[PATCH v2 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK

[PATCH v2 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK

[Rishab Pradeep]

SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and never apply the pointer-masking
ignore transformation. With pointer masking enabled, a tagged ssp
raises a store/AMO page fault, whereas Spike, Sail and Whisper mask
the access.

Patch 1 factors the address adjustment out of get_address() and
get_address_indexed() into gen_pm_adjust_addr(), with no functional
change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still
written back unmasked, and the SSPOPCHK value comparison is unchanged.

Tested with the reproducer from the issue; all four cases now match
Spike.

v1 -> v2:
  - Patch 1: Collected Reviewed-by from Daniel Henrique Barboza.
  - Patch 2: Cite Privileged Architecture Specification, Section
    17.1.2.6 ("Memory Accesses Subject to Pointer Masking"), in the
    commit message, per Daniel's review.

v1: https://lore.kernel.org/qemu-devel/20261029183751.11143-1-rishab@rispop.dev/

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758

Rishab Pradeep (2):
  target/riscv: Factor out pointer-masking address adjustment
  target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

 .../tcg/insn_trans/trans_rvzicfiss.c.inc      |  8 +++++--
 target/riscv/tcg/translate.c                  | 21 ++++++++++---------
 2 files changed, 17 insertions(+), 12 deletions(-)

-- 
2.56.0

[PATCH v2 1/2] target/riscv: Factor out pointer-masking address adjustment

[Rishab Pradeep]

From: Rishab Pradeep <rishab@rispop.dev>

Move the addr_xl/addr_signed extract, which applies address-width
truncation and the pointer-masking ignore transformation, out of
get_address() and get_address_indexed() into a new helper,
gen_pm_adjust_addr(), so it can be applied to addresses that are not
formed from a GPR. No functional change.

Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
 target/riscv/tcg/translate.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 79b0f444ef..72d36764d8 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
+static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv src)
+{
+    if (ctx->addr_signed) {
+        tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
+    } else {
+        tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
+    }
+}
+
 /* Compute a canonical address from a register plus offset. */
 static TCGv get_address(DisasContext *ctx, int rs1, int imm)
 {
@@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_addi_tl(addr, src1, imm);
-    if (ctx->addr_signed) {
-        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
-    } else {
-        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
-    }
+    gen_pm_adjust_addr(ctx, addr, addr);
 
     return addr;
 }
@@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_add_tl(addr, src1, offs);
-    if (ctx->addr_signed) {
-        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
-    } else {
-        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
-    }
+    gen_pm_adjust_addr(ctx, addr, addr);
 
     return addr;
 }
-- 
2.56.0

Re: [PATCH v2 1/2] target/riscv: Factor out pointer-masking address adjustment

[Alistair Francis]

On Sun, 2026-11-08 at 00:46 -0600, Rishab Pradeep wrote:
> From: Rishab Pradeep <rishab@rispop.dev>
> 
> Move the addr_xl/addr_signed extract, which applies address-width
> truncation and the pointer-masking ignore transformation, out of
> get_address() and get_address_indexed() into a new helper,
> gen_pm_adjust_addr(), so it can be applied to addresses that are not
> formed from a GPR. No functional change.
> 
> Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Reviewed-by: Daniel Henrique Barboza
> <daniel.barboza@oss.qualcomm.com>
> Signed-off-by: Rishab Pradeep <rishab@rispop.dev>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/tcg/translate.c | 21 +++++++++++----------
>  1 file changed, 11 insertions(+), 10 deletions(-)
> 
> diff --git a/target/riscv/tcg/translate.c
> b/target/riscv/tcg/translate.c
> index 79b0f444ef..72d36764d8 100644
> --- a/target/riscv/tcg/translate.c
> +++ b/target/riscv/tcg/translate.c
> @@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd,
> target_ulong imm)
>      ctx->base.is_jmp = DISAS_NORETURN;
>  }
>  
> +static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv
> src)
> +{
> +    if (ctx->addr_signed) {
> +        tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
> +    } else {
> +        tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
> +    }
> +}
> +
>  /* Compute a canonical address from a register plus offset. */
>  static TCGv get_address(DisasContext *ctx, int rs1, int imm)
>  {
> @@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int
> rs1, int imm)
>      TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
>  
>      tcg_gen_addi_tl(addr, src1, imm);
> -    if (ctx->addr_signed) {
> -        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
> -    } else {
> -        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
> -    }
> +    gen_pm_adjust_addr(ctx, addr, addr);
>  
>      return addr;
>  }
> @@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext
> *ctx, int rs1, TCGv offs)
>      TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
>  
>      tcg_gen_add_tl(addr, src1, offs);
> -    if (ctx->addr_signed) {
> -        tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
> -    } else {
> -        tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
> -    }
> +    gen_pm_adjust_addr(ctx, addr, addr);
>  
>      return addr;
>  }

[PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

[Rishab Pradeep]

From: Rishab Pradeep <rishab@rispop.dev>

SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and the pointer-masking ignore
transformation is never applied. With pointer masking enabled, a
tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
same tagged pointer succeeds.

The Privileged Architecture Specification, Section 17.1.2.6 ("Memory
Accesses Subject to Pointer Masking"), applies the ignore
transformation to the effective address of explicit memory accesses.
SSPUSH and SSPOPCHK perform explicit store and load accesses at ssp,
so that address must be masked.

Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
still written back unmasked, and the SSPOPCHK comparison of the loaded
value against rs1 is unchanged.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
 target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
index d47a9f9c7d..c2dddcc8bb 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
@@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
     }
 
     TCGv addr = tcg_temp_new();
+    TCGv maddr = tcg_temp_new();
     TCGLabel *skip = gen_new_label();
     uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
     TCGv data = tcg_temp_new();
@@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
     TCGv_i64 wide_addr = tcg_temp_new_i64();
     tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
     tcg_gen_trunc_i64_tl(addr, wide_addr);
+    gen_pm_adjust_addr(ctx, maddr, addr);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
-    tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
+    tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
                        mxl_memop(ctx) | MO_ALIGN);
     TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
     tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
@@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
     }
 
     TCGv addr = tcg_temp_new();
+    TCGv maddr = tcg_temp_new();
     int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
     TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
     TCGv_i64 wide_addr = tcg_temp_new_i64();
@@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
     tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
     tcg_gen_trunc_i64_tl(addr, wide_addr);
     tcg_gen_addi_tl(addr, addr, tmp);
-    tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
+    gen_pm_adjust_addr(ctx, maddr, addr);
+    tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
                        mxl_memop(ctx) | MO_ALIGN);
     tcg_gen_ext_tl_i64(wide_addr, addr);
     tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
-- 
2.56.0

Re: [PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

[Daniel Henrique Barboza]

On 11/8/2026 3:46 AM, Rishab Pradeep wrote:
> From: Rishab Pradeep <rishab@rispop.dev>
> 
> SSPUSH and SSPOPCHK form their effective address from ssp rather than
> a GPR, so they bypass get_address() and the pointer-masking ignore
> transformation is never applied. With pointer masking enabled, a
> tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
> same tagged pointer succeeds.
> 
> The Privileged Architecture Specification, Section 17.1.2.6 ("Memory
> Accesses Subject to Pointer Masking"), applies the ignore
> transformation to the effective address of explicit memory accesses.
> SSPUSH and SSPOPCHK perform explicit store and load accesses at ssp,
> so that address must be masked.
> 
> Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
> still written back unmasked, and the SSPOPCHK comparison of the loaded
> value against rs1 is unchanged.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
> Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
> ---

Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>

>   target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> index d47a9f9c7d..c2dddcc8bb 100644
> --- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> +++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> @@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
>       }
>   
>       TCGv addr = tcg_temp_new();
> +    TCGv maddr = tcg_temp_new();
>       TCGLabel *skip = gen_new_label();
>       uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
>       TCGv data = tcg_temp_new();
> @@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
>       TCGv_i64 wide_addr = tcg_temp_new_i64();
>       tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
>       tcg_gen_trunc_i64_tl(addr, wide_addr);
> +    gen_pm_adjust_addr(ctx, maddr, addr);
>       decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
> -    tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
> +    tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
>                          mxl_memop(ctx) | MO_ALIGN);
>       TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
>       tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
> @@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
>       }
>   
>       TCGv addr = tcg_temp_new();
> +    TCGv maddr = tcg_temp_new();
>       int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
>       TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
>       TCGv_i64 wide_addr = tcg_temp_new_i64();
> @@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
>       tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
>       tcg_gen_trunc_i64_tl(addr, wide_addr);
>       tcg_gen_addi_tl(addr, addr, tmp);
> -    tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
> +    gen_pm_adjust_addr(ctx, maddr, addr);
> +    tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
>                          mxl_memop(ctx) | MO_ALIGN);
>       tcg_gen_ext_tl_i64(wide_addr, addr);
>       tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));

