Volume 3: General-Purpose and System Instructions - Stanford ...
Volume 3: General-Purpose and System Instructions - Stanford ... Volume 3: General-Purpose and System Instructions - Stanford ...
AMD64 Technology 24594 Rev. 3.10 February 2005SYSCALLFast System CallTransfers control to a fixed entry point in an operating system. It is designed for useby system and application software implementing a flat-segment memory model.The SYSCALL and SYSRET instructions are low-latency system call and returncontrol-transfer instructions, which assume that the operating system implements aflat-segment memory model. By eliminating unneeded checks, and by loading predeterminedvalues into the CS and SS segment registers (both visible and hiddenportions), calls to and returns from the operating system are greatly simplified. Theseinstructions can be used in protected mode and are particularly well-suited for use in64-bit mode, which requires implementation of a paged, flat-segment memory model.This instruction has been optimized by reducing the number of checks and memoryreferences that are normally made so that a call or return takes considerably fewerclock cycles than the CALL FAR /RET FAR instruction method.It is assumed that the base, limit, and attributes of the Code Segment will remain flatfor all processes and for the operating system, and that only the current privilege levelfor the selector of the calling process should be changed from a current privilege levelof 3 to a new privilege level of 0. It is also assumed (but not checked) that the RPL ofthe SYSCALL and SYSRET target selectors are set to 0 and 3, respectively.SYSCALL sets the CPL to 0, regardless of the values of bits 33–32 of the STARregister. There are no permission checks based on the CPL, real mode, or virtual-8086mode. SYSCALL and SYSRET must be enabled by setting EFER.SCE to 1.It is the responsibility of the operating system to keep the descriptors in memory thatcorrespond to the CS and SS selectors loaded by the SYSCALL and SYSRETinstructions consistent with the segment base, limit, and attribute values forced bythese instructions.Legacy x86 Mode. In legacy x86 mode, when SYSCALL is executed, the EIP register iscopied into the ECX register. Bits 31–0 of the SYSCALL/SYSRET target addressregister (STAR) are copied into the EIP register. (The STAR register is model-specificregister C000_0081h.)New selectors are loaded, without permission checking (see above), as follows:• Bits 47–32 of the STAR register specify the selector that is copied into the CS register.• Bits 47–32 of the STAR register + 8 specify the selector that is copied into the SSregister.354 SYSCALL
24594 Rev. 3.10 February 2005 AMD64 Technology• The CS_base and the SS_base are both forced to zero.• The CS_limit and the SS_limit are both forced to 4 Gbyte.• The CS segment attributes are set to execute/read 32-bit code with a CPL of zero.• The SS segment attributes are set to read/write and expand-up with a 32-bit stackreferenced by ESP.Long Mode. When long mode is activated, the behavior of the SYSCALL instructiondepends on whether the calling software is in 64-bit mode or compatibility mode. In64-bit mode, SYSCALL saves the RIP of the instruction following the SYSCALL intoRCX and loads the new RIP from LSTAR bits 63–0. (The LSTAR register is modelspecificregister C000_0082h.) In compatibility mode, SYSCALL saves the RIP of theinstruction following the SYSCALL into RCX and loads the new RIP from CSTAR bits63–0. (The CSTAR register is model-specific register C000_0083h.)New selectors are loaded, without permission checking (see above), as follows:• Bits 47–32 of the STAR register specify the selector that is copied into the CS register.• Bits 47–32 of the STAR register + 8 specify the selector that is copied into the SSregister.• The CS_base and the SS_base are both forced to zero.• The CS_limit and the SS_limit are both forced to 4 Gbyte.• The CS segment attributes are set to execute/read 64-bit code with a CPL of zero.• The SS segment attributes are set to read/write and expand-up with a 64-bit stackreferenced by RSP.The WRMSR instruction loads the target RIP into the LSTAR and CSTAR registers. Ifan RIP written by WRMSR is not in canonical form, a general-protection exception(#GP) occurs.How SYSCALL and SYSRET handle rFLAGS, depends on the processor’s operatingmode.In legacy mode, SYSCALL treats EFLAGS as follows:• EFLAGS.IF is cleared to 0.• EFLAGS.RF is cleared to 0.• EFLAGS.VM is cleared to 0.In long mode, SYSCALL treats RFLAGS as follows:• The current value of RFLAGS is saved in R11.• RFLAGS is masked using the value stored in SYSCALL_FLAG_MASK.SYSCALL 355
- Page 334 and 335: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 336 and 337: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 338 and 339: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 340 and 341: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 342 and 343: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 344 and 345: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 346 and 347: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 348 and 349: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 350 and 351: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 352 and 353: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 354 and 355: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 356 and 357: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 358 and 359: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 360 and 361: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 362 and 363: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 364 and 365: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 366 and 367: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 368 and 369: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 370 and 371: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 372 and 373: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 374 and 375: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 376 and 377: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 378 and 379: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 380 and 381: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 382 and 383: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 386 and 387: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 388 and 389: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 390 and 391: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 392 and 393: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 394 and 395: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 396 and 397: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 398 and 399: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 400 and 401: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 402 and 403: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 404 and 405: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 406 and 407: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 408 and 409: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 410 and 411: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 412 and 413: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 414 and 415: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 416 and 417: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 418 and 419: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 420 and 421: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 422 and 423: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 424 and 425: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 426 and 427: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 428 and 429: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 430 and 431: AMD64 Technology 24594 Rev. 3.10 Fe
- Page 432 and 433: AMD64 Technology 24594 Rev. 3.10 Fe
AMD64 Technology 24594 Rev. 3.10 February 2005SYSCALLFast <strong>System</strong> CallTransfers control to a fixed entry point in an operating system. It is designed for useby system <strong>and</strong> application software implementing a flat-segment memory model.The SYSCALL <strong>and</strong> SYSRET instructions are low-latency system call <strong>and</strong> returncontrol-transfer instructions, which assume that the operating system implements aflat-segment memory model. By eliminating unneeded checks, <strong>and</strong> by loading predeterminedvalues into the CS <strong>and</strong> SS segment registers (both visible <strong>and</strong> hiddenportions), calls to <strong>and</strong> returns from the operating system are greatly simplified. Theseinstructions can be used in protected mode <strong>and</strong> are particularly well-suited for use in64-bit mode, which requires implementation of a paged, flat-segment memory model.This instruction has been optimized by reducing the number of checks <strong>and</strong> memoryreferences that are normally made so that a call or return takes considerably fewerclock cycles than the CALL FAR /RET FAR instruction method.It is assumed that the base, limit, <strong>and</strong> attributes of the Code Segment will remain flatfor all processes <strong>and</strong> for the operating system, <strong>and</strong> that only the current privilege levelfor the selector of the calling process should be changed from a current privilege levelof 3 to a new privilege level of 0. It is also assumed (but not checked) that the RPL ofthe SYSCALL <strong>and</strong> SYSRET target selectors are set to 0 <strong>and</strong> 3, respectively.SYSCALL sets the CPL to 0, regardless of the values of bits 33–32 of the STARregister. There are no permission checks based on the CPL, real mode, or virtual-8086mode. SYSCALL <strong>and</strong> SYSRET must be enabled by setting EFER.SCE to 1.It is the responsibility of the operating system to keep the descriptors in memory thatcorrespond to the CS <strong>and</strong> SS selectors loaded by the SYSCALL <strong>and</strong> SYSRETinstructions consistent with the segment base, limit, <strong>and</strong> attribute values forced bythese instructions.Legacy x86 Mode. In legacy x86 mode, when SYSCALL is executed, the EIP register iscopied into the ECX register. Bits 31–0 of the SYSCALL/SYSRET target addressregister (STAR) are copied into the EIP register. (The STAR register is model-specificregister C000_0081h.)New selectors are loaded, without permission checking (see above), as follows:• Bits 47–32 of the STAR register specify the selector that is copied into the CS register.• Bits 47–32 of the STAR register + 8 specify the selector that is copied into the SSregister.354 SYSCALL
Change language