KVM: x86/mmu: Update iter->old_spte if cmpxchg64 on mirror SPTE "fails"

Pass a pointer to iter->old_spte, not simply its value, when setting an
external SPTE in __tdp_mmu_set_spte_atomic(), so that the iterator's value
will be updated if the cmpxchg64 to freeze the mirror SPTE fails.  The bug
is currently benign as TDX is mutualy exclusive with all paths that do
"local" retry", e.g. clear_dirty_gfn_range() and wrprot_gfn_range().

Fixes: 77ac7079e66d ("KVM: x86/tdp_mmu: Propagate building mirror page tables")
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Link: https://patch.msgid.link/20260129011517.3545883-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
index 5a2f8ce9a32b8d8dd5ac819d411eb8dc721a96b0..f98afc3422ce50ccacd037dac3e5e9dfbb7956d5 100644 (file)
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -509,10 +509,10 @@ static void *get_external_spt(gfn_t gfn, u64 new_spte, int level)
 }
 
 static int __must_check set_external_spte_present(struct kvm *kvm, tdp_ptep_t sptep,
-                                                gfn_t gfn, u64 old_spte,
+                                                gfn_t gfn, u64 *old_spte,
                                                 u64 new_spte, int level)
 {
-       bool was_present = is_shadow_present_pte(old_spte);
+       bool was_present = is_shadow_present_pte(*old_spte);
        bool is_present = is_shadow_present_pte(new_spte);
        bool is_leaf = is_present && is_last_spte(new_spte, level);
        int ret = 0;
@@ -525,7 +525,7 @@ static int __must_check set_external_spte_present(struct kvm *kvm, tdp_ptep_t sp
         * page table has been modified. Use FROZEN_SPTE similar to
         * the zapping case.
         */
-       if (!try_cmpxchg64(rcu_dereference(sptep), &old_spte, FROZEN_SPTE))
+       if (!try_cmpxchg64(rcu_dereference(sptep), old_spte, FROZEN_SPTE))
                return -EBUSY;
 
        /*
@@ -541,7 +541,7 @@ static int __must_check set_external_spte_present(struct kvm *kvm, tdp_ptep_t sp
                ret = kvm_x86_call(link_external_spt)(kvm, gfn, level, external_spt);
        }
        if (ret)
-               __kvm_tdp_mmu_write_spte(sptep, old_spte);
+               __kvm_tdp_mmu_write_spte(sptep, *old_spte);
        else
                __kvm_tdp_mmu_write_spte(sptep, new_spte);
        return ret;
@@ -670,7 +670,7 @@ static inline int __must_check __tdp_mmu_set_spte_atomic(struct kvm *kvm,
                        return -EBUSY;
 
                ret = set_external_spte_present(kvm, iter->sptep, iter->gfn,
-                                               iter->old_spte, new_spte, iter->level);
+                                               &iter->old_spte, new_spte, iter->level);
                if (ret)
                        return ret;
        } else {