Vesta
English
Source code

INCSSPD, INCSSPQ

Increment Shadow Stack Pointer

stableVMJITAOTinstruction

Encodings

OpcodeInstructionOp/En64-bitCompat/LegacyDescription
F3 0F AE /5INCSSPD r32RValidValidIncrement SSP by 4 * r32[7:0].
F3 REX.W 0F AE /5INCSSPQ r64RValidNot encodableIncrement SSP by 8 * r64[7:0].

Operand encoding

Each mode is a value of the Op/En column above. It says which field of the encoded instruction carries each operand, in the order they are written, and whether the instruction reads it, writes it or both.

R

  1. modrm.rm lecturaModRM byte, r/m field (bits 2-0); with the SIB byte and the displacement when the mod field asks for them

Measured cost

Loading measurements from arch-data...

Description

This instruction can be used to increment the current shadow stack pointer by the operand size of the instruction times the unsigned 8-bit value specified by bits 7:0 in the source operand. The instruction performs a pop and discard of the first and last element on the shadow stack in the range specified by the unsigned 8-bit value in bits 7:0 of the source operand.

Operation

IF CPL = 3
    IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0
          THEN #UD; FI;

ELSE
    IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0
          THEN #UD; FI;

FI;

IF (operand size is 64-bit)
    THEN
          Range := R64[7:0];
          shadow_stack_load 8 bytes from SSP;
          IF Range > 0
                THEN shadow_stack_load 8 bytes from SSP + 8 * (Range - 1);
          FI;
          SSP := SSP + Range * 8;
    ELSE
          Range := R32[7:0];
          shadow_stack_load 4 bytes from SSP;
          IF Range > 0
                THEN shadow_stack_load 4 bytes from SSP + 4 * (Range - 1);
          FI;
          SSP := SSP + Range * 4;

FI;

Flags affected

None.

Intel C/C++ compiler intrinsics

INCSSPD void _incsspd(int);
INCSSPQ void _incsspq(int);

Exceptions

Protected mode
#UDIf the LOCK prefix is used. If CR4.CET = 0. IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0. IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0. #PF(fault-code) If a page fault occurs.
Real address mode
#UDThe INCSSP instruction is not recognized in real-address mode.
Virtual-8086 mode
#UDThe INCSSP instruction is not recognized in virtual-8086 mode.
Compatibility mode
Same exceptions as in protected mode.
64-bit mode
Same exceptions as in protected mode.

Sources