Re: [PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

[Rishab Pradeep]

Sashiko suggested a Fixes tag pointing at f06bfe3dc38c ("target/riscv:
implement zicfiss instructions"). I agree this needs a Fixes tag, but
I think the right target is the pointer-masking commit rather than the
zicfiss one. Zicfiss predates it, and its ssp accesses were correct
until get_address() started applying the ignore transformation without
covering ssp:

Fixes: 4d501a7a7fb4 ("target/riscv: Update address modify functions to take into account pointer masking")

Alistair, could you add this when applying, or would you prefer a v3?

Thanks,
Rishab

Re: [PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

[Alistair Francis]

On Sun, 2026-11-08 at 22:35 -0600, Rishab Pradeep wrote:
> Sashiko suggested a Fixes tag pointing at f06bfe3dc38c
> ("target/riscv:
> implement zicfiss instructions"). I agree this needs a Fixes tag, but
> I think the right target is the pointer-masking commit rather than
> the
> zicfiss one. Zicfiss predates it, and its ssp accesses were correct
> until get_address() started applying the ignore transformation
> without
> covering ssp:
> 
> Fixes: 4d501a7a7fb4 ("target/riscv: Update address modify functions
> to take into account pointer masking")
> 
> Alistair, could you add this when applying, or would you prefer a v3?

I can add it

Thanks!

Applied to riscv-to-apply.next

Alistair

> 
> Thanks,
> Rishab

Re: [PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses

[Alistair Francis]

On Sun, 2026-11-08 at 00:46 -0600, Rishab Pradeep wrote:
> From: Rishab Pradeep <rishab@rispop.dev>
> 
> SSPUSH and SSPOPCHK form their effective address from ssp rather than
> a GPR, so they bypass get_address() and the pointer-masking ignore
> transformation is never applied. With pointer masking enabled, a
> tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
> same tagged pointer succeeds.
> 
> The Privileged Architecture Specification, Section 17.1.2.6 ("Memory
> Accesses Subject to Pointer Masking"), applies the ignore
> transformation to the effective address of explicit memory accesses.
> SSPUSH and SSPOPCHK perform explicit store and load accesses at ssp,
> so that address must be masked.
> 
> Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
> still written back unmasked, and the SSPOPCHK comparison of the
> loaded
> value against rs1 is unchanged.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
> Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
> Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
> Signed-off-by: Rishab Pradeep <rishab@rispop.dev>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> index d47a9f9c7d..c2dddcc8bb 100644
> --- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> +++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
> @@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx,
> arg_sspopchk *a)
>      }
>  
>      TCGv addr = tcg_temp_new();
> +    TCGv maddr = tcg_temp_new();
>      TCGLabel *skip = gen_new_label();
>      uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
>      TCGv data = tcg_temp_new();
> @@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx,
> arg_sspopchk *a)
>      TCGv_i64 wide_addr = tcg_temp_new_i64();
>      tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState,
> ssp));
>      tcg_gen_trunc_i64_tl(addr, wide_addr);
> +    gen_pm_adjust_addr(ctx, maddr, addr);
>      decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
> -    tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
> +    tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
>                         mxl_memop(ctx) | MO_ALIGN);
>      TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
>      tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
> @@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx,
> arg_sspush *a)
>      }
>  
>      TCGv addr = tcg_temp_new();
> +    TCGv maddr = tcg_temp_new();
>      int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
>      TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
>      TCGv_i64 wide_addr = tcg_temp_new_i64();
> @@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx,
> arg_sspush *a)
>      tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState,
> ssp));
>      tcg_gen_trunc_i64_tl(addr, wide_addr);
>      tcg_gen_addi_tl(addr, addr, tmp);
> -    tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
> +    gen_pm_adjust_addr(ctx, maddr, addr);
> +    tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
>                         mxl_memop(ctx) | MO_ALIGN);
>      tcg_gen_ext_tl_i64(wide_addr, addr);
>      tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState,
> ssp));