Skip to content

ERETS

Jump to bottom
Henk-Jan Lebbink edited this page Jun 4, 2026 · 1 revision

ERETS — Event Return to Supervisor

Opcode Instruction Op/ En 64-Bit Mode Compat/ Leg Mode Description
F2 0F 01 CA ERETS ZO Valid Invalid Event return for events occurring in ring 0.

Instruction Operand Encoding

Op/En Operand 1 Operand 2 Operand 3 Operand 4
ZO N/A N/A N/A N/A

Description

ERETS returns from an event handler, establishing the state based on the contents of the stack (typically, that which was in effect before FRED event delivery). ERETS can be executed only if CPL = 0, and it does not change CPL. For this reason, ERETS is used to return from handling events that occurred while CPL = 0.

ERETS takes no explicit arguments; its operation depends on the contents of the regular stack and (when enabled) the shadow stack.

Execution of ERETS causes an invalid-opcode exception (#UD) if FRED transitions are not enabled or if CPL > 0. For this reason, ERETS can be executed only in 64-bit mode.

Section 8.4.1, “ERETS (Event Return to Supervisor),” of the Intel® 64 and IA-32 Architectures software devel-oper’s Manual, Volume 3 includes a detailed discussion of ERETS.

Instruction ordering. Instructions following execution of ERETS may be fetched from memory before earlier instructions complete execution, but they will not execute (even speculatively) until all instructions prior to ERETS have completed execution (the later instructions may execute before data stored by the earlier instructions have become globally visible).

Operation

IF CR4.FRED = 0 OR CPL > 0
    THEN #UD;
FI;
// CR4.FRED = 1 and CPL = 0 implies IA32_EFER.LMA = CS.L = 1
// pop old state from regular stack and check it
RSP ← RSP + 8;
                        // skip over error code so that RSP references the return state
pop8B newRIP;
pop8B tempCS;
                        // not used to load CS
pop8B newRFLAGS;
pop8B newRSP;
pop8B tempSS;
                        // not used to load SS
IF newRIP is not paging canonical OR
    tempCS & FFFFFFFF_FFF8FFFFH ≠ current CS selector OR
    newRFLAGS & FFFFFFFF_FFC2802AH ≠ 2 OR
                            // enforce bit 1 set; VM, reserved bits clear
    tempSS & FFF8FFFFH ≠ current SS selector OR
                            // do not check bits 63:32
        THEN #GP(0);
FI;
// ERETS will not numerically increase stack level
newCSL ← min{CSL,tempCS[17:16]};
IBT_restore ← tempCS[18];
STI_block ← tempSS[16];
pend_DB ← tempSS[17];
NMI_unblock ← tempSS[18];
// If supervisor shadow stacks are enabled, pop and check values from the shadow stack
IF CR4.CET = 1 AND IA32_S_CET.SH_STK_EN = 1
    THEN
        IF SSP & 7 ≠ 0
                            // require 8-byte alignment
            THEN #CP(FAR-RET/IRET);
        FI;
        popSS_8B newSSP;
        popSS_8B checkSSLIP;
        popSS_8B checkSSCS;
        IF checkSSCS ≠ tempCS
                            // 64-bit compare
            OR checkSSLIP ≠ newRIP
            OR newSSP & 3H ≠ 0
            THEN #CP(FAR-RET/IRET);
        FI;
        IF newSSP not CPU canonical
            THEN #GP(0);
        FI;
        // If the stack level is changing, compare SSP to the FRED SSP MSR for the old stack level
        IF newCSL < CSL AND IA32_FRED_SSPi ≠ SSP // where i = CSL
            THEN #CP(FAR-RET/IRET);
        FI;
FI;
// update registers for return state
RIP ← newRIP;
RFLAGS ← newRFLAGS;
                            // ERETS can set RFLAGS.RF to 1
RSP ← newRSP;
CSL ← newCSL;
                            // reflect in IA32_FRED_CONFIG[1:0]
IF CR4.CET = 1 AND IA32_S_CET.SH_STK_EN = 1
    THEN SSP ← newSSP;
FI;
IF CR4.CET = 1 AND IA32_S_CET.ENDBR_EN = 1 AND IA32_S_CET.SUPPRESS = 0 AND IBT_restore = 1
    THEN IA32_S_CET.TRACKER ← 1;
FI;
// update event-related state
IF STI_block = 1 AND RFLAGS.IF = 1 AND STI blocking was not in effect prior to ERETS
    THEN establish STI blocking after ERETS;
FI;
IF pend_DB = 1 AND RFLAGS.TF =1
    THEN pend a single-step debug exception (#DB) to be delivered after ERETS;
FI;
IF NMI_unblock = 1
    THEN unblock NMIs;
FI;

Flags Affected

All defined flags and fields in the RFLAGS register are potentially modified except for the VM flag.

Protected Mode Exceptions

#UD The ERETS instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD The ERETS instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The ERETS instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD The ERETS instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD If CR4.FRED = 0. If CPL > 0. If the LOCK prefix is used.

#GP(0) If the RIP image on the stack is a not paging canonical. If the RFLAGS image on the stack sets reserved bits or the VM bit (or fails to set bit 1). If bits 15:0 of the CS image on the stack differs from the value of the current CS selector. If the CS image on the stack sets undefined bits (bits 63:19). If bits 15:0 of the SS image on the stack differs from the value of the current SS selector. If the SS image on the stack sets undefined bits (bits 31:19). If the SSP image on the shadow stack is not CPU canonical. If a shadow-stack access would use an address that is not paging canonical or would cause a LASS violation.

#SS(0) If an ordinary stack access would use an address that is not paging canonical or would cause a LASS violation.

#CP(FAR-RET/IRET)If the address in SSP is not 8-byte aligned. If the 64-bit CS image on the shadow stack differs from that on the regular stack. If the SSLIP image on the shadow stack differs from the RIP image on the regular stack. If the SSP image on the shadow stack is not 4-byte aligned. If the CSL is i, the stack level is changing, and SSP differs from the value of IA32_FRED_SSPi.

Source: Intel® 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes (Order Number 325462-091US, March 2026)
Generated: 7-6-2026

Clone this wiki locally