RVOPcode
Home/Instructions/Landing Pad
LPAD

RISC-V LPAD Instruction Details

Instruction ManualU-type (AUIPC HINT)

Zicfilp landing-pad instruction; validates indirect jump/call targets when forward-edge CFI is enabled.

Instruction Syntax

lpad label
Operand Breakdown
This is a U-type (AUIPC HINT)-format instruction. Confirm operand positions based on the assembly syntax.
ZicfilpSecurity Mechanisms
Related Search Terms
lpad instructionRISC-V lpadlpad syntaxlpad encodinglpad landing-pad CFIlpad CFIlpad landing pad

Instruction Behavior

Beginner view: with forward-edge CFI enabled, indirect calls/jumps must land on LPAD or raise a software-check exception. LPAD can carry a 20-bit label; when Zicfilp is inactive it is compatible as a no-op.

LPAD Decode & Execute Animation

Shows only specification-defined encodings, conditions, and architectural state; it does not model pipelines, cache coherence, or platform policy.

lpad 0x12345
Execution Context
Instruction Encoding
31..12
LPL
00010010001101000101
11..7
rd
00000 (x0)
6..0
opcode
0010111 (AUIPC)
Decode fixed fields
Fixed encoding fields identify the instruction and operand roles.
No exception: ELP is updated to NO_LP_EXPECTED.
Architectural state has not been committed.

Quick Understanding & Search Notes

LPAD belongs to the RISC-V Zicfilp forward-edge CFI instructions; behavior depends on whether Zicfilp is enabled and on environment configuration.

LPAD uses AUIPC HINT code points and has no architectural effect when inactive.
LPAD uses the U-type AUIPC major opcode with rd fixed to x0; its LPL occupies bits 31:12.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Forward-edge CFI

Understand this scenario with real code like «lpad 0».

Indirect call/jump marking

Understand this scenario with real code like «lpad 0».

Security hardening

Understand this scenario with real code like «lpad 0».

Pre-Use Checklist

Syntax Check
  • Confirm the current instruction format is U-type (AUIPC HINT).
  • Confirm the operand order matches the example.
Semantic Check
  • Ensure the destination register usage is compatible with the calling convention.
  • Confirm this is not the lower-level form of a pseudo-instruction expansion.

Pitfalls / Common Confusions

LPAD provides protection only when Zicfilp forward-edge CFI state is enabled; otherwise it acts as a no-op.
Only with Zicfilp enabled and ELP=LP_EXPECTED does LPAD check its PC alignment and label; with no landing pad expected, it does not update ELP.
LPAD targets require 4-byte alignment; a nonzero label must match the expected label in x7.
When Zicfilp is inactive LPAD is a no-op; when enabled with ELP=LP_EXPECTED it checks 4-byte alignment and label match.

FAQ

What happens if the related CFI feature is inactive for LPAD?

LPAD executes as a no-op.

What official rule defines LPAD?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.