RVOPcode
Home/Instructions/C-SSPUSH
C.SSPUSH

RISC-V C.SSPUSH Instruction Details

Instruction ManualC-type

C.SSPUSH pushes the fixed x1 link-register value onto the downward-growing shadow stack.

Instruction Syntax

c.sspush x1
Operand Breakdown
This compressed form fixes x1 and has no variable explicit register operand.
The C.MOP.1 encoding expands to SSPUSH x1 when xSSE=1; ssp is the implicit base and the access width is XLEN.
With xSSE=0 no shadow-stack operation occurs, and C.MOP.1 writes no register.
ZicfissZcmopSecurity Mechanisms
Related Search Terms
c.sspush instructionRISC-V c.sspushc.sspush syntaxc.sspush encodingc.sspush shadow-stack pushc.sspush CFIc.sspush shadow stack

Instruction Behavior

C.SSPUSH x1 (Zicfiss, depending on Zcmop) uses the C.MOP.1 encoding and, when xSSE=1, is equivalent to SSPUSH x1: it stores x1 at ssp - XLEN/8; only after that store succeeds does ssp decrement by XLEN/8 and commit. When Zicfiss is not active it follows the C.MOP.1 Zcmop behavior.

C.SSPUSH Decode & Execute Animation

Shows only official encodings, conditions, and architectural results; it does not imply a microarchitecture.

c.sspush x1

This compressed encoding has no variable explicit register: C.SSPUSH fixes x1; C.SSPOPCHK fixes x5.

Execution context
mem[0x0000000000001FF8] <- 0x0123456789ABCDEF; ssp <- 0x0000000000001FF8
16-bit encoding fields
15..13
funct3
011
12..11
fixed high bits
00
10..8
C.MOP.1 selector
000
7
fixed bit
1
6..2
fixed low bits
00000
1..0
op
01
Fixed compressed fields select the implicit register.
address = 0x0000000000002000 - 8 = 0x0000000000001FF8; store 0x0123456789ABCDEF
mem[0x0000000000001FF8] <- 0x0123456789ABCDEF; ssp <- 0x0000000000001FF8
Architectural state has not been committed.

Quick Understanding & Search Notes

C.SSPUSH is the fixed-x1 Zicfiss shadow-stack push; ssp decrements only when xSSE=1 and the store succeeds.

Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; with xSSE=0 these compressed C.MOP forms do not access the shadow stack or write a register.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Function Call & Return

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Security Mechanisms

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Compressed & Code Size

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Pre-Use Checklist

Syntax Check
  • Confirm the 16-bit C.MOP.1 form fixes x1; this compressed form has no variable explicit register.
  • Confirm Zicfiss, Zcmop, and Zicfiss dependencies Zicsr, Zimop, and Zaamo are available, and do not use Zicfiss in M-mode.
Semantic Check
  • With xSSE=1, calculate ssp - XLEN/8 and store x1 there; commit ssp only after the store completes.
  • With xSSE=0, use C.MOP.1 behavior: no shadow-stack access and no register write.

Pitfalls / Common Confusions

Only x1 is provided in compressed form; SSPUSH itself supports x1 and x5.
Zicfiss depends on Zicsr, Zimop, and Zaamo; compressed forms require Zcmop.
Use of Zicfiss in M-mode is not supported.
SSPUSH/C.SSPUSH decrement ssp only after the shadow-stack store succeeds.

FAQ

What happens if the related CFI feature is inactive for C.SSPUSH?

Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.

What official rule defines C.SSPUSH?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.