zbyszek / rpms / xen

Forked from rpms/xen 5 years ago
Clone
Blob Blame History Raw
xen: arm: correct arm64 version of gva_to_ma_par

The implementation was backwards and checked that the guest could
read when asked about write and vice versa.

This is an update to the fix for XSA-98.

Reported-by: Tamas K Lengyel <tklengyel@sec.in.tum.de>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/xen/include/asm-arm/arm64/page.h b/xen/include/asm-arm/arm64/page.h
index bb10164..386e434 100644
--- a/xen/include/asm-arm/arm64/page.h
+++ b/xen/include/asm-arm/arm64/page.h
@@ -86,9 +86,9 @@ static inline uint64_t gva_to_ma_par(vaddr_t va, unsigned int flags)
     uint64_t par, tmp = READ_SYSREG64(PAR_EL1);
 
     if ( (flags & GV2M_WRITE) == GV2M_WRITE )
-        asm volatile ("at s12e1r, %0;" : : "r" (va));
-    else
         asm volatile ("at s12e1w, %0;" : : "r" (va));
+    else
+        asm volatile ("at s12e1r, %0;" : : "r" (va));
     isb();
     par = READ_SYSREG64(PAR_EL1);
     WRITE_SYSREG64(tmp, PAR_EL1);