Volume 3: General-Purpose and System Instructions - Stanford ...

AMD64 Technology 24594 Rev. 3.10 February 2005SYSCALLFast System CallTransfers control to a fixed entry point in an operating system. It is designed for useby system and application software implementing a flat-segment memory model.The SYSCALL and SYSRET instructions are low-latency system call and returncontrol-transfer instructions, which assume that the operating system implements aflat-segment memory model. By eliminating unneeded checks, and by loading predeterminedvalues into the CS and SS segment registers (both visible and hiddenportions), calls to and returns from the operating system are greatly simplified. Theseinstructions can be used in protected mode and are particularly well-suited for use in64-bit mode, which requires implementation of a paged, flat-segment memory model.This instruction has been optimized by reducing the number of checks and memoryreferences that are normally made so that a call or return takes considerably fewerclock cycles than the CALL FAR /RET FAR instruction method.It is assumed that the base, limit, and attributes of the Code Segment will remain flatfor all processes and for the operating system, and that only the current privilege levelfor the selector of the calling process should be changed from a current privilege levelof 3 to a new privilege level of 0. It is also assumed (but not checked) that the RPL ofthe SYSCALL and SYSRET target selectors are set to 0 and 3, respectively.SYSCALL sets the CPL to 0, regardless of the values of bits 33–32 of the STARregister. There are no permission checks based on the CPL, real mode, or virtual-8086mode. SYSCALL and SYSRET must be enabled by setting EFER.SCE to 1.It is the responsibility of the operating system to keep the descriptors in memory thatcorrespond to the CS and SS selectors loaded by the SYSCALL and SYSRETinstructions consistent with the segment base, limit, and attribute values forced bythese instructions.Legacy x86 Mode. In legacy x86 mode, when SYSCALL is executed, the EIP register iscopied into the ECX register. Bits 31–0 of the SYSCALL/SYSRET target addressregister (STAR) are copied into the EIP register. (The STAR register is model-specificregister C000_0081h.)New selectors are loaded, without permission checking (see above), as follows:• Bits 47–32 of the STAR register specify the selector that is copied into the CS register.• Bits 47–32 of the STAR register + 8 specify the selector that is copied into the SSregister.354 SYSCALL