RVOPcode
Home/Instructions/C-SSPUSH
C.SSPUSH

RISC-V C.SSPUSH Instruction Details

Instruction ManualC-type

C.SSPUSH pushes the x1/x5 link-register value onto the downward-growing shadow stack.

Instruction Syntax

c.sspush x1
Operand Breakdown
Compressed instructions are 16 bits; registers are often limited to x8–x15.
Immediate fields are narrower. Refer to the full encoding for this compressed instruction.
ZicfissZcmopSecurity Mechanisms
Related Search Terms
c.sspush instructionRISC-V c.sspushc.sspush syntaxc.sspush encodingc.sspush shadow-stack pushc.sspush CFIc.sspush shadow stack

Instruction Behavior

C.SSPUSH x1 (Zicfiss, depending on Zcmop) uses the C.MOP.1 encoding and, when xSSE=1, is equivalent to SSPUSH x1: it first decrements ssp by XLEN/8, then stores x1 to the new ssp address; the ssp update commits only after the store succeeds. When Zicfiss is not active it follows the C.MOP.1 Zcmop behavior.

Quick Understanding & Search Notes

C.SSPUSH belongs to the RISC-V CFI instruction set; behavior depends on whether Zicfilp/Zicfiss is enabled and on environment configuration.

Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; inactive cases may degrade to no-op or zero-result behavior.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Function Call & Return

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Security Mechanisms

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Compressed & Code Size

Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».

Pre-Use Checklist

Syntax Check
  • Confirm the current instruction format is C-type.
  • Confirm the operand order matches the example.
Semantic Check
  • Ensure the destination register usage is compatible with the calling convention.
  • Confirm this is not the lower-level form of a pseudo-instruction expansion.

Pitfalls / Common Confusions

Only x1 is provided in compressed form; SSPUSH itself supports x1 and x5.
Zicfiss depends on Zicsr, Zimop, and Zaamo; compressed forms require Zcmop.
Use of Zicfiss in M-mode is not supported.
SSPUSH/C.SSPUSH decrement ssp only after the shadow-stack store succeeds.

FAQ

What happens if the related CFI feature is inactive for C.SSPUSH?

Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.

What official rule defines C.SSPUSH?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.