From 79cabc6cb7fb3a47d193cbb9a6bee71af5536dfc Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Mon, 13 Jul 2026 12:34:17 +0100 Subject: [PATCH] target/arm: Be more defensive for invalid tlbi_aa64_get_range MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's possible to program TCR_ELx with an invalid granule size, which could match passing an invalid granule size to TLBI RVA, which would then fall through to assert in arm_granule_bits. Cc: qemu-stable@nongnu.org Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters") Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-id: 20260710175818.528974-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell --- target/arm/tcg/tlb-insns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c index 1a0a332583..b24eb57788 100644 --- a/target/arm/tcg/tlb-insns.c +++ b/target/arm/tcg/tlb-insns.c @@ -854,7 +854,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx, gran = tlbi_range_tg_to_gran_size(page_size_granule); /* The granule encoded in value must match the granule in use. */ - if (gran != param.gran) { + if (gran != param.gran || gran == GranInvalid) { qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n", page_size_granule); return ret;