[PATCH v4 16/17] [GMEM-DEPENDENT] KVM: TDX: Implement .gmem_prezap() hook to split S-EPT

[Yan Zhao]

Implement the .gmem_prezap() hook to split S-EPT huge mappings before
guest_memfd zaps S-EPT, in case KVM zaps only a subset of an S-EPT huge
mapping's range. This allows guest_memfd to precisely zap/remove S-EPT
entries to avoid clobbering guest memory, as the lifetime of guest private
memory is tied to the S-EPT. That is, KVM must first split a huge mapping
so that it does not over-zap irrelevant subranges of the huge mapping,
which could cause TD termination.

Signed-off-by: Yan Zhao <yan.y.zhao@xxxxxxxxx>
---
 arch/x86/kvm/Kconfig   |  1 +
 arch/x86/kvm/vmx/tdx.c | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 2c3c22aeafa5..9ac79639dfba 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -147,6 +147,7 @@ config KVM_INTEL_TDX
 	default y
 	depends on INTEL_TDX_HOST
 	select HAVE_KVM_ARCH_GMEM_POPULATE
+	select HAVE_KVM_ARCH_GMEM_PREZAP
 	help
 	  Provides support for launching Intel Trust Domain Extensions (TDX)
 	  confidential VMs on Intel processors.
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 5c5919b76bdd..0ecfc17e6235 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -2089,8 +2089,7 @@ static int tdx_sept_split_straddling_huge_pages_to_level(struct kvm *kvm, gfn_t
  * per-VM cache of pre-allocated pages used to populate the Dynamic PAMT when
  * splitting S-EPT huge pages.
  */
-static int __maybe_unused tdx_sept_split_huge_pages(struct kvm *kvm, gfn_t start,
-						    gfn_t end)
+static int tdx_sept_split_huge_pages(struct kvm *kvm, gfn_t start, gfn_t end)
 {
 	guard(mutex)(&to_kvm_tdx(kvm)->pamt_cache_lock);
 
@@ -2103,6 +2102,20 @@ static int __maybe_unused tdx_sept_split_huge_pages(struct kvm *kvm, gfn_t start
 	return tdx_sept_split_straddling_huge_pages_to_level(kvm, start, end, PG_LEVEL_4K);
 }
 
+/*
+ * Before zapping private mappings, KVM must first split any huge mappings that
+ * straddle the zapping range, as KVM mustn't overzap private mappings for TDX
+ * guests, i.e. KVM must zap _exactly_ [start, end).
+ */
+static int tdx_gmem_prezap(struct kvm *kvm, gfn_t start, gfn_t end,
+			   enum kvm_gfn_range_filter attr_filter)
+{
+	if (!(attr_filter & KVM_FILTER_PRIVATE) || !kvm_has_mirrored_tdp(kvm))
+		return 0;
+
+	return tdx_sept_split_huge_pages(kvm, start, end);
+}
+
 void tdx_deliver_interrupt(struct kvm_lapic *apic, int delivery_mode,
 			   int trig_mode, int vector)
 {
@@ -3799,6 +3812,7 @@ int __init tdx_hardware_setup(void)
 
 	vt_x86_ops.set_external_spte = tdx_sept_set_private_spte;
 	vt_x86_ops.free_external_spt = tdx_sept_free_private_spt;
+	vt_x86_ops.gmem_prezap = tdx_gmem_prezap;
 
 	if (tdx_supports_dynamic_pamt(tdx_sysinfo))
 		vt_x86_ops.topup_external_cache = tdx_topup_external_pamt_cache;
-- 
2.43.2