From: Xiaoyao Li <xiaoyao.li@intel.com>

Provide level information to tdx_reclaim_page() to enable it to verify that
the reclaimed pages were mapped at the expected level in the S-EPT.

[Yan: split patch, wrote patch log]

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Yan Zhao <yan.y.zhao@intel.com>
---
 arch/x86/kvm/vmx/tdx.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 1186085795ac..69f3140928b5 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -325,7 +325,7 @@ static void tdx_no_vcpus_enter_stop(struct kvm *kvm)
 }
 
 /* TDH.PHYMEM.PAGE.RECLAIM is allowed only when destroying the TD. */
-static int __tdx_reclaim_page(struct page *page)
+static int __tdx_reclaim_page(struct page *page, int level)
 {
 	u64 err, tdx_pt, tdx_owner, tdx_size;
 
@@ -340,16 +340,18 @@ static int __tdx_reclaim_page(struct page *page)
 		pr_tdx_error_3(TDH_PHYMEM_PAGE_RECLAIM, err, tdx_pt, tdx_owner, tdx_size);
 		return -EIO;
 	}
+
+	WARN_ON_ONCE(tdx_size != pg_level_to_tdx_sept_level(level));
 	return 0;
 }
 
-static int tdx_reclaim_page(struct page *page)
+static int tdx_reclaim_page(struct page *page, int level)
 {
 	int r;
 
-	r = __tdx_reclaim_page(page);
+	r = __tdx_reclaim_page(page, level);
 	if (!r)
-		tdx_clear_page(page, PG_LEVEL_4K);
+		tdx_clear_page(page, level);
 	return r;
 }
 
@@ -364,7 +366,7 @@ static void tdx_reclaim_control_page(struct page *ctrl_page)
 	 * Leak the page if the kernel failed to reclaim the page.
 	 * The kernel cannot use it safely anymore.
 	 */
-	if (tdx_reclaim_page(ctrl_page))
+	if (tdx_reclaim_page(ctrl_page, PG_LEVEL_4K))
 		return;
 
 	__free_page(ctrl_page);
@@ -583,7 +585,7 @@ static void tdx_reclaim_td_control_pages(struct kvm *kvm)
 	if (!kvm_tdx->td.tdr_page)
 		return;
 
-	if (__tdx_reclaim_page(kvm_tdx->td.tdr_page))
+	if (__tdx_reclaim_page(kvm_tdx->td.tdr_page, PG_LEVEL_4K))
 		return;
 
 	/*
@@ -1791,7 +1793,7 @@ int tdx_sept_free_private_spt(struct kvm *kvm, gfn_t gfn,
 	 * The HKID assigned to this TD was already freed and cache was
 	 * already flushed. We don't have to flush again.
 	 */
-	return tdx_reclaim_page(virt_to_page(private_spt));
+	return tdx_reclaim_page(virt_to_page(private_spt), PG_LEVEL_4K);
 }
 
 int tdx_sept_remove_private_spte(struct kvm *kvm, gfn_t gfn,
-- 
2.43.2

On Thu, 2025-04-24 at 11:05 +0800, Yan Zhao wrote:
>  /* TDH.PHYMEM.PAGE.RECLAIM is allowed only when destroying the TD. */
> -static int __tdx_reclaim_page(struct page *page)
> +static int __tdx_reclaim_page(struct page *page, int level)
>  {
>  	u64 err, tdx_pt, tdx_owner, tdx_size;
>  
> @@ -340,16 +340,18 @@ static int __tdx_reclaim_page(struct page *page)
>  		pr_tdx_error_3(TDH_PHYMEM_PAGE_RECLAIM, err, tdx_pt, tdx_owner, tdx_size);
>  		return -EIO;
>  	}
> +
> +	WARN_ON_ONCE(tdx_size != pg_level_to_tdx_sept_level(level));

Why not return an error in this case?

>  	return 0;
>  }
>  

No callers in the series pass anything other than PG_LEVEL_4K, so do we need
this patch?

On Wed, May 14, 2025 at 03:25:29AM +0800, Edgecombe, Rick P wrote:
> On Thu, 2025-04-24 at 11:05 +0800, Yan Zhao wrote:
> >  /* TDH.PHYMEM.PAGE.RECLAIM is allowed only when destroying the TD. */
> > -static int __tdx_reclaim_page(struct page *page)
> > +static int __tdx_reclaim_page(struct page *page, int level)
> >  {
> >  	u64 err, tdx_pt, tdx_owner, tdx_size;
> >  
> > @@ -340,16 +340,18 @@ static int __tdx_reclaim_page(struct page *page)
> >  		pr_tdx_error_3(TDH_PHYMEM_PAGE_RECLAIM, err, tdx_pt, tdx_owner, tdx_size);
> >  		return -EIO;
> >  	}
> > +
> > +	WARN_ON_ONCE(tdx_size != pg_level_to_tdx_sept_level(level));
> 
> Why not return an error in this case?
Yes, returing error seems reasonable, which indicate a series bug.

> >  	return 0;
> >  }
> >  
> 
> No callers in the series pass anything other than PG_LEVEL_4K, so do we need
> this patch?
Oh, this patch is only for future VM shutdown optimization where huge guest
pages could be reclaimed.
We can of couse include it in the VM shutdown optimization series if you think
it's better.

On Fri, 2025-05-16 at 10:11 +0800, Yan Zhao wrote:
> > No callers in the series pass anything other than PG_LEVEL_4K, so do we need
> > this patch?
> Oh, this patch is only for future VM shutdown optimization where huge guest
> pages could be reclaimed.
> We can of couse include it in the VM shutdown optimization series if you think
> it's better.

I think it's better.