NASM 2.05 based x86 Instruction Reference[ch341]
A.5.315 SYSEXIT: Fast Return From System Call SYSEXIT ; 0F 35 [P6,PRIV] SYSEXIT executes a fast return to privilege level 3 user code. This instruction is a companion instruction to the SYSENTER instruction, and can only be executed by privilege level 0 code. Various registers need to be set up before calling this instruction: - SYSENTER_CS_MSR contains the 32-bit segment selector for the privilege level 0 code segment in which the processor is currently executing. (This value is used to compute the segment selectors for the privilege level 3 code and stack segments.) - EDX contains the 32-bit offset into the privilege level 3 code segment to the first instruction to be executed in the user code. - ECX contains the 32-bit stack pointer for the privilege level 3 stack. SYSEXIT performs the following sequence of operations: - Adds 16 to the value in SYSENTER_CS_MSR and loads the sum into the CS selector register. - Loads the instruction pointer from the EDX register into the EIP register. - Adds 24 to the value in SYSENTER_CS_MSR and loads the sum into the SS selector register. - Loads the stack pointer from the ECX register into the ESP register. - Switches to privilege level 3. - Begins executing the user code at the EIP address. For more information on the use of the SYSENTER and SYSEXIT instructions, see the Intel Architecture Software Developer's Manual, Volume 2.