ERETU

if not cr4 >> 32 & 1 or CPL > 0:
    fault(UD)                    # FRED off, or CPL 3: #UD, not #GP
if msr[0x1D4] & 3:
    fault(GP, 0)                 # from stack level 0 only
t = load(rsp + 8, 64)            # RIP; the error code is skipped
c = load(rsp + 16, 64)           # CS
f = load(rsp + 24, 64)           # RFLAGS
p = load(rsp + 32, 64)           # RSP
s = load(rsp + 40, 64)           # SS, bits 18:16 event state
if c & 0xFFFFFFFFFFFF0003 != 3:
    fault(GP, 0)                 # to CPL 3, no other bits
if f & 0xFFFFFFFFFFC2B02A != 2:
    fault(GP, 0)                 # bit 1 set; IOPL, VM and reserved
                                 # bits clear
if s & 0xFFF80003 != 3:
    fault(GP, 0)
u = star >> 48                   # STAR[63:48], SYSRET's selectors
c &= 0xFFFF
s &= 0xFFFF
if c == u + 16 and s == u + 8:
    wide = 1                     # 64-bit code, flat, as SYSRET has it
elif c == u and s == u + 8:
    wide = 0                     # 32-bit code, flat
else:
    d = descriptor(c)            # any other: both descriptors read
    wide = d >> 53 & 1           # and checked as IRET checks them
if wide and not canonical(t):
    fault(GP, 0)
if not wide:
    t &= 0xFFFFFFFF              # to compatibility mode: 32 bits,
    p &= 0xFFFFFFFF              # within CS's limit
rip = t
rsp = p
cs = c                           # CPL 3
ss = s
cf = f & 1
pf = f >> 2 & 1
af = f >> 4 & 1
zf = f >> 6 & 1
sf = f >> 7 & 1
tf = f >> 8 & 1
if_ = f >> 9 & 1
df = f >> 10 & 1
of = f >> 11 & 1
iopl = f >> 12 & 3               # 0, as checked
nt = f >> 14 & 1
rf = f >> 16 & 1                 # RF may come back set
vm = f >> 17 & 1                 # 0, as checked
ac = f >> 18 & 1
vif = f >> 19 & 1
vip = f >> 20 & 1
id = f >> 21 & 1
k = kernel_gs_base               # GS's base swapped, as SWAPGS does
kernel_gs_base = gsbase
gsbase = k
# SS bit 17: a pending single-step #DB, if TF is set; bit 18: NMIs
# unblocked. With shadow stacks, SSP comes from IA32_PL3_SSP