RVOPcode
Home/Instructions/SSPOPCHK
SSPOPCHK

RISC-V SSPOPCHK Instruction Details

Instruction ManualSYSTEM (MOP.R.28)

With xSSE=1, SSPOPCHK reads the shadow return address at ssp and compares it with x1/x5.

Instruction Syntax

sspopchk rs1

RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); sspopchk rs1, rs1 restricted to x1/x5.

32-bit SYSTEM: bits31:20=110011011100, funct3=100, opcode=1110011; rs1 is the comparison source, rd=00000.

With xSSE=1, read mem[ssp] and compare bit-for-bit with the source; increment ssp by XLEN/8 only after a successful load and match. Mismatch raises software-check (cause=18, xtval=3); the source register is not written.

With S-mode implemented, xSSE is 0 for M, menvcfg.SSE for S/HS, henvcfg.SSE for VS and senvcfg.SSE for U/VU; without S-mode, it is 0 for M/U. Compatibility requires Zimop support. With xSSE=0 there is no shadow-stack access or ssp update; when active, non-XLEN alignment raises store/AMO access-fault.

ZicfissSecurity Mechanisms
Related Search Terms
sspopchk instructionRISC-V sspopchksspopchk syntaxsspopchk encodingsspopchk shadow-stack pop checksspopchk CFIsspopchk shadow stack

Instruction Behavior

With xSSE=1, SSPOPCHK loads the shadow return address at ssp and compares it bit-for-bit with x1 or x5. A mismatch raises a software-check exception; on success ssp advances by XLEN/8.

SSPOPCHK Decode & Execute Animation

Shows only specification-defined encodings, conditions, and architectural state.

sspopchk x1
sspopchk
Execution Context

Assumes Zicfiss and Zimop are implemented; xSSE is the enable state determined for the current mode. ssp low two bits must be zero; RV64 inputs with bit2=1 assume 32-bit modes are also supported. complete means shadow-stack access protections pass. Steps are not processor cycles.

Instruction Encoding
31..20
MOP.R.28
110011011100
19..15
rs1
00001
14..12
funct3
100
11..7
rd
00000
6..0
opcode
1110011 SYSTEM
Decode fixed fields
ssp=0x0000000000002000, x[x1]=0x0000000012345678, mem[ssp]=0x0000000012345678
ssp <- 0x0000000000002008
Architectural state has not been committed.

Quick Understanding & Search Notes

SSPOPCHK is a Zicfiss shadow-stack check; xSSE and the access result determine comparison and ssp update.

Implicitly uses ssp and XLEN-wide memory accesses; with xSSE=0 there is no shadow-stack access or ssp update.
MOP compatibility when Zicfiss is absent or inactive requires Zimop support; processors without Zimop may raise an illegal-instruction exception.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Control-flow Integrity (20260120)The RISC-V Instruction Set Manual, Volume II: Privileged Architecture — Shadow Stack (20260120)

Common Usage Scenarios

Function Call & Return

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1 (xSSE=1), and ssp=0x2000. With both x1 and mem[0x2000]=0x12345678, a permitted load and matching comparison give ssp=0x2008; x1 is unchanged.

Shadow-stack checking and unwinding

Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1 (xSSE=1), and ssp=0x2000. With both x1 and mem[0x2000]=0x12345678, a permitted load and matching comparison give ssp=0x2008; x1 is unchanged.

Pre-Use Checklist

Syntax Check
  • RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); sspopchk rs1, rs1 restricted to x1/x5.
  • 32-bit SYSTEM: bits31:20=110011011100, funct3=100, opcode=1110011; rs1 is the comparison source, rd=00000.
Semantic Check
  • With xSSE=1, read mem[ssp] and compare bit-for-bit with the source; increment ssp by XLEN/8 only after a successful load and match. Mismatch raises software-check (cause=18, xtval=3); the source register is not written.
  • With S-mode implemented, xSSE is 0 for M, menvcfg.SSE for S/HS, henvcfg.SSE for VS and senvcfg.SSE for U/VU; without S-mode, it is 0 for M/U. Compatibility requires Zimop support. With xSSE=0 there is no shadow-stack access or ssp update; when active, non-XLEN alignment raises store/AMO access-fault.

Pitfalls / Common Confusions

Only x1 and x5 are supported compared link-register operands.
Zicfiss depends on the Zicsr, Zimop, and Zaamo extensions.
A shadow-stack value mismatch raises a software-check exception.
A store/AMO access-fault has priority over software-check; if the implicit ssp load raises a store/AMO page-fault or guest-page-fault, it is not compared and ssp is not updated.
If ssp is not XLEN-aligned, SSPOPCHK raises a store/AMO access-fault.
The accessed memory must be idempotent and PMP must allow read/write access; otherwise it raises a store/AMO access-fault.
Trap behavior depends on privilege level, environment configuration CSRs, and page-table/memory attributes.
ssp is incremented by XLEN/8 only after the load succeeds and the comparison passes.

FAQ

What happens if the related CFI feature is inactive for SSPOPCHK?

With xSSE=0, SSPOPCHK neither accesses the shadow stack nor updates ssp. Without Zicfiss but with Zimop, its MOP behavior also applies; without Zimop support an illegal-instruction exception is possible.

What official rule defines SSPOPCHK?

The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture defines this instruction in Control-flow Integrity; Volume II: Privileged Architecture defines enable state and shadow-stack memory protection.