linux-uek5-v4.14.35-2047.502.4.1.patch

From a3f59d0d518ccd5ad54f37c5bed642aa6052f2ab Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang0129@gmail.com>
Date: Mon, 26 Jul 2021 09:19:41 -0700
Subject: [PATCH 1/1] linux uek5 v4.14.35-2047.502.4.1

Signed-off-by: Dongli Zhang <dongli.zhang0129@gmail.com>
---
 arch/x86/include/asm/apic.h           |  19 +
 arch/x86/include/asm/kvm_host.h       |  69 ++
 arch/x86/include/asm/pvclock-abi.h    |  14 +
 arch/x86/include/asm/x2apic.h         |   7 +
 arch/x86/include/uapi/asm/kvm_para.h  |  11 +
 arch/x86/kernel/apic/apic.c           | 111 ++++
 arch/x86/kernel/apic/probe_64.c       |  22 +
 arch/x86/kernel/apic/x2apic_cluster.c |  19 +
 arch/x86/kernel/apic/x2apic_phys.c    |  40 ++
 arch/x86/kernel/kvm.c                 |  36 +
 arch/x86/kvm/debugfs.c                |  15 +
 arch/x86/kvm/ioapic.c                 |  32 +
 arch/x86/kvm/irq.c                    |  32 +
 arch/x86/kvm/irq_comm.c               |  62 ++
 arch/x86/kvm/kvm_cache_regs.h         |   5 +
 arch/x86/kvm/lapic.c                  | 474 ++++++++++++++
 arch/x86/kvm/lapic.h                  |  87 +++
 arch/x86/kvm/mmu.c                    |   8 +
 arch/x86/kvm/pmu.c                    |  62 ++
 arch/x86/kvm/vmx/capabilities.h       |  85 +++
 arch/x86/kvm/vmx/ops.h                |   8 +
 arch/x86/kvm/vmx/pmu_intel.c          |  12 +
 arch/x86/kvm/vmx/vmcs.h               |  22 +
 arch/x86/kvm/vmx/vmx.c                | 901 ++++++++++++++++++++++++++
 arch/x86/kvm/vmx/vmx.h                |  40 ++
 arch/x86/kvm/x86.c                    | 297 +++++++++
 arch/x86/kvm/x86.h                    |   5 +
 drivers/net/virtio_net.c              | 318 +++++++++
 drivers/vhost/net.c                   |  86 +++
 drivers/vhost/vhost.c                 | 276 ++++++++
 drivers/vhost/vhost.h                 |  43 ++
 drivers/virtio/virtio_ring.c          | 316 +++++++++
 include/linux/hrtimer.h               |  38 ++
 include/linux/kvm_host.h              |  27 +-
 include/uapi/linux/kvm.h              |   9 +
 include/uapi/linux/kvm_para.h         |   6 +
 include/uapi/linux/vhost.h            |  25 +
 include/uapi/linux/virtio_ring.h      |  82 +++
 kernel/events/core.c                  |  10 +
 kernel/sched/core.c                   |  18 +
 kernel/sched/cputime.c                |   9 +
 kernel/sched/sched.h                  |   5 +
 kernel/sched/stats.h                  |   8 +
 kernel/smp.c                          |   4 +
 kernel/time/clockevents.c             |  29 +
 kernel/time/hrtimer.c                 |  50 ++
 kernel/time/tick-oneshot.c            |  13 +
 kernel/time/tick-sched.c              |   4 +
 virt/kvm/async_pf.c                   |  26 +
 virt/kvm/coalesced_mmio.c             |  23 +
 virt/kvm/eventfd.c                    |  25 +
 virt/kvm/irqchip.c                    |  43 ++
 virt/kvm/kvm_main.c                   | 346 ++++++++++
 virt/kvm/vfio.c                       |  19 +
 54 files changed, 4352 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 97d686b821b5..f4fa1da4b794 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -280,6 +280,25 @@ struct apic {
 	int (*apic_id_registered)(void);
 
 	u32 irq_delivery_mode;
+	/*
+	 * 在以下使用apic->irq_dest_mode:
+	 *   - arch/x86/kernel/apic/apic_flat_64.c|155| <<global>> .irq_dest_mode = 1,
+	 *   - arch/x86/kernel/apic/apic_flat_64.c|250| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/apic_noop.c|122| <<global>> .irq_dest_mode = 1,
+	 *   - arch/x86/kernel/apic/apic_numachip.c|250| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/apic_numachip.c|301| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/bigsmp_32.c|136| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/probe_32.c|85| <<global>> .irq_dest_mode = 1,
+	 *   - arch/x86/kernel/apic/x2apic_cluster.c|243| <<global>> .irq_dest_mode = 1,
+	 *   - arch/x86/kernel/apic/x2apic_phys.c|133| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/x2apic_uv_x.c|725| <<global>> .irq_dest_mode = 0,
+	 *   - arch/x86/kernel/apic/io_apic.c|2906| <<mp_setup_entry>> entry->dest_mode = apic->irq_dest_mode;
+	 *   - arch/x86/kernel/apic/msi.c|38| <<__irq_msi_compose_msg>> ((apic->irq_dest_mode == 0) ?
+	 *   - arch/x86/platform/uv/uv_irq.c|39| <<uv_program_mmr>> entry->dest_mode = apic->irq_dest_mode;
+	 *   - drivers/iommu/amd_iommu.c|4125| <<irq_remapping_prepare_irte>> apic->irq_dest_mode, irq_cfg->vector,
+	 *   - drivers/iommu/amd_iommu.c|4377| <<amd_ir_set_vcpu_affinity>> irte->lo.fields_remap.dm = apic->irq_dest_mode;
+	 *   - drivers/iommu/intel_irq_remapping.c|1067| <<prepare_irte>> irte->dst_mode = apic->irq_dest_mode;
+	 */
 	u32 irq_dest_mode;
 
 	const struct cpumask *(*target_cpus)(void);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 826fbad70c56..9bc52b12f2d9 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -556,7 +556,27 @@ struct kvm_vcpu_arch {
 	bool apicv_active;
 	bool load_eoi_exitmap_pending;
 	DECLARE_BITMAP(ioapic_handled_vectors, 256);
+	/*
+	 * 在以下使用kvm_vcpu_arch->apic_attention:
+	 *   - arch/x86/kvm/lapic.c|742| <<pv_eoi_set_pending>> __set_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
+	 *   - arch/x86/kvm/lapic.c|752| <<pv_eoi_clr_pending>> __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
+	 *   - arch/x86/kvm/lapic.c|2538| <<kvm_lapic_reset>> vcpu->arch.apic_attention = 0;
+	 *   - arch/x86/kvm/lapic.c|2886| <<kvm_lapic_sync_from_vapic>> if (test_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention))
+	 *   - arch/x86/kvm/lapic.c|2889| <<kvm_lapic_sync_from_vapic>> if (!test_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention))
+	 *   - arch/x86/kvm/lapic.c|2933| <<kvm_lapic_sync_to_vapic>> if (!test_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention))
+	 *   - arch/x86/kvm/lapic.c|2956| <<kvm_lapic_set_vapic_addr>> __set_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention);
+	 *   - arch/x86/kvm/lapic.c|2958| <<kvm_lapic_set_vapic_addr>> __clear_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention);
+	 *   - arch/x86/kvm/x86.c|8053| <<vcpu_enter_guest>> if (vcpu->arch.apic_attention)
+	 *   - arch/x86/kvm/x86.c|8062| <<vcpu_enter_guest>> if (unlikely(vcpu->arch.apic_attention))
+	 */
 	unsigned long apic_attention;
+	/*
+	 * 在以下使用kvm_vcpu_arch->apic_arb_prio:
+	 *   - arch/x86/kvm/lapic.c|1088| <<__apic_accept_irq>> vcpu->arch.apic_arb_prio++;
+	 *   - arch/x86/kvm/lapic.c|1187| <<kvm_apic_compare_prio>> return vcpu1->arch.apic_arb_prio - vcpu2->arch.apic_arb_prio;
+	 *   - arch/x86/kvm/lapic.c|2480| <<kvm_lapic_reset>> vcpu->arch.apic_arb_prio = 0;
+	 *   - arch/x86/kvm/lapic.c|2771| <<kvm_apic_set_state>> vcpu->arch.apic_arb_prio = 0;
+	 */
 	int32_t apic_arb_prio;
 	int mp_state;
 	u64 ia32_misc_enable_msr;
@@ -683,8 +703,28 @@ struct kvm_vcpu_arch {
 	u32 virtual_tsc_mult;
 	u32 virtual_tsc_khz;
 	s64 ia32_tsc_adjust_msr;
+	/*
+	 * 在以下使用kvm_vcpu_arch->tsc_scaling_ratio:
+	 *   - arch/x86/kvm/debugfs.c|37| <<vcpu_get_tsc_scaling_ratio>> *val = vcpu->arch.tsc_scaling_ratio;
+	 *   - arch/x86/kvm/svm.c|2304| <<svm_vcpu_load>> u64 tsc_ratio = vcpu->arch.tsc_scaling_ratio;
+	 *   - arch/x86/kvm/vmx/vmx.c|1297| <<vmx_vcpu_load>> vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
+	 *   - arch/x86/kvm/vmx/vmx.c|7421| <<vmx_set_hv_timer>> if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
+	 *   - arch/x86/kvm/vmx/vmx.c|7424| <<vmx_set_hv_timer>> vcpu->arch.tsc_scaling_ratio,
+	 *   - arch/x86/kvm/vmx/vmx.h|541| <<decache_tsc_multiplier>> vmx->current_tsc_ratio = vmx->vcpu.arch.tsc_scaling_ratio;
+	 *   - arch/x86/kvm/x86.c|1593| <<set_tsc_khz>> vcpu->arch.tsc_scaling_ratio = kvm_default_tsc_scaling_ratio;
+	 *   - arch/x86/kvm/x86.c|1619| <<set_tsc_khz>> vcpu->arch.tsc_scaling_ratio = ratio;
+	 *   - arch/x86/kvm/x86.c|1631| <<kvm_set_tsc_khz>> vcpu->arch.tsc_scaling_ratio = kvm_default_tsc_scaling_ratio;
+	 *   - arch/x86/kvm/x86.c|1722| <<kvm_scale_tsc>> u64 ratio = vcpu->arch.tsc_scaling_ratio;
+	 *   - arch/x86/kvm/x86.c|1884| <<adjust_tsc_offset_host>> if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio)
+	 */
 	u64 tsc_scaling_ratio;
 
+	/*
+	 * 在以下使用kvm_vcpu_arch->nmi_queued:
+	 *   - arch/x86/kvm/x86.c|615| <<kvm_inject_nmi>> atomic_inc(&vcpu->arch.nmi_queued);
+	 *   - arch/x86/kvm/x86.c|7403| <<process_nmi>> vcpu->arch.nmi_pending += atomic_xchg(&vcpu->arch.nmi_queued, 0);
+	 *   - arch/x86/kvm/x86.c|8916| <<kvm_vcpu_reset>> atomic_set(&vcpu->arch.nmi_queued, 0);
+	 */
 	atomic_t nmi_queued;  /* unprocessed asynchronous NMIs */
 	unsigned nmi_pending; /* NMI queued after currently running handler */
 	bool nmi_injected;    /* Trying to inject an NMI this entry */
@@ -727,6 +767,14 @@ struct kvm_vcpu_arch {
 	unsigned long last_retry_addr;
 
 	struct {
+		/*
+		 * 在以下使用kvm_vcpu_arch->apf.halted:
+		 *   - arch/x86/kvm/x86.c|7781| <<vcpu_enter_guest>> vcpu->arch.apf.halted = true;
+		 *   - arch/x86/kvm/x86.c|8056| <<vcpu_block>> vcpu->arch.apf.halted = false;
+		 *   - arch/x86/kvm/x86.c|8073| <<kvm_vcpu_running>> !vcpu->arch.apf.halted);
+		 *   - arch/x86/kvm/x86.c|8925| <<kvm_vcpu_reset>> vcpu->arch.apf.halted = false;
+		 *   - arch/x86/kvm/x86.c|9890| <<kvm_arch_async_page_present>> vcpu->arch.apf.halted = false;
+		 */
 		bool halted;
 		gfn_t gfns[roundup_pow_of_two(ASYNC_PF_PER_VCPU)];
 		struct gfn_to_hva_cache data;
@@ -875,8 +923,24 @@ struct kvm_arch {
 
 	gpa_t wall_clock;
 
+	/*
+	 * 在以下使用kvm_arch->mwait_in_guest:
+	 *   - arch/x86/kvm/x86.c|4662| <<kvm_vm_ioctl_enable_cap(KVM_CAP_X86_DISABLE_EXITS)>> kvm->arch.mwait_in_guest = true;
+	 *   - arch/x86/kvm/x86.h|330| <<kvm_mwait_in_guest>> return kvm->arch.mwait_in_guest;
+	 */
 	bool mwait_in_guest;
+	/*
+	 * 在以下使用hlt_in_guest:
+	 *   - arch/x86/kvm/x86.c|4664| <<kvm_vm_ioctl_enable_cap>> kvm->arch.hlt_in_guest = true;
+	 *   - arch/x86/kvm/x86.h|340| <<kvm_hlt_in_guest>> return kvm->arch.hlt_in_guest;
+	 */
 	bool hlt_in_guest;
+	/*
+	 * 在以下使用kvm_arch->pause_in_guest:
+	 *   - arch/x86/kvm/vmx/vmx.c|6874| <<vmx_vm_init>> kvm->arch.pause_in_guest = true;
+	 *   - arch/x86/kvm/x86.c|4666| <<kvm_vm_ioctl_enable_cap>> kvm->arch.pause_in_guest = true;
+	 *   - arch/x86/kvm/x86.h|340| <<kvm_pause_in_guest>> return kvm->arch.pause_in_guest;
+	 */
 	bool pause_in_guest;
 
 	unsigned long irq_sources_bitmap;
@@ -1366,6 +1430,11 @@ int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
 bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
 bool kvm_require_dr(struct kvm_vcpu *vcpu, int dr);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/i8259.c|193| <<kvm_pic_set_irq>> irq_level = __kvm_irq_line_state(&s->irq_states[irq],
+ *   - arch/x86/kvm/ioapic.c|395| <<kvm_ioapic_set_irq>> irq_level = __kvm_irq_line_state(&ioapic->irq_states[irq],
+ */
 static inline int __kvm_irq_line_state(unsigned long *irq_state,
 				       int irq_source_id, int level)
 {
diff --git a/arch/x86/include/asm/pvclock-abi.h b/arch/x86/include/asm/pvclock-abi.h
index 1436226efe3e..03cd41bd4cb2 100644
--- a/arch/x86/include/asm/pvclock-abi.h
+++ b/arch/x86/include/asm/pvclock-abi.h
@@ -40,6 +40,20 @@ struct pvclock_wall_clock {
 	u32   nsec;
 } __attribute__((__packed__));
 
+/*
+ * 在以下使用PVCLOCK_TSC_STABLE_BIT:
+ *   - arch/x86/entry/vdso/vclock_gettime.c|135| <<vread_pvclock>> if (unlikely(!(pvti->flags & PVCLOCK_TSC_STABLE_BIT))) {
+ *   - arch/x86/kernel/kvmclock.c|289| <<kvm_setup_vsyscall_timeinfo>> if (!(flags & PVCLOCK_TSC_STABLE_BIT))
+ *   - arch/x86/kernel/kvmclock.c|351| <<kvmclock_init>> pvclock_set_flags(PVCLOCK_TSC_STABLE_BIT);
+ *   - arch/x86/kernel/kvmclock.c|354| <<kvmclock_init>> kvm_sched_clock_init(flags & PVCLOCK_TSC_STABLE_BIT);
+ *   - arch/x86/kernel/pvclock.c|96| <<pvclock_clocksource_read>> if ((valid_flags & PVCLOCK_TSC_STABLE_BIT) &&
+ *   - arch/x86/kernel/pvclock.c|97| <<pvclock_clocksource_read>> (flags & PVCLOCK_TSC_STABLE_BIT))
+ *   - arch/x86/kvm/hyperv.c|913| <<compute_tsc_page_parameters>> if (!(hv_clock->flags & PVCLOCK_TSC_STABLE_BIT))
+ *   - arch/x86/kvm/x86.c|2351| <<kvm_guest_time_update>> pvclock_flags |= PVCLOCK_TSC_STABLE_BIT;
+ *   - arch/x86/xen/time.c|456| <<xen_setup_vsyscall_time_info>> if (!(ti->pvti.flags & PVCLOCK_TSC_STABLE_BIT)) {
+ *   - arch/x86/xen/time.c|504| <<xen_time_init>> if (pvti->flags & PVCLOCK_TSC_STABLE_BIT) {
+ *   - arch/x86/xen/time.c|505| <<xen_time_init>> pvclock_set_flags(PVCLOCK_TSC_STABLE_BIT);
+ */
 #define PVCLOCK_TSC_STABLE_BIT	(1 << 0)
 #define PVCLOCK_GUEST_STOPPED	(1 << 1)
 /* PVCLOCK_COUNTS_FROM_ZERO broke ABI and can't be used anymore. */
diff --git a/arch/x86/include/asm/x2apic.h b/arch/x86/include/asm/x2apic.h
index 78ccf28d17db..320d5e53d11a 100644
--- a/arch/x86/include/asm/x2apic.h
+++ b/arch/x86/include/asm/x2apic.h
@@ -20,6 +20,13 @@ static int x2apic_apic_id_registered(void)
 	return 1;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|33| <<x2apic_send_IPI>> __x2apic_send_IPI_dest(dest, vector, APIC_DEST_LOGICAL);
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|76| <<__x2apic_send_IPI_mask>> __x2apic_send_IPI_dest(dest, vector, apic->dest_logical);
+ *   - arch/x86/kernel/apic/x2apic_phys.c|45| <<x2apic_send_IPI>> __x2apic_send_IPI_dest(dest, vector, APIC_DEST_PHYSICAL);
+ *   - arch/x86/kernel/apic/x2apic_phys.c|63| <<__x2apic_send_IPI_mask>> __x2apic_send_IPI_dest(per_cpu(x86_cpu_to_apicid, query_cpu),
+ */
 static void
 __x2apic_send_IPI_dest(unsigned int apicid, int vector, unsigned int dest)
 {
diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h
index 21d5f0240595..aef2f287d653 100644
--- a/arch/x86/include/uapi/asm/kvm_para.h
+++ b/arch/x86/include/uapi/asm/kvm_para.h
@@ -59,7 +59,18 @@ struct kvm_steal_time {
 	__u32 pad[11];
 };
 
+/*
+ * 在以下使用KVM_VCPU_PREEMPTED:
+ *   - arch/x86/kernel/kvm.c|621| <<kvm_flush_tlb_others>> if ((state & KVM_VCPU_PREEMPTED)) {
+ *   - arch/x86/kernel/kvm.c|819| <<__kvm_vcpu_is_preempted>> return !!(src->preempted & KVM_VCPU_PREEMPTED);
+ *   - arch/x86/kvm/x86.c|3345| <<kvm_steal_time_set_preempted>> st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
+ */
 #define KVM_VCPU_PREEMPTED          (1 << 0)
+/*
+ * 在以下使用KVM_VCPU_FLUSH_TLB:
+ *   - arch/x86/kernel/kvm.c|623| <<kvm_flush_tlb_others>> state | KVM_VCPU_FLUSH_TLB))
+ *   - arch/x86/kvm/x86.c|2457| <<record_steal_time>> if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
+ */
 #define KVM_VCPU_FLUSH_TLB          (1 << 1)
 
 #define KVM_CLOCK_PAIRING_WALLCLOCK 0
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index ee33f0951322..218c4609de72 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -59,6 +59,18 @@
 #include <asm/intel-family.h>
 #include <asm/irq_regs.h>
 
+/*
+ * https://tcbbd.moe/ref-and-spec/intel-sdm/sdm-basic-ch10/
+ *
+ * 通过LINT0和LINT1这两个引脚接收的本地中断
+ * 通过IOAPIC接收的外部中断，以及通过MSI方式收到的外部中断
+ * 其他CPU(甚至自己)发来的IPI
+ * APIC Timer产生的中断
+ * Performance Monitoring Counter产生的中断
+ * 温度传感器产生的中断
+ * APIC内部错误引发的中断
+ */
+
 unsigned int num_processors;
 
 unsigned disabled_cpus;
@@ -90,6 +102,15 @@ static unsigned int disabled_cpu_apicid __read_mostly = BAD_APICID;
  * This variable controls which CPUs receive external NMIs.  By default,
  * external NMIs are delivered only to the BSP.
  */
+/*
+ * 在以下使用apic_extnmi:
+ *   - arch/x86/kernel/apic/apic.c|1319| <<init_bsp_APIC>> if (apic_extnmi == APIC_EXTNMI_NONE)
+ *   - arch/x86/kernel/apic/apic.c|1560| <<setup_local_APIC>> if ((!cpu && apic_extnmi != APIC_EXTNMI_NONE) ||
+ *   - arch/x86/kernel/apic/apic.c|1561| <<setup_local_APIC>> apic_extnmi == APIC_EXTNMI_ALL)
+ *   - arch/x86/kernel/apic/apic.c|2795| <<apic_set_extnmi>> apic_extnmi = APIC_EXTNMI_ALL;
+ *   - arch/x86/kernel/apic/apic.c|2797| <<apic_set_extnmi>> apic_extnmi = APIC_EXTNMI_NONE;
+ *   - arch/x86/kernel/apic/apic.c|2799| <<apic_set_extnmi>> apic_extnmi = APIC_EXTNMI_BSP;
+ */
 static int apic_extnmi = APIC_EXTNMI_BSP;
 
 /*
@@ -328,6 +349,11 @@ int lapic_get_maxlvt(void)
  * We do reads before writes even if unnecessary, to get around the
  * P5 APIC double write bug.
  */
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|524| <<lapic_timer_set_periodic_oneshot>> __setup_APIC_LVTT(lapic_timer_frequency, oneshot, 1);
+ *   - arch/x86/kernel/apic/apic.c|874| <<calibrate_APIC_clock>> __setup_APIC_LVTT(0xffffffff, 0, 0);
+ */
 static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
 {
 	unsigned int lvtt_value, tmp_value;
@@ -468,6 +494,24 @@ static int lapic_next_event(unsigned long delta,
 	return 0;
 }
 
+/*
+ * 一个例子
+ * lapic_next_deadline
+ * tick_program_event
+ * hrtimer_interrupt
+ * smp_apic_timer_interrupt
+ * apic_timer_interrupt
+ * cpuidle_enter_state
+ * cpuidle_enter
+ * call_cpuidle
+ * do_idle
+ * cpu_startup_entry
+ * start_secondary
+ * secondary_startup_64
+ *
+ * 在以下使用lapic_next_deadline():
+ *   - arch/x86/kernel/apic/apic.c|685| <<setup_APIC_timer>> levt->set_next_event = lapic_next_deadline;
+ */
 static int lapic_next_deadline(unsigned long delta,
 			       struct clock_event_device *evt)
 {
@@ -493,6 +537,11 @@ static int lapic_timer_shutdown(struct clock_event_device *evt)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|553| <<lapic_timer_set_periodic>> return lapic_timer_set_periodic_oneshot(evt, false);
+ *   - arch/x86/kernel/apic/apic.c|558| <<lapic_timer_set_oneshot>> return lapic_timer_set_periodic_oneshot(evt, true);
+ */
 static inline int
 lapic_timer_set_periodic_oneshot(struct clock_event_device *evt, bool oneshot)
 {
@@ -644,6 +693,13 @@ static __init bool apic_validate_deadline_timer(void)
  * Setup the local APIC timer for this CPU. Copy the initialized values
  * of the boot CPU and register the clock event in the framework.
  */
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|1035| <<setup_boot_APIC_clock>> setup_APIC_timer();
+ *   - arch/x86/kernel/apic/apic.c|1043| <<setup_boot_APIC_clock>> setup_APIC_timer();
+ *   - arch/x86/kernel/apic/apic.c|1055| <<setup_boot_APIC_clock>> setup_APIC_timer();
+ *   - arch/x86/kernel/apic/apic.c|1061| <<setup_secondary_APIC_clock>> setup_APIC_timer();
+ */
 static void setup_APIC_timer(void)
 {
 	struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
@@ -654,9 +710,31 @@ static void setup_APIC_timer(void)
 		lapic_clockevent.rating = 150;
 	}
 
+	/*
+	 * 580 static struct clock_event_device lapic_clockevent = {
+	 * 581         .name                           = "lapic",
+	 * 582         .features                       = CLOCK_EVT_FEAT_PERIODIC |
+	 * 583                                           CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_C3STOP
+	 * 584                                           | CLOCK_EVT_FEAT_DUMMY,
+	 * 585         .shift                          = 32,
+	 * 586         .set_state_shutdown             = lapic_timer_shutdown,
+	 * 587         .set_state_periodic             = lapic_timer_set_periodic,
+	 * 588         .set_state_oneshot              = lapic_timer_set_oneshot,
+	 * 589         .set_state_oneshot_stopped      = lapic_timer_shutdown,
+	 * 590         .set_next_event                 = lapic_next_event,
+	 * 591         .broadcast                      = lapic_timer_broadcast,
+	 * 592         .rating                         = 100,
+	 * 593         .irq                            = -1,
+	 * 594 };
+	 * 595 static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
+	 */
 	memcpy(levt, &lapic_clockevent, sizeof(*levt));
 	levt->cpumask = cpumask_of(smp_processor_id());
 
+	/*
+	 * # cat /sys/devices/system/clockevents/clockevent0/current_device 
+	 * lapic-deadline
+	 */
 	if (this_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER)) {
 		levt->name = "lapic-deadline";
 		levt->features &= ~(CLOCK_EVT_FEAT_PERIODIC |
@@ -1072,6 +1150,9 @@ static void local_apic_timer_interrupt(void)
 	 */
 	inc_irq_stat(apic_timer_irqs);
 
+	/*
+	 * hrtimer_interrupt()
+	 */
 	evt->event_handler(evt);
 }
 
@@ -1418,6 +1499,11 @@ static void apic_pending_intr_clear(void)
  * Used to setup local APIC while initializing BSP or bringing up APs.
  * Always called with preemption disabled.
  */
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|1598| <<apic_ap_setup>> setup_local_APIC();
+ *   - arch/x86/kernel/apic/apic.c|2413| <<apic_bsp_setup>> setup_local_APIC();
+ */
 void setup_local_APIC(void)
 {
 	int cpu = smp_processor_id();
@@ -1434,6 +1520,10 @@ void setup_local_APIC(void)
 	 * SPIV. Soft disable it before doing further initialization.
 	 */
 	value = apic_read(APIC_SPIV);
+	/*
+	 * Allows software to temporarily enable or disable the local APIC.
+	 * 第8位控制
+	 */
 	value &= ~APIC_SPIV_APIC_ENABLED;
 	apic_write(APIC_SPIV, value);
 
@@ -1698,6 +1788,10 @@ static __init void x2apic_enable(void)
 	__x2apic_enable();
 }
 
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|1802| <<enable_IR_x2apic>> try_to_enable_x2apic(ir_stat);
+ */
 static __init void try_to_enable_x2apic(int remap_mode)
 {
 	if (x2apic_state == X2APIC_DISABLED)
@@ -1749,6 +1843,10 @@ static inline void try_to_enable_x2apic(int remap_mode) { }
 static inline void __x2apic_enable(void) { }
 #endif /* !CONFIG_X86_X2APIC */
 
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/probe_64.c|32| <<default_setup_apic_routing>> enable_IR_x2apic();
+ */
 void __init enable_IR_x2apic(void)
 {
 	unsigned long flags;
@@ -2430,6 +2528,11 @@ int __init apic_bsp_setup(bool upmode)
  * This initializes the IO-APIC and APIC hardware if this is
  * a UP kernel.
  */
+/*
+ * called by:
+ *   - arch/x86/kernel/apic/apic.c|2471| <<up_late_init>> APIC_init_uniprocessor();
+ *   - arch/x86/kernel/smpboot.c|1338| <<native_smp_prepare_cpus>> if (APIC_init_uniprocessor())
+ */
 int __init APIC_init_uniprocessor(void)
 {
 	if (disable_apic) {
@@ -2791,6 +2894,14 @@ static int __init apic_set_extnmi(char *arg)
 	if (!arg)
 		return -EINVAL;
 
+	/*
+	 * bsp:  External NMI is delivered only to CPU 0
+	 * all:  External NMIs are broadcast to all CPUs as a
+	 *       backup of CPU 0
+	 * none: External NMI is masked for all CPUs. This is
+	 *       useful so that a dump capture kernel won't be
+	 *       shot down by NMI
+	 */
 	if (!strncmp("all", arg, 3))
 		apic_extnmi = APIC_EXTNMI_ALL;
 	else if (!strncmp("none", arg, 4))
diff --git a/arch/x86/kernel/apic/probe_64.c b/arch/x86/kernel/apic/probe_64.c
index c303054b90b5..111ff55e70fc 100644
--- a/arch/x86/kernel/apic/probe_64.c
+++ b/arch/x86/kernel/apic/probe_64.c
@@ -25,12 +25,30 @@
 /*
  * Check the APIC IDs in bios_cpu_apicid and choose the APIC mode.
  */
+/*
+ * called by:
+ *   - arch/x86/kernel/smpboot.c|1358| <<native_smp_prepare_cpus>> default_setup_apic_routing();
+ */
 void __init default_setup_apic_routing(void)
 {
 	struct apic **drv;
 
 	enable_IR_x2apic();
 
+	/*
+	 * 在以下使用apic_driver():
+	 *   - arch/x86/kernel/apic/apic_numachip.c|291| <<global>> apic_driver(apic_numachip1);
+	 *   - arch/x86/kernel/apic/apic_numachip.c|342| <<global>> apic_driver(apic_numachip2);
+	 *   - arch/x86/kernel/apic/bigsmp_32.c|198| <<global>> apic_driver(apic_bigsmp);
+	 *   - arch/x86/kernel/apic/probe_32.c|127| <<global>> apic_driver(apic_default);
+	 *   - arch/x86/kernel/apic/x2apic_cluster.c|283| <<global>> apic_driver(apic_x2apic_cluster);
+	 *   - arch/x86/kernel/apic/x2apic_phys.c|173| <<global>> apic_driver(apic_x2apic_phys);
+	 *   - arch/x86/kernel/apic/x2apic_uv_x.c|1759| <<global>> apic_driver(apic_x2apic_uv_x);
+	 *   - arch/x86/xen/apic.c|228| <<global>> apic_driver(xen_pv_apic);
+	 *
+	 * [    0.045605] x2apic enabled
+	 * [    0.046007] Switched APIC routing to physical x2apic.
+	 */
 	for (drv = __apicdrivers; drv < __apicdrivers_end; drv++) {
 		if ((*drv)->probe && (*drv)->probe()) {
 			if (apic != *drv) {
@@ -53,6 +71,10 @@ void apic_send_IPI_self(int vector)
 	__default_send_IPI_shortcut(APIC_DEST_SELF, vector, APIC_DEST_PHYSICAL);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kernel/acpi/boot.c|159| <<acpi_parse_madt>> default_acpi_madt_oem_check(madt->header.oem_id,
+ */
 int __init default_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
 	struct apic **drv;
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index ec6a004b0f55..08d42d292084 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -12,7 +12,26 @@
 #include <asm/x2apic.h>
 
 static DEFINE_PER_CPU(u32, x86_cpu_to_logical_apicid);
+/*
+ * 在以下使用cpus_in_cluster:
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|64| <<__x2apic_send_IPI_mask>> cpus_in_cluster_ptr = per_cpu(cpus_in_cluster, cpu);
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|143| <<init_x2apic_ldr>> cpumask_set_cpu(this_cpu, per_cpu(cpus_in_cluster, this_cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|147| <<init_x2apic_ldr>> cpumask_set_cpu(this_cpu, per_cpu(cpus_in_cluster, cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|148| <<init_x2apic_ldr>> cpumask_set_cpu(cpu, per_cpu(cpus_in_cluster, this_cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|157| <<x2apic_prepare_cpu>> if (!zalloc_cpumask_var(&per_cpu(cpus_in_cluster, cpu), GFP_KERNEL))
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|161| <<x2apic_prepare_cpu>> free_cpumask_var(per_cpu(cpus_in_cluster, cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|175| <<x2apic_dead_cpu>> cpumask_clear_cpu(this_cpu, per_cpu(cpus_in_cluster, cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|176| <<x2apic_dead_cpu>> cpumask_clear_cpu(cpu, per_cpu(cpus_in_cluster, this_cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|178| <<x2apic_dead_cpu>> free_cpumask_var(per_cpu(cpus_in_cluster, this_cpu));
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|197| <<x2apic_cluster_probe>> cpumask_set_cpu(cpu, per_cpu(cpus_in_cluster, cpu));
+ */
 static DEFINE_PER_CPU(cpumask_var_t, cpus_in_cluster);
+/*
+ * 在以下使用ipi_mask:
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|55| <<__x2apic_send_IPI_mask>> ipi_mask_ptr = this_cpu_cpumask_var_ptr(ipi_mask);
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|160| <<x2apic_prepare_cpu>> if (!zalloc_cpumask_var(&per_cpu(ipi_mask, cpu), GFP_KERNEL)) {
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|179| <<x2apic_dead_cpu>> free_cpumask_var(per_cpu(ipi_mask, this_cpu));
+ */
 static DEFINE_PER_CPU(cpumask_var_t, ipi_mask);
 
 static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index b94d35320f85..18a575f62240 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -9,6 +9,14 @@
 #include <asm/smp.h>
 #include <asm/x2apic.h>
 
+/*
+ * 在以下使用x2apic_phys:
+ *   - arch/x86/kernel/apic/apic.c|1739| <<try_to_enable_x2apic>> x2apic_phys = 1;
+ *   - arch/x86/kernel/apic/x2apic_phys.c|18| <<set_x2apic_phys_mode>> x2apic_phys = 1;
+ *   - arch/x86/kernel/apic/x2apic_phys.c|37| <<x2apic_acpi_madt_oem_check>> return x2apic_enabled() && (x2apic_phys || x2apic_fadt_phys());
+ *   - arch/x86/kernel/apic/x2apic_phys.c|96| <<x2apic_phys_probe>> if (x2apic_mode && (x2apic_phys || x2apic_fadt_phys()))
+ *   - arch/x86/kernel/cpu/mshyperv.c|340| <<ms_hyperv_init_platform>> x2apic_phys = 1;
+ */
 int x2apic_phys;
 
 static struct apic apic_x2apic_phys;
@@ -82,6 +90,13 @@ static void x2apic_send_IPI_allbutself(int vector)
 	__x2apic_send_IPI_mask(cpu_online_mask, vector, APIC_DEST_ALLBUT);
 }
 
+/*
+ * kvm会修改为以下:
+ * apic->send_IPI_mask = kvm_send_ipi_mask;
+ * apic->send_IPI_mask_allbutself = kvm_send_ipi_mask_allbutself;
+ * apic->send_IPI_allbutself = kvm_send_ipi_allbutself;
+ * apic->send_IPI_all = kvm_send_ipi_all;
+ */
 static void x2apic_send_IPI_all(int vector)
 {
 	__x2apic_send_IPI_mask(cpu_online_mask, vector, APIC_DEST_ALLINC);
@@ -99,6 +114,31 @@ static int x2apic_phys_probe(void)
 	return apic == &apic_x2apic_phys;
 }
 
+/*
+ * 在以下使用apic->irq_dest_mode:
+ *   - arch/x86/kernel/apic/apic_flat_64.c|155| <<global>> .irq_dest_mode = 1,
+ *   - arch/x86/kernel/apic/apic_flat_64.c|250| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/apic_noop.c|122| <<global>> .irq_dest_mode = 1,
+ *   - arch/x86/kernel/apic/apic_numachip.c|250| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/apic_numachip.c|301| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/bigsmp_32.c|136| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/probe_32.c|85| <<global>> .irq_dest_mode = 1,
+ *   - arch/x86/kernel/apic/x2apic_cluster.c|243| <<global>> .irq_dest_mode = 1,
+ *   - arch/x86/kernel/apic/x2apic_phys.c|133| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/x2apic_uv_x.c|725| <<global>> .irq_dest_mode = 0,
+ *   - arch/x86/kernel/apic/io_apic.c|2906| <<mp_setup_entry>> entry->dest_mode = apic->irq_dest_mode;
+ *   - arch/x86/kernel/apic/msi.c|38| <<__irq_msi_compose_msg>> ((apic->irq_dest_mode == 0) ?
+ *   - arch/x86/platform/uv/uv_irq.c|39| <<uv_program_mmr>> entry->dest_mode = apic->irq_dest_mode;
+ *   - drivers/iommu/amd_iommu.c|4125| <<irq_remapping_prepare_irte>> apic->irq_dest_mode, irq_cfg->vector,
+ *   - drivers/iommu/amd_iommu.c|4377| <<amd_ir_set_vcpu_affinity>> irte->lo.fields_remap.dm = apic->irq_dest_mode;
+ *   - drivers/iommu/intel_irq_remapping.c|1067| <<prepare_irte>> irte->dst_mode = apic->irq_dest_mode;
+ *
+ * kvm会修改为以下:
+ * apic->send_IPI_mask = kvm_send_ipi_mask;
+ * apic->send_IPI_mask_allbutself = kvm_send_ipi_mask_allbutself;
+ * apic->send_IPI_allbutself = kvm_send_ipi_allbutself;
+ * apic->send_IPI_all = kvm_send_ipi_all;
+ */
 static struct apic apic_x2apic_phys __ro_after_init = {
 
 	.name				= "physical x2apic",
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index d41230f9c67f..7d6c7f6fb3b2 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -449,6 +449,12 @@ static void __init sev_map_percpu_data(void)
 #ifdef CONFIG_SMP
 #define KVM_IPI_CLUSTER_SIZE	(2 * BITS_PER_LONG)
 
+/*
+ * called by:
+ *   - arch/x86/kernel/kvm.c|505| <<kvm_send_ipi_mask>> __send_ipi_mask(mask, vector);
+ *   - arch/x86/kernel/kvm.c|517| <<kvm_send_ipi_mask_allbutself>> __send_ipi_mask(local_mask, vector);
+ *   - arch/x86/kernel/kvm.c|527| <<kvm_send_ipi_all>> __send_ipi_mask(cpu_online_mask, vector);
+ */
 static void __send_ipi_mask(const struct cpumask *mask, int vector)
 {
 	unsigned long flags;
@@ -590,16 +596,33 @@ static void __init kvm_apf_trap_init(void)
 	update_intr_gate(X86_TRAP_PF, async_page_fault);
 }
 
+/*
+ * 在以下使用__pv_tlb_mask:
+ *   - arch/x86/kernel/kvm.c|611| <<kvm_flush_tlb_others>> struct cpumask *flushmask = this_cpu_cpumask_var_ptr(__pv_tlb_mask);
+ *   - arch/x86/kernel/kvm.c|764| <<kvm_setup_pv_tlb_flush>> zalloc_cpumask_var_node(per_cpu_ptr(&__pv_tlb_mask, cpu),
+ */
 static DEFINE_PER_CPU(cpumask_var_t, __pv_tlb_mask);
 
+/*
+ * 在以下使用kvm_flush_tlb_others():
+ *   - arch/x86/kernel/kvm.c|643| <<kvm_guest_init>> pv_mmu_ops.flush_tlb_others = kvm_flush_tlb_others;
+ */
 static void kvm_flush_tlb_others(const struct cpumask *cpumask,
 			const struct flush_tlb_info *info)
 {
 	u8 state;
 	int cpu;
 	struct kvm_steal_time *src;
+	/*
+	 * 在以下使用__pv_tlb_mask:
+	 *   - arch/x86/kernel/kvm.c|611| <<kvm_flush_tlb_others>> struct cpumask *flushmask = this_cpu_cpumask_var_ptr(__pv_tlb_mask);
+	 *   - arch/x86/kernel/kvm.c|764| <<kvm_setup_pv_tlb_flush>> zalloc_cpumask_var_node(per_cpu_ptr(&__pv_tlb_mask, cpu),
+	 */
 	struct cpumask *flushmask = this_cpu_cpumask_var_ptr(__pv_tlb_mask);
 
+	/*
+	 * 从cpumask copy到 flushmask
+	 */
 	cpumask_copy(flushmask, cpumask);
 	/*
 	 * We have to call flush only on online vCPUs. And
@@ -608,6 +631,19 @@ static void kvm_flush_tlb_others(const struct cpumask *cpumask,
 	for_each_cpu(cpu, flushmask) {
 		src = &per_cpu(steal_time, cpu);
 		state = READ_ONCE(src->preempted);
+		/*
+		 * 在以下使用KVM_VCPU_PREEMPTED:
+		 *   - arch/x86/kernel/kvm.c|621| <<kvm_flush_tlb_others>> if ((state & KVM_VCPU_PREEMPTED)) {
+		 *   - arch/x86/kernel/kvm.c|819| <<__kvm_vcpu_is_preempted>> return !!(src->preempted & KVM_VCPU_PREEMPTED);
+		 *   - arch/x86/kvm/x86.c|3345| <<kvm_steal_time_set_preempted>> st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
+		 *
+		 * 在以下使用KVM_VCPU_FLUSH_TLB:
+		 *   - arch/x86/kernel/kvm.c|623| <<kvm_flush_tlb_others>> state | KVM_VCPU_FLUSH_TLB))
+		 *   - arch/x86/kvm/x86.c|2457| <<record_steal_time>> if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
+		 *
+		 * #define KVM_VCPU_PREEMPTED          (1 << 0)
+		 * #define KVM_VCPU_FLUSH_TLB          (1 << 1)
+		 */
 		if ((state & KVM_VCPU_PREEMPTED)) {
 			if (try_cmpxchg(&src->preempted, &state,
 					state | KVM_VCPU_FLUSH_TLB))
diff --git a/arch/x86/kvm/debugfs.c b/arch/x86/kvm/debugfs.c
index c19c7ede9bd6..ce5e49932d75 100644
--- a/arch/x86/kvm/debugfs.c
+++ b/arch/x86/kvm/debugfs.c
@@ -10,6 +10,10 @@
 #include <linux/kvm_host.h>
 #include <linux/debugfs.h>
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2787| <<kvm_create_vcpu_debugfs>> if (!kvm_arch_has_vcpu_debugfs())
+ */
 bool kvm_arch_has_vcpu_debugfs(void)
 {
 	return true;
@@ -18,6 +22,13 @@ bool kvm_arch_has_vcpu_debugfs(void)
 static int vcpu_get_tsc_offset(void *data, u64 *val)
 {
 	struct kvm_vcpu *vcpu = (struct kvm_vcpu *) data;
+	/*
+	 * struct kvm_vcpu *vcpu:
+	 * -> struct kvm_vcpu_arch arch;
+	 *    -> struct kvm_lapic *apic;
+	 *       -> struct kvm_timer lapic_timer;
+	 *    -> u64 tsc_offset;
+	 */
 	*val = vcpu->arch.tsc_offset;
 	return 0;
 }
@@ -41,6 +52,10 @@ static int vcpu_get_tsc_scaling_frac_bits(void *data, u64 *val)
 
 DEFINE_SIMPLE_ATTRIBUTE(vcpu_tsc_scaling_frac_fops, vcpu_get_tsc_scaling_frac_bits, NULL, "%llu\n");
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2787| <<kvm_create_vcpu_debugfs>> ret = kvm_arch_create_vcpu_debugfs(vcpu);
+ */
 int kvm_arch_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
 {
 	struct dentry *ret;
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index bac2ec9b4443..168171a72b82 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -335,6 +335,13 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
 	}
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/ioapic.c|222| <<ioapic_set_irq>> ret = ioapic_service(ioapic, irq, line_status);
+ *   - arch/x86/kvm/ioapic.c|332| <<ioapic_write_indirect>> ioapic_service(ioapic, index, false);
+ *   - arch/x86/kvm/ioapic.c|427| <<kvm_ioapic_eoi_inject_work>> ioapic_service(ioapic, i, false);
+ *   - arch/x86/kvm/ioapic.c|485| <<__kvm_ioapic_update_eoi>> ioapic_service(ioapic, i, false);
+ */
 static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
 {
 	union kvm_ioapic_redirect_entry *entry = &ioapic->redirtbl[irq];
@@ -364,6 +371,15 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
 	if (irqe.trig_mode == IOAPIC_EDGE_TRIG)
 		ioapic->irr_delivered |= 1 << irq;
 
+	/*
+	 * called by:
+	 *   - arch/x86/kvm/hyperv.c|331| <<synic_set_irq>> ret = kvm_irq_delivery_to_apic(vcpu->kvm, vcpu->arch.apic, &irq, NULL);
+	 *   - arch/x86/kvm/ioapic.c|375| <<ioapic_service>> ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
+	 *   - arch/x86/kvm/ioapic.c|379| <<ioapic_service>> ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);
+	 *   - arch/x86/kvm/irq_comm.c|192| <<kvm_set_msi>> return kvm_irq_delivery_to_apic(kvm, NULL, &irq, NULL);
+	 *   - arch/x86/kvm/lapic.c|1249| <<apic_send_ipi>> kvm_irq_delivery_to_apic(apic->vcpu->kvm, apic, &irq, NULL);
+	 *   - arch/x86/kvm/x86.c|7133| <<kvm_pv_kick_cpu_op>> kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL);
+	 */
 	if (irq == RTC_GSI && line_status) {
 		/*
 		 * pending_eoi cannot ever become negative (see
@@ -384,6 +400,10 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
 	return ret;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/irq_comm.c|54| <<kvm_set_ioapic_irq>> return kvm_ioapic_set_irq(ioapic, e->irqchip.pin, irq_source_id, level,
+ */
 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int irq_source_id,
 		       int level, bool line_status)
 {
@@ -411,6 +431,10 @@ void kvm_ioapic_clear_all(struct kvm_ioapic *ioapic, int irq_source_id)
 	spin_unlock(&ioapic->lock);
 }
 
+/*
+ * 在以下使用kvm_ioapic_eoi_inject_work:
+ *   - arch/x86/kvm/ioapic.c|632| <<kvm_ioapic_init>> INIT_DELAYED_WORK(&ioapic->eoi_inject, kvm_ioapic_eoi_inject_work);
+ */
 static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
 {
 	int i;
@@ -661,6 +685,10 @@ void kvm_ioapic_destroy(struct kvm *kvm)
 	kfree(ioapic);
 }
 
+/*
+ * 处理KVM_IRQCHIP_IOAPIC:
+ *   - arch/x86/kvm/x86.c|4407| <<kvm_vm_ioctl_get_irqchip>> kvm_get_ioapic(kvm, &chip->chip.ioapic);
+ */
 void kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
 {
 	struct kvm_ioapic *ioapic = kvm->arch.vioapic;
@@ -671,6 +699,10 @@ void kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
 	spin_unlock(&ioapic->lock);
 }
 
