xen: arm: correct arm64 version of gva_to_ma_par The implementation was backwards and checked that the guest could read when asked about write and vice versa. This is an update to the fix for XSA-98. Reported-by: Tamas K Lengyel Signed-off-by: Ian Campbell diff --git a/xen/include/asm-arm/arm64/page.h b/xen/include/asm-arm/arm64/page.h index bb10164..386e434 100644 --- a/xen/include/asm-arm/arm64/page.h +++ b/xen/include/asm-arm/arm64/page.h @@ -86,9 +86,9 @@ static inline uint64_t gva_to_ma_par(vaddr_t va, unsigned int flags) uint64_t par, tmp = READ_SYSREG64(PAR_EL1); if ( (flags & GV2M_WRITE) == GV2M_WRITE ) - asm volatile ("at s12e1r, %0;" : : "r" (va)); - else asm volatile ("at s12e1w, %0;" : : "r" (va)); + else + asm volatile ("at s12e1r, %0;" : : "r" (va)); isb(); par = READ_SYSREG64(PAR_EL1); WRITE_SYSREG64(tmp, PAR_EL1);