XRSTORS instruction (XSAVES)

This instruction restores what XSAVES saved: the components that EDX:EAX AND (XCR0 OR IA32_XSS) selects, supervisor state included, from an area in the compacted format. It runs only at CPL 0. Component by component it does what XRSTOR does, whose page has the rules: a component whose XSTATE_BV bit is set is loaded from the area, one whose bit is clear is put in its initial state, and one outside the mask is left alone. AMD’s manual describes it as the compacted form of that instruction with those three differences.

Only the compacted format

XRSTOR reads either format and picks by bit 63 of XCOMP_BV; this one has no standard form and raises #GP(0) when that bit is clear. Its other checks of the header are those of XRSTOR in that format, with IA32_XSS counted in: #GP(0) for an XCOMP_BV bit not enabled in XCR0 OR IA32_XSS, an XSTATE_BV bit outside XCOMP_BV, or a nonzero byte in bytes 16 to 63 of the header. Since the compacted saves write only the first 16, those bytes must be zeroed when the buffer is set up.

A component asked for in the mask but missing from XCOMP_BV takes its initial state, as if its XSTATE_BV bit were clear; with SSE’s bit clear, MXCSR gets 1F80H.

Supervisor state

Supervisor components are loaded into MSRs, and the values are checked: a reserved bit set, or a value the MSR would refuse, raises #GP(0). Intel’s Volume 1 warns that after such a fault, or a VM exit, during or after a supervisor component, each part of that component may hold its old value, the value from the area or its initial value; a handler cannot assume that nothing changed.

Tracking and running it

Like any restore, it records the address, CPL, VMX mode and XCOMP_BV, which the modified optimization of the next save compares. A mask of 0 restores nothing and marks every component as modified, so that the next save writes all of them.

It raises #GP(0) at CPL above 0 and for an area not aligned to 64 bytes; the probe runs at CPL 3 and does not run it. _xrstors(p, mask) and _xrstors64 need -mxsaves in GCC 14 and Clang 23, and at -O2 emit the one instruction after splitting the mask into EDX:EAX. AMD’s Zen 5 guide lists it as microcoded.

Forms

Every encoding of XRSTORS that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`XRSTORS mem` XRSTORS_MEMmxsave	`NP 0F C7 /3`	XSAVES
`XRSTORS64 mem` XRSTORS64_MEMmxsave	`REX.W 0F C7 /3`	XSAVES

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
a = mem.address
if a % 64:
    fault(GP, 0)
on = xcr0 | xss                      # user and supervisor components
rfbm = (edx << 32 | eax) & on        # the components to restore
bv = load(a + 512, 64)               # XSTATE_BV
c = load(a + 520, 64)                # XCOMP_BV
std = 0                              # the compacted format only
bad = c >> 63 == 0 or c & ~(on | 1 << 63)
bad = bad or bv & ~c or load(a + 528, 384)
if bad:
    fault(GP, 0)
ld = rfbm & 6 if std else rfbm & bv & 2
mx = mxcsr
if ld:                               # MXCSR from the area: with SSE or
    mx = load(a + 24, 32)            # AVX in the standard format, with
    if mx & ~mxcsr_mask:             # SSE's data in the compacted
        fault(GP, 0)
elif rfbm & 2 and not std:
    mx = 0x1F80                      # initial, with SSE's registers
mxcsr = mx
if rfbm & bv & 1:                    # x87 state, as FXRSTOR loads it
    sw = load(a + 2, 16)
    t = sw >> 11 & 7                 # TOP from the area
    for i in range(8):
        v = load(a + 32 + 16 * i, 80)
        st[(t - top + i) % 8] = v
    tags = load(a + 4, 8)
    tw = 0
    for j in range(8):               # Rj empty where its bit is clear
        if not tags >> j & 1:
            tw |= 3 << 2 * j
    ftw = tw
    fcw = load(a, 16)
    fsw = sw
    fop = load(a + 6, 16)
    if OSIZE == 64:                  # REX.W: 64-bit offsets
        fip = load(a + 8, 64)
        fdp = load(a + 16, 64)
    else:
        fip = load(a + 8, 32)
        fcs = load(a + 12, 16)
        fdp = load(a + 16, 32)
        fds = load(a + 20, 16)
elif rfbm & 1:                       # x87 state initialized
    for i in range(8):
        st[i] = 0
    ftw = 0xFFFF                     # all empty
    fcw = 0x037F
    fsw = 0
    fop = fip = fcs = fdp = fds = 0
if rfbm & 2:                         # XMM0 to XMM15, or zeros
    b = a + 160
    for i in range(16):
        v = 0
        if bv & 2:
            v = load(b + 16 * i, 128)
        xmm[i] = v
if rfbm & 4:                         # AVX: bits 255:128
    b = a + xsave_offset(2, c)
    for i in range(16):
        v = 0
        if bv & 4:
            v = load(b + 16 * i, 128)
        ymm[i].dq[1] = v
if rfbm & 0x20:                      # AVX-512: k0 to k7
    b = a + xsave_offset(5, c)
    for i in range(8):
        v = 0
        if bv & 0x20:
            v = load(b + 8 * i, 64)
        opmask[i] = v
if rfbm & 0x40:                      # bits 511:256 of zmm0-15
    b = a + xsave_offset(6, c)
    for i in range(16):
        v = 0
        if bv & 0x40:
            v = load(b + 32 * i, 256)
        zmm[i].qq[1] = v
if rfbm & 0x80:                      # zmm16 to zmm31
    b = a + xsave_offset(7, c)
    for i in range(16):
        v = 0
        if bv & 0x80:
            v = load(b + 64 * i, 512)
        zmm[16 + i] = v
if rfbm & 0x200:                     # PKRU
    v = 0
    if bv & 0x200:
        v = load(a + xsave_offset(9, c), 32)
    pkru = v
# MPX's and AMX's components (3, 4, 17, 18) likewise, and the
# supervisor ones (PT, PASID, CET, ...) from their MSRs
u = xinuse & ~rfbm | bv & rfbm       # XINUSE as Zen 5's XRSTOR keeps it,
if mx != 0x1F80:                     # and as XGETBV reads it: SSE in use
    u |= 2                           # while MXCSR is not 1F80H
xinuse = u

Not run on a processor: XRSTORS runs at CPL 0 only.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`XRSTORS mem` `XRSTORS64 mem`
`mem`	explicit	read
`EDX`	implicit	read
`EAX`	implicit	read
`XCR0`	implicit	read

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: privileged: CPL 0 only; aligned memory operand; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`XSAVES` XSAVES	XSAVES `CPUID.(EAX=0DH,ECX=1):EAX[3]` XSAVES	Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Zen, Zen+, Zen 2, Zen 3, Zen 4, Zen 5, Zen 6

More XSAVES instructions

XSAVES

Only the compacted format#

Supervisor state#

Tracking and running it#