KVM: x86/mmu: Drop exec/NX check from "page fault can be fast"

Tweak the "page fault can be fast" logic to explicitly check for !PRESENT
faults in the access tracking case, and drop the exec/NX check that
becomes redundant as a result.  No sane hardware will generate an access
that is both an instruct fetch and a write, i.e. it's a waste of cycles.
If hardware goes off the rails, or KVM runs under a misguided hypervisor,
spuriously running throught fast path is benign (KVM has been uknowingly
being doing exactly that for years).

Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20220423034752.1161007-6-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index f36e3cdde25d9a2c7e32c5ce63d1430ca94b58ea..add486220dae077c6d29c6129c1289084e279509 100644 (file)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -3044,16 +3044,14 @@ static bool handle_abnormal_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fa
 static bool page_fault_can_be_fast(struct kvm_page_fault *fault)
 {
        /*
-        * Do not fix the mmio spte with invalid generation number which
-        * need to be updated by slow page fault path.
+        * Page faults with reserved bits set, i.e. faults on MMIO SPTEs, only
+        * reach the common page fault handler if the SPTE has an invalid MMIO
+        * generation number.  Refreshing the MMIO generation needs to go down
+        * the slow path.  Note, EPT Misconfigs do NOT set the PRESENT flag!
         */
        if (fault->rsvd)
                return false;
 
-       /* See if the page fault is due to an NX violation */
-       if (unlikely(fault->exec && fault->present))
-               return false;
-
        /*
         * #PF can be fast if:
         *
@@ -3069,7 +3067,14 @@ static bool page_fault_can_be_fast(struct kvm_page_fault *fault)
         *    SPTE is MMU-writable (determined later), the fault can be fixed
         *    by setting the Writable bit, which can be done out of mmu_lock.
         */
-       return !kvm_ad_enabled() || (fault->write && fault->present);
+       if (!fault->present)
+               return !kvm_ad_enabled();
+
+       /*
+        * Note, instruction fetches and writes are mutually exclusive, ignore
+        * the "exec" flag.
+        */
+       return fault->write;
 }
 
 /*