INCSSPD/INCSSPQ—Increment Shadow Stack Pointer

Opcode/

Op /

64/32

CPUID

Description

Instruction En bit Mode Support Feature Flag
F3 0F AE /05 INCSSPD r32 R V/V CET_SS Increment SSP by 4 * r32[7:0].
F3 REX.W 0F AE /05 INCSSPQ r64 R V/N.E. CET_SS Increment SSP by 8 * r64[7:0].

Instruction Operand Encoding

Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4
R NA ModRM:r/m (r) NA NA NA

Description

This instruction can be used to increment the current shadow stack pointer by the operand size of the instruction times the unsigned 8-bit value specified by bits 7:0 in the source operand. The instruction performs a pop and discard of the first and last element on the shadow stack in the range specified by the unsigned 8-bit value in bits 7:0 of the source operand.

Operation

IF CPL = 3
    IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0
         THEN #UD; FI;
ELSE
    IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0
         THEN #UD; FI;
FI;
IF (operand size is 64-bit)
    THEN
         TMP1 = (R64[7:0] == 0) ? 1 : R64[7:0]
         TMP = ShadowStackLoad8B(SSP)
         TMP = ShadowStackLoad8B(SSP + TMP1 * 8 - 8)
         SSP := SSP + R64[7:0] * 8;
    ELSE
         TMP1 = (R32[7:0] == 0) ? 1 : R32[7:0]
         TMP = ShadowStackLoad4B(SSP)
         TMP = ShadowStackLoad4B(SSP + TMP1 * 4 - 4)
         SSP := SSP + R32[7:0] * 4;
FI;

Flags Affected

None.

Intel C/C++ Compiler Intrinsic Equivalent

INCSSPD

void _incsspd(int);

INCSSPQ

void _incsspq(int);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#PF(fault-code) If a page fault occurs.

Real-Address Mode Exceptions

#UD The INCSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The INCSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.