Re: [PATCH 5.15.y v3 4/7] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes

[Sasha Levin]

> +	WARN_ON_ONCE(quadrant && role.gpte_is_8_bytes);
> +	WARN_ON_ONCE(role.direct && !role.gpte_is_8_bytes);

The second WARN is guest triggerable on 5.15 on any host running with ept=0 or
npt=0. For a non-paging guest kvm_calc_shadow_mmu_root_page_role() yields
direct=1 while kvm_calc_shadow_root_page_role_common() leaves gpte_is_8_bytes
at 0, so mmu_alloc_root() hits it on an ordinary guest entry. Under
panic_on_warn that is a host DoS.

It has the same root as the 3/7 comment: 5.15 spells the field gpte_is_8_bytes
rather than has_4_byte_gpte, so the upstream logic inverts when it is carried
over as-is. Keeping "if (role.direct) role.gpte_is_8_bytes = true;" in
mmu_alloc_root() and kvm_mmu_child_role() covers both, or backport the upstream
role-computation change first.

Patches 1, 2, 5, 6 and 7 look good. Could you respin as v4 with those two
addressed?

-- 
Thanks,
Sasha