target/riscv: fix stale ptshift and base on page walk restart

When the atomic compare-and-swap for updating A/D bits in the page table entry fails due to a concurrent PTE modification by another vCPU, get_physical_address() jumps to the 'restart' label to re-walk the page table from the root. However, neither 'ptshift' nor 'base' are re-initialized before the restart. After the walk completes, ptshift has been decremented to its final value and base has been overwritten with an inner PTE PPN. On goto restart, the for loop resets i=0 but ptshift and base remain stale, causing the restarted walk to compute incorrect PTE addresses. In an SMP guest with MTTCG and Svadu active, this can result in incorrect physical address mappings or guest crashes. Fix by saving the root base address and re-initializing both ptshift and base on each restart. Fixes: 0c3e702aca ("RISC-V CPU Helpers") Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260401053853.10473-1-sebasjosue84@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>