[xen master] x86/P2M: correct old entry checking in p2m_remove_entry()

[patchbot@xxxxxxx]

commit b04114ae2da0cae0a3e13324ecad21e1327bf260
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Mar 11 09:55:20 2025 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Mar 11 09:55:20 2025 +0100

    x86/P2M: correct old entry checking in p2m_remove_entry()
    
    Using p2m_is_valid() isn't quite right here. It expanding to RAM+MMIO,
    the subsequent p2m_mmio_direct check effectively reduces its use to
    RAM+MMIO_DM. Yet MMIO_DM entries, which are never marked present in the
    page tables, won't pass the mfn_valid() check. It is, however, quite
    plausible (and supported by the rest of the function) to permit
    "removing" hole entries, i.e. in particular to convert MMIO_DM to
    INVALID. Which leaves the original check to be against RAM (plus MFN
    validity), while HOLE then instead wants INVALID_MFN to be passed in.
    
    Further more grant and foreign entries (together with RAM becoming
    ANY_RAM) as well as BROKEN want the MFN checking, too.
    
    All other types (i.e. MMIO_DIRECT and POD) want rejecting here rather
    than skipping, for needing handling / accounting elsewhere.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
---
 xen/arch/x86/mm/p2m.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
index 1739133fc2..4f8a781842 100644
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -522,9 +522,9 @@ p2m_remove_entry(struct p2m_domain *p2m, gfn_t gfn, mfn_t 
mfn,
         mfn_t mfn_return = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0,
                                           &cur_order, NULL);
 
-        if ( p2m_is_valid(t) &&
-             (!mfn_valid(mfn) || t == p2m_mmio_direct ||
-              !mfn_eq(mfn_add(mfn, i), mfn_return)) )
+        if ( p2m_is_any_ram(t) || p2m_is_broken(t)
+             ? !mfn_valid(mfn) || !mfn_eq(mfn_add(mfn, i), mfn_return)
+             : !p2m_is_hole(t) || !mfn_eq(mfn, INVALID_MFN) )
             return -EILSEQ;
 
         i += (1UL << cur_order) -
--
generated by git-patchbot for /home/xen/git/xen.git#master