+/*
+ * 处理KVM_IRQCHIP_IOAPIC:
+ *   - arch/x86/kvm/x86.c|4436| <<kvm_vm_ioctl_set_irqchip>> kvm_set_ioapic(kvm, &chip->chip.ioapic);
+ */
 void kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
 {
 	struct kvm_ioapic *ioapic = kvm->arch.vioapic;
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index faa264822cee..289cd28191bb 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -31,6 +31,11 @@
  * check if there are pending timer events
  * to be processed.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|8088| <<vcpu_run>> if (kvm_cpu_has_pending_timer(vcpu))
+ *   - virt/kvm/kvm_main.c|2444| <<kvm_vcpu_check_block>> if (kvm_cpu_has_pending_timer(vcpu))
+ */
 int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
 {
 	if (lapic_in_kernel(vcpu))
@@ -100,6 +105,13 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
  * check if there is pending interrupt without
  * intack.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/irq.c|129| <<global>> EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt);
+ *   - arch/x86/kvm/vmx/nested.c|3481| <<vmx_check_nested_events>> if (kvm_cpu_has_interrupt(vcpu) && nested_exit_on_intr(vcpu)) {
+ *   - arch/x86/kvm/x86.c|3462| <<kvm_vcpu_ready_for_interrupt_injection>> !kvm_cpu_has_interrupt(vcpu) &&
+ *   - arch/x86/kvm/x86.c|9724| <<kvm_vcpu_has_events>> (kvm_cpu_has_interrupt(vcpu) ||
+ */
 int kvm_cpu_has_interrupt(struct kvm_vcpu *v)
 {
 	/*
@@ -144,6 +156,11 @@ static int kvm_cpu_get_extint(struct kvm_vcpu *v)
 /*
  * Read pending interrupt vector and intack.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|4063| <<nested_vmx_vmexit>> int irq = kvm_cpu_get_interrupt(vcpu);
+ *   - arch/x86/kvm/x86.c|7397| <<inject_pending_event>> kvm_queue_interrupt(vcpu, kvm_cpu_get_interrupt(vcpu),
+ */
 int kvm_cpu_get_interrupt(struct kvm_vcpu *v)
 {
 	int vector;
@@ -160,6 +177,17 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v)
 }
 EXPORT_SYMBOL_GPL(kvm_cpu_get_interrupt);
 
+/*
+ * kvm_inject_pending_timer_irqs
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by(处理kvm_cpu_has_pending_timer()):
+ *   - arch/x86/kvm/x86.c|8074| <<vcpu_run>> kvm_inject_pending_timer_irqs(vcpu);
+ */
 void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu)
 {
 	if (lapic_in_kernel(vcpu))
@@ -167,6 +195,10 @@ void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_inject_pending_timer_irqs);
 
+/*
+ * called by(处理KVM_REQ_MIGRATE_TIMER):
+ *   - arch/x86/kvm/x86.c|7779| <<vcpu_enter_guest>> __kvm_migrate_timers(vcpu);
+ */
 void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
 {
 	__kvm_migrate_apic_timer(vcpu);
diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
index 4d000aea05e0..79e7ae956489 100644
--- a/arch/x86/kvm/irq_comm.c
+++ b/arch/x86/kvm/irq_comm.c
@@ -55,6 +55,15 @@ static int kvm_set_ioapic_irq(struct kvm_kernel_irq_routing_entry *e,
 				line_status);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/hyperv.c|331| <<synic_set_irq>> ret = kvm_irq_delivery_to_apic(vcpu->kvm, vcpu->arch.apic, &irq, NULL);
+ *   - arch/x86/kvm/ioapic.c|375| <<ioapic_service>> ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
+ *   - arch/x86/kvm/ioapic.c|379| <<ioapic_service>> ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);
+ *   - arch/x86/kvm/irq_comm.c|192| <<kvm_set_msi>> return kvm_irq_delivery_to_apic(kvm, NULL, &irq, NULL);
+ *   - arch/x86/kvm/lapic.c|1249| <<apic_send_ipi>> kvm_irq_delivery_to_apic(apic->vcpu->kvm, apic, &irq, NULL);
+ *   - arch/x86/kvm/x86.c|7133| <<kvm_pv_kick_cpu_op>> kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL);
+ */
 int kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
 		struct kvm_lapic_irq *irq, struct dest_map *dest_map)
 {
@@ -112,6 +121,41 @@ int kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
 	return r;
 }
 
+/*
+ * # sudo /usr/share/bcc/tools/trace -t -C  'kvm_set_msi_irq'
+ * TIME     CPU PID     TID     COMM            FUNC
+ * 1.409018 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.430408 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.557921 1   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.594878 5   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.624964 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ *
+ * 9.586209 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586283 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586399 5   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 9.586470 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586482 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ *
+ * kvm_set_msi_irq
+ * irqfd_wakeup
+ * __wake_up_common
+ * __wake_up_locked_key
+ * eventfd_signal
+ * vhost_signal
+ * vhost_add_used_and_signal_n
+ * handle_rx
+ * handle_rx_net
+ * vhost_worker
+ * kthread
+ * ret_from_fork
+ *
+ * called by:
+ *   - arch/x86/kvm/irq_comm.c|155| <<kvm_set_msi>> kvm_set_msi_irq(kvm, e, &irq);
+ *   - arch/x86/kvm/irq_comm.c|187| <<kvm_arch_set_irq_inatomic>> kvm_set_msi_irq(kvm, e, &irq);
+ *   - arch/x86/kvm/irq_comm.c|428| <<kvm_scan_ioapic_routes>> kvm_set_msi_irq(vcpu->kvm, entry, &irq);
+ *   - arch/x86/kvm/svm.c|5309| <<get_pi_vcpu_info>> kvm_set_msi_irq(kvm, e, &irq);
+ *   - arch/x86/kvm/vmx/vmx.c|7543| <<vmx_update_pi_irte>> kvm_set_msi_irq(kvm, e, &irq);
+ */
 void kvm_set_msi_irq(struct kvm *kvm, struct kvm_kernel_irq_routing_entry *e,
 		     struct kvm_lapic_irq *irq)
 {
@@ -141,6 +185,11 @@ static inline bool kvm_msi_route_invalid(struct kvm *kvm,
 	return kvm->arch.x2apic_format && (e->msi.address_hi & 0xff);
 }
 
+/*
+ * called by
+ *   - arch/x86/kvm/irq_comm.c|359| <<kvm_set_routing_entry>> e->set = kvm_set_msi;
+ *   - virt/kvm/irqchip.c|78| <<kvm_send_userspace_msi>> return kvm_set_msi(&route, kvm, KVM_USERSPACE_IRQ_SOURCE_ID, 1, false);
+ */
 int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
 		struct kvm *kvm, int irq_source_id, int level, bool line_status)
 {
@@ -168,6 +217,11 @@ static int kvm_hv_set_sint(struct kvm_kernel_irq_routing_entry *e,
 	return kvm_hv_synic_set_irq(kvm, e->hv_sint.vcpu, e->hv_sint.sint);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/eventfd.c|178| <<kvm_arch_set_irq_inatomic>> int __attribute__((weak)) kvm_arch_set_irq_inatomic(
+ *   - virt/kvm/eventfd.c|212| <<irqfd_wakeup>> if (kvm_arch_set_irq_inatomic(&irq, kvm,
+ */
 int kvm_arch_set_irq_inatomic(struct kvm_kernel_irq_routing_entry *e,
 			      struct kvm *kvm, int irq_source_id, int level,
 			      bool line_status)
@@ -197,6 +251,10 @@ int kvm_arch_set_irq_inatomic(struct kvm_kernel_irq_routing_entry *e,
 	return -EWOULDBLOCK;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/i8254.c|660| <<kvm_create_pit>> pit->irq_source_id = kvm_request_irq_source_id(kvm);
+ */
 int kvm_request_irq_source_id(struct kvm *kvm)
 {
 	unsigned long *bitmap = &kvm->arch.irq_sources_bitmap;
@@ -279,6 +337,10 @@ bool kvm_arch_can_set_irq_routing(struct kvm *kvm)
 	return irqchip_in_kernel(kvm);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/irqchip.c|180| <<setup_routing_entry>> r = kvm_set_routing_entry(kvm, e, ue);
+ */
 int kvm_set_routing_entry(struct kvm *kvm,
 			  struct kvm_kernel_irq_routing_entry *e,
 			  const struct kvm_irq_routing_entry *ue)
diff --git a/arch/x86/kvm/kvm_cache_regs.h b/arch/x86/kvm/kvm_cache_regs.h
index 4fa133a69df7..21a49848b9fd 100644
--- a/arch/x86/kvm/kvm_cache_regs.h
+++ b/arch/x86/kvm/kvm_cache_regs.h
@@ -87,6 +87,11 @@ static inline u64 kvm_read_edx_eax(struct kvm_vcpu *vcpu)
 		| ((u64)(kvm_register_read(vcpu, VCPU_REGS_RDX) & -1u) << 32);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/svm.c|3621| <<enter_svm_guest_mode>> enter_guest_mode(&svm->vcpu);
+ *   - arch/x86/kvm/vmx/nested.c|3067| <<nested_vmx_enter_non_root_mode>> enter_guest_mode(vcpu);
+ */
 static inline void enter_guest_mode(struct kvm_vcpu *vcpu)
 {
 	vcpu->arch.hflags |= HF_GUEST_MASK;
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index baf4a218d186..510ecb8bf00e 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -44,6 +44,10 @@
 #include "cpuid.h"
 #include "hyperv.h"
 
+/*
+ * https://www.codeleading.com/article/91825014645/
+ */
+
 #ifndef CONFIG_X86_64
 #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
 #else
@@ -387,6 +391,11 @@ static u8 count_vectors(void *bitmap)
 	return count;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|424| <<kvm_apic_update_irr>> return __kvm_apic_update_irr(pir, apic->regs, max_irr);
+ *   - arch/x86/kvm/vmx/nested.c|3368| <<vmx_complete_nested_posted_interrupt>> __kvm_apic_update_irr(vmx->nested.pi_desc->pir,
+ */
 bool __kvm_apic_update_irr(u32 *pir, void *regs, int *max_irr)
 {
 	u32 i, vec;
@@ -417,6 +426,10 @@ bool __kvm_apic_update_irr(u32 *pir, void *regs, int *max_irr)
 }
 EXPORT_SYMBOL_GPL(__kvm_apic_update_irr);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|6087| <<vmx_sync_pir_to_irr>> kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
+ */
 bool kvm_apic_update_irr(struct kvm_vcpu *vcpu, u32 *pir, int *max_irr)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -425,6 +438,14 @@ bool kvm_apic_update_irr(struct kvm_vcpu *vcpu, u32 *pir, int *max_irr)
 }
 EXPORT_SYMBOL_GPL(kvm_apic_update_irr);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|460| <<apic_clear_irr>> apic_find_highest_irr(apic));
+ *   - arch/x86/kvm/lapic.c|548| <<kvm_lapic_find_highest_irr>> return apic_find_highest_irr(vcpu->arch.apic);
+ *   - arch/x86/kvm/lapic.c|679| <<apic_has_interrupt_for_ppr>> highest_irr = apic_find_highest_irr(apic);
+ *   - arch/x86/kvm/lapic.c|2482| <<kvm_apic_set_state>> apic_find_highest_irr(apic));
+ *   - arch/x86/kvm/lapic.c|2599| <<kvm_lapic_sync_to_vapic>> max_irr = apic_find_highest_irr(apic);
+ */
 static inline int apic_search_irr(struct kvm_lapic *apic)
 {
 	return find_highest_vector(apic->regs + APIC_IRR);
@@ -553,11 +574,72 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
 			     int vector, int level, int trig_mode,
 			     struct dest_map *dest_map);
 
+/*
+ * kvm_apic_set_irq
+ * kvm_irq_delivery_to_apic
+ * kvm_lapic_reg_write
+ * kvm_x2apic_msr_write
+ * kvm_set_msr_common
+ * vmx_set_msr
+ * kvm_set_msr
+ * __dta_handle_wrmsr_190
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * __dta_kvm_vcpu_ioctl_657
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * kvm_apic_set_irq
+ * kvm_irq_delivery_to_apic
+ * ioapic_service
+ * __dta_ioapic_set_irq_2902
+ * kvm_ioapic_set_irq
+ * kvm_set_ioapic_irq
+ * kvm_set_irq
+ * kvm_vm_ioctl_irq_line
+ * kvm_vm_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * kvm_apic_set_irq
+ * kvm_arch_set_irq_inatomic
+ * irqfd_wakeup
+ * __wake_up_common
+ * __wake_up_locked_key
+ * eventfd_signal
+ * vhost_signal
+ * vhost_add_used_and_signal_n
+ * handle_rx
+ * handle_rx_net
+ * vhost_worker
+ * kthread
+ * ret_from_fork
+ *
+ * called by:
+ *   - arch/x86/kvm/hyperv.c|658| <<stimer_notify_direct>> return !kvm_apic_set_irq(vcpu, &irq, NULL);
+ *   - arch/x86/kvm/hyperv.c|1450| <<kvm_send_ipi_to_many>> kvm_apic_set_irq(vcpu, &irq, NULL);
+ *   - arch/x86/kvm/irq_comm.c|97| <<kvm_irq_delivery_to_apic>> r += kvm_apic_set_irq(vcpu, irq, dest_map);
+ *   - arch/x86/kvm/irq_comm.c|119| <<kvm_irq_delivery_to_apic>> r = kvm_apic_set_irq(lowest, irq, dest_map);
+ *   - arch/x86/kvm/lapic.c|614| <<kvm_pv_send_ipi>> count += kvm_apic_set_irq(vcpu, &irq, NULL);
+ *   - arch/x86/kvm/lapic.c|627| <<kvm_pv_send_ipi>> count += kvm_apic_set_irq(vcpu, &irq, NULL);
+ *   - arch/x86/kvm/lapic.c|986| <<kvm_irq_delivery_to_apic_fast>> *r = kvm_apic_set_irq(src->vcpu, irq, dest_map);
+ *   - arch/x86/kvm/lapic.c|999| <<kvm_irq_delivery_to_apic_fast>> *r += kvm_apic_set_irq(dst[i]->vcpu, irq, dest_map);
+ */
 int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
 		     struct dest_map *dest_map)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
+	/*
+	 * called by:
+	 *   - arch/x86/kvm/lapic.c|561| <<kvm_apic_set_irq>> return __apic_accept_irq(apic, irq->delivery_mode, irq->vector,
+	 *   - arch/x86/kvm/lapic.c|2267| <<kvm_apic_local_deliver>> return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
+	 */
 	return __apic_accept_irq(apic, irq->delivery_mode, irq->vector,
 			irq->level, irq->trig_mode, dest_map);
 }
@@ -958,6 +1040,11 @@ static inline bool kvm_apic_map_get_dest_lapic(struct kvm *kvm,
 	return true;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/irq_comm.c|81| <<kvm_irq_delivery_to_apic>> if (kvm_irq_delivery_to_apic_fast(kvm, src, irq, &r, dest_map))
+ *   - arch/x86/kvm/irq_comm.c|243| <<kvm_arch_set_irq_inatomic>> if (kvm_irq_delivery_to_apic_fast(kvm, NULL, &irq, &r, NULL))
+ */
 bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src,
 		struct kvm_lapic_irq *irq, int *r, struct dest_map *dest_map)
 {
@@ -1037,6 +1124,11 @@ bool kvm_intr_is_single_vcpu_fast(struct kvm *kvm, struct kvm_lapic_irq *irq,
  * Add a pending IRQ into lapic.
  * Return 1 if successfully added and 0 if discarded.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|561| <<kvm_apic_set_irq>> return __apic_accept_irq(apic, irq->delivery_mode, irq->vector,
+ *   - arch/x86/kvm/lapic.c|2267| <<kvm_apic_local_deliver>> return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
+ */
 static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
 			     int vector, int level, int trig_mode,
 			     struct dest_map *dest_map)
@@ -1048,6 +1140,13 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
 				  trig_mode, vector);
 	switch (delivery_mode) {
 	case APIC_DM_LOWEST:
+		/*
+		 * 在以下使用kvm_vcpu_arch->apic_arb_prio:
+		 *   - arch/x86/kvm/lapic.c|1088| <<__apic_accept_irq>> vcpu->arch.apic_arb_prio++;
+		 *   - arch/x86/kvm/lapic.c|1187| <<kvm_apic_compare_prio>> return vcpu1->arch.apic_arb_prio - vcpu2->arch.apic_arb_prio;
+		 *   - arch/x86/kvm/lapic.c|2480| <<kvm_lapic_reset>> vcpu->arch.apic_arb_prio = 0;
+		 *   - arch/x86/kvm/lapic.c|2771| <<kvm_apic_set_state>> vcpu->arch.apic_arb_prio = 0;
+		 */
 		vcpu->arch.apic_arb_prio++;
 		/* fall through */
 	case APIC_DM_FIXED:
@@ -1072,6 +1171,9 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
 				apic_clear_vector(vector, apic->regs + APIC_TMR);
 		}
 
+		/*
+		 * vmx_deliver_posted_interrupt()
+		 */
 		if (kvm_x86_ops->deliver_posted_interrupt(vcpu, vector)) {
 			kvm_lapic_set_irr(vector, apic);
 			kvm_make_request(KVM_REQ_EVENT, vcpu);
@@ -1214,6 +1316,10 @@ void kvm_apic_set_eoi_accelerated(struct kvm_vcpu *vcpu, int vector)
 }
 EXPORT_SYMBOL_GPL(kvm_apic_set_eoi_accelerated);
 
+/*
+ * 处理APIC_ICR:
+ *   - arch/x86/kvm/lapic.c|1904| <<kvm_lapic_reg_write>> apic_send_ipi(apic);
+ */
 static void apic_send_ipi(struct kvm_lapic *apic)
 {
 	u32 icr_low = kvm_lapic_get_reg(apic, APIC_ICR);
@@ -1450,11 +1556,26 @@ static void limit_periodic_timer_frequency(struct kvm_lapic *apic)
 	}
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|2231| <<kvm_lapic_reg_write>> apic_update_lvtt(apic);
+ *   - arch/x86/kvm/lapic.c|2275| <<kvm_lapic_reg_write>> apic_update_lvtt(apic);
+ *   - arch/x86/kvm/lapic.c|2529| <<kvm_lapic_reset>> apic_update_lvtt(apic);
+ *   - arch/x86/kvm/lapic.c|2847| <<kvm_apic_set_state>> apic_update_lvtt(apic);
+ */
 static void apic_update_lvtt(struct kvm_lapic *apic)
 {
 	u32 timer_mode = kvm_lapic_get_reg(apic, APIC_LVTT) &
 			apic->lapic_timer.timer_mode_mask;
 
+	/*
+	 * 在以下使用kvm_timer->timer_mode:
+	 *   - arch/x86/kvm/lapic.c|316| <<apic_lvtt_oneshot>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_ONESHOT;
+	 *   - arch/x86/kvm/lapic.c|321| <<apic_lvtt_period>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_PERIODIC;
+	 *   - arch/x86/kvm/lapic.c|326| <<apic_lvtt_tscdeadline>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_TSCDEADLINE;
+	 *   - arch/x86/kvm/lapic.c|1499| <<apic_update_lvtt>> if (apic->lapic_timer.timer_mode != timer_mode) {
+	 *   - arch/x86/kvm/lapic.c|1507| <<apic_update_lvtt>> apic->lapic_timer.timer_mode = timer_mode;
+	 */
 	if (apic->lapic_timer.timer_mode != timer_mode) {
 		if (apic_lvtt_tscdeadline(apic) != (timer_mode ==
 				APIC_LVT_TIMER_TSCDEADLINE)) {
@@ -1468,6 +1589,39 @@ static void apic_update_lvtt(struct kvm_lapic *apic)
 	}
 }
 
+/*
+ * 例子们
+ * apic_timer_expired
+ * handle_preemption_timer
+ * vmx_handle_exit
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * __dta_kvm_vcpu_ioctl_657
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * apic_timer_expired
+ * __hrtimer_run_queues
+ * hrtimer_interrupt
+ * smp_apic_timer_interrupt
+ * apic_timer_interrupt
+ * cpuidle_enter_state
+ * cpuidle_enter
+ * call_cpuidle
+ * do_idle
+ * cpu_startup_entry
+ * start_secondary
+ * secondary_startup_64
+ *
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1622| <<start_sw_tscdeadline>> apic_timer_expired(apic);
+ *   - arch/x86/kvm/lapic.c|1714| <<start_sw_period>> apic_timer_expired(apic);
+ *   - arch/x86/kvm/lapic.c|1773| <<start_hv_timer>> apic_timer_expired(apic);
+ *   - arch/x86/kvm/lapic.c|1816| <<kvm_lapic_expired_hv_timer>> apic_timer_expired(apic);
+ *   - arch/x86/kvm/lapic.c|2324| <<apic_timer_fn>> apic_timer_expired(apic);
+ */
 static void apic_timer_expired(struct kvm_lapic *apic)
 {
 	struct kvm_vcpu *vcpu = apic->vcpu;
@@ -1487,6 +1641,13 @@ static void apic_timer_expired(struct kvm_lapic *apic)
 	if (swait_active(q))
 		swake_up(q);
 
+	/*
+	 * 在以下使用kvm_timer->expired_tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1561| <<apic_timer_expired>> ktimer->expired_tscdeadline = ktimer->tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1595| <<wait_lapic_expire>> if (apic->lapic_timer.expired_tscdeadline == 0)
+	 *   - arch/x86/kvm/lapic.c|1601| <<wait_lapic_expire>> tsc_deadline = apic->lapic_timer.expired_tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1602| <<wait_lapic_expire>> apic->lapic_timer.expired_tscdeadline = 0;
+	 */
 	if (apic_lvtt_tscdeadline(apic))
 		ktimer->expired_tscdeadline = ktimer->tscdeadline;
 }
@@ -1496,6 +1657,10 @@ static void apic_timer_expired(struct kvm_lapic *apic)
  * during a higher-priority task.
  */
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1670| <<wait_lapic_expire>> if (!lapic_timer_int_injected(vcpu))
+ */
 static bool lapic_timer_int_injected(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -1514,6 +1679,10 @@ static bool lapic_timer_int_injected(struct kvm_vcpu *vcpu)
 	return false;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|7981| <<vcpu_enter_guest>> wait_lapic_expire(vcpu);
+ */
 void wait_lapic_expire(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -1522,6 +1691,13 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu)
 	if (!lapic_in_kernel(vcpu))
 		return;
 
+	/*
+	 * 在以下使用kvm_timer->expired_tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1561| <<apic_timer_expired>> ktimer->expired_tscdeadline = ktimer->tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1595| <<wait_lapic_expire>> if (apic->lapic_timer.expired_tscdeadline == 0)
+	 *   - arch/x86/kvm/lapic.c|1601| <<wait_lapic_expire>> tsc_deadline = apic->lapic_timer.expired_tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1602| <<wait_lapic_expire>> apic->lapic_timer.expired_tscdeadline = 0;
+	 */
 	if (apic->lapic_timer.expired_tscdeadline == 0)
 		return;
 
@@ -1557,8 +1733,15 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu)
 	}
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1802| <<start_sw_timer>> start_sw_tscdeadline(apic);
+ */
 static void start_sw_tscdeadline(struct kvm_lapic *apic)
 {
+	/*
+	 * 这里tscdeadline是基于VM的tsc
+	 */
 	u64 guest_tsc, tscdeadline = apic->lapic_timer.tscdeadline;
 	u64 ns = 0;
 	ktime_t expire;
@@ -1578,6 +1761,18 @@ static void start_sw_tscdeadline(struct kvm_lapic *apic)
 		ns = (tscdeadline - guest_tsc) * 1000000ULL;
 		do_div(ns, this_tsc_khz);
 		expire = ktime_add_ns(now, ns);
+		/*
+		 * 在以下使用lapic_timer_advance_ns:
+		 *   - arch/x86/kvm/x86.c|142| <<global>> module_param(lapic_timer_advance_ns, uint, S_IRUGO | S_IWUSR);
+		 *   - arch/x86/kvm/lapic.c|1584| <<wait_lapic_expire>> nsec_to_cycles(vcpu, lapic_timer_advance_ns)));
+		 *   - arch/x86/kvm/lapic.c|1591| <<wait_lapic_expire>> lapic_timer_advance_ns -= min((unsigned int )ns,
+		 *   - arch/x86/kvm/lapic.c|1592| <<wait_lapic_expire>> lapic_timer_advance_ns / LAPIC_TIMER_ADVANCE_ADJUST_STEP);
+		 *   - arch/x86/kvm/lapic.c|1597| <<wait_lapic_expire>> lapic_timer_advance_ns += min((unsigned int )ns,
+		 *   - arch/x86/kvm/lapic.c|1598| <<wait_lapic_expire>> lapic_timer_advance_ns / LAPIC_TIMER_ADVANCE_ADJUST_STEP);
+		 *   - arch/x86/kvm/lapic.c|1630| <<start_sw_tscdeadline>> expire = ktime_sub_ns(expire, lapic_timer_advance_ns);
+		 *   - arch/x86/kvm/vmx/vmx.c|7259| <<vmx_set_hv_timer>> lapic_timer_advance_cycles = nsec_to_cycles(vcpu, lapic_timer_advance_ns);
+		 *   - arch/x86/kvm/x86.c|7926| <<vcpu_enter_guest>> if (lapic_timer_advance_ns)
+		 */
 		expire = ktime_sub_ns(expire, lapic_timer_advance_ns);
 		hrtimer_start(&apic->lapic_timer.timer,
 				expire, HRTIMER_MODE_ABS_PINNED);
@@ -1588,6 +1783,10 @@ static void start_sw_tscdeadline(struct kvm_lapic *apic)
 }
 
 
+/*
+ * 处理APIC_TDCR:
+ *   - arch/x86/kvm/lapic.c|2286| <<kvm_lapic_reg_write>> update_target_expiration(apic, old_divisor);
+ */
 static void update_target_expiration(struct kvm_lapic *apic, uint32_t old_divisor)
 {
 	ktime_t now, remaining;
@@ -1613,6 +1812,10 @@ static void update_target_expiration(struct kvm_lapic *apic, uint32_t old_diviso
 }
 
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|2024| <<start_apic_timer>> && !set_target_expiration(apic))
+ */
 static bool set_target_expiration(struct kvm_lapic *apic)
 {
 	ktime_t now;
@@ -1692,18 +1895,54 @@ bool kvm_lapic_hv_timer_in_use(struct kvm_vcpu *vcpu)
 	if (!lapic_in_kernel(vcpu))
 		return false;
 
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
 }
 EXPORT_SYMBOL_GPL(kvm_lapic_hv_timer_in_use);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1851| <<start_sw_timer>> cancel_hv_timer(apic);
+ *   - arch/x86/kvm/lapic.c|1883| <<kvm_lapic_expired_hv_timer>> cancel_hv_timer(apic);
+ */
 static void cancel_hv_timer(struct kvm_lapic *apic)
 {
 	WARN_ON(preemptible());
 	WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	/*
+	 * vmx_cancel_hv_timer()
+	 */
 	kvm_x86_ops->cancel_hv_timer(apic->vcpu);
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	apic->lapic_timer.hv_timer_in_use = false;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|2021| <<restart_apic_timer>> if (!start_hv_timer(apic))
+ */
 static bool start_hv_timer(struct kvm_lapic *apic)
 {
 	struct kvm_timer *ktimer = &apic->lapic_timer;
@@ -1716,13 +1955,35 @@ static bool start_hv_timer(struct kvm_lapic *apic)
 	if (!apic_lvtt_period(apic) && atomic_read(&ktimer->pending))
 		return false;
 
+	/*
+	 * 在以下设置kvm_timer->tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1501| <<apic_update_lvtt>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|1695| <<update_target_expiration>> apic->lapic_timer.tscdeadline +=
+	 *   - arch/x86/kvm/lapic.c|1712| <<set_target_expiration>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|2559| <<kvm_inject_apic_timer_irqs>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|2561| <<kvm_inject_apic_timer_irqs>> apic->lapic_timer.tscdeadline = 0;
+	 * 在以下使用kvm_timer->tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1561| <<apic_timer_expired>> ktimer->expired_tscdeadline = ktimer->tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1636| <<start_sw_tscdeadline>> u64 guest_tsc, tscdeadline = apic->lapic_timer.tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1810| <<start_hv_timer>> if (!ktimer->tscdeadline)
+	 *   - arch/x86/kvm/lapic.c|1813| <<start_hv_timer>> r = kvm_x86_ops->set_hv_timer(apic->vcpu, ktimer->tscdeadline);
+	 *   - arch/x86/kvm/lapic.c|2242| <<kvm_get_lapic_tscdeadline_msr>> return apic->lapic_timer.tscdeadline;
+	 */
 	if (!ktimer->tscdeadline)
 		return false;
 
+	/*
+	 * vmx_set_hv_timer()
+	 */
 	r = kvm_x86_ops->set_hv_timer(apic->vcpu, ktimer->tscdeadline);
 	if (r < 0)
 		return false;
 
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 */
 	ktimer->hv_timer_in_use = true;
 	hrtimer_cancel(&ktimer->timer);
 
@@ -1741,11 +2002,63 @@ static bool start_hv_timer(struct kvm_lapic *apic)
 	return true;
 }
 
+/*
+ * start_sw_timer
+ * start_apic_timer
+ * kvm_set_lapic_tscdeadline_msr
+ * kvm_set_msr_common
+ * vmx_set_msr
+ * kvm_set_msr
+ * handle_wrmsr
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * __dta_kvm_vcpu_ioctl_657
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * start_sw_timer
+ * kvm_lapic_switch_to_hv_timer
+ * vmx_post_block
+ * kvm_arch_vcpu_ioctl_run
+ * __dta_kvm_vcpu_ioctl_657
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * start_sw_timer
+ * vmx_pre_block
+ * kvm_arch_vcpu_ioctl_run
+ * __dta_kvm_vcpu_ioctl_657
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1810| <<restart_apic_timer>> start_sw_timer(apic);
+ *   - arch/x86/kvm/lapic.c|1852| <<kvm_lapic_switch_to_sw_timer>> start_sw_timer(apic);
+ */
 static void start_sw_timer(struct kvm_lapic *apic)
 {
 	struct kvm_timer *ktimer = &apic->lapic_timer;
 
 	WARN_ON(preemptible());
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	if (apic->lapic_timer.hv_timer_in_use)
 		cancel_hv_timer(apic);
 	if (!apic_lvtt_period(apic) && atomic_read(&ktimer->pending))
@@ -1758,6 +2071,54 @@ static void start_sw_timer(struct kvm_lapic *apic)
 	trace_kvm_hv_timer_state(apic->vcpu->vcpu_id, false);
 }
 
+/*
+ * restart_apic_timer
+ * kvm_lapic_reg_write
+ * kvm_x2apic_msr_write
+ * kvm_set_msr_common
+ * vmx_set_msr
+ * kvm_set_msr
+ * handle_wrmsr
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * restart_apic_timer
+ * vmx_post_block
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * restart_apic_timer
+ * kvm_set_lapic_tscdeadline_msr
+ * kvm_set_msr_common
+ * vmx_set_msr
+ * kvm_set_msr
+ * handle_wrmsr
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1893| <<kvm_lapic_expired_hv_timer>> restart_apic_timer(apic);
+ *   - arch/x86/kvm/lapic.c|1906| <<kvm_lapic_switch_to_hv_timer>> restart_apic_timer(vcpu->arch.apic);
+ *   - arch/x86/kvm/lapic.c|1931| <<kvm_lapic_restart_hv_timer>> restart_apic_timer(apic);
+ *   - arch/x86/kvm/lapic.c|1942| <<start_apic_timer>> restart_apic_timer(apic);
+ *   - arch/x86/kvm/lapic.c|2080| <<kvm_lapic_reg_write>> restart_apic_timer(apic);
+ */
 static void restart_apic_timer(struct kvm_lapic *apic)
 {
 	preempt_disable();
@@ -1766,12 +2127,35 @@ static void restart_apic_timer(struct kvm_lapic *apic)
 	preempt_enable();
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|5485| <<handle_preemption_timer>> kvm_lapic_expired_hv_timer(vcpu);
+ */
 void kvm_lapic_expired_hv_timer(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * struct kvm_vcpu *vcpu:
+	 * -> struct kvm_vcpu_arch arch
+	 *    -> struct kvm_lapic *apic;
+	 *       -> struct kvm_timer lapic_timer;
+	 *          -> struct hrtimer timer;
+	 */
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
 	preempt_disable();
 	/* If the preempt notifier has already run, it also called apic_timer_expired */
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	if (!apic->lapic_timer.hv_timer_in_use)
 		goto out;
 	WARN_ON(swait_active(&vcpu->wq));
@@ -1787,18 +2171,38 @@ void kvm_lapic_expired_hv_timer(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_lapic_expired_hv_timer);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|7489| <<vmx_post_block>> kvm_lapic_switch_to_hv_timer(vcpu);
+ */
 void kvm_lapic_switch_to_hv_timer(struct kvm_vcpu *vcpu)
 {
 	restart_apic_timer(vcpu->arch.apic);
 }
 EXPORT_SYMBOL_GPL(kvm_lapic_switch_to_hv_timer);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|7470| <<vmx_pre_block>> kvm_lapic_switch_to_sw_timer(vcpu);
+ */
 void kvm_lapic_switch_to_sw_timer(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
 	preempt_disable();
 	/* Possibly the TSC deadline timer is not enabled yet */
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	if (apic->lapic_timer.hv_timer_in_use)
 		start_sw_timer(apic);
 	preempt_enable();
@@ -1813,10 +2217,20 @@ void kvm_lapic_restart_hv_timer(struct kvm_vcpu *vcpu)
 	restart_apic_timer(apic);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|2099| <<kvm_lapic_reg_write>> start_apic_timer(apic);
+ *   - arch/x86/kvm/lapic.c|2249| <<kvm_set_lapic_tscdeadline_msr>> start_apic_timer(apic);
+ *   - arch/x86/kvm/lapic.c|2650| <<kvm_apic_set_state>> start_apic_timer(apic);
+ */
 static void start_apic_timer(struct kvm_lapic *apic)
 {
 	atomic_set(&apic->lapic_timer.pending, 0);
 
+	/*
+	 * 只在此处调用start_apic_timer():
+	 *   - arch/x86/kvm/lapic.c|2024| <<start_apic_timer>> && !set_target_expiration(apic))
+	 */
 	if ((apic_lvtt_period(apic) || apic_lvtt_oneshot(apic))
 	    && !set_target_expiration(apic))
 		return;
@@ -2048,6 +2462,11 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
 }
 EXPORT_SYMBOL_GPL(kvm_apic_write_nodecode);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9380| <<kvm_arch_vcpu_init>> kvm_free_lapic(vcpu);
+ *   - arch/x86/kvm/x86.c|9396| <<kvm_arch_vcpu_uninit>> kvm_free_lapic(vcpu);
+ */
 void kvm_free_lapic(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2085,6 +2504,10 @@ u64 kvm_get_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu)
 	return apic->lapic_timer.tscdeadline;
 }
 
+/*
+ * 处理MSR_IA32_TSCDEADLINE:
+ *   - arch/x86/kvm/x86.c|2564| <<kvm_set_msr_common>> kvm_set_lapic_tscdeadline_msr(vcpu, data);
+ */
 void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2093,6 +2516,9 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
 			apic_lvtt_period(apic))
 		return;
 
+	/*
+	 * cancel a timer and wait for the handler to finish.
+	 */
 	hrtimer_cancel(&apic->lapic_timer.timer);
 	apic->lapic_timer.tscdeadline = data;
 	start_apic_timer(apic);
@@ -2241,6 +2667,10 @@ static bool lapic_is_periodic(struct kvm_lapic *apic)
 	return apic_lvtt_period(apic);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/irq.c|37| <<kvm_cpu_has_pending_timer>> return apic_has_pending_timer(vcpu);
+ */
 int apic_has_pending_timer(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2251,6 +2681,12 @@ int apic_has_pending_timer(struct kvm_vcpu *vcpu)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|2392| <<kvm_apic_nmi_wd_deliver>> kvm_apic_local_deliver(apic, APIC_LVT0);
+ *   - arch/x86/kvm/lapic.c|2493| <<kvm_inject_apic_timer_irqs>> kvm_apic_local_deliver(apic, APIC_LVTT);
+ *   - arch/x86/kvm/pmu.c|305| <<kvm_pmu_deliver_pmi>> kvm_apic_local_deliver(vcpu->arch.apic, APIC_LVTPC);
+ */
 int kvm_apic_local_deliver(struct kvm_lapic *apic, int lvt_type)
 {
 	u32 reg = kvm_lapic_get_reg(apic, lvt_type);
@@ -2260,6 +2696,11 @@ int kvm_apic_local_deliver(struct kvm_lapic *apic, int lvt_type)
 		vector = reg & APIC_VECTOR_MASK;
 		mode = reg & APIC_MODE_MASK;
 		trig_mode = reg & APIC_LVT_LEVEL_TRIGGER;
+		/*
+		 * called by:
+		 *   - arch/x86/kvm/lapic.c|561| <<kvm_apic_set_irq>> return __apic_accept_irq(apic, irq->delivery_mode, irq->vector,
+		 *   - arch/x86/kvm/lapic.c|2267| <<kvm_apic_local_deliver>> return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
+		 */
 		return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
 					NULL);
 	}
@@ -2279,6 +2720,10 @@ static const struct kvm_io_device_ops apic_mmio_ops = {
 	.write    = apic_mmio_write,
 };
 
+/*
+ * 在以下使用apic_timer_fn():
+ *   - arch/x86/kvm/lapic.c|2357| <<kvm_create_lapic>> apic->lapic_timer.timer.function = apic_timer_fn;
+ */
 static enum hrtimer_restart apic_timer_fn(struct hrtimer *data)
 {
 	struct kvm_timer *ktimer = container_of(data, struct kvm_timer, timer);
@@ -2334,6 +2779,12 @@ int kvm_create_lapic(struct kvm_vcpu *vcpu)
 	return -ENOMEM;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/irq.c|96| <<kvm_cpu_has_injectable_intr>> return kvm_apic_has_interrupt(v) != -1;
+ *   - arch/x86/kvm/irq.c|122| <<kvm_cpu_has_interrupt>> return kvm_apic_has_interrupt(v) != -1;
+ *   - arch/x86/kvm/lapic.c|2506| <<kvm_get_apic_interrupt>> int vector = kvm_apic_has_interrupt(vcpu);
+ */
 int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2359,6 +2810,14 @@ int kvm_apic_accept_pic_intr(struct kvm_vcpu *vcpu)
 	return r;
 }
 
+/*
+ * vcpu_run()
+ * -> kvm_inject_pending_timer_irqs()
+ *    -> kvm_inject_apic_timer_irqs()
+ *
+ * called by:
+ *   - arch/x86/kvm/irq.c|166| <<kvm_inject_pending_timer_irqs>> kvm_inject_apic_timer_irqs(vcpu);
+ */
 void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2438,12 +2897,20 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu,
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|3494| <<kvm_vcpu_ioctl_get_lapic>> return kvm_apic_get_state(vcpu, s);
+ */
 int kvm_apic_get_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s)
 {
 	memcpy(s->regs, vcpu->arch.apic->regs, sizeof(*s));
 	return kvm_apic_state_fixup(vcpu, s, false);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|3439| <<kvm_vcpu_ioctl_set_lapic>> r = kvm_apic_set_state(vcpu, s);
+ */
 int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
@@ -2713,6 +3180,13 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len)
 	return kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, addr, new_len);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|7924| <<vcpu_enter_guest>> kvm_apic_accept_events(vcpu);
+ *   - arch/x86/kvm/x86.c|8145| <<vcpu_block>> kvm_apic_accept_events(vcpu);
+ *   - arch/x86/kvm/x86.c|8361| <<kvm_arch_vcpu_ioctl_run>> kvm_apic_accept_events(vcpu);
+ *   - arch/x86/kvm/x86.c|8563| <<kvm_arch_vcpu_ioctl_get_mpstate>> kvm_apic_accept_events(vcpu);
+ */
 void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
index ff6ef9c3d760..9a27e2227f08 100644
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -26,12 +26,80 @@ enum lapic_mode {
 struct kvm_timer {
 	struct hrtimer timer;
 	s64 period; 				/* unit: ns */
+	/*
+	 * 在以下设置kvm_timer->timer_mode:
+	 *   - arch/x86/kvm/lapic.c|1702| <<update_target_expiration>> apic->lapic_timer.target_expiration = ktime_add_ns(now, ns_remaining_new);
+	 *   - arch/x86/kvm/lapic.c|1734| <<set_target_expiration>> apic->lapic_timer.target_expiration = ktime_add_ns(now, apic->lapic_timer.period);
+	 *   - arch/x86/kvm/lapic.c|1752| <<advance_periodic_target_expiration>> apic->lapic_timer.target_expiration =
+	 *   - arch/x86/kvm/lapic.c|2611| <<kvm_inject_apic_timer_irqs>> apic->lapic_timer.target_expiration = 0;
+	 * 在以下使用kvm_timer->timer_mode:
+	 *   - arch/x86/kvm/lapic.c|1303| <<apic_get_tmcct>> remaining = ktime_sub(apic->lapic_timer.target_expiration, now);
+	 *   - arch/x86/kvm/lapic.c|1691| <<update_target_expiration>> remaining = ktime_sub(apic->lapic_timer.target_expiration, now);
+	 *   - arch/x86/kvm/lapic.c|1753| <<advance_periodic_target_expiration>> ktime_add_ns(apic->lapic_timer.target_expiration,
+	 *   - arch/x86/kvm/lapic.c|1755| <<advance_periodic_target_expiration>> delta = ktime_sub(apic->lapic_timer.target_expiration, now);
+	 *   - arch/x86/kvm/lapic.c|1766| <<start_sw_period>> apic->lapic_timer.target_expiration)) {
+	 *   - arch/x86/kvm/lapic.c|1776| <<start_sw_period>> apic->lapic_timer.target_expiration,
+	 */
 	ktime_t target_expiration;
+	/*
+	 * 在以下使用kvm_timer->timer_mode:
+	 *   - arch/x86/kvm/lapic.c|316| <<apic_lvtt_oneshot>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_ONESHOT;
+	 *   - arch/x86/kvm/lapic.c|321| <<apic_lvtt_period>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_PERIODIC;
+	 *   - arch/x86/kvm/lapic.c|326| <<apic_lvtt_tscdeadline>> return apic->lapic_timer.timer_mode == APIC_LVT_TIMER_TSCDEADLINE;
+	 *   - arch/x86/kvm/lapic.c|1499| <<apic_update_lvtt>> if (apic->lapic_timer.timer_mode != timer_mode) {
+	 *   - arch/x86/kvm/lapic.c|1507| <<apic_update_lvtt>> apic->lapic_timer.timer_mode = timer_mode;
+	 */
 	u32 timer_mode;
+	/*
+	 * 在以下使用kvm_timer->timer_mode_mask:
+	 *   - arch/x86/kvm/cpuid.c|93| <<kvm_update_cpuid>> apic->lapic_timer.timer_mode_mask = 3 << 17;
+	 *   - arch/x86/kvm/cpuid.c|95| <<kvm_update_cpuid>> apic->lapic_timer.timer_mode_mask = 1 << 17;
+	 *   - arch/x86/kvm/lapic.c|1497| <<apic_update_lvtt>> apic->lapic_timer.timer_mode_mask;
+	 *   - arch/x86/kvm/lapic.c|2140| <<kvm_lapic_reg_write>> val &= (apic_lvt_mask[0] | apic->lapic_timer.timer_mode_mask);
+	 *   - arch/x86/kvm/lapic.c|1728| <<set_target_expiration>> apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) +
+	 *   - arch/x86/kvm/lapic.c|1752| <<advance_periodic_target_expiration>> apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) +
+	 *   - arch/x86/kvm/lapic.c|2258| <<kvm_set_lapic_tscdeadline_msr>> apic->lapic_timer.tscdeadline = data;
+	 */
 	u32 timer_mode_mask;
+	/*
+	 * 在以下设置kvm_timer->tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1501| <<apic_update_lvtt>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|1695| <<update_target_expiration>> apic->lapic_timer.tscdeadline +=
+	 *   - arch/x86/kvm/lapic.c|1712| <<set_target_expiration>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|2559| <<kvm_inject_apic_timer_irqs>> apic->lapic_timer.tscdeadline = 0;
+	 *   - arch/x86/kvm/lapic.c|2561| <<kvm_inject_apic_timer_irqs>> apic->lapic_timer.tscdeadline = 0;
+	 * 在以下使用kvm_timer->tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1561| <<apic_timer_expired>> ktimer->expired_tscdeadline = ktimer->tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1636| <<start_sw_tscdeadline>> u64 guest_tsc, tscdeadline = apic->lapic_timer.tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1810| <<start_hv_timer>> if (!ktimer->tscdeadline)
+	 *   - arch/x86/kvm/lapic.c|1813| <<start_hv_timer>> r = kvm_x86_ops->set_hv_timer(apic->vcpu, ktimer->tscdeadline);
+	 *   - arch/x86/kvm/lapic.c|2242| <<kvm_get_lapic_tscdeadline_msr>> return apic->lapic_timer.tscdeadline;
+	 */
 	u64 tscdeadline;
+	/*
+	 * 在以下使用kvm_timer->expired_tscdeadline:
+	 *   - arch/x86/kvm/lapic.c|1561| <<apic_timer_expired>> ktimer->expired_tscdeadline = ktimer->tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1595| <<wait_lapic_expire>> if (apic->lapic_timer.expired_tscdeadline == 0)
+	 *   - arch/x86/kvm/lapic.c|1601| <<wait_lapic_expire>> tsc_deadline = apic->lapic_timer.expired_tscdeadline;
+	 *   - arch/x86/kvm/lapic.c|1602| <<wait_lapic_expire>> apic->lapic_timer.expired_tscdeadline = 0;
+	 */
 	u64 expired_tscdeadline;
+	/*
+	 * 会使用apic_has_pending_timer()查询
+	 */
 	atomic_t pending;			/* accumulated triggered timers */
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	bool hv_timer_in_use;
 };
 
