SWAPGS instruction (System)

SWAPGS exchanges the base address of GS with the IA32_KERNEL_GS_BASE MSR (C0000102H). It has no operand and reads no general register, memory or flag, which is its point: at the entry point of SYSCALL, the kernel still runs on the user’s stack and has no register free to save anything in. Both manuals describe the use: one SWAPGS puts the kernel’s own pointer into GS, after which GS-relative accesses reach the kernel’s data for this processor, where the user’s stack pointer can be saved and the kernel’s loaded; a second one before the return to user mode puts the user’s base back.

A swap, not a load

Executed twice, SWAPGS undoes itself. So it belongs exactly once on each path from user mode into the kernel and once on the way back out: an interrupt or exception taken while the kernel already runs has the kernel’s base in GS, and a swap there would install the user’s. The interrupted CS, which the processor saves in the stack frame, holds the privilege level the event came from.

Neither value is checked as it moves. AMD’s manual says that SWAPGS does no canonical check and relies on WRMSR, which refuses a non-canonical address for the MSR; WRGSBASE refuses one for GS too. The user’s base, which a program can set itself with WRGSBASE where the OS enables FSGSBASE, may be any canonical address, so the value in GS does not show which base it is; the saved CS does. While the kernel runs between the two swaps, the MSR holds the user’s base, and WRMSR to C0000102H changes it.

Where it runs

SWAPGS exists only in 64-bit mode and raises #UD elsewhere. Below CPL 0 it raises #GP(0): Zen 5 did so in both recorded cases, at CPL 3. SYSRET and IRET do not swap by themselves.

With FRED enabled, SWAPGS raises #UD instead: the delivery of an event from CPL 3 and its return, ERETU, make the same exchange themselves (Intel’s Volume 3), and LKGS loads a GS selector while sending its base to IA32_KERNEL_GS_BASE rather than to GS. AMD’s Zen 5 guide lists SWAPGS as microcoded.

Forms

Every encoding of SWAPGS that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`SWAPGS` 64-bit mode only SWAPGS	`0F 01 F8`	LM

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if cr4 >> 32 & 1:
    fault(UD)                    # CR4.FRED: its returns swap instead
if CPL > 0:
    fault(GP, 0)
k = kernel_gs_base               # C000_0102H
kernel_gs_base = gsbase          # neither is checked: WRMSR keeps
gsbase = k                       # both canonical

Run on AMD Zen 5 (EPYC 9645): 2 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`SWAPGS` 64-bit mode only
`GS base`	implicit	read, write

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`LONGMODE` General-purpose System SYSCALL/SYSRET	LM `CPUID.80000001H:EDX[29]` LM	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

SWAPGS

A swap, not a load

Where it runs

Forms

Operation

Operands

Flags

Attributes

CPUID and processors

More System instructions

Sources

A swap, not a load#

Where it runs#

Forms

Operation

Operands

Flags

Attributes

CPUID and processors

More System instructions

Sources

A swap, not a load

Where it runs