XMM11
ZMM12	YMM12	XMM12
ZMM13	YMM13	XMM13
ZMM14	YMM14	XMM14
ZMM15	YMM15	XMM15
ZMM16	YMM16	XMM16
ZMM17	YMM17	XMM17
ZMM18	YMM18	XMM18
ZMM19	YMM19	XMM19
ZMM20	YMM20	XMM20
ZMM21	YMM21	XMM21
ZMM22	YMM22	XMM22
ZMM23	YMM23	XMM23
ZMM24	YMM24	XMM24
ZMM25	YMM25	XMM25
ZMM26	YMM26	XMM26
ZMM27	YMM27	XMM27
ZMM28	YMM28	XMM28
ZMM29	YMM29	XMM29
ZMM30	YMM30	XMM30
ZMM31	YMM31	XMM31

In other words: the lower half of each ZMMn is YMMn, and the lower half of each YMMn is XMMn. At that place'south no straight way register access for simply the upper half of YMMn, nor does ZMMn accept directly 256- or 128-bit access for the thunks of its upper half.

SSE too defines a new condition register, MXCSR, that contains flags roughly parallel to the arithmetics flags in RFLAGS (along with floating-betoken flags in the x87 condition give-and-take). SSE also introduces a load/store instruction pair for manipulating it (LDMXCSR and STMXCSR).

AVX-512 besides introduces 8 opmask registers, k0 through k7. k0 is a special case that behaves much like the "naught" register on some RISC ISAs: it can't exist stored to, and loads from it always produce a bitmask of all ones.

Errata: The tabular array above includes AVX-512, which isn't available on any AMD CPUs as of 2020. I've updated the counts beneath to only include SSE and AVX2-introduced registers.

Registers in this group: 33.

Running total: 133.

Bounds registers

Intel added these with MPX, which was intended to offering hardware-accelerated bounds checking. Nobody uses it, since it doesn't work very well. Just x86 is eternal and dull to fix mistakes, so we'll probably have these registers taking upward space for at least a while longer:

BND0 — BND3: Individual 128-bit registers, each containing a pair of addresses for a spring.
BNDCFG: Leap configuration, kernel mode.
BNDCFU: Leap configuration, user mode.
BNDSTATUS: Bound condition, afterward a #BR is raised.

Registers in this group: 7.

Running full: 140.

Debug registers

These are what they sound like: registers that assist and accelerate software debuggers, similar GDB.

There are 6 debug registers of two types:

DR0 through DR3 contain linear addresses, each of which is associated with a breakpoint condition.
DR6 and DR7 are the debug status and control registers. DR6'due south lower bits indicate which debug weather condition were encountered (upon entering the debug exception handler), while DR7 controls which breakpoint addresses are enabled and their breakpoint conditions (due east.one thousand., when a item address is written to).

What nearly DR4 and DR5? For reasons that are unclear to me, they don't (and accept never) existed⁹. They do take encodings but are treated as DR6 and DR7, respective, or produce an #UD exception when CR4.DE[chip 3] = 1.

Registers in this group: half-dozen.

Running total: 146.

Command registers

x86-64 defines a set of control registers that can be used to manage and audit the land of the CPU.

In that location are sixteen "main" control registers, all of which can be accessed with a MOV variant:

Proper name	Purpose
CR0	Bones CPU performance flags
CR1	Reserved
CR2	Page-mistake linear address
CR3	Virtual addressing country
CR4	Protected manner performance flags
CR5	Reserved
CR6	Reserved
CR7	Reserved
CR8	Chore priority register (TPR)
CR9	Reserved
CR10	Reserved
CR11	Reserved
CR12	Reserved
CR13	Reserved
CR14	Reserved
CR15	Reserved

All reserved command registers upshot in an #UD when accessed, which makes me inclined to not count them in this post.

In addition to the "main" CRn control registers in that location are also the "extended" control registers, introduced with the XSAVE feature gear up. As of writing, XCR0 is the only specified extended control annals.

The extended control registers use XGETBV and XSETBV instead of a MOV variant.

Registers in this grouping: 6.

Running total: 152.

"Organisation table pointer registers"

That'southward what the Intel SDM calls these⁸: these registers hold sizes and pointers to various protected mode tables.

As best I tin can tell, there are four of them:

GDTR: Holds the size and base accost of the GDT
LDTR: Holds the size and base address of the LDT
IDTR: Holds the size and base address of the IDT
TR: Holds the TSS selector and base address for the TSS

The GDTR, LDTR, and IDTR each seem to be 80 bits in 64-bit modes: 16 lower bits for the size of the register's table, so the upper 64 bits for the tabular array'southward starting accost.

TR is likewise lxxx bits: 16 bits for the selector (which behaves identically to a segment selector), and so another 64 for the base of operations address of the TSS^x.

Registers in this group: iv.

Running count: 156.

Memory-type-ranger registers

These are an interesting case: unlike all of the other registers I've covered and so far, these are non unique to a particular CPU in a multicore chip; instead, they're shared across all cores¹¹.

The number of MTTRs seems to vary by CPU model, and have been largely superseded by entries in the page attribute table, which is programmed with an MSR¹².

Registers in this grouping:

Running count: >156.

Model specific registers

Model-specific registers are where things go fun.

Like extended control registers, they're accessed indirectly (past identifier) through a pair of instructions: RDMSR and WRMSR. MSRs themselves are 64-bits but originated during the 32-bit era, and so RDMSR and WRMSR read from and write to 2 32-bit registers: EDX and EAX.

By way of example: here's the setup and RDMSR invocation for accessing the IA32_MTRRCAP MSR, which includes (among other things) that actual number of MTRRs available on the organisation:

                                                                                          one two 3                    
                                                                              MOV                      ECX                      ,                      0xFE                      ; 0xFE = IA32_MTRRCAP                      RDMSR                      ; The $.25 of IA32_MTRRCAP are now in EDX:EAX

RDMSR and WRMSR are privileged instructions, so normal ring-iii code can't admission MSRs direct^thirteen. The i (?) exception that I know of is the timestamp counter (TSC), which is stored in the IA32_TSC MSR just can exist read from non-privileged contexts with RDTSC and RDTSCP.

Two other interesting (simply still privileged¹⁴) cases are FSBASE and GSBASE, which are stored as IA32_FS_BASE and IA32_GS_BASE, respectively. As mentioned in the segment register section, these shop the FS and GS segment bases on x86-64 CPUs. This makes them targets of relatively frequent utilize (past MSR standards), and then they take their own dedicated R/W opcodes:

RDFSBASE and RDGSBASE for reading
WRFSBASE and WRGSBASE for writing

But back to the meat of things: how many MSRs are there?

Using the standards laid out at the kickoff of this post, nosotros're interested in counting what Intel calls "architectural" MSRs. From the SDM¹⁵:

Many MSRs have carried over from ane generation of IA-32 processors to the adjacent and to Intel 64 processors. A subset of MSRs and associated bit fields, which do not change on time to come processor generations, are now considered architectural MSRs. For historical reasons (beginning with the Pentium 4 processor), these "architectural MSRs" were given the prefix "IA32_".

Co-ordinate to the subsequent tabular array^xvi, the highest architectural MSR is 6097/17D1H, or IA32_HW_FEEDBACK_CONFIG. And so, the naïve answer is over 6000.

However, there are meaning gaps in the documented MSR ranges: Intel's documentation jumps directly from 3506/DB2H (IA32_THREAD_STALL) to 6096/17D0H (IA32_HW_FEEDBACK_PTR). On top of the empty ranges, there are also ranges that are explicitly marked as reserved, either generally or explicitly for later expansion of a particular MSR family.

To count the actual number of MSRs, I did a fleck of pipeline ugliness:

Extract just table 2-ii from Volume 4 of the SDM (link):

                                                                                                                  1                        
                                                                                              $                          pdfjam 335592-sdm-vol-4.pdf 19-67                          -o                          2-2.pdf

Apply pdftotext to convert it to apparently text and manually trim the next table from the terminal page:

                                                                                                                  ane two                        
                                                                                              $                          pdftotext 2-two.pdf tabular array.txt                          # edit table.txt by hand

Dissever the manifestly text table into a sequence of words, filter by IA32_, remove cruft, and do a standard sort-unique-count:

                                                                                                                  1 2 three four 5 6                        
                                                                                              $                                                    tr                          -s                          '[:space:]'                          '\n'                          < tabular array.txt                          \                          |                          grep                          'IA32_'                          \                          |                          tr                          -d                          '.'                          \                          |                          sed                          'southward/\[.*$//'                          \                          |                          sort                          |                          uniq                          |                          wc                          -fifty                          404

(Output preserved for posterity here).

That pipeline left a bit of cruft towards the cease thank you to quoted variants, so I count the bodily number at 400 architectural MSRs. That's a lot more reasonable than 6096!

Registers in this grouping: 400

Running count: >556.

Other bits and wrapup

The footnotes at the bottom of this mail cover most of my notes, but I also wanted to dump another resource that I found useful while discovering registers:

sandpile.org has a nice visualization of many of the architectural MSRs, including field breakdowns.
Vol. 3A § 8.vii.1 ("Country of the Logical Processors") of the Intel SDM has a useful list of nearly all of the registers that are either unique to or shared between x86-64 cores.
The OSDev Wiki has drove of helpful pages on various x86-64 registers, including a great page on the behavior of the segment base MSRs.

All told, I retrieve that there are roughly 557 registers on the average (relatively contempo) x86-64 CPU core. With that being said, I accept some peripheral cases that I'thousand not sure virtually:

Modern Intel CPUs utilise integrated APICs as part of their SMT implementation. These APICs have their own annals banks which can be memory-mapped for reading and potential modification past an x86 core. I didn't count them because (i) they're memory mapped, and thus behave more than like mapped registers from an arbitrary piece of hardware than CPU registers, and (2) I'one thousand not sure whether AMD uses the same machinery/implementation.
The Intel SDM implies that Last Branch Records are stored in discrete, not-MSR registers. AMD'southward developer manual, on the other paw, specifies a range of MSRs. Equally such, I didn't effort to count these separately.
Both Intel and AMD take their ain (and incompatible) virtualization extensions, too as their ain enclave/hardened execution extensions. My intuition is that each introduces some additional registers (or maybe only MSRs), but their vendor-specificity made me inclined to not look too deeply.

Information on these (and whatsoever other) registers would be deeply appreciated.

Discussions: Reddit

Source: https://blog.yossarian.net/2020/11/30/How-many-registers-does-an-x86-64-cpu-have

Posted by: poorealiampat.blogspot.com