ERETS

ERETS returns from an event that FRED delivered while the processor was already at CPL 0: an exception, interrupt or NMI in the kernel. It is FRED’s replacement for IRET in that case, and ERETU is the one for events from user mode. RSP must point at the frame that event delivery pushed, six quadwords up from RSP: the error code, which ERETS skips, then RIP, CS, RFLAGS, RSP and SS. It loads RIP, RFLAGS and RSP from the frame and stays at CPL 0.

What it checks#

CS and SS are not loaded: their 16-bit selectors in the frame must be the ones in use, or ERETS raises #GP(0). So do a non-canonical RIP, RFLAGS with VM or a reserved bit set or bit 1 clear, and undefined bits in the CS or SS image. With supervisor shadow stacks it also pops SSP, RIP and CS from the shadow stack and compares them, raising #CP when they differ. ERETS raises #UD while FRED is off and at CPL above 0, and therefore outside 64-bit mode. Intel’s manual adds that nothing after it executes, even speculatively, before everything ahead has completed.

The event state in the frame#

The upper bits of the CS and SS images carry state that IRET did not have. Bits 17:16 of CS give the stack level to return to, which ERETS can lower but never raise; bit 18 restores CET’s indirect-branch tracker waiting for ENDBRANCH. In SS, bit 16 restores the blocking that follows STI, bit 17 a pending single-step #DB, and bit 18 unblocks NMIs, so a handler that returns with that bit clear keeps them blocked.

In Linux#

Linux 7.3’s arch/x86/entry/entry_64_fred.S ends its kernel entry point with ERETS. Its fred.c loads SS with the kernel’s data selector when it enables FRED: a frame pushed while SS was still null would otherwise fail ERETS’s SS check after a task switch. KVM on Intel, after a VM exit for an NMI or interrupt, runs the host’s handler through a frame of its own and returns with ERETS, which can unblock NMIs.

Not run here#

The Zen 5 guest that ran the probe does not report FRED, so ERETS was not run. GNU as 2.44 and Clang 23 assemble erets as F2 0F 01 CA; Linux writes the bytes, and neither compiler has an intrinsic.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cr4 >> 32 & 1 or CPL > 0:
    fault(UD)                    # FRED off, or CPL 3: #UD, not #GP
t = load(rsp + 8, 64)            # RIP; the error code is skipped
c = load(rsp + 16, 64)           # CS, bits 18:16 event state
f = load(rsp + 24, 64)           # RFLAGS
p = load(rsp + 32, 64)           # RSP
s = load(rsp + 40, 64)           # SS, bits 18:16 event state
if not canonical(t):
    fault(GP, 0)
if c & ~0x70000 != cs:
    fault(GP, 0)                 # the same CS, no other bits
if f & 0xFFFFFFFFFFC2802A != 2:
    fault(GP, 0)                 # bit 1 set; VM, reserved bits clear
if s & 0xFFF8FFFF != ss:
    fault(GP, 0)                 # the same SS; bits 63:32 ignored
g = msr[0x1D4]                   # IA32_FRED_CONFIG
lvl = min(g & 3, c >> 16 & 3)    # the stack level, never raised
msr[0x1D4] = g & ~3 | lvl
rip = t
rsp = p
cf = f & 1
pf = f >> 2 & 1
af = f >> 4 & 1
zf = f >> 6 & 1
sf = f >> 7 & 1
tf = f >> 8 & 1
if_ = f >> 9 & 1
df = f >> 10 & 1
of = f >> 11 & 1
iopl = f >> 12 & 3
nt = f >> 14 & 1
rf = f >> 16 & 1                 # RF may come back set
vm = f >> 17 & 1                 # 0, as checked
ac = f >> 18 & 1
vif = f >> 19 & 1
vip = f >> 20 & 1
id = f >> 21 & 1
# SS bit 16: STI's blocking again, if IF is set; bit 17: a pending
# single-step #DB, if TF is set; bit 18: NMIs unblocked; CS bit 18:
# an indirect branch tracker of CET waiting for ENDBRANCH

Operands

Flags

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More FRED instructions

• ERETU