In Armv8-R AArch32 the shareability field of an MPU region lives in
PRBAR, not PRLAR:

  PRBAR: [31:6] BASE  [5] RES0  [4:3] SH  [2:1] AP  [0] XN
  PRLAR: [31:6] LIMIT [5:4] RES0  [3:1] AttrIndx  [0] EN

(Arm Cortex-R52 TRM 100026_0103_00_en: Tables 3-80 and 3-83 for
HPRBAR/HPRLAR, Tables 3-124 and 3-127 for PRBAR/PRLAR.)

Without this fix, address translation instructions like ATS1HR
will return wrong value for PAR.SH.

Signed-off-by: Jean-Francois Bortolotti <jeff@borto.fr>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index a29de0385f..663a4862a4 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3085,7 +3085,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
         if (!arm_feature(env, ARM_FEATURE_M)) {
             uint8_t attrindx = extract32(matched_rlar, 1, 3);
             uint64_t mair = env->cp15.mair_el[regime_el(mmu_idx)];
-            uint8_t sh = extract32(matched_rlar, 3, 2);
+            uint8_t sh = extract32(matched_rbar, 3, 2);
 
             if (regime_sctlr(env, mmu_idx) & SCTLR_WXN &&
                 result->f.prot & PAGE_WRITE && mmu_idx != ARMMMUIdx_Stage2) {
-- 
2.34.1