SSPUSH and SSPOPCHK form their effective address from ssp rather than a GPR, so they bypass get_address() and never apply the pointer-masking ignore transformation. With pointer masking enabled, a tagged ssp raises a store/AMO page fault, whereas Spike, Sail and Whisper mask the access.
Patch 1 factors the address adjustment out of get_address() and get_address_indexed() into gen_pm_adjust_addr(), with no functional change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still written back unmasked, and the SSPOPCHK value comparison is unchanged. Tested with the reproducer from the issue; all four cases now match Spike. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758 Rishab Pradeep (2): target/riscv: Factor out pointer-masking address adjustment target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses .../tcg/insn_trans/trans_rvzicfiss.c.inc | 8 +++++-- target/riscv/tcg/translate.c | 21 ++++++++++--------- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.54.0 (Apple Git-157)
