What happens if the related CFI feature is inactive for C.SSPOPCHK?
Assuming Zcmop is present, xSSE=0 retains the corresponding C.MOP behavior: no shadow-stack access, ssp update, or register write.
C.SSPOPCHK
RISC-V C.SSPOPCHK Instruction Details
Instruction ManualC-typeWith xSSE=1, C.SSPOPCHK reads XLEN bits from the shadow stack and compares them with fixed x5.
Instruction Syntax
c.sspopchk x5
Operand Breakdown
This compressed form fixes x5 and has no variable explicit register operand.
The C.MOP.5 encoding expands to SSPOPCHK x5 when xSSE=1; ssp is the implicit base and the load width is XLEN.
A completed load that differs from x5 raises a software-check exception; only a successful match increments ssp.
ZicfissZcmopSecurity Mechanisms
Instruction Behavior
C.SSPOPCHK x5 (Zicfiss with Zcmop) expands to SSPOPCHK x5 for Zicfiss backward-edge CFI. It reads an XLEN-wide return address from ssp and compares it with fixed x5; a mismatch raises a software-check exception (cause 18, xtval shadow stack fault code 3). It reuses C.MOP.5. Only xSSE=1 performs the shadow-stack operation; otherwise it retains C.MOP.5 behavior, which writes no register.
C.SSPOPCHK Decode & Execute Animation
Shows only official encodings, conditions, and architectural results; it does not imply a microarchitecture.
c.sspopchk x5
This compressed encoding has no variable explicit register: C.SSPUSH fixes x1; C.SSPOPCHK fixes x5.
Execution context
Assumes Zicfiss, Zcmop and their dependencies. xSSE is the effective enable for the current privilege mode. Only aligned ssp is modeled; RV64 assumes UXLEN/SXLEN are always 64.
software-check exception (cause=18, xtval=shadow stack fault code 3); ssp is unchanged.
16-bit encoding fields
15..13
funct3
011
12..11
fixed high bits
00
10..8
C.MOP.5 selector
010
7
fixed bit
1
6..2
fixed low bits
00000
1..0
op
01
Fixed compressed fields select the implicit register.
load 0x0000000000003000 from 0x0000000000002000; 0x0000000000003000 != x5=0x0123456789ABCDEF; software-check; ssp unchanged
software-check exception (cause=18, xtval=shadow stack fault code 3); ssp is unchanged.
Architectural state has not been committed.
Quick Understanding & Search Notes
C.SSPOPCHK is the fixed-x5 Zicfiss shadow-stack check; only xSSE=1 reads, compares, and may update ssp.
Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; with xSSE=0 these compressed C.MOP forms do not access the shadow stack or write a register.
Zicfiss is not used in M-mode; U-mode use requires S-mode. xSSE is the effective enable for the current privilege mode.
Common Usage Scenarios
Shadow-stack return-address checking
Understand this scenario with real code like «c.sspopchk x5».
Shadow-stack pop after a successful match
Understand this scenario with real code like «c.sspopchk x5».
Pre-Use Checklist
Syntax Check
- Confirm the 16-bit C.MOP.5 form fixes x5; this compressed form has no variable explicit register.
- Confirm Zicfiss, Zcmop, and Zicfiss dependencies Zicsr, Zimop, and Zaamo are available, and do not use Zicfiss in M-mode.
Semantic Check
- With xSSE=1, load an XLEN-wide value from ssp and compare it with x5; an access fault takes priority over the software-check test.
- Only a successful match increments ssp by XLEN/8; a mismatch raises software-check cause 18 with xtval shadow stack fault code 3.
Pitfalls / Common Confusions
Only x5 is provided in compressed form; SSPOPCHK itself supports x1 and x5.
Mismatch raises a software-check exception with shadow-stack fault code.
Zicfiss depends on Zicsr, Zimop, and Zaamo; compressed forms require Zcmop.
SSPOPCHK/C.SSPOPCHK increment ssp only after the load succeeds and comparison passes.
FAQ
When does C.SSPOPCHK update ssp?
With xSSE=1, mem[ssp] is compared bitwise with x5. Only a successful, matching load increments ssp by XLEN/8; mismatch raises a software-check exception with cause=18 and xtval=3.