SYSRET

SYSRET is the way back from a SYSCALL: at CPL 0 it jumps to the address in RCX, loads RFLAGS from R11 and enters CPL 3, with CS and SS selectors taken from bits 63:48 of the IA32_STAR MSR and descriptors that the processor fills in itself rather than reading the GDT, which the operating system must keep matching. RSP stays as it is, so the kernel loads the user’s stack pointer itself before SYSRET, or the program does after it.

Which mode it returns to#

With REX.W, SYSRET returns to 64-bit code at STAR[63:48] + 16; without it, to compatibility mode at STAR[63:48], with EIP from ECX. The mnemonic decides which: in our builds the GNU assembler rejects a bare sysret in Intel syntax and in AT&T syntax assembles it, with a warning, as the 32-bit 0F 07; Clang 23 assembles sysret as 0F 07 in both, silently. A 64-bit return needs sysretq (48 0F 07).

Where the manuals differ#

• A non-canonical RCX. Intel’s manual raises #GP(0) for it before leaving CPL 0, and warns that the handler then runs on whatever stack RSP holds, which may already be the user’s; it suggests checking RCX, using paging so that SYSCALL can never save such an address, or giving #GP a stack of its own through the IST. AMD’s manual lists no such check: its SYSRET sets CPL 3 and then loads RIP from RCX.
• SS. Intel’s forces the RPL of SS to 3 and loads a fixed flat data descriptor; AMD’s takes STAR[63:48] + 8 without forcing the RPL and leaves the hidden part of SS as it was.
• RFLAGS. Both clear RF and VM. Intel’s masks R11 with 3C7FD7H and sets bit 1; AMD’s loads bits 31:0 of R11 and clears the upper half.
• Outside 64-bit mode. AMD’s processors also run SYSRET in legacy protected mode, where it only sets IF of the flags; Intel’s raise #UD.

Where it runs#

SYSRET raises #UD while EFER.SCE is clear, and #GP(0) at any CPL but 0. Zen 5 recorded #GP for both forms at CPL 3. Intel’s manual adds that nothing after SYSRET executes, even speculatively, before everything ahead of it has completed. With FRED enabled it raises #UD, and the kernel returns with ERETU instead. AMD’s Zen 5 guide lists SYSRET as microcoded.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not efer & 1 or cr4 >> 32 & 1:
    fault(UD)                    # EFER.SCE clear, or CR4.FRED set
if CPL > 0:
    fault(GP, 0)
s = star >> 48                   # STAR[63:48]
if OSIZE == 64:                  # REX.W: back to 64-bit code
    if not canonical(rcx):
        fault(GP, 0)             # Intel's: at CPL 0. AMD's manual
                                 # has no such check
    rip = rcx
    cs = s + 16 | 3
else:                            # to compatibility mode
    rip = ecx
    cs = s | 3
ss = s + 8 | 3                   # AMD's manual: RPL as STAR has it,
                                 # and SS's descriptor unchanged
f = r11                          # RFLAGS from R11, but for RF and VM
cf = f & 1
pf = f >> 2 & 1
af = f >> 4 & 1
zf = f >> 6 & 1
sf = f >> 7 & 1
tf = f >> 8 & 1
if_ = f >> 9 & 1
df = f >> 10 & 1
of = f >> 11 & 1
iopl = f >> 12 & 3
nt = f >> 14 & 1
ac = f >> 18 & 1
vif = f >> 19 & 1
vip = f >> 20 & 1
id = f >> 21 & 1
rf = 0
# VM stays 0, as in 64-bit mode it always is; RSP stays too

if not efer & 1:
    fault(UD)                    # EFER.SCE clear
if CPL > 0:
    fault(GP, 0)
s = star >> 48                   # STAR[63:48]
rip = ecx                        # to 32-bit code
cs = s | 3
ss = s + 8                       # RPL as STAR has it
if_ = 1                          # the other flags stay
# Intel's processors raise #UD outside 64-bit mode

Operands

Flags

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; not in real-address mode

Forms only in 64-bit mode

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SYSCALL/SYSRET instructions

• SYSCALL