@@ -42,6 +110,16 @@ struct kvm_lapic {
 	u32 divide_count;
 	struct kvm_vcpu *vcpu;
 	bool sw_enabled;
+	/*
+	 * 在以下使用kvm_lapic->irr_pending:
+	 *   - arch/x86/kvm/lapic.c|462| <<apic_find_highest_irr>> if (!apic->irr_pending)
+	 *   - arch/x86/kvm/lapic.c|483| <<apic_clear_irr>> apic->irr_pending = false;
+	 *   - arch/x86/kvm/lapic.c|486| <<apic_clear_irr>> apic->irr_pending = true;
+	 *   - arch/x86/kvm/lapic.c|2525| <<kvm_lapic_reset>> apic->irr_pending = vcpu->arch.apicv_active;
+	 *   - arch/x86/kvm/lapic.c|2817| <<kvm_apic_set_state>> apic->irr_pending = true;
+	 *   - arch/x86/kvm/lapic.c|2914| <<apic_sync_pv_eoi_to_guest>> apic->irr_pending ||
+	 *   - arch/x86/kvm/lapic.h|217| <<kvm_lapic_set_irr>> apic->irr_pending = true;
+	 */
 	bool irr_pending;
 	bool lvt0_in_nmi_mode;
 	/* Number of bits set in ISR. */
@@ -132,6 +210,11 @@ static inline void kvm_lapic_set_vector(int vec, void *bitmap)
 	set_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1076| <<__apic_accept_irq>> kvm_lapic_set_irr(vector, apic);
+ *   - arch/x86/kvm/svm.c|5214| <<svm_deliver_avic_intr>> kvm_lapic_set_irr(vec, vcpu->arch.apic);
+ */
 static inline void kvm_lapic_set_irr(int vec, struct kvm_lapic *apic)
 {
 	kvm_lapic_set_vector(vec, apic->regs + APIC_IRR);
@@ -199,6 +282,10 @@ static inline bool kvm_vcpu_apicv_active(struct kvm_vcpu *vcpu)
 	return vcpu->arch.apic && vcpu->arch.apicv_active;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9891| <<kvm_vcpu_has_events>> if (kvm_apic_has_events(vcpu))
+ */
 static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
 {
 	return lapic_in_kernel(vcpu) && vcpu->arch.apic->pending_events;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 5f52161c4bf2..56a4705bd49b 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -6370,6 +6370,10 @@ static int set_nx_huge_pages_recovery_ratio(const char *val, const struct kernel
 	return err;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/mmu.c|6439| <<kvm_nx_lpage_recovery_worker>> kvm_recover_nx_lpages(kvm);
+ */
 static void kvm_recover_nx_lpages(struct kvm *kvm)
 {
 	int rcu_idx;
@@ -6440,6 +6444,10 @@ static int kvm_nx_lpage_recovery_worker(struct kvm *kvm, uintptr_t data)
 	}
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9462| <<kvm_arch_post_init_vm>> return kvm_mmu_post_init_vm(kvm);
+ */
 int kvm_mmu_post_init_vm(struct kvm *kvm)
 {
 	int err;
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 36bc936ceb71..5fb7b163bb8e 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -96,6 +96,24 @@ static void kvm_perf_overflow_intr(struct perf_event *perf_event,
 	}
 }
 
+/*
+ * pmc_reprogram_counter
+ * reprogram_counter
+ * intel_pmu_set_msr
+ * kvm_pmu_set_msr
+ * kvm_set_msr_common
+ * vmx_set_msr
+ * kvm_set_msr
+ * handle_wrmsr
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ */
 static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type,
 				  unsigned config, bool exclude_user,
 				  bool exclude_kernel, bool intr,
@@ -218,6 +236,19 @@ void reprogram_counter(struct kvm_pmu *pmu, int pmc_idx)
 }
 EXPORT_SYMBOL_GPL(reprogram_counter);
 
+/*
+ * "perf record -e branch-misses"的时候会获得以下:
+ * kvm_pmu_handle_event
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+  do_vfs_ioctl
+  sys_ioctl
+  do_syscall_64
+  entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/x86.c|7831| <<vcpu_enter_guest>> kvm_pmu_handle_event(vcpu);
+ */
 void kvm_pmu_handle_event(struct kvm_vcpu *vcpu)
 {
 	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
@@ -299,6 +330,16 @@ int kvm_pmu_rdpmc(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
 	return 0;
 }
 
+/*
+ * "perf record -e branch-misses"的时候会获得以下:
+ * kvm_pmu_deliver_pmi
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ */
 void kvm_pmu_deliver_pmi(struct kvm_vcpu *vcpu)
 {
 	if (lapic_in_kernel(vcpu))
@@ -315,6 +356,20 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *data)
 	return kvm_x86_ops->pmu_ops->get_msr(vcpu, msr, data);
 }
 
+/*
+ * kvm_pmu_set_msr
+ * vmx_set_msr
+ * kvm_set_msr
+ * handle_wrmsr
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ */
 int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
 	return kvm_x86_ops->pmu_ops->set_msr(vcpu, msr_info);
@@ -326,6 +381,9 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
  */
 void kvm_pmu_refresh(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * intel_pmu_refresh()
+	 */
 	kvm_x86_ops->pmu_ops->refresh(vcpu);
 }
 
@@ -337,6 +395,10 @@ void kvm_pmu_reset(struct kvm_vcpu *vcpu)
 	kvm_x86_ops->pmu_ops->reset(vcpu);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9231| <<kvm_arch_vcpu_init>> kvm_pmu_init(vcpu);
+ */
 void kvm_pmu_init(struct kvm_vcpu *vcpu)
 {
 	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h
index 09a60369a9a4..b1ff486b1ba4 100644
--- a/arch/x86/kvm/vmx/capabilities.h
+++ b/arch/x86/kvm/vmx/capabilities.h
@@ -49,10 +49,80 @@ struct vmcs_config {
 	int order;
 	u32 basic_cap;
 	u32 revision_id;
+	/*
+	 * 在以下使用vmcs_config->pin_based_exec_ctrl:
+	 *   - arch/x86/kvm/vmx/capabilities.h|74| <<cpu_has_virtual_nmis>> return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
+	 *   - arch/x86/kvm/vmx/capabilities.h|79| <<cpu_has_vmx_preemption_timer>> return vmcs_config.pin_based_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|86| <<cpu_has_vmx_posted_intr>> vmcs_config.pin_based_exec_ctrl & PIN_BASED_POSTED_INTR;
+	 *   - arch/x86/kvm/vmx/evmcs.c|299| <<evmcs_sanitize_exec_ctrls>> vmcs_conf->pin_based_exec_ctrl &= ~EVMCS1_UNSUPPORTED_PINCTRL;
+	 *   - arch/x86/kvm/vmx/nested.c|2016| <<prepare_vmcs02_early>> exec_control |= vmcs_config.pin_based_exec_ctrl;
+	 *   - arch/x86/kvm/vmx/vmx.c|2613| <<setup_vmcs_config>> vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4159| <<vmx_pin_based_exec_ctrl>> u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
+	 */
 	u32 pin_based_exec_ctrl;
+	/*
+	 * 在以下使用vmcs->cpu_based_exec_ctrl:
+	 *   - arch/x86/kvm/vmx/capabilities.h|122| <<cpu_has_vmx_tpr_shadow>> return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW;
+	 *   - arch/x86/kvm/vmx/capabilities.h|132| <<cpu_has_vmx_msr_bitmap>> return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS;
+	 *   - arch/x86/kvm/vmx/capabilities.h|137| <<cpu_has_secondary_exec_ctrls>> return vmcs_config.cpu_based_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/vmx.c|2618| <<setup_vmcs_config>> vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4201| <<vmx_exec_control>> u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
+	 */
 	u32 cpu_based_exec_ctrl;
+	/*
+	 * 在以下使用vmcs_config->cpu_based_2nd_exec_ctrl:
+	 *   - arch/x86/kvm/vmx/capabilities.h|143| <<cpu_has_vmx_virtualize_apic_accesses>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|149| <<cpu_has_vmx_ept>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|158| <<vmx_umip_emulated>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|172| <<cpu_has_vmx_rdtscp>> return vmcs_config.cpu_based_2nd_exec_ctrl & 
+	 *   - arch/x86/kvm/vmx/capabilities.h|178| <<cpu_has_vmx_virtualize_x2apic_mode>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|184| <<cpu_has_vmx_vpid>> return vmcs_config.cpu_based_2nd_exec_ctrl & 
+	 *   - arch/x86/kvm/vmx/capabilities.h|193| <<cpu_has_vmx_wbinvd_exit>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|199| <<cpu_has_vmx_unrestricted_guest>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|205| <<cpu_has_vmx_apic_register_virt>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|211| <<cpu_has_vmx_virtual_intr_delivery>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|217| <<cpu_has_vmx_ple>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|223| <<vmx_rdrand_supported>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|229| <<cpu_has_vmx_invpcid>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|235| <<cpu_has_vmx_vmfunc>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|248| <<cpu_has_vmx_shadow_vmcs>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|254| <<cpu_has_vmx_encls_vmexit>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|260| <<vmx_rdseed_supported>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|266| <<cpu_has_vmx_pml>> return vmcs_config.cpu_based_2nd_exec_ctrl & SECONDARY_EXEC_ENABLE_PML;
+	 *   - arch/x86/kvm/vmx/capabilities.h|274| <<vmx_xsaves_supported>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|280| <<cpu_has_vmx_tsc_scaling>> return vmcs_config.cpu_based_2nd_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|368| <<cpu_has_vmx_intel_pt>> (vmcs_config.cpu_based_2nd_exec_ctrl & SECONDARY_EXEC_PT_USE_GPA) &&
+	 *   - arch/x86/kvm/vmx/evmcs.c|300| <<evmcs_sanitize_exec_ctrls>> vmcs_conf->cpu_based_2nd_exec_ctrl &= ~EVMCS1_UNSUPPORTED_2NDEXEC;
+	 *   - arch/x86/kvm/vmx/vmx.c|2619| <<setup_vmcs_config>> vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4230| <<vmx_compute_secondary_exec_control>> u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
+	 */
 	u32 cpu_based_2nd_exec_ctrl;
+	/*
+	 * 在以下使用vmcs_config->vmexit_ctrl:
+	 *   - arch/x86/kvm/vmx/capabilities.h|102| <<cpu_has_load_ia32_efer>> (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_EFER);
+	 *   - arch/x86/kvm/vmx/capabilities.h|108| <<cpu_has_load_perf_global_ctrl>> (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
+	 *   - arch/x86/kvm/vmx/capabilities.h|116| <<vmx_mpx_supported>> return (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_BNDCFGS) &&
+	 *   - arch/x86/kvm/vmx/capabilities.h|369| <<cpu_has_vmx_intel_pt>> (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_IA32_RTIT_CTL) &&
+	 *   - arch/x86/kvm/vmx/evmcs.c|302| <<evmcs_sanitize_exec_ctrls>> vmcs_conf->vmexit_ctrl &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
+	 *   - arch/x86/kvm/vmx/vmx.c|2620| <<setup_vmcs_config>> vmcs_conf->vmexit_ctrl = _vmexit_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4139| <<vmx_set_constant_host_state>> if (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT) {
+	 *   - arch/x86/kvm/vmx/vmx.h|488| <<vmx_vmexit_ctrl>> u32 vmexit_ctrl = vmcs_config.vmexit_ctrl;
+	 *   - arch/x86/kvm/vmx/vmx.h|492| <<vmx_vmexit_ctrl>> return vmcs_config.vmexit_ctrl &
+	 */
 	u32 vmexit_ctrl;
+	/*
+	 * 在以下使用vmcs_config->vmentry_ctrl:
+	 *   - arch/x86/kvm/vmx/capabilities.h|101| <<cpu_has_load_ia32_efer>> return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_EFER) &&
+	 *   - arch/x86/kvm/vmx/capabilities.h|107| <<cpu_has_load_perf_global_ctrl>> return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL) &&
+	 *   - arch/x86/kvm/vmx/capabilities.h|117| <<vmx_mpx_supported>> (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
+	 *   - arch/x86/kvm/vmx/capabilities.h|370| <<cpu_has_vmx_intel_pt>> (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_RTIT_CTL);
+	 *   - arch/x86/kvm/vmx/evmcs.c|303| <<evmcs_sanitize_exec_ctrls>> vmcs_conf->vmentry_ctrl &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
+	 *   - arch/x86/kvm/vmx/nested.c|2325| <<prepare_vmcs02>> } else if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+	 *   - arch/x86/kvm/vmx/vmx.c|2147| <<vmx_set_msr>> if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+	 *   - arch/x86/kvm/vmx/vmx.c|2621| <<setup_vmcs_config>> vmcs_conf->vmentry_ctrl = _vmentry_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4433| <<vmx_vcpu_setup>> if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
+	 *   - arch/x86/kvm/vmx/vmx.h|478| <<vmx_vmentry_ctrl>> u32 vmentry_ctrl = vmcs_config.vmentry_ctrl;
+	 */
 	u32 vmentry_ctrl;
 	struct nested_vmx_msrs nested;
 };
@@ -98,6 +168,9 @@ static inline bool cpu_has_load_perf_global_ctrl(void)
 	       (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.mpx_supported = vmx_mpx_supported()
+ */
 static inline bool vmx_mpx_supported(void)
 {
 	return (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_BNDCFGS) &&
@@ -137,12 +210,18 @@ static inline bool cpu_has_vmx_ept(void)
 		SECONDARY_EXEC_ENABLE_EPT;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.umip_emulated = vmx_umip_emulated()
+ */
 static inline bool vmx_umip_emulated(void)
 {
 	return vmcs_config.cpu_based_2nd_exec_ctrl &
 		SECONDARY_EXEC_DESC;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pku_supported = vmx_pku_supported()
+ */
 static inline bool vmx_pku_supported(void)
 {
 	return boot_cpu_has(X86_FEATURE_PKU);
@@ -166,6 +245,9 @@ static inline bool cpu_has_vmx_vpid(void)
 		SECONDARY_EXEC_ENABLE_VPID;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.has+wbinvd_exit = cpu_has_vmx_wbinvd_exit()
+ */
 static inline bool cpu_has_vmx_wbinvd_exit(void)
 {
 	return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -244,6 +326,9 @@ static inline bool cpu_has_vmx_pml(void)
 	return vmcs_config.cpu_based_2nd_exec_ctrl & SECONDARY_EXEC_ENABLE_PML;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.xsaves_supported = vmx_xsaves_supported()
+ */
 static inline bool vmx_xsaves_supported(void)
 {
 	return vmcs_config.cpu_based_2nd_exec_ctrl &
diff --git a/arch/x86/kvm/vmx/ops.h b/arch/x86/kvm/vmx/ops.h
index b8e50f76fefc..1053728a6ec9 100644
--- a/arch/x86/kvm/vmx/ops.h
+++ b/arch/x86/kvm/vmx/ops.h
@@ -192,6 +192,14 @@ static inline void vmcs_clear(struct vmcs *vmcs)
 		       vmcs, phys_addr);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|1339| <<copy_shadow_to_vmcs12>> vmcs_load(shadow_vmcs);
+ *   - arch/x86/kvm/vmx/nested.c|1355| <<copy_shadow_to_vmcs12>> vmcs_load(vmx->loaded_vmcs->vmcs);
+ *   - arch/x86/kvm/vmx/nested.c|1378| <<copy_vmcs12_to_shadow>> vmcs_load(shadow_vmcs);
+ *   - arch/x86/kvm/vmx/nested.c|1389| <<copy_vmcs12_to_shadow>> vmcs_load(vmx->loaded_vmcs->vmcs);
+ *   - arch/x86/kvm/vmx/vmx.c|1514| <<vmx_vcpu_load>> vmcs_load(vmx->loaded_vmcs->vmcs);
+ */
 static inline void vmcs_load(struct vmcs *vmcs)
 {
 	u64 phys_addr = __pa(vmcs);
diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
index ea77590743ad..42cfb950ff8d 100644
--- a/arch/x86/kvm/vmx/pmu_intel.c
+++ b/arch/x86/kvm/vmx/pmu_intel.c
@@ -20,6 +20,15 @@
 #include "lapic.h"
 #include "pmu.h"
 
+/*
+ * 在以下使用intel_arch_events[]:
+ *   - arch/x86/kvm/vmx/pmu_intel.c|76| <<intel_find_arch_event>> for (i = 0; i < ARRAY_SIZE(intel_arch_events); i++)
+ *   - arch/x86/kvm/vmx/pmu_intel.c|77| <<intel_find_arch_event>> if (intel_arch_events[i].eventsel == event_select
+ *   - arch/x86/kvm/vmx/pmu_intel.c|78| <<intel_find_arch_event>> && intel_arch_events[i].unit_mask == unit_mask
+ *   - arch/x86/kvm/vmx/pmu_intel.c|82| <<intel_find_arch_event>> if (i == ARRAY_SIZE(intel_arch_events))
+ *   - arch/x86/kvm/vmx/pmu_intel.c|85| <<intel_find_arch_event>> return intel_arch_events[i].event_type;
+ *   - arch/x86/kvm/vmx/pmu_intel.c|97| <<intel_find_fixed_event>> return intel_arch_events[event].event_type;
+ */
 static struct kvm_event_hw_type_mapping intel_arch_events[] = {
 	/* Index must match CPUID 0x0A.EBX bit vector */
 	[0] = { 0x3c, 0x00, PERF_COUNT_HW_CPU_CYCLES },
@@ -358,6 +367,9 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu)
 		pmu->global_ovf_ctrl = 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pmu_ops = &intel_pmu_ops 
+ */
 struct kvm_pmu_ops intel_pmu_ops = {
 	.find_arch_event = intel_find_arch_event,
 	.find_fixed_event = intel_find_fixed_event,
diff --git a/arch/x86/kvm/vmx/vmcs.h b/arch/x86/kvm/vmx/vmcs.h
index 6def3ba88e3b..bc1243d8e57d 100644
--- a/arch/x86/kvm/vmx/vmcs.h
+++ b/arch/x86/kvm/vmx/vmcs.h
@@ -52,8 +52,30 @@ struct loaded_vmcs {
 	int cpu;
 	bool launched;
 	bool nmi_known_unmasked;
+	/*
+	 * 在以下使用loaded_vmcs->hv_timer_armed:
+	 *   - arch/x86/kvm/vmx/nested.c|2018| <<prepare_vmcs02_early>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 *   - arch/x86/kvm/vmx/vmx.c|6367| <<vmx_arm_hv_timer>> if (!vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6370| <<vmx_arm_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = true;
+	 *   - arch/x86/kvm/vmx/vmx.c|6420| <<vmx_update_hv_timer>> if (vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6423| <<vmx_update_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 */
 	bool hv_timer_armed;
 	/* Support for vnmi-less CPUs */
+	/*
+	 * 在以下设置loaded_vmcs->soft_vnmi_blocked:
+	 *   - arch/x86/kvm/vmx/vmx.c|4638| <<vmx_inject_nmi>> vmx->loaded_vmcs->soft_vnmi_blocked = 1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6225| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+	 *   - arch/x86/kvm/vmx/vmx.c|6237| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+	 * 在以下使用loaded_vmcs->soft_vnmi_blocked:
+	 *   - arch/x86/kvm/vmx/vmx.c|4663| <<vmx_get_nmi_mask>> return vmx->loaded_vmcs->soft_vnmi_blocked;
+	 *   - arch/x86/kvm/vmx/vmx.c|4676| <<vmx_set_nmi_mask>> if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
+	 *   - arch/x86/kvm/vmx/vmx.c|4677| <<vmx_set_nmi_mask>> vmx->loaded_vmcs->soft_vnmi_blocked = masked;
+	 *   - arch/x86/kvm/vmx/vmx.c|4700| <<vmx_nmi_allowed>> to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
+	 *   - arch/x86/kvm/vmx/vmx.c|6223| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked)) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6676| <<vmx_recover_nmi_blocking>> } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
+	 *   - arch/x86/kvm/vmx/vmx.c|7021| <<vmx_vcpu_run>> vmx->loaded_vmcs->soft_vnmi_blocked))
+	 */
 	int soft_vnmi_blocked;
 	ktime_t entry_time;
 	s64 vnmi_blocked_time;
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index d60edd838993..5a946d3406c6 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -70,6 +70,86 @@
 MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
 
+/*
+ * 关于vmx.
+ *
+ * Intel VMX的VMCS包含几个部分.
+ *
+ * 1. Guest-state are.
+ * 2. Host-state area.
+ * 3. VM-execution control fields.
+ *    These fields control processir behavior in VM non-root operation. They
+ *    determine in part the casues of VM exits.
+ * 4. VM-exit control fields.
+ *    用来指定虚拟机在发生VM Exit时的行为, 如一些寄存器的保存.
+ * 5. VM-entry control fields.
+ *    用来指定虚拟机在发生VM Entry时的行为, 如一些寄存器的加载, 还有一些虚拟机的事件注入.
+ * 6. VM-exit information fields.
+ *
+ * VM-execution control fields包含非常多的fields, 有bit也有具体value的配置. bit有以下几组:
+ * - Pin-Based VM-Execution Controls
+ *   The pin-based VM-execution controls constitute a 32-bit vector that
+ *   governs the handling of asynchronous events (e.g., interrupts).
+ * - Processor-Based VM-Execution Controls.
+ *   包含 "primary processor-based VM-execution controls"和"secondary processor-based"
+ *
+ * The processor-based VM-execution controls constitute two 32-bit vectors that
+ * govern the handling of synchronous events, mainly those caused by the
+ * execution of specific instructions.
+ *
+ * 以上那些只是bit的可以由以下的global的管理.
+ *
+ * struct vmcs_config {
+ *     int size;
+ *     int order;
+ *     u32 basic_cap;
+ *     u32 revision_id;
+ *     u32 pin_based_exec_ctrl;
+ *     u32 cpu_based_exec_ctrl;
+ *     u32 cpu_based_2nd_exec_ctrl;
+ *     u32 vmexit_ctrl;
+ *     u32 vmentry_ctrl;
+ *     struct nested_vmx_msrs nested;
+ * };
+ */
+
+/*
+ * 关于shadow vmcs:
+ *
+ * A shadow VMCS differs from an ordinary VMCS in two ways:
+ *
+ * An ordinary VMCS can be used for VM entry but a shadow VMCS cannot. Attempts
+ * to perform VM entry when the current VMCS is a shadow VMCS fail (see Section
+ * 26.1).
+ *
+ * The VMREAD and VMWRITE instructions can be used in VMX non-root operation to
+ * access a shadow VMCS but not an ordinary VMCS. This fact results from the
+ * following:
+ *
+ * - If the "VMCS shadowing" VM-execution control is 0, execution of the VMREAD
+ *   and VMWRITE instructions in VMX non-root operation always cause VM exits
+ *   (see Section 25.1.3).
+ * 
+ * - If the "VMCS shadowing" VM-execution control is 1, execution of the VMREAD
+ *   and VMWRITE instructions in VMX non-root operation can access the VMCS
+ *   referenced by the VMCS link pointer (see Section 30.3)
+ *
+ * - If the "VMCS shadowing" VM-execution control is 1, VM entry ensures that
+ *   any VMCS referenced by the VMCS link pointer is a shadow VMCS (see Section
+ *   26.3.1.5).
+ *
+ * In VMX root operation, both types of VMCSs can be accessed with the VMREAD
+ * and VMWRITE instructions. Software should not modify the shadow-VMCS
+ * indicator in the VMCS region of a VMCS that is active. Doing so may cause
+ * the VMCS to become corrupted (see Section 24.11.1). Before modifying the
+ * shadow-VMCS indicator, software should execute VMCLEAR for the VMCS to
+ * ensure that it is not active.
+ */
+
+/*
+ * 时间account_guest_time()
+ */
+
 static const struct x86_cpu_id vmx_cpu_id[] = {
 	X86_FEATURE_MATCH(X86_FEATURE_VMX),
 	{}
@@ -82,6 +162,19 @@ module_param_named(vpid, enable_vpid, bool, 0444);
 static bool __read_mostly enable_vnmi = 1;
 module_param_named(vnmi, enable_vnmi, bool, S_IRUGO);
 
+/*
+ * 在以下设置flexpriority_enabled:
+ *   - module默认是1
+ *   - arch/x86/kvm/vmx/vmx.c|7989| <<hardware_setup>> flexpriority_enabled = 0;
+ * 在以下使用flexpriority_enabled:
+ *   - arch/x86/kvm/vmx/vmx.c|86| <<global>> module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
+ *   - arch/x86/kvm/vmx/nested.c|5775| <<nested_vmx_setup_ctls_msrs>> if (flexpriority_enabled)
+ *   - arch/x86/kvm/vmx/vmx.c|654| <<cpu_need_virtualize_apic_accesses>> return flexpriority_enabled && lapic_in_kernel(vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|659| <<report_flexpriority>> return flexpriority_enabled;
+ *   - arch/x86/kvm/vmx/vmx.c|6127| <<vmx_set_virtual_apic_mode>> if (!flexpriority_enabled &&
+ *   - arch/x86/kvm/vmx/vmx.c|6147| <<vmx_set_virtual_apic_mode>> if (flexpriority_enabled) {
+ *   - arch/x86/kvm/vmx/vmx.c|7999| <<hardware_setup>> if (!flexpriority_enabled)
+ */
 bool __read_mostly flexpriority_enabled = 1;
 module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
 
@@ -114,6 +207,9 @@ module_param(nested, bool, S_IRUGO);
 
 static u64 __read_mostly host_xss;
 
+/*
+ * Page Modification Logging
+ */
 bool __read_mostly enable_pml = 1;
 module_param_named(pml, enable_pml, bool, S_IRUGO);
 
@@ -166,6 +262,9 @@ module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
 static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
 module_param(ple_gap, uint, 0444);
 
+/*
+ * !!! PLE = Pause Loop Exiting
+ */
 static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
 module_param(ple_window, uint, 0444);
 
@@ -182,9 +281,41 @@ static unsigned int ple_window_max        = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
 module_param(ple_window_max, uint, 0444);
 
 /* Default is SYSTEM mode, 1 for host-guest mode */
+/*
+ * 在以下设置pt_mode:
+ *   - arch/x86/kvm/vmx/vmx.c|7964| <<hardware_setup>> pt_mode = PT_MODE_SYSTEM;
+ * 在以下使用pt_mode:
+ *   - arch/x86/kvm/vmx/nested.c|4294| <<enter_vmx_operation>> if (pt_mode == PT_MODE_HOST_GUEST) {
+ *   - arch/x86/kvm/vmx/vmx.c|1003| <<pt_guest_enter>> if (pt_mode == PT_MODE_SYSTEM)
+ *   - arch/x86/kvm/vmx/vmx.c|1020| <<pt_guest_exit>> if (pt_mode == PT_MODE_SYSTEM)
+ *   - arch/x86/kvm/vmx/vmx.c|1752| <<vmx_get_msr>> if (pt_mode != PT_MODE_HOST_GUEST)
+ *   - arch/x86/kvm/vmx/vmx.c|1757| <<vmx_get_msr>> if (pt_mode != PT_MODE_HOST_GUEST)
+ *   - arch/x86/kvm/vmx/vmx.c|1762| <<vmx_get_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|1769| <<vmx_get_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|1778| <<vmx_get_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|1788| <<vmx_get_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|1985| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|1994| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|2001| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|2009| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|2020| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|2031| <<vmx_set_msr>> if ((pt_mode != PT_MODE_HOST_GUEST) ||
+ *   - arch/x86/kvm/vmx/vmx.c|3924| <<vmx_compute_secondary_exec_control>> if (pt_mode == PT_MODE_SYSTEM)
+ *   - arch/x86/kvm/vmx/vmx.c|4173| <<vmx_vcpu_setup>> if (pt_mode == PT_MODE_HOST_GUEST) {
+ *   - arch/x86/kvm/vmx/vmx.c|6272| <<vmx_pt_supported>> return pt_mode == PT_MODE_HOST_GUEST;
+ *   - arch/x86/kvm/vmx/vmx.c|7961| <<hardware_setup>> if (pt_mode != PT_MODE_SYSTEM && pt_mode != PT_MODE_HOST_GUEST)
+ *   - arch/x86/kvm/vmx/vmx.h|473| <<vmx_vmentry_ctrl>> if (pt_mode == PT_MODE_SYSTEM)
+ *   - arch/x86/kvm/vmx/vmx.h|483| <<vmx_vmexit_ctrl>> if (pt_mode == PT_MODE_SYSTEM)
+ */
 int __read_mostly pt_mode = PT_MODE_SYSTEM;
 module_param(pt_mode, int, S_IRUGO);
 
+/*
+ * 在以下使用vmx_l1d_should_flush:
+ *   - arch/x86/kvm/vmx/vmx.c|271| <<vmx_setup_l1d_flush>> static_branch_enable(&vmx_l1d_should_flush);
+ *   - arch/x86/kvm/vmx/vmx.c|273| <<vmx_setup_l1d_flush>> static_branch_disable(&vmx_l1d_should_flush);
+ *   - arch/x86/kvm/vmx/vmx.c|6509| <<__vmx_vcpu_run>> if (static_branch_unlikely(&vmx_l1d_should_flush))
+ */
 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
 static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
 static DEFINE_MUTEX(vmx_l1d_flush_mutex);
@@ -333,6 +464,26 @@ static const struct kernel_param_ops vmentry_l1d_flush_ops = {
 	.set = vmentry_l1d_flush_set,
 	.get = vmentry_l1d_flush_get,
 };
+/*
+ * 注释l1tf.
+ * kvm-intel.vmentry_l1d_flush: KVM module parameter to control L1 data cache
+ * flush operations on each VM entry. It can have possible values as shown:
+ *
+ *    always     L1D cache flush on every VMENTER.
+ *    cond       Conditional L1D cache flush.
+ *    never      Disable the L1D cache flush mitigation.
+ *
+ * cond is trying to avoid L1D cache flushes on VMENTER if the code executed
+ * between VMEXIT and VMENTER is considered safe, i.e. is not bringing any
+ * interesting information into L1D which might be exploited.
+ *
+ * # cat  /sys/module/kvm_intel/parameters/vmentry_l1d_flush
+ * cond
+ *
+ * This parameter is set to cond by default; it performs an L1 Data Cache flush
+ * upon selective VM entry instances. This should help to reduce the
+ * performance impact of the L1 data cache flush.
+ */
 module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
 
 static bool guest_state_valid(struct kvm_vcpu *vcpu);
@@ -342,18 +493,51 @@ static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bit
 
 void vmx_vmexit(void);
 
+/*
+ * 在以下使用vmarea (是指针):
+ *   - arch/x86/kvm/vmx/vmx.c|2124| <<hardware_enable>> u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+ *   - arch/x86/kvm/vmx/vmx.c|2482| <<free_kvm_area>> free_vmcs(per_cpu(vmxarea, cpu));
+ *   - arch/x86/kvm/vmx/vmx.c|2483| <<free_kvm_area>> per_cpu(vmxarea, cpu) = NULL;
+ *   - arch/x86/kvm/vmx/vmx.c|2513| <<alloc_kvm_area>> per_cpu(vmxarea, cpu) = vmcs;
+ */
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
+/*
+ * 在以下使用current_vmcs (是指针):
+ *   - arch/x86/kvm/vmx/vmcs.h|25| <<global>> DECLARE_PER_CPU(struct vmcs *, current_vmcs);
+ *   - arch/x86/kvm/vmx/vmx.c|346| <<global>> DEFINE_PER_CPU(struct vmcs *, current_vmcs);
+ *   - arch/x86/kvm/vmx/evmcs.h|18| <<current_evmcs>> #define current_evmcs ((struct hv_enlightened_vmcs *)this_cpu_read(current_vmcs))
+ *   - arch/x86/kvm/vmx/vmx.c|613| <<__loaded_vmcs_clear>> if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
+ *   - arch/x86/kvm/vmx/vmx.c|614| <<__loaded_vmcs_clear>> per_cpu(current_vmcs, cpu) = NULL;
+ *   - arch/x86/kvm/vmx/vmx.c|1261| <<vmx_vcpu_load>> if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) {
+ *   - arch/x86/kvm/vmx/vmx.c|1262| <<vmx_vcpu_load>> per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs;
+ */
 DEFINE_PER_CPU(struct vmcs *, current_vmcs);
 /*
  * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
  * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
  */
+/*
+ * 在以下使用loaded_vmcss_on_cpu:
+ *   - arch/x86/kvm/vmx/vmx.c|600| <<crash_vmclear_local_loaded_vmcss>> list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
+ *   - arch/x86/kvm/vmx/vmx.c|1257| <<vmx_vcpu_load>> &per_cpu(loaded_vmcss_on_cpu, cpu));
+ *   - arch/x86/kvm/vmx/vmx.c|2161| <<vmclear_local_loaded_vmcss>> list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu),
+ *   - arch/x86/kvm/vmx/vmx.c|8241| <<vmx_init>> INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
+ *
+ * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
+ * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
+ */
 static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu);
 
 /*
  * We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we
  * can find which vCPU should be waken up.
  */
+/*
+ * 在以下使用blocked_vcpu_on_cpu:
+ *   - arch/x86/kvm/vmx/vmx.c|5407| <<wakeup_handler>> list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
+ *   - arch/x86/kvm/vmx/vmx.c|7685| <<pi_pre_block>> &per_cpu(blocked_vcpu_on_cpu,
+ *   - arch/x86/kvm/vmx/vmx.c|8327| <<vmx_init>> INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
+ */
 static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
 static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
 
@@ -371,6 +555,16 @@ struct vmx_capability vmx_capability;
 		.ar_bytes = GUEST_##seg##_AR_BYTES,	   	\
 	}
 
+/*
+ * 在以下使用kvm_vmx_segment_fields[]:
+ *   - arch/x86/kvm/vmx/vmx.c|749| <<vmx_read_guest_seg_selector>> *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector);
+ *   - arch/x86/kvm/vmx/vmx.c|758| <<vmx_read_guest_seg_base>> *p = vmcs_readl(kvm_vmx_segment_fields[seg].base);
+ *   - arch/x86/kvm/vmx/vmx.c|767| <<vmx_read_guest_seg_limit>> *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit);
+ *   - arch/x86/kvm/vmx/vmx.c|776| <<vmx_read_guest_seg_ar>> *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes);
+ *   - arch/x86/kvm/vmx/vmx.c|2664| <<fix_rmode_seg>> const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+ *   - arch/x86/kvm/vmx/vmx.c|3138| <<vmx_set_segment>> const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+ *   - arch/x86/kvm/vmx/vmx.c|3481| <<seg_setup>> const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+ */
 static const struct kvm_vmx_segment_field {
 	unsigned selector;
 	unsigned base;
@@ -387,6 +581,19 @@ static const struct kvm_vmx_segment_field {
 	VMX_SEGMENT_FIELD(LDTR),
 };
 
+/*
+ * 在以下使用host_efer:
+ *   - arch/x86/kvm/vmx/nested.c|2116| <<prepare_vmcs02_early>> if (guest_efer != host_efer)
+ *   - arch/x86/kvm/vmx/nested.c|2129| <<prepare_vmcs02_early>> if (cpu_has_load_ia32_efer() && guest_efer != host_efer)
+ *   - arch/x86/kvm/vmx/nested.c|3840| <<nested_vmx_get_vmcs01_guest_efer>> return host_efer;
+ *   - arch/x86/kvm/vmx/nested.c|3851| <<nested_vmx_get_vmcs01_guest_efer>> return host_efer;
+ *   - arch/x86/kvm/vmx/vmx.c|1007| <<update_transition_efer>> (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) {
+ *   - arch/x86/kvm/vmx/vmx.c|1010| <<update_transition_efer>> if (guest_efer != host_efer)
+ *   - arch/x86/kvm/vmx/vmx.c|1012| <<update_transition_efer>> guest_efer, host_efer, false);
+ *   - arch/x86/kvm/vmx/vmx.c|1020| <<update_transition_efer>> guest_efer |= host_efer & ignore_bits;
+ *   - arch/x86/kvm/vmx/vmx.c|3925| <<vmx_set_constant_host_state>> vmcs_write64(HOST_IA32_EFER, host_efer);
+ *   - arch/x86/kvm/vmx/vmx.c|7924| <<hardware_setup>> rdmsrl_safe(MSR_EFER, &host_efer);
+ */
 u64 host_efer;
 
 /*
@@ -492,6 +699,11 @@ static int hv_remote_flush_tlb(struct kvm *kvm)
  * Refer from
  * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp
  */
+/*
+ * 在以下使用vmx_preemption_cpu_tfms[]:
+ *   - arch/x86/kvm/vmx/vmx.c|645| <<cpu_has_broken_vmx_preemption_timer>> for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++)
+ *   - arch/x86/kvm/vmx/vmx.c|646| <<cpu_has_broken_vmx_preemption_timer>> if (eax == vmx_preemption_cpu_tfms[i])
+ */
 static u32 vmx_preemption_cpu_tfms[] = {
 /* 323344.pdf - BA86   - D0 - Xeon 7500 Series */
 0x000206E6,
@@ -522,6 +734,10 @@ static u32 vmx_preemption_cpu_tfms[] = {
 0x000306A8,
 };
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|2439| <<setup_vmcs_config>> if (cpu_has_broken_vmx_preemption_timer())
+ */
 static inline bool cpu_has_broken_vmx_preemption_timer(void)
 {
 	u32 eax = cpuid_eax(0x00000001), i;
@@ -540,8 +756,24 @@ static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu)
 	return flexpriority_enabled && lapic_in_kernel(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.
+ */
 static inline bool report_flexpriority(void)
 {
+	/*
+	 * 在以下设置flexpriority_enabled:
+	 *   - module默认是1
+	 *   - arch/x86/kvm/vmx/vmx.c|7989| <<hardware_setup>> flexpriority_enabled = 0;
+	 * 在以下使用flexpriority_enabled:
+	 *   - arch/x86/kvm/vmx/vmx.c|86| <<global>> module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
+	 *   - arch/x86/kvm/vmx/nested.c|5775| <<nested_vmx_setup_ctls_msrs>> if (flexpriority_enabled)
+	 *   - arch/x86/kvm/vmx/vmx.c|654| <<cpu_need_virtualize_apic_accesses>> return flexpriority_enabled && lapic_in_kernel(vcpu);
+	 *   - arch/x86/kvm/vmx/vmx.c|659| <<report_flexpriority>> return flexpriority_enabled;
+	 *   - arch/x86/kvm/vmx/vmx.c|6127| <<vmx_set_virtual_apic_mode>> if (!flexpriority_enabled &&
+	 *   - arch/x86/kvm/vmx/vmx.c|6147| <<vmx_set_virtual_apic_mode>> if (flexpriority_enabled) {
+	 *   - arch/x86/kvm/vmx/vmx.c|7999| <<hardware_setup>> if (!flexpriority_enabled)
+	 */
 	return flexpriority_enabled;
 }
 
@@ -565,6 +797,11 @@ struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
 	return NULL;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|2190| <<vmx_set_msr>> ret = vmx_set_guest_msr(vmx, msr, data);
+ *   - arch/x86/kvm/vmx/vmx.c|7367| <<vmx_cpuid_update>> vmx_set_guest_msr(vmx, msr, enabled ? 0 : TSX_CTRL_RTM_DISABLE);
+ */
 static int vmx_set_guest_msr(struct vcpu_vmx *vmx, struct shared_msr_entry *msr, u64 data)
 {
 	int ret = 0;
@@ -584,6 +821,11 @@ static int vmx_set_guest_msr(struct vcpu_vmx *vmx, struct shared_msr_entry *msr,
 
 void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
 {
+	/*
+	 * struct loaded_vmcs:
+	 * -> struct vmcs *vmcs;
+	 * -> struct vmcs *shadow_vmcs;
+	 */
 	vmcs_clear(loaded_vmcs->vmcs);
 	if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
 		vmcs_clear(loaded_vmcs->shadow_vmcs);
@@ -692,6 +934,19 @@ static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg)
 	return *p;
 }
 
+/*
+ * The exception bitmap is a 32-bit field that contains one bit for each
+ * exception. When an exception occurs, its vector is used to select a bit in
+ * this field. If the bit is 1, the exception causes a VM exit. If the bit is
+ * 0, the exception is delivered normally through the IDT, using the descriptor
+ * corresponding to the exception’s vector.  Whether a page fault (exception
+ * with vector 14) causes a VM exit is determined by bit 14 in the exception
+ * bitmap as well as the error code produced by the page fault and two 32-bit
+ * fields in the VMCS (the page-fault error-code mask and page-fault error-code
+ * match). See Section 25.2 for details.
+ *
+ * struct kvm_x86_ops vmx_x86_ops.update_bp_intercept = update_exception_bitmap()
+ */
 void update_exception_bitmap(struct kvm_vcpu *vcpu)
 {
 	u32 eb;
@@ -1029,6 +1284,9 @@ static void pt_guest_exit(struct vcpu_vmx *vmx)
 	wrmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.prepare_guest_switch = vmx_prepare_switch_to_guest()
+ */
 void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -1236,6 +1494,14 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
  * Switches to specified vcpu, until a matching vcpu_put(), but assumes
  * vcpu mutex is already taken.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|268| <<vmx_switch_vmcs>> vmx_vcpu_load(vcpu, cpu);
+ *   - arch/x86/kvm/vmx/vmx.c|7450| <<vmx_create_vcpu>> vmx_vcpu_load(&vmx->vcpu, cpu);
+ *   - arch/x86/kvm/x86.c|3325| <<kvm_arch_vcpu_load>> kvm_x86_ops->vcpu_load(vcpu, cpu);
+ *
+ * struct kvm_x86_ops vmx_x86_ops.vcpu_load = vmx_vcpu_load()
+ */
 void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -1316,6 +1582,9 @@ static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
 		pi_set_sn(pi_desc);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vcpu_put = vmx_vcpu_put()
+ */
 void vmx_vcpu_put(struct kvm_vcpu *vcpu)
 {
 	vmx_vcpu_pi_put(vcpu);
@@ -1330,6 +1599,9 @@ static bool emulation_required(struct kvm_vcpu *vcpu)
 
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_rflags = vmx_get_rflags()
+ */
 unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
 {
 	unsigned long rflags, save_rflags;
@@ -1347,6 +1619,9 @@ unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
 	return to_vmx(vcpu)->rflags;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_rflags = vmx_set_rflags()
+ */
 void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 {
 	unsigned long old_rflags = vmx_get_rflags(vcpu);
@@ -1363,6 +1638,9 @@ void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 		to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_interrupt_shadow = vmx_get_interrupt_shadow()
+ */
 u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
 {
 	u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
@@ -1376,6 +1654,9 @@ u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
 	return ret;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_interrupt_shadow = vmx_set_interrupt_shadow()
+ */
 void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
 {
 	u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
@@ -1465,6 +1746,9 @@ static int vmx_rtit_ctl_check(struct kvm_vcpu *vcpu, u64 data)
 }
 
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.skip_emulated_instruction()
+ */
 static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
 {
 	unsigned long rip;
@@ -1528,11 +1812,17 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu)
 	vmx_clear_hlt(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.rdtscp_supported = vmx_rdtscp_supported()
+ */
 static bool vmx_rdtscp_supported(void)
 {
 	return cpu_has_vmx_rdtscp();
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.invpcid_supported = vmx_invpcid_supportted()
+ */
 static bool vmx_invpcid_supported(void)
 {
 	return cpu_has_vmx_invpcid();
@@ -1594,6 +1884,9 @@ static void setup_msrs(struct vcpu_vmx *vmx)
 		vmx_update_msr_bitmap(&vmx->vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.read_l1_tsc_offset = vmx_read_l1_tsc_offset()
+ */
 static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
 {
 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
@@ -1605,6 +1898,9 @@ static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
 	return vcpu->arch.tsc_offset;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.write_l1_tsc_offset = vmx_write_l1_tsc_offset()
+ */
 static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
@@ -1646,6 +1942,9 @@ static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
 	return !(val & ~valid_bits);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_msr_feature = vmx_get_msr_feature()
+ */
 static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
 {
 	switch (msr->index) {
@@ -1665,6 +1964,9 @@ static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
  * Returns 0 on success, non-0 otherwise.
  * Assumes vcpu_load() was already called.
  */
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_msr = vmx_get_msr()
+ */
 static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -1817,6 +2119,9 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
  * Returns 0 on success, non-0 otherwise.
  * Assumes vcpu_load() was already called.
  */
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_msr = vmx_set_msr()
+ */
 static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -2059,6 +2364,9 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 	return ret;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.cache_reg = vmx_cache_reg()
+ */
 static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
 {
 	__set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail);
@@ -2078,11 +2386,17 @@ static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.cpu_has_kvm_support = cpu_has_kvm_support()
+ */
 static __init int cpu_has_kvm_support(void)
 {
 	return cpu_has_vmx();
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.disabled_by_bios =
+ */
 static __init int vmx_disabled_by_bios(void)
 {
 	u64 msr;
@@ -2118,6 +2432,9 @@ static void kvm_cpu_vmxon(u64 addr)
 	asm volatile ("vmxon %0" : : "m"(addr));
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.hardware_enable = hardware_enable()
+ */
 static int hardware_enable(void)
 {
 	int cpu = raw_smp_processor_id();
@@ -2175,6 +2492,9 @@ static void kvm_cpu_vmxoff(void)
 	cr4_clear_bits(X86_CR4_VMXE);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.hardware_disable = hardware_disable()
+ */
 static void hardware_disable(void)
 {
 	vmclear_local_loaded_vmcss();
@@ -2200,6 +2520,11 @@ static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|7430| <<vmx_check_processor_compat>> if (setup_vmcs_config(&vmcs_conf, &vmx_cap) < 0)
+ *   - arch/x86/kvm/vmx/vmx.c|8382| <<hardware_setup>> if (setup_vmcs_config(&vmcs_config, &vmx_capability) < 0)
+ */
 static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
 				    struct vmx_capability *vmx_cap)
 {
@@ -2211,6 +2536,34 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
 	u32 _vmexit_control = 0;
 	u32 _vmentry_control = 0;
 
+	/*
+	 * 新的kernel已经使用CPU_BASED_UNCOND_IO_EXITING(bit 24)了. 以前使用bit
+	 * 25, 需要配置必要的bitmap. 自从以下的patch后就是unconditional的io
+	 * trap了.
+	 *
+	 * 关于io exiting
+	 *
+	 * commit 8eb73e2d410f00d383023fe41c0c25c6195b7389
+	 * Author: Quan Xu <quan.xu0@gmail.com>
+	 * Date:   Tue Dec 12 16:44:21 2017 +0800
+	 *
+	 * KVM: VMX: drop I/O permission bitmaps
+	 *
+	 * Since KVM removes the only I/O port 0x80 bypass on Intel hosts,
+	 * clear CPU_BASED_USE_IO_BITMAPS and set CPU_BASED_UNCOND_IO_EXITING
+	 * bit. Then these I/O permission bitmaps are not used at all, so
+	 * drop I/O permission bitmaps.
+	 *
+	 * Signed-off-by: Jim Mattson <jmattson@google.com>
+	 * Signed-off-by: Radim KrÄmář <rkrcmar@redhat.com>
+	 * Signed-off-by: Quan Xu <quan.xu0@gmail.com>
+	 * Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+	 *
+	 *
+	 * 在这之前, 是在commit d59d51f08801 ("KVM: VMX: remove I/O port
+	 * 0x80 bypass on Intel hosts")中移除的port 0x80.
+	 */
+
 	memset(vmcs_conf, 0, sizeof(*vmcs_conf));
 	min = CPU_BASED_HLT_EXITING |
 #ifdef CONFIG_X86_64
@@ -2428,6 +2781,30 @@ void free_vmcs(struct vmcs *vmcs)
 /*
  * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded
  */
+/*
+ * free_loaded_vmcs
+ * kvm_arch_vcpu_free
+ * kvm_arch_destroy_vm
+ * kvm_put_kvm
+ * kvm_vm_release
+ * __fput
+ * ____fput
+ * task_work_run
+ * do_exit
+ * do_group_exit
+ * get_signal
+ * do_signal
+ * exit_to_usermode_loop
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|254| <<free_nested>> free_loaded_vmcs(&vmx->nested.vmcs02);
+ *   - arch/x86/kvm/vmx/nested.c|4308| <<enter_vmx_operation>> free_loaded_vmcs(&vmx->nested.vmcs02);
+ *   - arch/x86/kvm/vmx/vmx.c|2826| <<alloc_loaded_vmcs>> free_loaded_vmcs(loaded_vmcs);
+ *   - arch/x86/kvm/vmx/vmx.c|7395| <<vmx_free_vcpu>> free_loaded_vmcs(vmx->loaded_vmcs);
+ *   - arch/x86/kvm/vmx/vmx.c|7506| <<vmx_create_vcpu>> free_loaded_vmcs(vmx->loaded_vmcs);
+ */
 void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
 {
 	if (!loaded_vmcs->vmcs)
@@ -2510,6 +2887,13 @@ static __init int alloc_kvm_area(void)
 		if (static_branch_unlikely(&enable_evmcs))
 			vmcs->hdr.revision_id = vmcs_config.revision_id;
 
