Re: [PATCH 1/2] x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core

[Paolo Bonzini <pbonzini@redhat.com>]

On 4/28/26 11:43, Binbin Wu wrote:
> 
> 
> On 4/23/2026 11:56 PM, Peter Zijlstra wrote:
>> Move the VMX interrupt dispatch magic into the x86 core code. This
>> isolates KVM from the FRED/IDT decisions and reduces the amount of
>> EXPORT_SYMBOL_FOR_KVM().
>>
>> Suggested-by: Sean Christopherson <seanjc@google.com>
>> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
>> Tested-by: "Verma, Vishal L" <vishal.l.verma@intel.com>
>> ---
>>   arch/x86/entry/Makefile             |    2 -
>>   arch/x86/entry/common.c             |   48 ++++++++++++++++++++++++++++++++++++
>>   arch/x86/entry/entry.S              |   46 ++++++++++++++++++++++++++++++++++
>>   arch/x86/entry/entry_64_fred.S      |    1
>>   arch/x86/include/asm/desc.h         |    4 +++
>>   arch/x86/include/asm/desc_defs.h    |    2 -
>>   arch/x86/include/asm/entry-common.h |    2 +
>>   arch/x86/include/asm/fred.h         |    1
>>   arch/x86/include/asm/idtentry.h     |   11 --------
>>   arch/x86/kernel/idt.c               |   13 +++++++++
>>   arch/x86/kernel/nmi.c               |    8 ------
>>   arch/x86/kvm/vmx/vmenter.S          |   46 ----------------------------------
>>   arch/x86/kvm/vmx/vmx.c              |   20 ++-------------
>>   13 files changed, 118 insertions(+), 86 deletions(-)
>>
>> --- a/arch/x86/entry/Makefile
>> +++ b/arch/x86/entry/Makefile
>> @@ -13,7 +13,7 @@ CFLAGS_REMOVE_syscall_64.o	= $(CC_FLAGS_
>>   CFLAGS_syscall_32.o		+= -fno-stack-protector
>>   CFLAGS_syscall_64.o		+= -fno-stack-protector
>>   
>> -obj-y				:= entry.o entry_$(BITS).o syscall_$(BITS).o
>> +obj-y				:= entry.o entry_$(BITS).o syscall_$(BITS).o common.o
>>   
>>   obj-y				+= vdso/
>>   obj-y				+= vsyscall/
>> --- /dev/null
>> +++ b/arch/x86/entry/common.c
>> @@ -0,0 +1,48 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +
>> +#include <linux/entry-common.h>
>> +#include <linux/kvm_types.h>
>> +#include <asm/fred.h>
>> +#include <asm/desc.h>
>> +
>> +#if IS_ENABLED(CONFIG_KVM_INTEL)
>> +/*
>> + * On VMX, NMIs and IRQs (as configured by KVM) are acknowledge by hardware as
> 
> s/acknowledge/acknowledged
>   
>> + * part of the VM-Exit, i.e. the event itself is consumed as part the VM-Exit.
>> + * x86_entry_from_kvm() is invoked by KVM to effectively forward NMIs and IRQs
>> + * to the kernel for servicing.  On SVM, a.k.a. AMD, the NMI/IRQ VM-Exit is
>> + * purely a signal that an NMI/IRQ is pending, i.e. the event that triggered
>> + * the VM-Exit is held pending until it's unblocked in the host.
>> + */
> 
> [...]
> 
>> -
>> -#if IS_ENABLED(CONFIG_KVM_INTEL)
>> -/*
>> - * Special entry point for VMX which invokes this on the kernel stack, even for
>> - * 64-bit, i.e. without using an IST.  asm_exc_nmi() requires an IST to work
> 
> Although it's being removed, I guess what it says is still true?
> 
> It says asm_exc_nmi() requires an IST to work correctly, and the new path for
> handling NMI when FRED is disabled.
> 
> idt_entry_from_kvm
>      idt_do_nmi_irqoff
>          IDT_DO_EVENT_IRQOFF call asm_exc_nmi
>              ...
>              call asm_exc_nmi
> 
> It seems the stack before calling asm_exc_nmi is not an IST?
> Does it matter?

I think it does, the IST is needed because of all the stuff to detect 
recursive NMIs.  So asm_exc_nmi_kvm_vmx needs to remain.

By the way, here:

> +	/*
> +	 * Notably, we must use IDT dispatch for NMI when running in IDT mode.
> +	 * The FRED NMI context is significantly different and will not work
> +	 * right (speficially FRED fixed the NMI recursion issue).
> +	 */

It's even more important to note that NMIs need an IRET in order to 
unblock further NMIs.  This is even more important than the recursion 
issue, which does not affect KVM's non-IST entry into the NMI handler, 
and is the real reason to use IDT_DO_EVENT_IRQOFF to build the interrupt 
stack frame for NMIs.

Paolo