XRSTOR

Restore Processor Extended States

Opcodes

Hex Mnemonic Encoding Long Mode Legacy Mode Description
REX.W+ 0F AE /5 XRSTOR64 mem A Valid N.E. Restore processor extended states from memory. The states are specified by EDX:EAX
0F AE /5 XRSTOR mem A Valid Valid Restore processor extended states from memory. The states are specified by EDX:EAX

Instruction Operand Encoding

Op/En Operand 0 Operand 1 Operand 2 Operand 3
A NA NA NA ModRM:r/m (r)

Description

Performs a full or partial restore of the enabled processor states using the state information stored in the memory address specified by the source operand. The implicit EDX:EAX register pair specifies a 64-bit restore mask.

The format of the XSAVE/XRSTOR area is shown in Table 4-18. The memory layout ofthe XSAVE/XRSTOR area may have holes between save areas written by the processor as a result of the processor not supporting certain processor extended states or system software not supporting certain processor extended states.

General Layout of the XSAVE/XRSTOR Save Area
Save Areas Offset (Byte) Size (Bytes)
FPU/SSE SaveArea1 0 512
Header 512 64
Reserved (Ext_Save_Area_2) CPUID.(EAX=0DH, ECX=2):EBX CPUID.(EAX=0DH, ECX=2):EAX
Reserved(Ext_Save_A rea_3) CPUID.(EAX=0DH, ECX=3):EBX CPUID.(EAX=0DH, ECX=3):EAX
Reserved(Ext_Save_A rea_4) CPUID.(EAX=0DH, ECX=4):EBX CPUID.(EAX=0DH, ECX=4):EAX
Reserved(...) ... ...

XRSTOR operates on each subset of the processor state or a processor extended state in one of three ways (depending on the corresponding bit in the XFEATURE_ENABLED_MASK register (XCR0), the restore mask EDX:EAX, and the save mask XSAVE.HEADER.XSTATE_BV in memory):

The format of the header section (XSAVE.HEADER) of the XSAVE/XRSTOR area is shown in the following table.

XSAVE.HEADER Layout
15 8 7 0 Byte Offset from Header Byte Offset from XSAVE/XRSTOR Area
Rsrvd (Must be 0) XSTATE_BV 0 512
Reserved Rsrvd (Must be 0) 16 528
Reserved Reserved 32 544
Reserved Reserved 48 560

If a processor state component is not enabled in XCR0 but the corresponding save mask bit in XSAVE.HEADER.XSTATE_BV is 1, an attempt to execute XRSTOR will cause a #GP(0) exception. Software may specify all 1's in the implicit restore mask EDX:EAX, so that all the enabled processors states in XCR0 are restored from state information stored in memory or from processor supplied values.

An attempt to restore processor states with writing 1s to reserved bits in certain registers (see Table 4-21) will cause a #GP(0) exception.

Because bit 63 of the XFEATURE_ENABLED_MASK register is reserved for future bit vector expansion, it will not be used for any future processor state feature, and XRSTOR will ignore bit 63 of EDX:EAX (EDX[31].

Processor Supplied Init Values XRSTOR May Use
Processor State Component Processor Supplied Register Values
x87 FPU State FCW = 037FH; FTW = 0FFFFH; FSW = 0H; FPU CS = 0H; FPU DS = 0H; FPU IP = 0H; FPU DP = 0; ST0-ST7 = 0;
SSE State1 If 64-bit Mode: XMM0-XMM15 = 0H; Else XMM0-XMM7 = 0H
Reserved Bit Checking and XRSTOR
Processor State Component Reserved Bit Checking
X87 FPU State None
SSE State Reserved bits of MXCSR

A source operand not aligned to 64-byte boundary (for 64-bit and 32-bit modes) will result in a general-protection (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored.

Pseudo Code

/* The alignment of the x87 and SSE fields in the XSAVE area is the same as in FXSAVE area*/
RS_TMP_MASK[62:0] = (EDX[30:0] << 32) OR EAX[31:0];
ST_TMP_MASK[62:0] = SRCMEM.HEADER.XSTATE_BV[62:0];
IF (((XCR0[62:0] XOR 7FFFFFFF_FFFFFFFFH) AND ST_TMP_MASK[62:0]))
	#GP(0)
ELSE
	FOR i = 0, 62 STEP 1
		IF (RS_TMP_MASK[i] and XCR0[i])
			IF (ST_TMP_MASK[i]) CASE (i) OF
				0: Processor state[x87 FPU] = SRCMEM. FPUSSESave_Area[FPU];
				1: Processor state[SSE] = SRCMEM. FPUSSESave_Area[SSE];
				(* MXCSR is loaded as part of the SSE state DEFAULT: // i corresponds to a valid sub-leaf index of CPUID leaf 0DH Processor state[i] = SRCMEM. Ext_Save_Area[i]; *)
			ESAC;
			ELSE
				Processor extended state[i] = Processor supplied values; (see
				Table 4-20
				) CASE (i) OF
				1: MXCSR = SRCMEM. FPUSSESave_Area[SSE];
			ESAC;
			FI;
		FI;
		NEXT;
FI;

Flags Affected

None.

Exceptions

64-Bit Mode Exceptions

Exception Description
#AC If this exception is disabled a general protection exception (#GP) is signaled if the memory operand is not aligned on a 16-byte boundary, as described above. If the alignment check exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may vary with implementation, as follows. In all implementations where #AC is not signaled, a general protection exception is signaled in its place. In addition, the width of the alignment check may also vary with implemen tation. For instance, for a given implementation, an alignment check exception might be signaled for a 2-byte misalignment, whereas a general protection exception might be signaled for all other misalignments (4-, 8-, or 16-byte misalignments).
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. If CR4.OSXSAVE[bit 18] = 0. If the LOCK prefix is used. If 66H, F3H or F2H prefix is used.
#NM If CR0.TS[bit 3] = 1.
#PF(fault-code) If a page fault occurs.
#SS(0) If a memory address referencing the SS segment is in a non- canonical form.
#GP(0) If the memory address is in a non-canonical form. If a memory operand is not aligned on a 64-byte boundary, regardless of segment. If a bit in XCR0 is 0 and the corresponding bit in XSAVE.HEADER.XSTATE_BV is 1. If bytes 23:8 of HEADER is not zero. If attempting to write any reserved bits of the MXCSR register with 1.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in Protected Mode.

Real-Address Mode Exceptions

Exception Description
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. If CR4.OSXSAVE[bit 18] = 0. If the LOCK prefix is used. If 66H, F3H or F2H prefix is used.
#NM If CR0.TS[bit 3] = 1.
#GP If a memory operand is not aligned on a 64-byte boundary, regardless of segment. If any part of the operand lies outside the effective address space from 0 to FFFFH. If a bit in XCR0 is 0 and the corresponding bit in HEADER.XSTATE_BV field of the source operand is 1. If bytes 23:8 of HEADER is not zero. If attempting to write any reserved bits of the MXCSR register with 1.

Protected Mode Exceptions

Exception Description
#AC If this exception is disabled a general protection exception (#GP) is signaled if the memory operand is not aligned on a 16 byte boundary, as described above. If the alignment check exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may vary with implementation, as follows. In all implementations where #AC is not signaled, a general protection exception is signaled in its place. In addition, the width of the alignment check may also vary with implemen tation. For instance, for a given implementation, an alignment check exception might be signaled for a 2-byte misalignment, whereas a general protection exception might be signaled for all other misalignments (4-, 8-, or 16-byte misalignments).
#UD If CPUID.01H:ECX.XSAVE[bit 26] = 0. If CR4.OSXSAVE[bit 18] = 0. If the LOCK prefix is used. If 66H, F3H or F2H prefix is used.
#NM If CR0.TS[bit 3] = 1.
#PF(fault-code) If a page fault occurs.
#SS(0) If a memory operand effective address is outside the SS segment limit.
#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If a memory operand is not aligned on a 64-byte boundary, regardless of segment. If a bit in XCR0 is 0 and the corresponding bit in HEADER.XSTATE_BV field of the source operand is 1. If bytes 23:8 of HEADER is not zero. If attempting to write any reserved bits of the MXCSR register with 1.