TDP and turbo parameter modification with MSR on non-overclockable Intel CPU (such as Intel i7-8550U)

README.md

TDP and Turbo Parameter Modification with MSR on Non-Overclockable CPUs

Disclaimer

• Modifying MSR may void your CPU's (or system board's) warranty. Proceed with caution. I am not responsible for any damage caused by this article.
• MSR addresses vary significantly between CPUs. Check your CPU's MSR address using Intel's documentation.
• This has only been tested on the Intel i7-8550U (Kaby Lake R).
• This article is a translation of this article. If you can read Korean, I recommend reading that article instead.

Introduction

On Windows, Intel XTU can be used to modify turbo boost parameters and TDP-related settings. However, on other operating systems, there are no specific user-friendly tools available. In this article, I will directly modify MSR (Model-Specific Registers) to achieve a similar effect.

Understanding Your CPU

There are many CPU models, which we often refer to by their friendly names—such as "Core i7"—but this is not sufficient for this article. Some CPUs are very different even if they share the same friendly name. Conversely, some CPUs have different names but are actually variants of another CPU. Intel distinguishes between CPUs using CPU family and model. For example:

$ cat /proc/cpuinfo | less
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 142
model name      : Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
stepping        : 10
...

Note that /proc/cpuinfo returns the CPU family and model as decimal values.

Dependencies

On Linux, you will need msr-tools and the msr kernel module. You may want to insert the kernel module automatically by adding the appropriate configuration (e.g., echo msr > /etc/modules-load.d/msr.conf in Arch Linux).

You can read from MSR with rdmsr 0x(address) and write to MSR with wrmsr 0x(address) 0x(value). When reading, you can specify bitmasks with -f 15:0 (from bit 0 to bit 15, in reverse).

Power/Energy/Time Units

My CPU has MSR_RAPL_POWER_UNIT at address 606h.

606H MSR_RAPL_POWER_UNIT (RO)
    3:0 = Power unit (W) = 1/2^(decimal)W - def: 0.125W
    12:8 = Energy unit (J) = 1/2^(decimal)J - def: 0.00006103515625J
    19:16 = Time unit (sec) = 1/2^(decimal)sec - def: 0.0009765625sec

These units are needed to modify existing values.

Package Power Limits

Now the fun begins: MSR_PKG_POWER_LIMIT contains package power limit variables.

610H MSR_PKG_POWER_LIMIT (RW)
    14:0 = Pkg power limit = Powerunit * decimal
    15:15 = Pkg power enabled (bool)
    16:16 = Pkg clamping limit (bool)
    23:17 = Pkg power limit time window = 2^(21:17 bit) * (1.0 + (23:22 bit)/4.0 ) * Timeunit

    46:32 = Pkg power limit 2 = Powerunit * decimal
    47:47 = Pkg power 2 enabled (bool)
    48:48 = Pkg clamping limit 2 (bool)
    55:49 = Pkg power limit time window = 2^(53:49 bit) * (1.0 + (55:54 bit)/4.0 ) * Timeunit
    
    63:63 = MSR lock (bool)

If bit 63 is 0, these values can be changed by writing to the 0x610 register. You may change the package power limit to a higher TDP and prolong the limit time window to increase your processor's performance (if not limited by thermal throttling).

Turbo Boost Ratio Limit

If MSR_PLATFORM_INFO[28] is 1, you can also change the turbo boost limit variable.

CEH MSR_PLATFORM_INFO
    15:8 = Maximum non-turbo (RO) bool
    28 = Programmable ratio limit for turbo (RO) bool
    29 = Programmable TDP limit for turbo (RO) bool
    30 = Programmable TJ offset (RO) bool

1ADH MSR_TURBO_RATIO_LIMIT (RO if MSR_PLATFORM_INFO[28]=0, else RW)
    7:0 = Ratio 1C
    15:8 = Ratio 2C
    23:16 = Ratio 3C
    31:24 = Ratio 4C

Real-life Example: Tuning the i7-8550U Processor

Using the above information, I modified the MSR on my i7-8550U processor.

Since this processor is limited to a 37 boost ratio when all 4 cores are being used, I changed the limitation to 40. Additionally, I changed the 23W limit to 25W with a longer (1,073,741,824 seconds) boost duration.

