From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BEFF25782A; Sat, 18 Jul 2026 01:45:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339114; cv=none; b=oqe/TMU5EpFsky+4EW8i17YkxiyuX5wpeMo87eqqibTQh1NT2LFKWU3541atxt7y/+z5i3BQ5WcHx1mGYNDlTM6y9iE0Cy3bSC7kNTd58L3+HEgxlMhIHbfRt5D9VosiPpXk4j8BqRb84KA3EwpPeYjcOtYjC9kTcNhkK39GWhA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339114; c=relaxed/simple; bh=HoyPPPUO6IwUXpJ4ZorqwTAjPWUhjWrOCnMCvGN67QM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qnQM1sjtPFQuw3fgYDYQF5+GU6CMZRpZ45+W7H304g7l3r6qPe0MJvrDKiLvE7NKwD+U8ODcPSkwOcHjiNtrWiRkAYFQlhJU8Kl1IKHmpwK70X719f4xUxHVgLGe2ADTe0XeAzml9OPFkO/BxhaDbSNfbRSt8bOusmxmubkjiMM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=AJ7jclLC; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="AJ7jclLC" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339111; x=1815875111; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HoyPPPUO6IwUXpJ4ZorqwTAjPWUhjWrOCnMCvGN67QM=; b=AJ7jclLC3veFH/mvXMibwZ2OLLZYfu+ISXyYhI/d3eaQZ891gua6B4ef QJLWyRZVXat2QR+cIb0PSCgxVnE+7ANSp6BvZhdfpA2e7c0q2yHIMbQ49 l56/Ux0QcZRwuzU0/g/oVe918k+qogtB4rfU5QQIznKd7/dDDHf3dvQRR lxwWUdLIJctJdXX4DfmqWsGbfeUEHPS8aPe35+1WpDvvp7rfKFdMjR/7Q Usgei+MCj7RFMuRj5H0IwvUIndUdawX+vBECvgW02ZlHZ60ze1pVcDT9K KQ4k1E5V9TX3btevOUT+DtkdSDPyJ4i+w3xDkd0iKFN6irE0VVyVe8zsZ A==; X-CSE-ConnectionGUID: f3UspKLzTUSnY5QcP9IKLA== X-CSE-MsgGUID: 00u9EJ0wSu2DI8XAp0+9Ew== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377096" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377096" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:07 -0700 X-CSE-ConnectionGUID: kd9L2KuaTxm8Fwo2YU0P1g== X-CSE-MsgGUID: vQU2GTGLSr6oHO3Q+m0lLw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296253" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:06 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 01/11] x86/virt/tdx: Simplify PAMT layout calculation Date: Fri, 17 Jul 2026 18:44:50 -0700 Message-ID: <20260718014500.2231262-2-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For each memory region that the TDX module might use (called TDMR), three separate traditional PAMT allocations are needed. There is one for each supported page size (1GB, 2MB, 4KB). These store information on each page in the TDMR. In Linux, they are allocated out of one physically contiguous block, in order to more efficiently use some internal TDX module bookkeeping resources. So some simple math is needed to break the single large allocation into three smaller allocations for each page size. There are some commonalities in the math needed to calculate the base and size for each smaller allocation, and so an effort was made to share logic across the three. Unfortunately doing this turned out unnaturally tortured, with a loop iterating over the three page sizes, only to call into a function with case statements for each page size. In the future Dynamic PAMT will add more logic that is special to the 4KB page size, making the benefit of the math sharing even more questionable. Three is not a very high number, so get rid of the loop and just duplicate the small calculation three times. In doing so, setup for future Dynamic PAMT changes. Since the loop that iterates over it is gone, further simplify the code by dropping the array of intermediate size and base storage. Just store the values to their final locations. Accept the small complication of having to clear tdmr->pamt_4k_base in the error path, so that tdmr_do_pamt_func() will not try to operate on the TDMR struct when attempting to free it. AI was used under supervision to collect/apply feedback, review code and workshop logs. Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kiryl Shutsemau (Meta) Reviewed-by: Chao Gao Reviewed-by: Yan Zhao Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta --- v7: - Remove accidentital whitespace changes (Kiryl) - Drop stale sentence in log (Chao) - Better patch subject (Yan) - Drop Assisted-by tag and cover AI use in log (Dave) v6: - Drop {} by moving a comment (Binbin) - Log tweaks --- arch/x86/virt/vmx/tdx/tdx.c | 90 ++++++++++++------------------------- 1 file changed, 28 insertions(+), 62 deletions(-) diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index 42df8ea464c47..e77a5265c2c84 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -514,31 +514,21 @@ static __init int fill_out_tdmrs(struct list_head *tm= b_list, * Calculate PAMT size given a TDMR and a page size. The returned * PAMT size is always aligned up to 4K page boundary. */ -static __init unsigned long tdmr_get_pamt_sz(struct tdmr_info *tdmr, int p= gsz, - u16 pamt_entry_size) +static __init unsigned long tdmr_get_pamt_sz(struct tdmr_info *tdmr, int p= gsz) { unsigned long pamt_sz, nr_pamt_entries; + const int tdx_pg_size_shift[TDX_PS_NR] =3D { PAGE_SHIFT, PMD_SHIFT, PUD_S= HIFT }; + const u16 pamt_entry_size[TDX_PS_NR] =3D { + tdx_sysinfo.tdmr.pamt_4k_entry_size, + tdx_sysinfo.tdmr.pamt_2m_entry_size, + tdx_sysinfo.tdmr.pamt_1g_entry_size, + }; =20 - switch (pgsz) { - case TDX_PS_4K: - nr_pamt_entries =3D tdmr->size >> PAGE_SHIFT; - break; - case TDX_PS_2M: - nr_pamt_entries =3D tdmr->size >> PMD_SHIFT; - break; - case TDX_PS_1G: - nr_pamt_entries =3D tdmr->size >> PUD_SHIFT; - break; - default: - WARN_ON_ONCE(1); - return 0; - } + nr_pamt_entries =3D tdmr->size >> tdx_pg_size_shift[pgsz]; + pamt_sz =3D nr_pamt_entries * pamt_entry_size[pgsz]; =20 - pamt_sz =3D nr_pamt_entries * pamt_entry_size; /* TDX requires PAMT size must be 4K aligned */ - pamt_sz =3D ALIGN(pamt_sz, PAGE_SIZE); - - return pamt_sz; + return PAGE_ALIGN(pamt_sz); } =20 /* @@ -576,15 +566,11 @@ static __init int tdmr_get_nid(struct tdmr_info *tdmr= , struct list_head *tmb_lis * within @tdmr, and set up PAMTs for @tdmr. */ static __init int tdmr_set_up_pamt(struct tdmr_info *tdmr, - struct list_head *tmb_list, - u16 pamt_entry_size[]) + struct list_head *tmb_list) { - unsigned long pamt_base[TDX_PS_NR]; - unsigned long pamt_size[TDX_PS_NR]; - unsigned long tdmr_pamt_base; unsigned long tdmr_pamt_size; struct page *pamt; - int pgsz, nid; + int nid; =20 nid =3D tdmr_get_nid(tdmr, tmb_list); =20 @@ -592,12 +578,10 @@ static __init int tdmr_set_up_pamt(struct tdmr_info *= tdmr, * Calculate the PAMT size for each TDX supported page size * and the total PAMT size. */ - tdmr_pamt_size =3D 0; - for (pgsz =3D TDX_PS_4K; pgsz < TDX_PS_NR; pgsz++) { - pamt_size[pgsz] =3D tdmr_get_pamt_sz(tdmr, pgsz, - pamt_entry_size[pgsz]); - tdmr_pamt_size +=3D pamt_size[pgsz]; - } + tdmr->pamt_4k_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_4K); + tdmr->pamt_2m_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_2M); + tdmr->pamt_1g_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_1G); + tdmr_pamt_size =3D tdmr->pamt_4k_size + tdmr->pamt_2m_size + tdmr->pamt_1= g_size; =20 /* * Allocate one chunk of physically contiguous memory for all @@ -606,25 +590,17 @@ static __init int tdmr_set_up_pamt(struct tdmr_info *= tdmr, */ pamt =3D alloc_contig_pages(tdmr_pamt_size >> PAGE_SHIFT, GFP_KERNEL, nid, &node_online_map); + + /* + * tdmr->pamt_4k_base is still zero so the error + * path of the caller will skip freeing the pamt. + */ if (!pamt) return -ENOMEM; =20 - /* - * Break the contiguous allocation back up into the - * individual PAMTs for each page size. - */ - tdmr_pamt_base =3D page_to_pfn(pamt) << PAGE_SHIFT; - for (pgsz =3D TDX_PS_4K; pgsz < TDX_PS_NR; pgsz++) { - pamt_base[pgsz] =3D tdmr_pamt_base; - tdmr_pamt_base +=3D pamt_size[pgsz]; - } - - tdmr->pamt_4k_base =3D pamt_base[TDX_PS_4K]; - tdmr->pamt_4k_size =3D pamt_size[TDX_PS_4K]; - tdmr->pamt_2m_base =3D pamt_base[TDX_PS_2M]; - tdmr->pamt_2m_size =3D pamt_size[TDX_PS_2M]; - tdmr->pamt_1g_base =3D pamt_base[TDX_PS_1G]; - tdmr->pamt_1g_size =3D pamt_size[TDX_PS_1G]; + tdmr->pamt_4k_base =3D page_to_phys(pamt); + tdmr->pamt_2m_base =3D tdmr->pamt_4k_base + tdmr->pamt_4k_size; + tdmr->pamt_1g_base =3D tdmr->pamt_2m_base + tdmr->pamt_2m_size; =20 return 0; } @@ -655,10 +631,7 @@ static __init void tdmr_do_pamt_func(struct tdmr_info = *tdmr, tdmr_get_pamt(tdmr, &pamt_base, &pamt_size); =20 /* Do nothing if PAMT hasn't been allocated for this TDMR */ - if (!pamt_size) - return; - - if (WARN_ON_ONCE(!pamt_base)) + if (!pamt_base) return; =20 pamt_func(pamt_base, pamt_size); @@ -684,14 +657,12 @@ static __init void tdmrs_free_pamt_all(struct tdmr_in= fo_list *tdmr_list) =20 /* Allocate and set up PAMTs for all TDMRs */ static __init int tdmrs_set_up_pamt_all(struct tdmr_info_list *tdmr_list, - struct list_head *tmb_list, - u16 pamt_entry_size[]) + struct list_head *tmb_list) { int i, ret =3D 0; =20 for (i =3D 0; i < tdmr_list->nr_consumed_tdmrs; i++) { - ret =3D tdmr_set_up_pamt(tdmr_entry(tdmr_list, i), tmb_list, - pamt_entry_size); + ret =3D tdmr_set_up_pamt(tdmr_entry(tdmr_list, i), tmb_list); if (ret) goto err; } @@ -968,18 +939,13 @@ static __init int construct_tdmrs(struct list_head *t= mb_list, struct tdmr_info_list *tdmr_list, struct tdx_sys_info_tdmr *sysinfo_tdmr) { - u16 pamt_entry_size[TDX_PS_NR] =3D { - sysinfo_tdmr->pamt_4k_entry_size, - sysinfo_tdmr->pamt_2m_entry_size, - sysinfo_tdmr->pamt_1g_entry_size, - }; int ret; =20 ret =3D fill_out_tdmrs(tmb_list, tdmr_list); if (ret) return ret; =20 - ret =3D tdmrs_set_up_pamt_all(tdmr_list, tmb_list, pamt_entry_size); + ret =3D tdmrs_set_up_pamt_all(tdmr_list, tmb_list); if (ret) return ret; =20 --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F9E5244665; Sat, 18 Jul 2026 01:45:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339114; cv=none; b=XXlYJJqYCJDc4YRCLwS1BmYPoiwA+iyXcJK9v8MWfAhKt1ItHuS9esgN3VKdfDhrHwvMjIFqRFBFEX+1pxWgTooNqFL7eaiDfm9GMLb9/ZY2XLAWisgC8YfNdyS/Gtp2GQxdwvjyElTFMVg88cVf05iy5q0qPTnhuFnVlOB+iGw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339114; c=relaxed/simple; bh=xlsk49L8d9h6YHSEC9bPc+KNw/0li7AtNN/l/1WhSSY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kk2X8gjJ7Y2EvltdxAamK862s537WCB74yGAYGUm3DxL/YhNyQlarYwPqK35t+Y/YOeen5Gbu2jK4cTszWLIIT7/epGoljyEYJfXohHFgrVD4xEJUvfKQVZWI55kd22ewarpacnCMNZq+ctXNKa4g8lNLqYGbjMVKQHtDlm6ITQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=h1I7Kil9; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="h1I7Kil9" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339111; x=1815875111; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=xlsk49L8d9h6YHSEC9bPc+KNw/0li7AtNN/l/1WhSSY=; b=h1I7Kil9KEocFNscioGl7iLV4l8yr8TpbF764Qb4DCDWeipAieM1eNBZ ar/qHdVBhPFQSgLAIeXRGUNuSWUrW/dCJtT3bvDykthhlX3toMuHbQ6l3 XN9OENiJ8PrkYDjV01xjyO5WQCPVQmuuTqQOwx0BKmuw5NWexLGJjylrA DLxbKHHiULsv0X3uXRJ7RZzwpjSs68S+jovFRceqiv+4AuMVwTcSZeo5e RjkuAGYtXKQzaL7co+R/1jjSq4UmZWObp5r4ePJv26JDXbz2e9WqJoj1H RwIuldzqN0Afw+mcfr1niatujcj//AzRGnVHwMj+QkV4UloyhRnTHZJvd A==; X-CSE-ConnectionGUID: Ir3y/ey7RumkmwlBsOiDFA== X-CSE-MsgGUID: IyZKHVa9QjmRMuoM5CUHnA== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377106" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377106" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:07 -0700 X-CSE-ConnectionGUID: qtxvRLmZSMOdNFOIrkKYqg== X-CSE-MsgGUID: xAnNWTMtRCSfmpw0gmxLog== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296256" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:07 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 02/11] x86/virt/tdx: Allocate page bitmap for Dynamic PAMT Date: Fri, 17 Jul 2026 18:44:51 -0700 Message-ID: <20260718014500.2231262-3-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" The TDX Physical Address Metadata Table (PAMT) holds data about the physical memory used by TDX, and must be allocated by the kernel during TDX module initialization. The exact size of the required PAMT memory is determined by the TDX module and may vary between TDX module versions. Currently it is approximately 0.4% of the system memory. This is a significant commitment, especially if it is not known upfront whether the machine will run any TDX guests. Each memory region that the TDX module might use needs three separate PAMT allocations. One for each supported page size (1GB, 2MB, 4KB). The TDX module supports a new feature designed to reduce PAMT overhead called Dynamic PAMT. Under Dynamic PAMT the 4KB level is allocated dynamically during runtime, while the 1GB and 2MB levels remain allocated on TDX module initialization. However, in the details, Dynamic PAMT still needs some smaller per 4KB page scoped data (currently it is 1 bit per page). The TDX module exposes the number of bits as a separate piece of metadata than the 4KB static allocation for normal PAMT. Although the size is enumerated differently, it is handed to the TDX module in the same way the 4KB page size PAMT allocation is for normal PAMT. Begin to implement Dynamic PAMT in the kernel by reading the bits-per-page needed for Dynamic PAMT. Calculate the size needed for the bitmap, and use it instead of the 4KB size determined for normal PAMT, in the case of Dynamic PAMT. The existing metadata reading code was generated by a script, but the current plan is to stop generating this code, as the script has continued to need adjustments. So add manually written code and adjust the comment about it being autogenerated to be more generic. Start to adopt a more normal kernel code style without the ternary statements and if conditionals assignments that the auto generated code has. AI was used under supervision to collect/apply feedback, review code and workshop logs. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Vishal Annapurve Reviewed-by: Binbin Wu Reviewed-by: Tony Lindgren Reviewed-by: Yan Zhao Acked-by: Sohil Mehta --- v7: - Re-order pamt size calculations for greater readability (Kiryl) - Move comment to its own line in tdx_supports_dynamic_pamt() (Yan, Sohil) - Log tweak (Sohil) - Make comment in metadata reading more appropriate (Sohil) - Drop Assisted-by tag and cover AI use in log (Dave) - Move tdx_supports_dynamic_pamt() to not static inline to reduce churn in later changes v6: - Improve comment (Binbin) - Log tweaks - Mark tdmr_get_pamt_bitmap_sz() __init in response to upstream changes - Switch to more normal kernel code style, even though it differs from the existing auto generated code. --- arch/x86/include/asm/tdx.h | 2 ++ arch/x86/include/asm/tdx_global_metadata.h | 3 +++ arch/x86/virt/vmx/tdx/tdx.c | 29 +++++++++++++++++++-- arch/x86/virt/vmx/tdx/tdx_global_metadata.c | 23 +++++++++++++++- 4 files changed, 54 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h index 89e97d5761d89..d414064436221 100644 --- a/arch/x86/include/asm/tdx.h +++ b/arch/x86/include/asm/tdx.h @@ -118,6 +118,8 @@ static inline bool tdx_supports_runtime_update(const st= ruct tdx_sys_info *sysinf return sysinfo->features.tdx_features0 & TDX_FEATURES0_TD_PRESERVING; } =20 +bool tdx_supports_dynamic_pamt(const struct tdx_sys_info *sysinfo); + int tdx_guest_keyid_alloc(void); u32 tdx_get_nr_guest_keyids(void); void tdx_guest_keyid_free(unsigned int keyid); diff --git a/arch/x86/include/asm/tdx_global_metadata.h b/arch/x86/include/= asm/tdx_global_metadata.h index 41150d546589c..2a42551fc33cd 100644 --- a/arch/x86/include/asm/tdx_global_metadata.h +++ b/arch/x86/include/asm/tdx_global_metadata.h @@ -21,6 +21,9 @@ struct tdx_sys_info_tdmr { u16 pamt_4k_entry_size; u16 pamt_2m_entry_size; u16 pamt_1g_entry_size; + + /* Optional metadata, if Dynamic PAMT is supported */ + u8 pamt_page_bitmap_entry_bits; }; =20 struct tdx_sys_info_td_ctrl { diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index e77a5265c2c84..f395f1fe95093 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -510,6 +510,18 @@ static __init int fill_out_tdmrs(struct list_head *tmb= _list, return 0; } =20 +static __init unsigned long tdmr_get_pamt_bitmap_sz(struct tdmr_info *tdmr) +{ + unsigned long pamt_sz, nr_pamt_entries; + int bits_per_entry; + + bits_per_entry =3D tdx_sysinfo.tdmr.pamt_page_bitmap_entry_bits; + nr_pamt_entries =3D tdmr->size >> PAGE_SHIFT; + pamt_sz =3D DIV_ROUND_UP(nr_pamt_entries * bits_per_entry, BITS_PER_BYTE); + + return PAGE_ALIGN(pamt_sz); +} + /* * Calculate PAMT size given a TDMR and a page size. The returned * PAMT size is always aligned up to 4K page boundary. @@ -578,9 +590,16 @@ static __init int tdmr_set_up_pamt(struct tdmr_info *t= dmr, * Calculate the PAMT size for each TDX supported page size * and the total PAMT size. */ - tdmr->pamt_4k_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_4K); - tdmr->pamt_2m_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_2M); tdmr->pamt_1g_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_1G); + tdmr->pamt_2m_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_2M); + + if (tdx_supports_dynamic_pamt(&tdx_sysinfo)) { + /* With Dynamic PAMT, PAMT_4K is replaced with a bitmap */ + tdmr->pamt_4k_size =3D tdmr_get_pamt_bitmap_sz(tdmr); + } else { + tdmr->pamt_4k_size =3D tdmr_get_pamt_sz(tdmr, TDX_PS_4K); + } + tdmr_pamt_size =3D tdmr->pamt_4k_size + tdmr->pamt_2m_size + tdmr->pamt_1= g_size; =20 /* @@ -1969,6 +1988,12 @@ u64 tdh_phymem_page_wbinvd_hkid(u64 hkid, kvm_pfn_t = pfn) } EXPORT_SYMBOL_FOR_KVM(tdh_phymem_page_wbinvd_hkid); =20 +bool tdx_supports_dynamic_pamt(const struct tdx_sys_info *sysinfo) +{ + /* To be enabled when kernel is ready. */ + return false; +} + void tdx_sys_disable(void) { struct tdx_module_args args =3D {}; diff --git a/arch/x86/virt/vmx/tdx/tdx_global_metadata.c b/arch/x86/virt/vm= x/tdx/tdx_global_metadata.c index e49c300f23d43..8393d2aa59dbe 100644 --- a/arch/x86/virt/vmx/tdx/tdx_global_metadata.c +++ b/arch/x86/virt/vmx/tdx/tdx_global_metadata.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Automatically generated functions to read TDX global metadata. + * Functions to read TDX global metadata. * * This file doesn't compile on its own as it lacks of inclusion * of SEAMCALL wrapper primitive which reads global metadata. @@ -33,6 +33,18 @@ static __init int get_tdx_sys_info_features(struct tdx_s= ys_info_features *sysinf return ret; } =20 +static __init int get_tdx_sys_info_tdmr_dpamt(struct tdx_sys_info_tdmr *sy= sinfo_tdmr) +{ + int ret; + u64 val; + + ret =3D read_sys_metadata_field(0x9100000100000013, &val); + if (!ret) + sysinfo_tdmr->pamt_page_bitmap_entry_bits =3D val; + + return ret; +} + static __init int get_tdx_sys_info_tdmr(struct tdx_sys_info_tdmr *sysinfo_= tdmr) { int ret =3D 0; @@ -129,5 +141,14 @@ static __init int get_tdx_sys_info(struct tdx_sys_info= *sysinfo) ret =3D ret ?: get_tdx_sys_info_td_ctrl(&sysinfo->td_ctrl); ret =3D ret ?: get_tdx_sys_info_td_conf(&sysinfo->td_conf); =20 + /* + * The kernel supports using TDX without Dynamic PAMT, so + * avoid reporting failure if it's not supported. Don't try + * to support buggy TDX modules that advertise Dynamic PAMT + * but don't expose the metadata. + */ + if (!ret && tdx_supports_dynamic_pamt(sysinfo)) + ret =3D get_tdx_sys_info_tdmr_dpamt(&sysinfo->tdmr); + return ret; } --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 39D11256C6D; Sat, 18 Jul 2026 01:45:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339122; cv=none; b=TUXnpg2Vgjj8+hT9L0245IVagj66Y3ym9WCG9TIyafoq7rEFaVH81AA7RJrjgOLsZ1gJxC8RcDmiMNwK/hHCaW6l1voX05T2+usGk9CNzc8DyMtdudFB8xzaqIQ+SRpM2Za4vvCHjmYHR4ub+AWvRXe0kAsOeu/DT8VInXdkvHE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339122; c=relaxed/simple; bh=bYQUWwg6y2WyxdkhaowFaT4cBLGQpPA5z+2C/IaTcPw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jJlYfnKFdbvyG0aCHTi+bJBB+GP7vPjpJx8A3jmMvABnFgKCFiRGiXkOb/5z2ybNcE1dfrEIo2os5tu6YPmPnZ7u+9aZqOS9ghAGNlA7eQcKWUSb4wRhBenNcfWL2HpFN5StzF6butkbSvgvhuaPLB9bcFTXv8Na08xM7kUm8Bc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=JGm+1SIi; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="JGm+1SIi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339117; x=1815875117; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=bYQUWwg6y2WyxdkhaowFaT4cBLGQpPA5z+2C/IaTcPw=; b=JGm+1SIi2wWpDJPhTJLEvpkyhocDnWllC8vry2wlNi8zwE8FFxsQVQVB gUC2zd6AUsVwtH3YZxNh147JQ81xDHKFHexTS3bt1fUbIWQSo+o+xlPoC DBL+BtsbhDKGYtarOS4cWcdxJ2W8+XGzqahhwIPK66OnVLyfZbhsNaX64 Hft++cU+MLKCVbW/wPLvoprJlexw/wqe2Bu0cq9H8j4hHBX7KTfh4B+Di 28VMYhf2hTJfZftmMYqLLVmTtMBzsvh7baVnp2l6NsxnBi6gQ9/daxXsl 52mhBEQurleZOq8WjbNPhifZEEDJWfip+9wFG+a0rbvqHbZOiwEgvCYVp Q==; X-CSE-ConnectionGUID: cSi5B3PGQDSl5x1LrHT98g== X-CSE-MsgGUID: 6S2z5seVT8yTIk/E/w9hpQ== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377125" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377125" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:16 -0700 X-CSE-ConnectionGUID: Z5lhPoc5SquyMw1Lo3NKxA== X-CSE-MsgGUID: thxjIc1iRiix6lUTS04NtQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296262" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:07 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 03/11] x86/virt/tdx: Add tdx_alloc/free_control_page() helpers Date: Fri, 17 Jul 2026 18:44:52 -0700 Message-ID: <20260718014500.2231262-4-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" Add helpers to use when allocating or preparing pages that are handed to the TDX module for use as control/S-EPT pages, and thus need Dynamic PAMT adjustments. The TDX module tracks some state for each page of physical memory that it might use. It calls this state the PAMT. It includes separate state for each page size a physical page could be utilized at within the TDX module (1GB, 2MB, 4KB). In Dynamic PAMT, only the 4KB page size state is allocated dynamically. KVM will need to hand pages to the TDX module that it will use at 4KB granularity. So these pages will need Dynamic PAMT backing added before they are used by the TDX module, and removed afterwards. Add tdx_alloc_control_page() and tdx_free_control_page() to handle both page allocation and Dynamic PAMT installation. Make them behave like normal alloc/free functions where allocation can fail in the case of no memory, but free (with any necessary Dynamic PAMT release) always succeeds. Do this so they can support the existing TDX flows that require teardowns to succeed. Also create tdx_pamt_get/put() to handle installing Dynamic PAMT 4KB backing for pages that are already allocated (such as KVM's use of S-EPT page tables or guest private memory). Have them take a pfn instead of a struct page, as future changes will want to use these helpers for guest pages which are tracked by PFN. Don't CLFLUSH the Dynamic PAMT pages handed to the TDX module, as is done for some other SEAMCALLs, as the TDX docs specify that this is only needed on "TD private memory or TD control structure page". Since these allocations will be easily user triggerable, account the memory. Leave logic to handle concurrency issues for future changes. AI was used under supervision to collect/apply feedback, split patches, review code and workshop