IRET

if nt:
    fault(GP, 0)                 # no task to return to in IA-32e mode
n = OSIZE // 8                   # a field: 8 bytes for IRETQ, 4 for
                                 # IRETD, 2 for IRET
t = load(rsp, OSIZE)             # the return address
c = load(rsp + n, OSIZE) & 0xFFFF
f = load(rsp + 2 * n, OSIZE)     # RFLAGS
new_sp = load(rsp + 3 * n, OSIZE)   # 64-bit mode pops RSP and SS
s = load(rsp + 4 * n, OSIZE) & 0xFFFF   # also when the CPL stays
pl = c & 3                       # the CPL to return to: CS's RPL
if c & ~3 == 0:
    fault(GP, 0)                 # a null CS
if pl < CPL:
    fault(GP, c & ~3)            # never to a more privileged level
d = descriptor(c)
if d >> 43 & 3 != 3:
    fault(GP, c & ~3)            # bits 44 and 43: not code
dpl = d >> 45 & 3
if d >> 42 & 1 and dpl > pl:
    fault(GP, c & ~3)            # conforming: a DPL up to the RPL
if not d >> 42 & 1 and dpl != pl:
    fault(GP, c & ~3)            # else the DPL is the RPL
if d >> 47 & 1 == 0:
    fault(NP, c & ~3)
wide = d >> 53 & 1               # L: 64-bit code; else compatibility
                                 # mode
lim = d & 0xFFFF | d >> 32 & 0xF0000
if d >> 55 & 1:
    lim = lim << 12 | 0xFFF      # G: in units of 4 KiB
if wide and not canonical(t):
    fault(GP, 0)
if not wide and t > lim:
    fault(GP, 0)
if s & ~3 == 0:
    if pl == 3 or not wide:
        fault(GP, 0)             # a null SS: only to 64-bit code at
                                 # CPL 0 to 2
else:
    if s & 3 != pl:
        fault(GP, s & ~3)
    e = descriptor(s)
    if e >> 41 & 0xD != 9:
        fault(GP, s & ~3)        # bits 44, 43 and 41: S set, code
                                 # clear, writable set
    if e >> 45 & 3 != pl:
        fault(GP, s & ~3)        # its DPL is the new CPL
    if e >> 47 & 1 == 0:
        fault(SS, s & ~3)
cf = f & 1                       # the status flags, TF, DF and NT at
pf = f >> 2 & 1                  # every operand size
af = f >> 4 & 1
zf = f >> 6 & 1
sf = f >> 7 & 1
tf = f >> 8 & 1
df = f >> 10 & 1
of = f >> 11 & 1
nt = f >> 14 & 1
rf = 0                           # IRET's image has no RF: cleared
if OSIZE != 16:
    rf = f >> 16 & 1             # IRETD and IRETQ load it from the
                                 # image: SDM Volume 3B, 20.3.1.1,
                                 # rev. 093; Zen 5 too (a breakpoint
                                 # at the return address did not
                                 # fire), though APM Volume 3, IRET,
                                 # rev. 3.36, clears it
if OSIZE != 16:
    ac = f >> 18 & 1
    id = f >> 21 & 1
if CPL <= iopl:
    if_ = f >> 9 & 1             # else IF stays
if CPL == 0:
    iopl = f >> 12 & 3
    if OSIZE != 16:
        vif = f >> 19 & 1
        vip = f >> 20 & 1
if not wide:
    if AMD:
        new_sp = low(new_sp, 32)     # into compatibility mode, ESP
                                     # alone, zero-extended: APM (RSP.s,
                                     # of the new stack size), Zen 5
rsp = new_sp                     # all of RSP on Intel's (SDM); IRETD's
                                 # and IRET's zero-extended
ss = s
cs = c                           # and CPL becomes pl
rip = t
# VM stays 0, the other bits of the image are ignored. To an outer
# level, ES, DS, FS and GS become null where the new CPL may not
# use their segments (data, or code that is not conforming, of a
# lower DPL). With FRED enabled, an IRET that would change CPL, or
# enter compatibility mode at CPL 0, raises #GP(c & ~3). IRET also
# ends the blocking of NMIs