KVM: TDX: Drop kvm_x86_ops.remove_external_spte()

Drop kvm_x86_ops.remove_external_spte(), and instead handle the removal of
leaf SPTEs in the S-EPT (a.k.a. external page table) in
kvm_x86_ops.set_external_spte(). This will also allow extending
tdx_sept_set_private_spte() to support splitting a huge S-EPT entry without
needing yet another kvm_x86_ops hook.

Now all changes for removing leaf mirror SPTEs are propagated through
kvm_x86_ops.set_external_spte().
- When removing leaf mirror SPTEs under shared mmu_lock (though currently
  no path can trigger this scenario and TDX does not support this
  scenario), tdx_sept_remove_private_spte() may produce a warning due to
  lockdep_assert_held_write() or may return -EIO and trigger TDX_BUG_ON()
  due to concurrent BLOCK, TRACK, REMOVE.
- When removing leaf mirror SPTEs under exclusive mmu_lock, all errors are
  unexpected. If any error occurs in this scenario,
  tdx_sept_remove_private_spte() will return -EIO and trigger KVM_BUG_ON().
  A redundant KVM_BUG_ON() call will also be triggered in TDP MMU core in
  handle_changed_spte(), which is benign (the WARN will fire if and only if
  the VM isn't already bugged).

Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260509075709.4322-1-yan.y.zhao@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h
index 2cb393000ee92725f2e295ee73687335d2259ed8..771d991562caf755cf93214f4cf850a622a5a23a 100644 (file)
--- a/arch/x86/include/asm/kvm-x86-ops.h
+++ b/arch/x86/include/asm/kvm-x86-ops.h
@@ -98,7 +98,6 @@ KVM_X86_OP_OPTIONAL_RET0(tdp_has_smep)
 KVM_X86_OP(load_mmu_pgd)
 KVM_X86_OP_OPTIONAL_RET0(set_external_spte)
 KVM_X86_OP_OPTIONAL_RET0(free_external_spt)
-KVM_X86_OP_OPTIONAL(remove_external_spte)
 KVM_X86_OP(has_wbinvd_exit)
 KVM_X86_OP(get_l2_tsc_offset)
 KVM_X86_OP(get_l2_tsc_multiplier)

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index b8ca43241b11545569a5152e49efbb2136ceadde..dc5625950e5bf4bb87bc67d08dc1d4b692b86fd2 100644 (file)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1919,9 +1919,6 @@ struct kvm_x86_ops {
        int (*free_external_spt)(struct kvm *kvm, gfn_t gfn, enum pg_level level,
                                 void *external_spt);
 
-       /* Update external page table from spte getting removed, and flush TLB. */
-       void (*remove_external_spte)(struct kvm *kvm, gfn_t gfn, enum pg_level level,
-                                    u64 mirror_spte);
 
        bool (*has_wbinvd_exit)(void);
 

diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
index 3ba7556a8d2fdba8e648c2bfe4a21f954fd84c51..72d323f2d0dcc5c8229114298758e22652dafbad 100644 (file)
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -359,25 +359,6 @@ static void tdp_mmu_unlink_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
        spin_unlock(&kvm->arch.tdp_mmu_pages_lock);
 }
 
-static void remove_external_spte(struct kvm *kvm, gfn_t gfn, u64 old_spte,
-                                int level)
-{
-       /*
-        * External (TDX) SPTEs are limited to PG_LEVEL_4K, and external
-        * PTs are removed in a special order, involving free_external_spt().
-        * But remove_external_spte() will be called on non-leaf PTEs via
-        * __tdp_mmu_zap_root(), so avoid the error the former would return
-        * in this case.
-        */
-       if (!is_last_spte(old_spte, level))
-               return;
-
-       /* Zapping leaf spte is allowed only when write lock is held. */
-       lockdep_assert_held_write(&kvm->mmu_lock);
-
-       kvm_x86_call(remove_external_spte)(kvm, gfn, level, old_spte);
-}
-
 /**
  * handle_removed_pt() - handle a page table removed from the TDP structure
  *
@@ -472,9 +453,6 @@ static void handle_removed_pt(struct kvm *kvm, tdp_ptep_t pt, bool shared)
                                                          FROZEN_SPTE, level);
                }
                handle_changed_spte(kvm, sp, gfn, old_spte, FROZEN_SPTE, level, shared);
-
-               if (is_mirror_sp(sp))
-                       remove_external_spte(kvm, gfn, old_spte, level);
        }
 
        if (is_mirror_sp(sp) &&
@@ -585,14 +563,14 @@ static int __handle_changed_spte(struct kvm *kvm, struct kvm_mmu_page *sp,
         * SPTE being converted to a hugepage (leaf) or being zapped.  Shadow
         * pages are kernel allocations and should never be migrated.
         *
-        * For the mirror page table, propagate changes to present or changes of
-        * leaf SPTEs to !present under shared mmu_lock to the external SPTE via
+        * For the mirror page table, propagate all changes to the external SPTE
+        * (except zapping/promotion of non-leaf SPTEs) via the
         * set_external_spte() op.
         */
        if (was_present && !was_leaf &&
            (is_leaf || !is_present || WARN_ON_ONCE(pfn_changed))) {
                handle_removed_pt(kvm, spte_to_child_pt(old_spte, level), shared);
-       } else if (is_mirror_sp(sp) && (is_present || shared)) {
+       } else if (is_mirror_sp(sp)) {
                int r;
 
                r = kvm_x86_call(set_external_spte)(kvm, gfn, old_spte, new_spte, level);
@@ -745,15 +723,6 @@ static u64 tdp_mmu_set_spte(struct kvm *kvm, tdp_ptep_t sptep, u64 old_spte,
 
        handle_changed_spte(kvm, sp, gfn, old_spte, new_spte, level, false);
 
