Bug in tlbi_aa64_vae2is_write: tlbbits_for_regime called with swapped ARMMMUIdx_ values?

[Rebecca Cran]

I noticed the following in tlbi_aa64_vae2is_write: it appears that when 
calling tlbbits_for_regime the ARMMMUIdx values are swapped?

static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                   uint64_t value)
{
    CPUState *cs = env_cpu(env);
    uint64_t pageaddr = sextract64(value << 12, 0, 56);
    bool secure = arm_is_secure_below_el3(env);
    int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : 
ARMMMUIdx_SE2,
                                  pageaddr);

    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, 
bits);
}

--
Rebecca Cran