RVOPcode
Home/Instructions/Shadow-Stack Atomic Swap (Doubleword)
SSAMOSWAP.D

RISC-V SSAMOSWAP.D Instruction Details

Instruction ManualAMO-type

SSAMOSWAP.D is an RV64-only AMO-style swap on shadow-stack memory, returning the old value and storing the new value.

Instruction Syntax

ssamoswap.d rd, rs2, (rs1)

RV64 Zicfiss only (depends on Zicsr, Zimop, Zaamo); syntax ssamoswap.d rd, rs2, (rs1), with three integer-register fields and no offset immediate.

32-bit AMO: funct5=01001, funct3=011, opcode=0101111; aq=1 is acquire and rl=1 is release.

Success atomically loads the original address's 64-bit old value into rd and stores old rs2 at the original address; rd=x0 only discards register writeback. Overlapping sources use one pre-writeback value.

SSE checks, shadow-stack memory protection, and eight-byte natural alignment apply; absent S-mode is illegal instruction, and effective-M memory access is access-fault. Misalignment uses the AMO exception options.

ZicfissSecurity Mechanisms
Related Search Terms
ssamoswap.d instructionRISC-V ssamoswap.dssamoswap.d syntaxssamoswap.d encodingssamoswap.d shadow-stack atomic swapssamoswap.d CFIssamoswap.d shadow stack

Instruction Behavior

Beginner view: SSAMOSWAP.D atomically reads a value from the shadow-stack location addressed by rs1 into rd and writes the corresponding value from rs2 back to that address. It supports shadow-stack switching and checkpoint maintenance.

SSAMOSWAP.D Decode & Execute Animation

Shows only specification-defined encodings, conditions, and architectural state; it does not model pipelines, cache coherence, or platform policy.

ssamoswap.d a0, a2, (a1)
Execution Context

complete: assume S-mode, menvcfg.SSE=1, a valid shadow-stack page, idempotent memory, PMP read/write and PMA AMOSwap support, and a successful access; illegal: absent S-mode or an illegal-instruction SSE condition; virtual: a virtual-instruction SSE condition; m-access-fault: S-mode implemented and effective privilege M. All scenarios use the original address and old source data; ssp is unchanged.

Instruction Encoding
31..27
funct5
01001
26
aq
0
25
rl
0
24..20
rs2
01100 (a2)
19..15
rs1
01011 (a1)
14..12
funct3
011
11..7
rd
01010 (a0)
6..0
opcode
0101111 (AMO)
Decode fixed fields
Fixed encoding fields identify the instruction and operand roles.
Atomic swap: x[a0] <- mem[0x0000000000003000] = 0x1122334455667788; mem <- 0xAABBCCDDEEFF0011.
Architectural state has not been committed.

Quick Understanding & Search Notes

SSAMOSWAP.D is an RV64 Zicfiss AMO: it atomically loads the old doubleword into rd, then stores rs2's doubleword at the shadow-stack location addressed by rs1.

SSAMOSWAP.W/D use AMO-style read-old/write-new behavior and may use aq/rl consistency semantics.
It does not use a Zimop/Zcmop fallback: SSAMOSWAP.W/D execution is also constrained by SSE control and shadow-stack memory-protection conditions.
Successful exchange requires a valid shadow-stack page, idempotent memory, PMP read/write permission, and PMA AMOSwap support; virtualized G-stage translation must also permit read/write.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Version 20260120, §34.2.7The RISC-V Instruction Set Manual, Volume II: Privileged Architecture — Version 20260120, §16.2.3

Common Usage Scenarios

Shadow-stack switching

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1, t2=0x3000, t1=0xAABBCCDDEEFF0011, old memory doubleword=0x1122334455667788, and a permitted shadow-stack access that completes. t0 receives old memory, the original address receives old t1, and ssp is unchanged.

Saving shadow-stack checkpoints

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1, t2=0x3000, t1=0xAABBCCDDEEFF0011, old memory doubleword=0x1122334455667788, and a permitted shadow-stack access that completes. t0 receives old memory, the original address receives old t1, and ssp is unchanged.

Pre-Use Checklist

Syntax Check
  • RV64 Zicfiss only (depends on Zicsr, Zimop, Zaamo); syntax ssamoswap.d rd, rs2, (rs1), with three integer-register fields and no offset immediate.
  • 32-bit AMO: funct5=01001, funct3=011, opcode=0101111; aq=1 is acquire and rl=1 is release.
Semantic Check
  • Success atomically loads the original address's 64-bit old value into rd and stores old rs2 at the original address; rd=x0 only discards register writeback. Overlapping sources use one pre-writeback value.
  • SSE checks, shadow-stack memory protection, and eight-byte natural alignment apply; absent S-mode is illegal instruction, and effective-M memory access is access-fault. Misalignment uses the AMO exception options.

Pitfalls / Common Confusions

SSAMOSWAP.D has no MOP no-op fallback; absent S-mode or failed SSE access checks raise illegal/virtual instruction exceptions as applicable. With effective privilege M, its memory access raises a store/AMO access-fault.
The address must refer to valid shadow-stack memory and be naturally aligned to the operand width; otherwise shadow-stack memory-protection rules apply.
It is an AMO-like operation with aq/rl release-consistency semantics; do not treat it as an ordinary load/store.
On RV64, SSAMOSWAP.W sign-extends the loaded 32-bit old value to rd; .D is RV64-only.

FAQ

What happens if the related CFI feature is inactive for SSAMOSWAP.D?

SSAMOSWAP.D does not use a Zimop/Zcmop fallback; its execution follows SSE access-control and shadow-stack memory-protection rules, which can raise illegal-instruction, virtual-instruction, or store/AMO access-fault exceptions depending on privilege and state.

Does rd=x0 cancel the memory exchange?

No. A successful exchange still stores the 64-bit rs2 value at the original address; only register writeback of old memory is discarded. The address and source data are read before writeback.