What happens if the related CFI feature is inactive for SSRDP?
With xSSE=0, SSRDP's MOP behavior writes zero to its destination register; it writes ssp only when xSSE=1.
SSRDP
RISC-V SSRDP Instruction Details
Instruction ManualSYSTEM (MOP.R.28)Reads current ssp; writes zero when Zicfiss is not active according to Zimop behavior.
Instruction Syntax
ssrdp rd
Operand Breakdown
This is a SYSTEM (MOP.R.28)-format instruction. Confirm operand positions based on the assembly syntax.
ZicfissSecurity Mechanisms
Instruction Behavior
Beginner view: SSRDP lets runtimes, unwinders, or stack-switching code read ssp. If Zicfiss is inactive it writes zero to its destination register, so software can use it to detect active shadow stacks.
SSRDP Decode & Execute Animation
Shows only specification-defined encodings, conditions, and architectural state.
ssrdp t0
Execution Context
Instruction Encoding
31..20
SSRDP
110011011100
19..15
rs1
00000
14..12
funct3
100
11..7
rd
t0
6..0
opcode
SYSTEM
Decode fixed fields
ssp=0x0000000000002000
x[t0] <- 0x0000000000002000
Architectural state has not been committed.
Quick Understanding & Search Notes
SSRDP reads the Zicfiss ssp and writes zero under the Zimop behavior when inactive.
SSRDP uses the MOP.R.28 encoding with fixed rs1=x0, and rd cannot be x0.
When xSSE=1, rd receives the XLEN-wide ssp; when xSSE=0, rd receives zero.
Common Usage Scenarios
Data Loading
Understand this scenario with real code like «ssrdp t0».
Resource Management
Understand this scenario with real code like «ssrdp t0».
Stack & Frame
Understand this scenario with real code like «ssrdp t0».
System & Privilege
Understand this scenario with real code like «ssrdp t0».
Pre-Use Checklist
Syntax Check
- Confirm the current instruction format is SYSTEM (MOP.R.28).
- Confirm the operand order matches the example.
Semantic Check
- Ensure the destination register usage is compatible with the calling convention.
- Confirm this is not the lower-level form of a pseudo-instruction expansion.
Pitfalls / Common Confusions
SSRDP returns ssp only when Zicfiss xSSE=1; otherwise it writes zero.
Zicfiss depends on the Zicsr, Zimop, and Zaamo extensions.
SSRDP uses the MOP.R.28 encoding with fixed rs1=x0.
rd must not be x0.
OS/runtime code should not place valid shadow stacks at address 0 if using zero as the inactive indicator.
rd=x0 encoding is not supported; when xSSE=0 the result is zero.
FAQ
What official rule defines SSRDP?
The Control-Flow Integrity chapter of the RISC-V Unprivileged ISA defines LPAD, SSPUSH, SSPOPCHK, SSRDP, and SSAMOSWAP.