WRMSR

WRMSR writes EDX:EAX into the model-specific register whose number is in ECX, the high half from EDX; bits 63:32 of RCX, RAX and RDX do not count. It is how a kernel sets up much of the processor: EFER, the SYSCALL targets in STAR and LSTAR, the FS, GS and kernel GS bases that SWAPGS exchanges, the memory type ranges. RDMSR reads them back.

What it checks#

WRMSR runs only at CPL 0 (or in real mode) and raises #GP(0) elsewhere: Zen 5 recorded that at CPL 3 for EFER and the time stamp counter, and changed nothing. At CPL 0 it also raises #GP(0) for an MSR that does not exist, for a value that sets a reserved bit, and, for the MSRs that hold addresses, for an address that is not canonical: Intel’s manual names the FS, GS and kernel GS bases, LSTAR, the SYSENTER entry point and stack, and the debug store area. AMD’s manual says that SWAPGS relies on this check and does none of its own. Intel’s manual asks that undefined and reserved bits be written with the values read before, so a write usually follows a read.

A serializing write#

WRMSR is serializing in both manuals: everything before it completes, and its buffered stores reach memory, before anything after it starts. Each manual makes exceptions. Intel’s names IA32_TSC_DEADLINE and the x2APIC MSRs; AMD’s names SPEC_CTRL, PRED_CMD and the x2APIC MSRs, and some AVIC ones. A write to a memory type range register also invalidates the TLBs, global entries included (Intel’s manual). Code that used WRMSR to serialize can use SERIALIZE instead, Intel’s manual suggests, and writes that need no serializing can use WRMSRNS or, for up to 64 MSRs from a table, WRMSRLIST, neither of them serializing. All three, Intel’s manual says, keep instructions before them from using the new value and make those after them use it.

Writes from user mode#

UWRMSR writes, at any CPL, only the MSRs that the OS allows in a bitmap, today IA32_UARCH_MISC_CTL alone, and without serializing. Under VMX and SVM, the hypervisor’s MSR bitmap or permissions map decides which writes of a guest exit to it. AMD’s Zen 5 guide lists WRMSR as microcoded and names it among the serializing instructions that close write combining.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
n = ecx                          # bits 63:32 of RCX, RAX and RDX do
v = edx << 32 | eax              # not count
if not msr_allows(n, v):
    fault(GP, 0)                 # an MSR it lacks, a reserved bit
                                 # set, or an address that is not
                                 # canonical
msr[n] = v
# serializing: the instructions after it wait until it is done; a
# write to an MTRR also flushes the TLBs

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• INVLPG
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDMSR
• RDPMC
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD