Commit 1dece86e3c for qemu.org

commit 1dece86e3c7e0489745edb084b31c0ca55174e4c
Author: Gilles Grimaud <gilles.grimaud@univ-lille.fr>
Date:   Mon Sep 14 21:23:21 2026 +0200

    target/arm: fix MPU SIZE min for v6-M/v7-M/v7-R

    The PMSAv7 walk accepted any non-zero region size field, but Armv6-M
    requires a minimum of 7 (256 B), Armv7-M requires 4 (32 B) and v7-R
    retains its current minimum of 1 (4 B). Introduce rsize_min based on
    ARM_FEATURE_M and ARM_FEATURE_V7 and reject smaller values. The PMSAv8
    path is handled earlier and remains unchanged.

    Suggested-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Gilles Grimaud <gilles.grimaud@univ-lille.fr>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index a29de0385f..cb9e73fc0a 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2720,6 +2720,11 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_user = regime_is_user(mmu_idx);
     bool secure = arm_space_is_secure(ptw->in_space);
+    uint32_t rsize_min = 1;
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        rsize_min = arm_feature(env, ARM_FEATURE_V7) ? 4 : 7;
+    }

     result->f.phys_addr = address;
     result->f.lg_page_size = TARGET_PAGE_BITS;
@@ -2748,11 +2753,13 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
                 continue;
             }

-            if (!rsize) {
+            if (rsize < rsize_min) {
                 qemu_log_mask(LOG_GUEST_ERROR,
-                              "DRSR[%d]: Rsize field cannot be 0\n", n);
+                              "DRSR[%d]: invalid Rsize field 0x%x\n",
+                              n, rsize);
                 continue;
             }
+
             rsize++;
             rmask = (1ull << rsize) - 1;