RDMSR

RDMSR reads the model-specific register whose number is in ECX into EDX:EAX, the high half in EDX. In 64-bit mode bits 63:32 of RCX are ignored and those of RAX and RDX cleared, so a 64-bit value takes a shift and an OR to assemble, as with RDTSC. MSRs hold the processor’s configuration and its counters: EFER (C0000080H) with the long-mode and SYSCALL enables, the SYSCALL targets, the FS and GS bases, the time stamp counter (10H) and many more. Both vendors share some numbers and differ on many: Intel’s MSRs are listed in its manual’s Volume 4, AMD’s in its Volume 2 and in the documentation of each processor family.

Privileged, and strict about numbers#

RDMSR runs only at CPL 0 (or in real mode); elsewhere it raises #GP(0). Zen 5 recorded that at CPL 3 for EFER and for the time stamp counter, with RAX and RDX left alone. At CPL 0 a number the processor does not implement raises #GP(0) too, rather than reading 0, so code that reads an MSR it is not sure of has to be ready for the fault. Bits that an MSR does not implement read as undefined, both manuals say.

Order#

RDMSR is not serializing. Intel’s manual warns that a sequence of RDMSRs may read their MSRs in another order than the program’s, and offers IA32_BARRIER (2FH) to order the reads of RDMSRLIST, which reads up to 64 MSRs from a table in one instruction.

Other forms and kin#

• With MSR_IMM, a VEX form (and an APX one) takes the number as a 32-bit immediate and writes all 64 bits to one register; Intel’s manual says it may be faster. No processor at hand has it.
• URDMSR reads, at any CPL, the MSRs that the OS marks in a bitmap given by IA32_USER_MSR_CTL.
• RDPMC and RDTSC read counters that are also MSRs, without needing CPL 0 where the OS allows.

Under a hypervisor, RDMSR may leave the guest: Intel’s VMX checks an MSR bitmap and AMD’s SVM an MSR permissions map, both set by the hypervisor, to decide which reads exit. WRMSR is the write. AMD’s Zen 5 guide lists RDMSR as microcoded.

Vulnerability mitigations

Mitigations of these processor vulnerabilities use RDMSR:

• CVE-2022-21233: Stale Data Read from Legacy xAPIC
• CVE-2020-8695: RAPL Energy Reporting (RAPL energy reporting)
• CVE-2018-3640: Rogue System Register Read
• CVE-2017-5754: Meltdown (Rogue Data Cache Load)

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
n = ecx                          # bits 63:32 of RCX do not count
if not msr_exists(n):
    fault(GP, 0)                 # reserved or not implemented
v = msr[n]
eax = v                          # bits 63:32 of RAX and RDX cleared
edx = v >> 32
# bits that the MSR does not implement read as undefined, Intel's
# manual says

if CPL > 0:
    fault(GP, 0)
n = src.read()                   # imm32: the MSR's number
if not msr_exists(n):
    fault(GP, 0)
dest.write(msr[n])               # all 64 bits

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

VEX forms

MSR-IMM-VEX

EVEX forms

MSR-IMM-EVEX

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDPMC
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR

More MSR_IMM instructions

• WRMSRNS

More APX instructions

• MOVBE
• MOVDIR64B
• MOVDIRI
• MOVRS
• MUL
• MULX
• NEG
• NOT
• OR
• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX
• STTILECFG
• SUB
• TILELOADD
• TILELOADDRS
• TILELOADDRST1
• TILELOADDT1
• TILESTORED

All 88 APX instructions