Commit 07a4c09e4c for qemu.org

commit 07a4c09e4c1c9de78b3ee287b3ac7b5badc0277b
Author: Bibo Mao <maobibo@loongson.cn>
Date:   Fri Oct 30 16:05:16 2026 +0800

    target/loongarch: Clear PAGE_READ when PTE.NR is set

    On LoongArch the NR bit in a PTE indicates that the page is not
    readable, i.e. it is write-only. When translating a PTE to QEMU
    protection bits, clear PAGE_READ if PTE.NR is set instead of always
    exposing PAGE_READ.

    This avoids incorrectly marking a write-only page as readable.

    Cc: qemu-stable@nongnu.org
    Fixes: 7392cb1c7b24 ("target/loongarch: Add common function loongarch_check_pte()")
    Signed-off-by: Bibo Mao <maobibo@loongson.cn>
    Reviewed-by: Xianglai Li <lixianglai@loongson.cn>

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 271b4adc17..6b98fff691 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -101,7 +101,10 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,

     context->physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
                         (context->addr & MAKE_64BIT_MASK(0, tlb_ps));
-    context->prot = PAGE_READ;
+    context->prot = 0;
+    if (!tlb_nr) {
+        context->prot |= PAGE_READ;
+    }
     context->mmu_index = tlb_plv;
     if (tlb_d) {
         context->prot |= PAGE_WRITE;