RVOPcode
Home/Instructions/SSAMOSWAP.W
SSAMOSWAP.W

RISC-V SSAMOSWAP.W Instruction Details

Instruction ManualAMO-type

SSAMOSWAP.W performs an AMO-style swap on shadow-stack memory, returning the old value and storing the new value.

Instruction Syntax

ssamoswap.w rd, rs2, (rs1)

RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); syntax ssamoswap.w rd, rs2, (rs1), with no offset immediate.

32-bit AMO: funct5=01001, funct3=010, opcode=0101111; aq=1 is acquire and rl=1 is release.

Success atomically reads the original address's old 32-bit value into rd (sign-extended on RV64), storing old rs2[31:0] at that address; rd=x0 discards writeback and ssp is unchanged. Overlapping sources use one old value.

Check in specification order: non-M with menvcfg.SSE=0, absent S-mode, or U with senvcfg.SSE=0 raises illegal; otherwise VS with henvcfg.SSE=0 or VU with senvcfg.SSE=0 raises virtual. Success also requires shadow-stack memory protection and four-byte natural alignment; effective-M accesses raise access-fault and misalignment uses AMO exception options.

ZicfissSecurity Mechanisms
Related Search Terms
ssamoswap.w instructionRISC-V ssamoswap.wssamoswap.w syntaxssamoswap.w encodingssamoswap.w shadow-stack atomic swapssamoswap.w CFIssamoswap.w shadow stack

Instruction Behavior

Beginner view: SSAMOSWAP.W atomically loads a 32-bit word from the shadow-stack location addressed by rs1 into rd and stores rs2's low 32 bits back to that address. On RV64, the loaded word is sign-extended to rd. It supports shadow-stack switching and checkpoint maintenance.

SSAMOSWAP.W Decode & Execute Animation

Shows only specification-defined encodings, conditions, and architectural state.

ssamoswap.w a0, a1, (a2)
ssamoswap.w,, ()
Execution Context

Assumes Zicfiss is implemented. complete means SSE checks and shadow-stack page/PMP/PMA/translation checks pass; fault options are preselected outcomes, not inferred privilege states. aq=1 is acquire and rl=1 is release; swap values and ssp are unaffected by aq/rl.

Instruction Encoding
31..27
funct5
01001
26/25
aq/rl
00
24..20
rs2
01011
19..15
rs1
01100
14..12
funct3
010
11..7
rd
01010
6..0
opcode
0101111 AMO
Decode fixed fields
x[a2]=0x0000000000002000, x[a1]=0x0000000012345678, mem[address]=0x89ABCDEF
x[a0] <- 0xFFFFFFFF89ABCDEF; mem[0x0000000000002000] <- 0x12345678
Architectural state has not been committed.

Quick Understanding & Search Notes

SSAMOSWAP.W is a Zicfiss shadow-stack AMO; its SSE access conditions are controlled by the current privilege environment.

SSAMOSWAP.W/D use AMO-style read-old/write-new behavior and may use aq/rl consistency semantics.
SSAMOSWAP.W/D are not MOP encodings; unsatisfied SSE conditions take their specified exception paths.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Control-flow Integrity (20260120)The RISC-V Instruction Set Manual, Volume II: Privileged Architecture — Shadow Stack (20260120)

Common Usage Scenarios

Shadow-stack switching

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1, t2=0x2000, t1=0x12345678 and old memory word=0x89ABCDEF; a permitted shadow-stack access completes. t0=0xFFFFFFFF89ABCDEF, the original address receives 0x12345678, and ssp is unchanged.

Shadow-stack checkpoint maintenance

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1, t2=0x2000, t1=0x12345678 and old memory word=0x89ABCDEF; a permitted shadow-stack access completes. t0=0xFFFFFFFF89ABCDEF, the original address receives 0x12345678, and ssp is unchanged.

Pre-Use Checklist

Syntax Check
  • RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); syntax ssamoswap.w rd, rs2, (rs1), with no offset immediate.
  • 32-bit AMO: funct5=01001, funct3=010, opcode=0101111; aq=1 is acquire and rl=1 is release.
Semantic Check
  • Success atomically reads the original address's old 32-bit value into rd (sign-extended on RV64), storing old rs2[31:0] at that address; rd=x0 discards writeback and ssp is unchanged. Overlapping sources use one old value.
  • Check in specification order: non-M with menvcfg.SSE=0, absent S-mode, or U with senvcfg.SSE=0 raises illegal; otherwise VS with henvcfg.SSE=0 or VU with senvcfg.SSE=0 raises virtual. Success also requires shadow-stack memory protection and four-byte natural alignment; effective-M accesses raise access-fault and misalignment uses AMO exception options.

Pitfalls / Common Confusions

SSAMOSWAP.W is not a Zimop/Zcmop MOP-compatible no-op; failure of the manual's listed SSE or S-mode conditions raises an illegal-instruction or virtual-instruction exception, while a memory access with effective privilege M raises a store/AMO access-fault.
Zicfiss depends on the Zicsr, Zimop, and Zaamo extensions.
Activating Zicfiss in M-mode is not supported, and U-mode use requires S-mode to be implemented.
SSAMOSWAP.W's rs1 address must be naturally aligned to the word's four-byte width; if it is not naturally aligned, the same exception options as A-extension AMOs apply.
It is an AMO-like operation with aq/rl release-consistency semantics; do not treat it as an ordinary load/store.
The accessed memory must be idempotent; non-idempotent memory or insufficient PMP read/write permission raises a store/AMO access-fault. SSAMOSWAP.W additionally requires AMOSwap-level PMA support.
On RV64, SSAMOSWAP.W sign-extends the loaded 32-bit old value to rd; .D is RV64-only.

FAQ

What happens if the related CFI feature is inactive for SSAMOSWAP.W?

SSAMOSWAP.W is an AMO encoding, not a Zimop/Zcmop MOP. If its SSE access-control or S-mode conditions are not met, it takes the specified illegal-instruction or virtual-instruction exception path.

What official rule defines SSAMOSWAP.W?

The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture defines this instruction in Control-flow Integrity; Volume II: Privileged Architecture defines enable state and shadow-stack memory protection.