RDSSPQ

RDSSPQ copies SSP, the shadow-stack pointer, into a 64-bit register. Its use lies in what it does without a shadow stack: on a processor without CET, or while shadow stacks are off at the current privilege level, it is a NOP and the register keeps its value. Code that zeroes the register first can therefore ask whether its thread runs on a shadow stack, with no CPUID test and no system call: in user code, 0 means no. (In the kernel, SSP can be 0 with shadow stacks on: AMD’s manual has SYSCALL clear it.) Its bytes, F3 REX.W 0F 1E with a register operand, lie in the hint-NOP space 0F 18 to 0F 1F, as those of ENDBR64 do, which is how older processors skip it. RDSSPD, without REX.W, reads the low 32 bits.

The intrinsic decides what 0 means#

_get_ssp() is the one that zeroes: with -mshstk, GCC 14 and Clang 23 at -O2 compile it to xor eax, eax and rdsspq rax. Clang 23 has two more. _rdsspq(x) returns x where the instruction does nothing. _rdsspq_i64() hands the instruction an uninitialized variable, and Clang compiles it to a bare rdsspq rax: without shadow stacks it returns whatever RAX held, so it says nothing about whether they are on. GCC 14 has neither.

Popping to a saved point#

A setjmp-like routine can save SSP next to RSP; the jump back then pops the difference, one entry per 8 bytes, with INCSSPQ. INCSSPQ raises #UD where shadow stacks are off, so the saved 0 is also the test that skips it. SSP points at the top entry, the return address of the latest CALL; the entries of the callers lie above it, where only shadow-stack instructions such as WRSSD may write.

On Linux, user shadow stacks need a processor that has them, a kernel configured for them and libraries built for them; the loader enables them per thread, and /proc/<pid>/status lists shstk among the thread’s features when it runs with one.

AMD’s Zen 5 guide lists RDSSP among the shadow-stack instructions Zen 5 supports, as microcoded. The KVM guest that ran the probe reported no shadow stacks in CPUID (leaf 07H, ECX bit 7), and Zen 5 ran all three recorded cases as a NOP: RAX, R9 and RDX kept their values.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if cr4 >> 23 & 1:                # CR4.CET; clear without CET
    cet = u_cet if CPL == 3 else s_cet
    if cet & 1:                  # SH_STK_EN: shadow stacks on
        dest.write(ssp)
# a NOP otherwise (a hint NOP, 0F 1E), so that the register keeps the
# value a program put there

Operands

Flags

None: XED records no flag that the forms test or change.

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to RDSSPQ, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More CET instructions

• CLRSSBSY
• ENDBR32
• ENDBR64
• INCSSPD
• INCSSPQ
• RDSSPD
• RSTORSSP
• SAVEPREVSSP
• SETSSBSY
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