KVM: x86: Initialize allow_smaller_maxphyaddr earlier in setup

Initialize allow_smaller_maxphyaddr during hardware setup as soon as KVM
knows whether or not TDP will be utilized.  To avoid having to teach KVM's
emulator all about CET, KVM's upcoming CET virtualization support will be
mutually exclusive with allow_smaller_maxphyaddr, i.e. will disable SHSTK
and IBT if allow_smaller_maxphyaddr is enabled.

In general, allow_smaller_maxphyaddr should be initialized as soon as
possible since it's globally visible while its only input is whether or
not EPT/NPT is enabled.  I.e. there's effectively zero risk of setting
allow_smaller_maxphyaddr too early, and substantial risk of setting it
too late.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250922184743.1745778-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index d092102fe1cbf3b3bf9bd4bf5d4a5c662731d9c4..d20e5917b0fe666e33fe013180a07a7ce09f2b75 100644 (file)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5370,6 +5370,21 @@ static __init int svm_hardware_setup(void)
                          get_npt_level(), PG_LEVEL_1G);
        pr_info("Nested Paging %s\n", str_enabled_disabled(npt_enabled));
 
+       /*
+        * It seems that on AMD processors PTE's accessed bit is
+        * being set by the CPU hardware before the NPF vmexit.
+        * This is not expected behaviour and our tests fail because
+        * of it.
+        * A workaround here is to disable support for
+        * GUEST_MAXPHYADDR < HOST_MAXPHYADDR if NPT is enabled.
+        * In this case userspace can know if there is support using
+        * KVM_CAP_SMALLER_MAXPHYADDR extension and decide how to handle
+        * it
+        * If future AMD CPU models change the behaviour described above,
+        * this variable can be changed accordingly
+        */
+       allow_smaller_maxphyaddr = !npt_enabled;
+
        /* Setup shadow_me_value and shadow_me_mask */
        kvm_mmu_set_me_spte_mask(sme_me_mask, sme_me_mask);
 
@@ -5449,21 +5464,6 @@ static __init int svm_hardware_setup(void)
 
        svm_set_cpu_caps();
 
-       /*
-        * It seems that on AMD processors PTE's accessed bit is
-        * being set by the CPU hardware before the NPF vmexit.
-        * This is not expected behaviour and our tests fail because
-        * of it.
-        * A workaround here is to disable support for
-        * GUEST_MAXPHYADDR < HOST_MAXPHYADDR if NPT is enabled.
-        * In this case userspace can know if there is support using
-        * KVM_CAP_SMALLER_MAXPHYADDR extension and decide how to handle
-        * it
-        * If future AMD CPU models change the behaviour described above,
-        * this variable can be changed accordingly
-        */
-       allow_smaller_maxphyaddr = !npt_enabled;
-
        kvm_caps.inapplicable_quirks &= ~KVM_X86_QUIRK_CD_NW_CLEARED;
        return 0;
 

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 4ab066a3c22f6e9e50ba35f22c2f165eddf25d9e..4d775983506e84dfb2a65ad572cf0fbed8bcd01d 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8436,6 +8436,14 @@ __init int vmx_hardware_setup(void)
                return -EOPNOTSUPP;
        }
 
+       /*
+        * Shadow paging doesn't have a (further) performance penalty
+        * from GUEST_MAXPHYADDR < HOST_MAXPHYADDR so enable it
+        * by default
+        */
+       if (!enable_ept)
+               allow_smaller_maxphyaddr = true;
+
        if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
                enable_ept_ad_bits = 0;
 
@@ -8665,14 +8673,6 @@ int __init vmx_init(void)
 
        vmx_check_vmcs12_offsets();
 
-       /*
-        * Shadow paging doesn't have a (further) performance penalty
-        * from GUEST_MAXPHYADDR < HOST_MAXPHYADDR so enable it
-        * by default
-        */
-       if (!enable_ept)
-               allow_smaller_maxphyaddr = true;
-
        return 0;
 
 err_l1d_flush: