Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 5 Apr 2023 07:36:44 -0700
In-Reply-To: <a1ed2308-b521-14c0-a118-19c1afffd1d6@grsecurity.net>
Mime-Version: 1.0
References: <20230405002608.418442-1-seanjc@google.com> <a1ed2308-b521-14c0-a118-19c1afffd1d6@grsecurity.net>
Message-ID: <ZC2HfNLa7sLewJtl@google.com>
Subject: Re: [PATCH] KVM: x86/mmu: Refresh CR0.WP prior to checking for
 emulated permission faults
From:   Sean Christopherson <seanjc@google.com>
To:     Mathias Krause <minipli@grsecurity.net>
Cc:     Paolo Bonzini <pbonzini@redhat.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, Apr 05, 2023, Mathias Krause wrote:
> On 05.04.23 02:26, Sean Christopherson wrote:
> > +void __kvm_mmu_refresh_passthrough_bits(struct kvm_vcpu *vcpu,
> > +					struct kvm_mmu *mmu)
> > +{
> > +	const bool cr0_wp =3D kvm_is_cr0_bit_set(vcpu, X86_CR0_WP);
> > +
> > +	BUILD_BUG_ON((KVM_MMU_CR0_ROLE_BITS & KVM_POSSIBLE_CR0_GUEST_BITS) !=
=3D X86_CR0_WP);
>=20
> > +	BUILD_BUG_ON((KVM_MMU_CR4_ROLE_BITS & KVM_POSSIBLE_CR4_GUEST_BITS));
>=20
> Just curious, this should assert that we don't run into similar issues
> if we make more bits of CR4 guest owned?

Yes?  I'm not sure what you're asking.  BUILD_BUG_ON() is a just more flexi=
ble
version of stiatic_assert(); it only requires that the inputs be compile-ti=
me
constants, not purely "static".

he above throws an error at compile-time if there is new overlap between th=
e
CR{0,4} MMU role bits and the possible guest-owned bits.  E.g. adding SMEP =
to the
possible guest-owned CR4 bits yields:

arch/x86/kvm/mmu/mmu.c: In function =E2=80=98__kvm_mmu_refresh_passthrough_=
bits=E2=80=99:
include/linux/compiler_types.h:397:45: error: call to =E2=80=98__compiletim=
e_assert_1564=E2=80=99
 declared with attribute error: BUILD_BUG_ON failed: (KVM_MMU_CR4_ROLE_BITS=
 & KVM_POSSIBLE_CR4_GUEST_BITS)
  397 |         _compiletime_assert(condition, msg, __compiletime_assert_, =
__COUNTER__)
      |                                             ^
include/linux/compiler_types.h:378:25: note: in definition of macro =E2=80=
=98__compiletime_assert=E2=80=99
  378 |                         prefix ## suffix();                        =
     \
      |                         ^~~~~~
include/linux/compiler_types.h:397:9: note: in expansion of macro =E2=80=98=
_compiletime_assert=E2=80=99
  397 |         _compiletime_assert(condition, msg, __compiletime_assert_, =
__COUNTER__)
      |         ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro =E2=80=98compi=
letime_assert=E2=80=99
   39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg=
)
      |                                     ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:9: note: in expansion of macro =E2=80=98BUILD_=
BUG_ON_MSG=E2=80=99
   50 |         BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condit=
ion)
      |         ^~~~~~~~~~~~~~~~
arch/x86/kvm/mmu/mmu.c:5191:9: note: in expansion of macro =E2=80=98BUILD_B=
UG_ON=E2=80=99
 5191 |         BUILD_BUG_ON((KVM_MMU_CR4_ROLE_BITS & KVM_POSSIBLE_CR4_GUES=
T_BITS));
      |         ^~~~~~~~~~~~
scripts/Makefile.build:252: arch/x86/kvm/mmu/mmu.o] Error 1