RDMSRLIST

RDMSRLIST reads up to 64 model-specific registers in one instruction, where RDMSR reads one. RSI holds the linear address of a table of MSR numbers and RDI that of a table for their values, 8 bytes an entry in both, and bit n of RCX selects entry n of each. Going through the set bits from bit 0 up, the instruction reads the MSR named in entry n of the first table into entry n of the second and clears bit n, until RCX is 0. Each read is checked as RDMSR checks it, and a failed check raises #GP(0), as do a number with any of bits 63:32 set, a table address that is not a multiple of 8 or not canonical, and a CPL other than 0. WRMSRLIST is the write.

Stopping and going on#

Because RCX shows what is left, the instruction can stop part way, like a REP string instruction: an interrupt or an exception leaves RIP at RDMSRLIST and RCX with the bits of the finished entries clear, and running it again does the rest. A #GP for an MSR thus leaves the failing entry as the lowest set bit. A #PF need not point at the entry in hand, as the processor may read the tables ahead and fault on a later entry.

Order of the reads#

The entries are taken in order, but the MSRs may be read out of it, as with two RDMSRs. The number of IA32_BARRIER (2FH) in the table orders them: the MSRs of the entries after it are read only once every earlier instruction has completed locally and the earlier entries’ MSRs have been read. CPUID.(EAX=07H,ECX=1):EAX[27] reports both instructions and that MSR.

Encoding and guests#

RDMSRLIST is F2 0F 01 C6, the opcode of WRMSRNS with F2; WRMSRLIST takes F3. It exists only in 64-bit mode. A VMX guest needs the tertiary control “enable MSR-list instructions”, or RDMSRLIST raises #UD. With MSR bitmaps, a hypervisor sees an exit only for an MSR the bitmaps intercept, with that entry’s bit still set in RCX and the MSR’s number as the exit qualification; without them, every RDMSRLIST exits.

GCC 14.2.0 and Clang 23.1.2 have no option or intrinsic for it, though both assemblers know the mnemonic. Intel’s table of new features names Sierra Forest, Grand Ridge, Panther Lake and Diamond Rapids for it. The probe runs at CPL 3, and the Zen 5 guest behind its recorded cases lacks MSRLIST, so it ran neither instruction; AMD’s manuals do not describe them.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
if rsi & 7 or rdi & 7:
    fault(GP, 0)                 # both tables 8-byte aligned
for i in range(64):              # entry i of each table where bit i
    if rcx >> i & 1:             # of RCX is set, from bit 0 up
        e = load(rsi + 8 * i, 64)
        if e >> 32 or not msr_exists(e):
            fault(GP, 0)         # a number is 32 bits
        store(rdi + 8 * i, 64, msr[e])
rcx = 0
# each bit of RCX clears as its MSR is done: an interrupt or a fault
# leaves RIP at the instruction and RCX with the bits of the entries
# done clear, so that it goes on where it stopped; this block shows
# a fault ending it with RCX as it was. The MSRs may be read out of
# order, but for those after an entry of IA32_BARRIER (2FH)

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More MSRLIST instructions

• WRMSRLIST