What happens if the related CFI feature is inactive for C.SSPOPCHK?
Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.
C.SSPOPCHK
RISC-V C.SSPOPCHK Instruction Details
Instruction ManualC-typeC.SSPOPCHK reads the shadow return address at ssp and checks it against fixed x5.
Instruction Syntax
c.sspopchk x5
Operand Breakdown
This compressed form fixes x5 and has no variable explicit register operand.
The C.MOP.5 encoding expands to SSPOPCHK x5 when xSSE=1; ssp is the implicit base and the load width is XLEN.
A completed load that differs from x5 raises a software-check exception; only a successful match increments ssp.
ZicfissZcmopSecurity Mechanisms
Instruction Behavior
C.SSPOPCHK x5 (Zicfiss with Zcmop) expands to SSPOPCHK x5 for Zicfiss backward-edge CFI. It reads an XLEN-wide return address from ssp and compares it with fixed x5; a mismatch raises a software-check exception (cause 18, xtval shadow stack fault code 3). It reuses C.MOP.5. Only xSSE=1 performs the shadow-stack operation; otherwise it retains C.MOP.5 behavior, which writes no register.
C.SSPOPCHK Decode & Execute Animation
Shows only official encodings, conditions, and architectural results; it does not imply a microarchitecture.
c.sspopchk x5
This compressed encoding has no variable explicit register: C.SSPUSH fixes x1; C.SSPOPCHK fixes x5.
Execution context
software-check exception (cause=18, xtval=shadow stack fault code 3); ssp is unchanged.
16-bit encoding fields
15..13
funct3
011
12..11
fixed high bits
00
10..8
C.MOP.5 selector
010
7
fixed bit
1
6..2
fixed low bits
00000
1..0
op
01
Fixed compressed fields select the implicit register.
load 0x0000000000003000 from 0x0000000000002000; compare with x5 = 0x0123456789ABCDEF
software-check exception (cause=18, xtval=shadow stack fault code 3); ssp is unchanged.
Architectural state has not been committed.
Quick Understanding & Search Notes
C.SSPOPCHK is the fixed-x5 Zicfiss shadow-stack check; only xSSE=1 reads, compares, and may update ssp.
Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; with xSSE=0 these compressed C.MOP forms do not access the shadow stack or write a register.
Common Usage Scenarios
Compressed & Code Size
Understand this scenario with real code like «c.sspopchk x5».
Register Operations
Understand this scenario with real code like «c.sspopchk x5».
Stack & Frame
Understand this scenario with real code like «c.sspopchk x5».
Pre-Use Checklist
Syntax Check
- Confirm the 16-bit C.MOP.5 form fixes x5; this compressed form has no variable explicit register.
- Confirm Zicfiss, Zcmop, and Zicfiss dependencies Zicsr, Zimop, and Zaamo are available, and do not use Zicfiss in M-mode.
Semantic Check
- With xSSE=1, load an XLEN-wide value from ssp and compare it with x5; an access fault takes priority over the software-check test.
- Only a successful match increments ssp by XLEN/8; a mismatch raises software-check cause 18 with xtval shadow stack fault code 3.
Pitfalls / Common Confusions
Only x5 is provided in compressed form; SSPOPCHK itself supports x1 and x5.
Mismatch raises a software-check exception with shadow-stack fault code.
Zicfiss depends on Zicsr, Zimop, and Zaamo; compressed forms require Zcmop.
SSPOPCHK/C.SSPOPCHK increment ssp only after the load succeeds and comparison passes.
FAQ
What official rule defines C.SSPOPCHK?
The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.