diff --git a/Rakefile b/Rakefile
index 434aab66ba..288a47c2d5 100755
--- a/Rakefile
+++ b/Rakefile
@@ -12,6 +12,7 @@ Rake.application.options.thread_pool_size = $jobs
 puts "Running with #{Rake.application.options.thread_pool_size} job(s)"
 
 require "etc"
+require "pathname"
 
 $root = Pathname.new(__dir__).realpath
 $lib = $root / "lib"
diff --git a/backends/cpp_hart_gen/lib/decode_tree.rb b/backends/cpp_hart_gen/lib/decode_tree.rb
index 2f962e0d11..3adf0a92ef 100644
--- a/backends/cpp_hart_gen/lib/decode_tree.rb
+++ b/backends/cpp_hart_gen/lib/decode_tree.rb
@@ -112,20 +112,22 @@ def construct_decode_tree(tree, xlen, cur_range, test: false)
 
     tree.insts.each do |inst|
       inst_format = inst.encoding(xlen).format
-      if inst_format.reverse[cur_range].match?(/^[01]+$/)
+      range_bits = inst_format.reverse[cur_range]
+      if range_bits && range_bits.match?(/^[01]+$/)
         # puts "#{inst.name} has opcode bit(s) in #{cur_range} (#{inst_format.reverse[cur_range].reverse})"
         # whole range is opcode bits
         if inst_format.gsub('0', '1') == tree.mask(cur_range).to_s(2).gsub('0', '-').rjust(inst.encoding(xlen).size, '-')
-          done_insts[inst_format.reverse[cur_range]] = inst
+          done_insts[range_bits] = inst
         else
-          in_progress_groups[inst_format.reverse[cur_range]] ||= []
-          in_progress_groups[inst_format.reverse[cur_range]] << inst
+          in_progress_groups[range_bits] ||= []
+          in_progress_groups[range_bits] << inst
         end
       else
-        # puts "#{inst.name} has variable bit(s) in #{cur_range} (#{inst_format.reverse[cur_range].reverse} #{inst_format.reverse})"
+        # puts "#{inst.name} has variable bit(s) in #{cur_range} (#{range_bits || 'nil'} #{inst_format.reverse})"
         variable_insts << inst
       end
     end
+
     if test
       # puts "test result for #{cur_range}: #{variable_insts.empty?} (#{tree.insts.map(&:name)})"
       return variable_insts.empty?
diff --git a/spec/std/isa/inst/Zicfilp/sspopchk.x1.yaml b/spec/std/isa/inst/Zicfilp/sspopchk.x1.yaml
new file mode 100644
index 0000000000..7b7db9cdbc
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspopchk.x1.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspopchk.x1
+long_name: Shadow Stack Pop and Check X1
+description: |
+  Pop a value from the shadow stack and check it against register x1.
+definedBy: Zicfilp
+assembly: x1
+encoding:
+  match: "11001101110000001100000001110011"
+  variables: []
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Pop value from shadow stack and check against register x1
diff --git a/spec/std/isa/inst/Zicfilp/sspopchk.x5.yaml b/spec/std/isa/inst/Zicfilp/sspopchk.x5.yaml
new file mode 100644
index 0000000000..4afe79f31f
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspopchk.x5.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspopchk.x5
+long_name: Shadow Stack Pop and Check X5
+description: |
+  Pop a value from the shadow stack and check it against register x5.
+definedBy: Zicfilp
+assembly: x5
+encoding:
+  match: "11001101110000101100000001110011"
+  variables: []
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Pop value from shadow stack and check against register x5
diff --git a/spec/std/isa/inst/Zicfilp/sspopchk.yaml b/spec/std/isa/inst/Zicfilp/sspopchk.yaml
new file mode 100644
index 0000000000..e92457933e
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspopchk.yaml
@@ -0,0 +1,28 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspopchk
+long_name: Shadow Stack Pop and Check
+description: |
+  Pop a value from the shadow stack and check it.
+definedBy: Zicfilp
+assembly: xs1
+encoding:
+  match: "110011011100-----100000001110011"
+  variables:
+    - name: xs1
+      location: 19-15
+      # prettier-ignore
+      not: [ 1, 5 ]
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Pop value from shadow stack and check against register xs1
diff --git a/spec/std/isa/inst/Zicfilp/sspush.x1.yaml b/spec/std/isa/inst/Zicfilp/sspush.x1.yaml
new file mode 100644
index 0000000000..5865df5b41
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspush.x1.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspush.x1
+long_name: Shadow Stack Push X1
+description: |
+  Push a value from register x1 onto the shadow stack.
+definedBy: Zicfilp
+assembly: x1
+encoding:
+  match: "11001110000100000100000001110011"
+  variables: []
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Push value from register x1 onto shadow stack
diff --git a/spec/std/isa/inst/Zicfilp/sspush.x5.yaml b/spec/std/isa/inst/Zicfilp/sspush.x5.yaml
new file mode 100644
index 0000000000..8ac0ad62a7
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspush.x5.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspush.x5
+long_name: Shadow Stack Push X5
+description: |
+  Push a value from register x5 onto the shadow stack.
+definedBy: Zicfilp
+assembly: x5
+encoding:
+  match: "11001110010100000100000001110011"
+  variables: []
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Push value from register x5 onto shadow stack
diff --git a/spec/std/isa/inst/Zicfilp/sspush.yaml b/spec/std/isa/inst/Zicfilp/sspush.yaml
new file mode 100644
index 0000000000..e88485a10b
--- /dev/null
+++ b/spec/std/isa/inst/Zicfilp/sspush.yaml
@@ -0,0 +1,28 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/inst_schema.json
+
+$schema: inst_schema.json#
+kind: instruction
+name: sspush
+long_name: Shadow Stack Push
+description: |
+  Push a value onto the shadow stack.
+definedBy: Zicfilp
+assembly: xs2
+encoding:
+  match: "1100111-----00000100000001110011"
+  variables:
+    - name: xs2
+      location: 24-20
+      # prettier-ignore
+      not: [ 1, 5 ]
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+data_independent_timing: false
+operation(): |
+  # Push value from register xs2 onto shadow stack