WRMSRNS

WRMSRNS writes a model-specific register as WRMSR does, EDX:EAX into the MSR whose number is in ECX, with the same checks: CPL 0 or real mode, an MSR that exists, no reserved bit set and, for the MSRs that hold addresses, a canonical address, each failure raising #GP(0). What it drops is serialization. WRMSR waits for everything before it to finish and its buffered stores to reach memory before the next instruction starts; WRMSRNS does not. Intel’s manual still promises that instructions before it use the old value of the MSR and those after it the new one, and that an MSR whose write invalidates the TLBs, such as an MTRR, does so here too. Some processors may serialize anyway for certain MSRs, but nothing may rely on it.

Where it pays#

Intel’s manual suggests WRMSRNS in place of WRMSR wherever the serialization is not needed, for speed. Linux’s wrmsrns() helper uses WRMSRNS where CPUID leaf 7, sub-leaf 1, reports it (EAX bit 19) and is patched to an ordinary WRMSR elsewhere, written with a redundant DS prefix so that both take 3 bytes. KVM, for one, uses it for MSRs that it writes while a guest’s values are loaded. Code that relied on WRMSR to serialize needs SERIALIZE instead, which Intel’s manual suggests also ahead of a WRMSRNS that changes the controls of performance-monitoring events that count stores only as they drain to memory: without it, stores from before the write may be counted under the new controls.

The immediate form#

With MSR_IMM (CPUID leaf 7, sub-leaf 1, ECX bit 5), a VEX form in 64-bit mode takes the MSR number as a 32-bit immediate and the whole 64-bit value from one general-purpose register, so no ECX, EDX or EAX need setting up; APX adds an EVEX form that can name the new registers. It is the write that the immediate form of RDMSR pairs with. Outside 64-bit mode, or without the feature, the form raises #UD.

Not run here#

The probe runs at CPL 3, and the Zen 5 guest it ran on reports neither WRMSRNS nor MSR_IMM, so it never ran either form; AMD’s manuals do not describe the instruction. GCC 14 and Clang 23 have no intrinsic for it, and their assemblers know the mnemonic, encoding it as 0F 01 C6.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
n = ecx                          # bits 63:32 of RCX, RAX and RDX do
v = edx << 32 | eax              # not count
if not msr_allows(n, v):
    fault(GP, 0)                 # as WRMSR's checks
msr[n] = v                       # not serializing, unlike WRMSR:
                                 # what follows sees the new value,
                                 # but stores before it may still
                                 # be on their way to memory

if CPL > 0:
    fault(GP, 0)
n = dest.read()                  # imm32: the MSR's number
v = src.read()                   # all 64 bits of the register
if not msr_allows(n, v):
    fault(GP, 0)
msr[n] = v                       # not serializing

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

VEX forms

MSR-IMM-VEX

EVEX forms

MSR-IMM-EVEX

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More MSR_IMM instructions

• RDMSR

More APX instructions

• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX
• STTILECFG
• SUB
• TILELOADD
• TILELOADDRS
• TILELOADDRST1
• TILELOADDT1
• TILESTORED
• TZCNT
• URDMSR
• UWRMSR
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ
• XOR

All 88 APX instructions