Re: [PATCH v3 1/3] KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 9/3/2026 7:09 AM, Sean Christopherson wrote:
> When checking to see if KVM needs to allocate a TDP PAE root that's 32-bit
> addressable, query KVM's overall max TDP level, not the vCPU-specific TDP
> level, as the logic is specific to using NPT on 32-bit hosts.  Querying the
> vCPU's alleged TDP level is flawed and confusing, as KVM selects between
> 4-level vs. 5-level based on the guest's MAXPHYADDR, and MAXPHYADDR isn't
> yet configured (via CPUID) when the vCPU is being created.
> 
> I.e. as is, it would *appear* that KVM is violating its own rules with
> respect to changing guest CPUID (see kvm_mmu_after_set_cpuid()).  In
> practice, the flaw is benign as the goal is purely to see if KVM needs to
> use PAE-paging; whether KVM will use 4-level vs. 5-level is irrelevant.
> 
> More importantly, avoiding kvm_mmu_get_tdp_level() during vCPU creation
> will allow hardening KVM's handling of S-EPT mirror root level.
> 
> For all intents and purposes, no functional change intended.
> 
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>

> ---
>  arch/x86/kvm/mmu/mmu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 064ecc33b926..c9a684151420 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -6834,7 +6834,7 @@ static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, struct k
>  	 * other exception is for shadowing L1's 32-bit or PAE NPT on 64-bit
>  	 * KVM; that horror is handled on-demand by mmu_alloc_special_roots().
>  	 */
> -	if (tdp_enabled && kvm_mmu_get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)
> +	if (tdp_enabled && kvm_mmu_get_max_tdp_level() > PT32E_ROOT_LEVEL)
>  		return 0;
>  
>  	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_DMA32);