rdsspq

Read Shadow Stack Pointer (Quadword)

RDSSPQ r64

Reads the current shadow stack pointer into a register.

Details

Read Shadow Stack Pointer into a 64-bit register. Reads the current shadow stack pointer (SSP) maintained by CET-SS hardware and stores it in the destination register. No flags are affected. Requires CET-SS (Control Flow Enforcement Technology—Shadow Stack) capability; 64-bit mode only.

Pseudocode Operation

dest ← SSP

Example

RDSSPQ rax

Encoding

Binary Layout
F3
+0
0F
+1
1E
+2
ModRM
+3
 
Format Legacy
Opcode F3 REX.W 0F 1E /1
Extension CET-SS

Operands

  • dest
    64-bit general-purpose register (e.g. RAX)

Reference (Intel® SDM)

Instruction Forms

Opcode Instruction Op/En 64/32-bit Mode CPUID Description
F3 0F 1E /1 RDSSPD r32 R V/V CET_SS Copy low 32 bits of shadow stack pointer (SSP) to r32.
F3 REX.W 0F 1E /1 RDSSPQ r64 R V/N.E. CET_SS Copies shadow stack pointer (SSP) to r64.

Description

Copies the current shadow stack pointer (SSP) register to the register destination. This opcode is a NOP when CET shadow stacks are not enabled and on processors that do not support CET.

Operation

IF CPL = 3
IF CR4.CET & IA32_U_CET.SH_STK_EN
IF (operand size is 64 bit)
THEN
Dest := SSP;
ELSE
Dest := SSP[31:0];
FI;
FI;
ELSE
IF CR4.CET & IA32_S_CET.SH_STK_EN
IF (operand size is 64 bit)
THEN
Dest := SSP;
ELSE
Dest := SSP[31:0];
FI;
FI;
FI;

Flags Affected

None. C/C++ Compiler Intrinsic Equivalent RDSSPD__int32 _rdsspd_i32(void); RDSSPQ__int64 _rdsspq_i64(void); Exceptions (All Operating Modes) #UD If the LOCK prefix is used. RDSSPD/RDSSPQ—Read Shadow Stack Pointer Vol. 2B 4-558