incsspq

Increment Shadow Stack Pointer (Quadword)

INCSSPQ r64

Adjusts the shadow stack pointer.

Details

Increment Shadow Stack Pointer by the value in a 64-bit register. Adjusts the shadow stack pointer (SSP) forward by the count specified in the source register, typically used to skip multiple shadow stack entries or adjust SSP during context switching. No flags are affected. Requires CET-SS capability; 64-bit mode only.

Pseudocode Operation

SSP ← SSP + src

Example

INCSSPQ rax

Encoding

Binary Layout
F3
+0
0F
+1
AE
+2
ModRM
+3
 
Format Legacy
Opcode F3 REX.W 0F AE /5
Extension CET-SS

Operands

  • dest
    64-bit general-purpose register (e.g. RAX)

Reference (Intel® SDM)

Instruction Forms

Opcode Instruction Op/En 64/32-bit Mode CPUID Description
F3 0F AE /5 INCSSPD r32 R V/V CET_SS Increment SSP by 4 * r32[7:0].
F3 REX.W 0F AE /5 INCSSPQ r64 R V/N.E. CET_SS Increment SSP by 8 * r64[7:0].

Description

This instruction can be used to increment the current shadow stack pointer by the operand size of the instruction times the unsigned 8-bit value specified by bits 7:0 in the source operand. The instruction performs a pop and discard of the first and last element on the shadow stack in the range specified by the unsigned 8-bit value in bits 7:0 of the source operand.

Operation

IF CPL = 3
IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0
THEN #UD; FI;
ELSE
IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0
THEN #UD; FI;
FI;

IF (operand size is 64-bit)
THEN
Range := R64[7:0];
shadow_stack_load 8 bytes from SSP;
IF Range > 0
THEN shadow_stack_load 8 bytes from SSP + 8 * (Range - 1);
FI;
SSP := SSP + Range * 8;
ELSE
Range := R32[7:0];
shadow_stack_load 4 bytes from SSP;
IF Range > 0
THEN shadow_stack_load 4 bytes from SSP + 4 * (Range - 1);
FI;
SSP := SSP + Range * 4;
FI;

Intel C/C++ Compiler Intrinsic Equivalent

INCSSPD void _incsspd(int);
INCSSPQ void _incsspq(int);
INCSSPD/INCSSPQ—Increment Shadow Stack Pointer                                                                                           Vol. 2A 3-459

Flags Affected

None.

Exceptions

Protected Mode Exceptions

#UD If the LOCK prefix is used. If CR4.CET = 0. IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0. #PF(fault-code) If a page fault occurs.

Real-Address Mode Exceptions

#UD The INCSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The INCSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode. INCSSPD/INCSSPQ—Increment Shadow Stack Pointer Vol. 2A 3-460