[PATCH v4 08/17] KVM: TDX: Adjust the topup count of DPAMT page pairs for splitting S-EPT

[Yan Zhao]

KVM needs to allocate enough DPAMT page pairs in the pamt_cache for
consumption by both page table pages and guest pages. Since the DPAMT page
pair for the S-EPT root page is already allocated during TD initialization,
there is no need to allocate the DPAMT page pair for the S-EPT root page.
Therefore, previously the DPAMT page pairs required equals
"min_nr_spts - 1 + 1".

When splitting S-EPT, min_nr_spts does not include the root SPT. So, limit
the -1 calculation to when min_nr_spts equals root_level, though this will
cause one pair over-allocation in the normal page fault path because
PT64_ROOT_MAX_LEVEL is always passed even when launching a 4-level TD.

Additionally, KVM may need to retry tdh_mem_page_demote() a second time,
causing the DPAMT page pair for the guest private pages to be drawn from
the pamt_cache twice in the worst case. Therefore, add an extra +1 to cover
this worst-case scenario.

The slight over-allocation is acceptable since KVM already pre-allocates
more pages than needed (e.g., when mapping huge pages) in case of the
worst-case scenario.

Signed-off-by: Yan Zhao <yan.y.zhao@xxxxxxxxx>
---
 arch/x86/kvm/vmx/tdx.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 3186c4808cae..397a308b834c 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1630,16 +1630,34 @@ void tdx_load_mmu_pgd(struct kvm_vcpu *vcpu, hpa_t root_hpa, int pgd_level)
 
 static int tdx_topup_external_pamt_cache(struct kvm_vcpu *vcpu, int min_nr_spts)
 {
+	int dpamt_pairs;
+
 	if (WARN_ON_ONCE(!vcpu))
 		return -EIO;
 
+	/* Exclude the root SPT, as its DPAMT page pair is already installed */
+	if (min_nr_spts == vcpu->kvm->arch.mirror_root_level)
+		min_nr_spts -= 1;
+
+	/*
+	 * Each S-EPT page table page + 4KB guest private page needs a pair of
+	 * DPAMT pages.
+	 */
+	dpamt_pairs = min_nr_spts + 1;
+
 	/*
-	 * Minus one page to exclude the root SPT, but plus one page for a
-	 * possible 4KB private mapping.
+	 * After each topup, KVM may invoke DEMOTE at most twice. The first
+	 * DEMOTE invocation draws two pairs of pages from the cache: one for
+	 * the S-EPT page table page and one for the guest private memory.
+	 * Since these pages are not returned to the cache, the second DEMOTE
+	 * invocation still needs to consume one additional pair for the guest
+	 * private memory (the pair for the S-EPT page table page is reused for
+	 * the 2nd invocation). Increase the topup count to account for this
+	 * worst-case scenario.
 	 */
-	min_nr_spts += -1 + 1;
+	dpamt_pairs += 1;
 
-	return tdx_topup_pamt_cache(&to_tdx(vcpu)->pamt_cache, min_nr_spts);
+	return tdx_topup_pamt_cache(&to_tdx(vcpu)->pamt_cache, dpamt_pairs);
 }
 
 static int tdx_mem_page_add(struct kvm *kvm, gfn_t gfn, enum pg_level level,
-- 
2.43.2