INCSSPD instruction (CET)

Forms

Every encoding of INCSSPD that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`INCSSPD r32` INCSSPD_GPR32u8	`F3 0F AE /5`	CET

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cr4 >> 23 & 1:            # CR4.CET; clear without CET
    fault(UD)
cet = u_cet if CPL == 3 else s_cet
if not cet & 1:                  # SH_STK_EN: shadow stacks off
    fault(UD)
n = src.read() & 0xFF            # bits 7:0, unsigned: 0 to 255
ss_load(ssp, 32)                 # the first element and the last
if n > 0:                        # of those it pops are read, and
    ss_load(ssp + 4 * (n - 1), 32)
                                 # dropped: a pop past the stack's
                                 # end raises #PF there
ssp = ssp + 4 * n                # 4-byte elements

Run on AMD Zen 5 (EPYC 9645): 2 cases. Its cases ran where CPUID reported no CET, and every one raised an exception.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`INCSSPD r32`
`r32`	explicit	read
`SSP`	implicit	read, write

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms: not in real-address mode

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to INCSSPD, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

Intrinsic	Compiles to
`_incsspd` `void _incsspd(int __a)`	`INCSSPD r32` Legacy -mshstk

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set CPUID Processors

ISA set	CPUID	Processors
`CET` CET	CET `CPUID.(EAX=07H,ECX=0):ECX[7]` CET	Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6 Note: Zen 3 to Zen 6 have the shadow stacks of CET but not its indirect branch tracking, so ENDBR32 and ENDBR64 run on them as hint NOPs. AMD's references for Zen 3, Zen 4 and Zen 5 (55898, 55901, 57238) set CPUID_Fn00000007_ECX_x00[CET_SS] (bit 7) and leave bit 20 of CPUID_Fn00000007_EDX_x00, which Intel gives to indirect branch tracking, reserved and clear. Note: Zen 6 is listed because Zen 5 has these instructions. GCC's -march sets, which give the other features of Zen 6, leave them out, and AMD has not yet published a Processor Programming Reference for Zen 6.

CET

CET
CPUID.(EAX=07H,ECX=0):ECX[7] CET

Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6

Note: Zen 3 to Zen 6 have the shadow stacks of CET but not its indirect branch tracking, so ENDBR32 and ENDBR64 run on them as hint NOPs. AMD's references for Zen 3, Zen 4 and Zen 5 (55898, 55901, 57238) set CPUID_Fn00000007_ECX_x00[CET_SS] (bit 7) and leave bit 20 of CPUID_Fn00000007_EDX_x00, which Intel gives to indirect branch tracking, reserved and clear.

Note: Zen 6 is listed because Zen 5 has these instructions. GCC's -march sets, which give the other features of Zen 6, leave them out, and AMD has not yet published a Processor Programming Reference for Zen 6.

INCSSPD