XSAVES

XSAVES, the operating system’s save of extended state, writes the compacted format of XSAVEC, whose page describes the layout, with two additions, and runs only at CPL 0:

• Supervisor state. The requested-feature bitmap is EDX:EAX AND (XCR0 OR IA32_XSS). XCR0, which XSETBV writes, enables the user components, those a program may save itself; IA32_XSS (MSR DA0H) enables the supervisor components, which only this instruction and XRSTORS handle. Intel’s list has Processor Trace (8), PASID (10), the user and supervisor shadow-stack registers (11 and 12), HDC (13), user interrupts (14), LBRs (15) and HWP (16); AMD’s Volume 2 defines only bits 11 and 12, CET_U and CET_S. Their state lives in MSRs, saved here without a RDMSR for each.
• The modified optimization. It may skip a component that has not changed since the last compacted restore from the same address, at the same CPL, in the same VMX mode and with the same XCOMP_BV. A kernel that restores a thread’s state from its buffer and later saves it back to the same buffer gets both optimizations at once.

It skips components in their initial state too, sets XCOMP_BV to RFBM with bit 63, and writes no other part of the header.

Sizing the buffer#

CPUID leaf 0DH, sub-leaf 1, reports this instruction, XRSTORS and IA32_XSS together in EAX bit 3, and every processor with them also has the compacted format. EBX then gives the size of an area holding every component enabled in XCR0 OR IA32_XSS, and ECX and EDX list the supervisor components that IA32_XSS may enable. For a supervisor component, sub-leaf i gives the size in EAX, 0 in EBX, since it has no offset in the standard format, and sets ECX bit 0. The Zen 5 behind the recorded cases reports them, with EAX = FH in sub-leaf 1.

Faults and running it#

It raises #GP(0) at CPL above 0 and for an area not aligned to 64 bytes, #UD with CR4.OSXSAVE clear and #NM with CR0.TS set. The probe runs at CPL 3 and does not run it. GCC 14 and Clang 23 have _xsaves(p, mask) and _xsaves64 with -mxsaves; at -O2 they split the mask into EDX:EAX and emit the one instruction. AMD’s Zen 5 guide lists it as microcoded.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
a = mem.address
if a % 64:
    fault(GP, 0)
on = xcr0 | xss                      # user and supervisor components
rfbm = (edx << 32 | eax) & on        # the components to save
s = rfbm & xinuse                    # the ones in use, which it saves
if rfbm & 2 and mxcsr != 0x1F80:     # SSE too where MXCSR is not its
    s |= 2                           # initial 1F80H
c = 1 << 63 | rfbm                   # XCOMP_BV: compacted, RFBM's
store(a + 512, 64, s)                # XSTATE_BV
store(a + 520, 64, c)
if s & 1:                            # x87 state
    t = 0
    for j in range(8):
        if ftw >> 2 * j & 3 != 3:    # Rj not empty
            t |= 1 << j
    k = fsw >> 7 & 1                 # ES: as Zen 5's XSAVE, the pointers
    store(a, 16, fcw)                # are zeros without it
    store(a + 2, 16, fsw)
    store(a + 4, 16, t)
    store(a + 6, 16, fop * k)
    if OSIZE == 64:                  # REX.W: 64-bit offsets
        store(a + 8, 64, fip * k)
        store(a + 16, 64, fdp * k)
    else:
        store(a + 8, 32, fip * k)
        store(a + 12, 32, fcs * k)
        store(a + 16, 32, fdp * k)
        store(a + 20, 32, fds * k)
    for i in range(8):
        store(a + 32 + 16 * i, 128, st[i])
if s & 2:                            # SSE: MXCSR and its mask, XMM0
    store(a + 24, 32, mxcsr)         # to XMM15
    store(a + 28, 32, mxcsr_mask)
    for i in range(16):
        store(a + 160 + 16 * i, 128, xmm[i])
if s & 4:                            # AVX: bits 255:128
    b = a + xsave_offset(2, c)
    for i in range(16):
        v = ymm[i].dq[1]
        store(b + 16 * i, 128, v)
if s & 0x20:                         # AVX-512: k0 to k7
    b = a + xsave_offset(5, c)
    for i in range(8):
        store(b + 8 * i, 64, opmask[i])
if s & 0x40:                         # bits 511:256 of zmm0-15
    b = a + xsave_offset(6, c)
    for i in range(16):
        v = zmm[i].qq[1]
        store(b + 32 * i, 256, v)
if s & 0x80:                         # zmm16 to zmm31
    b = a + xsave_offset(7, c)
    for i in range(16):
        store(b + 64 * i, 512, zmm[16 + i])
if s & 0x200:                        # PKRU, in 4 of its 8 bytes (Zen 5's XSAVE)
    store(a + xsave_offset(9, c), 32, pkru)
# MPX's and AMX's components (3, 4, 17, 18) likewise, and the
# supervisor ones (PT, PASID, CET, ...) from their MSRs. It may also
# leave out a component that has not changed since an XRSTORS from
# the same area, as the processor tracks it

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; aligned memory operand; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More XSAVES instructions

• XRSTORS