bool                    hpd;
        bool                    e0poe;
        bool                    poe;
+       bool                    pan;
        bool                    be;
        bool                    s2;
 };
 
        wi->regime = compute_translation_regime(vcpu, op);
        as_el0 = (op == OP_AT_S1E0R || op == OP_AT_S1E0W);
+       wi->pan = (op == OP_AT_S1E1RP || op == OP_AT_S1E1WP) &&
+                 (*vcpu_cpsr(vcpu) & PSR_PAN_BIT);
 
        va55 = va & BIT(55);
 
        }
 }
 
-static void compute_s1_permissions(struct kvm_vcpu *vcpu, u32 op,
+static void compute_s1_permissions(struct kvm_vcpu *vcpu,
                                   struct s1_walk_info *wi,
                                   struct s1_walk_result *wr)
 {
+       bool pan;
+
        if (!s1pie_enabled(vcpu, wi->regime))
                compute_s1_direct_permissions(vcpu, wi, wr);
        else
        if (!wi->hpd)
                compute_s1_hierarchical_permissions(vcpu, wi, wr);
 
-       if (op == OP_AT_S1E1RP || op == OP_AT_S1E1WP) {
-               bool pan;
-
-               pan = *vcpu_cpsr(vcpu) & PSR_PAN_BIT;
-               pan &= wr->ur || wr->uw || (pan3_enabled(vcpu, wi->regime) && wr->ux);
-               wr->pw &= !pan;
-               wr->pr &= !pan;
-       }
+       pan = wi->pan && (wr->ur || wr->uw ||
+                         (pan3_enabled(vcpu, wi->regime) && wr->ux));
+       wr->pw &= !pan;
+       wr->pr &= !pan;
 }
 
 static u64 handle_at_slow(struct kvm_vcpu *vcpu, u32 op, u64 vaddr)
        if (ret)
                goto compute_par;
 
-       compute_s1_permissions(vcpu, op, &wi, &wr);
+       compute_s1_permissions(vcpu, &wi, &wr);
 
        switch (op) {
        case OP_AT_S1E1RP: