Commit 79cabc6cb7 for qemu.org

commit 79cabc6cb7fb3a47d193cbb9a6bee71af5536dfc
Author: Richard Henderson <richard.henderson@linaro.org>
Date:   Mon Jul 13 12:34:17 2026 +0100

    target/arm: Be more defensive for invalid tlbi_aa64_get_range

    It's possible to program TCR_ELx with an invalid granule size,
    which could match passing an invalid granule size to TLBI RVA,
    which would then fall through to assert in arm_granule_bits.

    Cc: qemu-stable@nongnu.org
    Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters")
    Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-id: 20260710175818.528974-1-richard.henderson@linaro.org
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index 1a0a332583..b24eb57788 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -854,7 +854,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
     gran = tlbi_range_tg_to_gran_size(page_size_granule);

     /* The granule encoded in value must match the granule in use. */
-    if (gran != param.gran) {
+    if (gran != param.gran || gran == GranInvalid) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
                       page_size_granule);
         return ret;