SYSENTER instruction (SYSENTER/SYSEXIT)

SYSENTER switches to privilege level 0 using three MSRs: IA32_SYSENTER_CS (174H) gives the kernel’s code segment, and the stack segment follows it in the GDT; IA32_SYSENTER_EIP (176H) the entry point; IA32_SYSENTER_ESP (175H) the kernel stack pointer. It saves neither the return address nor the user’s stack pointer, and it clears IF, so the kernel starts with interrupts off. Executed in IA-32e mode it enters 64-bit mode.

The caller must leave its return address and stack pointer where the kernel can find them. SYSEXIT returns to privilege level 3 at the address in RDX (EDX) with the stack pointer in RCX (ECX), to 32-bit code or, with REX.W, to 64-bit code. On 32-bit Linux a function of the vDSO wraps the pair, so programs never execute SYSENTER themselves (see the system call conventions). With FRED enabled, SYSENTER delivers an event like SYSCALL.

Forms

Every encoding of SYSENTER that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`SYSENTER` SYSENTER	`0F 34`	SEP

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`SYSENTER`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Lunar Lake	100 / 0.17p012345
Bonnell	100 / 0.5p01
Silvermont	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

c = sysenter_cs & 0xFFFC         # SYSENTER_CS[15:0], RPL 0
if c == 0:
    fault(GP, 0)                 # a null selector
if not canonical(sysenter_eip):
    fault(GP, 0)                 # as SYSCALL's LSTAR
vm = 0
if_ = 0
rf = 0                           # XED's; Intel's manual names VM and
                                 # IF only
cs = c                           # 64-bit code of DPL 0: CPL 0
ss = c + 8
rsp = sysenter_esp               # 64 bits, canonical
rip = sysenter_eip
# the return address is not saved. AMD's processors raise #UD in
# long mode, 64-bit and compatibility, where SYSCALL serves

Not run on a processor: on Intel's processors SYSENTER is a system call of the program that runs it, which the probe never makes.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`SYSENTER`
`RIP`	implicit	write
`RSP`	implicit	write
`RFLAGS`	implicit	write

Flags

0 cleared; blank: not affected. How to read.

IF	RF	VM
All forms
0	0	0

Attributes

What else XED records about the forms. How to read.

All forms: not in real-address mode; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`SEP` SYSENTER/SYSEXIT	SEP `CPUID.01H:EDX[11]` SEP	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More SYSENTER/SYSEXIT instructions

SYSEXIT