KVM: nVMX: Hardcode dummy EPTP used for early nested consistency checks

Hardcode the dummy EPTP used for "early" consistency checks as there's no
need to use 5-level EPT based on the guest.MAXPHYADDR (the EPTP just needs
to be valid, it's never truly consumed).

This will allow breaking construct_eptp()'s dependency on having access to
the vCPU, which in turn will (much further in the future) allow for eliding
per-root TLB flushes when a vCPU is migrated between pCPUs (a flush is
need if and only if that particular pCPU hasn't already flushed the vCPU's
roots).

Link: https://lore.kernel.org/r/20250919005955.1366256-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 3fca63a261f5ef44b2950f6cb39eb8c1ba50a6a6..0a4b4e790f9f07f3aa455fc1450b862a0303792c 100644 (file)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2297,13 +2297,11 @@ static void prepare_vmcs02_constant_state(struct vcpu_vmx *vmx)
        vmx->nested.vmcs02_initialized = true;
 
        /*
-        * We don't care what the EPTP value is we just need to guarantee
-        * it's valid so we don't get a false positive when doing early
-        * consistency checks.
+        * If early consistency checks are enabled, stuff the EPT Pointer with
+        * a dummy *legal* value to avoid false positives on bad control state.
         */
        if (enable_ept && nested_early_check)
-               vmcs_write64(EPT_POINTER,
-                            construct_eptp(&vmx->vcpu, 0, PT64_ROOT_4LEVEL));
+               vmcs_write64(EPT_POINTER, VMX_EPTP_MT_WB | VMX_EPTP_PWL_4);
 
        if (vmx->ve_info)
                vmcs_write64(VE_INFORMATION_ADDRESS, __pa(vmx->ve_info));

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 98506c7232913f206422bdbc042f43be29de264f..6a1377015a2a6de9624b92bdfc245913902a087a 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -3219,7 +3219,7 @@ static inline int vmx_get_current_vpid(struct kvm_vcpu *vcpu)
        return to_vmx(vcpu)->vpid;
 }
 
-u64 construct_eptp(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level)
+static u64 construct_eptp(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level)
 {
        u64 eptp = VMX_EPTP_MT_WB;
 

diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index ea93121029f913fdb8b64505f4807745b41b36ca..6cb04a6afeefbab6edb2a3de5fc0d9ca18a3a1fb 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -369,7 +369,6 @@ void set_cr4_guest_host_mask(struct vcpu_vmx *vmx);
 void ept_save_pdptrs(struct kvm_vcpu *vcpu);
 void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
 void __vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
-u64 construct_eptp(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level);
 
 bool vmx_guest_inject_ac(struct kvm_vcpu *vcpu);
 void vmx_update_exception_bitmap(struct kvm_vcpu *vcpu);