target/arm: Be more defensive for invalid tlbi_aa64_get_range
It's possible to program TCR_ELx with an invalid granule size, which could match passing an invalid granule size to TLBI RVA, which would then fall through to assert in arm_granule_bits. Cc: qemu-stable@nongnu.org Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-id: 20260710175818.528974-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson committed
Jul 13, 2026 at 12:34 UTC
79cabc6cb7fb3a47d193cbb9a6bee71af5536dfc
1 file changed
+1
-1
target/arm/tcg/tlb-insns.c
+1
-1
@@ -854,7 +854,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
854
gran = tlbi_range_tg_to_gran_size(page_size_granule);
855
856
/* The granule encoded in value must match the granule in use. */
857
- if (gran != param.gran) {
857
+ if (gran != param.gran || gran == GranInvalid) {
858
qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
859
page_size_granule);
860
return ret;