From: Richard Henderson <[email protected]> It's possible to program TCR_ELx with an invalid granule size, which could match passing an invalid granule size to TLBI RVA, which would then fall through to assert in arm_granule_bits.
Cc: [email protected] Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters") Signed-off-by: Richard Henderson <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Message-id: [email protected] Signed-off-by: Peter Maydell <[email protected]> (cherry picked from commit 79cabc6cb7fb3a47d193cbb9a6bee71af5536dfc) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c index 630a481f0f8..4d0442cc56c 100644 --- a/target/arm/tcg/tlb-insns.c +++ b/target/arm/tcg/tlb-insns.c @@ -839,7 +839,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx, gran = tlbi_range_tg_to_gran_size(page_size_granule); /* The granule encoded in value must match the granule in use. */ - if (gran != param.gran) { + if (gran != param.gran || gran == GranInvalid) { qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n", page_size_granule); return ret; -- 2.47.3
