Commit 31b8d287b7 for qemu.org

commit 31b8d287b7fe59d135b836cacaaa364efe598ec0
Author: Zenghui Yu <zenghui.yu@linux.dev>
Date:   Mon Mar 30 16:18:06 2026 +0100

    target/arm: Don't skip access flag fault for AccessType_AT

    As per the pseudo code from DDI0487 M.a.a (on J1-16021) AArch64.S1Walk():

      // Check descriptor AF bit
      elsif (descriptor<10> == '0' && walkparams.ha == '0' &&
              (!accdesc.acctype IN {AccessType_DC, AccessType_IC} ||
               boolean IMPLEMENTATION_DEFINED "Generate access flag fault on IC/DC operations")) then
          fault.statuscode = Fault_AccessFlag;

    an access flag fault should be generated for AccessType_AT, if the AF bit
    is 0 and !param.ha.

    Besides, we should continue to not raise the access flag fault for
    in_debug = true which is what we've been doing previously (before commit
    efebeec13d07) for LPAE and is what intention of the debugger access
    codepath is.

    Cc: qemu-stable@nongnu.org
    Fixes: efebeec13d07 ("target/arm: Skip AF and DB updates for AccessType_AT")
    Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
    Message-id: 20260324160321.96347-1-zenghui.yu@linux.dev
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e289f88124..08a76bd3f1 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2118,6 +2118,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));

+    if (likely(!ptw->in_debug)) {
+        /* Check descriptor AF bit */
+        if (!(descriptor & (1 << 10)) && !param.ha) {
+            fi->type = ARMFault_AccessFlag;
+            goto do_fault;
+        }
+    }
+
     /*
      * For AccessType_AT, DB is not updated (AArch64.SetDirtyFlag),
      * and it is IMPLEMENTATION DEFINED whether AF is updated
@@ -2127,15 +2135,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         /*
          * Access flag.
          * If HA is enabled, prepare to update the descriptor below.
-         * Otherwise, pass the access fault on to software.
          */
-        if (!(descriptor & (1 << 10))) {
-            if (param.ha) {
-                new_descriptor |= 1 << 10; /* AF */
-            } else {
-                fi->type = ARMFault_AccessFlag;
-                goto do_fault;
-            }
+        if (!(descriptor & (1 << 10)) && param.ha) {
+            new_descriptor |= 1 << 10; /* AF */
         }

         /*