RVOPcode
Home/Instructions/SSRDP
SSRDP

RISC-V SSRDP Instruction Details

Instruction ManualR-type

Reads current ssp; returns zero when Zicfiss is not active according to Zimop behavior.

Instruction Syntax

ssrdp rd
Operand Breakdown
Destination rd: register receiving the operation result.
Source rs1: register holding the first operand.
Source rs2: register holding the second operand.
ZicfissSecurity Mechanisms
Related Search Terms
ssrdp instructionRISC-V ssrdpssrdp syntaxssrdp encodingssrdp read shadow stack pointerssrdp CFIssrdp shadow stack

Instruction Behavior

Beginner view: SSRDP lets runtimes, unwinders, or stack-switching code read ssp. If Zicfiss is inactive it can return zero, so software can use it to detect active shadow stacks.

Quick Understanding & Search Notes

SSRDP belongs to the RISC-V CFI instruction set; behavior depends on whether Zicfilp/Zicfiss is enabled and on environment configuration.

Shadow-stack operations implicitly use ssp and XLEN width.
Do not mistake MOP compatibility for always-active security checks; inactive cases may degrade to no-op or zero-result behavior.
RISC-V Unprivileged ISA Manual: Control-Flow IntegrityRISC-V Unprivileged ISA Manual: Zimop/Zcmop May-Be-Operations

Common Usage Scenarios

Data Loading

Understand this scenario with real code like «ssrdp t0».

Resource Management

Understand this scenario with real code like «ssrdp t0».

Stack & Frame

Understand this scenario with real code like «ssrdp t0».

System & Privilege

Understand this scenario with real code like «ssrdp t0».

Pre-Use Checklist

Syntax Check
  • Confirm the current instruction format is R-type.
  • Confirm the operand order matches the example.
Semantic Check
  • Ensure the destination register usage is compatible with the calling convention.
  • Confirm this is not the lower-level form of a pseudo-instruction expansion.

Pitfalls / Common Confusions

These instructions provide protection only when the corresponding Zicfilp/Zicfiss state is enabled; otherwise they may act like NOPs or return zero.
Trap behavior depends on privilege level, environment configuration CSRs, and page attributes.
rd must not be x0.
OS/runtime code should not place valid shadow stacks at address 0 if using zero as the inactive indicator.
rd=x0 encoding is not supported; when xSSE=0 the result is zero.

FAQ

What happens if the related CFI feature is inactive for SSRDP?

Zicfiss instructions degrade according to the official Zimop/Zcmop-compatible behavior and do not perform shadow-stack checks or updates.

What official rule defines SSRDP?

The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.