RVOPcode
Home/Instructions/SSPUSH
SSPUSH

RISC-V SSPUSH Instruction Details

Instruction ManualR-type

SSPUSH pushes the x1/x5 link-register value onto the downward-growing shadow stack.

Instruction Syntax

sspush rs1
Operand Breakdown
Destination rd: register receiving the operation result.
Source rs1: register holding the first operand.
Source rs2: register holding the second operand.
ZicfissSecurity Mechanisms
Related Search Terms
sspush instructionRISC-V sspushsspush syntaxsspush encodingsspush shadow-stack pushsspush CFIsspush shadow stack

Instruction Behavior

SSPUSH first decrements ssp by XLEN/8, stores a shadow copy of x1 or x5 to the new ssp address, and commits the ssp update only after the shadow-stack store succeeds. It is used in non-leaf prologues alongside the normal stack return-address save.

Quick Understanding & Search Notes

SSPUSH belongs to the RISC-V CFI instruction set; behavior depends on whether Zicfilp/Zicfiss is enabled and on environment configuration.

Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; inactive cases may degrade to no-op or zero-result behavior.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Data Loading

Understand this scenario with real code like «sspush x1».

Function Call & Return

Understand this scenario with real code like «sspush x1».

Resource Management

Understand this scenario with real code like «sspush x1».

Pre-Use Checklist

Syntax Check
  • Confirm the current instruction format is R-type.
  • Confirm the operand order matches the example.
Semantic Check
  • Ensure the destination register usage is compatible with the calling convention.
  • Confirm this is not the lower-level form of a pseudo-instruction expansion.

Pitfalls / Common Confusions

Only x1 and x5 are supported source link-register operands.
Shadow-stack protection is provided only when the corresponding Zicfiss state is enabled; otherwise the specified compatible behavior applies.
Trap behavior depends on privilege level, environment configuration CSRs, and page-table/memory attributes.
ssp is decremented before the store address is formed, but the update commits only after the store succeeds.
SSPUSH/C.SSPUSH decrement ssp only after the shadow-stack store succeeds.

FAQ

What happens if the related CFI feature is inactive for SSPUSH?

Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.

What official rule defines SSPUSH?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.