What happens if the related CFI feature is inactive for C.SSPUSH?
Assuming Zcmop is present, xSSE=0 retains the corresponding C.MOP behavior: no shadow-stack access, ssp update, or register write.
C.SSPUSH
RISC-V C.SSPUSH Instruction Details
Instruction ManualC-typeWith xSSE=1, C.SSPUSH pushes the fixed x1 value onto the shadow stack.
Instruction Syntax
c.sspush x1
Operand Breakdown
This compressed form fixes x1 and has no variable explicit register operand.
The C.MOP.1 encoding expands to SSPUSH x1 when xSSE=1; ssp is the implicit base and the access width is XLEN.
With xSSE=0 no shadow-stack operation occurs, and C.MOP.1 writes no register.
ZicfissZcmopSecurity Mechanisms
Instruction Behavior
C.SSPUSH x1 (Zicfiss, depending on Zcmop) uses the C.MOP.1 encoding and, when xSSE=1, is equivalent to SSPUSH x1: it stores x1 at ssp - XLEN/8; only after that store succeeds does ssp decrement by XLEN/8 and commit. When Zicfiss is not active it follows the C.MOP.1 Zcmop behavior.
C.SSPUSH Decode & Execute Animation
Shows only official encodings, conditions, and architectural results; it does not imply a microarchitecture.
c.sspush x1
This compressed encoding has no variable explicit register: C.SSPUSH fixes x1; C.SSPOPCHK fixes x5.
Execution context
Assumes Zicfiss, Zcmop and their dependencies. xSSE is the effective enable for the current privilege mode. Only aligned ssp is modeled; RV64 assumes UXLEN/SXLEN are always 64.
mem[0x0000000000001FF8] <- 0x0123456789ABCDEF; ssp <- 0x0000000000001FF8
16-bit encoding fields
15..13
funct3
011
12..11
fixed high bits
00
10..8
C.MOP.1 selector
000
7
fixed bit
1
6..2
fixed low bits
00000
1..0
op
01
Fixed compressed fields select the implicit register.
address = 0x0000000000002000 - 8 = 0x0000000000001FF8; store 0x0123456789ABCDEF
mem[0x0000000000001FF8] <- 0x0123456789ABCDEF; ssp <- 0x0000000000001FF8
Architectural state has not been committed.
Quick Understanding & Search Notes
C.SSPUSH is the fixed-x1 Zicfiss shadow-stack push; ssp decrements only when xSSE=1 and the store succeeds.
Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; with xSSE=0 these compressed C.MOP forms do not access the shadow stack or write a register.
Zicfiss is not used in M-mode; U-mode use requires S-mode. xSSE is the effective enable for the current privilege mode.
Common Usage Scenarios
Shadow-stack return-address copy storage
Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».
Fixed-x1 compressed shadow-stack push
Understand this scenario with real code like «c.sspush x1 # push ra onto shadow stack».
Pre-Use Checklist
Syntax Check
- Confirm the 16-bit C.MOP.1 form fixes x1; this compressed form has no variable explicit register.
- Confirm Zicfiss, Zcmop, and Zicfiss dependencies Zicsr, Zimop, and Zaamo are available, and do not use Zicfiss in M-mode.
Semantic Check
- With xSSE=1, calculate ssp - XLEN/8 and store x1 there; commit ssp only after the store completes.
- With xSSE=0, use C.MOP.1 behavior: no shadow-stack access and no register write.
Pitfalls / Common Confusions
Only x1 is provided in compressed form; SSPUSH itself supports x1 and x5.
Zicfiss depends on Zicsr, Zimop, and Zaamo; compressed forms require Zcmop.
Use of Zicfiss in M-mode is not supported.
SSPUSH/C.SSPUSH decrement ssp only after the shadow-stack store succeeds.
FAQ
When does C.SSPUSH update ssp?
With xSSE=1, x1 is stored at ssp−XLEN/8; ssp decrements by XLEN/8 only after a successful store. A store fault prevents that update.