Vesta
English
Source code

CLRSSBSY

Clear Busy Flag in a Supervisor Shadow Stack Token

stableVMJITAOTinstruction

Encodings

OpcodeInstructionOp/En64-bitCompat/LegacyDescription
F3 0F AE /6CLRSSBSY m64MValidValidClear busy flag in supervisor shadow stack token reference by m64.

Operand encoding

Each mode is a value of the Op/En column above. It says which field of the encoded instruction carries each operand, in the order they are written, and whether the instruction reads it, writes it or both.

M

  1. modrm.rm lectura y escrituraModRM byte, r/m field (bits 2-0); with the SIB byte and the displacement when the mod field asks for them

Measured cost

Loading measurements from arch-data...

Flags named

Description

Clear busy flag in supervisor shadow stack token reference by m64. Subsequent to marking the shadow stack as not busy the SSP is loaded with value 0.

This instruction cannot be executed when FRED transitions are enabled. FRED transitions do not use supervisor shadow stack tokens.

Operation

IF CR4.CET = 0 OR CR4.FRED = 1

    THEN #UD; FI;

IF IA32_S_CET.SH_STK_EN = 0
    THEN #UD; FI;

IF CPL > 0
    THEN GP(0); FI;

SSP_LA = Linear_Address(mem operand)

IF SSP_LA not aligned to 8 bytes

THEN #GP(0); FI;

expected_token_value = SSP_LA | BUSY_BIT (* busy bit - bit position 0 - must be set *)

new_token_value = SSP_LA              (* Clear the busy bit *)

IF shadow_stack_lock_cmpxchg8b(SSP_LA, new_token_value, expected_token_value) != expected_token_value

invalid_token := 1; FI

(* Set the CF if invalid token was detected *)
RFLAGS.CF = (invalid_token == 1) ? 1 : 0;
RFLAGS.ZF,PF,AF,OF,SF := 0;
SSP := 0

Flags affected

CF is set if an invalid token was detected, else it is cleared. ZF, PF, AF, OF, and SF are cleared.

Exceptions

Protected mode
#UDIf the LOCK prefix is used. If CR4.CET = 0. IF IA32_S_CET.SH_STK_EN = 0.
#GP(0)If memory operand linear address not aligned to 8 bytes. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If destination is located in a non-writable segment. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. If CPL is not 0.
#SS(0)If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs.
Real address mode
#UDThe CLRSSBSY instruction is not recognized in real-address mode.
Virtual-8086 mode
#UDThe CLRSSBSY instruction is not recognized in virtual-8086 mode.
Compatibility mode
#UDIf the LOCK prefix is used. If CR4.CET = 0. IF IA32_S_CET.SH_STK_EN = 0. If CR4.FRED = 1.
#GP(0)If memory operand linear address not aligned to 8 bytes. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If destination is located in a non-writable segment. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. If CPL is not 0.
#SS(0)If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs.
64-bit mode
#UDIf the LOCK prefix is used. If CR4.CET = 0. If CR4.FRED = 1. IF IA32_S_CET.SH_STK_EN = 0.
#GP(0)If memory operand linear address not aligned to 8 bytes. If CPL is not 0. If the memory address is in a non-canonical form.
#SS(0)If a memory address referencing the SS segment is in a non-canonical form. #PF(fault-code) If a page fault occurs.

Sources