logs. Signed-off-by: Kirill A. Shutemov Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta --- v7: - Comment improvements (Chao) - Drop unneeded addition of mm.h header include (Binbin) - Log clarity, code style nits (Sohil) - Drop Assisted-by tag and cover AI use in log (Dave) v6: The major change was to split out the concurrency stuff into a future patch. It makes it easier to explain in the log. This one is the basic functionality. Then the simple version of the concurrency and why in the next patch. Also, to get rid of the dynamically sized DPAMT backing support which was not based on a formal spec. Details: - Split out concurrency stuff into next patch because the log was too long - Switch to fixed size pamt page arrays (Nikolay) - Rename tdx_alloc_page()/tdx_free_page() to tdx_alloc_control_page()/ tdx_free_control_page() to reflect control/S-EPT purpose (Sean) - Take gfp from the caller in tdx_alloc_control_page() (Sean) - Narrow external API: make tdx_pamt_get()/tdx_pamt_put() static and export only tdx_alloc_control_page()/tdx_free_control_page() (note: dropped inline helpers since the discussion on Sean's series resulted in them not being needed) - Switch EXPORT_SYMBOL_GPL to EXPORT_SYMBOL_FOR_KVM (Sean) - Use WARN_ON_ONCE() instead of pr_err() for TDX module failures (Sean) - Fold alloc_pamt_array()/free_pamt_array() helpers back in and fix the error-unwind index bug (dpamt_pages[i] -> [j]) - Adjustments after struct page->pfn - Adjustments from dropping error helper patches - Make the free error paths more normal - Drop gfp_t arg in tdx_alloc_control_page(). In the Sean mega v5, it was really needed because the kvm_mmu_memory_cache had a gfp_t it needed something to do with. But this was still weird because that version didn't handle allocating the DPAMT pages as the gfp_t. And in the end all the callers pass GFP_KERNEL_ACCOUNT. So just drop the arg. - Log tweaks --- arch/x86/include/asm/tdx.h | 6 ++ arch/x86/virt/vmx/tdx/tdx.c | 163 ++++++++++++++++++++++++++++++++++++ arch/x86/virt/vmx/tdx/tdx.h | 2 + 3 files changed, 171 insertions(+) diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h index d414064436221..86bf37b15c705 100644 --- a/arch/x86/include/asm/tdx.h +++ b/arch/x86/include/asm/tdx.h @@ -126,6 +126,12 @@ void tdx_guest_keyid_free(unsigned int keyid); =20 void tdx_quirk_reset_paddr(unsigned long base, unsigned long size); =20 +/* Number of PAMT pages to be provided to TDX module per 2MB region of PA = */ +#define TDX_DPAMT_ENTRY_PAGE_CNT 2 + +struct page *tdx_alloc_control_page(void); +void tdx_free_control_page(struct page *page); + struct tdx_td { /* TD root structure: */ struct page *tdr_page; diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index f395f1fe95093..bfd9928c10249 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -1994,6 +1994,169 @@ bool tdx_supports_dynamic_pamt(const struct tdx_sys= _info *sysinfo) return false; } =20 +static int alloc_pamt_array(struct page **pamt_pages) +{ + int i, j; + + for (i =3D 0; i < TDX_DPAMT_ENTRY_PAGE_CNT; i++) { + pamt_pages[i] =3D alloc_page(GFP_KERNEL_ACCOUNT); + if (!pamt_pages[i]) + goto err; + } + + return 0; + +err: + for (j =3D 0; j < i; j++) + __free_page(pamt_pages[j]); + + return -ENOMEM; +} + +static void free_pamt_array(struct page **pamt_pages) +{ + for (int i =3D 0; i < TDX_DPAMT_ENTRY_PAGE_CNT; i++) { + /* + * Reset pages unconditionally to cover cases + * where they were passed to the TDX module. + */ + tdx_quirk_reset_paddr(page_to_phys(pamt_pages[i]), PAGE_SIZE); + + __free_page(pamt_pages[i]); + } +} + +/* + * Calculate the arg needed for operating on the DPAMT backing for + * a given 4KB page. + */ +static u64 pamt_2mb_arg(kvm_pfn_t pfn) +{ + /* Arg value will specify a 2MB region of physical address space. */ + unsigned long hpa_2mb =3D ALIGN_DOWN(pfn << PAGE_SHIFT, PMD_SIZE); + + return hpa_2mb | TDX_PS_2M; +} + +/* Add PAMT backing for the 2MB region surrounding the given pfn. */ +static u64 tdh_phymem_pamt_add(kvm_pfn_t pfn, struct page **pamt_pages) +{ + struct tdx_module_args args =3D { + .rcx =3D pamt_2mb_arg(pfn), + .rdx =3D page_to_phys(pamt_pages[0]), + .r8 =3D page_to_phys(pamt_pages[1]), + }; + + return seamcall(TDH_PHYMEM_PAMT_ADD, &args); +} + +/* Remove PAMT backing for the 2MB region surrounding the given pfn. */ +static u64 tdh_phymem_pamt_remove(kvm_pfn_t pfn, struct page **pamt_pages) +{ + struct tdx_module_args args =3D { + .rcx =3D pamt_2mb_arg(pfn), + }; + u64 ret; + + ret =3D seamcall_ret(TDH_PHYMEM_PAMT_REMOVE, &args); + if (ret) + return ret; + + /* Copy PAMT pages out of the struct per the TDX ABI */ + pamt_pages[0] =3D phys_to_page(args.rdx); + pamt_pages[1] =3D phys_to_page(args.r8); + + return 0; +} + +/* Allocate PAMT memory for the given page */ +static int tdx_pamt_get(kvm_pfn_t pfn) +{ + struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT]; + u64 tdx_status; + int ret; + + if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) + return 0; + + ret =3D alloc_pamt_array(pamt_pages); + if (ret) + return ret; + + tdx_status =3D tdh_phymem_pamt_add(pfn, pamt_pages); + if (tdx_status !=3D TDX_SUCCESS) { + ret =3D -EIO; + goto out_free; + } + + return 0; + +out_free: + free_pamt_array(pamt_pages); + + return ret; +} + +/* Free PAMT memory for the given page */ +static void tdx_pamt_put(kvm_pfn_t pfn) +{ + struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT] =3D {}; + u64 tdx_status; + + if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) + return; + + tdx_status =3D tdh_phymem_pamt_remove(pfn, pamt_pages); + + /* + * Don't free pamt_pages as it could hold garbage when + * tdh_phymem_pamt_remove() fails. Don't panic/BUG_ON(), as + * there is no risk of data corruption, but do yell loudly as + * failure indicates a kernel bug, memory is being leaked, and + * the dangling PAMT entry may cause future operations to fail. + */ + if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) + return; + + free_pamt_array(pamt_pages); +} + +/* + * Return a page that can be gifted to the TDX-Module for use as a "contro= l" + * page, i.e. pages that are used for control structures for a given TDX + * guest, and thus obtain TDX protections, including PAMT tracking. + */ +struct page *tdx_alloc_control_page(void) +{ + struct page *page; + + page =3D alloc_page(GFP_KERNEL_ACCOUNT); + if (!page) + return NULL; + + if (tdx_pamt_get(page_to_pfn(page))) { + __free_page(page); + return NULL; + } + + return page; +} +EXPORT_SYMBOL_FOR_KVM(tdx_alloc_control_page); + +/* + * Free a page that was gifted to the TDX-Module for use as a control + * page. After this, the page is no longer protected by TDX. + */ +void tdx_free_control_page(struct page *page) +{ + if (!page) + return; + + tdx_pamt_put(page_to_pfn(page)); + __free_page(page); +} +EXPORT_SYMBOL_FOR_KVM(tdx_free_control_page); + void tdx_sys_disable(void) { struct tdx_module_args args =3D {}; diff --git a/arch/x86/virt/vmx/tdx/tdx.h b/arch/x86/virt/vmx/tdx/tdx.h index bdfd0e1e337ac..a886c54decaad 100644 --- a/arch/x86/virt/vmx/tdx/tdx.h +++ b/arch/x86/virt/vmx/tdx/tdx.h @@ -48,6 +48,8 @@ #define TDH_SYS_CONFIG 45 #define TDH_SYS_SHUTDOWN 52 #define TDH_SYS_UPDATE 53 +#define TDH_PHYMEM_PAMT_ADD 58 +#define TDH_PHYMEM_PAMT_REMOVE 59 #define TDH_SYS_DISABLE 69 =20 /* --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B152C25A2A2; Sat, 18 Jul 2026 01:45:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339126; cv=none; b=HjpLPZXkrA0DEXVtjAuzKNAfVfEJfnGcHSHlYcGId7v6rUt4Ov6TMhBuM+fjVZ+24kFYLrw53i0SyV70/JtLCQ8p0wxYvjz1kDGN4SSiIEXLcxGT5eMlygoklKby4ATYzMQ+ihG93mv5npQdIakqvFcIwn2tjA/ehNr/39CFNkA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339126; c=relaxed/simple; bh=2/PFvR+1Ho7cowhHo5Xn94JMiCMP1fK3rRGLmjd8Inw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ciHBYx8NEsSRLaP3yJUz7pKSfp8j42EaSQL1wR4n3hFaghCmQA8A0HY/vMwbSYrgoAH9XooebG1+Sswn0Wrb6Y3CFqf97qwp/lEvRTOEsljuXwCry/muF8RLs9vCTS5ODAGTxhjujVUT0Zd1WQUCnyuGtHqUZ3r4An+Sukl1fvo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=oCc9gqSX; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="oCc9gqSX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339123; x=1815875123; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2/PFvR+1Ho7cowhHo5Xn94JMiCMP1fK3rRGLmjd8Inw=; b=oCc9gqSXENRZbEHXmELNf4IrcaXhFaTlfHeTsVd7qaNNdZtDGL+X0apC TnjR7A9luz4lIOH9kT8ex5ofCoqyy5wyoFWGtMSDC7GQM6MIjfyfJMIir MO9dUyMyMo1K1aKCsaR9L+gC6ZcZkW8RXvWgwvjsbGz/llfvRdIGr6/6H nl53f9N0m3ssgBMGB/AI85pnXcdLP/qSreH2sngyoszLKdS62rldezh62 aMGKMiwDrDlUU3Sb1Q0G5wwckPbZJ/t6xshKJiuPOqW4u2XUSivk9GfMf JXOjQImIp041k4+/nhs4EwojfvWqZoT5c+zkBv/bMNrGqQLJ2VYHfhRFu A==; X-CSE-ConnectionGUID: jVzkX/9YRrmm3Ml+z8NzXw== X-CSE-MsgGUID: HFnkvtDEQlqoQWRIlscCqg== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377148" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377148" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:16 -0700 X-CSE-ConnectionGUID: DYccGylFQBiBrF9z2ZL/8g== X-CSE-MsgGUID: pOfC1LOBQCOqVtFLx2AOKA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296265" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:08 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 04/11] x86/virt/tdx: Allocate refcounts for Dynamic PAMT memory Date: Fri, 17 Jul 2026 18:44:53 -0700 Message-ID: <20260718014500.2231262-5-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" The PAMT memory holds metadata for all possible TDX protected memory. Each physical address range is covered by PAMT entries at three levels (1GB, 2MB, 4KB). With Dynamic PAMT, the 4KB level of PAMT is allocated on demand. The kernel supplies the TDX module with page pairs to store the 4KB level entries, which cover 2MB of host physical memory. The kernel must provide this page pair before using pages from the range for TDX. If this is not done, SEAMCALLs that give the pages to be protected by the TDX module will fail. Allocate reference counters for every 2MB range to track TDX memory usage. This can be used to handle concurrent get/put callers, in order to accurately determine when the dynamic 4KB level of Dynamic PAMT needs to be allocated and when it can be freed. This allocation will currently consume 2MB for every 1TB of address space from 0 to max_pfn. The allocation size will depend on how the RAM is physically laid out. In a worst case scenario where the entire 52 bit address space is covered this would be 8GB. Then the Dynamic PAMT refcount allocations could hypothetically cause the savings from Dynamic PAMT to go negative on exotic platforms with sparse, small amounts of memory. Future changes could reduce this refcount overhead to be only allocating refcounts for physical ranges that contain memory that TDX can use. However, this is left for future work. AI was used under supervision to collect/apply feedback, review code and workshop logs. