RDSSPD instruction (CET)

Forms

Every encoding of RDSSPD that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`RDSSPD r32` RDSSPD_GPR32u32	`F3 0F 1E /1`	CET

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if cr4 >> 23 & 1:                # CR4.CET; clear without CET
    cet = u_cet if CPL == 3 else s_cet
    if cet & 1:                  # SH_STK_EN: shadow stacks on
        dest.write(ssp)          # bits 31:0, zero-extended
# a NOP otherwise: the opcode is a hint NOP (0F 1E), so a program that
# zeroes the register first learns from a nonzero one that shadow
# stacks are on

Run on AMD Zen 5 (EPYC 9645): 3 cases. Its cases ran where CPUID reported no CET.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`RDSSPD r32`
`r32`	explicit	write
`SSP`	implicit	read

Flags

None: XED records no flag that the forms test or change.

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to RDSSPD, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

Intrinsic	Compiles to
`_rdsspd` `unsigned int _rdsspd(unsigned int __a)`	`RDSSPD r32` Legacy -mshstk
`_rdsspd_i32` `unsigned int _rdsspd_i32(void)`	`RDSSPD r32` Legacy -mshstk

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set CPUID Processors

ISA set	CPUID	Processors
`CET` CET	CET `CPUID.(EAX=07H,ECX=0):ECX[7]` CET	Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6 Note: Zen 3 to Zen 6 have the shadow stacks of CET but not its indirect branch tracking, so ENDBR32 and ENDBR64 run on them as hint NOPs. AMD's references for Zen 3, Zen 4 and Zen 5 (55898, 55901, 57238) set CPUID_Fn00000007_ECX_x00[CET_SS] (bit 7) and leave bit 20 of CPUID_Fn00000007_EDX_x00, which Intel gives to indirect branch tracking, reserved and clear. Note: Zen 6 is listed because Zen 5 has these instructions. GCC's -march sets, which give the other features of Zen 6, leave them out, and AMD has not yet published a Processor Programming Reference for Zen 6.

CET

CET
CPUID.(EAX=07H,ECX=0):ECX[7] CET

Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6

Note: Zen 3 to Zen 6 have the shadow stacks of CET but not its indirect branch tracking, so ENDBR32 and ENDBR64 run on them as hint NOPs. AMD's references for Zen 3, Zen 4 and Zen 5 (55898, 55901, 57238) set CPUID_Fn00000007_ECX_x00[CET_SS] (bit 7) and leave bit 20 of CPUID_Fn00000007_EDX_x00, which Intel gives to indirect branch tracking, reserved and clear.

Note: Zen 6 is listed because Zen 5 has these instructions. GCC's -march sets, which give the other features of Zen 6, leave them out, and AMD has not yet published a Processor Programming Reference for Zen 6.

RDSSPD