Commit 7eacd04f49 for qemu.org

commit 7eacd04f49b901927e42641e5050245eb449d282
Author: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date:   Mon Nov 9 13:52:08 2026 +0000

    target/arm/ptw: check XN for ARMv6 in get_S1prot()

    The XN bits are supported in all ARMv6 and onward VMSA translation
    tables, but we were ignoring them unless the CPU was at least v7.

    For the ARM_FEATURE_V6 case, we retrieve the AP and XN bits in
    get_phys_addr_v6() but we don't check the XN bit in get_S1prot().
    Since you can't validly get to get_S1prot() except via
    get_phys_addr_v6() or get_phys_addr_lpae(), we can remove the version
    check entirely and need not explicitly check for "v6 or better"..

    Change the `else if (arm_feature(env, ARM_FEATURE_V7))` check in
    get_S1prot() to plain `else`.

    Cc: qemu-stable@nongnu.org
    Fixes: d8e052b3876356 ("target-arm: get_phys_addr_lpae: more xn control")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4367
    Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
    Message-id: 20261106-armv6-xn-check-v2-1-1291bb77a6c2@linaro.org
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    [PMM: tweaked commit message]
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 2e67d02493..e36d2ff938 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1595,7 +1595,7 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         if (regime_has_2_ranges(mmu_idx) && !is_user) {
             xn = pxn || (user_rw & PAGE_WRITE);
         }
-    } else if (arm_feature(env, ARM_FEATURE_V7)) {
+    } else {
         switch (regime_el(mmu_idx)) {
         case 1:
         case 3:
@@ -1613,8 +1613,6 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         case 2:
             break;
         }
-    } else {
-        xn = wxn = 0;
     }

     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {