tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y

Now that FRED provides C-code entry points for handling IRQs, use the
FRED infrastructure for forwarding IRQs even if FRED is fully
disabled, e.g. isn't supported in hardware. Avoiding the non-FRED
assembly trampolines into the IDT handlers for IRQs eliminates the
associated non-CFI indirect call (KVM performs a CALL by doing a
lookup on the IDT using the IRQ vector).

Keep NMIs on the legacy IDT path, as the FRED NMI entry code relies on
FRED's architectural behavior with respect to NMI blocking, i.e. doesn't
jump through the myriad hoops needed to deal with IRET "unexpectedly"
unmasking NMIs. KVM's NMI path already makes a direct CALL to C-code,
i.e. isn't problematic for CFI. KVM does make a short detour through
assembly code to build the stack frame, but the "FRED entry from KVM"
path does the same.

Force FRED for 64-bit kernels if KVM_INTEL is enabled, as the benefits of
eliminating the IRQ trampoline usage far outwieghts the code overhead for
FRED.

Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250714103441.381946911@infradead.org

authored by

Sean Christopherson and committed by
Peter Zijlstra 28d11e45 deed19b9

+8 -1
+1
arch/x86/kvm/Kconfig
··· 97 97 depends on KVM && IA32_FEAT_CTL 98 98 select KVM_GENERIC_PRIVATE_MEM if INTEL_TDX_HOST 99 99 select KVM_GENERIC_MEMORY_ATTRIBUTES if INTEL_TDX_HOST 100 + select X86_FRED if X86_64 100 101 help 101 102 Provides support for KVM on processors equipped with Intel's VT 102 103 extensions, a.k.a. Virtual Machine Extensions (VMX).
+7 -1
arch/x86/kvm/vmx/vmx.c
··· 6913 6913 "unexpected VM-Exit interrupt info: 0x%x", intr_info)) 6914 6914 return; 6915 6915 6916 + /* 6917 + * Invoke the kernel's IRQ handler for the vector. Use the FRED path 6918 + * when it's available even if FRED isn't fully enabled, e.g. even if 6919 + * FRED isn't supported in hardware, in order to avoid the indirect 6920 + * CALL in the non-FRED path. 6921 + */ 6916 6922 kvm_before_interrupt(vcpu, KVM_HANDLING_IRQ); 6917 - if (cpu_feature_enabled(X86_FEATURE_FRED)) 6923 + if (IS_ENABLED(CONFIG_X86_FRED)) 6918 6924 fred_entry_from_kvm(EVENT_TYPE_EXTINT, vector); 6919 6925 else 6920 6926 vmx_do_interrupt_irqoff(gate_offset((gate_desc *)host_idt_base + vector));