+		/*
+		 * 在以下使用vmarea (是指针):
+		 *   - arch/x86/kvm/vmx/vmx.c|2124| <<hardware_enable>> u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+		 *   - arch/x86/kvm/vmx/vmx.c|2482| <<free_kvm_area>> free_vmcs(per_cpu(vmxarea, cpu));
+		 *   - arch/x86/kvm/vmx/vmx.c|2483| <<free_kvm_area>> per_cpu(vmxarea, cpu) = NULL;
+		 *   - arch/x86/kvm/vmx/vmx.c|2513| <<alloc_kvm_area>> per_cpu(vmxarea, cpu) = vmcs;
+		 */
 		per_cpu(vmxarea, cpu) = vmcs;
 	}
 	return 0;
@@ -2656,6 +3040,9 @@ static void enter_rmode(struct kvm_vcpu *vcpu)
 	kvm_mmu_reset_context(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_efer = vmx_set_efer()
+ */
 void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -2703,6 +3090,9 @@ static void exit_lmode(struct kvm_vcpu *vcpu)
 
 #endif
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.tlb_flush_gva = vmx_flush_tlb_gva()
+ */
 static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
 {
 	int vpid = to_vmx(vcpu)->vpid;
@@ -2717,6 +3107,9 @@ static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
 	 */
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.decache_cr0_guest_bits =
+ */
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
 	ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -2725,6 +3118,9 @@ static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 	vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.deache_cr3 = vmx_decache_cr3()
+ */
 static void vmx_decache_cr3(struct kvm_vcpu *vcpu)
 {
 	if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu)))
@@ -2732,6 +3128,9 @@ static void vmx_decache_cr3(struct kvm_vcpu *vcpu)
 	__set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.decache_cr4_guest_bits =
+ */
 static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
 {
 	ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits;
@@ -2801,6 +3200,9 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
 		*hw_cr0 &= ~X86_CR0_WP;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_cr0 = vmx_set_cr0()
+ */
 void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -2839,6 +3241,9 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 	vmx->emulation_required = emulation_required(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_tdp_level = get_ept_level()
+ */
 static int get_ept_level(struct kvm_vcpu *vcpu)
 {
 	/* Nested EPT currently only supports 4-level walks. */
@@ -2863,6 +3268,10 @@ u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
 	return eptp;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_cr3 = vmxe_set_cr3()
+ * struct kvm_x86_ops vmx_x86_ops.set_tdp_cr3 = vmx_set_cr3()
+ */
 void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 {
 	struct kvm *kvm = vcpu->kvm;
@@ -2882,6 +3291,11 @@ void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 			spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
 		}
 
+		/*
+		 * enable_unrestricted_guest:
+		 * This control determines whether guest software may
+		 * run in unpaged protected mode or in real-address mode.
+		 */
 		if (enable_unrestricted_guest || is_paging(vcpu) ||
 		    is_guest_mode(vcpu))
 			guest_cr3 = kvm_read_cr3(vcpu);
@@ -2893,6 +3307,9 @@ void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 	vmcs_writel(GUEST_CR3, guest_cr3);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_cr4 = vmx_set_cr4()
+ */
 int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
 	/*
@@ -2968,6 +3385,9 @@ int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_segment = vmx_get_segment()
+ */
 void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3004,6 +3424,9 @@ void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
 	var->g = (ar >> 15) & 1;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_segment_base = vmx_gey_segment_base()
+ */
 static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
 {
 	struct kvm_segment s;
@@ -3015,6 +3438,9 @@ static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
 	return vmx_read_guest_seg_base(to_vmx(vcpu), seg);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_cpl = vmx_get_cpl()
+ */
 int vmx_get_cpl(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3047,6 +3473,9 @@ static u32 vmx_segment_access_rights(struct kvm_segment *var)
 	return ar;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_segment = vmx_set_segment()
+ */
 void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3087,6 +3516,9 @@ void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
 	vmx->emulation_required = emulation_required(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_cs_db_l_bits = 
+ */
 static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
 {
 	u32 ar = vmx_read_guest_seg_ar(to_vmx(vcpu), VCPU_SREG_CS);
@@ -3095,24 +3527,36 @@ static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
 	*l = (ar >> 13) & 1;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_idt = vmx_get_idt()
+ */
 static void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
 {
 	dt->size = vmcs_read32(GUEST_IDTR_LIMIT);
 	dt->address = vmcs_readl(GUEST_IDTR_BASE);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_idt = vmx_set_idt()
+ */
 static void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
 {
 	vmcs_write32(GUEST_IDTR_LIMIT, dt->size);
 	vmcs_writel(GUEST_IDTR_BASE, dt->address);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_gdt = vmx_get_gdt()
+ */
 static void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
 {
 	dt->size = vmcs_read32(GUEST_GDTR_LIMIT);
 	dt->address = vmcs_readl(GUEST_GDTR_BASE);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_gdt = vmx_set_gdt()
+ */
 static void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
 {
 	vmcs_write32(GUEST_GDTR_LIMIT, dt->size);
@@ -3624,11 +4068,17 @@ void pt_update_intercept_for_msr(struct vcpu_vmx *vmx)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get)enable_apicv = vmx_get_enable_apicv()
+ */
 static bool vmx_get_enable_apicv(struct kvm_vcpu *vcpu)
 {
 	return enable_apicv;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_apic_has_interrupt = vmx_guest_apic_has_interrupt()
+ */
 static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3708,6 +4158,40 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
 	}
 	return -1;
 }
+/*
+ * If the "external-interrupt exiting" VM-execution control is 1, any unmasked
+ * external interrupt causes a VM exit. If the "process posted interrupts"
+ * VM-execution control is also 1, this behavior is changed and the processor
+ * handles an external interrupt as follows:
+ *
+ * 1. The local APIC is acknowledged; this provides the processor core with an
+ * interrupt vector, called here the "physical vector".
+ *
+ * 2. If the physical vector equals the posted-interrupt notification vector,
+ * the logical processor continues to the next step. Otherwise, a VM exit
+ * occurs as it would normally due to an external interrupt; the vector is
+ * saved in the VM-exit interruption-information field.
+ *
+ * 3. The processor clears the outstanding-notification bit in the
+ * posted-interrupt descriptor. This is done automatically as as to leave the
+ * reminder of the descriptor unmodified (e.g., with a locked AND operation).
+ *
+ * 4. The processor writes zero to the EOI register in the local APIC; this
+ * dismisses the interrupt with the posted-interrupt notification vector from
+ * the local APIC.
+ *
+ * 5. The logical processor performs a logical-OR of PIR into VIRR and clears
+ * PIR. No other agent can read or write a PIR bit (or group of bits) between
+ * the time it is read (to determine what to OR into VIRR) and when it is
+ * cleared.
+ *
+ * 6. The logical processor sets RVI to be the maximum of the old value of RVI
+ * and the highest index of all bits that were set in PIO; if no bits was set
+ * in PIR, RVI is left unmodified.
+ *
+ * 7. The logical processor evaluates pending virtual interrupts.
+ *
+ */
 /*
  * Send interrupt to vcpu via posted interrupt way.
  * 1. If target vcpu is running(non-root mode), send posted interrupt
@@ -3715,6 +4199,9 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
  * 2. If target vcpu isn't running(root mode), kick it to pick up the
  * interrupt from PIR in next vmentry.
  */
+/*
+ * struct kvm_x86_ops vmx_x86_ops.deliver_posted_interrupt = vmx_deliter_posted_interrupt()
+ */
 static int vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3819,8 +4306,23 @@ void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
 	vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|4198| <<vmx_refresh_apicv_exec_ctrl>> vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
+ *   - arch/x86/kvm/vmx/vmx.c|4400| <<vmx_vcpu_setup>> vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
+ */
 static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
 {
+	/*
+	 * 在以下使用vmcx_config->vmcs_config:
+	 *   - arch/x86/kvm/vmx/capabilities.h|74| <<cpu_has_virtual_nmis>> return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
+	 *   - arch/x86/kvm/vmx/capabilities.h|79| <<cpu_has_vmx_preemption_timer>> return vmcs_config.pin_based_exec_ctrl &
+	 *   - arch/x86/kvm/vmx/capabilities.h|86| <<cpu_has_vmx_posted_intr>> vmcs_config.pin_based_exec_ctrl & PIN_BASED_POSTED_INTR;
+	 *   - arch/x86/kvm/vmx/evmcs.c|299| <<evmcs_sanitize_exec_ctrls>> vmcs_conf->pin_based_exec_ctrl &= ~EVMCS1_UNSUPPORTED_PINCTRL;
+	 *   - arch/x86/kvm/vmx/nested.c|2016| <<prepare_vmcs02_early>> exec_control |= vmcs_config.pin_based_exec_ctrl;
+	 *   - arch/x86/kvm/vmx/vmx.c|2613| <<setup_vmcs_config>> vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+	 *   - arch/x86/kvm/vmx/vmx.c|4159| <<vmx_pin_based_exec_ctrl>> u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
+	 */
 	u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
 
 	if (!kvm_vcpu_apicv_active(&vmx->vcpu))
@@ -3834,6 +4336,9 @@ static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
 	return pin_based_exec_ctrl;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl()
+ */
 static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -4023,6 +4528,10 @@ static void ept_set_mmio_spte_mask(void)
 /*
  * Sets up the vmcs for emulated real mode.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|7324| <<vmx_create_vcpu>> vmx_vcpu_setup(vmx);
+ */
 static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
 {
 	int i;
@@ -4144,6 +4653,9 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vcpu_reset = vmx_vcpu_reset()
+ */
 static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -4240,12 +4752,18 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 		vmx_clear_hlt(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.enable_irq_window = enable_irq_window()
+ */
 static void enable_irq_window(struct kvm_vcpu *vcpu)
 {
 	vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
 		      CPU_BASED_VIRTUAL_INTR_PENDING);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.enable_nmi_window = enable_nmi_window()
+ */
 static void enable_nmi_window(struct kvm_vcpu *vcpu)
 {
 	if (!enable_vnmi ||
@@ -4258,6 +4776,9 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
 		      CPU_BASED_VIRTUAL_NMI_PENDING);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_irq = vmx_inject_irq()
+ */
 static void vmx_inject_irq(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -4287,6 +4808,9 @@ static void vmx_inject_irq(struct kvm_vcpu *vcpu)
 	vmx_clear_hlt(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_nmi = vmx_inject_nmi()
+ */
 static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -4383,6 +4907,9 @@ static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
 			(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_tss_addr = vmx_set_tss_addr()
+ */
 static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
 {
 	int ret;
@@ -4398,6 +4925,9 @@ static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
 	return init_rmode_tss(kvm);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_identify_map_addr = vmx_set_identity_map_addr()
+ */
 static int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
 {
 	to_kvm_vmx(kvm)->ept_identity_map_addr = ident_addr;
@@ -4627,6 +5157,9 @@ static int handle_io(struct kvm_vcpu *vcpu)
 	return kvm_fast_pio(vcpu, size, port, in);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.patch_hypercall = vmx_patch_hypercall()
+ */
 static void
 vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
 {
@@ -4839,15 +5372,24 @@ static int handle_dr(struct kvm_vcpu *vcpu)
 	return kvm_skip_emulated_instruction(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_dr6 = vmx_get_dr6()
+ */
 static u64 vmx_get_dr6(struct kvm_vcpu *vcpu)
 {
 	return vcpu->arch.dr6;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_dr6 = vmx_set_dr6()
+ */
 static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
 {
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.sync_dirty_debug_regs = vmx_sync_dirty_debug_regs()
+ */
 static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
 {
 	get_debugreg(vcpu->arch.db[0], 0);
@@ -4861,6 +5403,9 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
 	vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL, CPU_BASED_MOV_DR_EXITING);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_dr7 = vmx_set_dr7()
+ */
 static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
 {
 	vmcs_writel(GUEST_DR7, val);
@@ -5261,6 +5806,10 @@ static void grow_ple_window(struct kvm_vcpu *vcpu)
 	trace_kvm_ple_window_grow(vcpu->vcpu_id, vmx->ple_window, old);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|7625| <<vmx_sched_in>> shrink_ple_window(vcpu);
+ */
 static void shrink_ple_window(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -5570,6 +6119,9 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
 static const int kvm_vmx_max_exit_handlers =
 	ARRAY_SIZE(kvm_vmx_exit_handlers);
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_exit_info = vmx_get_exit_info()
+ */
 static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
 {
 	*info1 = vmcs_readl(EXIT_QUALIFICATION);
@@ -5786,6 +6338,9 @@ void dump_vmcs(void)
  * The guest has exited.  See if we can fix it or if we need userspace
  * assistance.
  */
+/*
+ * struct kvm_x86_ops vmx_x86_ops.handle_exit = vmx_handle_exit()
+ */
 static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -5813,6 +6368,15 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 
 	if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
 		dump_vmcs();
+		/*
+		 * x86使用KVM_EXIT_INTERNAL_ERROR的地方:
+		 *   - arch/x86/kvm/svm.c|3938| <<task_switch_interception>> svm->vcpu.run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 *   - arch/x86/kvm/vmx/vmx.c|5040| <<handle_exception>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 *   - arch/x86/kvm/vmx/vmx.c|5606| <<handle_task_switch>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 *   - arch/x86/kvm/vmx/vmx.c|5764| <<handle_invalid_guest_state>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 *   - arch/x86/kvm/vmx/vmx.c|6373| <<vmx_handle_exit>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 *   - arch/x86/kvm/x86.c|6314| <<handle_emulation_failure>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		 */
 		vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
 		vcpu->run->fail_entry.hardware_entry_failure_reason
 			= exit_reason;
@@ -5953,6 +6517,9 @@ static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
 		: "eax", "ebx", "ecx", "edx");
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.update_cr8_intercept = update_cr8_intercept()
+ */
 static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
 {
 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
@@ -5969,6 +6536,9 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
 	vmcs_write32(TPR_THRESHOLD, irr);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_virtual_apic_mode = vmx_set_virtual_apic_mode()
+ */
 void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
 {
 	u32 sec_exec_control;
@@ -6013,6 +6583,9 @@ void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
 	vmx_update_msr_bitmap(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_apic_access_page_addr = vmx_set_apic_access_page_addr()
+ */
 static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
 {
 	if (!is_guest_mode(vcpu)) {
@@ -6021,6 +6594,9 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.hwapic_isr_update = vmx_hwapic_isr_update()
+ */
 static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
 {
 	u16 status;
@@ -6055,6 +6631,13 @@ static void vmx_set_rvi(int vector)
 	}
 }
 
+/*
+ * 在以下使用:
+ *   - struct kvm_x86_ops vmx_x86_ops.hwapic_irr_update = vmx_hwapic_irr_update()
+ *   - arch/x86/kvm/vmx/vmx.c|6106| <<vmx_sync_pir_to_irr>> vmx_hwapic_irr_update(vcpu, max_irr);
+ *
+ * struct kvm_x86_ops vmx_x86_ops.hwapic_irr_update = vmx_hwapic_irr_update()
+ */
 static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
 {
 	/*
@@ -6069,6 +6652,15 @@ static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
 		vmx_set_rvi(max_irr);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|709| <<apic_has_interrupt_for_ppr>> highest_irr = kvm_x86_ops->sync_pir_to_irr(apic->vcpu);
+ *   - arch/x86/kvm/x86.c|3408| <<kvm_vcpu_ioctl_get_lapic>> kvm_x86_ops->sync_pir_to_irr(vcpu);
+ *   - arch/x86/kvm/x86.c|7663| <<vcpu_scan_ioapic>> kvm_x86_ops->sync_pir_to_irr(vcpu);
+ *   - arch/x86/kvm/x86.c|7926| <<vcpu_enter_guest>> kvm_x86_ops->sync_pir_to_irr(vcpu);
+ *
+ * struct kvm_x86_ops vmx_x86_ops.sync_pir_to_irr = vmx_sync_pir_to_irr()
+ */
 static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -6107,11 +6699,17 @@ static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 	return max_irr;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt()
+ */
 static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
 {
 	return pi_test_on(vcpu_to_pi_desc(vcpu));
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.load_eoi_exitmap = vmx_load_eoi_exitmap()
+ */
 static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 {
 	if (!kvm_vcpu_apicv_active(vcpu))
@@ -6123,6 +6721,9 @@ static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 	vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.apicv_post_state_restore = vmx_apicv_post_state_restore()
+ */
 static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -6161,6 +6762,9 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.handle_external_intr = vmx_handle_external_intr()
+ */
 static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
 {
 	u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
@@ -6202,6 +6806,9 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
 }
 STACK_FRAME_NON_STANDARD(vmx_handle_external_intr);
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.has_emulated_msr = vmx_has_emulated_msr()
+ */
 static bool vmx_has_emulated_msr(int index)
 {
 	switch (index) {
@@ -6219,6 +6826,9 @@ static bool vmx_has_emulated_msr(int index)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pt_supported = vmx_pt_supported()
+ */
 static bool vmx_pt_supported(void)
 {
 	return pt_mode == PT_MODE_HOST_GUEST;
@@ -6267,6 +6877,11 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
 					      vmx->loaded_vmcs->entry_time));
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|6326| <<vmx_complete_interrupts>> __vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
+ *   - arch/x86/kvm/vmx/vmx.c|6333| <<vmx_cancel_injection>> __vmx_complete_interrupts(vcpu,
+ */
 static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
 				      u32 idt_vectoring_info,
 				      int instr_len_field,
@@ -6321,6 +6936,10 @@ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
 	}
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|6797| <<vmx_vcpu_run>> vmx_complete_interrupts(vmx);
+ */
 static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
 {
 	__vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
@@ -6356,26 +6975,62 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
 					msrs[i].host, false);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|6379| <<vmx_update_hv_timer>> vmx_arm_hv_timer(vmx, 0);
+ *   - arch/x86/kvm/vmx/vmx.c|6392| <<vmx_update_hv_timer>> vmx_arm_hv_timer(vmx, delta_tsc);
+ */
 static void vmx_arm_hv_timer(struct vcpu_vmx *vmx, u32 val)
 {
 	vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, val);
+	/*
+	 * 在以下使用loaded_vmcs->hv_timer_armed:
+	 *   - arch/x86/kvm/vmx/nested.c|2018| <<prepare_vmcs02_early>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 *   - arch/x86/kvm/vmx/vmx.c|6367| <<vmx_arm_hv_timer>> if (!vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6370| <<vmx_arm_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = true;
+	 *   - arch/x86/kvm/vmx/vmx.c|6420| <<vmx_update_hv_timer>> if (vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6423| <<vmx_update_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 */
 	if (!vmx->loaded_vmcs->hv_timer_armed)
 		vmcs_set_bits(PIN_BASED_VM_EXEC_CONTROL,
 			      PIN_BASED_VMX_PREEMPTION_TIMER);
 	vmx->loaded_vmcs->hv_timer_armed = true;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|6605| <<vmx_vcpu_run>> vmx_update_hv_timer(vcpu);
+ */
 static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 	u64 tscl;
 	u32 delta_tsc;
 
+	/*
+	 * 在以下设置vcpu_vmx->req_immediate_exit:
+	 *   - arch/x86/kvm/vmx/vmx.c|1043| <<vmx_prepare_switch_to_guest>> vmx->req_immediate_exit = false;
+	 *   - arch/x86/kvm/vmx/vmx.c|7147| <<vmx_request_immediate_exit>> to_vmx(vcpu)->req_immediate_exit = true;
+	 * 在以下使用vcpu_vmx->req_immediate_exit:
+	 *   - arch/x86/kvm/vmx/vmx.c|5484| <<handle_preemption_timer>> if (!to_vmx(vcpu)->req_immediate_exit)
+	 *   - arch/x86/kvm/vmx/vmx.c|6378| <<vmx_update_hv_timer>> if (vmx->req_immediate_exit) {
+	 */
 	if (vmx->req_immediate_exit) {
 		vmx_arm_hv_timer(vmx, 0);
 		return;
 	}
 
+	/*
+	 * 在以下使用vcpu_vmx->hv_deadline_tsc:
+	 *   - arch/x86/kvm/vmx/vmx.c|4040| <<vmx_vcpu_setup>> vmx->hv_deadline_tsc = -1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6383| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc != -1) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6385| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc > tscl)
+	 *   - arch/x86/kvm/vmx/vmx.c|6387| <<vmx_update_hv_timer>> delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+	 *   - arch/x86/kvm/vmx/vmx.c|7287| <<vmx_set_hv_timer>> vmx->hv_deadline_tsc = tscl + delta_tsc;
+	 *   - arch/x86/kvm/vmx/vmx.c|7293| <<vmx_cancel_hv_timer>> to_vmx(vcpu)->hv_deadline_tsc = -1;
+	 *
+	 * apic deadline value in host tsc
+	 */
 	if (vmx->hv_deadline_tsc != -1) {
 		tscl = rdtsc();
 		if (vmx->hv_deadline_tsc > tscl)
@@ -6389,6 +7044,14 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
 		return;
 	}
 
+	/*
+	 * 在以下使用loaded_vmcs->hv_timer_armed:
+	 *   - arch/x86/kvm/vmx/nested.c|2018| <<prepare_vmcs02_early>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 *   - arch/x86/kvm/vmx/vmx.c|6367| <<vmx_arm_hv_timer>> if (!vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6370| <<vmx_arm_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = true;
+	 *   - arch/x86/kvm/vmx/vmx.c|6420| <<vmx_update_hv_timer>> if (vmx->loaded_vmcs->hv_timer_armed)
+	 *   - arch/x86/kvm/vmx/vmx.c|6423| <<vmx_update_hv_timer>> vmx->loaded_vmcs->hv_timer_armed = false;
+	 */
 	if (vmx->loaded_vmcs->hv_timer_armed)
 		vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL,
 				PIN_BASED_VMX_PREEMPTION_TIMER);
@@ -6543,23 +7206,56 @@ static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
 }
 STACK_FRAME_NON_STANDARD(__vmx_vcpu_run);
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.run = vmx_vcpu_run()
+ */
 static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 	unsigned long cr3, cr4;
 
 	/* Record the guest's net vcpu time for enforced NMI injections. */
+	/*
+	 * 在以下设置loaded_vmcs->soft_vnmi_blocked:
+	 *   - arch/x86/kvm/vmx/vmx.c|4638| <<vmx_inject_nmi>> vmx->loaded_vmcs->soft_vnmi_blocked = 1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6225| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+	 *   - arch/x86/kvm/vmx/vmx.c|6237| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+	 * 在以下使用loaded_vmcs->soft_vnmi_blocked:
+	 *   - arch/x86/kvm/vmx/vmx.c|4663| <<vmx_get_nmi_mask>> return vmx->loaded_vmcs->soft_vnmi_blocked;
+	 *   - arch/x86/kvm/vmx/vmx.c|4676| <<vmx_set_nmi_mask>> if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
+	 *   - arch/x86/kvm/vmx/vmx.c|4677| <<vmx_set_nmi_mask>> vmx->loaded_vmcs->soft_vnmi_blocked = masked;
+	 *   - arch/x86/kvm/vmx/vmx.c|4700| <<vmx_nmi_allowed>> to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
+	 *   - arch/x86/kvm/vmx/vmx.c|6223| <<vmx_handle_exit>> vmx->loaded_vmcs->soft_vnmi_blocked)) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6676| <<vmx_recover_nmi_blocking>> } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
+	 *   - arch/x86/kvm/vmx/vmx.c|7021| <<vmx_vcpu_run>> vmx->loaded_vmcs->soft_vnmi_blocked))
+	 */
 	if (unlikely(!enable_vnmi &&
 		     vmx->loaded_vmcs->soft_vnmi_blocked))
 		vmx->loaded_vmcs->entry_time = ktime_get();
 
 	/* Don't enter VMX if guest state is invalid, let the exit handler
 	   start emulation until we arrive back to a valid state */
+	/*
+	 * 在以下设置vcpu_vmx->emulation_required:
+	 *   - arch/x86/kvm/vmx/vmx.c|1530| <<vmx_set_rflags>> to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
+	 *   - arch/x86/kvm/vmx/vmx.c|3076| <<vmx_set_cr0>> vmx->emulation_required = emulation_required(vcpu);
+	 *   - arch/x86/kvm/vmx/vmx.c|3346| <<vmx_set_segment>> vmx->emulation_required = emulation_required(vcpu);
+	 */
 	if (vmx->emulation_required)
 		return;
 
 	if (vmx->ple_window_dirty) {
 		vmx->ple_window_dirty = false;
+		/*
+		 * Intel的cpu上,使用的VMM为kvm时,当guest的vcpu变为busy-waiting状态,
+		 * 也就是loop-wait状态,就会在一定情况下触发vmexit.
+		 *
+		 * 触发条件: 由于kvm中不会使能"PAUSE exiting"feature,因此单一的PAUSE指令
+		 * 不会导致vmexit,kvm中只使用"PAUSE-loop exiting" feature,即循环(loop-wait)
+		 * 中的PAUSE指令会导致vmexit,具体情境为:当一个循环中的两次PAUSE之间的时间差
+		 * 不超过PLE_gap常量,且该循环中某次PAUSE指令与第一次PAUSE指令的时间差超过了
+		 * PLE_window,那么就会产生一个vmexit,触发原因field会填为PAUSE指令.
+		 */
 		vmcs_write32(PLE_WINDOW, vmx->ple_window);
 	}
 
@@ -6700,17 +7396,26 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
 	vmx_complete_interrupts(vmx);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vm_alloc = vmx_vm_alloc()
+ */
 static struct kvm *vmx_vm_alloc(void)
 {
 	struct kvm_vmx *kvm_vmx = vzalloc(sizeof(struct kvm_vmx));
 	return &kvm_vmx->kvm;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vm_free = vmx_vm_free()
+ */
 static void vmx_vm_free(struct kvm *kvm)
 {
 	vfree(to_kvm_vmx(kvm));
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vcpu_free = vmx_free_vcpu()
+ */
 static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -6727,6 +7432,9 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
 	kmem_cache_free(kvm_vcpu_cache, vmx);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vcpu_create = vmx_create_vcpu()
+ */
 static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 {
 	int err;
@@ -6846,6 +7554,9 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 #define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
 #define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.vm_init = vmx_vm_init()
+ */
 static int vmx_vm_init(struct kvm *kvm)
 {
 	spin_lock_init(&to_kvm_vmx(kvm)->ept_pointer_lock);
@@ -6879,6 +7590,9 @@ static int vmx_vm_init(struct kvm *kvm)
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.check_processor_compatibility = 
+ */
 static void __init vmx_check_processor_compat(void *rtn)
 {
 	struct vmcs_config vmcs_conf;
@@ -6897,6 +7611,9 @@ static void __init vmx_check_processor_compat(void *rtn)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_mt_mask = vmx_get_mt_mask()
+ */
 static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
 {
 	u8 cache;
@@ -6939,6 +7656,9 @@ static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
 	return (cache << VMX_EPT_MT_EPTE_SHIFT) | ipat;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.get_lpage_level = vmx_get_lpage_level()
+ */
 static int vmx_get_lpage_level(void)
 {
 	if (enable_ept && !cpu_has_vmx_ept_1g_page())
@@ -7097,6 +7817,9 @@ static void update_intel_pt_cfg(struct kvm_vcpu *vcpu)
 		vmx->pt_desc.ctl_bitmask &= ~(0xfULL << (32 + i * 4));
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.cpuid_update = vmx_cpuid_update()
+ */
 static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -7132,12 +7855,18 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
 	}
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_supported_cpuid = vmx_set_supported_cpuid()
+ */
 static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
 {
 	if (func == 1 && nested)
 		entry->ecx |= bit(X86_FEATURE_VMX);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.request_immediate_exit = vmx_request_immediate_exit()
+ */
 static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu)
 {
 	to_vmx(vcpu)->req_immediate_exit = true;
@@ -7177,6 +7906,9 @@ static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,
 	return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.check_intercept = vmx_check_intercept()
+ */
 static int vmx_check_intercept(struct kvm_vcpu *vcpu,
 			       struct x86_instruction_info *info,
 			       enum x86_intercept_stage stage)
@@ -7244,11 +7976,67 @@ static inline int u64_shl_div_u64(u64 a, unsigned int shift,
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.set_hv_timer = vmx_set_hv_timer()
+ */
 static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc)
 {
 	struct vcpu_vmx *vmx;
 	u64 tscl, guest_tscl, delta_tsc, lapic_timer_advance_cycles;
 
+	/*
+	 * https://patchwork.kernel.org/project/kvm/patch/1523362546-20909-1-git-send-email-karahmed@amazon.de/
+	 *
+	 * The VMX-preemption timer is used by KVM as a way to set deadlines for the
+	 * guest (i.e. timer emulation). That was safe till very recently when
+	 * capability KVM_X86_DISABLE_EXITS_MWAIT to disable intercepting MWAIT was
+	 * introduced. According to Intel SDM 25.5.1:
+	 *
+	 * """
+	 * The VMX-preemption timer operates in the C-states C0, C1, and C2; it also
+	 * operates in the shutdown and wait-for-SIPI states. If the timer counts down
+	 * to zero in any state other than the wait-for SIPI state, the logical
+	 * processor transitions to the C0 C-state and causes a VM exit; the timer
+	 * does not cause a VM exit if it counts down to zero in the wait-for-SIPI
+	 * state. The timer is not decremented in C-states deeper than C2.
+	 * """
+	 *
+	 * Now once the guest issues the MWAIT with a c-state deeper than
+	 * C2 the preemption timer will never wake it up again since it stopped
+	 * ticking! Usually this is compensated by other activities in the system that
+	 * would wake the core from the deep C-state (and cause a VMExit). For
+	 * example, if the host itself is ticking or it received interrupts, etc!
+	 *
+	 * So disable the VMX-preemption timer if MWAIT is exposed to the guest!
+	 *
+	 * mwait穿透是否实现了
+	 *
+	 * 随便测试都是false
+	 *     mwait_in_guest = false,
+	 *     hlt_in_guest = false,
+	 *     pause_in_guest = false,
+	 *
+	 *
+	 * http://liujunming.top/2020/05/01/Introduction-to-halt-pause-monitor-mwait-instruction/
+	 *
+	 * monitor and mwait
+	 *
+	 * Executing the HLT instruction on a idle logical processor puts the
+	 * targeted processor in a non-execution state. This requires another
+	 * processor (when posting work for the halted logical processor) to
+	 * wake up the halted processor using an inter-processor interrupt. The
+	 * posting and servicing of such an interrupt introduces a delay in the
+	 * servicing of new work requests.
+	 *
+	 * MONITOR sets up an effective address range that is monitored for
+	 * write-to-memory activities; MWAIT places the processor in an
+	 * optimized state (this may vary between different implementations)
+	 * until a write to the monitored address range occurs.
+	 *
+	 * 引入了monitor 和 mwait指令后，避免了hlt导致的the posting and
+	 * servicing of such an interrupt introduces a delay in the servicing
+	 * of new work requests.
+	 */
 	if (kvm_mwait_in_guest(vcpu->kvm))
 		return -EOPNOTSUPP;
 
@@ -7280,22 +8068,53 @@ static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc)
 	if (delta_tsc >> (cpu_preemption_timer_multi + 32))
 		return -ERANGE;
 
+	/*
+	 * 在以下使用vcpu_vmx->hv_deadline_tsc:
+	 *   - arch/x86/kvm/vmx/vmx.c|4040| <<vmx_vcpu_setup>> vmx->hv_deadline_tsc = -1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6383| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc != -1) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6385| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc > tscl)
+	 *   - arch/x86/kvm/vmx/vmx.c|6387| <<vmx_update_hv_timer>> delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+	 *   - arch/x86/kvm/vmx/vmx.c|7287| <<vmx_set_hv_timer>> vmx->hv_deadline_tsc = tscl + delta_tsc;
+	 *   - arch/x86/kvm/vmx/vmx.c|7293| <<vmx_cancel_hv_timer>> to_vmx(vcpu)->hv_deadline_tsc = -1;
+	 *
+	 * apic deadline value in host tsc
+	 */
 	vmx->hv_deadline_tsc = tscl + delta_tsc;
 	return delta_tsc == 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.cancel_hv_timer = vmx_cancel_hv_timer()
+ */
 static void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * 在以下使用vcpu_vmx->hv_deadline_tsc:
+	 *   - arch/x86/kvm/vmx/vmx.c|4040| <<vmx_vcpu_setup>> vmx->hv_deadline_tsc = -1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6383| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc != -1) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6385| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc > tscl)
+	 *   - arch/x86/kvm/vmx/vmx.c|6387| <<vmx_update_hv_timer>> delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+	 *   - arch/x86/kvm/vmx/vmx.c|7287| <<vmx_set_hv_timer>> vmx->hv_deadline_tsc = tscl + delta_tsc;
+	 *   - arch/x86/kvm/vmx/vmx.c|7293| <<vmx_cancel_hv_timer>> to_vmx(vcpu)->hv_deadline_tsc = -1;
+	 *
+	 * apic deadline value in host tsc
+	 */
 	to_vmx(vcpu)->hv_deadline_tsc = -1;
 }
 #endif
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.sched_in = vmx_sched_in()
+ */
 static void vmx_sched_in(struct kvm_vcpu *vcpu, int cpu)
 {
 	if (!kvm_pause_in_guest(vcpu->kvm))
 		shrink_ple_window(vcpu);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.slot_enable_log_dirty = vmx_slot_enable_log_dirty()
+ */
 static void vmx_slot_enable_log_dirty(struct kvm *kvm,
 				     struct kvm_memory_slot *slot)
 {
@@ -7303,17 +8122,28 @@ static void vmx_slot_enable_log_dirty(struct kvm *kvm,
 	kvm_mmu_slot_largepage_remove_write_access(kvm, slot);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.slot_disable_log_dirty = vmx_slot_disable_log_dirty()
+ */
 static void vmx_slot_disable_log_dirty(struct kvm *kvm,
 				       struct kvm_memory_slot *slot)
 {
 	kvm_mmu_slot_set_dirty(kvm, slot);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.flush_log_dirty = vmx_flush_log_dirty()
+ */
 static void vmx_flush_log_dirty(struct kvm *kvm)
 {
 	kvm_flush_pml_buffers(kvm);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.write_log_dirty = vmx_write_pml_buffer()
+ *
+ * PML: Page Modification Logging
+ */
 static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
 {
 	struct vmcs12 *vmcs12;
@@ -7321,6 +8151,11 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
 	struct page *page = NULL;
 	u64 *pml_address;
 
+	/*
+	 * 在以下调用enter_guest_mode():
+	 *   - arch/x86/kvm/svm.c|3621| <<enter_svm_guest_mode>> enter_guest_mode(&svm->vcpu);
+	 *   - arch/x86/kvm/vmx/nested.c|3067| <<nested_vmx_enter_non_root_mode>> enter_guest_mode(vcpu);
+	 */
 	if (is_guest_mode(vcpu)) {
 		WARN_ON_ONCE(vmx->nested.pml_full);
 
@@ -7353,10 +8188,23 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.enable_log_dirty_pt_masked = vmx_enable_log_dirty_pt_masked()
+ */
 static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
 					   struct kvm_memory_slot *memslot,
 					   gfn_t offset, unsigned long mask)
 {
+	/*
+	 * kvm_mmu_clear_dirty_pt_masked - clear MMU D-bit for PT level pages, or write
+	 * protect the page if the D-bit isn't supported.
+	 * @kvm: kvm instance
+	 * @slot: slot to clear D-bit
+	 * @gfn_offset: start of the BITS_PER_LONG pages we care about
+	 * @mask: indicates which pages we should clear D-bit
+	 *
+	 * Used for PML to re-log the dirty GPAs after userspace querying dirty_bitmap.
+	 */
 	kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
 }
 
@@ -7461,11 +8309,26 @@ static int pi_pre_block(struct kvm_vcpu *vcpu)
 	return (vcpu->pre_pcpu == -1);
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pre_block = vmx_pre_block()
+ */
 static int vmx_pre_block(struct kvm_vcpu *vcpu)
 {
 	if (pi_pre_block(vcpu))
 		return 1;
 
+	/*
+	 * 在以下修改kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1765| <<cancel_hv_timer>> apic->lapic_timer.hv_timer_in_use = false;
+	 *   - arch/x86/kvm/lapic.c|1787| <<start_hv_timer>> ktimer->hv_timer_in_use = true;
+	 * 在以下使用kvm_timer->hv_timer_in_use:
+	 *   - arch/x86/kvm/lapic.c|1756| <<kvm_lapic_hv_timer_in_use>> return vcpu->arch.apic->lapic_timer.hv_timer_in_use;
+	 *   - arch/x86/kvm/lapic.c|1763| <<cancel_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 *   - arch/x86/kvm/lapic.c|1850| <<start_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1880| <<kvm_lapic_expired_hv_timer>> if (!apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1911| <<kvm_lapic_switch_to_sw_timer>> if (apic->lapic_timer.hv_timer_in_use)
+	 *   - arch/x86/kvm/lapic.c|1921| <<kvm_lapic_restart_hv_timer>> WARN_ON(!apic->lapic_timer.hv_timer_in_use);
+	 */
 	if (kvm_lapic_hv_timer_in_use(vcpu))
 		kvm_lapic_switch_to_sw_timer(vcpu);
 
@@ -7483,6 +8346,9 @@ static void pi_post_block(struct kvm_vcpu *vcpu)
 	local_irq_enable();
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.post_block = vmx_post_block()
+ */
 static void vmx_post_block(struct kvm_vcpu *vcpu)
 {
 	if (kvm_x86_ops->set_hv_timer)
@@ -7500,6 +8366,14 @@ static void vmx_post_block(struct kvm_vcpu *vcpu)
  * @set: set or unset PI
  * returns 0 on success, < 0 on failure
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|10004| <<kvm_arch_irq_bypass_add_producer>> return kvm_x86_ops->update_pi_irte(irqfd->kvm,
+ *   - arch/x86/kvm/x86.c|10024| <<kvm_arch_irq_bypass_del_producer>> ret = kvm_x86_ops->update_pi_irte(irqfd->kvm, prod->irq, irqfd->gsi, 0);
+ *   - arch/x86/kvm/x86.c|10036| <<kvm_arch_update_irqfd_routing>> return kvm_x86_ops->update_pi_irte(kvm, host_irq, guest_irq, set);
+ *
+ * struct kvm_x86_ops vmx_x86_ops.update_pi_irte = vmx_update_pi_irte()
+ */
 static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
 			      uint32_t guest_irq, bool set)
 {
@@ -7581,6 +8455,9 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
 	return ret;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.setup_mce = vmx_setup_mce()
+ */
 static void vmx_setup_mce(struct kvm_vcpu *vcpu)
 {
 	if (vcpu->arch.mcg_cap & MCG_LMCE_P)
@@ -7591,6 +8468,9 @@ static void vmx_setup_mce(struct kvm_vcpu *vcpu)
 			~FEATURE_CONTROL_LMCE;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.smi_allowed = vmx_smi_allowed()
+ */
 static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
 {
 	/* we need a nested vmexit to enter SMM, postpone if run is pending */
@@ -7599,6 +8479,9 @@ static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
 	return 1;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pre_enter_smm = vmx_pre_enter_smm()
+ */
 static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -7613,6 +8496,9 @@ static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.pre_leave_smm = vmx_pre_leave_smm()
+ */
 static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -7633,16 +8519,28 @@ static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.enable_smi_window = enable_smi_window()
+ */
 static int enable_smi_window(struct kvm_vcpu *vcpu)
 {
 	return 0;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.apic_init_signal_blocked = vmx_apic_init_signal_blocked()
+ */
 static bool vmx_apic_init_signal_blocked(struct kvm_vcpu *vcpu)
 {
 	return to_vmx(vcpu)->nested.vmxon;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9131| <<kvm_arch_hardware_setup>> r = kvm_x86_ops->hardware_setup();
+ *
+ * struct kvm_x86_ops vmx_x86_ops.hardware_setup = hardware_setup()
+ */
 static __init int hardware_setup(void)
 {
 	unsigned long host_bndcfgs;
@@ -7790,6 +8688,9 @@ static __init int hardware_setup(void)
 	return r;
 }
 
+/*
+ * struct kvm_x86_ops vmx_x86_ops.hardware_unsetup =
+ */
 static __exit void hardware_unsetup(void)
 {
 	if (nested)
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index c8817c05aad2..2452d2766963 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -229,6 +229,12 @@ struct vcpu_vmx {
 		} seg[8];
 	} segment_cache;
 	int vpid;
+	/*
+	 * 在以下设置vcpu_vmx->emulation_required:
+	 *   - arch/x86/kvm/vmx/vmx.c|1530| <<vmx_set_rflags>> to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
+	 *   - arch/x86/kvm/vmx/vmx.c|3076| <<vmx_set_cr0>> vmx->emulation_required = emulation_required(vcpu);
+	 *   - arch/x86/kvm/vmx/vmx.c|3346| <<vmx_set_segment>> vmx->emulation_required = emulation_required(vcpu);
+	 */
 	bool emulation_required;
 
 	u32 exit_reason;
@@ -243,6 +249,14 @@ struct vcpu_vmx {
 	int ple_window;
 	bool ple_window_dirty;
 
+	/*
+	 * 在以下设置vcpu_vmx->req_immediate_exit:
+	 *   - arch/x86/kvm/vmx/vmx.c|1043| <<vmx_prepare_switch_to_guest>> vmx->req_immediate_exit = false;
+	 *   - arch/x86/kvm/vmx/vmx.c|7147| <<vmx_request_immediate_exit>> to_vmx(vcpu)->req_immediate_exit = true;
+	 * 在以下使用vcpu_vmx->req_immediate_exit:
+	 *   - arch/x86/kvm/vmx/vmx.c|5484| <<handle_preemption_timer>> if (!to_vmx(vcpu)->req_immediate_exit)
+	 *   - arch/x86/kvm/vmx/vmx.c|6378| <<vmx_update_hv_timer>> if (vmx->req_immediate_exit) {
+	 */
 	bool req_immediate_exit;
 
 	/* Support for PML */
@@ -250,6 +264,17 @@ struct vcpu_vmx {
 	struct page *pml_pg;
 
 	/* apic deadline value in host tsc */
+	/*
+	 * 在以下使用vcpu_vmx->hv_deadline_tsc:
+	 *   - arch/x86/kvm/vmx/vmx.c|4040| <<vmx_vcpu_setup>> vmx->hv_deadline_tsc = -1;
+	 *   - arch/x86/kvm/vmx/vmx.c|6383| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc != -1) {
+	 *   - arch/x86/kvm/vmx/vmx.c|6385| <<vmx_update_hv_timer>> if (vmx->hv_deadline_tsc > tscl)
+	 *   - arch/x86/kvm/vmx/vmx.c|6387| <<vmx_update_hv_timer>> delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+	 *   - arch/x86/kvm/vmx/vmx.c|7287| <<vmx_set_hv_timer>> vmx->hv_deadline_tsc = tscl + delta_tsc;
+	 *   - arch/x86/kvm/vmx/vmx.c|7293| <<vmx_cancel_hv_timer>> to_vmx(vcpu)->hv_deadline_tsc = -1;
+	 *
+	 * apic deadline value in host tsc
+	 */
 	u64 hv_deadline_tsc;
 
 	u64 current_tsc_ratio;
@@ -492,6 +517,11 @@ void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs);
 void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs);
 void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|4258| <<alloc_shadow_vmcs>> loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
+ *   - arch/x86/kvm/vmx/vmx.c|2445| <<alloc_loaded_vmcs>> loaded_vmcs->vmcs = alloc_vmcs(false);
+ */
 static inline struct vmcs *alloc_vmcs(bool shadow)
 {
 	return alloc_vmcs_cpu(shadow, raw_smp_processor_id());
@@ -512,6 +542,16 @@ static inline void __vmx_flush_tlb(struct kvm_vcpu *vcpu, int vpid,
 	}
 }
 
+/*
+ * 在以下使用vmx_flush_tlb():
+ *   - struct kvm_x86_ops vmx_x86_ops.tlb_flush = vmx_flush_tlb()
+ *   - arch/x86/kvm/vmx/nested.c|2368| <<prepare_vmcs02>> vmx_flush_tlb(vcpu, true);
+ *   - arch/x86/kvm/vmx/nested.c|4029| <<nested_vmx_vmexit>> vmx_flush_tlb(vcpu, true);
+ *   - arch/x86/kvm/vmx/vmx.c|6036| <<vmx_set_virtual_apic_mode>> vmx_flush_tlb(vcpu, true);
+ *   - arch/x86/kvm/vmx/vmx.c|6054| <<vmx_set_apic_access_page_addr>> vmx_flush_tlb(vcpu, true);
+ *
+ * struct kvm_x86_ops vmx_x86_ops.tlb_flush = vmx_flush_tlb()
+ */
 static inline void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
 {
 	__vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 242555889380..5e3c8a801ae3 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -138,6 +138,18 @@ static u32 __read_mostly tsc_tolerance_ppm = 250;
 module_param(tsc_tolerance_ppm, uint, S_IRUGO | S_IWUSR);
 
