WRMSRLIST

WRMSRLIST writes up to 64 model-specific registers from memory in one instruction, where WRMSR writes one from EDX:EAX. It takes the tables and mask of RDMSRLIST: RSI points to 8-byte MSR numbers, RDI to 8-byte values, both tables 8-byte aligned, and bit n of RCX selects entry n of each, bit 0 first. Every write is checked as WRMSR checks it: the MSR must exist, no reserved bit may be set and an address must be canonical. A failure raises #GP(0) with the bits of the entries already written clear in RCX, as an interrupt leaves them, so that running the instruction again goes on from there. It needs CPL 0 and 64-bit mode; its encoding is F3 0F 01 C6.

In order, not serializing#

Unlike RDMSRLIST’s reads, the writes happen in the table’s order, each with its side effects in place before the next. What WRMSRLIST leaves out is serialization, as WRMSRNS does: earlier stores need not have drained when it ends. Instructions before it still use the old values and those after it the new ones, and an MSR whose write by WRMSR flushes the TLBs, an MTRR for one, flushes them here too. Code that used WRMSR as a barrier adds SERIALIZE, which the SDM also suggests ahead of a change to the controls of performance-monitoring events that count stores as they drain to memory.

The processor may also read the tables ahead. It can fault on an entry past the last one written, and its loads from the tables may still use a memory type or TLB entry that an earlier entry has changed, through an MTRR or a TLB flush.

Guests and our builds#

In a VMX guest WRMSRLIST raises #UD unless the tertiary control “enable MSR-list instructions” is set. With MSR bitmaps, a write that they intercept exits after its value has been read, with that entry’s bit still set in RCX and the value in the VMCS’s MSR-data field for the hypervisor; without bitmaps, every WRMSRLIST exits. GCC 14.2.0 and Clang 23.1.2 have no intrinsic for it, though both assemblers encode the mnemonic. The probe runs at CPL 3, and the Zen 5 guest behind its recorded cases lacks MSRLIST, CPUID.(EAX=07H,ECX=1):EAX[27], so it ran no case; AMD’s manuals do not describe the instruction.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
if rsi & 7 or rdi & 7:
    fault(GP, 0)                 # both tables 8-byte aligned
for i in range(64):              # entry i of each table where bit i
    if rcx >> i & 1:             # of RCX is set, from bit 0 up
        e = load(rsi + 8 * i, 64)
        v = load(rdi + 8 * i, 64)
        if e >> 32 or not msr_allows(e, v):
            fault(GP, 0)         # as WRMSR's checks
        msr[e] = v               # in order: the effects of one write
                                 # come before the next
rcx = 0
# each bit of RCX clears as its MSR is written: an interrupt or a
# fault leaves RIP at the instruction and RCX with the bits of the
# entries done clear, so that it goes on where it stopped; this
# block shows a fault ending it with RCX as it was. Not serializing

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More MSRLIST instructions

• RDMSRLIST