[PATCH v2 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK

[Rishab Pradeep <rishab@rispop.dev>]

SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and never apply the pointer-masking
ignore transformation. With pointer masking enabled, a tagged ssp
raises a store/AMO page fault, whereas Spike, Sail and Whisper mask
the access.

Patch 1 factors the address adjustment out of get_address() and
get_address_indexed() into gen_pm_adjust_addr(), with no functional
change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still
written back unmasked, and the SSPOPCHK value comparison is unchanged.

Tested with the reproducer from the issue; all four cases now match
Spike.

v1 -> v2:
  - Patch 1: Collected Reviewed-by from Daniel Henrique Barboza.
  - Patch 2: Cite Privileged Architecture Specification, Section
    17.1.2.6 ("Memory Accesses Subject to Pointer Masking"), in the
    commit message, per Daniel's review.

v1: https://lore.kernel.org/qemu-devel/20261029183751.11143-1-rishab@rispop.dev/

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758

Rishab Pradeep (2):
  target/riscv: Factor out pointer-masking address adjustment
  target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

 .../tcg/insn_trans/trans_rvzicfiss.c.inc      |  8 +++++--
 target/riscv/tcg/translate.c                  | 21 ++++++++++---------
 2 files changed, 17 insertions(+), 12 deletions(-)

-- 
2.56.0