clrssbsy

Clear Shadow Stack Busy Flag

CLRSSBSY m64

Clears the busy flag in the shadow stack token.

Details

Clears the busy flag (bit 0) of a shadow stack token located at the memory address specified by the operand. This instruction is part of Control-flow Enforcement Technology (CET) Shadow Stack and is used to mark a shadow stack token as no longer busy (e.g., after an exception handler has completed). ZF is set to 0 on success or 1 if the token address is misaligned or the token is invalid.

Pseudocode Operation

token_addr ← m64
if (token_addr is misaligned or not_valid_token) {
  ZF ← 1
} else {
  [token_addr] ← [token_addr] & ~(1)  // Clear bit 0
  ZF ← 0
}

Example

CLRSSBSY [rbp-8]

Encoding

Binary Layout

ModRM

Format Legacy

Opcode F3 0F AE /6

Extension CET-SS

Operands

token
Mem

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 0F AE /6	CLRSSBSY m64	M	V/V	CET_SS	Clear busy flag in supervisor shadow stack token reference by m64.

Description

Clear busy flag in supervisor shadow stack token reference by m64. Subsequent to marking the shadow stack as not busy the SSP is loaded with value 0. This instruction cannot be executed when FRED transitions are enabled. FRED transitions do not use supervisor shadow stack tokens.

Operation

IF CR4.CET = 0 OR CR4.FRED = 1
THEN #UD; FI;

IF IA32_S_CET.SH_STK_EN = 0
THEN #UD; FI;

IF CPL > 0
THEN GP(0); FI;

SSP_LA = Linear_Address(mem operand)
IF SSP_LA not aligned to 8 bytes
THEN #GP(0); FI;
expected_token_value = SSP_LA | BUSY_BIT  (* busy bit - bit position 0 - must be set *)
new_token_value = SSP_LA                     (* Clear the busy bit *)
IF shadow_stack_lock_cmpxchg8b(SSP_LA, new_token_value, expected_token_value) != expected_token_value
invalid_token := 1; FI

(* Set the CF if invalid token was detected *)
RFLAGS.CF = (invalid_token == 1) ? 1 : 0;
RFLAGS.ZF,PF,AF,OF,SF := 0;
SSP := 0

Flags Affected

CF is set if an invalid token was detected, else it is cleared. ZF, PF, AF, OF, and SF are cleared. CLRSSBSY—Clear Busy Flag in a Supervisor Shadow Stack Token Vol. 2A 3-150

Exceptions

Protected Mode Exceptions

#UD If the LOCK prefix is used. If CR4.CET = 0. IF IA32_S_CET.SH_STK_EN = 0. #GP(0) If memory operand linear address not aligned to 8 bytes. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If destination is located in a non-writable segment. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. If CPL is not 0. #SS(0) If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs.

Real-Address Mode Exceptions

#UD The CLRSSBSY instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The CLRSSBSY instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD If the LOCK prefix is used. If CR4.CET = 0. IF IA32_S_CET.SH_STK_EN = 0. If CR4.FRED = 1. #GP(0) If memory operand linear address not aligned to 8 bytes. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If destination is located in a non-writable segment. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. If CPL is not 0. #SS(0) If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs.

64-Bit Mode Exceptions

#UD If the LOCK prefix is used. If CR4.CET = 0. If CR4.FRED = 1. IF IA32_S_CET.SH_STK_EN = 0. #GP(0) If memory operand linear address not aligned to 8 bytes. If CPL is not 0. If the memory address is in a non-canonical form. #SS(0) If a memory address referencing the SS segment is in a non-canonical form. #PF(fault-code) If a page fault occurs. CLRSSBSY—Clear Busy Flag in a Supervisor Shadow Stack Token Vol. 2A 3-151