x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y

Now that FRED provides C-code entry points for handling IRQs, use the
FRED infrastructure for forwarding IRQs even if FRED is fully
disabled, e.g. isn't supported in hardware. Avoiding the non-FRED
assembly trampolines into the IDT handlers for IRQs eliminates the
associated non-CFI indirect call (KVM performs a CALL by doing a
lookup on the IDT using the IRQ vector).

Keep NMIs on the legacy IDT path, as the FRED NMI entry code relies on
FRED's architectural behavior with respect to NMI blocking, i.e. doesn't
jump through the myriad hoops needed to deal with IRET "unexpectedly"
unmasking NMIs.  KVM's NMI path already makes a direct CALL to C-code,
i.e. isn't problematic for CFI.  KVM does make a short detour through
assembly code to build the stack frame, but the "FRED entry from KVM"
path does the same.

Force FRED for 64-bit kernels if KVM_INTEL is enabled, as the benefits of
eliminating the IRQ trampoline usage far outwieghts the code overhead for
FRED.

Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250714103441.381946911@infradead.org

diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 2c86673155c9a097a6af3d313a9f7d1429d8102f..b92ef117f355c9a0c21665cecbad255c9322c274 100644 (file)
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -97,6 +97,7 @@ config KVM_INTEL
        depends on KVM && IA32_FEAT_CTL
        select KVM_GENERIC_PRIVATE_MEM if INTEL_TDX_HOST
        select KVM_GENERIC_MEMORY_ATTRIBUTES if INTEL_TDX_HOST
+       select X86_FRED if X86_64
        help
          Provides support for KVM on processors equipped with Intel's VT
          extensions, a.k.a. Virtual Machine Extensions (VMX).

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index aa157fe5b7b31802aa71351db92c8d1b68111432..f7f6c04a41d66e8709fc248434f6203f0282ce23 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6913,8 +6913,14 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu,
            "unexpected VM-Exit interrupt info: 0x%x", intr_info))
                return;
 
+       /*
+        * Invoke the kernel's IRQ handler for the vector.  Use the FRED path
+        * when it's available even if FRED isn't fully enabled, e.g. even if
+        * FRED isn't supported in hardware, in order to avoid the indirect
+        * CALL in the non-FRED path.
+        */
        kvm_before_interrupt(vcpu, KVM_HANDLING_IRQ);
-       if (cpu_feature_enabled(X86_FEATURE_FRED))
+       if (IS_ENABLED(CONFIG_X86_FRED))
                fred_entry_from_kvm(EVENT_TYPE_EXTINT, vector);
        else
                vmx_do_interrupt_irqoff(gate_offset((gate_desc *)host_idt_base + vector));