KVM: x86/mmu: WARN on any attempt to atomically update REMOVED SPTE

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2074832



commit 396fd74d
Author: Sean Christopherson <seanjc@google.com>
Date:   Sat Feb 26 00:15:42 2022 +0000

    KVM: x86/mmu: WARN on any attempt to atomically update REMOVED SPTE

    Disallow calling tdp_mmu_set_spte_atomic() with a REMOVED "old" SPTE.
    This solves a conundrum introduced by commit 3255530a ("KVM: x86/mmu:
    Automatically update iter->old_spte if cmpxchg fails"); if the helper
    doesn't update old_spte in the REMOVED case, then theoretically the
    caller could get stuck in an infinite loop as it will fail indefinitely
    on the REMOVED SPTE.  E.g. until recently, clear_dirty_gfn_range() didn't
    check for a present SPTE and would have spun until getting rescheduled.

    In practice, only the page fault path should "create" a new SPTE, all
    other paths should only operate on existing, a.k.a. shadow present,
    SPTEs.  Now that the page fault path pre-checks for a REMOVED SPTE in all
    cases, require all other paths to indirectly pre-check by verifying the
    target SPTE is a shadow-present SPTE.

    Note, this does not guarantee the actual SPTE isn't REMOVED, nor is that
    scenario disallowed.  The invariant is only that the caller mustn't
    invoke tdp_mmu_set_spte_atomic() if the SPTE was REMOVED when last
    observed by the caller.

    Cc: David Matlack <dmatlack@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
    Message-Id: <20220226001546.360188-25-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>