Thread by @_can1357

Turns out you can also find out undocumented MSRs behind NDA with Haruspex, looks like either rdmsr/wrmsr dispatches μOps dynamically or the decoder waits for the ecx value to be set, pretty interesting.🤭

You also get to see how certain MSRs such as the LSTAR and KERNEL_GS_BASE are optimized compared to normal CRBUS MSRs, likely due to the fact that they're kept in the register file instead.

Quick read through the following article even confirms it: software.intel.com/content/www/us…

Bit more research reveals that, it's not the decoder but the uOps of the rdmsr that schedule the rest of the ops since MSRs for the SMM state seem to look like other #GPs --however it seems like they forgot a speculative barrier there so DIV cycles gives those away 🥰

x86 do be fun.