[PATCH v3 1/3] KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root

[Sean Christopherson <seanjc@google.com>]

When checking to see if KVM needs to allocate a TDP PAE root that's 32-bit
addressable, query KVM's overall max TDP level, not the vCPU-specific TDP
level, as the logic is specific to using NPT on 32-bit hosts.  Querying the
vCPU's alleged TDP level is flawed and confusing, as KVM selects between
4-level vs. 5-level based on the guest's MAXPHYADDR, and MAXPHYADDR isn't
yet configured (via CPUID) when the vCPU is being created.

I.e. as is, it would *appear* that KVM is violating its own rules with
respect to changing guest CPUID (see kvm_mmu_after_set_cpuid()).  In
practice, the flaw is benign as the goal is purely to see if KVM needs to
use PAE-paging; whether KVM will use 4-level vs. 5-level is irrelevant.

More importantly, avoiding kvm_mmu_get_tdp_level() during vCPU creation
will allow hardening KVM's handling of S-EPT mirror root level.

For all intents and purposes, no functional change intended.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/mmu/mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 064ecc33b926..c9a684151420 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -6834,7 +6834,7 @@ static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, struct k
 	 * other exception is for shadowing L1's 32-bit or PAE NPT on 64-bit
 	 * KVM; that horror is handled on-demand by mmu_alloc_special_roots().
 	 */
-	if (tdp_enabled && kvm_mmu_get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)
+	if (tdp_enabled && kvm_mmu_get_max_tdp_level() > PT32E_ROOT_LEVEL)
 		return 0;
 
 	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_DMA32);
-- 
2.55.0.970.g62bdec98f9-goog