 /* lapic timer advance (tscdeadline mode only) in nanoseconds */
+/*
+ * 在以下使用lapic_timer_advance_ns:
+ *   - arch/x86/kvm/x86.c|142| <<global>> module_param(lapic_timer_advance_ns, uint, S_IRUGO | S_IWUSR);
+ *   - arch/x86/kvm/lapic.c|1584| <<wait_lapic_expire>> nsec_to_cycles(vcpu, lapic_timer_advance_ns)));
+ *   - arch/x86/kvm/lapic.c|1591| <<wait_lapic_expire>> lapic_timer_advance_ns -= min((unsigned int )ns,
+ *   - arch/x86/kvm/lapic.c|1592| <<wait_lapic_expire>> lapic_timer_advance_ns / LAPIC_TIMER_ADVANCE_ADJUST_STEP);
+ *   - arch/x86/kvm/lapic.c|1597| <<wait_lapic_expire>> lapic_timer_advance_ns += min((unsigned int )ns,
+ *   - arch/x86/kvm/lapic.c|1598| <<wait_lapic_expire>> lapic_timer_advance_ns / LAPIC_TIMER_ADVANCE_ADJUST_STEP);
+ *   - arch/x86/kvm/lapic.c|1630| <<start_sw_tscdeadline>> expire = ktime_sub_ns(expire, lapic_timer_advance_ns);
+ *   - arch/x86/kvm/vmx/vmx.c|7259| <<vmx_set_hv_timer>> lapic_timer_advance_cycles = nsec_to_cycles(vcpu, lapic_timer_advance_ns);
+ *   - arch/x86/kvm/x86.c|7926| <<vcpu_enter_guest>> if (lapic_timer_advance_ns)
+ */
 unsigned int __read_mostly lapic_timer_advance_ns = 1000;
 module_param(lapic_timer_advance_ns, uint, S_IRUGO | S_IWUSR);
 EXPORT_SYMBOL_GPL(lapic_timer_advance_ns);
@@ -228,6 +240,32 @@ static inline void kvm_async_pf_hash_reset(struct kvm_vcpu *vcpu)
 		vcpu->arch.apf.gfns[i] = ~0;
 }
 
+/*
+ * vcpu返回用户态切换的过程是调用kvm_on_user_return函数,而这个函数也
+ * 就是在kvm_x86_ops->prepare_guest_switch(vcpu)的时候调用
+ * kvm_set_shared_msr配置的,后者调用了内核函数:user_return_notifier_register(&smsr->urn);
+ * 这个函数是内核提供的返回用户态时刻的通知链接口,kvm用它来给vcpu返回挂
+ * 了个钩子,如此实现了vcpu ioctl系统调用返回qemu时将shared_msrs切换回
+ * host之前保存的值.
+ *
+ * kvm_on_user_return就是注册到内核的vcpu返回用户态时执行的逻辑,
+ * 在切换shared_msrs的同时也把自己从通知链上注销了,因为一方面不需
+ * 要别的进程在退出的时候也执行这个函数另一方面在vcpu enter guest的时候还会再注册的.
+ *
+ * kvm_on_user_return
+ * exit_to_usermode_loop
+ * syscall_return_slowpath
+ * ret_from_fork
+ *
+ * kvm_on_user_return
+ * exit_to_usermode_loop
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/x86.c|319| <<kvm_set_shared_msr>> smsr->urn.on_user_return = kvm_on_user_return;
+ *   - arch/x86/kvm/x86.c|333| <<drop_user_return_notifiers>> kvm_on_user_return(&smsr->urn);
+ */
 static void kvm_on_user_return(struct user_return_notifier *urn)
 {
 	unsigned slot;
@@ -289,6 +327,11 @@ static void kvm_shared_msr_cpu_online(void)
 		shared_msr_update(i, shared_msrs_global.msrs[i]);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|813| <<vmx_set_guest_msr>> ret = kvm_set_shared_msr(msr->index, msr->data,
+ *   - arch/x86/kvm/vmx/vmx.c|1311| <<vmx_prepare_switch_to_guest>> kvm_set_shared_msr(vmx->guest_msrs[i].index,
+ */
 int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask)
 {
 	unsigned int cpu = smp_processor_id();
@@ -449,6 +492,15 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_deliver_exception_payload);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|554| <<kvm_queue_exception>> kvm_multiple_exception(vcpu, nr, false, 0, false, 0, false);
+ *   - arch/x86/kvm/x86.c|560| <<kvm_requeue_exception>> kvm_multiple_exception(vcpu, nr, false, 0, false, 0, true);
+ *   - arch/x86/kvm/x86.c|567| <<kvm_queue_exception_p>> kvm_multiple_exception(vcpu, nr, false, 0, true, payload, false);
+ *   - arch/x86/kvm/x86.c|573| <<kvm_queue_exception_e_p>> kvm_multiple_exception(vcpu, nr, true, error_code,
+ *   - arch/x86/kvm/x86.c|633| <<kvm_queue_exception_e>> kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, false);
+ *   - arch/x86/kvm/x86.c|639| <<kvm_requeue_exception_e>> kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, true);
+ */
 static void kvm_multiple_exception(struct kvm_vcpu *vcpu,
 		unsigned nr, bool has_error, u32 error_code,
 	        bool has_payload, unsigned long payload, bool reinject)
@@ -537,24 +589,78 @@ static void kvm_multiple_exception(struct kvm_vcpu *vcpu,
 		goto queue;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/hyperv.c|1608| <<kvm_hv_hypercall>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/svm.c|2748| <<db_interception>> kvm_queue_exception(&svm->vcpu, DB_VECTOR);
+ *   - arch/x86/kvm/svm.c|3025| <<nested_svm_check_permissions>> kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/svm.c|3856| <<skinit_interception>> kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/svm.c|4060| <<cr_interception>> kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/svm.c|4082| <<cr_interception>> kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/svm.c|5061| <<handle_exit>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|3000| <<nested_vmx_check_permission>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|4133| <<get_vmx_mem_address>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|4341| <<handle_vmon>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|4753| <<handle_invept>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|4814| <<handle_invvpid>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/nested.c|4933| <<handle_vmfunc>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|4968| <<handle_rmode_exception>> kvm_queue_exception(vcpu, vec);
+ *   - arch/x86/kvm/vmx/vmx.c|5074| <<handle_exception>> kvm_queue_exception(vcpu, DB_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|5319| <<handle_dr>> kvm_queue_exception(vcpu, DB_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|5868| <<handle_invalid_op>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|5898| <<handle_invpcid>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|6020| <<handle_vmx_instruction>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|6031| <<handle_encls>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/vmx/vmx.c|6412| <<vmx_handle_exit>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/x86.c|670| <<kvm_require_dr>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/x86.c|3591| <<kvm_vcpu_ioctl_x86_set_mce>> kvm_queue_exception(vcpu, MC_VECTOR);
+ *   - arch/x86/kvm/x86.c|5387| <<handle_ud>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/x86.c|6193| <<inject_emulated_exception>> kvm_queue_exception(vcpu, ctxt->exception.vector);
+ *   - arch/x86/kvm/x86.c|6261| <<handle_emulation_failure>> kvm_queue_exception(vcpu, UD_VECTOR);
+ *   - arch/x86/kvm/x86.c|6484| <<kvm_vcpu_check_breakpoint>> kvm_queue_exception(vcpu, DB_VECTOR);
+ *   - arch/x86/kvm/x86.c|8777| <<kvm_arch_vcpu_ioctl_set_guest_debug>> kvm_queue_exception(vcpu, DB_VECTOR);
+ *   - arch/x86/kvm/x86.c|8779| <<kvm_arch_vcpu_ioctl_set_guest_debug>> kvm_queue_exception(vcpu, BP_VECTOR);
+ */
 void kvm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr)
 {
+	/*
+	 * 在以下调用kvm_multiple_exception():
+	 *   - arch/x86/kvm/x86.c|554| <<kvm_queue_exception>> kvm_multiple_exception(vcpu, nr, false, 0, false, 0, false);
+	 *   - arch/x86/kvm/x86.c|560| <<kvm_requeue_exception>> kvm_multiple_exception(vcpu, nr, false, 0, false, 0, true);
+	 *   - arch/x86/kvm/x86.c|567| <<kvm_queue_exception_p>> kvm_multiple_exception(vcpu, nr, false, 0, true, payload, false);
+	 *   - arch/x86/kvm/x86.c|573| <<kvm_queue_exception_e_p>> kvm_multiple_exception(vcpu, nr, true, error_code,
+	 *   - arch/x86/kvm/x86.c|633| <<kvm_queue_exception_e>> kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, false);
+	 *   - arch/x86/kvm/x86.c|639| <<kvm_requeue_exception_e>> kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, true);
+	 */
 	kvm_multiple_exception(vcpu, nr, false, 0, false, 0, false);
 }
 EXPORT_SYMBOL_GPL(kvm_queue_exception);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/svm.c|5644| <<svm_complete_interrupts>> kvm_requeue_exception(&svm->vcpu, vector);
+ *   - arch/x86/kvm/vmx/vmx.c|6893| <<__vmx_complete_interrupts>> kvm_requeue_exception(vcpu, vector);
+ */
 void kvm_requeue_exception(struct kvm_vcpu *vcpu, unsigned nr)
 {
 	kvm_multiple_exception(vcpu, nr, false, 0, false, 0, true);
 }
 EXPORT_SYMBOL_GPL(kvm_requeue_exception);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|6429| <<kvm_vcpu_do_singlestep>> kvm_queue_exception_p(vcpu, DB_VECTOR, DR6_BS);
+ */
 static void kvm_queue_exception_p(struct kvm_vcpu *vcpu, unsigned nr,
 				  unsigned long payload)
 {
 	kvm_multiple_exception(vcpu, nr, false, 0, true, payload, false);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|606| <<kvm_inject_page_fault>> kvm_queue_exception_e_p(vcpu, PF_VECTOR, fault->error_code,
+ */
 static void kvm_queue_exception_e_p(struct kvm_vcpu *vcpu, unsigned nr,
 				    u32 error_code, unsigned long payload)
 {
@@ -598,8 +704,19 @@ static bool kvm_propagate_fault(struct kvm_vcpu *vcpu, struct x86_exception *fau
 	return fault->nested_page_fault;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/lapic.c|1194| <<__apic_accept_irq>> kvm_inject_nmi(vcpu);
+ *   - arch/x86/kvm/x86.c|3475| <<kvm_vcpu_ioctl_nmi>> kvm_inject_nmi(vcpu);
+ */
 void kvm_inject_nmi(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * 在以下使用kvm_vcpu_arch->nmi_queued:
+	 *   - arch/x86/kvm/x86.c|615| <<kvm_inject_nmi>> atomic_inc(&vcpu->arch.nmi_queued);
+	 *   - arch/x86/kvm/x86.c|7403| <<process_nmi>> vcpu->arch.nmi_pending += atomic_xchg(&vcpu->arch.nmi_queued, 0);
+	 *   - arch/x86/kvm/x86.c|8916| <<kvm_vcpu_reset>> atomic_set(&vcpu->arch.nmi_queued, 0);
+	 */
 	atomic_inc(&vcpu->arch.nmi_queued);
 	kvm_make_request(KVM_REQ_NMI, vcpu);
 }
@@ -645,6 +762,11 @@ EXPORT_SYMBOL_GPL(kvm_require_dr);
  * running guest. The difference to kvm_vcpu_read_guest_page is that this function
  * can read from guest physical or from the guest's guest physical memory.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|787| <<kvm_read_nested_guest_page>> return kvm_read_guest_page_mmu(vcpu, vcpu->arch.walk_mmu, gfn,
+ *   - arch/x86/kvm/x86.c|808| <<load_pdptrs>> ret = kvm_read_guest_page_mmu(vcpu, mmu, pdpt_gfn, pdpte,
+ */
 int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
 			    gfn_t ngfn, void *data, int offset, int len,
 			    u32 access)
@@ -1072,6 +1194,16 @@ static int __kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/svm.c|4116| <<dr_interception>> kvm_set_dr(&svm->vcpu, dr - 16, val);
+ *   - arch/x86/kvm/vmx/nested.c|2301| <<prepare_vmcs02>> kvm_set_dr(vcpu, 7, vmcs12->guest_dr7);
+ *   - arch/x86/kvm/vmx/nested.c|2304| <<prepare_vmcs02>> kvm_set_dr(vcpu, 7, vcpu->arch.dr7);
+ *   - arch/x86/kvm/vmx/nested.c|3820| <<load_vmcs12_host_state>> kvm_set_dr(vcpu, 7, 0x400);
+ *   - arch/x86/kvm/vmx/nested.c|3873| <<nested_vmx_restore_host_state>> kvm_set_dr(vcpu, 7, DR7_FIXED_1);
+ *   - arch/x86/kvm/vmx/nested.c|3875| <<nested_vmx_restore_host_state>> WARN_ON(kvm_set_dr(vcpu, 7, vmcs_readl(GUEST_DR7)));
+ *   - arch/x86/kvm/vmx/vmx.c|5369| <<handle_dr>> if (kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg)))
+ */
 int kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val)
 {
 	if (__kvm_set_dr(vcpu, dr, val)) {
@@ -1353,6 +1485,16 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
  * Returns 0 on success, non-0 otherwise.
  * Assumes vcpu_load() was already called.
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|1502| <<global>> EXPORT_SYMBOL_GPL(kvm_set_msr); 
+ *   - arch/x86/kvm/svm.c|4482| <<wrmsr_interception>> if (kvm_set_msr(&svm->vcpu, &msr)) {
+ *   - arch/x86/kvm/vmx/nested.c|862| <<nested_vmx_load_msr>> if (kvm_set_msr(vcpu, &msr)) {
+ *   - arch/x86/kvm/vmx/nested.c|3950| <<nested_vmx_restore_host_state>> if (kvm_set_msr(vcpu, &msr)) {
+ *   - arch/x86/kvm/vmx/vmx.c|5450| <<handle_wrmsr>> if (kvm_set_msr(vcpu, &msr) != 0) {
+ *   - arch/x86/kvm/x86.c|1529| <<do_set_msr>> return kvm_set_msr(vcpu, &msr);
+ *   - arch/x86/kvm/x86.c|6132| <<emulator_set_msr>> return kvm_set_msr(emul_to_vcpu(ctxt), &msr);
+ */
 int kvm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 {
 	switch (msr->index) {
@@ -1463,6 +1605,11 @@ void kvm_set_pending_timer(struct kvm_vcpu *vcpu)
 	 * vcpu_enter_guest.  This function is only called from
 	 * the physical CPU that is running vcpu.
 	 */
+	/*
+	 * x86在以下使用KVM_REQ_PENDING_TIMER:
+	 *   - arch/x86/kvm/x86.c|1489| <<kvm_set_pending_timer>> kvm_make_request(KVM_REQ_PENDING_TIMER, vcpu);
+	 *   - arch/x86/kvm/x86.c|8150| <<vcpu_run>> kvm_clear_request(KVM_REQ_PENDING_TIMER, vcpu);
+	 */
 	kvm_make_request(KVM_REQ_PENDING_TIMER, vcpu);
 }
 
@@ -2174,6 +2321,10 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
 				sizeof(vcpu->hv_clock.version));
 }
 
+/*
+ * called by (KVM_REQ_CLOCK_UPDATE):
+ *   - arch/x86/kvm/x86.c|7742| <<vcpu_enter_guest>> r = kvm_guest_time_update(vcpu);
+ */
 static int kvm_guest_time_update(struct kvm_vcpu *v)
 {
 	unsigned long flags, tgt_tsc_khz;
@@ -2397,6 +2548,10 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
 	return r;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|2707| <<kvm_set_msr_common(MSR_KVM_ASYNC_PF_EN)>> if (kvm_pv_enable_async_pf(vcpu, data))
+ */
 static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
 {
 	gpa_t gpa = data & ~0x3f;
@@ -2434,6 +2589,10 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
 	kvm_x86_ops->tlb_flush(vcpu, invalidate_gpa);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|7762| <<vcpu_enter_guest>> record_steal_time(vcpu);
+ */
 static void record_steal_time(struct kvm_vcpu *vcpu)
 {
 	struct kvm_host_map map;
@@ -3270,6 +3429,11 @@ static bool need_emulate_wbinvd(struct kvm_vcpu *vcpu)
 	return kvm_arch_has_noncoherent_dma(vcpu->kvm);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|186| <<vcpu_load>> kvm_arch_vcpu_load(vcpu, cpu);
+ *   - virt/kvm/kvm_main.c|4388| <<kvm_sched_in>> kvm_arch_vcpu_load(vcpu, cpu);
+ */
 void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
 	/* Address WBINVD may be executed by guest */
@@ -3320,6 +3484,10 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|3371| <<kvm_arch_vcpu_put>> kvm_steal_time_set_preempted(vcpu);
+ */
 static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
 {
 	struct kvm_host_map map;
@@ -3446,6 +3614,10 @@ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
 	return 0;
 }
 
+/*
+ * 处理KVM_NMI:
+ *   - arch/x86/kvm/x86.c|4031| <<kvm_arch_vcpu_ioctl>> r = kvm_vcpu_ioctl_nmi(vcpu);
+ */
 static int kvm_vcpu_ioctl_nmi(struct kvm_vcpu *vcpu)
 {
 	kvm_inject_nmi(vcpu);
@@ -5307,6 +5479,11 @@ int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
 }
 EXPORT_SYMBOL_GPL(kvm_write_guest_virt_system);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/svm.c|2782| <<ud_interception>> return handle_ud(&svm->vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|5016| <<handle_exception>> return handle_ud(vcpu);
+ */
 int handle_ud(struct kvm_vcpu *vcpu)
 {
 	int emul_type = EMULTYPE_TRAP_UD;
@@ -6183,6 +6360,11 @@ int kvm_inject_realmode_interrupt(struct kvm_vcpu *vcpu, int irq, int inc_eip)
 }
 EXPORT_SYMBOL_GPL(kvm_inject_realmode_interrupt);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|6645| <<x86_emulate_instruction>> return handle_emulation_failure(vcpu, emulation_type);
+ *   - arch/x86/kvm/x86.c|6684| <<x86_emulate_instruction>> return handle_emulation_failure(vcpu, emulation_type);
+ */
 static int handle_emulation_failure(struct kvm_vcpu *vcpu, int emulation_type)
 {
 	int r = EMULATE_DONE;
@@ -7056,10 +7238,48 @@ void kvm_arch_exit(void)
 	kmem_cache_destroy(x86_fpu_cache);
 }
 
+/*
+ * kvm_vcpu_halt
+ * handle_halt
+ * __dta_vmx_handle_exit_306
+ * __dta_vcpu_enter_guest_1388
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|3242| <<nested_vmx_run>> return kvm_vcpu_halt(vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|4946| <<handle_rmode_exception>> return kvm_vcpu_halt(vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|5740| <<handle_invalid_guest_state>> ret = kvm_vcpu_halt(vcpu);
+ *   - arch/x86/kvm/x86.c|7128| <<kvm_emulate_halt>> return kvm_vcpu_halt(vcpu) && ret;
+ *
+ * 最终由native_safe_halt()实现CPU的idle task,该函数只是简单地将中断使能,
+ * 然后执行HLT指令,即停止CPU的运行,并做好接收中断退出HALT状态的准备.--> asm volatile("sti; hlt": : :"memory");
+ * [0] native_safe_halt
+ * [0] default_idle
+ * [0] haltpoll_enter_idle
+ * [0] cpuidle_enter_state
+ * [0] cpuidle_enter
+ * [0] call_cpuidle
+ * [0] do_idle
+ * [0] cpu_startup_entry
+ * [0] start_secondary
+ * [0] secondary_startup_64
+ */
 int kvm_vcpu_halt(struct kvm_vcpu *vcpu)
 {
 	++vcpu->stat.halt_exits;
 	if (lapic_in_kernel(vcpu)) {
+		/*
+		 * 在以下使用KVM_MP_STATE_HALTED:
+		 *   - include/uapi/linux/kvm.h|532| <<global>> #define KVM_MP_STATE_HALTED 3
+		 *   - arch/x86/kvm/vmx/nested.c|3562| <<sync_vmcs12>> if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED)
+		 *   - arch/x86/kvm/x86.c|7112| <<kvm_vcpu_halt>> vcpu->arch.mp_state = KVM_MP_STATE_HALTED;
+		 *   - arch/x86/kvm/x86.c|8520| <<kvm_arch_vcpu_ioctl_get_mpstate>> if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED &&
+		 */
 		vcpu->arch.mp_state = KVM_MP_STATE_HALTED;
 		return 1;
 	} else {
@@ -7364,6 +7584,12 @@ static int inject_pending_event(struct kvm_vcpu *vcpu)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|3573| <<kvm_vcpu_ioctl_x86_get_vcpu_events>> process_nmi(vcpu);
+ *   - arch/x86/kvm/x86.c|3664| <<kvm_vcpu_ioctl_x86_set_vcpu_events>> process_nmi(vcpu);
+ *   - arch/x86/kvm/x86.c|7797| <<vcpu_enter_guest(KVM_REQ_NMI)>> process_nmi(vcpu);
+ */
 static void process_nmi(struct kvm_vcpu *vcpu)
 {
 	unsigned limit = 2;
@@ -7376,6 +7602,12 @@ static void process_nmi(struct kvm_vcpu *vcpu)
 	if (kvm_x86_ops->get_nmi_mask(vcpu) || vcpu->arch.nmi_injected)
 		limit = 1;
 
+	/*
+	 * 在以下使用kvm_vcpu_arch->nmi_queued:
+	 *   - arch/x86/kvm/x86.c|615| <<kvm_inject_nmi>> atomic_inc(&vcpu->arch.nmi_queued);
+	 *   - arch/x86/kvm/x86.c|7403| <<process_nmi>> vcpu->arch.nmi_pending += atomic_xchg(&vcpu->arch.nmi_queued, 0);
+	 *   - arch/x86/kvm/x86.c|8916| <<kvm_vcpu_reset>> atomic_set(&vcpu->arch.nmi_queued, 0);
+	 */
 	vcpu->arch.nmi_pending += atomic_xchg(&vcpu->arch.nmi_queued, 0);
 	vcpu->arch.nmi_pending = min(vcpu->arch.nmi_pending, limit);
 	kvm_make_request(KVM_REQ_EVENT, vcpu);
@@ -7752,6 +7984,13 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 			r = 0;
 			goto out;
 		}
+		/*
+		 * 在以下使用KVM_REQ_APF_HALT:
+		 *   - arch/x86/include/asm/kvm_host.h|60| <<global>> #define KVM_REQ_APF_HALT KVM_ARCH_REQ(7)
+		 *   - arch/x86/kvm/mmu.c|4201| <<try_async_pf>> kvm_make_request(KVM_REQ_APF_HALT, vcpu);
+		 *   - arch/x86/kvm/x86.c|7779| <<vcpu_enter_guest>> if (kvm_check_request(KVM_REQ_APF_HALT, vcpu)) {
+		 *   - arch/x86/kvm/x86.c|9843| <<kvm_arch_async_page_not_present>> kvm_make_request(KVM_REQ_APF_HALT, vcpu);
+		 */
 		if (kvm_check_request(KVM_REQ_APF_HALT, vcpu)) {
 			/* Page is swapped out. Do synthetic halt */
 			vcpu->arch.apf.halted = true;
@@ -7891,6 +8130,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 	 * This handles the case where a posted interrupt was
 	 * notified with kvm_vcpu_kick.
 	 */
+	/*
+	 * vmx_sync_pir_to_irr()
+	 */
 	if (kvm_lapic_enabled(vcpu) && vcpu->arch.apicv_active)
 		kvm_x86_ops->sync_pir_to_irr(vcpu);
 
@@ -7925,6 +8167,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 		vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
 	}
 
+	/*
+	 * vmx_vcpu_run()
+	 */
 	kvm_x86_ops->run(vcpu);
 
 	/*
@@ -7958,6 +8203,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 	smp_wmb();
 
 	kvm_before_interrupt(vcpu);
+	/*
+	 * vmx_handle_external_intr()
+	 */
 	kvm_x86_ops->handle_external_intr(vcpu);
 	kvm_after_interrupt(vcpu);
 
@@ -7996,14 +8244,30 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 	return r;
 }
 
+/*
+ * 在以下使用KVM_MP_STATE_HALTED:
+ *   - include/uapi/linux/kvm.h|532| <<global>> #define KVM_MP_STATE_HALTED 3
+ *   - arch/x86/kvm/vmx/nested.c|3562| <<sync_vmcs12>> if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED)
+ *   - arch/x86/kvm/x86.c|7112| <<kvm_vcpu_halt>> vcpu->arch.mp_state = KVM_MP_STATE_HALTED;
+ *   - arch/x86/kvm/x86.c|8520| <<kvm_arch_vcpu_ioctl_get_mpstate>> if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED &&
+ *
+ * called by:
+ *   - arch/x86/kvm/x86.c|8081| <<vcpu_run>> r = vcpu_block(kvm, vcpu);
+ */
 static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
 {
+	/*
+	 * vmx_pre_block()
+	 */
 	if (!kvm_arch_vcpu_runnable(vcpu) &&
 	    (!kvm_x86_ops->pre_block || kvm_x86_ops->pre_block(vcpu) == 0)) {
 		srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
 		kvm_vcpu_block(vcpu);
 		vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
 
+		/*
+		 * vmx_post_block()
+		 */
 		if (kvm_x86_ops->post_block)
 			kvm_x86_ops->post_block(vcpu);
 
@@ -8032,13 +8296,28 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
 
 static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * 如果不是nested就不太可能是guest mode
+	 */
 	if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events)
 		kvm_x86_ops->check_nested_events(vcpu);
 
+	/*
+	 * 在以下使用kvm_vcpu_arch->apf.halted:
+	 *   - arch/x86/kvm/x86.c|7781| <<vcpu_enter_guest>> vcpu->arch.apf.halted = true;
+	 *   - arch/x86/kvm/x86.c|8056| <<vcpu_block>> vcpu->arch.apf.halted = false;
+	 *   - arch/x86/kvm/x86.c|8073| <<kvm_vcpu_running>> !vcpu->arch.apf.halted);
+	 *   - arch/x86/kvm/x86.c|8925| <<kvm_vcpu_reset>> vcpu->arch.apf.halted = false;
+	 *   - arch/x86/kvm/x86.c|9890| <<kvm_arch_async_page_present>> vcpu->arch.apf.halted = false;
+	 */
 	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
 		!vcpu->arch.apf.halted);
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|8352| <<kvm_arch_vcpu_ioctl_run>> r = vcpu_run(vcpu);
+ */
 static int vcpu_run(struct kvm_vcpu *vcpu)
 {
 	int r;
@@ -8057,6 +8336,11 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
 		if (r <= 0)
 			break;
 
+		/*
+		 * x86在以下使用KVM_REQ_PENDING_TIMER:
+		 *   - arch/x86/kvm/x86.c|1489| <<kvm_set_pending_timer>> kvm_make_request(KVM_REQ_PENDING_TIMER, vcpu);
+		 *   - arch/x86/kvm/x86.c|8150| <<vcpu_run>> kvm_clear_request(KVM_REQ_PENDING_TIMER, vcpu);
+		 */
 		kvm_clear_request(KVM_REQ_PENDING_TIMER, vcpu);
 		if (kvm_cpu_has_pending_timer(vcpu))
 			kvm_inject_pending_timer_irqs(vcpu);
@@ -8777,6 +9061,11 @@ static void fx_init(struct kvm_vcpu *vcpu)
 	vcpu->arch.cr0 |= X86_CR0_ET;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9080| <<kvm_arch_vcpu_destroy>> kvm_arch_vcpu_free(vcpu);
+ *   - arch/x86/kvm/x86.c|9476| <<kvm_free_vcpus>> kvm_arch_vcpu_free(vcpu);
+ */
 void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
 {
 	void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
@@ -9162,6 +9451,10 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
 	return r;
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|357| <<kvm_vcpu_uninit>> kvm_arch_vcpu_uninit(vcpu);
+ */
 void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu)
 {
 	int idx;
@@ -9590,6 +9883,10 @@ static inline bool kvm_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
 			kvm_x86_ops->guest_apic_has_interrupt(vcpu));
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9922| <<kvm_arch_vcpu_runnable>> return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
+ */
 static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu)
 {
 	if (!list_empty_careful(&vcpu->async_pf.done))
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index bf9f5a8c2d70..f9e8295892f8 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -327,6 +327,11 @@ static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
 
 static inline bool kvm_mwait_in_guest(struct kvm *kvm)
 {
+	/*
+	 * 在以下使用kvm_arch->mwait_in_guest:
+	 *   - arch/x86/kvm/x86.c|4662| <<kvm_vm_ioctl_enable_cap(KVM_CAP_X86_DISABLE_EXITS)>> kvm->arch.mwait_in_guest = true;
+	 *   - arch/x86/kvm/x86.h|330| <<kvm_mwait_in_guest>> return kvm->arch.mwait_in_guest;
+	 */
 	return kvm->arch.mwait_in_guest;
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9a91ce8037c3..7e9809685ff8 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -39,15 +39,39 @@
 static int napi_weight = NAPI_POLL_WEIGHT;
 module_param(napi_weight, int, 0444);
 
+/*
+ * 在以下使用napi_tx:
+ *   - drivers/net/virtio_net.c|2623| <<virtnet_alloc_queues>> napi_tx ? napi_weight : 0);
+ */
 static bool csum = true, gso = true, napi_tx;
 module_param(csum, bool, 0444);
 module_param(gso, bool, 0444);
 module_param(napi_tx, bool, 0644);
 
 /* FIXME: MTU in config. */
+/*
+ * 在以下使用GOOD_PACKET_LEN:
+ *   - drivers/net/virtio_net.c|570| <<receive_small>> unsigned int buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +
+ *   - drivers/net/virtio_net.c|599| <<receive_small>> buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +
+ *   - drivers/net/virtio_net.c|980| <<add_recvbuf_small>> int len = vi->hdr_len + VIRTNET_RX_PAD + GOOD_PACKET_LEN + xdp_headroom;
+ *   - drivers/net/virtio_net.c|992| <<add_recvbuf_small>> vi->hdr_len + GOOD_PACKET_LEN);
+ *   - drivers/net/virtio_net.c|2516| <<mergeable_min_buf_len>> (unsigned int )GOOD_PACKET_LEN);
+ */
 #define GOOD_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+/*
+ * 在以下使用GOOD_COPY_LEN:
+ *   - drivers/net/virtio_net.c|361| <<page_to_skb>> skb = napi_alloc_skb(&rq->napi, GOOD_COPY_LEN);
+ */
 #define GOOD_COPY_LEN	128
 
+/*
+ * 在以下使用VIRTNET_RX_PAD:
+ *   - drivers/net/virtio_net.c|568| <<receive_small>> unsigned int header_offset = VIRTNET_RX_PAD + xdp_headroom;
+ *   - drivers/net/virtio_net.c|597| <<receive_small>> header_offset = VIRTNET_RX_PAD + xdp_headroom;
+ *   - drivers/net/virtio_net.c|612| <<receive_small>> xdp.data_hard_start = buf + VIRTNET_RX_PAD + vi->hdr_len;
+ *   - drivers/net/virtio_net.c|980| <<add_recvbuf_small>> int len = vi->hdr_len + VIRTNET_RX_PAD + GOOD_PACKET_LEN + xdp_headroom;
+ *   - drivers/net/virtio_net.c|991| <<add_recvbuf_small>> sg_init_one(rq->sg, buf + VIRTNET_RX_PAD + xdp_headroom,
+ */
 #define VIRTNET_RX_PAD (NET_IP_ALIGN + NET_SKB_PAD)
 
 /* Amount of XDP headroom to prepend to packets for use by xdp_adjust_head */
@@ -148,6 +172,13 @@ struct receive_queue {
 	/* Name of this receive queue: input.$index */
 	char name[40];
 
+	/*
+	 * 在以下使用receive_queue->xdp_rxq:
+	 *   - drivers/net/virtio_net.c|615| <<receive_small>> xdp.rxq = &rq->xdp_rxq;
+	 *   - drivers/net/virtio_net.c|757| <<receive_mergeable>> xdp.rxq = &rq->xdp_rxq;
+	 *   - drivers/net/virtio_net.c|1335| <<virtnet_open>> err = xdp_rxq_info_reg(&vi->rq[i].xdp_rxq, dev, i);
+	 *   - drivers/net/virtio_net.c|1680| <<virtnet_close>> xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq);
+	 */
 	struct xdp_rxq_info xdp_rxq;
 };
 
@@ -164,6 +195,14 @@ struct control_buf {
 
 struct virtnet_info {
 	struct virtio_device *vdev;
+	/*
+	 * 在以下使用virtnet_info->cvq:
+	 *   - drivers/net/virtio_net.c|1606| <<virtnet_send_command>> virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
+	 *   - drivers/net/virtio_net.c|1608| <<virtnet_send_command>> if (unlikely(!virtqueue_kick(vi->cvq)))
+	 *   - drivers/net/virtio_net.c|1614| <<virtnet_send_command>> while (!virtqueue_get_buf(vi->cvq, &tmp) &&
+	 *   - drivers/net/virtio_net.c|1615| <<virtnet_send_command>> !virtqueue_is_broken(vi->cvq))
+	 *   - drivers/net/virtio_net.c|2667| <<virtnet_find_vqs>> vi->cvq = vqs[total_vqs - 1];
+	 */
 	struct virtqueue *cvq;
 	struct net_device *dev;
 	struct send_queue *sq;
@@ -174,6 +213,33 @@ struct virtnet_info {
 	u16 max_queue_pairs;
 
 	/* # of queue pairs currently used by the driver */
+	/*
+	 * 在以下设置virtnet_info->curr_queue_pairs:
+	 *   - drivers/net/virtio_net.c|1830| <<_virtnet_set_queues>> vi->curr_queue_pairs = queue_pairs;
+	 *   - drivers/net/virtio_net.c|3135| <<virtnet_probe>> vi->curr_queue_pairs = max_queue_pairs;
+	 *   - drivers/net/virtio_net.c|3137| <<virtnet_probe>> vi->curr_queue_pairs = num_online_cpus();
+	 * 在以下使用virtnet_info->curr_queue_pairs:
+	 *   - drivers/net/virtio_net.c|545| <<virtnet_xdp_flush>> qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id();
+	 *   - drivers/net/virtio_net.c|561| <<__virtnet_xdp_xmit>> qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id();
+	 *   - drivers/net/virtio_net.c|1328| <<refill_work>> for (i = 0; i < vi->curr_queue_pairs; i++) {
+	 *   - drivers/net/virtio_net.c|1419| <<is_xdp_raw_buffer_queue>> if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+	 *   - drivers/net/virtio_net.c|1421| <<is_xdp_raw_buffer_queue>> else if (q < vi->curr_queue_pairs)
+	 *   - drivers/net/virtio_net.c|1477| <<virtnet_open>> if (i < vi->curr_queue_pairs)
+	 *   - drivers/net/virtio_net.c|1799| <<virtnet_netpoll>> for (i = 0; i < vi->curr_queue_pairs; i++)
+	 *   - drivers/net/virtio_net.c|1989| <<virtnet_set_affinity>> if (vi->curr_queue_pairs == 1 ||
+	 *   - drivers/net/virtio_net.c|2136| <<virtnet_get_strings>> for (i = 0; i < vi->curr_queue_pairs; i++) {
+	 *   - drivers/net/virtio_net.c|2144| <<virtnet_get_strings>> for (i = 0; i < vi->curr_queue_pairs; i++) {
+	 *   - drivers/net/virtio_net.c|2164| <<virtnet_get_sset_count>> return vi->curr_queue_pairs * (VIRTNET_RQ_STATS_LEN +
+	 *   - drivers/net/virtio_net.c|2182| <<virtnet_get_ethtool_stats>> for (i = 0; i < vi->curr_queue_pairs; i++) {
+	 *   - drivers/net/virtio_net.c|2196| <<virtnet_get_ethtool_stats>> for (i = 0; i < vi->curr_queue_pairs; i++) {
+	 *   - drivers/net/virtio_net.c|2219| <<virtnet_get_channels>> channels->combined_count = vi->curr_queue_pairs;
+	 *   - drivers/net/virtio_net.c|2373| <<virtnet_restore_up>> for (i = 0; i < vi->curr_queue_pairs; i++)
+	 *   - drivers/net/virtio_net.c|2456| <<virtnet_xdp_set>> curr_qp = vi->curr_queue_pairs - vi->xdp_queue_pairs;
+	 *   - drivers/net/virtio_net.c|3149| <<virtnet_probe>> netif_set_real_num_tx_queues(dev, vi->curr_queue_pairs);
+	 *   - drivers/net/virtio_net.c|3150| <<virtnet_probe>> netif_set_real_num_rx_queues(dev, vi->curr_queue_pairs);
+	 *   - drivers/net/virtio_net.c|3174| <<virtnet_probe>> virtnet_set_queues(vi, vi->curr_queue_pairs);
+	 *   - drivers/net/virtio_net.c|3267| <<virtnet_restore>> virtnet_set_queues(vi, vi->curr_queue_pairs);
+	 */
 	u16 curr_queue_pairs;
 
 	/* # of XDP queue pairs currently used by the driver */
@@ -195,12 +261,41 @@ struct virtnet_info {
 	u8 hdr_len;
 
 	/* Work struct for refilling if we run low on memory. */
+	/*
+	 * 在以下使用virtnet_info->refill:
+	 *   - drivers/net/virtio_net.c|1311| <<refill_work>> container_of(work, struct virtnet_info, refill.work);
+	 *   - drivers/net/virtio_net.c|1326| <<refill_work>> schedule_delayed_work(&vi->refill, HZ/2);
+	 *   - drivers/net/virtio_net.c|1358| <<virtnet_receive>> schedule_delayed_work(&vi->refill, 0);
+	 *   - drivers/net/virtio_net.c|1467| <<virtnet_open>> schedule_delayed_work(&vi->refill, 0);
+	 *   - drivers/net/virtio_net.c|1820| <<_virtnet_set_queues>> schedule_delayed_work(&vi->refill, 0);
+	 *   - drivers/net/virtio_net.c|1842| <<virtnet_close>> cancel_delayed_work_sync(&vi->refill);
+	 *   - drivers/net/virtio_net.c|2336| <<virtnet_freeze_down>> cancel_delayed_work_sync(&vi->refill);
+	 *   - drivers/net/virtio_net.c|2362| <<virtnet_restore_up>> schedule_delayed_work(&vi->refill, 0);
+	 *   - drivers/net/virtio_net.c|2837| <<virtnet_alloc_queues>> INIT_DELAYED_WORK(&vi->refill, refill_work);
+	 *   - drivers/net/virtio_net.c|3180| <<virtnet_probe>> cancel_delayed_work_sync(&vi->refill);
+	 */
 	struct delayed_work refill;
 
 	/* Work struct for config space updates */
+	/*
+	 * 在以下使用virtnet_info->config_work:
+	 *   - drivers/net/virtio_net.c|2268| <<virtnet_freeze_down>> flush_work(&vi->config_work);
+	 *   - drivers/net/virtio_net.c|2512| <<virtnet_config_changed_work>> container_of(work, struct virtnet_info, config_work);
+	 *   - drivers/net/virtio_net.c|2546| <<virtnet_config_changed>> schedule_work(&vi->config_work);
+	 *   - drivers/net/virtio_net.c|2980| <<virtnet_probe>> INIT_WORK(&vi->config_work, virtnet_config_changed_work);
+	 *   - drivers/net/virtio_net.c|3076| <<virtnet_probe>> schedule_work(&vi->config_work);
+	 *   - drivers/net/virtio_net.c|3128| <<virtnet_remove>> flush_work(&vi->config_work);
+	 */
 	struct work_struct config_work;
 
 	/* Does the affinity hint is set for virtqueues? */
+	/*
+	 * 在以下使用virtnet_info->affinity_hint_set:
+	 *   - drivers/net/virtio_net.c|1254| <<virtnet_napi_tx_enable>> if (!vi->affinity_hint_set) {
+	 *   - drivers/net/virtio_net.c|1871| <<virtnet_clean_affinity>> if (vi->affinity_hint_set) {
+	 *   - drivers/net/virtio_net.c|1877| <<virtnet_clean_affinity>> vi->affinity_hint_set = false;
+	 *   - drivers/net/virtio_net.c|1904| <<virtnet_set_affinity>> vi->affinity_hint_set = true;
+	 */
 	bool affinity_hint_set;
 
 	/* CPU hotplug instances for online & dead */
@@ -252,6 +347,13 @@ static int rxq2vq(int rxq)
 	return rxq * 2;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|365| <<page_to_skb>> hdr = skb_vnet_hdr(skb);
+ *   - drivers/net/virtio_net.c|659| <<receive_small>> memcpy(skb_vnet_hdr(skb), buf, vi->hdr_len);
+ *   - drivers/net/virtio_net.c|940| <<receive_buf>> hdr = skb_vnet_hdr(skb);
+ *   - drivers/net/virtio_net.c|1391| <<xmit_skb>> hdr = skb_vnet_hdr(skb);
+ */
 static inline struct virtio_net_hdr_mrg_rxbuf *skb_vnet_hdr(struct sk_buff *skb)
 {
 	return (struct virtio_net_hdr_mrg_rxbuf *)skb->cb;
@@ -261,6 +363,16 @@ static inline struct virtio_net_hdr_mrg_rxbuf *skb_vnet_hdr(struct sk_buff *skb)
  * private is used to chain pages for big packets, put the whole
  * most recent used list in the beginning for reuse
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|418| <<page_to_skb>> give_pages(rq, page);
+ *   - drivers/net/virtio_net.c|690| <<receive_big>> give_pages(rq, page);
+ *   - drivers/net/virtio_net.c|923| <<receive_buf>> give_pages(rq, buf);
+ *   - drivers/net/virtio_net.c|1013| <<add_recvbuf_big>> give_pages(rq, list);
+ *   - drivers/net/virtio_net.c|1025| <<add_recvbuf_big>> give_pages(rq, list);
+ *   - drivers/net/virtio_net.c|1043| <<add_recvbuf_big>> give_pages(rq, first);
+ *   - drivers/net/virtio_net.c|2484| <<free_unused_bufs>> give_pages(&vi->rq[i], buf);
+ */
 static void give_pages(struct receive_queue *rq, struct page *page)
 {
 	struct page *end;
@@ -271,6 +383,12 @@ static void give_pages(struct receive_queue *rq, struct page *page)
 	rq->pages = page;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1010| <<add_recvbuf_big>> first = get_a_page(rq, gfp);
+ *   - drivers/net/virtio_net.c|1023| <<add_recvbuf_big>> first = get_a_page(rq, gfp);
+ *   - drivers/net/virtio_net.c|2438| <<_free_receive_bufs>> __free_pages(get_a_page(&vi->rq[i], GFP_KERNEL), 0);
+ */
 static struct page *get_a_page(struct receive_queue *rq, gfp_t gfp_mask)
 {
 	struct page *p = rq->pages;
@@ -284,20 +402,43 @@ static struct page *get_a_page(struct receive_queue *rq, gfp_t gfp_mask)
 	return p;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|308| <<virtqueue_napi_complete>> virtqueue_napi_schedule(napi, vq);
+ *   - drivers/net/virtio_net.c|323| <<skb_xmit_done>> virtqueue_napi_schedule(napi, vq);
+ *   - drivers/net/virtio_net.c|1149| <<skb_recv_done>> virtqueue_napi_schedule(&rq->napi, rvq);
+ *   - drivers/net/virtio_net.c|1161| <<virtnet_napi_enable>> virtqueue_napi_schedule(napi, vq);
+ */
 static void virtqueue_napi_schedule(struct napi_struct *napi,
 				    struct virtqueue *vq)
 {
+	/*
+	 * Test if NAPI routine is already running, and if not mark
+	 * it as running.  This is used as a condition variable
+	 * insure only one NAPI poll instance runs.  We also make
+	 * sure there is no pending NAPI disable.
+	 */
 	if (napi_schedule_prep(napi)) {
 		virtqueue_disable_cb(vq);
 		__napi_schedule(napi);
 	}
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1316| <<virtnet_poll>> virtqueue_napi_complete(napi, rq->vq, received);
+ *   - drivers/net/virtio_net.c|1364| <<virtnet_poll_tx>> virtqueue_napi_complete(napi, sq->vq, 0);
+ */
 static void virtqueue_napi_complete(struct napi_struct *napi,
 				    struct virtqueue *vq, int processed)
 {
 	int opaque;
 
+	/*
+	 * 在以下调用virtqueue_enable_cb_prepare():
+	 *   - drivers/net/virtio_net.c|397| <<virtqueue_napi_complete>> opaque = virtqueue_enable_cb_prepare(vq);
+	 *   - drivers/virtio/virtio_ring.c|879| <<virtqueue_enable_cb>> unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
+	 */
 	opaque = virtqueue_enable_cb_prepare(vq);
 	if (napi_complete_done(napi, processed)) {
 		if (unlikely(virtqueue_poll(vq, opaque)))
@@ -340,6 +481,12 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx)
 }
 
