xen: arm: correct arm64 version of gva_to_ma_par

The implementation was backwards and checked that the guest could
read when asked about write and vice versa.

This is an update to the fix for XSA-98.

Reported-by: Tamas K Lengyel <tklengyel@sec.in.tum.de>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/xen/include/asm-arm/arm64/page.h b/xen/include/asm-arm/arm64/page.h
index 1fd416d4b2b65939cabece3180ba2aabcd2066a3..e7a761dd5a9393ff30487bb1bb2f013731eb6eee 100644 (file)
--- a/xen/include/asm-arm/arm64/page.h
+++ b/xen/include/asm-arm/arm64/page.h
@@ -89,9 +89,9 @@ static inline uint64_t gva_to_ma_par(vaddr_t va, unsigned int flags)
     uint64_t par, tmp = READ_SYSREG64(PAR_EL1);
 
     if ( (flags & GV2M_WRITE) == GV2M_WRITE )
-        asm volatile ("at s12e1r, %0;" : : "r" (va));
-    else
         asm volatile ("at s12e1w, %0;" : : "r" (va));
+    else
+        asm volatile ("at s12e1r, %0;" : : "r" (va));
     isb();
     par = READ_SYSREG64(PAR_EL1);
     WRITE_SYSREG64(tmp, PAR_EL1);