To avoid confusion, here's the full new design:
1.when an EPT violation carries an ACCEPT level info
(This occurs when TD performs ACCEPT before it accesses memory),
KVM maps the page at map level <= the specified level.
Guest's ACCEPT will succeed or return PAGE_SIZE_MATCH if map level < the
specified level.
2.when an EPT violation does not carry ACCEPT level info
(This occurs when TD accesses memory before invoking ACCEPT),
1) if the TD is configured to always accept VMM's map level,
KVM allows to map at 2MB.
TD's later 4KB ACCEPT will return PAGE_SIZE_MATCH.
TD can either retry with 2MB ACCEPT or explictly invoke a TDVMCALL for
demotion.
2) if the TD is not configured to always accept VMM's map level,
KVM always maps at 4KB.
TD's 2MB ACCEPT will return PAGE_SIZE_MATCH.
Please let me know if anything does not look right.