 /* Called from bottom half context */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|680| <<receive_big>> struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len,
+ *   - drivers/net/virtio_net.c|774| <<receive_mergeable>> head_skb = page_to_skb(vi, rq, xdp_page,
+ *   - drivers/net/virtio_net.c|826| <<receive_mergeable>> head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog);
+ */
 static struct sk_buff *page_to_skb(struct virtnet_info *vi,
 				   struct receive_queue *rq,
 				   struct page *page, unsigned int offset,
@@ -687,6 +834,10 @@ static struct sk_buff *receive_big(struct net_device *dev,
 	return NULL;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1029| <<receive_buf>> skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit);
+ */
 static struct sk_buff *receive_mergeable(struct net_device *dev,
 					 struct virtnet_info *vi,
 					 struct receive_queue *rq,
@@ -1041,6 +1192,11 @@ static int add_recvbuf_big(struct virtnet_info *vi, struct receive_queue *rq,
 	return err;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1080| <<add_recvbuf_mergeable>> len = get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len, room);
+ *   - drivers/net/virtio_net.c|2685| <<mergeable_rx_buffer_size_show>> get_mergeable_buf_len(&vi->rq[queue_index], avg,
+ */
 static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
 					  struct ewma_pkt_len *avg_pkt_len,
 					  unsigned int room)
@@ -1107,6 +1263,13 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,
  * before we're receiving packets, or from refill_work which is
  * careful to disable receiving (using napi_disable).
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1189| <<refill_work>> still_empty = !try_fill_recv(vi, rq, GFP_KERNEL);
+ *   - drivers/net/virtio_net.c|1223| <<virtnet_receive>> if (!try_fill_recv(vi, rq, GFP_ATOMIC))
+ *   - drivers/net/virtio_net.c|1321| <<virtnet_open>> if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL))
+ *   - drivers/net/virtio_net.c|2149| <<virtnet_restore_up>> if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL))
+ */
 static bool try_fill_recv(struct virtnet_info *vi, struct receive_queue *rq,
 			  gfp_t gfp)
 {
@@ -1138,6 +1301,15 @@ static void skb_recv_done(struct virtqueue *rvq)
 	virtqueue_napi_schedule(&rq->napi, rvq);
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1339| <<virtnet_napi_tx_enable>> return virtnet_napi_enable(vq, napi);
+ *   - drivers/net/virtio_net.c|1360| <<refill_work>> virtnet_napi_enable(rq->vq, &rq->napi);
+ *   - drivers/net/virtio_net.c|1513| <<virtnet_open>> virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+ *   - drivers/net/virtio_net.c|2429| <<virtnet_restore_up>> virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+ *   - drivers/net/virtio_net.c|2551| <<virtnet_xdp_set>> virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+ *   - drivers/net/virtio_net.c|2562| <<virtnet_xdp_set>> virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+ */
 static void virtnet_napi_enable(struct virtqueue *vq, struct napi_struct *napi)
 {
 	napi_enable(napi);
@@ -1151,6 +1323,13 @@ static void virtnet_napi_enable(struct virtqueue *vq, struct napi_struct *napi)
 	local_bh_enable();
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1426| <<virtnet_open>> virtnet_napi_tx_enable(vi, vi->sq[i].vq, &vi->sq[i].napi);
+ *   - drivers/net/virtio_net.c|2255| <<virtnet_restore_up>> virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+ *   - drivers/net/virtio_net.c|2377| <<virtnet_xdp_set>> virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+ *   - drivers/net/virtio_net.c|2388| <<virtnet_xdp_set>> virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+ */
 static void virtnet_napi_tx_enable(struct virtnet_info *vi,
 				   struct virtqueue *vq,
 				   struct napi_struct *napi)
@@ -1197,6 +1376,10 @@ static void refill_work(struct work_struct *work)
 	}
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1433| <<virtnet_poll>> received = virtnet_receive(rq, budget, &xdp_xmit);
+ */
 static int virtnet_receive(struct receive_queue *rq, int budget, bool *xdp_xmit)
 {
 	struct virtnet_info *vi = rq->vq->vdev->priv;
@@ -1232,6 +1415,13 @@ static int virtnet_receive(struct receive_queue *rq, int budget, bool *xdp_xmit)
 	return received;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1381| <<virtnet_poll_cleantx>> free_old_xmit_skbs(sq);
+ *   - drivers/net/virtio_net.c|1451| <<virtnet_poll_tx>> free_old_xmit_skbs(sq);
+ *   - drivers/net/virtio_net.c|1520| <<start_xmit>> free_old_xmit_skbs(sq);
+ *   - drivers/net/virtio_net.c|1563| <<start_xmit>> free_old_xmit_skbs(sq);
+ */
 static void free_old_xmit_skbs(struct send_queue *sq)
 {
 	struct sk_buff *skb;
@@ -1270,6 +1460,10 @@ static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
 		return false;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1396| <<virtnet_poll>> virtnet_poll_cleantx(rq);
+ */
 static void virtnet_poll_cleantx(struct receive_queue *rq)
 {
 	struct virtnet_info *vi = rq->vq->vdev->priv;
@@ -1332,6 +1526,10 @@ static int virtnet_open(struct net_device *dev)
 	return 0;
 }
 
+/*
+ * 在以下使用virtnet_poll_tx():
+ *   - drivers/net/virtio_net.c|2705| <<virtnet_alloc_queues>> netif_tx_napi_add(vi->dev, &vi->sq[i].napi, virtnet_poll_tx,
+ */
 static int virtnet_poll_tx(struct napi_struct *napi, int budget)
 {
 	struct send_queue *sq = container_of(napi, struct send_queue, napi);
@@ -1413,11 +1611,26 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
 	int err;
 	struct netdev_queue *txq = netdev_get_tx_queue(dev, qnum);
 	bool kick = !skb->xmit_more;
+	/*
+	 * struct send_queue *sq:
+	 * -> struct napi_struct napi;
+	 *    -> int weight;
+	 */
 	bool use_napi = sq->napi.weight;
 
 	/* Free up any pending old buffers before queueing new ones. */
 	free_old_xmit_skbs(sq);
 
+	/*
+	 * This re-enables callbacks but hints to the other side to delay
+	 * interrupts until most of the available buffers have been processed;
+	 * it returns "false" if there are many pending buffers in the queue,
+	 * to detect a possible race between the driver checking for more work,
+	 * and enabling callbacks.
+	 *
+	 * Caller must ensure we don't call this with other virtqueue
+	 * operations at the same time (except where noted).
+	 */
 	if (use_napi && kick)
 		virtqueue_enable_cb_delayed(sq->vq);
 
@@ -1478,6 +1691,18 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
  * supported by the hypervisor, as indicated by feature bits, should
  * never fail unless improperly formatted.
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1642| <<virtnet_set_mac_address>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
+ *   - drivers/net/virtio_net.c|1719| <<virtnet_ack_link_announce>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_ANNOUNCE,
+ *   - drivers/net/virtio_net.c|1736| <<_virtnet_set_queues>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ,
+ *   - drivers/net/virtio_net.c|1798| <<virtnet_set_rx_mode>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ *   - drivers/net/virtio_net.c|1805| <<virtnet_set_rx_mode>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ *   - drivers/net/virtio_net.c|1841| <<virtnet_set_rx_mode>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
+ *   - drivers/net/virtio_net.c|1857| <<virtnet_vlan_rx_add_vid>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ *   - drivers/net/virtio_net.c|1872| <<virtnet_vlan_rx_kill_vid>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ *   - drivers/net/virtio_net.c|2273| <<virtnet_set_guest_offloads>> if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
+ */
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
 				 struct scatterlist *out)
 {
@@ -1621,6 +1846,25 @@ static void virtnet_ack_link_announce(struct virtnet_info *vi)
 	rtnl_unlock();
 }
 
+/*
+ * [0] _virtnet_set_queues
+ * [0] virtnet_set_channels
+ * [0] ethtool_set_channels
+ * [0] dev_ethtool
+ * [0] dev_ioctl
+ * [0] sock_do_ioctl
+ * [0] sock_ioctl
+ * [0] do_vfs_ioctl
+ * [0] ksys_ioctl
+ * [0] __x64_sys_ioctl
+ * [0] do_syscall_64
+ * [0] entry_SYSCALL_64_after_hwframe
+ *
+ * called by:
+ *   - drivers/net/virtio_net.c|1844| <<virtnet_set_queues>> err = _virtnet_set_queues(vi, queue_pairs);
+ *   - drivers/net/virtio_net.c|2113| <<virtnet_set_channels>> err = _virtnet_set_queues(vi, queue_pairs);
+ *   - drivers/net/virtio_net.c|2482| <<virtnet_xdp_set>> err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
+ */
 static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
 {
 	struct scatterlist sg;
@@ -1647,6 +1891,11 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|3174| <<virtnet_probe>> virtnet_set_queues(vi, vi->curr_queue_pairs);
+ *   - drivers/net/virtio_net.c|3267| <<virtnet_restore>> virtnet_set_queues(vi, vi->curr_queue_pairs);
+ */
 static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
 {
 	int err;
@@ -1863,6 +2112,9 @@ static void virtnet_cpu_notif_remove(struct virtnet_info *vi)
 					    &vi->node_dead);
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_ringparam = virtnet_get_ringparam()
+ */
 static void virtnet_get_ringparam(struct net_device *dev,
 				struct ethtool_ringparam *ring)
 {
@@ -1875,6 +2127,9 @@ static void virtnet_get_ringparam(struct net_device *dev,
 }
 
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_drvinfo = virtnet_get_drvinfo()
+ */
 static void virtnet_get_drvinfo(struct net_device *dev,
 				struct ethtool_drvinfo *info)
 {
@@ -1888,6 +2143,9 @@ static void virtnet_get_drvinfo(struct net_device *dev,
 }
 
 /* TODO: Eliminate OOO packets during switching */
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.set_channels = virtnet_set_channels()
+ */
 static int virtnet_set_channels(struct net_device *dev,
 				struct ethtool_channels *channels)
 {
@@ -1924,6 +2182,9 @@ static int virtnet_set_channels(struct net_device *dev,
 	return err;
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_strings = virtnet_get_strings()
+ */
 static void virtnet_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
@@ -1951,6 +2212,9 @@ static void virtnet_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 	}
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_sset_count = virtnet_get_sset_count()
+ */
 static int virtnet_get_sset_count(struct net_device *dev, int sset)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
@@ -1964,6 +2228,9 @@ static int virtnet_get_sset_count(struct net_device *dev, int sset)
 	}
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_ethtool_stats = virtnet_get_ethtool_stats()
+ */
 static void virtnet_get_ethtool_stats(struct net_device *dev,
 				      struct ethtool_stats *stats, u64 *data)
 {
@@ -2001,6 +2268,9 @@ static void virtnet_get_ethtool_stats(struct net_device *dev,
 	}
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_channels = virtnet_get_channels()
+ */
 static void virtnet_get_channels(struct net_device *dev,
 				 struct ethtool_channels *channels)
 {
@@ -2040,6 +2310,9 @@ virtnet_validate_ethtool_cmd(const struct ethtool_link_ksettings *cmd)
 			     __ETHTOOL_LINK_MODE_MASK_NBITS);
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.set_link_ksettings = virtnet_set_link_ksettings()
+ */
 static int virtnet_set_link_ksettings(struct net_device *dev,
 				      const struct ethtool_link_ksettings *cmd)
 {
@@ -2058,6 +2331,9 @@ static int virtnet_set_link_ksettings(struct net_device *dev,
 	return 0;
 }
 
+/*
+ * struct ethtool_ops virtnet_ethtool_ops.get_link_ksettings = virtnet_get_link_ksettings()
+ */
 static int virtnet_get_link_ksettings(struct net_device *dev,
 				      struct ethtool_link_ksettings *cmd)
 {
@@ -2078,6 +2354,11 @@ static void virtnet_init_settings(struct net_device *dev)
 	vi->duplex = DUPLEX_UNKNOWN;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|2533| <<virtnet_config_changed_work>> virtnet_update_settings(vi);
+ *   - drivers/net/virtio_net.c|3079| <<virtnet_probe>> virtnet_update_settings(vi);
+ */
 static void virtnet_update_settings(struct virtnet_info *vi)
 {
 	u32 speed;
@@ -2110,6 +2391,10 @@ static const struct ethtool_ops virtnet_ethtool_ops = {
 	.set_link_ksettings = virtnet_set_link_ksettings,
 };
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|3197| <<virtnet_freeze>> virtnet_freeze_down(vdev);
+ */
 static void virtnet_freeze_down(struct virtio_device *vdev)
 {
 	struct virtnet_info *vi = vdev->priv;
@@ -2357,6 +2642,18 @@ static const struct net_device_ops virtnet_netdev = {
 	.ndo_get_phys_port_name	= virtnet_get_phys_port_name,
 };
 
+/*
+ * 在以下使用virtnet_info->config_work:
+ *   - drivers/net/virtio_net.c|2268| <<virtnet_freeze_down>> flush_work(&vi->config_work);
+ *   - drivers/net/virtio_net.c|2512| <<virtnet_config_changed_work>> container_of(work, struct virtnet_info, config_work);
+ *   - drivers/net/virtio_net.c|2546| <<virtnet_config_changed>> schedule_work(&vi->config_work);
+ *   - drivers/net/virtio_net.c|2980| <<virtnet_probe>> INIT_WORK(&vi->config_work, virtnet_config_changed_work);
+ *   - drivers/net/virtio_net.c|3076| <<virtnet_probe>> schedule_work(&vi->config_work);
+ *   - drivers/net/virtio_net.c|3128| <<virtnet_remove>> flush_work(&vi->config_work);
+ *
+ * 在以下使用virtnet_config_changed_work():
+ *   - drivers/net/virtio_net.c|2980| <<virtnet_probe>> INIT_WORK(&vi->config_work, virtnet_config_changed_work);
+ */
 static void virtnet_config_changed_work(struct work_struct *work)
 {
 	struct virtnet_info *vi =
@@ -2390,6 +2687,9 @@ static void virtnet_config_changed_work(struct work_struct *work)
 	}
 }
 
+/*
+ * struct virtio_driver virtio_net_driver.config_changed = virtnet_config_changed()
+ */
 static void virtnet_config_changed(struct virtio_device *vdev)
 {
 	struct virtnet_info *vi = vdev->priv;
@@ -2478,6 +2778,11 @@ static void free_unused_bufs(struct virtnet_info *vi)
 	}
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|3195| <<virtnet_probe>> virtnet_del_vqs(vi);
+ *   - drivers/net/virtio_net.c|3212| <<remove_vq_common>> virtnet_del_vqs(vi);
+ */
 static void virtnet_del_vqs(struct virtnet_info *vi)
 {
 	struct virtio_device *vdev = vi->vdev;
@@ -2633,6 +2938,11 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
 	return -ENOMEM;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|2366| <<virtnet_restore_up>> err = init_vqs(vi);
+ *   - drivers/net/virtio_net.c|3136| <<virtnet_probe>> err = init_vqs(vi);
+ */
 static int init_vqs(struct virtnet_info *vi)
 {
 	int ret;
@@ -2726,6 +3036,9 @@ static bool virtnet_validate_features(struct virtio_device *vdev)
 #define MIN_MTU ETH_MIN_MTU
 #define MAX_MTU ETH_MAX_MTU
 
+/*
+ * struct virtio_driver virtio_net_driver.validate = virtnet_validate()
+ */
 static int virtnet_validate(struct virtio_device *vdev)
 {
 	if (!vdev->config->get) {
@@ -2955,6 +3268,11 @@ static int virtnet_probe(struct virtio_device *vdev)
 	return err;
 }
 
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|3228| <<virtnet_remove>> remove_vq_common(vi);
+ *   - drivers/net/virtio_net.c|3239| <<virtnet_freeze>> remove_vq_common(vi);
+ */
 static void remove_vq_common(struct virtnet_info *vi)
 {
 	vi->vdev->config->reset(vi->vdev);
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 8fe07622ae59..7b077d3a2252 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -388,6 +388,12 @@ static bool vhost_can_busy_poll(struct vhost_dev *dev,
 	       !vhost_has_work(dev);
 }
 
+/*
+ * called by:
+ *   - drivers/vhost/net.c|773| <<handle_rx>> vhost_net_disable_vq(net, vq);
+ *   - drivers/vhost/net.c|970| <<vhost_net_stop_vq>> vhost_net_disable_vq(n, vq);
+ *   - drivers/vhost/net.c|1150| <<vhost_net_set_backend>> vhost_net_disable_vq(n, vq);
+ */
 static void vhost_net_disable_vq(struct vhost_net *n,
 				 struct vhost_virtqueue *vq)
 {
@@ -620,6 +626,9 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
 	struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_TX];
 	struct vhost_virtqueue *vq = &nvq->vq;
 	unsigned long uninitialized_var(endtime);
+	/*
+	 * 返回的等价skb->len
+	 */
 	int len = peek_head_len(rvq, sk);
 
 	if (!len && vq->busyloop_timeout) {
@@ -662,6 +671,14 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
  * @quota       - headcount quota, 1 for big buffer
  *	returns number of buffer heads allocated, negative on error
  */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|804| <<handle_rx>> headcount = get_rx_bufs(vq, vq->heads, vhost_len,
+ *
+ * 827                 headcount = get_rx_bufs(vq, vq->heads, vhost_len,
+ * 828                                         &in, vq_log, &log,
+ * 829                                         likely(mergeable) ? UIO_MAXIOV : 1);
+ */
 static int get_rx_bufs(struct vhost_virtqueue *vq,
 		       struct vring_used_elem *heads,
 		       int datalen,
@@ -672,6 +689,10 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 {
 	unsigned int out, in;
 	int seg = 0;
+	/*
+	 * headcount只在while循环每一次的结束增加!!
+	 * 不到while循环第一次结束的discard都不会影响avail index !!!
+	 */
 	int headcount = 0;
 	unsigned d;
 	int r, nlogs = 0;
@@ -680,11 +701,26 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 	 */
 	u32 uninitialized_var(len);
 
+	/*
+	 * 每次while循环结束前datalen会减少
+	 */
 	while (datalen > 0 && headcount < quota) {
 		if (unlikely(seg >= UIO_MAXIOV)) {
 			r = -ENOBUFS;
+			/*
+			 * goto err会调用vhost_discard_vq_desc()
+			 *
+			 * 这里不会导致endless loop???
+			 */
 			goto err;
 		}
+		/*
+		 * seg一开始是0
+		 *
+		 * 如果是net的rx, 每次只取一个seg吧
+		 *
+		 * vhost_get_vq_desc()会增加vq->last_avail_idx++
+		 */
 		r = vhost_get_vq_desc(vq, vq->iov + seg,
 				      ARRAY_SIZE(vq->iov) - seg, &out,
 				      &in, log, log_num);
@@ -696,6 +732,9 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 			r = 0;
 			goto err;
 		}
+		/*
+		 * 因为这是收包, 不能有out!!!
+		 */
 		if (unlikely(out || in <= 0)) {
 			vq_err(vq, "unexpected descriptor format for RX: "
 				"out %d, in %d\n", out, in);
@@ -710,6 +749,10 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 		len = iov_length(vq->iov + seg, in);
 		heads[headcount].len = cpu_to_vhost32(vq, len);
 		datalen -= len;
+		/*
+		 * headcount只在这里增加!!
+		 * 不到这里的discard都不会影响avail index !!!
+		 */
 		++headcount;
 		seg += in;
 	}
@@ -725,12 +768,21 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 	}
 	return headcount;
 err:
+	/*
+	 * headcount只在while循环每一次的结束增加!!
+	 * 不到while循环第一次结束的discard都不会影响avail index !!!
+	 */
 	vhost_discard_vq_desc(vq, headcount);
 	return r;
 }
 
 /* Expects to be always run from workqueue - which acts as
  * read-size critical section for our kind of RCU. */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|893| <<handle_rx_kick>> handle_rx(net);
+ *   - drivers/vhost/net.c|907| <<handle_rx_net>> handle_rx(net);
+ */
 static void handle_rx(struct vhost_net *net)
 {
 	struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_RX];
@@ -763,12 +815,20 @@ static void handle_rx(struct vhost_net *net)
 	if (!sock)
 		goto out;
 
+	/*
+	 * !vq->iotlb的话直接返回1
+	 */
 	if (!vq_iotlb_prefetch(vq))
 		goto out;
 
 	vhost_disable_notify(&net->dev, vq);
 	vhost_net_disable_vq(net, vq);
 
+	/*
+	 * rhck的例子
+	 *   vhost_hlen = 0,
+	 *   sock_hlen = 12,
+	 */
 	vhost_hlen = nvq->vhost_hlen;
 	sock_hlen = nvq->sock_hlen;
 
@@ -777,12 +837,23 @@ static void handle_rx(struct vhost_net *net)
 	mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF);
 
 	do {
+		/*
+		 * 返回的等价skb->len
+		 */
 		sock_len = vhost_net_rx_peek_head_len(net, sock->sk);
 
 		if (!sock_len)
 			break;
 		sock_len += sock_hlen;
 		vhost_len = sock_len + vhost_hlen;
+		/*
+		 * struct vhost_virtqueue *vq:
+		 * -> struct vring_used_elem *heads;
+		 *
+		 * in的类型: unsigned uninitialized_var(in)
+		 *
+		 * 因为可能有indirect, headcount是response的数目, in是用的desc的数目
+		 */
 		headcount = get_rx_bufs(vq, vq->heads, vhost_len,
 					&in, vq_log, &log,
 					likely(mergeable) ? UIO_MAXIOV : 1);
@@ -791,6 +862,9 @@ static void handle_rx(struct vhost_net *net)
 			goto out;
 		/* OK, now we need to know about added descriptors. */
 		if (!headcount) {
+			/*
+			 * 这里概率不大 但是可以遇到
+			 */
 			if (unlikely(vhost_enable_notify(&net->dev, vq))) {
 				/* They have slipped one in as we were
 				 * doing that: check again. */
@@ -804,6 +878,10 @@ static void handle_rx(struct vhost_net *net)
 		if (nvq->rx_array)
 			msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
 		/* On overrun, truncate and discard */
+		/*
+		 * 这里看着挺有问题的!!!
+		 * 但是似乎(headcount > UIO_MAXIOV)的时候get_rx_bufs()里已经discard了
+		 */
 		if (unlikely(headcount > UIO_MAXIOV)) {
 			iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
 			err = sock->ops->recvmsg(sock, &msg,
@@ -828,6 +906,7 @@ static void handle_rx(struct vhost_net *net)
 		if (unlikely(err != sock_len)) {
 			pr_debug("Discarded rx packet: "
 				 " len %d, expected %zd\n", err, sock_len);
+			/* 会 vq->last_avail_idx -= n; */
 			vhost_discard_vq_desc(vq, headcount);
 			continue;
 		}
@@ -860,6 +939,9 @@ static void handle_rx(struct vhost_net *net)
 		if (unlikely(vq_log))
 			vhost_log_write(vq, vq_log, log, vhost_len,
 					vq->iov, in);
+		/*
+		 * total_len只在这里增加, 就用在判断vhost_exceeds_weight()
+		 */
 		total_len += vhost_len;
 	} while (likely(!vhost_exceeds_weight(vq, ++recv_pkts, total_len)));
 
@@ -1192,6 +1274,10 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
 	return r;
 }
 
+/*
+ * called by:
+ *   - drivers/vhost/net.c|1398| <<vhost_net_ioctl(VHOST_RESET_OWNER)>> return vhost_net_reset_owner(n);
+ */
 static long vhost_net_reset_owner(struct vhost_net *n)
 {
 	struct socket *tx_sock = NULL;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 78f26cd4eef9..ec385d6e4fe0 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -47,7 +47,18 @@ enum {
 	VHOST_MEMORY_F_LOG = 0x1,
 };
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2413| <<vhost_notify>> if (vhost_get_avail(vq, event, vhost_used_event(vq))) {
+ */
 #define vhost_used_event(vq) ((__virtio16 __user *)&vq->avail->ring[vq->num])
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|1888| <<vhost_update_avail_event>> vhost_avail_event(vq)))
+ *   - drivers/vhost/vhost.c|1895| <<vhost_update_avail_event>> used = vhost_avail_event(vq);
+ *   - drivers/vhost/vhost.c|1897| <<vhost_update_avail_event>> sizeof *vhost_avail_event(vq));
+ *   - drivers/vhost/vhost.c|2514| <<vhost_enable_notify>> vhost_avail_event(vq), r);
+ */
 #define vhost_avail_event(vq) ((__virtio16 __user *)&vq->used->ring[vq->num])
 
 INTERVAL_TREE_DEFINE(struct vhost_umem_node,
@@ -306,6 +317,11 @@ bool vhost_vq_is_setup(struct vhost_virtqueue *vq)
 }
 EXPORT_SYMBOL_GPL(vhost_vq_is_setup);
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|479| <<vhost_dev_init>> vhost_vq_reset(dev, vq);
+ *   - drivers/vhost/vhost.c|665| <<vhost_dev_cleanup>> vhost_vq_reset(dev, dev->vqs[i]);
+ */
 static void vhost_vq_reset(struct vhost_dev *dev,
 			   struct vhost_virtqueue *vq)
 {
@@ -433,6 +449,15 @@ bool vhost_exceeds_weight(struct vhost_virtqueue *vq,
 }
 EXPORT_SYMBOL_GPL(vhost_exceeds_weight);
 
+/*
+ * called by:
+ *   - drivers/vhost/net.c|1025| <<vhost_net_open>> vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+ *   - drivers/vhost/scsi.c|1880| <<vhost_scsi_open>> vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, VHOST_SCSI_WEIGHT, 0);
+ *   - drivers/vhost/test.c|123| <<vhost_test_open>> vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX,
+ *   - drivers/vhost/vsock.c|629| <<vhost_vsock_dev_open>> vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs),
+ *
+ * 在QEMU中reboot的时候不会调用第二次
+ */
 void vhost_dev_init(struct vhost_dev *dev,
 		    struct vhost_virtqueue **vqs, int nvqs,
 		    int weight, int byte_weight)
@@ -1857,9 +1882,26 @@ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
 }
 EXPORT_SYMBOL_GPL(vhost_log_write);
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|1912| <<vhost_vq_init_access>> r = vhost_update_used_flags(vq);
+ *   - drivers/vhost/vhost.c|2447| <<vhost_enable_notify>> r = vhost_update_used_flags(vq);
+ *   - drivers/vhost/vhost.c|2484| <<vhost_disable_notify>> r = vhost_update_used_flags(vq);
+ */
 static int vhost_update_used_flags(struct vhost_virtqueue *vq)
 {
 	void __user *used;
+	/*
+	 * 在以下设置vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|321| <<vhost_vq_reset>> vq->used_flags = 0;
+	 *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+	 *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+	 * 在以下使用vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|1869| <<vhost_update_used_flags>> if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
+	 *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+	 *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+	 *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+	 */
 	if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
 			   &vq->used->flags) < 0)
 		return -EFAULT;
@@ -1876,6 +1918,10 @@ static int vhost_update_used_flags(struct vhost_virtqueue *vq)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2558| <<vhost_enable_notify>> r = vhost_update_avail_event(vq, vq->avail_idx);
+ */
 static int vhost_update_avail_event(struct vhost_virtqueue *vq, u16 avail_event)
 {
 	if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->avail_idx),
@@ -1895,6 +1941,13 @@ static int vhost_update_avail_event(struct vhost_virtqueue *vq, u16 avail_event)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - drivers/vhost/net.c|1230| <<vhost_net_set_backend>> r = vhost_vq_init_access(vq);
+ *   - drivers/vhost/scsi.c|1696| <<vhost_scsi_set_endpoint>> vhost_vq_init_access(vq);
+ *   - drivers/vhost/test.c|204| <<vhost_test_run>> r = vhost_vq_init_access(&n->vqs[index]);
+ *   - drivers/vhost/vsock.c|540| <<vhost_vsock_start>> ret = vhost_vq_init_access(vq);
+ */
 int vhost_vq_init_access(struct vhost_virtqueue *vq)
 {
 	__virtio16 last_used_idx;
@@ -2105,6 +2158,19 @@ static int get_indirect(struct vhost_virtqueue *vq,
  * This function returns the descriptor number found, or vq->num (which is
  * never a valid descriptor number) if none was found.  A negative code is
  * returned on error. */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|429| <<vhost_net_tx_get_vq_desc>> int r = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
+ *   - drivers/vhost/net.c|439| <<vhost_net_tx_get_vq_desc>> r = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
+ *   - drivers/vhost/net.c|694| <<get_rx_bufs>> r = vhost_get_vq_desc(vq, vq->iov + seg,
+ *   - drivers/vhost/scsi.c|508| <<vhost_scsi_do_evt_work>> head = vhost_get_vq_desc(vq, vq->iov,
+ *   - drivers/vhost/scsi.c|886| <<vhost_scsi_get_desc>> vc->head = vhost_get_vq_desc(vq, vq->iov,
+ *   - drivers/vhost/test.c|62| <<handle_vq>> head = vhost_get_vq_desc(vq, vq->iov,
+ *   - drivers/vhost/vsock.c|121| <<vhost_transport_do_send_pkt>> head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
+ *   - drivers/vhost/vsock.c|460| <<vhost_vsock_handle_tx_kick>> head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
+ *
+ * vhost_get_vq_desc()会增加vq->last_avail_idx++
+ */
 int vhost_get_vq_desc(struct vhost_virtqueue *vq,
 		      struct iovec iov[], unsigned int iov_size,
 		      unsigned int *out_num, unsigned int *in_num,
@@ -2239,10 +2305,28 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
 	} while ((i = next_desc(vq, &desc)) != -1);
 
 	/* On success, increment avail index. */
+	/*
+	 * 在以下设置vhost_virtqueue->last_avail_idx:
+	 *   - drivers/vhost/vhost.c|316| <<vhost_vq_reset>> vq->last_avail_idx = 0;
+	 *   - drivers/vhost/vhost.c|1440| <<vhost_vring_ioctl>> vq->last_avail_idx = s.num;
+	 *   - drivers/vhost/vhost.c|2248| <<vhost_get_vq_desc>> vq->last_avail_idx++;
+	 *   - drivers/vhost/vhost.c|2260| <<vhost_discard_vq_desc>> vq->last_avail_idx -= n;
+	 */
 	vq->last_avail_idx++;
 
 	/* Assume notifications from guest are disabled at this point,
 	 * if they aren't we would need to update avail_event index. */
+	/*
+	 * 在以下设置vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|321| <<vhost_vq_reset>> vq->used_flags = 0;
+	 *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+	 *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+	 * 在以下使用vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|1869| <<vhost_update_used_flags>> if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
+	 *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+	 *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+	 *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+	 */
 	BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
 	return head;
 }
@@ -2251,12 +2335,26 @@ EXPORT_SYMBOL_GPL(vhost_get_vq_desc);
 /* Reverse the effect of vhost_get_vq_desc. Useful for error handling. */
 void vhost_discard_vq_desc(struct vhost_virtqueue *vq, int n)
 {
+	/*
+	 * 在以下设置vhost_virtqueue->last_avail_idx:
+	 *   - drivers/vhost/vhost.c|316| <<vhost_vq_reset>> vq->last_avail_idx = 0;
+	 *   - drivers/vhost/vhost.c|1440| <<vhost_vring_ioctl>> vq->last_avail_idx = s.num;
+	 *   - drivers/vhost/vhost.c|2248| <<vhost_get_vq_desc>> vq->last_avail_idx++;
+	 *   - drivers/vhost/vhost.c|2260| <<vhost_discard_vq_desc>> vq->last_avail_idx -= n;
+	 */
 	vq->last_avail_idx -= n;
 }
 EXPORT_SYMBOL_GPL(vhost_discard_vq_desc);
 
 /* After we've used one of their buffers, we tell them about it.  We'll then
  * want to notify the guest, using eventfd. */
+/*
+ * called by:
+ *   - drivers/vhost/scsi.c|598| <<vhost_scsi_complete_cmd_work>> vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0);
+ *   - drivers/vhost/vhost.c|2424| <<vhost_add_used_and_signal>> vhost_add_used(vq, head, len);
+ *   - drivers/vhost/vsock.c|190| <<vhost_transport_do_send_pkt>> vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
+ *   - drivers/vhost/vsock.c|493| <<vhost_vsock_handle_tx_kick>> vhost_add_used(vq, head, len);
+ */
 int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 {
 	struct vring_used_elem heads = {
@@ -2268,6 +2366,13 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 }
 EXPORT_SYMBOL_GPL(vhost_add_used);
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2328| <<vhost_add_used_n>> r = __vhost_add_used_n(vq, heads, n);
+ *   - drivers/vhost/vhost.c|2334| <<vhost_add_used_n>> r = __vhost_add_used_n(vq, heads, count);
+ *
+ * 核心思想是把count个heads给copy到shared used buffer
+ */
 static int __vhost_add_used_n(struct vhost_virtqueue *vq,
 			    struct vring_used_elem *heads,
 			    unsigned count)
@@ -2277,6 +2382,15 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
 	int start;
 
 	start = vq->last_used_idx & (vq->num - 1);
+	/*
+	 * struct vhost_virtqueue *vq:
+	 * -> struct vring_desc __user *desc;
+	 * -> struct vring_avail __user *avail;
+	 * -> struct vring_used __user *used;
+	 *    -> __virtio16 flags;
+	 *    -> __virtio16 idx;
+	 *    -> struct vring_used_elem ring[];
+	 */
 	used = vq->used->ring + start;
 	if (count == 1) {
 		if (vhost_put_user(vq, heads[0].id, &used->id)) {
@@ -2298,6 +2412,12 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
 		log_used(vq, ((void __user *)used - (void __user *)vq->used),
 			 count * sizeof *used);
 	}
+	/*
+	 * 在以下设置vhost_virtqueue->last_used_idx:
+	 *   - drivers/vhost/vhost.c|318| <<vhost_vq_reset>> vq->last_used_idx = 0;
+	 *   - drivers/vhost/vhost.c|1930| <<vhost_vq_init_access>> vq->last_used_idx = vhost16_to_cpu(vq, last_used_idx);
+	 *   - drivers/vhost/vhost.c|2308| <<__vhost_add_used_n>> new = (vq->last_used_idx += count);
+	 */
 	old = vq->last_used_idx;
 	new = (vq->last_used_idx += count);
 	/* If the driver never bothers to signal in a very long while,
@@ -2311,6 +2431,11 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
 
 /* After we've used one of their buffers, we tell them about it.  We'll then
  * want to notify the guest, using eventfd. */
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2273| <<vhost_add_used>> return vhost_add_used_n(vq, &heads, 1);
+ *   - drivers/vhost/vhost.c|2434| <<vhost_add_used_and_signal_n>> vhost_add_used_n(vq, heads, count);
+ */
 int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
 		     unsigned count)
 {
@@ -2347,6 +2472,10 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
 }
 EXPORT_SYMBOL_GPL(vhost_add_used_n);
 
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2391| <<vhost_signal>> if (vq->call_ctx && vhost_notify(dev, vq))
+ */
 static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
 	__u16 old, new;
@@ -2357,6 +2486,9 @@ static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 	 * interrupts. */
 	smp_mb();
 
+	/*
+	 * 不太见VIRTIO_F_NOTIFY_ON_EMPTY使用
+	 */
 	if (vhost_has_feature(vq, VIRTIO_F_NOTIFY_ON_EMPTY) &&
 	    unlikely(vq->avail_idx == vq->last_avail_idx))
 		return true;
@@ -2369,22 +2501,80 @@ static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 		}
 		return !(flags & cpu_to_vhost16(vq, VRING_AVAIL_F_NO_INTERRUPT));
 	}
+	/*
+	 * 在以下使用vhost_virtqueue->signalled_used:
+	 *   - drivers/vhost/vhost.c|319| <<vhost_vq_reset>> vq->signalled_used = 0;
+	 *   - drivers/vhost/vhost.c|2313| <<__vhost_add_used_n>> if (unlikely((u16)(new - vq->signalled_used) < (u16)(new - old)))
+	 *   - drivers/vhost/vhost.c|2382| <<vhost_notify>> old = vq->signalled_used;
+	 *   - drivers/vhost/vhost.c|2384| <<vhost_notify>> new = vq->signalled_used = vq->last_used_idx;
+	 */
 	old = vq->signalled_used;
 	v = vq->signalled_used_valid;
+	/*
+	 * 在以下设置vhost_virtqueue->last_used_idx:
+	 *   - drivers/vhost/vhost.c|318| <<vhost_vq_reset>> vq->last_used_idx = 0;
+	 *   - drivers/vhost/vhost.c|1930| <<vhost_vq_init_access>> vq->last_used_idx = vhost16_to_cpu(vq, last_used_idx);
+	 *   - drivers/vhost/vhost.c|2308| <<__vhost_add_used_n>> new = (vq->last_used_idx += count);
+	 */
 	new = vq->signalled_used = vq->last_used_idx;
 	vq->signalled_used_valid = true;
 
 	if (unlikely(!v))
 		return true;
 
+	/*
+	 * 获取((__virtio16 __user *)&vq->avail->ring[vq->num])
+	 */
 	if (vhost_get_avail(vq, event, vhost_used_event(vq))) {
 		vq_err(vq, "Failed to get used event idx");
 		return true;
 	}
+	/*
+	 * event_idx : vq->avail->ring[vq->num]
+	 * new_idx   : 当前的vq->last_used_idx (也是vq->signalled_used)
+	 * old       : 上一次的vq->signalled_used
+	 *
+	 * (__u16)(new_idx - event_idx - 1) < (__u16)(new_idx - old);
+	 */
 	return vring_need_event(vhost16_to_cpu(vq, event), new, old);
 }
 
 /* This actually signals the guest, using eventfd. */
+/*
+ * # sudo /usr/share/bcc/tools/trace -t -C  'kvm_set_msi_irq'
+ * TIME     CPU PID     TID     COMM            FUNC
+ * 1.409018 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.430408 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.557921 1   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.594878 5   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 1.624964 4   23372   23372   vhost-23357     kvm_set_msi_irq
+ *
+ * 9.586209 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586283 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586399 5   23372   23372   vhost-23357     kvm_set_msi_irq
+ * 9.586470 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ * 9.586482 17  23357   23357   qemu-system-x86 kvm_set_msi_irq
+ *
+ * kvm_set_msi_irq
+ * irqfd_wakeup
+ * __wake_up_common
+ * __wake_up_locked_key
+ * eventfd_signal
+ * vhost_signal
+ * vhost_add_used_and_signal_n
+ * handle_rx
+ * handle_rx_net
+ * vhost_worker
+ * kthread
+ * ret_from_fork
+ *
+ * called by:
+ *   - drivers/vhost/scsi.c|611| <<vhost_scsi_complete_cmd_work>> vhost_signal(&vs->dev, &vs->vqs[vq].vq);
+ *   - drivers/vhost/vhost.c|2425| <<vhost_add_used_and_signal>> vhost_signal(dev, vq);
+ *   - drivers/vhost/vhost.c|2435| <<vhost_add_used_and_signal_n>> vhost_signal(dev, vq);
+ *   - drivers/vhost/vsock.c|220| <<vhost_transport_do_send_pkt>> vhost_signal(&vsock->dev, vq);
+ *   - drivers/vhost/vsock.c|500| <<vhost_vsock_handle_tx_kick>> vhost_signal(&vsock->dev, vq);
+ */
 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
 	/* Signal the Guest tell them we used something up. */
@@ -2394,6 +2584,15 @@ void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 EXPORT_SYMBOL_GPL(vhost_signal);
 
 /* And here's the combo meal deal.  Supersize me! */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|577| <<handle_tx>> vhost_add_used_and_signal(&net->dev, vq, head, 0);
+ *   - drivers/vhost/scsi.c|537| <<vhost_scsi_do_evt_work>> vhost_add_used_and_signal(&vs->dev, vq, head, 0);
+ *   - drivers/vhost/scsi.c|875| <<vhost_scsi_send_bad_target>> vhost_add_used_and_signal(&vs->dev, vq, head, 0);
+ *   - drivers/vhost/scsi.c|1217| <<vhost_scsi_send_tmf_resp>> vhost_add_used_and_signal(&vs->dev, vq, vq_desc, 0);
+ *   - drivers/vhost/scsi.c|1309| <<vhost_scsi_send_an_resp>> vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
+ *   - drivers/vhost/test.c|88| <<handle_vq>> vhost_add_used_and_signal(&n->dev, vq, head, 0);
+ */
 void vhost_add_used_and_signal(struct vhost_dev *dev,
 			       struct vhost_virtqueue *vq,
 			       unsigned int head, int len)
@@ -2404,6 +2603,11 @@ void vhost_add_used_and_signal(struct vhost_dev *dev,
 EXPORT_SYMBOL_GPL(vhost_add_used_and_signal);
 
 /* multi-buffer version of vhost_add_used_and_signal */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|344| <<vhost_zerocopy_signal_used>> vhost_add_used_and_signal_n(vq->dev, vq,
+ *   - drivers/vhost/net.c|865| <<handle_rx>> vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
+ */
 void vhost_add_used_and_signal_n(struct vhost_dev *dev,
 				 struct vhost_virtqueue *vq,
 				 struct vring_used_elem *heads, unsigned count)
@@ -2432,11 +2636,53 @@ bool vhost_vq_avail_empty(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 EXPORT_SYMBOL_GPL(vhost_vq_avail_empty);
 
 /* OK, now we need to know about added descriptors. */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|504| <<handle_tx>> if (unlikely(vhost_enable_notify(&net->dev, vq))) {
+ *   - drivers/vhost/net.c|642| <<vhost_net_rx_peek_head_len>> else if (unlikely(vhost_enable_notify(&net->dev, vq))) {
+ *   - drivers/vhost/net.c|797| <<handle_rx>> if (unlikely(vhost_enable_notify(&net->dev, vq))) {
+ *   - drivers/vhost/scsi.c|516| <<vhost_scsi_do_evt_work>> if (vhost_enable_notify(&vs->dev, vq))
+ *   - drivers/vhost/scsi.c|899| <<vhost_scsi_get_desc>> if (unlikely(vhost_enable_notify(&vs->dev, vq))) {
+ *   - drivers/vhost/test.c|71| <<handle_vq>> if (unlikely(vhost_enable_notify(&n->dev, vq))) {
+ *   - drivers/vhost/vsock.c|112| <<vhost_transport_do_send_pkt>> vhost_enable_notify(&vsock->dev, vq);
+ *   - drivers/vhost/vsock.c|138| <<vhost_transport_do_send_pkt>> if (unlikely(vhost_enable_notify(&vsock->dev, vq))) {
+ *   - drivers/vhost/vsock.c|466| <<vhost_vsock_handle_tx_kick>> if (unlikely(vhost_enable_notify(&vsock->dev, vq))) {
+ */
 bool vhost_enable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
 	__virtio16 avail_idx;
 	int r;
 
+	/*
+	 * vm reboot之后是1 ...
+	 * crash> vhost_virtqueue ffff97ffa41400b0 | grep used
+	 *   used = 0x7fb3e89ed240, 
+	 *   last_used_idx = 32642, 
+	 *   used_flags = 1, 
+	 *   signalled_used = 32642, 
+	 *   signalled_used_valid = true, 
+	 *   log_used = false, 
+	 *
+	 * ifconfig down之后变成了0
+	 *
+	 * crash> vhost_virtqueue ffff97ffa41400b0 | grep used
+	 *   used = 0x7fb3e89ed240, 
+	 *   last_used_idx = 32659, 
+	 *   used_flags = 0, 
+	 *   signalled_used = 32659, 
+	 *   signalled_used_valid = true, 
+	 *   log_used = false,
+	 *
+	 * 在以下设置vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|321| <<vhost_vq_reset>> vq->used_flags = 0;
+	 *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+	 *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+	 * 在以下使用vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|1869| <<vhost_update_used_flags>> if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
+	 *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+	 *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+	 *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+	 */
 	if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
 		return false;
 	vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
@@ -2470,10 +2716,40 @@ bool vhost_enable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 EXPORT_SYMBOL_GPL(vhost_enable_notify);
 
 /* We don't need to be notified again. */
+/*
+ * called by:
+ *   - drivers/vhost/net.c|486| <<handle_tx>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/net.c|511| <<handle_tx>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/net.c|637| <<vhost_net_rx_peek_head_len>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/net.c|652| <<vhost_net_rx_peek_head_len>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/net.c|824| <<handle_rx>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/net.c|871| <<handle_rx>> vhost_disable_notify(&net->dev, vq);
+ *   - drivers/vhost/scsi.c|507| <<vhost_scsi_do_evt_work>> vhost_disable_notify(&vs->dev, vq);
+ *   - drivers/vhost/scsi.c|900| <<vhost_scsi_get_desc>> vhost_disable_notify(&vs->dev, vq);
+ *   - drivers/vhost/scsi.c|1012| <<vhost_scsi_handle_vq>> vhost_disable_notify(&vs->dev, vq);
+ *   - drivers/vhost/scsi.c|1337| <<vhost_scsi_ctl_handle_vq>> vhost_disable_notify(&vs->dev, vq);
+ *   - drivers/vhost/test.c|59| <<handle_vq>> vhost_disable_notify(&n->dev, vq);
+ *   - drivers/vhost/test.c|72| <<handle_vq>> vhost_disable_notify(&n->dev, vq);
+ *   - drivers/vhost/vsock.c|99| <<vhost_transport_do_send_pkt>> vhost_disable_notify(&vsock->dev, vq);
+ *   - drivers/vhost/vsock.c|139| <<vhost_transport_do_send_pkt>> vhost_disable_notify(&vsock->dev, vq);
+ *   - drivers/vhost/vsock.c|448| <<vhost_vsock_handle_tx_kick>> vhost_disable_notify(&vsock->dev, vq);
+ *   - drivers/vhost/vsock.c|467| <<vhost_vsock_handle_tx_kick>> vhost_disable_notify(&vsock->dev, vq);
+ */
 void vhost_disable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
 	int r;
 
+	/*
+	 * 在以下设置vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|321| <<vhost_vq_reset>> vq->used_flags = 0;
+	 *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+	 *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+	 * 在以下使用vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|1869| <<vhost_update_used_flags>> if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
+	 *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+	 *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+	 *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+	 */
 	if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
 		return;
 	vq->used_flags |= VRING_USED_F_NO_NOTIFY;
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index f7ec63af627d..6d5e134b0cb6 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -108,21 +108,60 @@ struct vhost_virtqueue {
 	vhost_work_fn_t handle_kick;
 
 	/* Last available index we saw. */
+	/*
+	 * 在以下设置vhost_virtqueue->last_avail_idx:
+	 *   - drivers/vhost/vhost.c|316| <<vhost_vq_reset>> vq->last_avail_idx = 0;
+	 *   - drivers/vhost/vhost.c|1440| <<vhost_vring_ioctl>> vq->last_avail_idx = s.num;
+	 *   - drivers/vhost/vhost.c|2248| <<vhost_get_vq_desc>> vq->last_avail_idx++;
+	 *   - drivers/vhost/vhost.c|2260| <<vhost_discard_vq_desc>> vq->last_avail_idx -= n;
+	 */
 	u16 last_avail_idx;
 
 	/* Caches available index value from user. */
 	u16 avail_idx;
 
 	/* Last index we used. */
+	/*
+	 * 在以下设置vhost_virtqueue->last_used_idx:
+	 *   - drivers/vhost/vhost.c|318| <<vhost_vq_reset>> vq->last_used_idx = 0;
+	 *   - drivers/vhost/vhost.c|1930| <<vhost_vq_init_access>> vq->last_used_idx = vhost16_to_cpu(vq, last_used_idx);
+	 *   - drivers/vhost/vhost.c|2308| <<__vhost_add_used_n>> new = (vq->last_used_idx += count);
+	 */
 	u16 last_used_idx;
 
 	/* Used flags */
+	/*
+	 * 在以下设置vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|321| <<vhost_vq_reset>> vq->used_flags = 0;
+	 *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+	 *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+	 * 在以下使用vhost_virtqueue->used_flags:
+	 *   - drivers/vhost/vhost.c|1869| <<vhost_update_used_flags>> if (vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
+	 *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+	 *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+	 *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+	 */
 	u16 used_flags;
 
 	/* Last used index value we have signalled on */
+	/*
+	 * 在以下设置vhost_virtqueue->signalled_used:
+	 *   - drivers/vhost/vhost.c|319| <<vhost_vq_reset>> vq->signalled_used = 0;
+	 *   - drivers/vhost/vhost.c|2313| <<__vhost_add_used_n>> if (unlikely((u16)(new - vq->signalled_used) < (u16)(new - old)))
+	 *   - drivers/vhost/vhost.c|2382| <<vhost_notify>> old = vq->signalled_used;
+	 *   - drivers/vhost/vhost.c|2384| <<vhost_notify>> new = vq->signalled_used = vq->last_used_idx;
+	 */
 	u16 signalled_used;
 
