What happens if the related CFI feature is inactive for SSRDP?
With xSSE=0, SSRDP's MOP behavior writes zero to its destination register; it writes ssp only when xSSE=1.
SSRDP
RISC-V SSRDP Instruction Details
Instruction ManualSYSTEM (MOP.R.28)SSRDP reads ssp when xSSE=1 and writes zero to a non-x0 destination when xSSE=0.
Instruction Syntax
ssrdp rd
RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); ssrdp rd, rd must not be x0.
32-bit SYSTEM: bits31:20=110011011100, funct3=100, opcode=1110011; rs1=00000, rd is the destination.
With xSSE=1, rd=ssp; with xSSE=0, rd=0. Reading changes neither ssp nor shadow-stack memory.
With S-mode implemented, xSSE is 0 for M, menvcfg.SSE for S/HS, henvcfg.SSE for VS and senvcfg.SSE for U/VU; without S-mode, it is 0 for M/U. Compatibility requires Zimop support. For detecting inactivity from zero, operating systems and runtimes must not locate shadow stacks at address 0.
ZicfissSecurity Mechanisms
Instruction Behavior
SSRDP copies the XLEN-wide ssp to a non-x0 destination, or writes zero when xSSE=0. With Zimop support it also writes zero if Zicfiss is absent. Runtimes can use a zero result to detect inactivity; to support this, operating systems and runtimes must not locate shadow stacks at address 0.
SSRDP Decode & Execute Animation
Shows only specification-defined encodings, conditions, and architectural state.
ssrdp t0
ssrdp
Execution Context
Assumes Zicfiss and Zimop are implemented; xSSE is the enable state determined for the current mode. ssp low two bits must be zero; RV64 inputs with bit2=1 assume 32-bit modes are also supported. complete means shadow-stack access protections pass. Steps are not processor cycles.
Instruction Encoding
31..20
SSRDP
110011011100
19..15
rs1
00000
14..12
funct3
100
11..7
rd
00101
6..0
opcode
1110011 SYSTEM
Decode fixed fields
ssp=0x0000000000002000
x[t0] <- 0x0000000000002000
Architectural state has not been committed.
Quick Understanding & Search Notes
SSRDP reads the Zicfiss ssp and writes zero under the Zimop behavior when inactive.
SSRDP uses the MOP.R.28 encoding with fixed rs1=x0, and rd cannot be x0.
When xSSE=1, rd receives the XLEN-wide ssp; when xSSE=0, rd receives zero.
Common Usage Scenarios
Reading shadow-stack state
Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1 (xSSE=1), and ssp=0x2000. ssrdp t0 gives t0=0x2000, leaving ssp unchanged; xSSE=0 instead writes zero.
Shadow-stack unwinding and switching
Assume RV64 Zicfiss, S-mode, menvcfg.SSE=1 (xSSE=1), and ssp=0x2000. ssrdp t0 gives t0=0x2000, leaving ssp unchanged; xSSE=0 instead writes zero.
Pre-Use Checklist
Syntax Check
- RV32/RV64 Zicfiss (depends on Zicsr, Zimop, Zaamo); ssrdp rd, rd must not be x0.
- 32-bit SYSTEM: bits31:20=110011011100, funct3=100, opcode=1110011; rs1=00000, rd is the destination.
Semantic Check
- With xSSE=1, rd=ssp; with xSSE=0, rd=0. Reading changes neither ssp nor shadow-stack memory.
- With S-mode implemented, xSSE is 0 for M, menvcfg.SSE for S/HS, henvcfg.SSE for VS and senvcfg.SSE for U/VU; without S-mode, it is 0 for M/U. Compatibility requires Zimop support. For detecting inactivity from zero, operating systems and runtimes must not locate shadow stacks at address 0.
Pitfalls / Common Confusions
SSRDP returns ssp only when Zicfiss xSSE=1; otherwise it writes zero.
Zicfiss depends on the Zicsr, Zimop, and Zaamo extensions.
SSRDP uses the MOP.R.28 encoding with fixed rs1=x0.
rd must not be x0.
To support detecting inactivity from a zero result, operating systems and runtimes must not locate shadow stacks at address 0.
Without Zicfiss, zero-result compatibility requires Zimop support; without Zimop an illegal-instruction exception is possible.
FAQ
What official rule defines SSRDP?
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture defines this instruction in Control-flow Integrity; Volume II: Privileged Architecture defines enable state and shadow-stack memory protection.