RVOPcode
Home/Instructions/SSPUSH
SSPUSH

RISC-V SSPUSH Instruction Details

Instruction ManualSYSTEM (MOP.RR.7)

SSPUSH pushes the x1/x5 link-register value onto the downward-growing shadow stack.

Instruction Syntax

sspush rs2
Operand Breakdown
This is a SYSTEM (MOP.RR.7)-format instruction. Confirm operand positions based on the assembly syntax.
ZicfissSecurity Mechanisms
Related Search Terms
sspush instructionRISC-V sspushsspush syntaxsspush encodingsspush shadow-stack pushsspush CFIsspush shadow stack

Instruction Behavior

SSPUSH stores a shadow copy of x1 or x5 to the address ssp - XLEN/8, then commits ssp to that new value only after the shadow-stack store succeeds. It is used in non-leaf prologues alongside the normal stack return-address save.

SSPUSH Decode & Execute Animation

Shows only specification-defined encodings, conditions, and architectural state.

sspush x1
Execution Context
Instruction Encoding
31..25
MOP.RR.7
1100111
24..20
rs2
x1
19..15
rs1
00000
14..12
funct3
100
11..7
rd
00000
6..0
opcode
SYSTEM
Decode fixed fields
ssp=0x0000000000002000, x[x1]=0x0000000012345678
mem[0x0000000000001FF8] <- 0x0000000012345678; ssp <- 0x0000000000001FF8
Architectural state has not been committed.

Quick Understanding & Search Notes

SSPUSH is a Zicfiss shadow-stack push; it updates ssp only after the store completes.

Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; inactive cases may degrade to no-op or zero-result behavior.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Data Loading

Understand this scenario with real code like «sspush x1».

Function Call & Return

Understand this scenario with real code like «sspush x1».

Resource Management

Understand this scenario with real code like «sspush x1».

Pre-Use Checklist

Syntax Check
  • Confirm the current instruction format is SYSTEM (MOP.RR.7).
  • Confirm the operand order matches the example.
Semantic Check
  • Ensure the destination register usage is compatible with the calling convention.
  • Confirm this is not the lower-level form of a pseudo-instruction expansion.

Pitfalls / Common Confusions

Only x1 and x5 are supported source link-register operands.
Zicfiss depends on the Zicsr, Zimop, and Zaamo extensions.
Shadow-stack protection is provided only when the corresponding Zicfiss state is enabled; otherwise the specified compatible behavior applies.
If the implicit shadow-stack store raises a store/AMO access, page, or guest-page fault, ssp is not updated.
If ssp is not XLEN-aligned, SSPUSH raises a store/AMO access-fault.
The accessed memory must be idempotent and PMP must allow read/write access; otherwise it raises a store/AMO access-fault.
Trap behavior depends on privilege level, environment configuration CSRs, and page-table/memory attributes.
ssp is decremented before the store address is formed, but the update commits only after the store succeeds.
SSPUSH/C.SSPUSH decrement ssp only after the shadow-stack store succeeds.

FAQ

What happens if the related CFI feature is inactive for SSPUSH?

Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.

What official rule defines SSPUSH?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.