[xen stable-4.20] x86/vmx: Fix VMEntry failure on ADL/SPR with shadow guests

[patchbot@xxxxxxx]

commit ed3bf0a89bd0f80e23bb68e9587ae8d88c6e4672
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Jun 26 08:35:42 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Jun 26 08:35:42 2025 +0200

    x86/vmx: Fix VMEntry failure on ADL/SPR with shadow guests
    
    Paging Writeable depends on EPT so must be disabled in non-EPT guests like 
the
    other EPT dependent features.  Otherwise, VMEntry fails with bad control
    state.
    
    Drop a piece of trailing whitepsace in context.
    
    Fixes: ff10aa9d8f90 ("x86: Add Support for Paging-Write Feature")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    master commit: d779e3f98c2a765aae57f6ab4b0257413c12ac97
    master date: 2025-05-27 12:21:38 +0100
---
 xen/arch/x86/hvm/vmx/vmcs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
index 8c0ea789c1..f9538063da 100644
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1150,9 +1150,11 @@ static int construct_vmcs(struct vcpu *v)
     else
     {
         v->arch.hvm.vmx.secondary_exec_control &=
-            ~(SECONDARY_EXEC_ENABLE_EPT | 
+            ~(SECONDARY_EXEC_ENABLE_EPT |
               SECONDARY_EXEC_UNRESTRICTED_GUEST |
               SECONDARY_EXEC_ENABLE_INVPCID);
+        v->arch.hvm.vmx.tertiary_exec_control &=
+            ~(TERTIARY_EXEC_EPT_PAGING_WRITE);
         vmexit_ctl &= ~(VM_EXIT_SAVE_GUEST_PAT |
                         VM_EXIT_LOAD_HOST_PAT);
         vmentry_ctl &= ~VM_ENTRY_LOAD_GUEST_PAT;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20