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Chao Gao Reviewed-by: Yan Zhao Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta --- v7: - Annote functions __init (Chao) - Log tweaks (Yan) - Stanardize on memory units in the text (Sohil) - Delete unneeded comment (Sohil) - Use vzalloc() (Sohil) - Drop Assisted-by tag and cover AI use in log (Dave) v6: - Remove confusing reference to allocating PAMT memory in pamt_refcounts comment. (Yan) - Rename "metadata" function names that really deal with refcounts, as metadata already has a different meaning in TDX. - Move tdx_find_pamt_refcount() to this patch to aid in reviewability --- arch/x86/virt/vmx/tdx/tdx.c | 53 ++++++++++++++++++++++++++++++++++++- 1 file changed, 52 insertions(+), 1 deletion(-) diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index bfd9928c10249..b2ddd3c192645 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -63,6 +64,14 @@ static DEFINE_PER_CPU(bool, tdx_lp_initialized); =20 static struct tdmr_info_list tdx_tdmr_list; =20 +/* + * On a machine with Dynamic PAMT, the kernel maintains a reference counter + * for every 2MB range. The counter indicates how many users there are for + * the PAMT memory of the 2MB range. The kernel allocates PAMT refcounts at + * initialization. + */ +static atomic_t *pamt_refcounts; + /* All TDX-usable memory regions. Protected by mem_hotplug_lock. */ static LIST_HEAD(tdx_memlist); =20 @@ -252,6 +261,42 @@ static struct syscore tdx_syscore =3D { .ops =3D &tdx_syscore_ops, }; =20 +/* + * Allocate PAMT reference counters for all physical memory. + * + * It consumes 2MB for every 1TB of physical memory. + */ +static __init int init_pamt_refcounts(void) +{ + size_t size =3D DIV_ROUND_UP(max_pfn, PTRS_PER_PTE) * sizeof(*pamt_refcou= nts); + + if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) + return 0; + + pamt_refcounts =3D vzalloc(size); + if (!pamt_refcounts) + return -ENOMEM; + + return 0; +} + +static __init void free_pamt_refcounts(void) +{ + if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) + return; + + vfree(pamt_refcounts); + pamt_refcounts =3D NULL; +} + +static atomic_t * __maybe_unused tdx_find_pamt_refcount(unsigned long pfn) +{ + /* Find which PMD a PFN is in. */ + unsigned long index =3D pfn >> (PMD_SHIFT - PAGE_SHIFT); + + return &pamt_refcounts[index]; +} + /* * Add a memory region as a TDX memory block. The caller must make sure * all memory regions are added in address ascending order and don't @@ -1152,10 +1197,14 @@ static __init int init_tdx_module(void) */ get_online_mems(); =20 - ret =3D build_tdx_memlist(&tdx_memlist); + ret =3D init_pamt_refcounts(); if (ret) goto out_put_tdxmem; =20 + ret =3D build_tdx_memlist(&tdx_memlist); + if (ret) + goto err_free_pamt_refcounts; + /* Allocate enough space for constructing TDMRs */ ret =3D alloc_tdmr_list(&tdx_tdmr_list, &tdx_sysinfo.tdmr); if (ret) @@ -1205,6 +1254,8 @@ static __init int init_tdx_module(void) free_tdmr_list(&tdx_tdmr_list); err_free_tdxmem: free_tdx_memlist(&tdx_memlist); +err_free_pamt_refcounts: + free_pamt_refcounts(); goto out_put_tdxmem; } =20 --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB76B1AA780; Sat, 18 Jul 2026 01:45:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339125; cv=none; b=WUbP9BN4RnK3pJuxRL0MA8ELRML3vshMENVJvZbRlUEVBTbI8ipCCFeyzpP8f5BWg9xRljIStkSq479VziFKoYlyBUz2KvFsFoDvKkj98Tq73MhXFMAYl8om85nuc2aSeY9RukCUIlbO1tHnitqPthuugfwxrZoRG9JaUaSZIEI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339125; c=relaxed/simple; bh=CLMCcFLJ90kRisX1xN8MPnbYt+KiCZYdwTbiGmkCWyA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CEW4NI3Wo0imBbFKG5lYg2izXSd9GuaA29oXpvz0Mt2mmxdW4YkLKFkOfBYBhsUkxzGMxfYyBNOLrWKC6Q49l9e871+R5cXGq6BtVo7N2CsY6RWqLCoIlwtyMmks5uPjiy0EjSIfZHUVlRngM2j7mpWMGay3A68LkrkMpJom1uE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ZcOngR8O; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ZcOngR8O" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339123; x=1815875123; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=CLMCcFLJ90kRisX1xN8MPnbYt+KiCZYdwTbiGmkCWyA=; b=ZcOngR8OqT6nBBQPcJr6MNgd3NOAGuq+neDo8RZUydtlLN4Kvrkhp5RD itGj4YYyLVH6g159LU4LEoax7TP+DarJNWOqkm0mwApzDzqnVhCjAjx1v O0n6IpETaHDH5O0M/LYUZI6xF6VnbJ/rH+w+nvhQ4pZpJwcuYu/j9Z0/Q lXDC7EI2IDA+LIMCzChG0lDc6065qGU/StRtfbbRz955JcZ81jQhnM8Zt dJ6nhAxxB5psliPRdzhnGc8MLYzYrCH8+hsXWsx64al46Lqv/PCrP5nOU AKaaSxhVmGieJmKRI4iIum7pR7Rn5zvdRjVhwnu2HkyZ4PDDj3A6MpYzx w==; X-CSE-ConnectionGUID: MtrfdLO3Rj2cAFF6jiMqGw== X-CSE-MsgGUID: GAdP19zQQf2MK/NyTxZfsQ== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377156" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377156" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:16 -0700 X-CSE-ConnectionGUID: MghjHFz4ROS7SHrs+ZeQYA== X-CSE-MsgGUID: h5UT576ER5aDucmcZOVgGQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296268" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:08 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 05/11] x86/virt/tdx: Handle multiple callers in tdx_pamt_get/put() Date: Fri, 17 Jul 2026 18:44:54 -0700 Message-ID: <20260718014500.2231262-6-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" tdx_pamt_get()/tdx_pamt_put() unconditionally add or remove Dynamic PAMT backing for the 2MB region covering the passed page. However, multiple callers can add or remove 4KB pages that fall within the same 2MB region and in that scenario only a single PAMT entry is required. Make the helpers handle only adding/removing Dynamic PAMT backing when required, by refcounting each 2MB range. Gate the actual Dynamic PAMT add and remove on refcount transitions (0->1 and 1->0). Serialize the refcount check and SEAMCALL with a global spinlock so the read-decide-act sequence is atomic. This also avoids TDX module BUSY errors, as the Dynamic PAMT add and remove SEAMCALLs take internal TDX module locks for the 2MB ranges of the specified PFN and the PAMT page pair PFNs. So simultaneous attempts on the same 2MB ranges of the PFNs would otherwise encounter an error, which would not be handleable in the put case. The lock is global and heavyweight. Use simple conditional logic to keep correctness obvious. This will be optimized in a later change. The pamt_refcounts[] are atomic_t's. They do not strictly need to be because all access is protected by pamt_lock. The overhead of an atomic_t in this situation is minuscule compared to the global lock. Leave the atomic_t in place to enable future optimization with minimal churn. AI was used under supervision to collect/apply feedback, split patches, review code and workshop logs. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Chao Gao Reviewed-by: Yan Zhao Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta Reviewed-by: Nikolay Borisov --- v7: - Convert scoped_guard() blocks to use normal spin_un/lock() for the sake of making next patches diff cleaner - Drop __maybe_unused from tdx_find_pamt_refcount() (Binbin) - Switch to atomic_inc_not_zero() (Dave) - Justify use of atomic_t in log (Sohil) - Log/comments (Yan) - Drop Assisted-by tag and cover AI use in log (Dave) v6: - Split from "x86/virt/tdx: Add tdx_alloc/free_control_page() helpers" - Return 0 instead of ret to be clearer (Binbin) - Clarify log (Nikolay) - Justify why the patch is not optimized in response to comments by (Nikolay) - Move tdx_find_pamt_refcount() to faciliate patch re-order - Adjustments from dropping error helper patches - Log tweaks --- arch/x86/virt/vmx/tdx/tdx.c | 48 +++++++++++++++++++++++++++++++++---- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index b2ddd3c192645..343d0cccc9874 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -289,7 +289,7 @@ static __init void free_pamt_refcounts(void) pamt_refcounts =3D NULL; } =20 -static atomic_t * __maybe_unused tdx_find_pamt_refcount(unsigned long pfn) +static atomic_t *tdx_find_pamt_refcount(unsigned long pfn) { /* Find which PMD a PFN is in. */ unsigned long index =3D pfn >> (PMD_SHIFT - PAGE_SHIFT); @@ -2120,10 +2120,14 @@ static u64 tdh_phymem_pamt_remove(kvm_pfn_t pfn, st= ruct page **pamt_pages) return 0; } =20 -/* Allocate PAMT memory for the given page */ +/* Serializes adding/removing PAMT memory */ +static DEFINE_SPINLOCK(pamt_lock); + +/* Bump PAMT refcount for the given pfn and allocate PAMT backing if neede= d. */ static int tdx_pamt_get(kvm_pfn_t pfn) { struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT]; + atomic_t *pamt_refcount; u64 tdx_status; int ret; =20 @@ -2134,29 +2138,58 @@ static int tdx_pamt_get(kvm_pfn_t pfn) if (ret) return ret; =20 + pamt_refcount =3D tdx_find_pamt_refcount(pfn); + + spin_lock(&pamt_lock); + + /* + * If the pamt page is already added (i.e. refcount >=3D 1), + * then just increment the refcount. + */ + if (atomic_inc_not_zero(pamt_refcount)) + goto out_free; + + /* Try to add the pamt page and take the refcount 0->1. */ tdx_status =3D tdh_phymem_pamt_add(pfn, pamt_pages); - if (tdx_status !=3D TDX_SUCCESS) { + if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) { ret =3D -EIO; goto out_free; } =20 + atomic_set(pamt_refcount, 1); + spin_unlock(&pamt_lock); return 0; =20 out_free: + spin_unlock(&pamt_lock); free_pamt_array(pamt_pages); =20 return ret; } =20 -/* Free PAMT memory for the given page */ +/* Drop PAMT refcount for the given pfn and free PAMT backing if needed. */ static void tdx_pamt_put(kvm_pfn_t pfn) { struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT] =3D {}; + atomic_t *pamt_refcount; u64 tdx_status; =20 if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) return; =20 + pamt_refcount =3D tdx_find_pamt_refcount(pfn); + + spin_lock(&pamt_lock); + /* + * If there is more than 1 reference on the pamt page, don't + * remove it yet. Just decrement the refcount. + */ + if (atomic_read(pamt_refcount) > 1) { + atomic_dec(pamt_refcount); + goto out_unlock; + } + + /* Try to remove the pamt page and take the refcount 1->0. */ tdx_status =3D tdh_phymem_pamt_remove(pfn, pamt_pages); =20 /* @@ -2167,9 +2200,14 @@ static void tdx_pamt_put(kvm_pfn_t pfn) * the dangling PAMT entry may cause future operations to fail. */ if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) - return; + goto out_unlock; =20 + atomic_set(pamt_refcount, 0); + spin_unlock(&pamt_lock); free_pamt_array(pamt_pages); + return; +out_unlock: + spin_unlock(&pamt_lock); } =20 /* --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A60B3244665; Sat, 18 Jul 2026 01:45:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339127; cv=none; b=I+tu5QUjNVrxkP6/l7SejTyQ3ZSeZRCznrNCQnPNYa/dx9AvttsG8KO8epjdXpq49RFksNKzuU104bARO0aLZV80vU0k3/FJr8vy4s2Hg53K3kfPGDGRpsCgr44gQvzWmiNAZY/64Uh7tlLDhCwyMokV8MKygE7/1N2YK2/7v9E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339127; c=relaxed/simple; bh=GJuTeIHYLzyBiVh+oXX/eeLc8lfjXNHZ+NmOFoTpb38=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FV0eVRl8wAXjBK1Z0W14jccCzj1AfTHIaYpcl/CJIEFMIW4la+mjKfHYj+jT2wT121Lc9NhlAAd3r/xP2z0s5cbU1fYL08WsvUZJM6xNYfkvjWLFfT6iYHmE+fqS2Kd2bMCJYLIjQ8TxvuuvuPsTPiJbGYRmw4U6RF9Pp87ZAXQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=BL64R/Zf; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="BL64R/Zf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339125; x=1815875125; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=GJuTeIHYLzyBiVh+oXX/eeLc8lfjXNHZ+NmOFoTpb38=; b=BL64R/Zf0Dp3vz/zjpgEdjs1uFbjBdgKDa4OVA7/lrFdT1VG99pme9X9 tWzWX/QQM+PRSczk5OE4flW2plLPW/RsHEPP3SGBY/4E7QAaBJaA94L3v 9aXCZlVb2NxiwC8puYCOsK+3BoXhZPyDDW5g5M9Nj8tIsR6f866R4B0Fu BDTIziMTzJrpourQFPnOj0uhL3okTEyu4/gPdaDXr2YCQ51vWsKEpPW2/ w1vBKBwwGxBvLyOHQyfMsDr98Il3ZABd376ho6SM19m2QX/+SDoYvZFt5 v0dj6/gTi8cifT0y3Nriavgx5xORHYiAZOsouWiX6R3kiBbPyZCObg6C4 A==; X-CSE-ConnectionGUID: T8K3XycZTOKXFYckz6zn+g== X-CSE-MsgGUID: 0Wx4v2XITVuWEvi1bS2TVQ== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377164" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377164" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:17 -0700 X-CSE-ConnectionGUID: mxzTt6ZFRo68uXzoOKXTgQ== X-CSE-MsgGUID: TpKBTr5fQqyTfojvRh2VHA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296274" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:09 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 06/11] KVM: TDX: Allocate PAMT memory for TD and vCPU control structures Date: Fri, 17 Jul 2026 18:44:55 -0700 Message-ID: <20260718014500.2231262-7-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" Use control page helpers for allocating and freeing TD control structures, such that these operations can work for Dynamic PAMT. The TDX module tracks some state for each page of physical memory that it might use. It calls this state the PAMT. It includes separate state for each page size a physical page could be utilized at within the TDX module (1GB, 2MB, 4KB). In Dynamic PAMT, only the 4KB page size state is allocated dynamically. So the kernel must ensure PAMT backing is installed for any 4KB page being gifted to the TDX module, and must tear down the backing when all associated gifted pages are reclaimed. TD scoped control pages (TDR, TDCS) and vCPU scoped control pages (TDVPR, TDCX) are all handed to the TDX module at 4KB page size and are therefore subject to this requirement. Replace the raw alloc_page()/__free_page() calls for these pages with tdx_alloc/free_control_page(). Switching between special Dynamic PAMT operations or normal page alloc/free operations is handled internally in tdx_alloc/free_control_page(). So don't check for Dynamic PAMT around these calls. Just call them unconditionally. Similarly, drop the NULL checks before freeing, as tdx_free_control_page() handles NULL internally. No functional change intended when Dynamic PAMT is not in use. Signed-off-by: Kirill A. Shutemov [sean: handle alloc+free+reclaim in one patch] Signed-off-by: Sean Christopherson [rick: enhance log, reviewing, rebase, with help from AI tooling] Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Chao Gao Reviewed-by: Yan Zhao Reviewed-by: Tony Lindgren Acked-by: Sean Christopherson Acked-by: Sohil Mehta Reviewed-by: Nikolay Borisov < nik.borisov@suse.com> --- v7: - Fixup tags (Sean) - Missing word in log (Binbin) - Log smoothness (Yan) --- arch/x86/kvm/vmx/tdx.c | 35 ++++++++++++++--------------------- 1 file changed, 14 insertions(+), 21 deletions(-) diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index 989ab29b8c6fb..f6c01eab8113b 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -362,7 +362,7 @@ static void tdx_reclaim_control_page(struct page *ctrl_= page) if (tdx_reclaim_page(ctrl_page)) return; =20 - __free_page(ctrl_page); + tdx_free_control_page(ctrl_page); } =20 struct tdx_flush_vp_arg { @@ -589,7 +589,7 @@ static void tdx_reclaim_td_control_pages(struct kvm *kv= m) =20 tdx_quirk_reset_paddr(page_to_phys(kvm_tdx->td.tdr_page), PAGE_SIZE); =20 - __free_page(kvm_tdx->td.tdr_page); + tdx_free_control_page(kvm_tdx->td.tdr_page); kvm_tdx->td.tdr_page =3D NULL; } =20 @@ -2459,7 +2459,7 @@ static int __tdx_td_init(struct kvm *kvm, struct td_p= arams *td_params, =20 ret =3D -ENOMEM; =20 - tdr_page =3D alloc_page(GFP_KERNEL_ACCOUNT); + tdr_page =3D tdx_alloc_control_page(); if (!tdr_page) goto free_hkid; =20 @@ -2472,7 +2472,7 @@ static int __tdx_td_init(struct kvm *kvm, struct td_p= arams *td_params, goto free_tdr; =20 for (i =3D 0; i < kvm_tdx->td.tdcs_nr_pages; i++) { - tdcs_pages[i] =3D alloc_page(GFP_KERNEL_ACCOUNT); + tdcs_pages[i] =3D tdx_alloc_control_page(); if (!tdcs_pages[i]) goto free_tdcs; } @@ -2590,10 +2590,8 @@ static int __tdx_td_init(struct kvm *kvm, struct td_= params *td_params, teardown: /* Only free pages not yet added, so start at 'i' */ for (; i < kvm_tdx->td.tdcs_nr_pages; i++) { - if (tdcs_pages[i]) { - __free_page(tdcs_pages[i]); - tdcs_pages[i] =3D NULL; - } + tdx_free_control_page(tdcs_pages[i]); + tdcs_pages[i] =3D NULL; } if (!kvm_tdx->td.tdcs_pages) kfree(tdcs_pages); @@ -2608,16 +2606,13 @@ static int __tdx_td_init(struct kvm *kvm, struct td= _params *td_params, free_cpumask_var(packages); =20 free_tdcs: - for (i =3D 0; i < kvm_tdx->td.tdcs_nr_pages; i++) { - if (tdcs_pages[i]) - __free_page(tdcs_pages[i]); - } + for (i =3D 0; i < kvm_tdx->td.tdcs_nr_pages; i++) + tdx_free_control_page(tdcs_pages[i]); kfree(tdcs_pages); kvm_tdx->td.tdcs_pages =3D NULL; =20 free_tdr: - if (tdr_page) - __free_page(tdr_page); + tdx_free_control_page(tdr_page); kvm_tdx->td.tdr_page =3D NULL; =20 free_hkid: @@ -2947,7 +2942,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u6= 4 vcpu_rcx) int ret, i; u64 err; =20 - page =3D alloc_page(GFP_KERNEL_ACCOUNT); + page =3D tdx_alloc_control_page(); if (!page) return -ENOMEM; tdx->vp.tdvpr_page =3D page; @@ -2967,7 +2962,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u6= 4 vcpu_rcx) } =20 for (i =3D 0; i < kvm_tdx->td.tdcx_nr_pages; i++) { - page =3D alloc_page(GFP_KERNEL_ACCOUNT); + page =3D tdx_alloc_control_page(); if (!page) { ret =3D -ENOMEM; goto free_tdcx; @@ -2989,7 +2984,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u6= 4 vcpu_rcx) * method, but the rest are freed here. */ for (; i < kvm_tdx->td.tdcx_nr_pages; i++) { - __free_page(tdx->vp.tdcx_pages[i]); + tdx_free_control_page(tdx->vp.tdcx_pages[i]); tdx->vp.tdcx_pages[i] =3D NULL; } return -EIO; @@ -3017,16 +3012,14 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, = u64 vcpu_rcx) =20 free_tdcx: for (i =3D 0; i < kvm_tdx->td.tdcx_nr_pages; i++) { - if (tdx->vp.tdcx_pages[i]) - __free_page(tdx->vp.tdcx_pages[i]); + tdx_free_control_page(tdx->vp.tdcx_pages[i]); tdx->vp.tdcx_pages[i] =3D NULL; } kfree(tdx->vp.tdcx_pages); tdx->vp.tdcx_pages =3D NULL; =20 free_tdvpr: - if (tdx->vp.tdvpr_page) - __free_page(tdx->vp.tdvpr_page); + tdx_free_control_page(tdx->vp.tdvpr_page); tdx->vp.tdvpr_page =3D NULL; tdx->vp.tdvpr_pa =3D 0; =20 --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 355AD256C70; Sat, 18 Jul 2026 01:45:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339127; cv=none; b=iOdoJjdPh6MVMAF4iWX3tpwLM/yyiQE98d0l8ElTXTIiYCuPl+LAsgBdezs79AmT2yy5gMbqSXyTwSHWOfkDFo50/x31tD3SCsnHgv0cSBbPOloVRQM8iErGMrnYIqJNcNnh2Z8tdg7VLFBDK4SIWFGxdi0MX5NkY0itdPhiI8o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339127; c=relaxed/simple; bh=/ajGMImpY2ZjUqHutJCj2FAmYE7evsIR4gQJ80vgUhQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Aqavk9n+idcjESOPmbJ5u0N5FfLF+aHimHVdm+r2FSK1tb+P4g2u917MPkgXymlQqNZCKHq8b0r3ms7UJcTvy2xZL3Ly3397+N4wdL9ZuW0op9FzNe58t/HIw7Na+6ZXMrHg+gQLBpF9mYgj5kczq6ui7nEiqWcYcQ+14HyVcks= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=G8Y6OthY; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="G8Y6OthY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339122; x=1815875122; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=/ajGMImpY2ZjUqHutJCj2FAmYE7evsIR4gQJ80vgUhQ=; b=G8Y6OthYaST1G5pi0dW52ixpiMjpC2Woql590KsaZ7Y/w7uBvUHfJw5m DOzgoV+iDDWm6qUR3VLJiZdAIaa4FbTW3UpjI074p93JBoPfjdRbjcCqk o7rYgTlbfyp+3JLVqsDy4JM8AUl/tTb//vLgiD2eKI+b8TCFtM2Cr58oK nsuEoz50BG6wobpR3z2r9rHnWlsZbV5tpZA5bUfBDWRwv5b8B2O8GjO36 AsCkGt12C2Zux29CrpnhzXWGqGlBhbjm0i5BitmLlDOGmOJjL2d/AaIbM Gp22nlleyqRpHYqDD8LnOoq5DKUxCfgOxfLe9CptQsNrS/8zfjW+ZuK/w g==; X-CSE-ConnectionGUID: OSimKaVZTwWYQGJE2N6/Ig== X-CSE-MsgGUID: zbstQeKXRhap6PHIpGyBiw== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377134" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377134" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:16 -0700 X-CSE-ConnectionGUID: oVpC3y3BRUaa1/3gez7pNw== X-CSE-MsgGUID: Iwhigj6GRgurQoHE5bxcMA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296278" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:09 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 07/11] x86/tdx: Add APIs to support Dynamic PAMT ops from KVM's fault path Date: Fri, 17 Jul 2026 18:44:56 -0700 Message-ID: <20260718014500.2231262-8-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When handling an EPT violation, KVM holds a spinlock while manipulating the EPT. Before entering the spinlock it doesn't know how many EPT page tables will need to be installed or whether a huge page will be used. For this reason it allocates a worst case number of page tables that it might need as part of servicing the EPT violation. Under Dynamic PAMT these pre-allocated pages will potentially need to have Dynamic PAMT backing pages installed for them. KVM already has helpers to manage topping up page caches before taking the MMU lock, but they cannot be passed from KVM to arch/x86 code. The problem of how and when to install the Dynamic PAMT backing pages for the pages given to the TDX module during the fault path has had a lot of design attempts. - Extracting KVM's MMU caches requires too much inlined code added to headers. - A few varieties of installing Dynamic PAMT backing when allocating the S-EPT page tables. (see links) - Using mempool_t to transfer the pages between KVM and arch/x86 doesn't work because the component is designed more around maintaining a pool of pages, rather than topping up a continually drained cache. So don't do these as they all had various problems. Instead just create a small simple data structure to use for handing a pre-allocated list of pages between KVM and arch/x86 code. Model this on KVM's existing MMU memory caches. Add a tdx_pamt_cache arg to tdx_pamt_get() so it can draw pages from a cache when needed. Not all Dynamic PAMT page installations will happen under spinlock, for example TD and vCPU scoped control pages. So have tdx_pamt_get() maintain the existing behavior of allocating from the page allocator when NULL is passed for the struct tdx_pamt_cache arg. This prevents excess allocations for cases where it can be avoided. Export the new helpers for KVM. AI was used under supervision to review code and workshop logs. Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Rick Edgecombe Reviewed-by: Kiryl Shutsemau (Meta) Reviewed-by: Binbin Wu Reviewed-by: Chao Gao Reviewed-by: Yan Zhao Reviewed-by: Tony Lindgren Link: https://lore.kernel.org/kvm/aXENNKjAKTM9UJNH@google.com/ Link: https://lore.kernel.org/kvm/20260129011517.3545883-20-seanjc@google.c= om/ Link: https://lore.kernel.org/kvm/aYW5CbUvZrLogsWF@yzhao56-desk.sh.intel.co= m/ Acked-by: Sohil Mehta Reviewed-by: Nikolay Borisov --- v7: - Log/comment tweaks (Yan) - Drop Assisted-by tag and cover AI use in log (Dave) v6: - Filled out log from Sean's series --- arch/x86/include/asm/tdx.h | 17 ++++++++++ arch/x86/virt/vmx/tdx/tdx.c | 65 +++++++++++++++++++++++++++++++++---- 2 files changed, 76 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h index 86bf37b15c705..9cbd250bbd39b 100644 --- a/arch/x86/include/asm/tdx.h +++ b/arch/x86/include/asm/tdx.h @@ -120,6 +120,23 @@ static inline bool tdx_supports_runtime_update(const s= truct tdx_sys_info *sysinf =20 bool tdx_supports_dynamic_pamt(const struct tdx_sys_info *sysinfo); =20 +/* Simple structure for pre-allocating Dynamic PAMT pages outside of spinl= ocks. */ +struct tdx_pamt_cache { + struct list_head page_list; + int cnt; +}; + +static inline void tdx_init_pamt_cache(struct tdx_pamt_cache *cache) +{ + INIT_LIST_HEAD(&cache->page_list); + cache->cnt =3D 0; +} + +void tdx_free_pamt_cache(struct tdx_pamt_cache *cache); +int tdx_topup_pamt_cache(struct tdx_pamt_cache *cache, unsigned long npage= s); +int tdx_pamt_get(kvm_pfn_t pfn, struct tdx_pamt_cache *cache); +void tdx_pamt_put(kvm_pfn_t pfn); + int tdx_guest_keyid_alloc(void); u32 tdx_get_nr_guest_keyids(void); void tdx_guest_keyid_free(unsigned int keyid); diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index 343d0cccc9874..e2f11b0ba46ce 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -2045,12 +2045,33 @@ bool tdx_supports_dynamic_pamt(const struct tdx_sys= _info *sysinfo) return false; } =20 -static int alloc_pamt_array(struct page **pamt_pages) +static struct page *tdx_alloc_page_pamt_cache(struct tdx_pamt_cache *cache) +{ + struct page *page; + + page =3D list_first_entry_or_null(&cache->page_list, struct page, lru); + if (page) { + list_del(&page->lru); + cache->cnt--; + } + + return page; +} + +static struct page *alloc_dpamt_page(struct tdx_pamt_cache *cache) +{ + if (cache) + return tdx_alloc_page_pamt_cache(cache); + + return alloc_page(GFP_KERNEL_ACCOUNT); +} + +static int alloc_pamt_array(struct page **pamt_pages, struct tdx_pamt_cach= e *cache) { int i, j; =20 for (i =3D 0; i < TDX_DPAMT_ENTRY_PAGE_CNT; i++) { - pamt_pages[i] =3D alloc_page(GFP_KERNEL_ACCOUNT); + pamt_pages[i] =3D alloc_dpamt_page(cache); if (!pamt_pages[i]) goto err; } @@ -2124,7 +2145,7 @@ static u64 tdh_phymem_pamt_remove(kvm_pfn_t pfn, stru= ct page **pamt_pages) static DEFINE_SPINLOCK(pamt_lock); =20 /* Bump PAMT refcount for the given pfn and allocate PAMT backing if neede= d. */ -static int tdx_pamt_get(kvm_pfn_t pfn) +int tdx_pamt_get(kvm_pfn_t pfn, struct tdx_pamt_cache *cache) { struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT]; atomic_t *pamt_refcount; @@ -2134,7 +2155,7 @@ static int tdx_pamt_get(kvm_pfn_t pfn) if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) return 0; =20 - ret =3D alloc_pamt_array(pamt_pages); + ret =3D alloc_pamt_array(pamt_pages, cache); if (ret) return ret; =20 @@ -2166,9 +2187,10 @@ static int tdx_pamt_get(kvm_pfn_t pfn) =20 return ret; } +EXPORT_SYMBOL_FOR_KVM(tdx_pamt_get); =20 /* Drop PAMT refcount for the given pfn and free PAMT backing if needed. */ -static void tdx_pamt_put(kvm_pfn_t pfn) +void tdx_pamt_put(kvm_pfn_t pfn) { struct page *pamt_pages[TDX_DPAMT_ENTRY_PAGE_CNT] =3D {}; atomic_t *pamt_refcount; @@ -2209,6 +2231,37 @@ static void tdx_pamt_put(kvm_pfn_t pfn) out_unlock: spin_unlock(&pamt_lock); } +EXPORT_SYMBOL_FOR_KVM(tdx_pamt_put); + +void tdx_free_pamt_cache(struct tdx_pamt_cache *cache) +{ + struct page *page; + + while ((page =3D tdx_alloc_page_pamt_cache(cache))) + __free_page(page); +} +EXPORT_SYMBOL_FOR_KVM(tdx_free_pamt_cache); + +int tdx_topup_pamt_cache(struct tdx_pamt_cache *cache, unsigned long npage= s) +{ + if (WARN_ON_ONCE(!tdx_supports_dynamic_pamt(&tdx_sysinfo))) + return 0; + + npages *=3D TDX_DPAMT_ENTRY_PAGE_CNT; + + while (cache->cnt < npages) { + struct page *page =3D alloc_page(GFP_KERNEL_ACCOUNT); + + if (!page) + return -ENOMEM; + + list_add(&page->lru, &cache->page_list); + cache->cnt++; + } + + return 0; +} +EXPORT_SYMBOL_FOR_KVM(tdx_topup_pamt_cache); =20 /* * Return a page that can be gifted to the TDX-Module for use as a "contro= l" @@ -2223,7 +2276,7 @@ struct page *tdx_alloc_control_page(void) if (!page) return NULL; =20 - if (tdx_pamt_get(page_to_pfn(page))) { + if (tdx_pamt_get(page_to_pfn(page), NULL)) { __free_page(page); return NULL; } --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7DF026B777; Sat, 18 Jul 2026 01:45:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339130; cv=none; b=BFW0x+0+DduDr4JJu8PsvH2zbW/Gtph7uW5QoeNo/eLNNrhK7IdJTPTJzaNCDMAiS1NqwR04InhSyciQiWLxADIXbwdE/UTRZ73uNYR6i9BpOEo3rtdOlPYPIPliVTokBNlAKSD5VUbAQKILfG++i2T2Asho5VIE6liPyAJMysY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339130; c=relaxed/simple; bh=0tQyn5b8noTcocSAf5EDWPpQ1LctvunYKj49Vw/XMk8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PIvVlgVxtOcbnDq1mr38KXNmACB4OaqOz5U3m7Y+RjKgpsI3XQawtfEt58nqC0S93tH2zmG1y+EaSkRMnNL1hRuhrnp/QcpyRPkOjRIAL6xaZWcin6UgUmdXWSTlHKJ5RZCm6nAyv5803WciMxc6iKhd4f4/iNjwCBT/vyfOYo4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=DOsGYFde; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="DOsGYFde" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339127; x=1815875127; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=0tQyn5b8noTcocSAf5EDWPpQ1LctvunYKj49Vw/XMk8=; b=DOsGYFdeAKiF8azjV1Em9lZSkPOb4ZWlqCzXEdznXSRBBrXgXRysrsRr qQoJmI5RNu9+4SoPR8D2PW4kBOvQNPO3qAo4KAXWDNQvofwXrDSJUHyXQ T1lXg2Cd/g+HVb4SOzIX8AJZU1pKgCi9aK3OnnkTzCqS0phZIY/0fKWQX 1lvdGUgEC1ccDvKBFxSTEDxi2cpyzTEe96nsMs0x09qQChFqpabqUsCH5 8rUDxknGva5iGniTQ2gx36FU0HR6AbvmdMQmRSg3qDqt9Ca9gzL6ogfL/ Naq7/lVx+aKtRpVYW0jhlYZ2Wj+8/d3mLFKluhMBNnLPpGvLxR+KZgOz5 w==; X-CSE-ConnectionGUID: u6/y688qRLGpj84UzxuDhg== X-CSE-MsgGUID: mS0YgCqBRjCJ/e4tKtmclA== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377181" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377181" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:17 -0700 X-CSE-ConnectionGUID: tEi4gzW0Tr6PZLVbKk0ezA== X-CSE-MsgGUID: lKdD4aRIS7ic5Gqxgb2SAQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296282" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:10 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 08/11] KVM: TDX: Get/put PAMT pages when (un)mapping private memory Date: Fri, 17 Jul 2026 18:44:57 -0700 Message-ID: <20260718014500.2231262-9-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" Add Dynamic PAMT support to KVM's S-EPT MMU by "getting" a PAMT page when adding guest memory (PAGE.ADD or PAGE.AUG), and "putting" the page when removing guest memory (PAGE.REMOVE). To access the per-vCPU PAMT caches without plumbing @vcpu throughout the TDP MMU, begrudgingly use kvm_get_running_vcpu() to get the vCPU, and bug the VM if KVM attempts to set an S-EPT leaf without an active vCPU. KVM only supports creating _new_ mappings in page (pre)fault paths, all of which require an active vCPU. The PAMT memory holds metadata for TDX protected memory. With Dynamic PAMT, PAMT_4K is allocated on demand. The kernel supplies the TDX module with a few pages that cover 2MB of host physical memory. Releases are balanced via tdx_pamt_put(): every control-page free goes through tdx_free_control_page(), and guest data pages are put directly on the successful tdh_mem_page_remove() path and in the tdx_mem_page_add/aug() error path. Signed-off-by: Kirill A. Shutemov Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson [rick: enhance log, reviewing, rebase, with help from AI tooling] Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Tony Lindgren Acked-by: Sean Christopherson Acked-by: Sohil Mehta --- v7: - Don't do to_tdx() before NULL check for readability (Binbin, Sean) - Fixup tags (Sean) - Export tdx_supports_dynamic_pamt() since it's used in KVM here and no longer an static inline. v6: - Don't have topup op take a min param (Yan, Sean) - Make log match style of the rest of the series - Adjustments from dropping error helper patches --- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 2 + arch/x86/kvm/mmu/mmu.c | 4 ++ arch/x86/kvm/vmx/tdx.c | 63 ++++++++++++++++++++++++++---- arch/x86/kvm/vmx/tdx.h | 2 + arch/x86/virt/vmx/tdx/tdx.c | 1 + 6 files changed, 65 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-= x86-ops.h index 83dc5086138b3..588563dfe88d5 100644 --- a/arch/x86/include/asm/kvm-x86-ops.h +++ b/arch/x86/include/asm/kvm-x86-ops.h @@ -98,6 +98,7 @@ KVM_X86_OP_OPTIONAL_RET0(tdp_has_smep) KVM_X86_OP(load_mmu_pgd) KVM_X86_OP_OPTIONAL_RET0(set_external_spte) KVM_X86_OP_OPTIONAL(free_external_spt) +KVM_X86_OP_OPTIONAL_RET0(topup_external_cache) KVM_X86_OP(has_wbinvd_exit) KVM_X86_OP(get_l2_tsc_offset) KVM_X86_OP(get_l2_tsc_multiplier) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_hos= t.h index 5f6c1ce9673b7..1c706e2d773b0 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1922,6 +1922,8 @@ struct kvm_x86_ops { /* Update external page tables for page table about to be freed. */ void (*free_external_spt)(struct kvm *kvm, struct kvm_mmu_page *sp); =20 + int (*topup_external_cache)(struct kvm_vcpu *vcpu, int min_nr_spts); + =20 bool (*has_wbinvd_exit)(void); =20 diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 234d0a95abf53..6dab99654f170 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -614,6 +614,10 @@ static int mmu_topup_memory_caches(struct kvm_vcpu *vc= pu, bool maybe_indirect) PT64_ROOT_MAX_LEVEL); if (r) return r; + + r =3D kvm_x86_call(topup_external_cache)(vcpu, PT64_ROOT_MAX_LEVEL); + if (r) + return r; } r =3D kvm_mmu_topup_memory_cache(&vcpu->arch.mmu_shadow_page_cache, PT64_ROOT_MAX_LEVEL); diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index f6c01eab8113b..c3b1d1f056cea 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -681,6 +681,8 @@ int tdx_vcpu_create(struct kvm_vcpu *vcpu) if (!irqchip_split(vcpu->kvm)) return -EINVAL; =20 + tdx_init_pamt_cache(&tdx->pamt_cache); + fpstate_set_confidential(&vcpu->arch.guest_fpu); vcpu->arch.apic->guest_apic_protected =3D true; INIT_LIST_HEAD(&tdx->vt.pi_wakeup_list); @@ -866,6 +868,8 @@ void tdx_vcpu_free(struct kvm_vcpu *vcpu) struct vcpu_tdx *tdx =3D to_tdx(vcpu); int i; =20 + tdx_free_pamt_cache(&tdx->pamt_cache); + if (vcpu->cpu !=3D -1) { KVM_BUG_ON(tdx->state =3D=3D VCPU_TD_STATE_INITIALIZED, vcpu->kvm); tdx_flush_vp_on_cpu(vcpu); @@ -1621,6 +1625,16 @@ void tdx_load_mmu_pgd(struct kvm_vcpu *vcpu, hpa_t r= oot_hpa, int pgd_level) td_vmcs_write64(to_tdx(vcpu), SHARED_EPT_POINTER, root_hpa); } =20 +static int tdx_topup_external_pamt_cache(struct kvm_vcpu *vcpu, int min_nr= _spts) +{ + /* + * Don't cover the root SPT, but cover a possible 4KB private + * page in addition to the SPTs. So -1 to exclude the root + * SPT, and +1 for the guest page cancel out. + */ + return tdx_topup_pamt_cache(&to_tdx(vcpu)->pamt_cache, min_nr_spts); +} + static int tdx_mem_page_add(struct kvm *kvm, gfn_t gfn, enum pg_level leve= l, kvm_pfn_t pfn) { @@ -1679,16 +1693,28 @@ static struct page *tdx_spte_to_sept_pt(struct kvm = *kvm, gfn_t gfn, static int tdx_sept_map_nonleaf_spte(struct kvm *kvm, gfn_t gfn, enum pg_level level, u64 new_spte) { + struct kvm_vcpu *vcpu =3D kvm_get_running_vcpu(); gpa_t gpa =3D gfn_to_gpa(gfn); u64 err, entry, level_state; struct page *sept_pt; + int ret; + + if (KVM_BUG_ON(!vcpu, kvm)) + return -EIO; =20 sept_pt =3D tdx_spte_to_sept_pt(kvm, gfn, new_spte, level); if (!sept_pt) return -EIO; =20 + ret =3D tdx_pamt_get(page_to_pfn(sept_pt), &to_tdx(vcpu)->pamt_cache); + if (ret) + return ret; + err =3D tdh_mem_sept_add(&to_kvm_tdx(kvm)->td, gpa, level, sept_pt, &entry, &level_state); + if (err) + tdx_pamt_put(page_to_pfn(sept_pt)); + if (unlikely(tdx_operand_busy(err))) return -EBUSY; =20 @@ -1701,8 +1727,13 @@ static int tdx_sept_map_nonleaf_spte(struct kvm *kvm= , gfn_t gfn, static int tdx_sept_map_leaf_spte(struct kvm *kvm, gfn_t gfn, enum pg_leve= l level, u64 new_spte) { + struct kvm_vcpu *vcpu =3D kvm_get_running_vcpu(); struct kvm_tdx *kvm_tdx =3D to_kvm_tdx(kvm); kvm_pfn_t pfn =3D spte_to_pfn(new_spte); + int ret; + + if (KVM_BUG_ON(!vcpu, kvm)) + return -EIO; =20 /* TODO: handle large pages. */ if (KVM_BUG_ON(level !=3D PG_LEVEL_4K, kvm)) @@ -1710,6 +1741,10 @@ static int tdx_sept_map_leaf_spte(struct kvm *kvm, g= fn_t gfn, enum pg_level leve =20 WARN_ON_ONCE((new_spte & VMX_EPT_RWX_MASK) !