swapgs

Swap GS Base Register

SWAPGS

Swaps user/kernel GS base address (System).

Details

Atomically exchanges the user-mode and kernel-mode FS base register values by swapping the contents of the MSR_FS_BASE and MSR_KERNEL_FS_BASE model-specific registers. This is a 64-bit only instruction used for efficient user/kernel context switching in system software. No flags are modified, and the operation serializes the instruction pipeline.

Pseudocode Operation

if (CODESIZE == 64 && CPL == 0) {
  temp ← MSR_FS_BASE;
  MSR_FS_BASE ← MSR_KERNEL_FS_BASE;
  MSR_KERNEL_FS_BASE ← temp;
}

Example

SWAPGS

Encoding

Binary Layout

Format Legacy

Opcode 0F 01 F8

Extension Base (64-bit System)

Operands

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
0F 01 F8	SWAPGS	ZO	Valid Invalid		Exchanges the current GS base register value with the IA32_KERNEL_GS_BASE MSR.

Description

SWAPGS exchanges the current GS base register value with the IA32_KERNEL_GS_BASE MSR (MSR address C0000102H). The SWAPGS instruction is a privileged instruction intended for use by system software. When using SYSCALL to implement system calls, there is no kernel stack at the OS entry point. Neither is there a straightforward method to obtain a pointer to kernel structures from which the kernel stack pointer could be read. Thus, the kernel cannot save general purpose registers or reference memory. By design, SWAPGS does not require any general purpose registers or memory operands. No registers need to be saved before using the instruction. SWAPGS exchanges the CPL 0 data pointer from the IA32_KERNEL_GS_BASE MSR with the GS base register. The kernel can then use the GS prefix on normal memory references to access kernel data structures. Similarly, when the OS kernel is entered using an interrupt or exception (where the kernel stack is already set up), SWAPGS can be used to quickly get a pointer to the kernel data structures. The IA32_KERNEL_GS_BASE MSR itself is only accessible using RDMSR/WRMSR instructions. Those instructions are only accessible at privilege level 0. The WRMSR instruction ensures that the IA32_KERNEL_GS_BASE MSR contains a canonical address. The instruction cannot be executed when FRED transitions are enabled. FRED transitions perform the same swap when changing the CPL.

Operation

IF CS.L ≠ 1 (* Not in 64-Bit Mode *) OR CR4.FRED = 1
THEN
#UD; FI;
IF CPL ≠ 0
THEN #GP(0); FI;
tmp := GS.base;
GS.base := IA32_KERNEL_GS_BASE;
IA32_KERNEL_GS_BASE := tmp;

Flags Affected

None.

Exceptions

Protected Mode Exceptions

#UD The SWAPGS instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD The SWAPGS instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The SWAPGS instruction is not recognized in virtual-8086 mode. SWAPGS—Swap GS Base Register Vol. 2B 4-696

Compatibility Mode Exceptions

#UD The SWAPGS instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#GP(0) If CPL ≠ 0. #UD If the LOCK prefix is used. If CR4.FRED = 1. SWAPGS—Swap GS Base Register Vol. 2B 4-697