-       /*
-        * Users that do non-atomic setting of PTEs don't operate on mirror
-        * roots, so don't handle it and bug the VM if it's seen.
-        */
-       if (is_mirror_sptep(sptep)) {
-               KVM_BUG_ON(is_shadow_present_pte(new_spte), kvm);
-               remove_external_spte(kvm, gfn, old_spte, level);
-       }
-
        return old_spte;
 }
 

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 8991f08ef81cde74194dea05d7953ba8bdb01517..54c85b81a09f5acafaabed014abef422e87b35f4 100644 (file)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1764,11 +1764,11 @@ static void tdx_track(struct kvm *kvm)
        kvm_make_all_cpus_request(kvm, KVM_REQ_OUTSIDE_GUEST_MODE);
 }
 
-static void tdx_sept_remove_private_spte(struct kvm *kvm, gfn_t gfn,
-                                        enum pg_level level, u64 mirror_spte)
+static int tdx_sept_remove_private_spte(struct kvm *kvm, gfn_t gfn,
+                                       enum pg_level level, u64 old_spte)
 {
        struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
-       kvm_pfn_t pfn = spte_to_pfn(mirror_spte);
+       kvm_pfn_t pfn = spte_to_pfn(old_spte);
        gpa_t gpa = gfn_to_gpa(gfn);
        u64 err, entry, level_state;
 
@@ -1780,16 +1780,16 @@ static void tdx_sept_remove_private_spte(struct kvm *kvm, gfn_t gfn,
         * there can't be anything populated in the private EPT.
         */
        if (KVM_BUG_ON(!is_hkid_assigned(to_kvm_tdx(kvm)), kvm))
-               return;
+               return -EIO;
 
        /* TODO: handle large pages. */
        if (KVM_BUG_ON(level != PG_LEVEL_4K, kvm))
-               return;
+               return -EIO;
 
        err = tdh_do_no_vcpus(tdh_mem_range_block, kvm, &kvm_tdx->td, gpa,
                              level, &entry, &level_state);
        if (TDX_BUG_ON_2(err, TDH_MEM_RANGE_BLOCK, entry, level_state, kvm))
-               return;
+               return -EIO;
 
        /*
         * TDX requires TLB tracking before dropping private page.  Do
@@ -1805,22 +1805,40 @@ static void tdx_sept_remove_private_spte(struct kvm *kvm, gfn_t gfn,
        err = tdh_do_no_vcpus(tdh_mem_page_remove, kvm, &kvm_tdx->td, gpa,
                              level, &entry, &level_state);
        if (TDX_BUG_ON_2(err, TDH_MEM_PAGE_REMOVE, entry, level_state, kvm))
-               return;
+               return -EIO;
 
        err = tdh_phymem_page_wbinvd_hkid((u16)kvm_tdx->hkid, pfn);
        if (TDX_BUG_ON(err, TDH_PHYMEM_PAGE_WBINVD, kvm))
-               return;
+               return -EIO;
 
        tdx_quirk_reset_paddr(PFN_PHYS(pfn), PAGE_SIZE);
+       return 0;
 }
 
+/*
+ * Handle changes for
+ * (1) leaf SPTEs from non-present to present
+ * (2) non-leaf SPTEs from non-present to present
+ * (3) leaf SPTEs from present to non-present
+ *
+ * - (1) and (2) must be under shared mmu_lock. If (1) and (2) are under
+ *   exclusive mmu_lock (currently impossible), contention errors may lead to
+ *   KVM_BUG_ON() in handle_changed_spte(), e.g., due to tdx_mem_page_aug(),
+ *   tdx_mem_page_add(), or tdh_mem_sept_add() contending with tdh_vp_enter()
+ *   due to zero-step mitigation or contending with TDCALLs.
+ * - (3) must be under write mmu_lock. If (3) is under shared mmu_lock
+ *   (currently impossible), warnings will be generated due to
+ *   lockdep_assert_held_write() or TDX_BUG_ON() caused by concurrent BLOCK,
+ *   TRACK, REMOVE.
+ * - Promotion/demotion is not yet supported.
+ */
 static int tdx_sept_set_private_spte(struct kvm *kvm, gfn_t gfn, u64 old_spte,
                                     u64 new_spte, enum pg_level level)
 {
        lockdep_assert_held(&kvm->mmu_lock);
 
-       if (KVM_BUG_ON(is_shadow_present_pte(old_spte), kvm))
-               return -EIO;
+       if (is_shadow_present_pte(old_spte))
+               return tdx_sept_remove_private_spte(kvm, gfn, level, old_spte);
 
        if (KVM_BUG_ON(!is_shadow_present_pte(new_spte), kvm))
                return -EIO;
@@ -3446,7 +3464,6 @@ int __init tdx_hardware_setup(void)
 
        vt_x86_ops.set_external_spte = tdx_sept_set_private_spte;
        vt_x86_ops.free_external_spt = tdx_sept_free_private_spt;
-       vt_x86_ops.remove_external_spte = tdx_sept_remove_private_spte;
        vt_x86_ops.protected_apic_has_interrupt = tdx_protected_apic_has_interrupt;
        return 0;