URDMSR

URDMSR reads a 64-bit model-specific register into a general-purpose register at any privilege level, as RDMSR reads it at CPL 0, but only the MSRs that the operating system has opened to it. The kernel writes IA32_USER_MSR_CTL (MSR 1CH): bit 0 enables the instruction, and the rest gives the address of a 4-KiB bitmap. Its first 2 KiB hold one bit per MSR from 0 to 3FFFH, and URDMSR reads an MSR only where that bit is 1; a clear bit, a number above 3FFFH, or an MSR that RDMSR itself could not read raises #GP. The processor reads the bitmap as a supervisor access, whatever the CPL. With the enable bit clear, or without USER_MSR, CPUID.(EAX=07H,ECX=1):EDX[15], it raises #UD.

Two forms#

Both exist only in 64-bit mode and write all 64 bits of the destination, where RDMSR splits the value into EDX:EAX. F2 0F38 F8 takes the MSR number in the register of ModRM.reg and writes the register of ModRM.rm; a VEX form in map 7 takes the number as a 32-bit immediate, like RDMSR’s MSR_IMM form, and APX adds EVEX forms for its new registers. The SDM’s list of #GP causes gives the bitmap’s range as 0 to 3FFH, where its description, and the #GP for any number with bits 63:14 set, give 0 to 3FFFH.

In our builds#

GCC 14 and Clang 23 at -O2 with -musermsr compile _urdmsr(n) from <x86gprintrin.h> to urdmsr rax, rdi, and _urdmsr(0x1b01) to the immediate form, c4 e7 7b f8 c0 01 1b 00 00; both turn the option on for -march=clearwaterforest. The register forms differ in their bytes, though. GCC 14 and GNU as 2.44 encode urdmsr rax, rdi as F2 0F 38 F8 F8, with RDI, the number, in ModRM.reg, as the SDM and XED have it; Clang 23 prints the same text but emits F2 0F 38 F8 C7, which GNU objdump shows as urdmsr rdi, rax: by the SDM’s encoding, the number comes from RAX and the result goes to RDI.

Not run here#

The Zen 5 guest behind this site’s recorded cases reports 0 in CPUID.(EAX=07H,ECX=1):EDX, so the probe ran no form of URDMSR. AMD’s manuals do not describe the instruction.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

c = msr[0x1C]                    # IA32_USER_MSR_CTL
if not c & 1:
    fault(UD)                    # the OS has not enabled them
n = src.read()                   # all 64 bits of the register
if n >> 14:
    fault(GP, 0)                 # MSRs 0 to 3FFFH only
b = load((c & ~0xFFF) + n // 8, 8)
if not b >> n % 8 & 1:           # the read bitmap: 2 KiB at the
    fault(GP, 0)                 # page of USER_MSR_CTL[63:12],
                                 # read as the kernel reads
if not msr_exists(n):
    fault(GP, 0)                 # as RDMSR's checks
dest.write(msr[n])               # at any CPL

c = msr[0x1C]                    # IA32_USER_MSR_CTL
if not c & 1:
    fault(UD)                    # the OS has not enabled them
n = src.read()                   # imm32: the MSR's number
if n >> 14:
    fault(GP, 0)                 # MSRs 0 to 3FFFH only
b = load((c & ~0xFFF) + n // 8, 8)
if not b >> n % 8 & 1:           # the read bitmap: 2 KiB at the
    fault(GP, 0)                 # page of USER_MSR_CTL[63:12]
if not msr_exists(n):
    fault(GP, 0)
dest.write(msr[n])

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

USER-MSR-LEGACY

VEX forms

USER-MSR-VEX

EVEX forms

USER-MSR-EVEX

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to URDMSR, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More USER_MSR instructions

• UWRMSR

More APX instructions

• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX
• STTILECFG
• SUB
• TILELOADD
• TILELOADDRS
• TILELOADDRST1
• TILELOADDT1
• TILESTORED
• TZCNT
• UWRMSR
• WRMSRNS
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ
• XOR

All 88 APX instructions