 	/* Last used index value we have signalled on */
+	/*
+	 * 在以下使用vhost_virtqueue->signalled_used_valid:
+	 *   - drivers/vhost/vhost.c|320| <<vhost_vq_reset>> vq->signalled_used_valid = false;
+	 *   - drivers/vhost/vhost.c|1918| <<vhost_vq_init_access>> vq->signalled_used_valid = false;
+	 *   - drivers/vhost/vhost.c|2314| <<__vhost_add_used_n>> vq->signalled_used_valid = false;
+	 *   - drivers/vhost/vhost.c|2386| <<vhost_notify>> v = vq->signalled_used_valid;
+	 *   - drivers/vhost/vhost.c|2388| <<vhost_notify>> vq->signalled_used_valid = true;
+	 */
 	bool signalled_used_valid;
 
 	/* Log writes to used structure. */
@@ -132,6 +171,10 @@ struct vhost_virtqueue {
 	struct iovec iov[UIO_MAXIOV];
 	struct iovec iotlb_iov[64];
 	struct iovec *indirect;
+	/*
+	 * 在以下分配vhost_virtqueue->heads:
+	 *   - drivers/vhost/vhost.c|412| <<vhost_dev_alloc_iovecs>> vq->heads = kmalloc(sizeof *vq->heads * UIO_MAXIOV, GFP_KERNEL);
+	 */
 	struct vring_used_elem *heads;
 	/* Protected by virtqueue mutex. */
 	struct vhost_umem *umem;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 51278f8bd3ab..d00d9cae8bb1 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -68,6 +68,10 @@ struct vring_virtqueue {
 	struct vring vring;
 
 	/* Can we use weak barriers? */
+	/*
+	 * 在以下设置vring_virtqueue->weak_barriers:
+	 *   - drivers/virtio/virtio_ring.c|1011| <<__vring_new_virtqueue>> vq->weak_barriers = weak_barriers;
+	 */
 	bool weak_barriers;
 
 	/* Other side has made a mess, don't try any more. */
@@ -82,15 +86,67 @@ struct vring_virtqueue {
 	/* Head of free buffer list. */
 	unsigned int free_head;
 	/* Number we've added since last sync. */
+	/*
+	 * 在以下设置vring_virtqueue->num_added:
+	 *   - drivers/virtio/virtio_ring.c|434| <<virtqueue_add>> vq->num_added++;
+	 *   - drivers/virtio/virtio_ring.c|590| <<virtqueue_kick_prepare>> vq->num_added = 0;
+	 *   - drivers/virtio/virtio_ring.c|1026| <<__vring_new_virtqueue>> vq->num_added = 0;
+	 * 在以下使用vring_virtqueue->num_added:
+	 *   - drivers/virtio/virtio_ring.c|441| <<virtqueue_add>> if (unlikely(vq->num_added == (1 << 16) - 1))
+	 *   - drivers/virtio/virtio_ring.c|588| <<virtqueue_kick_prepare>> old = vq->avail_idx_shadow - vq->num_added;
+	 */
 	unsigned int num_added;
 
 	/* Last used index we've seen. */
+	/*
+	 * 在以下设置vring_virtqueue->last_used_idx:
+	 *   - drivers/virtio/virtio_ring.c|869| <<virtqueue_get_buf_ctx>> vq->last_used_idx++;
+	 *   - drivers/virtio/virtio_ring.c|1199| <<__vring_new_virtqueue>> vq->last_used_idx = 0;
+	 * 在以下使用vring_virtqueue->last_used_idx:
+	 *   - drivers/virtio/virtio_ring.c|804| <<more_used>> return vq->last_used_idx != virtio16_to_cpu(vq->vq.vdev, vq->vring.used->idx);
+	 *   - drivers/virtio/virtio_ring.c|853| <<virtqueue_get_buf_ctx>> last_used = (vq->last_used_idx & (vq->vring.num - 1));
+	 *   - drivers/virtio/virtio_ring.c|892| <<virtqueue_get_buf_ctx>> cpu_to_virtio16(_vq->vdev, vq->last_used_idx));
+	 *   - drivers/virtio/virtio_ring.c|991| <<virtqueue_enable_cb_prepare>> vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
+	 *   - drivers/virtio/virtio_ring.c|1089| <<virtqueue_enable_cb_delayed>> bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
+	 *   - drivers/virtio/virtio_ring.c|1103| <<virtqueue_enable_cb_delayed>> cpu_to_virtio16(_vq->vdev, vq->last_used_idx + bufs));
+	 *   - drivers/virtio/virtio_ring.c|1105| <<virtqueue_enable_cb_delayed>> if (unlikely((u16)(virtio16_to_cpu(_vq->vdev, vq->vring.used->idx) - vq->last_used_idx) > bufs)) {
+	 */
 	u16 last_used_idx;
 
 	/* Last written value to avail->flags */
+	/*
+	 * 在以下设置vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|776| <<virtqueue_disable_cb>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|809| <<virtqueue_enable_cb_prepare>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|884| <<virtqueue_enable_cb_delayed>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|990| <<__vring_new_virtqueue>> vq->avail_flags_shadow = 0;
+	 *   - drivers/virtio/virtio_ring.c|1005| <<__vring_new_virtqueue>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 * 在以下使用vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|743| <<virtqueue_get_buf_ctx>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
+	 *   - drivers/virtio/virtio_ring.c|775| <<virtqueue_disable_cb>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+	 *   - drivers/virtio/virtio_ring.c|778| <<virtqueue_disable_cb>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|808| <<virtqueue_enable_cb_prepare>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|811| <<virtqueue_enable_cb_prepare>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|883| <<virtqueue_enable_cb_delayed>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|886| <<virtqueue_enable_cb_delayed>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|1007| <<__vring_new_virtqueue>> vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+	 */
 	u16 avail_flags_shadow;
 
 	/* Last written value to avail->idx in guest byte order */
+	/*
+	 * 在以下修改vring_virtqueue->avail_idx_shadow:
+	 *   - drivers/virtio/virtio_ring.c|432| <<virtqueue_add>> vq->avail_idx_shadow++;
+	 *   - drivers/virtio/virtio_ring.c|961| <<virtqueue_detach_unused_buf>> vq->avail_idx_shadow--;
+	 *   - drivers/virtio/virtio_ring.c|1025| <<__vring_new_virtqueue>> vq->avail_idx_shadow = 0;
+	 * 在以下使用vring_virtqueue->avail_idx_shadow:
+	 *   - drivers/virtio/virtio_ring.c|426| <<virtqueue_add>> avail = vq->avail_idx_shadow & (vq->vring.num - 1);
+	 *   - drivers/virtio/virtio_ring.c|433| <<virtqueue_add>> vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
+	 *   - drivers/virtio/virtio_ring.c|588| <<virtqueue_kick_prepare>> old = vq->avail_idx_shadow - vq->num_added;
+	 *   - drivers/virtio/virtio_ring.c|589| <<virtqueue_kick_prepare>> new = vq->avail_idx_shadow;
+	 *   - drivers/virtio/virtio_ring.c|923| <<virtqueue_enable_cb_delayed>> bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
+	 *   - drivers/virtio/virtio_ring.c|962| <<virtqueue_detach_unused_buf>> vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
+	 */
 	u16 avail_idx_shadow;
 
 	/* How to notify other side. FIXME: commonalize hcalls! */
@@ -226,6 +282,12 @@ static void vring_unmap_one(const struct vring_virtqueue *vq,
 	}
 }
 
+/*
+ * called by:
+ *   - drivers/virtio/virtio_ring.c|358| <<virtqueue_add>> if (vring_mapping_error(vq, addr))
+ *   - drivers/virtio/virtio_ring.c|371| <<virtqueue_add>> if (vring_mapping_error(vq, addr))
+ *   - drivers/virtio/virtio_ring.c|389| <<virtqueue_add>> if (vring_mapping_error(vq, addr))
+ */
 static int vring_mapping_error(const struct vring_virtqueue *vq,
 			       dma_addr_t addr)
 {
@@ -548,6 +610,13 @@ EXPORT_SYMBOL_GPL(virtqueue_add_inbuf_ctx);
  * This is sometimes useful because the virtqueue_kick_prepare() needs
  * to be serialized, but the actual virtqueue_notify() call does not.
  */
+/*
+ * called by:
+ *   - drivers/block/virtio_blk.c|301| <<virtio_queue_rq>> if (bd->last && virtqueue_kick_prepare(vblk->vqs[qid].vq))
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|973| <<rpmsg_probe>> notify = virtqueue_kick_prepare(vrp->rvq);
+ *   - drivers/scsi/virtio_scsi.c|476| <<virtscsi_kick_cmd>> needs_kick = virtqueue_kick_prepare(vq->vq);
+ *   - drivers/virtio/virtio_ring.c|649| <<virtqueue_kick>> if (virtqueue_kick_prepare(vq))
+ */
 bool virtqueue_kick_prepare(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
@@ -559,8 +628,30 @@ bool virtqueue_kick_prepare(struct virtqueue *_vq)
 	 * event. */
 	virtio_mb(vq->weak_barriers);
 
+	/*
+	 * 在以下修改vring_virtqueue->avail_idx_shadow:
+	 *   - drivers/virtio/virtio_ring.c|432| <<virtqueue_add>> vq->avail_idx_shadow++;
+	 *   - drivers/virtio/virtio_ring.c|961| <<virtqueue_detach_unused_buf>> vq->avail_idx_shadow--;
+	 *   - drivers/virtio/virtio_ring.c|1025| <<__vring_new_virtqueue>> vq->avail_idx_shadow = 0;
+	 * 在以下使用vring_virtqueue->avail_idx_shadow:
+	 *   - drivers/virtio/virtio_ring.c|426| <<virtqueue_add>> avail = vq->avail_idx_shadow & (vq->vring.num - 1);
+	 *   - drivers/virtio/virtio_ring.c|433| <<virtqueue_add>> vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
+	 *   - drivers/virtio/virtio_ring.c|588| <<virtqueue_kick_prepare>> old = vq->avail_idx_shadow - vq->num_added;
+	 *   - drivers/virtio/virtio_ring.c|589| <<virtqueue_kick_prepare>> new = vq->avail_idx_shadow;
+	 *   - drivers/virtio/virtio_ring.c|923| <<virtqueue_enable_cb_delayed>> bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
+	 *   - drivers/virtio/virtio_ring.c|962| <<virtqueue_detach_unused_buf>> vq->vring.avail->idx = cpu_to_virtio16(_vq->vdev, vq->avail_idx_shadow);
+	 */
 	old = vq->avail_idx_shadow - vq->num_added;
 	new = vq->avail_idx_shadow;
+	/*
+	 * 在以下设置vring_virtqueue->num_added:
+	 *   - drivers/virtio/virtio_ring.c|434| <<virtqueue_add>> vq->num_added++;
+	 *   - drivers/virtio/virtio_ring.c|590| <<virtqueue_kick_prepare>> vq->num_added = 0;
+	 *   - drivers/virtio/virtio_ring.c|1026| <<__vring_new_virtqueue>> vq->num_added = 0;
+	 * 在以下使用vring_virtqueue->num_added:
+	 *   - drivers/virtio/virtio_ring.c|441| <<virtqueue_add>> if (unlikely(vq->num_added == (1 << 16) - 1))
+	 *   - drivers/virtio/virtio_ring.c|588| <<virtqueue_kick_prepare>> old = vq->avail_idx_shadow - vq->num_added;
+	 */
 	vq->num_added = 0;
 
 #ifdef DEBUG
@@ -572,6 +663,9 @@ bool virtqueue_kick_prepare(struct virtqueue *_vq)
 #endif
 
 	if (vq->event) {
+		/*
+		 * return (__u16)(new_idx - event_idx - 1) < (__u16)(new_idx - old);
+		 */
 		needs_kick = vring_need_event(virtio16_to_cpu(_vq->vdev, vring_avail_event(&vq->vring)),
 					      new, old);
 	} else {
@@ -590,6 +684,13 @@ EXPORT_SYMBOL_GPL(virtqueue_kick_prepare);
  *
  * Returns false if host notify failed or queue is broken, otherwise true.
  */
+/*
+ * called by:
+ *   - drivers/block/virtio_blk.c|306| <<virtio_queue_rq>> virtqueue_notify(vblk->vqs[qid].vq);
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|984| <<rpmsg_probe>> virtqueue_notify(vrp->rvq);
+ *   - drivers/scsi/virtio_scsi.c|481| <<virtscsi_kick_cmd>> virtqueue_notify(vq->vq);
+ *   - drivers/virtio/virtio_ring.c|650| <<virtqueue_kick>> return virtqueue_notify(vq);
+ */
 bool virtqueue_notify(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
@@ -618,6 +719,43 @@ EXPORT_SYMBOL_GPL(virtqueue_notify);
  *
  * Returns false if kick failed, otherwise true.
  */
+/*
+ * called by:
+ *   - drivers/block/virtio_blk.c|289| <<virtio_queue_rq>> virtqueue_kick(vblk->vqs[qid].vq); 
+ *   - drivers/char/hw_random/virtio-rng.c|63| <<register_buffer>> virtqueue_kick(vi->vq);
+ *   - drivers/char/virtio_console.c|513| <<add_inbuf>> virtqueue_kick(vq); 
+ *   - drivers/char/virtio_console.c|582| <<__send_control_msg>> virtqueue_kick(vq);
+ *   - drivers/char/virtio_console.c|636| <<__send_to_port>> virtqueue_kick(out_vq);
+ *   - drivers/crypto/virtio/virtio_crypto_algs.c|179| <<virtio_crypto_alg_ablkcipher_init_session>> virtqueue_kick(vcrypto->ctrl_vq);
+ *   - drivers/crypto/virtio/virtio_crypto_algs.c|252| <<virtio_crypto_alg_ablkcipher_close_session>> virtqueue_kick(vcrypto->ctrl_vq);
+ *   - drivers/crypto/virtio/virtio_crypto_algs.c|466| <<__virtio_crypto_ablkcipher_do_req>> virtqueue_kick(data_vq->vq);
+ *   - drivers/crypto/virtio/virtio_crypto_algs.c|568| <<virtio_crypto_ablkcipher_crypt_req>> virtqueue_kick(data_vq->vq);
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|298| <<virtio_gpu_queue_ctrl_buffer_locked>> virtqueue_kick(vq);
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|373| <<virtio_gpu_queue_cursor>> virtqueue_kick(vq);
+ *   - drivers/net/caif/caif_virtio.c|589| <<cfv_netdev_tx>> virtqueue_kick(cfv->vq_tx);
+ *   - drivers/net/virtio_net.c|530| <<virtnet_xdp_flush>> virtqueue_kick(sq->vq);
+ *   - drivers/net/virtio_net.c|1243| <<try_fill_recv>> virtqueue_kick(rq->vq);
+ *   - drivers/net/virtio_net.c|1617| <<start_xmit>> virtqueue_kick(sq->vq);
+ *   - drivers/net/virtio_net.c|1665| <<virtnet_send_command>> if (unlikely(!virtqueue_kick(vi->cvq)))
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|654| <<rpmsg_send_offchannel_raw>> virtqueue_kick(vrp->svq);
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|802| <<rpmsg_recv_done>> virtqueue_kick(vrp->rvq);
+ *   - drivers/scsi/virtio_scsi.c|284| <<virtscsi_kick_event>> virtqueue_kick(vscsi->event_vq.vq);
+ *   - drivers/virtio/virtio_balloon.c|123| <<tell_host>> virtqueue_kick(vq);
+ *   - drivers/virtio/virtio_balloon.c|328| <<stats_handle_request>> virtqueue_kick(vq);
+ *   - drivers/virtio/virtio_balloon.c|463| <<init_vqs>> virtqueue_kick(vb->stats_vq);
+ *   - drivers/virtio/virtio_input.c|48| <<virtinput_recv_events>> virtqueue_kick(vq);
+ *   - drivers/virtio/virtio_input.c|77| <<virtinput_send_status>> virtqueue_kick(vi->sts);
+ *   - drivers/virtio/virtio_input.c|196| <<virtinput_fill_evt>> virtqueue_kick(vi->evt);
+ *   - drivers/virtio/virtio_ring.c|442| <<virtqueue_add>> virtqueue_kick(_vq);
+ *   - net/9p/trans_virtio.c|308| <<p9_virtio_request>> virtqueue_kick(chan->vq);
+ *   - net/9p/trans_virtio.c|501| <<p9_virtio_zc_request>> virtqueue_kick(chan->vq);
+ *   - net/vmw_vsock/virtio_transport.c|174| <<virtio_transport_send_pkt_work>> virtqueue_kick(vq);
+ *   - net/vmw_vsock/virtio_transport.c|300| <<virtio_vsock_rx_fill>> virtqueue_kick(vq);
+ *   - net/vmw_vsock/virtio_transport.c|371| <<virtio_vsock_event_fill>> virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]);
+ *   - net/vmw_vsock/virtio_transport.c|431| <<virtio_transport_event_work>> virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]);
+ *   - tools/virtio/virtio_test.c|176| <<run_test>> if (unlikely(!virtqueue_kick(vq->vq)))
+ *   - tools/virtio/vringh_test.c|402| <<bool>> virtqueue_kick(vq);
+ */
 bool virtqueue_kick(struct virtqueue *vq)
 {
 	if (virtqueue_kick_prepare(vq))
@@ -675,6 +813,11 @@ static void detach_buf(struct vring_virtqueue *vq, unsigned int head,
 	}
 }
 
+/*
+ * called by:
+ *   - drivers/virtio/virtio_ring.c|858| <<virtqueue_get_buf_ctx>> if (!more_used(vq)) {
+ *   - drivers/virtio/virtio_ring.c|1223| <<vring_interrupt>> if (!more_used(vq)) {
+ */
 static inline bool more_used(const struct vring_virtqueue *vq)
 {
 	return vq->last_used_idx != virtio16_to_cpu(vq->vq.vdev, vq->vring.used->idx);
@@ -696,6 +839,12 @@ static inline bool more_used(const struct vring_virtqueue *vq)
  * Returns NULL if there are no used buffers, or the "data" token
  * handed to virtqueue_add_*().
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|932| <<receive_mergeable>> buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx);
+ *   - drivers/net/virtio_net.c|1331| <<virtnet_receive>> (buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx))) {
+ *   - drivers/virtio/virtio_ring.c|883| <<virtqueue_get_buf>> return virtqueue_get_buf_ctx(_vq, len, NULL);
+ */
 void *virtqueue_get_buf_ctx(struct virtqueue *_vq, unsigned int *len,
 			    void **ctx)
 {
@@ -736,10 +885,39 @@ void *virtqueue_get_buf_ctx(struct virtqueue *_vq, unsigned int *len,
 	/* detach_buf clears data, so grab it now. */
 	ret = vq->desc_state[i].data;
 	detach_buf(vq, i, ctx);
+	/*
+	 * 在以下设置vring_virtqueue->last_used_idx:
+	 *   - drivers/virtio/virtio_ring.c|869| <<virtqueue_get_buf_ctx>> vq->last_used_idx++;
+	 *   - drivers/virtio/virtio_ring.c|1199| <<__vring_new_virtqueue>> vq->last_used_idx = 0;
+	 * 在以下使用vring_virtqueue->last_used_idx:
+	 *   - drivers/virtio/virtio_ring.c|804| <<more_used>> return vq->last_used_idx != virtio16_to_cpu(vq->vq.vdev, vq->vring.used->idx);
+	 *   - drivers/virtio/virtio_ring.c|853| <<virtqueue_get_buf_ctx>> last_used = (vq->last_used_idx & (vq->vring.num - 1));
+	 *   - drivers/virtio/virtio_ring.c|892| <<virtqueue_get_buf_ctx>> cpu_to_virtio16(_vq->vdev, vq->last_used_idx));
+	 *   - drivers/virtio/virtio_ring.c|991| <<virtqueue_enable_cb_prepare>> vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
+	 *   - drivers/virtio/virtio_ring.c|1089| <<virtqueue_enable_cb_delayed>> bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
+	 *   - drivers/virtio/virtio_ring.c|1103| <<virtqueue_enable_cb_delayed>> cpu_to_virtio16(_vq->vdev, vq->last_used_idx + bufs));
+	 *   - drivers/virtio/virtio_ring.c|1105| <<virtqueue_enable_cb_delayed>> if (unlikely((u16)(virtio16_to_cpu(_vq->vdev, vq->vring.used->idx) - vq->last_used_idx) > bufs)) {
+	 */
 	vq->last_used_idx++;
 	/* If we expect an interrupt for the next entry, tell host
 	 * by writing event index and flush out the write before
 	 * the read in the next get_buf call. */
+	/*
+	 * 在以下使用vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|743| <<virtqueue_get_buf_ctx>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
+	 *   - drivers/virtio/virtio_ring.c|775| <<virtqueue_disable_cb>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+	 *   - drivers/virtio/virtio_ring.c|776| <<virtqueue_disable_cb>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|778| <<virtqueue_disable_cb>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|808| <<virtqueue_enable_cb_prepare>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|809| <<virtqueue_enable_cb_prepare>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|811| <<virtqueue_enable_cb_prepare>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|883| <<virtqueue_enable_cb_delayed>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|884| <<virtqueue_enable_cb_delayed>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|886| <<virtqueue_enable_cb_delayed>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|990| <<__vring_new_virtqueue>> vq->avail_flags_shadow = 0;
+	 *   - drivers/virtio/virtio_ring.c|1005| <<__vring_new_virtqueue>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|1007| <<__vring_new_virtqueue>> vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+	 */
 	if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
 		virtio_store_mb(vq->weak_barriers,
 				&vring_used_event(&vq->vring),
@@ -768,10 +946,54 @@ EXPORT_SYMBOL_GPL(virtqueue_get_buf);
  *
  * Unlike other operations, this need not be serialized.
  */
+/*
+ * called by:
+ *   - drivers/block/virtio_blk.c|216| <<virtblk_done>> virtqueue_disable_cb(vq);
+ *   - drivers/char/virtio_console.c|2190| <<virtcons_freeze>> virtqueue_disable_cb(portdev->c_ivq);
+ *   - drivers/char/virtio_console.c|2198| <<virtcons_freeze>> virtqueue_disable_cb(portdev->c_ivq);
+ *   - drivers/char/virtio_console.c|2201| <<virtcons_freeze>> virtqueue_disable_cb(port->in_vq);
+ *   - drivers/char/virtio_console.c|2202| <<virtcons_freeze>> virtqueue_disable_cb(port->out_vq);
+ *   - drivers/crypto/virtio/virtio_crypto_core.c|47| <<virtcrypto_dataq_callback>> virtqueue_disable_cb(vq);
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|206| <<virtio_gpu_dequeue_ctrl_func>> virtqueue_disable_cb(vgdev->ctrlq.vq);
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|249| <<virtio_gpu_dequeue_cursor_func>> virtqueue_disable_cb(vgdev->cursorq.vq);
+ *   - drivers/net/caif/caif_virtio.c|203| <<cfv_release_used_buf>> virtqueue_disable_cb(cfv->vq_tx);
+ *   - drivers/net/caif/caif_virtio.c|462| <<cfv_netdev_close>> virtqueue_disable_cb(cfv->vq_tx);
+ *   - drivers/net/caif/caif_virtio.c|713| <<cfv_probe>> virtqueue_disable_cb(cfv->vq_tx);
+ *   - drivers/net/virtio_net.c|382| <<virtqueue_napi_schedule>> virtqueue_disable_cb(vq);
+ *   - drivers/net/virtio_net.c|402| <<virtqueue_napi_complete>> virtqueue_disable_cb(vq);
+ *   - drivers/net/virtio_net.c|412| <<skb_xmit_done>> virtqueue_disable_cb(vq);
+ *   - drivers/net/virtio_net.c|1611| <<start_xmit>> virtqueue_disable_cb(sq->vq);
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|523| <<rpmsg_downref_sleepers>> virtqueue_disable_cb(vrp->svq);
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|953| <<rpmsg_probe>> virtqueue_disable_cb(vrp->svq);
+ *   - drivers/scsi/virtio_scsi.c|221| <<virtscsi_vq_done>> virtqueue_disable_cb(vq);
+ *   - net/vmw_vsock/virtio_transport.c|320| <<virtio_transport_tx_work>> virtqueue_disable_cb(vq);
+ *   - net/vmw_vsock/virtio_transport.c|422| <<virtio_transport_event_work>> virtqueue_disable_cb(vq);
+ *   - net/vmw_vsock/virtio_transport.c|550| <<virtio_transport_rx_work>> virtqueue_disable_cb(vq);
+ *   - tools/virtio/virtio_test.c|166| <<run_test>> virtqueue_disable_cb(vq->vq);
+ *   - tools/virtio/vringh_test.c|394| <<bool>> virtqueue_disable_cb(vq);
+ *   - tools/virtio/vringh_test.c|427| <<bool>> virtqueue_disable_cb(vq);
+ */
 void virtqueue_disable_cb(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
+	/*
+	 * 在以下设置vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|776| <<virtqueue_disable_cb>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|809| <<virtqueue_enable_cb_prepare>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|884| <<virtqueue_enable_cb_delayed>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|990| <<__vring_new_virtqueue>> vq->avail_flags_shadow = 0;
+	 *   - drivers/virtio/virtio_ring.c|1005| <<__vring_new_virtqueue>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 * 在以下使用vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|743| <<virtqueue_get_buf_ctx>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
+	 *   - drivers/virtio/virtio_ring.c|775| <<virtqueue_disable_cb>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+	 *   - drivers/virtio/virtio_ring.c|778| <<virtqueue_disable_cb>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|808| <<virtqueue_enable_cb_prepare>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|811| <<virtqueue_enable_cb_prepare>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|883| <<virtqueue_enable_cb_delayed>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|886| <<virtqueue_enable_cb_delayed>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|1007| <<__vring_new_virtqueue>> vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+	 */
 	if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
 		vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
 		if (!vq->event)
@@ -793,6 +1015,11 @@ EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
  * Caller must ensure we don't call this with other virtqueue
  * operations at the same time (except where noted).
  */
+/*
+ * calld by:
+ *   - drivers/net/virtio_net.c|397| <<virtqueue_napi_complete>> opaque = virtqueue_enable_cb_prepare(vq);
+ *   - drivers/virtio/virtio_ring.c|879| <<virtqueue_enable_cb>> unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
+ */
 unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
@@ -805,11 +1032,31 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
 	/* Depending on the VIRTIO_RING_F_EVENT_IDX feature, we need to
 	 * either clear the flags bit or point the event index at the next
 	 * entry. Always do both to keep code simple. */
+	/*
+	 * 在以下设置vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|776| <<virtqueue_disable_cb>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|809| <<virtqueue_enable_cb_prepare>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|884| <<virtqueue_enable_cb_delayed>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+	 *   - drivers/virtio/virtio_ring.c|990| <<__vring_new_virtqueue>> vq->avail_flags_shadow = 0;
+	 *   - drivers/virtio/virtio_ring.c|1005| <<__vring_new_virtqueue>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+	 * 在以下使用vring_virtqueue->avail_flags_shadow:
+	 *   - drivers/virtio/virtio_ring.c|743| <<virtqueue_get_buf_ctx>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
+	 *   - drivers/virtio/virtio_ring.c|775| <<virtqueue_disable_cb>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+	 *   - drivers/virtio/virtio_ring.c|778| <<virtqueue_disable_cb>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|808| <<virtqueue_enable_cb_prepare>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|811| <<virtqueue_enable_cb_prepare>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|883| <<virtqueue_enable_cb_delayed>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+	 *   - drivers/virtio/virtio_ring.c|886| <<virtqueue_enable_cb_delayed>> vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+	 *   - drivers/virtio/virtio_ring.c|1007| <<__vring_new_virtqueue>> vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+	 */
 	if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
 		vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
 		if (!vq->event)
 			vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
 	}
+	/*
+	 * 这里更新这是让backend有call的机会
+	 */
 	vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
 	END_USE(vq);
 	return last_used_idx;
@@ -825,6 +1072,11 @@ EXPORT_SYMBOL_GPL(virtqueue_enable_cb_prepare);
  *
  * This does not need to be serialized.
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|399| <<virtqueue_napi_complete>> if (unlikely(virtqueue_poll(vq, opaque)))
+ *   - drivers/virtio/virtio_ring.c|1046| <<virtqueue_enable_cb>> return !virtqueue_poll(_vq, last_used_idx);
+ */
 bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
@@ -848,6 +1100,20 @@ EXPORT_SYMBOL_GPL(virtqueue_poll);
  * Caller must ensure we don't call this with other virtqueue
  * operations at the same time (except where noted).
  */
+/*
+ * called by:
+ *   - drivers/block/virtio_blk.c|225| <<virtblk_done>> } while (!virtqueue_enable_cb(vq));
+ *   - drivers/crypto/virtio/virtio_crypto_core.c|56| <<virtcrypto_dataq_callback>> } while (!virtqueue_enable_cb(vq));
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|209| <<virtio_gpu_dequeue_ctrl_func>> } while (!virtqueue_enable_cb(vgdev->ctrlq.vq));
+ *   - drivers/gpu/drm/virtio/virtgpu_vq.c|251| <<virtio_gpu_dequeue_cursor_func>> } while (!virtqueue_enable_cb(vgdev->cursorq.vq));
+ *   - drivers/net/caif/caif_virtio.c|565| <<cfv_netdev_tx>> virtqueue_enable_cb(cfv->vq_tx);
+ *   - drivers/rpmsg/virtio_rpmsg_bus.c|496| <<rpmsg_upref_sleepers>> virtqueue_enable_cb(vrp->svq);
+ *   - drivers/scsi/virtio_scsi.c|227| <<virtscsi_vq_done>> } while (!virtqueue_enable_cb(vq));
+ *   - net/vmw_vsock/virtio_transport.c|325| <<virtio_transport_tx_work>> } while (!virtqueue_enable_cb(vq));
+ *   - net/vmw_vsock/virtio_transport.c|429| <<virtio_transport_event_work>> } while (!virtqueue_enable_cb(vq));
+ *   - net/vmw_vsock/virtio_transport.c|581| <<virtio_transport_rx_work>> } while (!virtqueue_enable_cb(vq));
+ *   - tools/virtio/virtio_test.c|199| <<run_test>> if (virtqueue_enable_cb(vq->vq))
+ */
 bool virtqueue_enable_cb(struct virtqueue *_vq)
 {
 	unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
@@ -868,6 +1134,14 @@ EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
  * Caller must ensure we don't call this with other virtqueue
  * operations at the same time (except where noted).
  */
+/*
+ * called by:
+ *   - drivers/net/virtio_net.c|1512| <<start_xmit>> virtqueue_enable_cb_delayed(sq->vq);
+ *   - drivers/net/virtio_net.c|1550| <<start_xmit>> unlikely(!virtqueue_enable_cb_delayed(sq->vq))) {
+ *   - tools/virtio/virtio_test.c|196| <<run_test>> if (virtqueue_enable_cb_delayed(vq->vq))
+ *   - tools/virtio/vringh_test.c|387| <<bool>> if (!virtqueue_enable_cb_delayed(vq))
+ *   - tools/virtio/vringh_test.c|421| <<bool>> if (!virtqueue_enable_cb_delayed(vq))
+ */
 bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
@@ -886,8 +1160,28 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
 			vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
 	}
 	/* TODO: tune this threshold */
+	/*
+	 * 在以下修改vring_virtqueue->avail_idx_shadow:
+	 *   - drivers/virtio/virtio_ring.c|432| <<virtqueue_add>> vq->avail_idx_shadow++;
+	 *   - drivers/virtio/virtio_ring.c|961| <<virtqueue_detach_unused_buf>> vq->avail_idx_shadow--;
+	 *   - drivers/virtio/virtio_ring.c|1025| <<__vring_new_virtqueue>> vq->avail_idx_shadow = 0;
+	 *
+	 * 在以下设置vring_virtqueue->last_used_idx:
+	 *   - drivers/virtio/virtio_ring.c|869| <<virtqueue_get_buf_ctx>> vq->last_used_idx++;
+	 *   - drivers/virtio/virtio_ring.c|1199| <<__vring_new_virtqueue>> vq->last_used_idx = 0;
+	 */
 	bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
 
+	/*
+	 * called by:
+	 *   - drivers/vhost/vringh.c|478| <<__vringh_need_notify>> err = getu16(vrh, &used_event, &vring_used_event(&vrh->vring));
+	 *   - drivers/vhost/vringh.c|481| <<__vringh_need_notify>> &vring_used_event(&vrh->vring));
+	 *   - drivers/virtio/virtio_ring.c|869| <<virtqueue_get_buf_ctx>> &vring_used_event(&vq->vring),
+	 *   - drivers/virtio/virtio_ring.c|942| <<virtqueue_enable_cb_prepare>> vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
+	 *   - drivers/virtio/virtio_ring.c|1029| <<virtqueue_enable_cb_delayed>> &vring_used_event(&vq->vring),
+	 *   - tools/virtio/ringtest/virtio_ring_0_9.c|219| <<enable_call>> vring_used_event(&ring) = guest.last_used_idx;
+	 *   - tools/virtio/ringtest/virtio_ring_0_9.c|326| <<call_used>> need = vring_need_event(vring_used_event(&ring),
+	 */
 	virtio_store_mb(vq->weak_barriers,
 			&vring_used_event(&vq->vring),
 			cpu_to_virtio16(_vq->vdev, vq->last_used_idx + bufs));
@@ -1156,6 +1450,16 @@ void vring_del_virtqueue(struct virtqueue *_vq)
 EXPORT_SYMBOL_GPL(vring_del_virtqueue);
 
 /* Manipulates transport-specific feature bits. */
+/*
+ * called by:
+ *   - drivers/misc/mic/vop/vop_main.c|142| <<vop_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/remoteproc/remoteproc_virtio.c|213| <<rproc_virtio_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/s390/virtio/kvm_virtio.c|104| <<kvm_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/s390/virtio/virtio_ccw.c|801| <<virtio_ccw_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/virtio/virtio_mmio.c|131| <<vm_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/virtio/virtio_pci_legacy.c|38| <<vp_finalize_features>> vring_transport_features(vdev);
+ *   - drivers/virtio/virtio_pci_modern.c|162| <<vp_finalize_features>> vring_transport_features(vdev);
+ */
 void vring_transport_features(struct virtio_device *vdev)
 {
 	unsigned int i;
@@ -1206,6 +1510,12 @@ EXPORT_SYMBOL_GPL(virtqueue_is_broken);
  * This should prevent the device from being used, allowing drivers to
  * recover.  You may need to grab appropriate locks to flush.
  */
+/*
+ * called by:
+ *   - drivers/crypto/virtio/virtio_crypto_core.c|233| <<virtcrypto_update_status>> virtio_break_device(vcrypto->vdev);
+ *   - drivers/s390/virtio/virtio_ccw.c|1161| <<virtio_ccw_remove>> virtio_break_device(&vcdev->vdev);
+ *   - drivers/s390/virtio/virtio_ccw.c|1178| <<virtio_ccw_offline>> virtio_break_device(&vcdev->vdev);
+ */
 void virtio_break_device(struct virtio_device *dev)
 {
 	struct virtqueue *_vq;
@@ -1249,6 +1559,12 @@ dma_addr_t virtqueue_get_used_addr(struct virtqueue *_vq)
 }
 EXPORT_SYMBOL_GPL(virtqueue_get_used_addr);
 
+/*
+ * called by:
+ *   - include/linux/virtio.h|99| <<virtqueue_get_desc>> return virtqueue_get_vring(vq)->desc;
+ *   - include/linux/virtio.h|103| <<virtqueue_get_avail>> return virtqueue_get_vring(vq)->avail;
+ *   - include/linux/virtio.h|107| <<virtqueue_get_used>> return virtqueue_get_vring(vq)->used;
+ */
 const struct vring *virtqueue_get_vring(struct virtqueue *vq)
 {
 	return &to_vvq(vq)->vring;
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 5511dc963dd5..76d5006c16af 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -92,6 +92,17 @@ enum hrtimer_restart {
  */
 struct hrtimer {
 	struct timerqueue_node		node;
+	/*
+	 * 在以下使用hrtimer->_softexpires:
+	 *   - include/linux/hrtimer.h|229| <<hrtimer_set_expires>> timer->_softexpires = time;
+	 *   - include/linux/hrtimer.h|234| <<hrtimer_set_expires_range>> timer->_softexpires = time;
+	 *   - include/linux/hrtimer.h|240| <<hrtimer_set_expires_range_ns>> timer->_softexpires = time;
+	 *   - include/linux/hrtimer.h|247| <<hrtimer_set_expires_tv64>> timer->_softexpires = tv64;
+	 *   - include/linux/hrtimer.h|253| <<hrtimer_add_expires>> timer->_softexpires = ktime_add_safe(timer->_softexpires, time);
+	 *   - include/linux/hrtimer.h|259| <<hrtimer_add_expires_ns>> timer->_softexpires = ktime_add_ns(timer->_softexpires, ns);
+	 *   - include/linux/hrtimer.h|269| <<hrtimer_get_softexpires>> return timer->_softexpires;
+	 *   - include/linux/hrtimer.h|278| <<hrtimer_get_softexpires_tv64>> return timer->_softexpires;
+	 */
 	ktime_t				_softexpires;
 	enum hrtimer_restart		(*function)(struct hrtimer *);
 	struct hrtimer_clock_base	*base;
@@ -184,6 +195,33 @@ struct hrtimer_cpu_base {
 	unsigned int			in_hrtirq	: 1,
 					hres_active	: 1,
 					hang_detected	: 1;
+	/*
+	 * 在以下使用hrtimer_cpu_base->expires_next:
+	 *   - kernel/time/hrtimer.c|175| <<hrtimer_check_target>> return expires <= new_base->cpu_base->expires_next;
+	 *   - kernel/time/hrtimer.c|470| <<__hrtimer_get_next_event>> ktime_t expires, expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|483| <<__hrtimer_get_next_event>> if (expires < expires_next) {
+	 *   - kernel/time/hrtimer.c|484| <<__hrtimer_get_next_event>> expires_next = expires;
+	 *   - kernel/time/hrtimer.c|493| <<__hrtimer_get_next_event>> if (expires_next < 0)
+	 *   - kernel/time/hrtimer.c|494| <<__hrtimer_get_next_event>> expires_next = 0; 
+	 *   - kernel/time/hrtimer.c|495| <<__hrtimer_get_next_event>> return expires_next;
+	 *   - kernel/time/hrtimer.c|558| <<hrtimer_force_reprogram>> ktime_t expires_next; 
+	 *   - kernel/time/hrtimer.c|563| <<hrtimer_force_reprogram>> expires_next = __hrtimer_get_next_event(cpu_base);
+	 *   - kernel/time/hrtimer.c|565| <<hrtimer_force_reprogram>> if (skip_equal && expires_next == cpu_base->expires_next)
+	 *   - kernel/time/hrtimer.c|568| <<hrtimer_force_reprogram>> cpu_base->expires_next = expires_next;
+	 *   - kernel/time/hrtimer.c|587| <<hrtimer_force_reprogram>> tick_program_event(cpu_base->expires_next, 1);
+	 *   - kernel/time/hrtimer.c|629| <<hrtimer_reprogram>> if (expires >= cpu_base->expires_next)
+	 *   - kernel/time/hrtimer.c|648| <<hrtimer_reprogram>> cpu_base->expires_next = expires;
+	 *   - kernel/time/hrtimer.c|657| <<hrtimer_init_hres>> base->expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|1306| <<hrtimer_interrupt>> ktime_t expires_next, now, entry_time, delta;
+	 *   - kernel/time/hrtimer.c|1324| <<hrtimer_interrupt>> cpu_base->expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|1347| <<hrtimer_interrupt>> expires_next = __hrtimer_get_next_event(cpu_base);
+	 *   - kernel/time/hrtimer.c|1352| <<hrtimer_interrupt>> cpu_base->expires_next = expires_next;
+	 *   - kernel/time/hrtimer.c|1357| <<hrtimer_interrupt>> if (!tick_program_event(expires_next, 0)) {
+	 *   - kernel/time/hrtimer.c|1397| <<hrtimer_interrupt>> expires_next = ktime_add_ns(now, 100 * NSEC_PER_MSEC);
+	 *   - kernel/time/hrtimer.c|1399| <<hrtimer_interrupt>> expires_next = ktime_add(now, delta);
+	 *   - kernel/time/hrtimer.c|1400| <<hrtimer_interrupt>> tick_program_event(expires_next, 1);
+	 *   - kernel/time/timer_list.c|155| <<print_cpu>> P_ns(expires_next);
+	 */
 	ktime_t				expires_next;
 	struct hrtimer			*next_timer;
 	unsigned int			nr_events;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index b2020579bfc3..0df5804da25c 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -126,6 +126,11 @@ static inline bool is_error_page(struct page *page)
  */
 #define KVM_REQ_TLB_FLUSH         (0 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
 #define KVM_REQ_MMU_RELOAD        (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+/*
+ * x86在以下使用KVM_REQ_PENDING_TIMER:
+ *   - arch/x86/kvm/x86.c|1489| <<kvm_set_pending_timer>> kvm_make_request(KVM_REQ_PENDING_TIMER, vcpu);
+ *   - arch/x86/kvm/x86.c|8150| <<vcpu_run>> kvm_clear_request(KVM_REQ_PENDING_TIMER, vcpu);
+ */
 #define KVM_REQ_PENDING_TIMER     2
 #define KVM_REQ_UNHALT            3
 #define KVM_REQUEST_ARCH_BASE     8
@@ -373,7 +378,7 @@ struct kvm_kernel_irq_routing_entry {
 			u32 data;
 			u32 flags;
 			u32 devid;
-		} msi;
+		} msi; // --->>>> 注意 msi !!!
 		struct kvm_s390_adapter_int adapter;
 		struct kvm_hv_sint hv_sint;
 	};
@@ -382,6 +387,13 @@ struct kvm_kernel_irq_routing_entry {
 
 #ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
 struct kvm_irq_routing_table {
+	/*
+	 * 对于x86 ...
+	 * #define KVM_IRQCHIP_PIC_MASTER   0
+	 * #define KVM_IRQCHIP_PIC_SLAVE    1
+	 * #define KVM_IRQCHIP_IOAPIC       2
+	 * #define KVM_NR_IRQCHIPS          3
+	 */
 	int chip[KVM_NR_IRQCHIPS][KVM_IRQCHIP_NUM_PINS];
 	u32 nr_rt_entries;
 	/*
@@ -453,6 +465,15 @@ struct kvm {
 	struct kvm_arch arch;
 	refcount_t users_count;
 #ifdef CONFIG_KVM_MMIO
+	/*
+	 * 在以下使用kvm_memslots->coalesced_mmio_ring:
+	 *   - virt/kvm/coalesced_mmio.c|54| <<coalesced_mmio_has_room>> ring = dev->kvm->coalesced_mmio_ring;
+	 *   - virt/kvm/coalesced_mmio.c|69| <<coalesced_mmio_write>> struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
+	 *   - virt/kvm/coalesced_mmio.c|121| <<kvm_coalesced_mmio_init>> kvm->coalesced_mmio_ring = page_address(page);
+	 *   - virt/kvm/coalesced_mmio.c|137| <<kvm_coalesced_mmio_free>> if (kvm->coalesced_mmio_ring)
+	 *   - virt/kvm/coalesced_mmio.c|138| <<kvm_coalesced_mmio_free>> free_page((unsigned long )kvm->coalesced_mmio_ring);
+	 *   - virt/kvm/kvm_main.c|2953| <<kvm_vcpu_fault>> page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
+	 */
 	struct kvm_coalesced_mmio_ring *coalesced_mmio_ring;
 	spinlock_t ring_lock;
 	struct list_head coalesced_zones;
@@ -1191,6 +1212,10 @@ static inline void kvm_make_request(int req, struct kvm_vcpu *vcpu)
 
 static inline bool kvm_request_pending(struct kvm_vcpu *vcpu)
 {
+	/*
+	 * struct kvm_vcpu *vcpu:
+	 * -> u64 requests;
+	 */
 	return READ_ONCE(vcpu->requests);
 }
 
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index a4181f5753c8..4aecc81a3b99 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -226,6 +226,15 @@ struct kvm_hyperv_exit {
 #define KVM_EXIT_S390_RESET       14
 #define KVM_EXIT_DCR              15 /* deprecated */
 #define KVM_EXIT_NMI              16
+/*
+ * x86使用KVM_EXIT_INTERNAL_ERROR的地方:
+ *   - arch/x86/kvm/svm.c|3938| <<task_switch_interception>> svm->vcpu.run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ *   - arch/x86/kvm/vmx/vmx.c|5040| <<handle_exception>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ *   - arch/x86/kvm/vmx/vmx.c|5606| <<handle_task_switch>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ *   - arch/x86/kvm/vmx/vmx.c|5764| <<handle_invalid_guest_state>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ *   - arch/x86/kvm/vmx/vmx.c|6373| <<vmx_handle_exit>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ *   - arch/x86/kvm/x86.c|6314| <<handle_emulation_failure>> vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ */
 #define KVM_EXIT_INTERNAL_ERROR   17
 #define KVM_EXIT_OSI              18
 #define KVM_EXIT_PAPR_HCALL	  19
diff --git a/include/uapi/linux/kvm_para.h b/include/uapi/linux/kvm_para.h
index 6c0ce49931e5..7cb30a859edb 100644
--- a/include/uapi/linux/kvm_para.h
+++ b/include/uapi/linux/kvm_para.h
@@ -27,6 +27,12 @@
 #define KVM_HC_MIPS_EXIT_VM		7
 #define KVM_HC_MIPS_CONSOLE_OUTPUT	8
 #define KVM_HC_CLOCK_PAIRING		9
+/*
+ * 在以下使用KVM_HC_SEND_IPI:
+ *   - arch/x86/kernel/kvm.c|493| <<__send_ipi_mask>> kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long )ipi_bitmap,
+ *   - arch/x86/kernel/kvm.c|502| <<__send_ipi_mask>> kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long )ipi_bitmap,
+ *   - arch/x86/kvm/x86.c|7185| <<kvm_emulate_hypercall>> case KVM_HC_SEND_IPI:
+ */
 #define KVM_HC_SEND_IPI		10
 
