rdsspq

Read Shadow Stack Pointer (Quadword)

RDSSPQ r64

Reads the current shadow stack pointer into a register.

Pseudocode Operation

dest ← SSP

Example

RDSSPQ rax

Encoding

Binary Layout

F3

+0

0F

+1

1E

+2

ModRM

+3

 

Format Legacy

Opcode F3 REX.W 0F 1E /1

Extension CET-SS

Operands

• dest
  64-bit general-purpose register (e.g. RAX)

Related

More in CET-SS

Reference

View in Intel® 64 and IA-32 Architectures SDM ↗ Intel® SDM

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 0F 1E /1	RDSSPD r32	R	V/V	CET_SS	Copy low 32 bits of shadow stack pointer (SSP) to r32.
F3 REX.W 0F 1E /1	RDSSPQ r64	R	V/N.E.	CET_SS	Copies shadow stack pointer (SSP) to r64.

Description

Copies the current shadow stack pointer (SSP) register to the register destination. This opcode is a NOP when CET shadow stacks are not enabled and on processors that do not support CET.

Operation

IF CPL = 3
IF CR4.CET & IA32_U_CET.SH_STK_EN
IF (operand size is 64 bit)
THEN
Dest := SSP;
ELSE
Dest := SSP[31:0];
FI;
FI;
ELSE
IF CR4.CET & IA32_S_CET.SH_STK_EN
IF (operand size is 64 bit)
THEN
Dest := SSP;
ELSE
Dest := SSP[31:0];
FI;
FI;
FI;

Flags Affected

None. C/C++ Compiler Intrinsic Equivalent RDSSPD__int32 _rdsspd_i32(void); RDSSPQ__int64 _rdsspq_i64(void); Exceptions (All Operating Modes) #UD If the LOCK prefix is used. RDSSPD/RDSSPQ-Read Shadow Stack Pointer Vol. 2B 4-558