diff --git a/qemu/target/riscv/pmp.c b/qemu/target/riscv/pmp.c
index e385f6f7..1878698f 100644
--- a/qemu/target/riscv/pmp.c
+++ b/qemu/target/riscv/pmp.c
@@ -181,7 +181,7 @@ static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 
     case PMP_AMATCH_NA4:
         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
-        ea = (this_addr + 4u) - 1u;
+        ea = (sa + 4u) - 1u;
         break;
 
     case PMP_AMATCH_NAPOT: