UWRMSR instruction (USER_MSR, APX)

UWRMSR writes a general-purpose register to a 64-bit model-specific register at any privilege level, as WRMSR writes one at CPL 0, under the same control as URDMSR: bit 0 of IA32_USER_MSR_CTL (MSR 1CH) enables it, and the second 2 KiB of the bitmap whose address that MSR holds give one bit per MSR from 0 to 3FFFH. The SDM also limits it, for now, to a single MSR, IA32_UARCH_MISC_CTL (1B01H); any other number raises #GP whatever the bitmap says, as does a write that WRMSR would refuse, such as one setting a reserved bit. With the enable bit clear, or without USER_MSR, CPUID.(EAX=07H,ECX=1):EDX[15], it raises #UD.

Not serializing

UWRMSR behaves like WRMSRNS, not like WRMSR: it does not wait for earlier instructions to finish or stores to drain, and the WRMSRNS page says what still holds, that instructions after it see the new value. Code that needs the write ordered with earlier work adds SERIALIZE.

Two forms

Both exist only in 64-bit mode and take the whole value from one register, where WRMSR takes EDX:EAX. F3 0F38 F8 takes the MSR number in the register of ModRM.reg and the value in that of ModRM.rm; a VEX form in map 7 takes the number as a 32-bit immediate, and APX adds EVEX forms for its new registers. As for URDMSR, the SDM’s list of #GP causes gives the bitmap’s range as 0 to 3FFH, against 0 to 3FFFH in its description.

In our builds

GCC 14 and Clang 23 at -O2 with -musermsr compile _uwrmsr(n, v) from <x86gprintrin.h> to uwrmsr rdi, rsi, both as F3 0F 38 F8 FE, with the number in ModRM.reg; for this form the two compilers agree, unlike for URDMSR’s. _uwrmsr(0x1b01, v) becomes the immediate form. The probe never writes MSRs, so it ran no form of UWRMSR, and the Zen 5 guest behind this site’s recorded cases lacks USER_MSR in any case. AMD’s manuals do not describe the instruction.

Forms

Every encoding of UWRMSR that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`UWRMSR r64, r64` 64-bit mode only UWRMSR_GPR64u64_GPR64u64	`F3 0F 38 F8 /r`	USER_MSR
`UWRMSR imm32, r64` 64-bit mode only UWRMSR_IMM32_GPR64u64	`VEX.LZ.F3.MAP7.W0 F8 /0 id`	USER_MSR
`UWRMSR r64, r64` UWRMSR_GPR64u64_GPR64u64_APX	`EVEX.LLZ.F3.MAP4.W0 F8 /r`	APX_F + USER_MSR
`UWRMSR imm32, r64` UWRMSR_IMM32_GPR64u64_APX	`EVEX.LLZ.F3.MAP7.W0 F8 /0 id`	APX_F + USER_MSR

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

c = msr[0x1C]                    # IA32_USER_MSR_CTL
if not c & 1:
    fault(UD)                    # the OS has not enabled them
n = dest.read()                  # a register of 64 bits, or imm32
v = src.read()
if n >> 14:
    fault(GP, 0)                 # MSRs 0 to 3FFFH only
b = load((c & ~0xFFF) + 2048 + n // 8, 8)
if not b >> n % 8 & 1:           # the write bitmap: the upper 2 KiB
    fault(GP, 0)                 # of the page, read as the kernel
                                 # reads
if n != 0x1B01 or not msr_allows(n, v):
    fault(GP, 0)                 # IA32_UARCH_MISC_CTL alone, today
msr[n] = v                       # at any CPL; not serializing

Not run on a processor: no processor at hand has USER_MSR, and the probe does not write an MSR that the OS lets user mode write.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`UWRMSR r64, r64` 64-bit mode only
`r64`	explicit	read
`r64`	explicit	read
`MSRs`	implicit	write
`UWRMSR imm32, r64` 64-bit mode only
`imm32`	explicit	read
`r64`	explicit	read
`MSRs`	implicit	write

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms: USER-MSR-LEGACY
VEX forms: USER-MSR-VEX
EVEX forms: USER-MSR-EVEX

Attributes

What else XED records about the forms. How to read.

All forms: may abort a TSX transaction

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to UWRMSR, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

Intrinsic	Compiles to
`_uwrmsr` `void _uwrmsr(unsigned long long __A, unsigned long long __B)`	`UWRMSR r64, r64` Legacy -musermsr

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`USER_MSR` USER_MSR	USER_MSR `CPUID.(EAX=07H,ECX=1):EDX[15]` USER_MSR	Clearwater Forest
`APX_F_USER_MSR` APX	APX_F + USER_MSR `CPUID.(EAX=07H,ECX=1):EDX[21]` APX_F `CPUID.(EAX=07H,ECX=1):EDX[15]` USER_MSR	None in XED’s chip model, which lists these instructions only under its placeholder for future processors.

More USER_MSR instructions

URDMSR

More APX instructions

All 88 APX instructions

Not serializing#

Two forms#

In our builds#