WRSSD instruction (CET, APX)

WRSSD stores the low 32 bits of a register into a shadow stack. Shadow stacks live in pages that the page tables mark as such, and the two kinds of store are kept apart: an ordinary MOV to a shadow-stack page faults, and WRSSD to any other page raises #PF. At CPL 3 it writes user shadow stacks; below, supervisor ones. WRSSQ is the 8-byte form, and WRUSSD lets the kernel write a user shadow stack.

A hole in the protection, by request

A shadow stack is worth having because a program cannot rewrite it, and WRSS undoes that for whatever code runs in the thread. So it has an enable of its own, WR_SHSTK_EN in IA32_U_CET (IA32_S_CET for the kernel), on top of shadow stacks themselves; without it WRSSD raises #UD. On Linux, a thread asks for it with arch_prctl(ARCH_SHSTK_ENABLE, ARCH_SHSTK_WRSS), which works only once shadow stacks are on, and turning those off turns WRSS off too. A thread can lock the setting with ARCH_SHSTK_LOCK, and /proc/<pid>/status lists wrss when it is on.

The address must be 4-byte aligned, or WRSSD raises #GP(0). With -mshstk, Clang 23 at -O2 compiles _wrssd(v, p) to wrssd dword ptr [rsi], edi in Intel syntax, and GCC 14.4 to the same. GCC 14.2 puts the register first, wrssd edi, DWORD PTR [rsi], which GNU as 2.44 rejects, so with -masm=intel it cannot build the call; its AT&T output, wrssd %edi, (%rsi), is right. GCC fixed the Intel order in March 2026 (PR 124366). Clang 23 also enables the shadow-stack intrinsics for an -march such as znver5 or sapphirerapids; no -march of GCC 14 does, so there -mshstk is the only way.

The opcode

Intel’s manual and XED encode WRSSD as 0F 38 F6 with no prefix. AMD’s manual (24594, revision 3.39) gives 66 0F 38 F6 in the table of its WRSS page (page 518), the bytes of ADCX; its own 0F 38 opcode map (Table A-9, page 541) puts WRSS at F6 in the row without a prefix, as Intel does. F3 0F 38 F6 is ADOX. APX adds an EVEX form in map 4 that reaches the registers R16 to R31.

On Zen 5

AMD’s Zen 5 guide lists WRSS among the shadow-stack instructions Zen 5 supports, as microcoded. The KVM guest that ran the probe reported no shadow stacks in CPUID (leaf 07H, ECX bit 7), and both recorded cases raised #UD, with memory unchanged. No processor at hand has APX, so its form has no recorded cases.

Forms

Every encoding of WRSSD that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`WRSSD m32, r32` WRSSD_MEMu32_GPR32u32	`NP 0F 38 F6 /r`	CET
`WRSSD m32, r32` WRSSD_MEMu32_GPR32u32_APX	`EVEX.LLZ.NP.MAP4.W0 66 /r`	APX_F + CET

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`m32, r32`
Alder Lake, Sapphire Rapids	100 / 0.25p0156
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cr4 >> 23 & 1:            # CR4.CET; clear without CET
    fault(UD)
cet = u_cet if CPL == 3 else s_cet
if not cet & 1:                  # SH_STK_EN: shadow stacks off
    fault(UD)
if not cet & 2:                  # WR_SHSTK_EN: WRSS not allowed
    fault(UD)
a = dest.address
if not canonical(a):
    fault(GP, 0)                 # #SS(0) through RSP or RBP
if a & 3:
    fault(GP, 0)                 # 4-byte aligned
ss_store(a, 32, src.read())      # #PF unless a shadow-stack page of
                                 # CPL's kind: no other store
                                 # writes there

Run on AMD Zen 5 (EPYC 9645): 2 cases. Its cases ran where CPUID reported no CET, and every one raised an exception. The APX forms were not run: none of these processors has APX.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`WRSSD m32, r32`
`m32`	explicit	write
`r32`	explicit	read

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms: none in XED
EVEX forms: APX-EVEX-CET-WRSS

Attributes

What else XED records about the forms. How to read.

Legacy forms: not in real-address mode

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to WRSSD, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

Intrinsic	Compiles to
`_wrssd` `void _wrssd(unsigned int __a, void *__p)`	`WRSSD m32, r32` Legacy -mshstk

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`CET` CET	CET `CPUID.(EAX=07H,ECX=0):ECX[7]` CET	Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Sierra Forest, Clearwater Forest, Zen 3, Zen 4, Zen 5, Zen 6 Note: Zen 3 to Zen 6 have the shadow stacks of CET but not its indirect branch tracking, so ENDBR32 and ENDBR64 run on them as hint NOPs. AMD's references for Zen 3 to Zen 6 (55898, 55901, 57238, 58264, 58655) set CPUID_Fn00000007_ECX_x00[CET_SS] (bit 7) and leave bit 20 of CPUID_Fn00000007_EDX_x00, which Intel gives to indirect branch tracking, reserved and clear.
`APX_F_CET` APX	APX_F + CET `CPUID.(EAX=07H,ECX=1):EDX[21]` APX_F `CPUID.(EAX=07H,ECX=0):ECX[7]` CET	Nova Lake, Diamond Rapids

More CET instructions

More APX instructions

All 88 APX instructions

A hole in the protection, by request#

The opcode#

On Zen 5#