x86-64.net

APX

APX-EVEX-CET-WRSS exception class

APX-EVEX-CET-WRSS is the APX specification's exception class for WRSSD and WRSSQ in their EVEX encoding, which write to the shadow stack of the current privilege level.

Class
APX-EVEX-CET-WRSS in Intel XED
Applies to
The EVEX encodings of WRSSD and WRSSQ (CET), in map 4.
Instructions
2 mnemonics, 2 forms
Data
Intel XED v2026.08.23

Exception conditions

When an instruction of the class raises each exception, and in which processor modes. Protected mode includes compatibility mode. How to read the table.
ExceptionRealVirtual-8086Protected64-bitCondition
#UDAlways: the EVEX prefix raises #UD in real-address and virtual-8086 mode.
#UDAlways: EVEX map 4, where these instructions are, exists only in 64-bit mode.
#UDXCR0 bit 19 (APX) or CR4.OSXSAVE is 0: the operating system has not enabled APX.
#UDA bit of the last EVEX payload byte other than V4 is 1, or EVEX.V4 and EVEX.vvvv are not all 1s.
#UDThe destination is a register (ModRM.mod = 11B): it must be memory.
#UDShadow stacks are off: CR4.CET is 0, or SH_STK_EN is 0 in IA32_U_CET (at CPL 3) or IA32_S_CET (below CPL 3).
#UDWrites to the shadow stack are not allowed: WR_SHSTK_EN is 0 in IA32_U_CET (at CPL 3) or IA32_S_CET (below CPL 3).
#UDA LOCK, 66H, F2H, F3H or REX prefix comes before the EVEX prefix.
#UDCPUID reports no APX_F, or no shadow-stack support (CET_SS).
#GP(0)The memory address is not canonical.
#GP(0)The destination is not 4-byte aligned.
#PF(fault-code)The destination is not a shadow-stack page of the current kind: a user shadow stack at CPL 3, a supervisor one below CPL 3.
#PF(fault-code)Any other page fault on the write.

Notes

WRSSD and WRSSQ work only where the operating system has set WR_SHSTK_EN for the current privilege level, and they write only shadow-stack pages: an ordinary page as the destination causes a page fault rather than a write. The EVEX encoding adds access to R16 to R31.

  • APX-EVEX-CET-WRUSS: APX-EVEX-CET-WRUSS is the APX specification's exception class for WRUSSD and WRUSSQ in their EVEX encoding, with which code at CPL 0 writes to a user shadow stack.

Instructions

Intel XED puts forms of 2 mnemonics in this class, listed here by extension. Where a mnemonic also has forms of other classes, its link leads to its first form of this one.

APX

Sources

  1. Intel Advanced Performance Extensions (Intel APX) Architecture Specification, revision 7.0 (July 2025): Section 4.2.6, Table 4.7.
  2. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (325383-093, September 2026): WRSSD/WRSSQ, opcode table and 64-Bit Mode Exceptions.
  3. Intel XED v2026.08.23 (commit 0bcb6237345c): the exception class of each instruction form.

The list of instructions is derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted it. The text is our own.