SETSSBSY

SETSSBSY gives the kernel a shadow stack after SYSCALL. Interrupts, exceptions and far CALLs that raise the privilege level switch shadow stacks themselves, but SYSCALL does not: with supervisor shadow stacks on, it saves the user’s SSP in IA32_PL3_SSP and, by AMD’s manual, sets SSP to 0. AMD’s Volume 2 therefore has the system call entry point run SETSSBSY before anything pushes a return address, and the way back run CLRSSBSY before SYSRET.

The token#

SETSSBSY takes no operand. It reads the 8-byte supervisor shadow-stack token at the address in IA32_PL0_SSP, which the kernel set, and checks it in one locked step: the token must hold its own address with bit 0, the busy bit, clear. Then it sets the busy bit and loads SSP with that address. A token in use, or one that holds another address, raises #CP and is written back unchanged. The busy bit keeps one supervisor shadow stack on one logical processor at a time; an interrupt, exception or far CALL that switches to a supervisor shadow stack makes the same check itself.

The manuals number the error code of that #CP differently: 5 in Intel’s list, where 3 is the missing ENDBRANCH of indirect branch tracking, and 4 in AMD’s, which has no such entry.

Where it runs#

Only at CPL 0: elsewhere SETSSBSY raises #GP(0), and #UD comes first when CR4.CET or supervisor shadow stacks (SH_STK_EN in IA32_S_CET) are off. With FRED enabled it raises #UD too: FRED’s event delivery loads SSP from an MSR of the event’s stack level, and its return instructions check those MSRs instead of busy bits in tokens (Intel’s Volume 3).

AMD’s Zen 5 guide lists SETSSBSY among the shadow-stack instructions Zen 5 supports, as microcoded. The probe runs at CPL 3 in a KVM guest that reported no shadow stacks in CPUID (leaf 07H, ECX bit 7); both recorded cases raised #UD, the fault that the manuals check before the privilege level.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cr4 >> 23 & 1:            # CR4.CET; clear without CET
    fault(UD)
if cr4 >> 32 & 1:                # CR4.FRED
    fault(UD)
if not s_cet & 1:                # supervisor shadow stacks off
    fault(UD)
if CPL > 0:
    fault(GP, 0)
a = pl0_ssp                      # the shadow stack of CPL 0
if a & 7:
    fault(GP, 0)
t = ss_load(a, 64)               # locked until the store below
ok = t == a                      # its own address, not busy
ss_store(a, 64, a | 1 if ok else t)
                                 # marked busy
if not ok:
    fault(CP, 5)                 # #CP(SETSSBSY)
ssp = a

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; not in real-address mode

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SETSSBSY, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More CET instructions

• CLRSSBSY
• ENDBR32
• ENDBR64
• INCSSPD
• INCSSPQ
• RDSSPD
• RDSSPQ
• RSTORSSP
• SAVEPREVSSP
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