=3D VMX_EPT_RWX_MASK); =20 + ret =3D tdx_pamt_get(pfn, &to_tdx(vcpu)->pamt_cache); + if (ret) + return ret; + /* * Ensure pre_fault_allowed is read by kvm_arch_vcpu_pre_fault_memory() * before kvm_tdx->state. Userspace must not be allowed to pre-fault @@ -1722,10 +1757,15 @@ static int tdx_sept_map_leaf_spte(struct kvm *kvm, = gfn_t gfn, enum pg_level leve * If the TD isn't finalized/runnable, then userspace is initializing * the VM image via KVM_TDX_INIT_MEM_REGION; ADD the page to the TD. */ - if (unlikely(kvm_tdx->state !=3D TD_STATE_RUNNABLE)) - return tdx_mem_page_add(kvm, gfn, level, pfn); + if (likely(kvm_tdx->state =3D=3D TD_STATE_RUNNABLE)) + ret =3D tdx_mem_page_aug(kvm, gfn, level, pfn); + else + ret =3D tdx_mem_page_add(kvm, gfn, level, pfn); =20 - return tdx_mem_page_aug(kvm, gfn, level, pfn); + if (ret) + tdx_pamt_put(pfn); + + return ret; } =20 /* @@ -1822,6 +1862,7 @@ static int tdx_sept_remove_leaf_spte(struct kvm *kvm,= gfn_t gfn, return -EIO; =20 tdx_quirk_reset_paddr(PFN_PHYS(pfn), PAGE_SIZE); + tdx_pamt_put(pfn); return 0; } =20 @@ -1865,6 +1906,8 @@ static int tdx_sept_set_private_spte(struct kvm *kvm,= gfn_t gfn, u64 old_spte, */ static void tdx_sept_free_private_spt(struct kvm *kvm, struct kvm_mmu_page= *sp) { + struct page *sept_pt =3D virt_to_page(sp->external_spt); + /* * KVM doesn't (yet) zap page table pages in mirror page table while * TD is active, though guest pages mapped in mirror page table could be @@ -1878,15 +1921,15 @@ static void tdx_sept_free_private_spt(struct kvm *k= vm, struct kvm_mmu_page *sp) * the page to prevent the kernel from accessing the encrypted page. */ if (KVM_BUG_ON(is_hkid_assigned(to_kvm_tdx(kvm)), kvm) || - tdx_reclaim_page(virt_to_page(sp->external_spt))) + tdx_reclaim_page(sept_pt)) goto out; =20 /* - * Immediately free the S-EPT page because RCU-time free is unnecessary - * after TDH.PHYMEM.PAGE.RECLAIM ensures there are no outstanding - * readers. + * Immediately free the S-EPT page as the TDX subsystem doesn't support + * freeing pages from RCU callbacks, and more importantly because + * TDH.PHYMEM.PAGE.RECLAIM ensures there are no outstanding readers. */ - free_page((unsigned long)sp->external_spt); + tdx_free_control_page(sept_pt); out: sp->external_spt =3D NULL; } @@ -3482,6 +3525,10 @@ int __init tdx_hardware_setup(void) =20 vt_x86_ops.set_external_spte =3D tdx_sept_set_private_spte; vt_x86_ops.free_external_spt =3D tdx_sept_free_private_spt; + + if (tdx_supports_dynamic_pamt(tdx_sysinfo)) + vt_x86_ops.topup_external_cache =3D tdx_topup_external_pamt_cache; + vt_x86_ops.protected_apic_has_interrupt =3D tdx_protected_apic_has_interr= upt; return 0; =20 diff --git a/arch/x86/kvm/vmx/tdx.h b/arch/x86/kvm/vmx/tdx.h index ac8323a68b163..fd368e3ee060b 100644 --- a/arch/x86/kvm/vmx/tdx.h +++ b/arch/x86/kvm/vmx/tdx.h @@ -72,6 +72,8 @@ struct vcpu_tdx { =20 u64 map_gpa_next; u64 map_gpa_end; + + struct tdx_pamt_cache pamt_cache; }; =20 void tdh_vp_rd_failed(struct vcpu_tdx *tdx, char *uclass, u32 field, u64 e= rr); diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index e2f11b0ba46ce..61f48fff69df6 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -2044,6 +2044,7 @@ bool tdx_supports_dynamic_pamt(const struct tdx_sys_i= nfo *sysinfo) /* To be enabled when kernel is ready. */ return false; } +EXPORT_SYMBOL_FOR_KVM(tdx_supports_dynamic_pamt); =20 static struct page *tdx_alloc_page_pamt_cache(struct tdx_pamt_cache *cache) { --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F348226158B; Sat, 18 Jul 2026 01:45:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339129; cv=none; b=RD3W+6BbNiFc3RIiVT9EkfeEPM2BiSljUQCx3zSJG/r+W/N2CAPfHGUsDqouU85Lk0iOPZgwdSV5i6188dGGj9HJMm57xkN9//wnMLqKx1ibRHPPxc4VzY9O+Dz2DZBDlIEmLxo6t+AALDfwFBM08JtUF56GqzvPL1SenvL/+yc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339129; c=relaxed/simple; bh=nn84tB7jb4o5ROXYXo2hi61apKafyqMBLrSLmPKEziY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=inr/eHYwD1nIDbC0QgTJw9JwrPiushp5vEgvQf35ydGtn2FhOmqjmoJtoj1ImZmZDIWAGlGxj5EQVvePpwcTp+kzXRGvVHXn0DtEICb1hlgiGKDoslErOJNV6XhSaz8J947kw93w1eIzXgzll1bfj0eUyuGJjzHIFUjWYnf76rA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=dct5vA4+; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="dct5vA4+" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339127; x=1815875127; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nn84tB7jb4o5ROXYXo2hi61apKafyqMBLrSLmPKEziY=; b=dct5vA4+u0SMdXS0Sf3ou+G2PRE+uivK3uk2QUoFIAEXplF8O1JakA0+ msk96i0zpgx8k12SPRkGfClvRORK6+QQbEfMYvkss/IOB27+TWMROA13X W5steKnIWNtdoQftuvE568vLh1/1TqJp3LRoT9+BK3jXII7nCvQF5xAeP BiCRt4SW95tO108jTSYvEJAVWwFapezUmsdA73PW/i6JzbJSD9r5KPnue XQwglSwHi8h25LvGZZ6N24A47ObX+bJgYV7rzAs9IDA73uGVE2Nvzip4v cTPoeS8SK8aMOHDgqZmnUCPrsXAZncWud8lMidBkToaWhDV+TNLRomGL0 Q==; X-CSE-ConnectionGUID: aFUuBDhmSTeyUCRbGJtqfg== X-CSE-MsgGUID: 1jH+bh91SjOMpU8rjJfVcQ== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377173" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377173" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:17 -0700 X-CSE-ConnectionGUID: ixcNeQuFQFWUEBYqbOz/VQ== X-CSE-MsgGUID: keLndSSYTOeiMTLPlw5s1A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296285" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:10 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com Subject: [PATCH v7 09/11] x86/virt/tdx: Enable Dynamic PAMT Date: Fri, 17 Jul 2026 18:44:58 -0700 Message-ID: <20260718014500.2231262-10-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" The Physical Address Metadata Table (PAMT) holds TDX metadata for physical memory and must be allocated by the kernel during TDX module initialization. Dynamic PAMT is a TDX module feature that can reduce this memory use by allocating part of the PAMT dynamically. The TDX module exposes whether Dynamic PAMT is supported via a bit in the 'features0' metadata. Unfortunately, the TDX module exposes the feature as supported even when it does not support using it with the number of keyids currently configured in the BIOS. Since no TDX modules exist today with that issue fixed, make the feature default off to prevent users from upgrading their kernel and encountering TDX erroring out when trying to enable Dynamic PAMT. For the decision of whether to make it a boot time option and/or compile time option, consider that Dynamic PAMT's memory savings are significant enough to make it a good default configuration. That is most TDX users should want it unless they have strange keyid configurations. The feature increases the kernel size by 2KB (when TDX is configured in the build). All pieces are in place to enable Dynamic PAMT if it is supported and the user passes a kernel parameter. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta --- v7: - Add kernel parameter following some twists and turns, derriving originally from a comment by (Chao) v6: - After Nikolai pointed out that the TDX docs actually have the Dynamic PAMT pages-per-2MB region fixed at 2 instead of variable sized, I checked over the docs more closely looking for anything else that might have been missed. Spotted this 48 bit physical address bit check in the docs, so added it. --- .../admin-guide/kernel-parameters.txt | 7 +++++++ arch/x86/include/asm/tdx.h | 1 + arch/x86/virt/vmx/tdx/tdx.c | 21 +++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index b5493a7f8f228..be4928489b02f 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1321,6 +1321,13 @@ Kernel parameters The filter can be disabled or changed to another driver later using sysfs. =20 + tdx_dpamt=3D + [X86] Controls whether TDX will use Dynamic PAMT + to save memory, when supported. + + Valid parameters: "on", "off" + Default: "off" + reg_file_data_sampling=3D [X86] Controls mitigation for Register File Data Sampling (RFDS) vulnerability. RFDS is a CPU diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h index 9cbd250bbd39b..7910901a7ba21 100644 --- a/arch/x86/include/asm/tdx.h +++ b/arch/x86/include/asm/tdx.h @@ -36,6 +36,7 @@ /* Bit definitions of TDX_FEATURES0 metadata field */ #define TDX_FEATURES0_TD_PRESERVING BIT_ULL(1) #define TDX_FEATURES0_NO_RBP_MOD BIT_ULL(18) +#define TDX_FEATURES0_DYNAMIC_PAMT BIT_ULL(36) =20 #ifndef __ASSEMBLER__ =20 diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index 61f48fff69df6..f397ea17248e3 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -47,6 +47,8 @@ #include "seamcall_internal.h" #include "tdx.h" =20 +bool tdx_enable_dpamt __ro_after_init; + struct tdx_module_state { bool initialized; bool sysinit_done; @@ -1028,6 +1030,8 @@ static __init int construct_tdmrs(struct list_head *t= mb_list, return ret; } =20 +#define TDX_SYS_CONFIG_DYNAMIC_PAMT BIT(16) + static __init int config_tdx_module(struct tdmr_info_list *tdmr_list, u64 global_keyid) { @@ -1056,6 +1060,12 @@ static __init int config_tdx_module(struct tdmr_info= _list *tdmr_list, args.rcx =3D __pa(tdmr_pa_array); args.rdx =3D tdmr_list->nr_consumed_tdmrs; args.r8 =3D global_keyid; + + if (tdx_supports_dynamic_pamt(&tdx_sysinfo)) { + pr_info("Enable Dynamic PAMT\n"); + args.r8 |=3D TDX_SYS_CONFIG_DYNAMIC_PAMT; + } + ret =3D seamcall_prerr(TDH_SYS_CONFIG, &args); =20 /* Free the array as it is not required anymore. */ @@ -2041,8 +2051,8 @@ EXPORT_SYMBOL_FOR_KVM(tdh_phymem_page_wbinvd_hkid); =20 bool tdx_supports_dynamic_pamt(const struct tdx_sys_info *sysinfo) { - /* To be enabled when kernel is ready. */ - return false; + return sysinfo->features.tdx_features0 & TDX_FEATURES0_DYNAMIC_PAMT && + tdx_enable_dpamt; } EXPORT_SYMBOL_FOR_KVM(tdx_supports_dynamic_pamt); =20 @@ -2300,6 +2310,13 @@ void tdx_free_control_page(struct page *page) } EXPORT_SYMBOL_FOR_KVM(tdx_free_control_page); =20 +static int __init tdx_dpamt_setup(char *str) +{ + return kstrtobool(str, &tdx_enable_dpamt) =3D=3D 0; +} + +__setup("tdx_dpamt=3D", tdx_dpamt_setup); + void tdx_sys_disable(void) { struct tdx_module_args args =3D {}; --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A46624887E; Sat, 18 Jul 2026 01:45:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339130; cv=none; b=mfSwzaH/pK2FG/C72pO82+sELMeyaQQC0TwLFa+pFwJpvpD/3x/MqsEuX9SVDji+jkNZ1fHWpEcoHKuYvJOmiIyBiINfFFtbYdO4B0x7X/2YoKTVClcDfE9mwhkplgcSLGnM4fnvEOlyMt1I+KWtTBdzZO4JIYkJ2tkqTvgPUso= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339130; c=relaxed/simple; bh=7LozmiJpvCC4BDW3SOxqWy/rewZdhAty3fuN3HAe8jg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AYOyilfJCp0kqHoW/oIklP5czdwVpBX62L8A2cWJYXicXQFMp0FCVHxM8CnhcJUf6rGFaAqlZExBlPSD5z/49FNnNAN3p0O/35w5BBzx+G9Qz/sYZsirHGmnYgnLMZSalmveQMLytWlVmnYHz7hwjctIKQhTXfetaYSm+oQE2c8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=IK+OUbX6; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="IK+OUbX6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339128; x=1815875128; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7LozmiJpvCC4BDW3SOxqWy/rewZdhAty3fuN3HAe8jg=; b=IK+OUbX6QX9/uqGnaDpKsm+CoHQWoSNZPOznw9fv/KTlzZb7EG7qATSf WdJI+QWJ1qGrowOugK3T1y1lgW1FAV7SJ8gbzEBVGInIVfH5dQpdFoTUG tvMXDjY+xeK8BUlQ+77Eu7ZXARkhQAQOmAX2oYoPPi5wXjtsBFJWnr/4Q dQ3X0juzubiw6ojWXMRoVWpfXTqfl78EuQGe5XNuzhO8vSZEaI5FP4mrf jg8y2FPfMCR2VRrnVJZVgRY+pRt7UP3AhsvMKQNhXo62M1m/77JIoee1W eA5inunoOY51I7wcIs3qNWIi/rX6DUfO3O1RazuzWQtqq+Y2bHi8PZAFW Q==; X-CSE-ConnectionGUID: kDns+d7BTralqFqlGJHYTg== X-CSE-MsgGUID: Yp2lufLnR1KAynxuec09Pg== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377192" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377192" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:17 -0700 X-CSE-ConnectionGUID: oJ7mDoNyQAejCZZlNhwsXg== X-CSE-MsgGUID: cUeCrQdGT0uwmGH3MaUQcQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296290" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:10 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com, Binbin Wu Subject: [PATCH v7 10/11] Documentation/x86: Add documentation for TDX's Dynamic PAMT Date: Fri, 17 Jul 2026 18:44:59 -0700 Message-ID: <20260718014500.2231262-11-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" Expand TDX documentation to include information on the Dynamic PAMT feature. The new section explains PAMT support in the TDX module and how Dynamic PAMT affects the kernel memory use. AI was used under supervision to review the docs. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta --- v7: - Spell out PAMT acronym (Binbin) - Drop Assisted-by tag and cover AI use in log (Dave) - Add info about kernel parameter v6: - Add missing word (Binbin) - Use "::" instead of ":" - Make format of dmesg example accurate --- .../admin-guide/kernel-parameters.txt | 3 ++ Documentation/arch/x86/tdx.rst | 28 +++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index be4928489b02f..7c8627ce07eb4 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1328,6 +1328,9 @@ Kernel parameters Valid parameters: "on", "off" Default: "off" =20 + For details see: + Documentation/arch/x86/tdx.rst + reg_file_data_sampling=3D [X86] Controls mitigation for Register File Data Sampling (RFDS) vulnerability. RFDS is a CPU diff --git a/Documentation/arch/x86/tdx.rst b/Documentation/arch/x86/tdx.rst index 3303499ad4c6f..a1c2309230580 100644 --- a/Documentation/arch/x86/tdx.rst +++ b/Documentation/arch/x86/tdx.rst @@ -200,6 +200,34 @@ reflects the TCB of the currently running TDX module a= nd therefore changes after an update. By contrast, TEE_TCB_SVN reflects the TCB at TD launch time and is not affected. =20 +Dynamic PAMT +------------ + +Physical Address Metadata Table (PAMT) is memory that the TDX module needs +to keep data about each page (think like struct page). It needs to be hand= ed +to the TDX module for its exclusive use. For normal PAMT, this is installed +when the TDX module is first loaded and comes to about 0.4% of system memo= ry. + +Dynamic PAMT is a TDX module feature that allows VMM to allocate part of t= he +PAMT as needed (the parts for tracking 4KB size pages). The other page siz= es +(1GB and 2MB) are still allocated statically at the time of TDX module +initialization. This reduces the amount of memory that TDX uses while TDs = are +not in use. + +When Dynamic PAMT is in use, dmesg shows it like:: + + [..] virt/tdx: Enable Dynamic PAMT + [..] virt/tdx: 10092 KB allocated for PAMT + [..] virt/tdx: TDX-Module initialized + +Dynamic PAMT is only enabled when supported and the ``tdx_dpamt=3D`` kernel +parameter is set to "on". The feature is off by default because TDX module +internal details prevent Dynamic PAMT from working on all keyid partitioni= ng +configurations. When the TDX module is fixed to include these constraints = in +its enumeration of Dynamic PAMT support, kernel support can be changed to +default on. For more information, consult the Intel TDX documentation about +Dynamic PAMT. + TDX Interaction to Other Kernel Components ------------------------------------------ =20 --=20 2.54.0 From nobody Sat Jul 25 04:54:17 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5133242D88; Sat, 18 Jul 2026 01:45:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339132; cv=none; b=ZoZClVmAbDNGH9IvwjGazCcXTKNDarfOEhZHoOXyyu9Wj1CUa/llwxzbqxcHT6WYMFr/z45sJZtVyuOhBTtpwXwG7iKS4om5whE8oEGQp089PLzvyJF6hLtowvob4Fkt1iT710kH4G4LuXuf3F9RUW1KeAGfSO9mU1er/qgnyaY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784339132; c=relaxed/simple; bh=TWseCZ6THZmQHfEefjWVNRWJtOYBBk9BoZefAGepBbA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fpbFuSXqp/heksSNbCCdFp+M8XFAjvOY5WWs1FEdLI7AtLO905K0cL/+aCI4LSKvGEu6GPOavZtat7D+/HIxCwyDhc/E5YfpjK/ZXsDM1UehlAD++ZCgda/5Xd4RPDc2cRjXm5uYsNjuogqEX5/cKv58tP+z0tawc+g6RVDwvCk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Fn2qYcNa; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Fn2qYcNa" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784339129; x=1815875129; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=TWseCZ6THZmQHfEefjWVNRWJtOYBBk9BoZefAGepBbA=; b=Fn2qYcNascfzbTL3ZB94rpSekvgp2u1seHTmmaci5XW6jFCWMlldJ64h gmJR7O9OKc//ZobbG9DyWuMtfHUb3qhLQo8PuEa2iX7ECy4v8Ssqm0pW6 ZVP28eWwlei0le9vrajHAxIADTQDvrKfW++VFQ+Gzj4JH3RZN4Hz/J7G0 5VYPiNz1S8vdZGfDlH9XpQugcx5MW8hoH1Nz0gYAPRS0YHlNHKFAyrJaB /nXgiqKekopnwEoQSJsxd7zC5kiJy93KqFtU7i5sPoQ56HB+3K+Y+2b/T BPDLkPAimtz52GHCLZAdU45mWTwOL+w/hEsJc1O/7NLnOND4xPPQ4jC2Y w==; X-CSE-ConnectionGUID: CyP+riWxS/CxBqO7FSlkpw== X-CSE-MsgGUID: 55B422EDTWW8p/XQvINycw== X-IronPort-AV: E=McAfee;i="6800,10657,11849"; a="96377196" X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="96377196" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:17 -0700 X-CSE-ConnectionGUID: 3CawfvqsTnirYHNNuaEgFg== X-CSE-MsgGUID: ayfqzdOBSVKoEFR9Im2fNg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,170,1779174000"; d="scan'208";a="254296293" Received: from rpedgeco-desk.jf.intel.com ([10.88.27.135]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 18:45:11 -0700 From: Rick Edgecombe To: bp@alien8.de, dave.hansen@intel.com, hpa@zytor.com, kas@kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, nik.borisov@suse.com, pbonzini@redhat.com, seanjc@google.com, tglx@kernel.org, vannapurve@google.com, x86@kernel.org, chao.gao@intel.com, yan.y.zhao@intel.com, kai.huang@intel.com, tony.lindgren@linux.intel.com, binbin.wu@intel.com Cc: rick.p.edgecombe@intel.com Subject: [PATCH v7 11/11] x86/virt/tdx: Optimize tdx_pamt_get/put() Date: Fri, 17 Jul 2026 18:45:00 -0700 Message-ID: <20260718014500.2231262-12-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> References: <20260718014500.2231262-1-rick.p.edgecombe@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Kirill A. Shutemov" The Dynamic PAMT get/put helpers use a global spinlock to serialize all refcount updates and SEAMCALL invocations. This gives correct behavior for concurrent callers, but leads to contention. It is especially bad from the KVM side, which is designed to allow faulting in EPT under a shared lock. With the global spinlock, not only is the lock an exclusive one, but it is for all TDs instead of just a single one. But taking the global lock each time is actually unnecessary. Only the 0->1 and 1->0 refcount transitions actually need the lock (to pair with SEAMCALLs that actually add and remove with the Dynamic PAMT pages). The common case of incrementing or decrementing a non-zero refcount can be done locklessly. So create a fast and slow path. Check the refcount outside the lock and only take it for the slow path (0->1 and 1->0 transitions). On the put side make the refcount adjustment and lock taking atomic so if a 'get' happens between them, it doesn't cause the Dynamic PAMT to be freed incorrectly. On the get side there is no technique for doing the refcount adjustment and lock atomically, so check the refcount again inside the lock. AI was used under supervision to collect/apply feedback, review code and workshop logs. It assisted in identifying/evaluating the stale conditionals for the races resolved from the atomic_dec_and_lock() change. Separate from atomic_dec_and_lock() fallout, it suggested to change atomic_inc() to atomic_set(pamt_refcount, 1) in the put error path for the sake of being more precise, which Kiryl had also suggested in the past. The model also suggested updated comments following the atomic_dec_and_lock() change based on some directed prompting. The comments were subsequently edited or further prompted for fine tuning. Signed-off-by: Kirill A. Shutemov Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Reviewed-by: Chao Gao Reviewed-by: Tony Lindgren Acked-by: Sohil Mehta Reviewed-by: Nikolay Borisov --- v7: - Drop Assisted-by tag and cover AI use in log (Dave) - Move to end of the series - Use atomic_inc_not_zero() in this patch inside the spin_lock(), as suggested on non-optimized patch by. (Dave) v6: - Fix "tdx_pamt_add()" typo to "tdx_pamt_get()" in lost-race comment - Fix error path bug: set ret =3D -EIO and use WARN_ON_ONCE() instead of pr_err() for unexpected PAMT.ADD failures (Sean) - Use "set the refcount 0->1" wording to match atomic_set() usage - Wrap comments to 80 columns - Switch to atomic_dec_and_lock() and remove handling of races that are no longer needed as a result. Adjust comments as appropriate. (Dave) - Adjustments from dropping error helper patches --- arch/x86/virt/vmx/tdx/tdx.c | 44 ++++++++++++++++++++++++------------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c index f397ea17248e3..cb0f0ef0dd5f1 100644 --- a/arch/x86/virt/vmx/tdx/tdx.c +++ b/arch/x86/virt/vmx/tdx/tdx.c @@ -2166,28 +2166,41 @@ int tdx_pamt_get(kvm_pfn_t pfn, struct tdx_pamt_cac= he *cache) if (!tdx_supports_dynamic_pamt(&tdx_sysinfo)) return 0; =20 - ret =3D alloc_pamt_array(pamt_pages, cache); - if (ret) - return ret; - pamt_refcount =3D tdx_find_pamt_refcount(pfn); =20 - spin_lock(&pamt_lock); - /* * If the pamt page is already added (i.e. refcount >=3D 1), * then just increment the refcount. */ + if (atomic_inc_not_zero(pamt_refcount)) + return 0; + + ret =3D alloc_pamt_array(pamt_pages, cache); + if (ret) + return ret; + + spin_lock(&pamt_lock); + + /* + * Unlike tdx_pamt_put() which uses atomic_dec_and_lock() to + * atomically handle the 1->0 transition, the get side has no + * equivalent combined primitive for 0->1. Recheck under the + * lock since another get may have already done the 0->1 + * transition after both saw atomic_inc_not_zero() fail. + */ if (atomic_inc_not_zero(pamt_refcount)) goto out_free; =20 - /* Try to add the pamt page and take the refcount 0->1. */ tdx_status =3D tdh_phymem_pamt_add(pfn, pamt_pages); if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) { ret =3D -EIO; goto out_free; } =20 + /* + * The refcount is zero, and this locked path is the + * only way to increase it from 0->1. + */ atomic_set(pamt_refcount, 1); spin_unlock(&pamt_lock); return 0; @@ -2212,17 +2225,13 @@ void tdx_pamt_put(kvm_pfn_t pfn) =20 pamt_refcount =3D tdx_find_pamt_refcount(pfn); =20 - spin_lock(&pamt_lock); /* * If there is more than 1 reference on the pamt page, don't * remove it yet. Just decrement the refcount. */ - if (atomic_read(pamt_refcount) > 1) { - atomic_dec(pamt_refcount); - goto out_unlock; - } + if (!atomic_dec_and_lock(pamt_refcount, &pamt_lock)) + return; =20 - /* Try to remove the pamt page and take the refcount 1->0. */ tdx_status =3D tdh_phymem_pamt_remove(pfn, pamt_pages); =20 /* @@ -2232,10 +2241,15 @@ void tdx_pamt_put(kvm_pfn_t pfn) * failure indicates a kernel bug, memory is being leaked, and * the dangling PAMT entry may cause future operations to fail. */ - if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) + if (WARN_ON_ONCE(tdx_status !=3D TDX_SUCCESS)) { + /* + * atomic_dec_and_lock() already decremented it to 0, + * but the PAMT entry still exists since REMOVE failed. + */ + atomic_set(pamt_refcount, 1); goto out_unlock; + } =20 - atomic_set(pamt_refcount, 0); spin_unlock(&pamt_lock); free_pamt_array(pamt_pages); return; --=20 2.54.0