INCSSPD/INCSSPQ - Increment Shadow Stack Pointer

Opcode/ Instruction

Op / En

64/32 bit Mode Support

CPUID Feature Flag

Description

F3 0F AE /05 INCSSPD r32

R

V/V

CET_SS

Increment SSP by 4 * r32[7:0].

F3 REX.W 0F AE /05 INCSSPQ r64

R

V/N.E.

CET_SS

Increment SSP by 8 * r64[7:0].

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

R

N/A

ModRM:r/m (r)

N/A

N/A

N/A

Description

This instruction can be used to increment the current shadow stack pointer by the operand size of the instruction times the unsigned 8-bit value specified by bits 7:0 in the source operand. The instruction performs a pop and discard of the first and last element on the shadow stack in the range specified by the unsigned 8-bit value in bits 7:0 of the source operand.

Operation 

IF CPL = 3
   IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0
       THEN #UD; FI;
ELSE
   IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0
       THEN #UD; FI;
FI;
IF (operand size is 64-bit)
   THEN
       Range := R64[7:0];
       shadow_stack_load 8 bytes from SSP;
       IF Range > 0
                   THEN shadow_stack_load 8 bytes from SSP + 8 * (Range - 1);
       FI;
       SSP := SSP + Range * 8;
   ELSE
       Range := R32[7:0];
       shadow_stack_load 4 bytes from SSP;
       IF Range > 0
                   THEN shadow_stack_load 4 bytes from SSP + 4 * (Range - 1);
       FI;
       SSP := SSP + Range * 4;
FI;

Flags Affected

None.

Intel C/C++ Compiler Intrinsic Equivalent 

INCSSPD void _incsspd(int);
INCSSPQ void _incsspq(int);

Protected Mode Exceptions

#UD

If the LOCK prefix is used. If CR4.CET = 0. IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#PF(fault-code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

The INCSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The INCSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.