CLRSSBSY

CLRSSBSY releases a supervisor shadow stack: it clears the busy bit of the token at its memory operand and sets SSP to 0. It undoes SETSSBSY, and AMD’s Volume 2 places it on the way out of a system call, before SYSRET restores the user’s SSP from IA32_PL3_SSP. Once the bit is clear, the stack may be taken again, by this processor or another.

A bad token is no fault#

In one locked step, CLRSSBSY reads the 8-byte token, which must hold its own address with the busy bit set, and writes it back with the bit clear. A token that does not match is written back as it was, and CLRSSBSY reports it in CF = 1 instead of raising #CP, as SETSSBSY would; CF = 0 means the stack was released. OF, SF, ZF, AF and PF are cleared either way. The manuals part on SSP after a bad token: Intel’s sets it to 0 regardless, AMD’s leaves it alone. The operand must be 8-byte aligned, or #GP(0).

Running with SSP at 0#

Between CLRSSBSY and SYSRET the kernel runs without a shadow stack, and AMD’s manual warns that an interrupt or exception taken there must switch shadow stacks through its interrupt shadow stack table (ISST); one that pushed on the current stack would wrap SSP around from 0, which AMD expects to fault. With FRED enabled, CLRSSBSY raises #UD: FRED does not use busy tokens (Intel’s Volume 3).

The register form#

CLRSSBSY is F3 0F AE /6 with a memory operand. With a register operand the same bytes are UMONITOR, so on processors with both, the ModRM byte alone tells a kernel instruction from a user one. With -mshstk, GCC 14 compiles _clrssbsy(p) to clrssbsy QWORD PTR [rdi]; Clang 23’s Intel syntax prints dword ptr for the same 8-byte operand.

Where it runs#

Only at CPL 0, or #GP(0); #UD comes first when CR4.CET or supervisor shadow stacks are off. AMD’s Zen 5 guide lists CLRSSBSY among the shadow-stack instructions Zen 5 supports, as microcoded. The probe runs at CPL 3 in a KVM guest that reported no shadow stacks in CPUID (leaf 07H, ECX bit 7); both recorded cases raised #UD and left the token in memory unchanged.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cr4 >> 23 & 1:            # CR4.CET; clear without CET
    fault(UD)
if cr4 >> 32 & 1:                # CR4.FRED
    fault(UD)
if not s_cet & 1:                # supervisor shadow stacks off
    fault(UD)
if CPL > 0:
    fault(GP, 0)
a = dest.address
if not canonical(a):
    fault(GP, 0)
if a & 7:
    fault(GP, 0)
t = ss_load(a, 64)               # locked until the store below
ok = t == a | 1                  # its own address, busy
ss_store(a, 64, a if ok else t)  # busy bit cleared
cf = 0 if ok else 1              # a bad token: CF set, no fault
zf = pf = af = of = sf = 0
if ok:
    ssp = 0                      # no shadow stack in use
# Intel's manual sets SSP to 0 for a bad token too; AMD's leaves it

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; not in real-address mode

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to CLRSSBSY, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More CET instructions

• ENDBR32
• ENDBR64
• INCSSPD
• INCSSPQ
• RDSSPD
• RDSSPQ
• RSTORSSP
• SAVEPREVSSP
• SETSSBSY
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