KVM: TDX: Move KVM_BUG_ON()s in __tdp_mmu_set_spte_atomic() to TDX code

Drop some KVM_BUG_ON()s that are guarding against TDP MMU attempting to
propagate unsupported changes to the external page table through
__tdp_mmu_set_spte_atomic(). Have TDX code trigger them instead.

Now that TDP MMU logically allows propagating atomic zapping operation to
the external page table through the set_external_spte() op in
__tdp_mmu_set_spte_atomic(), TDX code will trigger the KVM_BUG_ON() on the
atomic zapping request instead. (Note: non-atomic zapping is not propagated
via the set_external_spte() op yet).

Despite the generic naming, external page table ops are designed completely
around TDX. They hook the bare minimum of what is needed, and exclude the
operations that are not supported by TDX. To help wrangle which operations
are handleable by various operations, warnings and KVM_BUG_ON()s exist in
the code. These warnings and KVM_BUG_ON()s put the burden of understanding
which operations should be forwarded to TDX code on TDP MMU developers, who
often read the code without TDX context.

Future changes will transition the encapsulation of this domain knowledge
to TDX code by funneling the external page table updates through a central
update mechanism. In this paradigm, the central update mechanism can
encapsulate the special knowledge, but will not have as much knowledge
about what operation is in progress.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260509075544.4210-1-yan.y.zhao@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
index 4e961b331780ba1f26599dc55fd077e46e6d9256..ed806a4768c2c8f37e1fc77a3d88e4f0c9641635 100644 (file)
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -610,20 +610,10 @@ static inline int __must_check __tdp_mmu_set_spte_atomic(struct kvm *kvm,
        WARN_ON_ONCE(iter->yielded || is_frozen_spte(iter->old_spte));
 
        if (is_mirror_sptep(iter->sptep) && !is_frozen_spte(new_spte)) {
-               bool was_present = is_shadow_present_pte(iter->old_spte);
                int ret;
 
-               KVM_BUG_ON(was_present, kvm);
-
                lockdep_assert_held(&kvm->mmu_lock);
 
-               /*
-                * Users of atomic zapping don't operate on mirror roots,
-                * so don't handle it and bug the VM if it's seen.
-                */
-               if (KVM_BUG_ON(!is_shadow_present_pte(new_spte), kvm))
-                       return -EBUSY;
-
                /*
                 * We need to lock out other updates to the SPTE until the external
                 * page table has been modified. Use FROZEN_SPTE similar to

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index c7ca5c79ada2044e744b7de4319d64c2ca1a10d7..ea3ad913e750a33d23aa6988db0141433e8dc7f7 100644 (file)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1721,6 +1721,9 @@ static int tdx_sept_map_leaf_spte(struct kvm *kvm, gfn_t gfn, enum pg_level leve
 static int tdx_sept_set_private_spte(struct kvm *kvm, gfn_t gfn, u64 old_spte,
                                     u64 new_spte, enum pg_level level)
 {
+       if (KVM_BUG_ON(is_shadow_present_pte(old_spte), kvm))
+               return -EIO;
+
        if (KVM_BUG_ON(!is_shadow_present_pte(new_spte), kvm))
                return -EIO;