From:

610H
    42819800dd80b8h

    00000000 01000010 10000001 10011000
    00000000 11011101 10000000 10111000

    14:0 = Pkg power limit = 10111000b (184d, b8h) = 23
    15:15 = Pkg power enabled (bool) = 1b
    16:16 = Pkg clamping limit (bool) = 1b
    23:17 = Pkg power limit time window = 11b(3d) 01110b(14d) = 2^14*(1+3/4)*(1/2)^10=28

    46:32 = Pkg power limit 2 = 110011000b (408d, 198h) = 51
    47:47 = Pkg power 2 enabled (bool) = 1b
    48:48 = Pkg clamping limit 2 (bool) = 0b
    55:49 = Pkg power limit time window = 01b(1d) 00001b(1d) = 2^1*(1+1/4)*(1/2)^10=0.00244140625
    
    63:63 = MSR lock (bool) = 0b
    
1ADH
    25252828h
    
    7:0 = Ratio 1C = 40
    15:8 = Ratio 2C = 40
    23:16 = Ratio 3C = 37
    31:24 = Ratio 4C = 37

To:

610H
    42819800FC80C8h

    00000000 01000010 10000001 10011000
    00000000 11111100 10000000 11001000

    14:0 = Pkg power limit = 11001000b (200d, c8h) = 25
    15:15 = Pkg power enabled (bool) = 1b
    16:16 = Pkg clamping limit (bool) = 0b
    23:17 = Pkg power limit time window = 11b(3d) 11110b(30d) = 2^30*(1+3/4)*(1/2)^10=1073741824

    46:32 = Pkg power limit 2 = 110011000b (408d, 198h) = 51
    47:47 = Pkg power 2 enabled (bool) = 1b
    48:48 = Pkg clamping limit 2 (bool) = 0b
    55:49 = Pkg power limit time window = 01b(1d) 00001b(1d) = 2^1*(1+1/4)*(1/2)^10=0.00244140625
    
    63:63 = MSR lock (bool) = 0b
    
1ADH
    28282828h
    
    7:0 = Ratio 1C = 40
    15:8 = Ratio 2C = 40
    23:16 = Ratio 3C = 40
    31:24 = Ratio 4C = 40

Results

turbostat reported the updated TDP limit and duration, as well as the changed turbo boost ratio. I could not test real-life performance differences, as my processor is heavily throttled by thermal throttling even at a 15W TDP.

i7-8550u-tdp-boost-modification.sh

#!/bin/bash
# This script is not intended for general usage.

# TDP
wrmsr 0x610 0x42819800FC80C8
/opt/devmem2 0xFED159A0 w 0x00DD80C8

# All core 40x boost
wrmsr 0x1AD 0x28282828

Hey! I tested this on my ups 9360 that I'm running the high Sierra, it sets the variable but it's unable to increase max pkg power, after 15 seconds it drops to 15w around 80C, maybe I've been seen some yt videos and saw that sometimes to adjust properly the turbo boost short power max and turbo boost power max to the same value could help this, but I have no idea how to calculate the new value for 0x610

got a work around using irf extractor you can identify your variable for ctdp configuration and set tdp up that equals to 25w, the notebook will work hotter but there won't be a 15w cap

25W TDP for i5-8250U with 128 seconds Time Window:
sudo wrmsr 0x610 0x00428160002380c8

(generated by XTU on Windows 10, Fuck Intel)

EDIT 2

I think it was resetting because of thermal throttling, Full Turbo made the CPU reach 98°C in an instant. So I did limit the turbo frequency as well. To limit to 3.0 GHz, I run wrmsr 0x01AD 0x1e1e1e1e. I get 80°C to 85°C on sustained 4-cores 100% load at 3.0 GHz without a cooling pad, which I think is pretty good, I might lower the max Turbo frequency further to 2.7 GHz if I plan on letting it run for several hours.

So, for an "Long Term Performance" setup with my i7-8550U, this is what I had to do (run as root):

# -90, -60, -90 mV undervolt; CPU Core, iGPU, CPU Cache
wrmsr 0x150 0x80000011f4800000         
wrmsr 0x150 0x80000111f8600000          
wrmsr 0x150 0x80000211f4800000

# 3.0 GHz Turbo for 4/3/2/1 cores
wrmsr 0x01AD 0x1e1e1e1e

# Unlock full 44 watts TDP
wrmsr 0x610 0x42016000dd8160
devmem2 0xFED159A0 w 0xDD8160

On a 4-cores/8-threads benchmark, I get 27% to 60% performance increase depending on the specifics of the computation. Not too bad!

EDIT

Turns out it still crashes using those settings, but only on AC, not on the battery... Any help would be greatly appreciated.

