KVM: x86/mmu: Move event re-injection unprotect+retry into common path

Move the event re-injection unprotect+retry logic into
kvm_mmu_write_protect_fault(), i.e. unprotect and retry if and only if
the #PF actually hit a write-protected gfn.  Note, there is a small
possibility that the gfn was unprotected by a different tasking between
hitting the #PF and acquiring mmu_lock, but in that case, KVM will resume
the guest immediately anyways because KVM will treat the fault as spurious.

As a bonus, unprotecting _after_ handling the page fault also addresses the
case where the installing a SPTE to handle fault encounters a shadowed PTE,
i.e. *creates* a read-only SPTE.

Opportunstically add a comment explaining what on earth the intent of the
code is, as based on the changelog from commit 577bdc496614 ("KVM: Avoid
instruction emulation when event delivery is pending").

Link: https://lore.kernel.org/r/20240831001538.336683-15-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 937fa9a82a4393960a854505b4388ae3512b65d0..195ba7430720bf3d2795cd0157bfee4cb9d8b253 100644 (file)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2743,23 +2743,6 @@ bool kvm_mmu_unprotect_gfn_and_retry(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa)
        return r;
 }
 
-static int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
-{
-       gpa_t gpa;
-       int r;
-
-       if (vcpu->arch.mmu->root_role.direct)
-               return 0;
-
-       gpa = kvm_mmu_gva_to_gpa_write(vcpu, gva, NULL);
-       if (gpa == INVALID_GPA)
-               return 0;
-
-       r = kvm_mmu_unprotect_page(vcpu->kvm, gpa >> PAGE_SHIFT);
-
-       return r;
-}
-
 static void kvm_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)
 {
        trace_kvm_mmu_unsync_page(sp);
@@ -4630,8 +4613,6 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
        if (!flags) {
                trace_kvm_page_fault(vcpu, fault_address, error_code);
 
-               if (kvm_event_needs_reinjection(vcpu))
-                       kvm_mmu_unprotect_page_virt(vcpu, fault_address);
                r = kvm_mmu_page_fault(vcpu, fault_address, error_code, insn,
                                insn_len);
        } else if (flags & KVM_PV_REASON_PAGE_NOT_PRESENT) {
@@ -6037,8 +6018,15 @@ static int kvm_mmu_write_protect_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
         * Note, this code also applies to Intel CPUs, even though it is *very*
         * unlikely that an L1 will share its page tables (IA32/PAE/paging64
         * format) with L2's page tables (EPT format).
-        */
-       if (direct && is_write_to_guest_page_table(error_code) &&
+        *
+        * For indirect MMUs, i.e. if KVM is shadowing the current MMU, try to
+        * unprotect the gfn and retry if an event is awaiting reinjection.  If
+        * KVM emulates multiple instructions before completing event injection,
+        * the event could be delayed beyond what is architecturally allowed,
+        * e.g. KVM could inject an IRQ after the TPR has been raised.
+        */
+       if (((direct && is_write_to_guest_page_table(error_code)) ||
+            (!direct && kvm_event_needs_reinjection(vcpu))) &&
            kvm_mmu_unprotect_gfn_and_retry(vcpu, cr2_or_gpa))
                return RET_PF_RETRY;