KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root

When checking to see if KVM needs to allocate a TDP PAE root that's 32-bit
addressable, query KVM's overall max TDP level, not the vCPU-specific TDP
level, as the logic is specific to using NPT on 32-bit hosts.  Querying the
vCPU's alleged TDP level is flawed and confusing, as KVM selects between
4-level vs. 5-level based on the guest's MAXPHYADDR, and MAXPHYADDR isn't
yet configured (via CPUID) when the vCPU is being created.

I.e. as is, it would *appear* that KVM is violating its own rules with
respect to changing guest CPUID (see kvm_mmu_after_set_cpuid()).  In
practice, the flaw is benign as the goal is purely to see if KVM needs to
use PAE-paging; whether KVM will use 4-level vs. 5-level is irrelevant.

More importantly, avoiding kvm_mmu_get_tdp_level() during vCPU creation
will allow hardening KVM's handling of S-EPT mirror root level.

For all intents and purposes, no functional change intended.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260902230932.2760127-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions