SYSEXIT instruction (SYSENTER/SYSEXIT)

Forms

Every encoding of SYSEXIT that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`SYSEXIT` SYSEXIT	`0F 35`	SEP

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`SYSEXIT`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Lunar Lake	100 / 0.17p012345
Bonnell	100 / 0.5p01
Silvermont	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if cr4 >> 32 & 1:
    fault(UD)                    # CR4.FRED
if CPL > 0 or sysenter_cs & 0xFFFC == 0:
    fault(GP, 0)
c = sysenter_cs & 0xFFFF
if OSIZE == 64:                  # REX.W: to 64-bit code
    if not canonical(rcx):
        fault(GP, 0)
    if not canonical(rdx):
        fault(GP, 0)
    rsp = rcx
    rip = rdx
    cs = c + 32 | 3
    ss = c + 40 | 3
else:                            # to 32-bit code: compatibility mode
    rsp = ecx
    rip = edx
    cs = c + 16 | 3
    ss = c + 24 | 3
# AMD's manual: #UD in long mode, 64-bit and compatibility. The
# Zen 5 guest that ran the probe raised #GP at CPL 3, probably
# KVM's answer: KVM emulates SYSEXIT on a #UD, and checks CPL first

Run on AMD Zen 5 (EPYC 9645): 2 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`SYSEXIT`
`RIP`	implicit	write
`RSP`	implicit	write
`RCX`	implicit	read
`RDX`	implicit	read

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: privileged: CPL 0 only; not in real-address mode; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`SEP` SYSENTER/SYSEXIT	SEP `CPUID.01H:EDX[11]` SEP	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More SYSENTER/SYSEXIT instructions

SYSENTER