I can temporarily make everything work on AC by doing:

wrmsr 0x610 0x42016000dd8160
devmem2 0xFED159A0 w 0xDD8160

But the MSR value get changed back to 0x42016000dc8040 after a while, sometimes 0x43816000dd8024. I really don't know what's happening really.

Original post follows

I have a laptop with a i7-8550U with 44W TDP that throtlles quite a lot on linux by defaults. Running some openmp code with 8 threads, it downclocks to 1.8 to 2 GHz in a matter of seconds eventhough the temperature is around 56°C. Note that I've put some thermal pads between the CPU heatsink and the chassis of the laptop to better dissipate heat. On windows the throttling is much less of a problem.

Using your gist as a guideline I've managed to drastically increase the performance on linux, by about 25%. Now the clock decreases slowly and stabilizes at 2.6 to 2.7 GHz with a temperature around 68°C. This is much more similar to what I get on Windows.

I simply increased the #1 window. When I tried to disable the clamping like you did, my computer crashed (probably reaching limit the temperature 100°C). For reference I did this (original 0x610 value is 0x42016000dc8160):

wrmsr 0x610 0x42016000fc8160
devmem2 0xFED159A0 w 0x00DD8160

It's still unclear to me what the devmem2 command is used for. And why 00DD should be kept regardless of the MSR stuff, I figured that out through trial and errors. Any explanation would be welcome.

And, in case anyone wants to mess with MSR in python, I'm sharing a few convenient functions I coded for that project:

def get_power_unit(x):
    x = format(x,'064b')
    ret = dict(
        power_unit = 0.5**int(x[-3-1:None],2),
        energy_unit = 0.5**int(x[-12-1:-8],2),
        time_unit = 0.5**int(x[-19-1:-16],2)
    )
    return ret

def _get_power_limits(x,y):
    x = format(x,'064b')
    pl = dict(
        pkg_power_limit_1 = y['power_unit'] * int(x[-14-1:None],2),
        pkg_power_enabled_1 = bool(int(x[-15-1],2)),
        pkg_clamping_limit_1 = bool(int(x[-16-1],2)),
        pkg_power_limit_time_window_1 = 2**(int(x[-21-1:-17],2))*(1.0 + int(x[-23-1:-22],2)/4.0)*y['time_unit'],
        pkg_power_limit_2   = y['power_unit'] * int(x[-46-1:-32],2),
        pkg_power_enabled_2 = bool(int(x[-47-1],2)),
        pkg_clamping_limit_2 = bool(int(x[-48-1],2)),
        pkg_power_limit_time_window_2 = 2**(int(x[-53-1:-49],2))*(1.0 + int(x[-55-1:-54],2)/4.0)*y['time_unit'],
        pkg_msr_lock = bool(int(x[-63-1],2))
    )
    return pl

def get_power_limits(x,y):
    y = get_power_unit(y)
    return _get_power_limits(x,y)

e.g. get_power_limits(0x42816000dd8160,0xa0e03) yields

{'pkg_clamping_limit_1': True,
 'pkg_clamping_limit_2': False,
 'pkg_msr_lock': False,
 'pkg_power_enabled_1': True,
 'pkg_power_enabled_2': True,
 'pkg_power_limit_1': 44.0,
 'pkg_power_limit_2': 44.0,
 'pkg_power_limit_time_window_1': 28.0,
 'pkg_power_limit_time_window_2': 0.00244140625}

I don't get how you found MSR_RAPL_POWER_UNIT register address at intel's docs, my cpu is a i7 8700 I downloaded it's datasheet and didn't saw anything related to that.

MSR_RAPL_POWER_UNIT is in Volume 3
List of all MSR for each model is in Volume 4
https://software.intel.com/en-us/articles/intel-sdm

Have been trying to do this but it does not have any effect on my i7-8550U - there must be other factor in play

(UPDATE: the other factor is EDP limit. In fact, all parameters was configured properly using method in this post but my laptop cannot operate beyond 18W. Value higher than 18W will trigger Ring EDP limit which if I understand correctly it is the "Electrical Design" limitation of the laptop.)

Hi,

Can someone help? I have an HP spectre x360 13 with i7-8550U
I would like to increase the TDP that is locked to 15w. My temperatures remain very low during CPU stress test, so I believe I could operate at for example 20W. Unfortunately HP BIOS has locked the intel configurable 15W, so I cannot increase the limits using throutling stop or XTU.
would this msr technique work in my case?

