image/svg+xml WRUSSD/WRUSSQ—Write to User Shadow Stack Instruction Operand Encoding Description Writes bytes in register source to a user shadow stack page. The WRUSS instruction can be executed only if CPL = 0, however the processor treats its shadow-stack accesses as user accesses. Operation IF CR4.CET = 0 THEN #UD; FI; IF CPL > 0 THEN #GP(0); FI; DEST_LA = Linear_Address(mem operand) IF (operand size is 64 bit) THEN (* Destination not 8B aligned *) IF DEST_LA[2:0] THEN GP(0); FI; Shadow_stack_store 8 bytes of SRC to DEST_LA as user-mode access; ELSE (* Destination not 4B aligned *) IF DEST_LA[1:0] THEN GP(0); FI; Shadow_stack_store 4 bytes of SRC[31:0] to DEST_LA as user-mode access; FI; Flags Affected None. C/C ++ Compiler Intrinsic Equivalent WRUSSDvoid _wrussd(__int32, void *); WRUSSQvoid _wrussq(__int64, void *); Opcode/ Instruction Op/ En 64/32 bit Mode Support CPUID Feature Flag Description 66 0F 38 F5 !(11):rrr:bbb WRUSSD m32, r32 MRV/VCET_SSWrite 4 bytes to shadow stack. 66 REX.W 0F 38 F5 !(11):rrr:bbb WRUSSQ m64, r64 MRV/N.E.CET_SSWrite 8 bytes to shadow stack. Op/EnOperand 1Operand 2Operand 3Operand 4 MRModRM:r/m (w)ModRM:reg (r)NANA image/svg+xml Protected Mode Exceptions #UDIf the LOCK prefix is used. If CR4.CET = 0. #GP(0)If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If destination is located in a non-writeable segment. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. If linear address of destination is not 4 byte aligned. If CPL is not 0. #SS(0)If a memory operand effective address is outside the SS segment limit. #PF(fault-code)If destination is not a user shadow stack. Other terminal and non-terminal faults. Real-Address Mode Exceptions #UDThe WRUSS instruction is not recognized in real-address mode. Virtual-8086 Mode Exceptions #UDThe WRUSS instruction is not recognized in virtual-8086 mode. Compatibility Mode Exceptions #UDIf the LOCK prefix is used. If CR4.CET = 0. #GP(0)If a memory address is in a non-canonical form. If linear address of destination is not 4 byte aligned. If CPL is not 0. #SS(0)If a memory address referencing the SS segment is in a non-canonical form. #PF(fault-code)If destination is not a user shadow stack. Other terminal and non-terminal faults. 64-Bit Mode Exceptions #UDIf the LOCK prefix is used. If CR4.CET = 0. #GP(0)If a memory address is in a non-canonical form. If linear address of destination is not 4 byte aligned. If CPL is not 0. #PF(fault-code)If destination is not a user shadow stack. Other terminal and non-terminal faults. This UNOFFICIAL reference was generated from the official Intel® 64 and IA-32 Architectures Software Developer’s Manual by a dumb script. There is no guarantee that some parts aren't mangled or broken and is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE .