friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

target/arm: Be more defensive for invalid tlbi_aa64_get_range

Browse Source 
It's possible to program TCR_ELx with an invalid granule size,
which could match passing an invalid granule size to TLBI RVA,
which would then fall through to assert in arm_granule_bits.

Cc: qemu-stable@nongnu.org
Fixes: 3c003f7029 ("target/arm: Use ARMGranuleSize in ARMVAParameters")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260710175818.528974-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Richard Henderson
2026-07-13 12:34:17 +01:00
committed by Peter Maydell
parent b9e03010b1
commit 79cabc6cb7
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
target/arm/tcg/tlb-insns.c
View File

@@ -854,7 +854,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
gran = tlbi_range_tg_to_gran_size(page_size_granule); gran = tlbi_range_tg_to_gran_size(page_size_granule);
/* The granule encoded in value must match the granule in use. */ /* The granule encoded in value must match the granule in use. */
if (gran != param.gran) { if (gran != param.gran || gran == GranInvalid) {
qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n", qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
page_size_granule); page_size_granule);
return ret; return ret;