On windows I can use the RWutility to run wrmsr commands, but I don't know which commands should I run.
Can anyone provide or help me with this commands?

thanks

so far I tried:
Pkg power limit = 17 w
Pkg power enabled (bool) = 1b
Pkg clamping limit (bool) = 0b
Pkg power limit time window= 1073741824 s

Pkg power limit 2 = 17w
Pkg power 2 enabled (bool) = 1b
Pkg clamping limit 2 (bool) = 0b
Pkg power limit time window =0.00244140625 s

using the following commands
wrmsr 0x610 0x42808800FC8088
devmem2 0xFED159A0 w 0xFC8088

however, after 60 s the power drops from 17 w to 15 W and stays there, If I put 16W instead of 17w, it keeps during 80s instead of 60. If I put 25 W it holds during just 24 s. Then I need to stop the stress test during a while and start again to have again 17/16/25 W before dropping again to 15W.

Do you have any suggestion?
thank you very much

Hi, where can i found the documents for 3rd gen intel cpu's ? Where else can i dig to get MSR_RAPL_POWER_UNIT or other adresses ?

Okay i found out how it works, that was a dumb question.

MSR_RAPL_POWER_UNIT is in Volume 3
List of all MSR for each model is in Volume 4
https://software.intel.com/en-us/articles/intel-sdm

I can't find MSR_PKG_POWER_LIMIT for the 8th generation (i7-8550u) in https://software.intel.com/en-us/download/intel-64-and-ia-32-architectures-software-developers-manual-volume-4-model-specific-registers. Are you looking on some other document or am I misinterpreting the document?

In your article you have mentioned that auto load of module will happen using below command, which I feel it's not correct:
echo msr > /etc/modules-load.d/msr.conf

In place of msr.conf it should be modules.conf, below is the correct one:
echo msr > /etc/modules-load.d/modules.conf

It should be correct, the filename does not matter. See https://www.freedesktop.org/software/systemd/man/modules-load.d.html for the upstream documentation.

Can someone explain, how to calculate the address which is passed to devmem2 in the upper conversation :
wrmsr 0x610 0x42016000fc8160
devmem2 0xFED159A0 w 0x00DD8160

Interested to know, how calculated 0xFED159A0. And what trying to do via devmem2, as 0x610 register value is already updated via wrmsr?

It should be correct, the filename does not matter. See https://www.freedesktop.org/software/systemd/man/modules-load.d.html for the upstream documentation.

ok thanks..

Can someone explain, how to calculate the address which is passed to devmem2 in the upper conversation :
wrmsr 0x610 0x42016000fc8160
devmem2 0xFED159A0 w 0x00DD8160

Interested to know, how calculated 0xFED159A0. And what trying to do via devmem2, as 0x610 register value is already updated via wrmsr?

https://blog.minori.moe/?p=1014 here (but not translated in English)

Can someone please help. I've done all due diligence before posting but I'm stuck.
I managed to change my ratio's and confirmed the success, It's not using them though I assume because I need to increase TDP. But I'm stuck on the TDP math [3:0 = Power unit (W) = 1/2^(decimal)W - def: 0.125W] not sure what "^" does or what "def" is. Sorry.
"rdmsr --processor 0 0x606" yields "a1003" Power unit
"rdmsr -f 14:0 --processor 0 0x610" yields "2f8" Pkg power limit
Processor is an https://ark.intel.com/content/www/us/en/ark/products/75269/intel-xeon-processor-e5-2650-v2-20m-cache-2-60-ghz.html
should be around 95W. The server can take 150W cpu's so I'm sure the board could handle it. was going to push it to 105W just to see the results. never goes over 40 degrees so thermal shouldn't be a problem.

Thanks in advance.

EDIT 1
I change "2f8" to "348" to try and get to 105W, it accepted the change. but my frequencies are still where they were.
Haven't done anything with "devmem2" It's not clear how to use it and I'm worried I might break it.
BTW, are these changes reboot persistent, or do I need to script em.

EDIT 2
"turbostat" shows this.... meaning my change has gone through in the registers.
cpu0: MSR_RAPL_POWER_UNIT: 0x000a1003 (0.125000 Watts, 0.000015 Joules, 0.000977 sec.)
cpu0: MSR_PKG_POWER_INFO: 0x2f04b001e002f8 (95 W TDP, RAPL 60 - 150 W, 0.045898 sec.)
cpu0: MSR_PKG_POWER_LIMIT: 0x68390005a8348 (UNlocked)
cpu0: PKG Limit #1: ENabled (105.000000 Watts, 10.000000 sec, clamp DISabled)
cpu0: PKG Limit #2: ENabled (114.000000 Watts, 0.007812* sec, clamp DISabled)
cpu0: MSR_DRAM_POWER_INFO,: 0x2f0098003e0088 (17 W TDP, RAPL 8 - 19 W, 0.045898 sec.)
cpu0: MSR_DRAM_POWER_LIMIT: 0x00000000 (UNlocked)
cpu0: DRAM Limit: DISabled (0.000000 Watts, 0.000977 sec, clamp DISabled)
cpu0: MSR_PP0_POLICY: 0
cpu0: MSR_PP0_POWER_LIMIT: 0x00000000 (UNlocked)
cpu0: Cores Limit: DISabled (0.000000 Watts, 0.000977 sec, clamp DISabled)

EDIT 3
See this page..... https://software.intel.com/en-us/forums/software-tuning-performance-optimization-platform-monitoring/topic/543895?language=en-us&https=1
"On Intel(r) Xeon(r) Processor E5 v2 family, the semaphore is bit 63 in MSR_TURBO_RATIO_LIMIT1."

Had to flick a hidden bit in order to make it read the MSRS. tricky intel. After flicking the bit it worked to change values down but still can't change them up above default. Damn.

You are using a e5 2xxx v2 CPU, which is meant to be used in a dual socket board. I'm pretty sure you can't overclock those, sadly :(. Coincidentally I have an E5 1680v2! It has an unlocked multiplier. I was trying to adjust the multipliers as well, but it seemed to be ignoring my inputs. I see in your comment you reference a "hidden bit". Sorry if this is a stupid question, but how exactly did you flip that bit? Mine doesn't seem to want to. Thanks!

The docs are here. https://software.intel.com/sites/default/files/managed/22/0d/335592-sdm-vol-4.pdf
What is doesn't say in the doc is that 0X1AE bit 63 is a sephamore to initiate the changes. So make you multiplier changes and then flick it.
for me it was "wrmsr -p 0 0x1AE 0x8000000020202020". But if I read it back strait away I only got 0x20202020. But the change went through.
Your multiplier could be capped by newer microcode like they did to the v3's. Try and lower it to make sure the method is working.

Hi, I'm using a system with Intel Core i5-8250U. The Power Limit is unlocked, both PL1 and 2 at 100 and 125W. However, the system throttles to 25W power under long term load, which I think is due to Intel Config/Configurable/cTDP Up. I want to set this cTDP level to default, to unlock it perhaps. The CPU temperature under 25W load is 85 C.

Is there a register to control this? The Intel datasheet seems to not have any information about cTDP on the 8th gen Intel CPU.

Thanks!!

My symptom is similar to yours: I have a Dell Vostro 5471 with i7-8550u, 15W TDP(as shown in HWInfo)

On ArchLinux, by using intel-undervolt(which is a nice tool) or this Gist, I'm able to set TDP 44W. When doing all-core stress testing, the laptop can run at 40W+ for ~30s(this time depends on thermal condition), then the power gradually falls to about 23W, the CPU temperature is about 80C+-10C.

I've once tried Throttle Stop on Win10, the same laptop can run at >30W for more than 2 minutes, maybe Throttle Stop can do more than MSR on Linux. Maybe you can have a try of Throttle Stop and see whether it makes any difference?

Another guess: maybe your 25W is because of thermal throttling, and just coincide with the cTDP, as many 8th gen ultrabooks behave bad at thermal design.

UPDATE: I did some search today and found many similar cases, some solved and some not, at https://github.com/erpalma/throttled. I tried it but no luck, though.

is this possible with a 10700 non-k? I'd like to try it out, if I can up the tdp to 95 from 65 or maybe a little higher & up the multiplier..

let me know thanks!

Interested to know, how calculated 0xFED159A0. And what trying to do via devmem2, as 0x610 register value is already updated via wrmsr?

0xFED159A0 is 0xFED10000 + 0x59A0. 0xFED10000 is a common value for MCHBAR. The value of MCHBAR is located in the 48h of Host Bridge/DRAM Registers, which can be obtained with sudo setpci -s 0:0.0 48.l. 59A0h is Package Power Limit, see https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/10th-gen-core-families-datasheet-vol-2-datasheet.pdf. It is not documented until 10th Gen, but it works in older generations.

610h MSR_PKG_POWER_LIMIT is not synchronized with MCHBAR Package Power Limit for unknown reasons. If you set only one of the two the lower value seems to take effect.

Also, the command with wrmsr 0x610 can be replaced with native kernel interfaces in /sys/devices/virtual/powercap/intel-rapl/intel-rapl:0/ so msr module is not needed.

So i was able to enable msr writing and reading on my system and installed the package. Also confirmed CPU frequency changes.

I have 2x E5-2687w v2 Cpus that have a base of 3.4 Ghz and a Turbo of 4Ghz. Iam trying to lock all cores at fixed turbo value for a real-time kernel to prevent frequency changes.

Can anyone give me a little more explaining, i understand the first value after wrmsr but i dont understand the 2nd long bit mask.... and have no clue how to convert what i want here.

I need 4Ghz for a total of 16 Cores.... and disable all Turbo power throttling if any...

@fixapc Did you get it to go up in speed? I have 2x E5-2667's in a dell T620. I could only adjust clocks down and not up. I'll try again and see what happens.

So i understand how it works and i know does work, but iam not sure how to calculate the last string value. The first string is what you want to modify. You can get these strings from the developers vol 4 guide on the intel site. If its not letting you get higher frequency you may have to increase the TDP or power watt limit first. As turbo boost works based on a power and thermal algorithm. Once you set those you can keep it locked at your designed frequency.

I now have a dell poweredge t620 with 2x e5-2667v2's. They can easy hold and sustain a 4gz clock. That's 16cores and 32 threads holding 4ghz on quite an old server. Thanks for the help everybody. I'm not sure what made it work in the end. I farted around for a day and gave up. a week later I checked my clocks and they were all 4ghz. Maybe it needed a restart??

I now have a dell poweredge t620 with 2x e5-2667v2's. They can easy hold and sustain a 4gz clock. That's 16cores and 32 threads holding 4ghz on quite an old server. Thanks for the help everybody. I'm not sure what made it work in the end. I farted around for a day and gave up. a week later I checked my clocks and they were all 4ghz. Maybe it needed a restart??

Can you replicate this results or did you suceed only one time? If you coupd help me that would he cool. Maybe write a guide. Thx in advance

I now have a dell poweredge t620 with 2x e5-2667v2's. They can easy hold and sustain a 4gz clock. That's 16cores and 32 threads holding 4ghz on quite an old server. Thanks for the help everybody. I'm not sure what made it work in the end. I farted around for a day and gave up. a week later I checked my clocks and they were all 4ghz. Maybe it needed a restart??

Can you replicate this results or did you suceed only one time? If you coupd help me that would he cool. Maybe write a guide. Thx in advance

Sorry man. It's so long ago i can't remember what happened. I've got a t640 now. I love the storage that these servers deliver and the amount of vms the ram can take. but single core speeds are so depressing no matter what i do, I don't think i'll do another server after this one. especially now desktops can take so much more ram than before.

Interested to know, how calculated 0xFED159A0. And what trying to do via devmem2, as 0x610 register value is already updated via wrmsr?

0xFED159A0 is 0xFED10000 + 0x59A0. 0xFED10000 is a common value for MCHBAR. The value of MCHBAR is located in the 48h of Host Bridge/DRAM Registers, which can be obtained with sudo setpci -s 0:0.0 48.l. 59A0h is Package Power Limit, see https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/10th-gen-core-families-datasheet-vol-2-datasheet.pdf. It is not documented until 10th Gen, but it works in older generations.

610h MSR_PKG_POWER_LIMIT is not synchronized with MCHBAR Package Power Limit for unknown reasons. If you set only one of the two the lower value seems to take effect.

Also, the command with wrmsr 0x610 can be replaced with native kernel interfaces in /sys/devices/virtual/powercap/intel-rapl/intel-rapl:0/ so msr module is not needed.

It seems simpler for changing TDP, as @xlz suggested, to use native kernel interfaces.

Example:

cd /sys/devices/virtual/powercap/intel-rapl/intel-rapl\:0
su
echo 15000000 > constraint_0_power_limit_uw
echo 15000000 > constraint_1_power_limit_uw

This sets the max TDP of the CPU at 15W for short and long turbo duration. CPU is now boosting to 4.3GHz in lightly threaded workloads like web browsing and goes down to 1.4GHz in heavy multi tasking like benchmarking. CPU temperatures are very under control now.

Thanks for all the documentation and effort!