 /*
diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h
index c51f8e5cc608..f15280a907c4 100644
--- a/include/uapi/linux/vhost.h
+++ b/include/uapi/linux/vhost.h
@@ -124,6 +124,31 @@ struct vhost_memory {
  * be modified while ring is running (bound to a device). */
 #define VHOST_SET_VRING_NUM _IOW(VHOST_VIRTIO, 0x10, struct vhost_vring_state)
 /* Set addresses for the ring. */
+/*
+ * 这是gdb的qemu-6.0.0的调用
+ * (gdb) bt
+ * #0  0x000055be200149a4 in vhost_virtqueue_start (dev=0x55be21df0890, vdev=0x55be22b90300, vq=0x55be21df0b50, idx=3) at ../hw/virtio/vhost.c:1057
+ * #1  0x000055be20016891 in vhost_dev_start (hdev=0x55be21df0890, vdev=0x55be22b90300) at ../hw/virtio/vhost.c:1734
+ * #2  0x000055be1fccc8b5 in vhost_net_start_one (net=0x55be21df0890, dev=0x55be22b90300) at ../hw/net/vhost_net.c:246
+ * #3  0x000055be1fcccd73 in vhost_net_start (dev=0x55be22b90300, ncs=0x55be22baac80, total_queues=2) at ../hw/net/vhost_net.c:351
+ * #4  0x000055be200095e1 in virtio_net_vhost_status (n=0x55be22b90300, status=15 '\017') at ../hw/net/virtio-net.c:288
+ * #5  0x000055be2000988c in virtio_net_set_status (vdev=0x55be22b90300, status=15 '\017') at ../hw/net/virtio-net.c:369
+ * #6  0x000055be1ffd07f0 in virtio_set_status (vdev=0x55be22b90300, val=15 '\017') at ../hw/virtio/virtio.c:1958
+ * #7  0x000055be1fc7d0af in virtio_pci_common_write (opaque=0x55be22b88160, addr=20, val=15, size=1) at ../hw/virtio/virtio-pci.c:1260
+ * #8  0x000055be2003abd3 in memory_region_write_accessor (mr=0x55be22b88b50, addr=20, value=0x7f68777fd6c8, size=1, shift=0, mask=255, attrs=...) at ../softmmu/memory.c:491
+ * #9  0x000055be2003adf7 in access_with_adjusted_size (addr=20, value=0x7f68777fd6c8, size=1, access_size_min=1, access_size_max=4, access_fn= 0x55be2003aaee <memory_region_write_accessor>,
+ *                              mr=0x55be22b88b50, attrs=...) at ../softmmu/memory.c:552
+ * #10 0x000055be2003ddf6 in memory_region_dispatch_write (mr=0x55be22b88b50, addr=20, data=15, op=MO_8, attrs=...) at ../softmmu/memory.c:1502
+ * #11 0x000055be2006a2cc in flatview_write_continue (fv=0x7f686c008230, addr=4261412884, attrs=..., ptr=0x7f69877a2028, len=1, addr1=20, l=1, mr=0x55be22b88b50) at ../softmmu/physmem.c:2746
+ * #12 0x000055be2006a411 in flatview_write (fv=0x7f686c008230, addr=4261412884, attrs=..., buf=0x7f69877a2028, len=1) at ../softmmu/physmem.c:2786
+ * #13 0x000055be2006a77d in address_space_write (as=0x55be20c94bc0 <address_space_memory>, addr=4261412884, attrs=..., buf=0x7f69877a2028, len=1) at ../softmmu/physmem.c:2878
+ * #14 0x000055be2006a7ea in address_space_rw (as=0x55be20c94bc0 <address_space_memory>, addr=4261412884, attrs=..., buf=0x7f69877a2028, len=1, is_write=true) at ../softmmu/physmem.c:2888
+ * #15 0x000055be1fff59c6 in kvm_cpu_exec (cpu=0x55be21e89650) at ../accel/kvm/kvm-all.c:2517
+ * #16 0x000055be20037aa9 in kvm_vcpu_thread_fn (arg=0x55be21e89650) at ../accel/kvm/kvm-accel-ops.c:49
+ * #17 0x000055be202437ea in qemu_thread_start (args=0x55be21e96780) at ../util/qemu-thread-posix.c:521
+ * #18 0x00007f6984be0ea5 in start_thread () at /lib64/libpthread.so.0
+ * #19 0x00007f69849098cd in clone () at /lib64/libc.so.6
+ */
 #define VHOST_SET_VRING_ADDR _IOW(VHOST_VIRTIO, 0x11, struct vhost_vring_addr)
 /* Base value where queue looks for available descriptors */
 #define VHOST_SET_VRING_BASE _IOW(VHOST_VIRTIO, 0x12, struct vhost_vring_state)
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 6d5d5faa989b..04fc1616e260 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -47,10 +47,33 @@
 /* The Host uses this in used->flags to advise the Guest: don't kick me when
  * you add a buffer.  It's unreliable, so it's simply an optimization.  Guest
  * will still kick if it's out of buffers. */
+/*
+ * 在以下使用VRING_USED_F_NO_NOTIFY:
+ *   - drivers/vhost/vhost.c|2252| <<vhost_get_vq_desc>> BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
+ *   - drivers/vhost/vhost.c|2500| <<vhost_enable_notify>> if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
+ *   - drivers/vhost/vhost.c|2502| <<vhost_enable_notify>> vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
+ *   - drivers/vhost/vhost.c|2537| <<vhost_disable_notify>> if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
+ *   - drivers/vhost/vhost.c|2539| <<vhost_disable_notify>> vq->used_flags |= VRING_USED_F_NO_NOTIFY;
+ *   - drivers/vhost/vringh.c|545| <<__vringh_notify_disable>> VRING_USED_F_NO_NOTIFY)) {
+ *   - drivers/virtio/virtio_ring.c|672| <<virtqueue_kick_prepare>> needs_kick = !(vq->vring.used->flags & cpu_to_virtio16(_vq->vdev, VRING_USED_F_NO_NOTIFY));
+ */
 #define VRING_USED_F_NO_NOTIFY	1
 /* The Guest uses this in avail->flags to advise the Host: don't interrupt me
  * when you consume a buffer.  It's unreliable, so it's simply an
  * optimization.  */
+/*
+ * 在以下使用VRING_AVAIL_F_NO_INTERRUPT:
+ *   - drivers/vhost/vhost.c|2400| <<vhost_notify>> return !(flags & cpu_to_vhost16(vq, VRING_AVAIL_F_NO_INTERRUPT));
+ *   - drivers/vhost/vringh.c|474| <<__vringh_need_notify>> return (!(flags & VRING_AVAIL_F_NO_INTERRUPT));
+ *   - drivers/virtio/virtio_ring.c|916| <<virtqueue_get_buf_ctx>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT))
+ *   - drivers/virtio/virtio_ring.c|992| <<virtqueue_disable_cb>> if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
+ *   - drivers/virtio/virtio_ring.c|993| <<virtqueue_disable_cb>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+ *   - drivers/virtio/virtio_ring.c|1030| <<virtqueue_enable_cb_prepare>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+ *   - drivers/virtio/virtio_ring.c|1031| <<virtqueue_enable_cb_prepare>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+ *   - drivers/virtio/virtio_ring.c|1135| <<virtqueue_enable_cb_delayed>> if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
+ *   - drivers/virtio/virtio_ring.c|1136| <<virtqueue_enable_cb_delayed>> vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
+ *   - drivers/virtio/virtio_ring.c|1267| <<bool>> vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
+ */
 #define VRING_AVAIL_F_NO_INTERRUPT	1
 
 /* We support indirect buffer descriptors */
@@ -60,6 +83,22 @@
  * at the end of the avail ring. Host should ignore the avail->flags field. */
 /* The Host publishes the avail index for which it expects a kick
  * at the end of the used ring. Guest should ignore the used->flags field. */
+/*
+ * 在以下使用VIRTIO_RING_F_EVENT_IDX:
+ *   - drivers/vhost/vhost.c|1199| <<vq_access_ok>> size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
+ *   - drivers/vhost/vhost.c|1257| <<vq_iotlb_prefetch>> size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
+ *   - drivers/vhost/vhost.c|1289| <<vq_log_access_ok>> size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
+ *   - drivers/vhost/vhost.c|2464| <<vhost_notify>> if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
+ *   - drivers/vhost/vhost.c|2638| <<vhost_enable_notify>> if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
+ *   - drivers/vhost/vhost.c|2686| <<vhost_disable_notify>> if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
+ *   - drivers/vhost/vringh.c|619| <<vringh_init_user>> vrh->event_indices = (features & (1 << VIRTIO_RING_F_EVENT_IDX));
+ *   - drivers/vhost/vringh.c|880| <<vringh_init_kern>> vrh->event_indices = (features & (1 << VIRTIO_RING_F_EVENT_IDX));
+ *   - drivers/virtio/virtio_ring.c|1295| <<bool>> vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
+ *   - drivers/virtio/virtio_ring.c|1471| <<vring_transport_features>> case VIRTIO_RING_F_EVENT_IDX:
+ *   - tools/virtio/virtio_test.c|265| <<main>> (1ULL << VIRTIO_RING_F_EVENT_IDX) | (1ULL << VIRTIO_F_VERSION_1);
+ *   - tools/virtio/virtio_test.c|278| <<main>> features &= ~(1ULL << VIRTIO_RING_F_EVENT_IDX);
+ *   - tools/virtio/vringh_test.c|461| <<main>> __virtio_set_bit(&vdev, VIRTIO_RING_F_EVENT_IDX);
+ */
 #define VIRTIO_RING_F_EVENT_IDX		29
 
 /* Virtio ring descriptors: 16 bytes.  These can chain together via "next". */
@@ -137,9 +176,33 @@ struct vring {
  */
 /* We publish the used event index at the end of the available ring, and vice
  * versa. They are at the end for backwards compatibility. */
+/*
+ * called by:
+ *   - drivers/vhost/vringh.c|478| <<__vringh_need_notify>> err = getu16(vrh, &used_event, &vring_used_event(&vrh->vring));
+ *   - drivers/vhost/vringh.c|481| <<__vringh_need_notify>> &vring_used_event(&vrh->vring));
+ *   - drivers/virtio/virtio_ring.c|869| <<virtqueue_get_buf_ctx>> &vring_used_event(&vq->vring),
+ *   - drivers/virtio/virtio_ring.c|942| <<virtqueue_enable_cb_prepare>> vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
+ *   - drivers/virtio/virtio_ring.c|1029| <<virtqueue_enable_cb_delayed>> &vring_used_event(&vq->vring),
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|219| <<enable_call>> vring_used_event(&ring) = guest.last_used_idx;
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|326| <<call_used>> need = vring_need_event(vring_used_event(&ring),
+ */
 #define vring_used_event(vr) ((vr)->avail->ring[(vr)->num])
+/*
+ * called by:
+ *   - drivers/vhost/vringh.c|514| <<__vringh_notify_enable>> if (putu16(vrh, &vring_avail_event(&vrh->vring),
+ *   - drivers/vhost/vringh.c|517| <<__vringh_notify_enable>> &vring_avail_event(&vrh->vring));
+ *   - drivers/virtio/virtio_ring.c|669| <<virtqueue_kick_prepare>> needs_kick = vring_need_event(virtio16_to_cpu(_vq->vdev, vring_avail_event(&vq->vring)),
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|233| <<kick_available>> need = vring_need_event(vring_avail_event(&ring),
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|252| <<enable_kick>> vring_avail_event(&ring) = host.used_idx;
+ */
 #define vring_avail_event(vr) (*(__virtio16 *)&(vr)->used->ring[(vr)->num])
 
+/*
+ * called by:
+ *   - drivers/misc/mic/vop/vop_vringh.c|336| <<vop_virtio_add_device>> vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
+ *   - drivers/virtio/virtio_ring.c|1403| <<bool>> vring_init(&vring, num, queue, vring_align);
+ *   - drivers/virtio/virtio_ring.c|1433| <<bool>> vring_init(&vring, num, pages, vring_align);
+ */
 static inline void vring_init(struct vring *vr, unsigned int num, void *p,
 			      unsigned long align)
 {
@@ -152,6 +215,17 @@ static inline void vring_init(struct vring *vr, unsigned int num, void *p,
 
 static inline unsigned vring_size(unsigned int num, unsigned long align)
 {
+	/*
+	 * sizeof(struct vring_desc) * num
+	 *
+	 * sizeof(__virtio16) * num
+	 *
+	 * sizeof(struct vring_used_elem) * num
+	 *
+	 *
+	 * sizeof(__virtio16) * 3: avail flags + idx + event
+	 * sizeof(__virtio16) * 3: used flags + idx + event
+	 */
 	return ((sizeof(struct vring_desc) * num + sizeof(__virtio16) * (3 + num)
 		 + align - 1) & ~(align - 1))
 		+ sizeof(__virtio16) * 3 + sizeof(struct vring_used_elem) * num;
@@ -161,6 +235,14 @@ static inline unsigned vring_size(unsigned int num, unsigned long align)
 /* Assuming a given event_idx value from the other side, if
  * we have just incremented index from old to new_idx,
  * should we trigger an event? */
+/*
+ * called by:
+ *   - drivers/vhost/vhost.c|2424| <<vhost_notify>> return vring_need_event(vhost16_to_cpu(vq, event), new, old);
+ *   - drivers/vhost/vringh.c|489| <<__vringh_need_notify>> notify = vring_need_event(used_event,
+ *   - drivers/virtio/virtio_ring.c|669| <<virtqueue_kick_prepare>> needs_kick = vring_need_event(virtio16_to_cpu(_vq->vdev, vring_avail_event(&vq->vring)), new, old);
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|233| <<kick_available>> need = vring_need_event(vring_avail_event(&ring),
+ *   - tools/virtio/ringtest/virtio_ring_0_9.c|326| <<call_used>> need = vring_need_event(vring_used_event(&ring),
+ */
 static inline int vring_need_event(__u16 event_idx, __u16 new_idx, __u16 old)
 {
 	/* Note: Xen has similar logic for notification hold-off
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d8db8e93c7f7..d97050ab4097 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10432,6 +10432,16 @@ SYSCALL_DEFINE5(perf_event_open,
  * @cpu: cpu in which the counter is bound
  * @task: task to profile (NULL for percpu)
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/pmu.c|130| <<pmc_reprogram_counter>> event = perf_event_create_kernel_counter(&attr, -1, current,
+ *   - drivers/oprofile/nmi_timer_int.c|42| <<nmi_timer_start_cpu>> event = perf_event_create_kernel_counter(&nmi_timer_attr, cpu, NULL,
+ *   - drivers/oprofile/oprofile_perf.c|82| <<op_create_counter>> pevent = perf_event_create_kernel_counter(&counter_config[event].attr,
+ *   - kernel/events/hw_breakpoint.c|421| <<register_user_hw_breakpoint>> return perf_event_create_kernel_counter(attr, -1, tsk, triggered,
+ *   - kernel/events/hw_breakpoint.c|497| <<register_wide_hw_breakpoint>> bp = perf_event_create_kernel_counter(attr, cpu, NULL,
+ *   - kernel/watchdog_hld.c|175| <<hardlockup_detector_event_create>> evt = perf_event_create_kernel_counter(wd_attr, cpu, NULL,
+ *   - virt/kvm/arm/pmu.c|419| <<kvm_pmu_set_counter_event_type>> event = perf_event_create_kernel_counter(&attr, -1, current,
+ */
 struct perf_event *
 perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
 				 struct task_struct *task,
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d2a1267ee462..a8c7a3479442 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3051,6 +3051,24 @@ unsigned long long task_sched_runtime(struct task_struct *p)
  * This function gets called by the timer code, with HZ frequency.
  * We call it with interrupts disabled.
  */
+/*
+ * 5.4上的例子
+ * scheduler_tick
+ * tick_sched_handle
+ * tick_sched_timer
+ * __hrtimer_run_queues
+ * hrtimer_interrupt
+ * smp_apic_timer_interrupt
+ * apic_timer_interrupt
+ * native_safe_halt
+ * default_idle
+ * arch_cpu_idle
+ * default_idle_call
+ * do_idle
+ * cpu_startup_entry
+ * start_secondary
+ * secondary_startup_64
+ */
 void scheduler_tick(void)
 {
 	int cpu = smp_processor_id();
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index 01bf6bfbcd47..4ff7537c34aa 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -139,6 +139,15 @@ void account_user_time(struct task_struct *p, u64 cputime)
  * @p: the process that the cpu time gets accounted to
  * @cputime: the cpu time spent in virtual machine since the last update
  */
+/*
+ * called by:
+ *   - arch/ia64/kernel/time.c|75| <<vtime_flush>> account_guest_time(tsk, cycle_to_nsec(ti->gtime));
+ *   - arch/powerpc/kernel/time.c|388| <<vtime_flush>> account_guest_time(tsk, cputime_to_nsecs(acct->gtime));
+ *   - arch/s390/kernel/vtime.c|173| <<do_account_vtime>> account_guest_time(tsk, cputime_to_nsecs(guest));
+ *   - kernel/sched/cputime.c|192| <<account_system_time>> account_guest_time(p, cputime);
+ *   - kernel/sched/cputime.c|391| <<irqtime_account_process_tick>> account_guest_time(p, cputime);
+ *   - kernel/sched/cputime.c|726| <<vtime_account_guest>> account_guest_time(tsk, vtime->gtime);
+ */
 void account_guest_time(struct task_struct *p, u64 cputime)
 {
 	u64 *cpustat = kcpustat_this_cpu->cpustat;
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index e9f04ce90dc4..79d1089fc3c6 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1731,6 +1731,11 @@ static inline void sub_nr_running(struct rq *rq, unsigned count)
 	sched_update_tick_dependency(rq);
 }
 
+/*
+ * called by:
+ *   - kernel/sched/core.c|3097| <<scheduler_tick>> rq_last_tick_reset(rq);
+ *   - kernel/sched/idle_task.c|51| <<put_prev_task_idle>> rq_last_tick_reset(rq);
+ */
 static inline void rq_last_tick_reset(struct rq *rq)
 {
 #ifdef CONFIG_NO_HZ_FULL
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 5d30f4b7d344..ecb2d771021f 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -17,6 +17,10 @@ rq_sched_info_arrive(struct rq *rq, unsigned long long delta)
 /*
  * Expects runqueue lock to be held for atomicity of update
  */
+/*
+ * called by:
+ *   - kernel/sched/stats.h|213| <<sched_info_depart>> rq_sched_info_depart(rq, delta);
+ */
 static inline void
 rq_sched_info_depart(struct rq *rq, unsigned long long delta)
 {
@@ -205,6 +209,10 @@ static inline void sched_info_queued(struct rq *rq, struct task_struct *t)
  * sched_info_queued() to mark that it has now again started waiting on
  * the runqueue.
  */
+/*
+ * called by:
+ *   - kernel/sched/stats.h|234| <<__sched_info_switch>> sched_info_depart(rq, prev);
+ */
 static inline void sched_info_depart(struct rq *rq, struct task_struct *t)
 {
 	unsigned long long delta = rq_clock(rq) -
diff --git a/kernel/smp.c b/kernel/smp.c
index 44ce7a6dd1bc..7648db56ff18 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -437,6 +437,10 @@ void smp_call_function_many(const struct cpumask *mask,
 
 	cfd = this_cpu_ptr(&cfd_data);
 
+	/*
+	 * 应该是把mask和cpu_online_mask给and
+	 * 结果到cfd->cpumask
+	 */
 	cpumask_and(cfd->cpumask, mask, cpu_online_mask);
 	__cpumask_clear_cpu(this_cpu, cfd->cpumask);
 
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 4237e0744e26..e83bfafba8ef 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -303,6 +303,32 @@ static int clockevents_program_min_delta(struct clock_event_device *dev)
  *
  * Returns 0 on success, -ETIME when the event is in the past.
  */
+/*
+ * 一个例子
+ * clockevents_program_event
+ * hrtimer_interrupt
+ * smp_apic_timer_interrupt
+ * apic_timer_interrupt
+ * native_safe_halt
+ * default_idle
+ * arch_cpu_idle
+ * default_idle_call
+ * do_idle
+ * cpu_startup_entry
+ * start_secondary
+ * secondary_startup_64
+ *
+ * called by:
+ *   - kernel/time/clockevents.c|520| <<__clockevents_update_freq>> return clockevents_program_event(dev, dev->next_event, false);
+ *   - kernel/time/tick-broadcast.c|334| <<tick_handle_periodic_broadcast>> clockevents_program_event(dev, next, true);
+ *   - kernel/time/tick-broadcast.c|568| <<tick_broadcast_set_event>> clockevents_program_event(bc, expires, 1);
+ *   - kernel/time/tick-broadcast.c|952| <<hotplug_cpu__broadcast_tick_pull>> clockevents_program_event(bc, bc->next_event, 1);
+ *   - kernel/time/tick-common.c|125| <<tick_handle_periodic>> if (!clockevents_program_event(dev, next, false))
+ *   - kernel/time/tick-common.c|167| <<tick_setup_periodic>> if (!clockevents_program_event(dev, next, false))
+ *   - kernel/time/tick-oneshot.c|47| <<tick_program_event>> return clockevents_program_event(dev, expires, force);
+ *   - kernel/time/tick-oneshot.c|58| <<tick_resume_oneshot>> clockevents_program_event(dev, ktime_get(), true);
+ *   - kernel/time/tick-oneshot.c|70| <<tick_setup_oneshot>> clockevents_program_event(newdev, next_event, true);
+ */
 int clockevents_program_event(struct clock_event_device *dev, ktime_t expires,
 			      bool force)
 {
@@ -336,6 +362,9 @@ int clockevents_program_event(struct clock_event_device *dev, ktime_t expires,
 	delta = max(delta, (int64_t) dev->min_delta_ns);
 
 	clc = ((unsigned long long) delta * dev->mult) >> dev->shift;
+	/*
+	 * lapic_next_deadline()
+	 */
 	rc = dev->set_next_event((unsigned long) clc, dev);
 
 	return (rc && force) ? clockevents_program_min_delta(dev) : rc;
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index e2c41ab09461..de3bf3ec3ef4 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -1295,6 +1295,11 @@ static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now)
  * High resolution timer interrupt
  * Called with interrupts disabled
  */
+/*
+ * 在以下使用hrtimer_interrupt():
+ *   - kernel/time/hrtimer.c|1392| <<__hrtimer_peek_ahead_timers>> hrtimer_interrupt(td->evtdev);
+ *   - kernel/time/tick-oneshot.c|130| <<tick_init_highres>> return tick_switch_to_oneshot(hrtimer_interrupt);
+ */
 void hrtimer_interrupt(struct clock_event_device *dev)
 {
 	struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
@@ -1318,6 +1323,24 @@ void hrtimer_interrupt(struct clock_event_device *dev)
 	 */
 	cpu_base->expires_next = KTIME_MAX;
 
+	/*
+	 * 5.4上的例子
+	 * scheduler_tick
+	 * tick_sched_handle
+	 * tick_sched_timer
+	 * __hrtimer_run_queues
+	 * hrtimer_interrupt
+	 * smp_apic_timer_interrupt
+	 * apic_timer_interrupt
+	 * native_safe_halt
+	 * default_idle
+	 * arch_cpu_idle
+	 * default_idle_call
+	 * do_idle
+	 * cpu_startup_entry
+	 * start_secondary
+	 * secondary_startup_64
+	 */
 	__hrtimer_run_queues(cpu_base, now);
 
 	/* Reevaluate the clock bases for the next expiry */
@@ -1326,6 +1349,33 @@ void hrtimer_interrupt(struct clock_event_device *dev)
 	 * Store the new expiry value so the migration code can verify
 	 * against it.
 	 */
+	/*
+	 * 在以下使用hrtimer_cpu_base->expires_next:
+	 *   - kernel/time/hrtimer.c|175| <<hrtimer_check_target>> return expires <= new_base->cpu_base->expires_next;
+	 *   - kernel/time/hrtimer.c|470| <<__hrtimer_get_next_event>> ktime_t expires, expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|483| <<__hrtimer_get_next_event>> if (expires < expires_next) {
+	 *   - kernel/time/hrtimer.c|484| <<__hrtimer_get_next_event>> expires_next = expires;
+	 *   - kernel/time/hrtimer.c|493| <<__hrtimer_get_next_event>> if (expires_next < 0)
+	 *   - kernel/time/hrtimer.c|494| <<__hrtimer_get_next_event>> expires_next = 0;
+	 *   - kernel/time/hrtimer.c|495| <<__hrtimer_get_next_event>> return expires_next;
+	 *   - kernel/time/hrtimer.c|558| <<hrtimer_force_reprogram>> ktime_t expires_next;
+	 *   - kernel/time/hrtimer.c|563| <<hrtimer_force_reprogram>> expires_next = __hrtimer_get_next_event(cpu_base);
+	 *   - kernel/time/hrtimer.c|565| <<hrtimer_force_reprogram>> if (skip_equal && expires_next == cpu_base->expires_next)
+	 *   - kernel/time/hrtimer.c|568| <<hrtimer_force_reprogram>> cpu_base->expires_next = expires_next;
+	 *   - kernel/time/hrtimer.c|587| <<hrtimer_force_reprogram>> tick_program_event(cpu_base->expires_next, 1);
+	 *   - kernel/time/hrtimer.c|629| <<hrtimer_reprogram>> if (expires >= cpu_base->expires_next)
+	 *   - kernel/time/hrtimer.c|648| <<hrtimer_reprogram>> cpu_base->expires_next = expires;
+	 *   - kernel/time/hrtimer.c|657| <<hrtimer_init_hres>> base->expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|1306| <<hrtimer_interrupt>> ktime_t expires_next, now, entry_time, delta;
+	 *   - kernel/time/hrtimer.c|1324| <<hrtimer_interrupt>> cpu_base->expires_next = KTIME_MAX;
+	 *   - kernel/time/hrtimer.c|1347| <<hrtimer_interrupt>> expires_next = __hrtimer_get_next_event(cpu_base);
+	 *   - kernel/time/hrtimer.c|1352| <<hrtimer_interrupt>> cpu_base->expires_next = expires_next;
+	 *   - kernel/time/hrtimer.c|1357| <<hrtimer_interrupt>> if (!tick_program_event(expires_next, 0)) {
+	 *   - kernel/time/hrtimer.c|1397| <<hrtimer_interrupt>> expires_next = ktime_add_ns(now, 100 * NSEC_PER_MSEC);
+	 *   - kernel/time/hrtimer.c|1399| <<hrtimer_interrupt>> expires_next = ktime_add(now, delta);
+	 *   - kernel/time/hrtimer.c|1400| <<hrtimer_interrupt>> tick_program_event(expires_next, 1);
+	 *   - kernel/time/timer_list.c|155| <<print_cpu>> P_ns(expires_next);
+	 */
 	cpu_base->expires_next = expires_next;
 	cpu_base->in_hrtirq = 0;
 	raw_spin_unlock(&cpu_base->lock);
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 6b009c207671..e705db3c58de 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -24,6 +24,19 @@
 /**
  * tick_program_event
  */
+/*
+ * called by:
+ *   - kernel/time/hrtimer.c|587| <<hrtimer_force_reprogram>> tick_program_event(cpu_base->expires_next, 1);
+ *   - kernel/time/hrtimer.c|649| <<hrtimer_reprogram>> tick_program_event(expires, 1);
+ *   - kernel/time/hrtimer.c|1339| <<hrtimer_interrupt>> if (!tick_program_event(expires_next, 0)) {
+ *   - kernel/time/hrtimer.c|1382| <<hrtimer_interrupt>> tick_program_event(expires_next, 1);
+ *   - kernel/time/tick-broadcast.c|845| <<__tick_broadcast_oneshot_control>> tick_program_event(dev->next_event, 1);
+ *   - kernel/time/tick-internal.h|105| <<__tick_broadcast_oneshot_control>> extern int tick_program_event(ktime_t expires, int force);
+ *   - kernel/time/tick-sched.c|672| <<tick_nohz_restart>> tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ *   - kernel/time/tick-sched.c|831| <<tick_nohz_stop_sched_tick>> tick_program_event(tick, 1);
+ *   - kernel/time/tick-sched.c|1129| <<tick_nohz_handler>> tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ *   - kernel/time/tick-sched.c|1166| <<tick_nohz_switch_to_nohz>> tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ */
 int tick_program_event(ktime_t expires, int force)
 {
 	struct clock_event_device *dev = __this_cpu_read(tick_cpu_device.evtdev);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3c7b400512eb..83f9f5815266 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -1206,6 +1206,10 @@ void tick_irq_enter(void)
  * We rearm the timer until we get disabled by the idle code.
  * Called with interrupts disabled.
  */
+/*
+ * 在以下使用tick_sched_timer():
+ *   - kernel/time/tick-sched.c|1258| <<tick_setup_sched_timer>> ts->sched_timer.function = tick_sched_timer;
+ */
 static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer)
 {
 	struct tick_sched *ts =
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index a402df565e9e..15bff1f95ed2 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -62,6 +62,10 @@ void kvm_async_pf_deinit(void)
 	async_pf_cache = NULL;
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|377| <<kvm_vcpu_init>> kvm_async_pf_vcpu_init(vcpu);
+ */
 void kvm_async_pf_vcpu_init(struct kvm_vcpu *vcpu)
 {
 	INIT_LIST_HEAD(&vcpu->async_pf.done);
@@ -69,6 +73,10 @@ void kvm_async_pf_vcpu_init(struct kvm_vcpu *vcpu)
 	spin_lock_init(&vcpu->async_pf.lock);
 }
 
+/*
+ * 在以下使用async_pf_execute():
+ *   - virt/kvm/async_pf.c|212| <<kvm_setup_async_pf>> INIT_WORK(&work->work, async_pf_execute);
+ */
 static void async_pf_execute(struct work_struct *work)
 {
 	struct kvm_async_pf *apf =
@@ -87,6 +95,20 @@ static void async_pf_execute(struct work_struct *work)
 	 * access remotely.
 	 */
 	down_read(&mm->mmap_sem);
+	/*
+	 * Returns number of pages pinned. This may be fewer than the number
+	 * requested. If nr_pages is 0 or negative, returns 0. If no pages
+	 * were pinned, returns -errno. Each page returned must be released
+	 * with a put_page() call when it is finished with. vmas will only
+	 * remain valid while mmap_sem is held.
+	 *
+	 * Must be called with mmap_sem held for read or write.
+	 *
+	 * get_user_pages walks a process's page tables and takes a reference to
+	 * each struct page that each user address corresponds to at a given
+	 * instant. That is, it takes the page that would be accessed if a user
+	 * thread accesses the given user virtual address at that instant.
+	 */
 	get_user_pages_remote(NULL, mm, addr, 1, FOLL_WRITE, NULL, NULL,
 			&locked);
 	if (locked)
@@ -224,6 +246,10 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
 	return 0;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|2517| <<kvm_pv_enable_async_pf>> kvm_async_pf_wakeup_all(vcpu);
+ */
 int kvm_async_pf_wakeup_all(struct kvm_vcpu *vcpu)
 {
 	struct kvm_async_pf *work;
diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index f52ae1e52591..cf901786400a 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -66,6 +66,12 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
 				int len, const void *val)
 {
 	struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
+	/*
+	 * struct kvm_coalesced_mmio_ring {
+	 *	__u32 first, last;
+	 *	struct kvm_coalesced_mmio coalesced_mmio[0];
+	 * };
+	 */
 	struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
 	__u32 insert;
 
@@ -107,6 +113,10 @@ static const struct kvm_io_device_ops coalesced_mmio_ops = {
 	.destructor = coalesced_mmio_destructor,
 };
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|3849| <<kvm_dev_ioctl_create_vm>> r = kvm_coalesced_mmio_init(kvm);
+ */
 int kvm_coalesced_mmio_init(struct kvm *kvm)
 {
 	struct page *page;
@@ -118,6 +128,15 @@ int kvm_coalesced_mmio_init(struct kvm *kvm)
 		goto out_err;
 
 	ret = 0;
+	/*
+	 * 在以下使用kvm_memslots->coalesced_mmio_ring:
+	 *   - virt/kvm/coalesced_mmio.c|54| <<coalesced_mmio_has_room>> ring = dev->kvm->coalesced_mmio_ring;
+	 *   - virt/kvm/coalesced_mmio.c|69| <<coalesced_mmio_write>> struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
+	 *   - virt/kvm/coalesced_mmio.c|121| <<kvm_coalesced_mmio_init>> kvm->coalesced_mmio_ring = page_address(page);
+	 *   - virt/kvm/coalesced_mmio.c|137| <<kvm_coalesced_mmio_free>> if (kvm->coalesced_mmio_ring)
+	 *   - virt/kvm/coalesced_mmio.c|138| <<kvm_coalesced_mmio_free>> free_page((unsigned long )kvm->coalesced_mmio_ring);
+	 *   - virt/kvm/kvm_main.c|2953| <<kvm_vcpu_fault>> page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
+	 */
 	kvm->coalesced_mmio_ring = page_address(page);
 
 	/*
@@ -138,6 +157,10 @@ void kvm_coalesced_mmio_free(struct kvm *kvm)
 		free_page((unsigned long)kvm->coalesced_mmio_ring);
 }
 
+/*
+ * 处理KVM_REGISTER_COALESCED_MMIO:
+ *   - virt/kvm/kvm_main.c|3663| <<kvm_vm_ioctl>> r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
+ */
 int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
 					 struct kvm_coalesced_mmio_zone *zone)
 {
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index e4d90224507a..4e243d7518b1 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -201,6 +201,10 @@ irqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 	if (flags & POLLIN) {
 		idx = srcu_read_lock(&kvm->irq_srcu);
 		do {
+			/*
+			 * struct kvm_kernel_irqfd *irqfd:
+			 * -> struct kvm_kernel_irq_routing_entry irq_entry;
+			 */
 			seq = read_seqcount_begin(&irqfd->irq_entry_sc);
 			irq = irqfd->irq_entry;
 		} while (read_seqcount_retry(&irqfd->irq_entry_sc, seq));
@@ -249,6 +253,12 @@ irqfd_ptable_queue_proc(struct file *file, wait_queue_head_t *wqh,
 static void irqfd_update(struct kvm *kvm, struct kvm_kernel_irqfd *irqfd)
 {
 	struct kvm_kernel_irq_routing_entry *e;
+	/*
+	 * #define KVM_IRQCHIP_PIC_MASTER   0
+	 * #define KVM_IRQCHIP_PIC_SLAVE    1
+	 * #define KVM_IRQCHIP_IOAPIC       2
+	 * #define KVM_NR_IRQCHIPS          3
+	 */
 	struct kvm_kernel_irq_routing_entry entries[KVM_NR_IRQCHIPS];
 	int n_entries;
 
@@ -284,6 +294,10 @@ int  __attribute__((weak)) kvm_arch_update_irqfd_routing(
 }
 #endif
 
+/*
+ * called by:
+ *   - virt/kvm/eventfd.c|581| <<kvm_irqfd>> return kvm_irqfd_assign(kvm, args);
+ */
 static int
 kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
 {
@@ -304,6 +318,9 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
 	irqfd->kvm = kvm;
 	irqfd->gsi = args->gsi;
 	INIT_LIST_HEAD(&irqfd->list);
+	/*
+	 * inject的时候以kvm_kernel_irqfd->gsi用来identify某一个vector
+	 */
 	INIT_WORK(&irqfd->inject, irqfd_inject);
 	INIT_WORK(&irqfd->shutdown, irqfd_shutdown);
 	seqcount_init(&irqfd->irq_entry_sc);
@@ -605,6 +622,10 @@ kvm_irqfd_release(struct kvm *kvm)
  * Take note of a change in irq routing.
  * Caller must invoke synchronize_srcu(&kvm->irq_srcu) afterwards.
  */
+/*
+ * called by:
+ *   - virt/kvm/irqchip.c|257| <<kvm_set_irq_routing>> kvm_irq_routing_update(kvm);
+ */
 void kvm_irq_routing_update(struct kvm *kvm)
 {
 	struct kvm_kernel_irqfd *irqfd;
@@ -954,6 +975,10 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 	return ret;
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|3680| <<kvm_vm_ioctl>> r = kvm_ioeventfd(kvm, &data);
+ */
 int
 kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {
diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index 0bfcbb9a9e62..26ecf90fe11e 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -31,6 +31,11 @@
 #include <trace/events/kvm.h>
 #include "irq.h"
 
+/*
+ * called by:
+ *   - virt/kvm/eventfd.c|265| <<irqfd_update>> n_entries = kvm_irq_map_gsi(kvm, entries, irqfd->gsi);
+ *   - virt/kvm/irqchip.c|118| <<kvm_set_irq>> i = kvm_irq_map_gsi(kvm, irq_set, irq);
+ */
 int kvm_irq_map_gsi(struct kvm *kvm,
 		    struct kvm_kernel_irq_routing_entry *entries, int gsi)
 {
@@ -62,6 +67,10 @@ int kvm_irq_map_chip_pin(struct kvm *kvm, unsigned irqchip, unsigned pin)
 	return irq_rt->chip[irqchip][pin];
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|3690| <<kvm_vm_ioctl(KVM_SIGNAL_MSI)>> r = kvm_send_userspace_msi(kvm, &msi);
+ */
 int kvm_send_userspace_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
 	struct kvm_kernel_irq_routing_entry route;
@@ -84,9 +93,27 @@ int kvm_send_userspace_msi(struct kvm *kvm, struct kvm_msi *msi)
  *  = 0   Interrupt was coalesced (previous irq is still pending)
  *  > 0   Number of CPUs interrupt was delivered to
  */
+/*
+ * called by:
+ *   - arch/x86/kvm/i8254.c|250| <<pit_do_work>> kvm_set_irq(kvm, pit->irq_source_id, 0, 1, false);
+ *   - arch/x86/kvm/i8254.c|251| <<pit_do_work>> kvm_set_irq(kvm, pit->irq_source_id, 0, 0, false);
+ *   - arch/x86/kvm/x86.c|4582| <<kvm_vm_ioctl_irq_line>> irq_event->status = kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID,
+ *   - virt/kvm/eventfd.c|55| <<irqfd_inject>> kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID, irqfd->gsi, 1,
+ *   - virt/kvm/eventfd.c|57| <<irqfd_inject>> kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID, irqfd->gsi, 0,
+ *   - virt/kvm/eventfd.c|60| <<irqfd_inject>> kvm_set_irq(kvm, KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
+ *   - virt/kvm/eventfd.c|81| <<irqfd_resampler_ack>> kvm_set_irq(kvm, KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
+ *   - virt/kvm/eventfd.c|106| <<irqfd_resampler_shutdown>> kvm_set_irq(kvm, KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
+ */
 int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level,
 		bool line_status)
 {
+	/*
+	 * 对于x86来说 ...
+	 * #define KVM_IRQCHIP_PIC_MASTER   0
+	 * #define KVM_IRQCHIP_PIC_SLAVE    1
+	 * #define KVM_IRQCHIP_IOAPIC       2
+	 * #define KVM_NR_IRQCHIPS          3
+	 */
 	struct kvm_kernel_irq_routing_entry irq_set[KVM_NR_IRQCHIPS];
 	int ret = -1, i, idx;
 
@@ -102,6 +129,9 @@ int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level,
 
 	while (i--) {
 		int r;
+		/*
+		 * kvm_set_msi()
+		 */
 		r = irq_set[i].set(&irq_set[i], kvm, irq_source_id, level,
 				   line_status);
 		if (r < 0)
@@ -141,6 +171,10 @@ void kvm_free_irq_routing(struct kvm *kvm)
 	free_irq_routing_table(rt);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/irqchip.c|257| <<kvm_set_irq_routing>> r = setup_routing_entry(kvm, new, e, ue);
+ */
 static int setup_routing_entry(struct kvm *kvm,
 			       struct kvm_irq_routing_table *rt,
 			       struct kvm_kernel_irq_routing_entry *e,
@@ -189,6 +223,15 @@ bool __weak kvm_arch_can_set_irq_routing(struct kvm *kvm)
 	return true;
 }
 
+/*
+ * called by:
+ *   - arch/powerpc/kvm/mpic.c|1650| <<mpic_set_default_irq_routing>> kvm_set_irq_routing(opp->kvm, routing, 0, 0);
+ *   - arch/s390/kvm/kvm-s390.c|1866| <<kvm_arch_vm_ioctl>> r = kvm_set_irq_routing(kvm, &routing, 0, 0);
+ *   - arch/x86/kvm/irq_comm.c|434| <<kvm_setup_default_irq_routing>> return kvm_set_irq_routing(kvm, default_routing,
+ *   - arch/x86/kvm/irq_comm.c|442| <<kvm_setup_empty_irq_routing>> return kvm_set_irq_routing(kvm, empty_routing, 0, 0);
+ *   - virt/kvm/arm/vgic/vgic-irqfd.c|125| <<kvm_vgic_setup_default_irq_routing>> ret = kvm_set_irq_routing(kvm, entries, nr, 0);
+ *   - virt/kvm/kvm_main.c|3481| <<kvm_vm_ioctl(KVM_SET_GSI_ROUTING)>> r = kvm_set_irq_routing(kvm, entries, routing.nr,
+ */
 int kvm_set_irq_routing(struct kvm *kvm,
 			const struct kvm_irq_routing_entry *ue,
 			unsigned nr,
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 2effd647a2cd..fca21eb1e6a7 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -73,6 +73,20 @@ MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
 
 /* Architectures should define their poll value according to the halt latency */
+/*
+ * 在实际业务中,guest执行HLT指令是导致虚拟化overhead的一个重要原因.
+ *
+ * KVM halt polling特性就是为了解决这一个问题被引入的,它在Linux 4.3-rc1被合入主干内核,
+ * 其基本原理是当guest idle发生vm-exit时,host 继续polling一段时间,用于减少guest的业务时延.
+ * 进一步讲,在vcpu进入idle之后,guest内核默认处理是执行HLT指令,就会发生vm-exit,
+ * host kernel并不马上让出物理核给调度器,而是poll一段时间,若guest在这段时间内被唤醒,便可以
+ * 马上调度回该vcpu线程继续运行.
+ *
+ * polling机制带来时延上的降低,至少是一个线程调度周期,通常是几微妙,但最终的性能提升是跟
+ * guest内业务模型相关的.如果在host kernel polling期间,没有唤醒事件发生或是运行队列里面
+ * 其他任务变成runnable状态,那么调度器就会被唤醒去干其他任务的事.因此,halt polling机制对
+ * 于那些在很短时间间隔就会被唤醒一次的业务特别有效.
+ */
 unsigned int halt_poll_ns = KVM_HALT_POLL_NS_DEFAULT;
 module_param(halt_poll_ns, uint, 0644);
 EXPORT_SYMBOL_GPL(halt_poll_ns);
@@ -130,6 +144,10 @@ static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
 
 static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot, gfn_t gfn);
 
+/*
+ * 在以下使用kvm_rebooting:
+ *   - virt/kvm/kvm_main.c|3853| <<kvm_reboot>> kvm_rebooting = true;
+ */
 __visible bool kvm_rebooting;
 EXPORT_SYMBOL_GPL(kvm_rebooting);
 
@@ -179,6 +197,27 @@ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
 /*
  * Switches to specified vcpu, until a matching vcpu_put()
  */
+/*
+ * x86下的调用:
+ *   - arch/x86/kvm/vmx/nested.c|282| <<nested_vmx_free_vcpu>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|4074| <<kvm_arch_vcpu_ioctl>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8424| <<kvm_arch_vcpu_ioctl_run>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8527| <<kvm_arch_vcpu_ioctl_get_regs>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8567| <<kvm_arch_vcpu_ioctl_set_regs>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8622| <<kvm_arch_vcpu_ioctl_get_sregs>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8631| <<kvm_arch_vcpu_ioctl_get_mpstate>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8656| <<kvm_arch_vcpu_ioctl_set_mpstate>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8822| <<kvm_arch_vcpu_ioctl_set_sregs>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8834| <<kvm_arch_vcpu_ioctl_set_guest_debug>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8895| <<kvm_arch_vcpu_ioctl_translate>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8913| <<kvm_arch_vcpu_ioctl_get_fpu>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|8933| <<kvm_arch_vcpu_ioctl_set_fpu>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|9042| <<kvm_arch_vcpu_setup>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|9058| <<kvm_arch_vcpu_postcreate>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|9081| <<kvm_arch_vcpu_destroy>> vcpu_load(vcpu);
+ *   - arch/x86/kvm/x86.c|9467| <<kvm_unload_vcpu_mmu>> vcpu_load(vcpu);
+ *   - virt/kvm/arm/arm.c|691| <<kvm_arch_vcpu_ioctl_run>> vcpu_load(vcpu);
+ */
 void vcpu_load(struct kvm_vcpu *vcpu)
 {
 	int cpu = get_cpu();
@@ -302,11 +341,28 @@ void kvm_flush_remote_tlbs(struct kvm *kvm)
 EXPORT_SYMBOL_GPL(kvm_flush_remote_tlbs);
 #endif
 
+/*
+ * called by:
+ *   - arch/x86/kvm/mmu.c|2828| <<kvm_mmu_prepare_zap_page>> kvm_reload_remote_mmus(kvm);
+ *   - arch/x86/kvm/mmu.c|6065| <<kvm_mmu_invalidate_zap_all_pages>> kvm_reload_remote_mmus(kvm);
+ */
 void kvm_reload_remote_mmus(struct kvm *kvm)
 {
 	kvm_make_all_cpus_request(kvm, KVM_REQ_MMU_RELOAD);
 }
 
+/*
+ * called by:
+ *   - arch/mips/kvm/mips.c|308| <<kvm_arch_vcpu_create>> err = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/powerpc/kvm/book3s_hv.c|1997| <<kvmppc_core_vcpu_create_hv>> err = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/powerpc/kvm/book3s_pr.c|1456| <<kvmppc_core_vcpu_create_pr>> err = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/powerpc/kvm/e500.c|453| <<kvmppc_core_vcpu_create_e500>> err = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/powerpc/kvm/e500mc.c|324| <<kvmppc_core_vcpu_create_e500mc>> err = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/s390/kvm/kvm-s390.c|2666| <<kvm_arch_vcpu_create>> rc = kvm_vcpu_init(vcpu, kvm, id);
+ *   - arch/x86/kvm/svm.c|2198| <<svm_create_vcpu>> err = kvm_vcpu_init(&svm->vcpu, kvm, id);
+ *   - arch/x86/kvm/vmx/vmx.c|7457| <<vmx_create_vcpu>> err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
+ *   - virt/kvm/arm/arm.c|293| <<kvm_arch_vcpu_create>> err = kvm_vcpu_init(vcpu, kvm, id);
+ */
 int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
 {
 	struct page *page;
@@ -328,6 +384,10 @@ int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
 		r = -ENOMEM;
 		goto fail;
 	}
+	/*
+	 * struct kvm_vcpu *vcpu:
+	 * -> struct kvm_run *run;
+	 */
 	vcpu->run = page_address(page);
 
 	kvm_vcpu_set_in_spin_loop(vcpu, false);
@@ -346,6 +406,15 @@ int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
 }
 EXPORT_SYMBOL_GPL(kvm_vcpu_init);
 
+/*
+ * x86下的调用:
+ *   - arch/x86/kvm/svm.c|2255| <<svm_create_vcpu>> kvm_vcpu_uninit(&svm->vcpu);
+ *   - arch/x86/kvm/svm.c|2272| <<svm_free_vcpu>> kvm_vcpu_uninit(vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|7430| <<vmx_free_vcpu>> kvm_vcpu_uninit(vcpu);
+ *   - arch/x86/kvm/vmx/vmx.c|7545| <<vmx_create_vcpu>> kvm_vcpu_uninit(&vmx->vcpu);
+ *   - virt/kvm/arm/arm.c|303| <<kvm_arch_vcpu_create>> kvm_vcpu_uninit(vcpu);
+ *   - virt/kvm/arm/arm.c|322| <<kvm_arch_vcpu_free>> kvm_vcpu_uninit(vcpu);
+ */
 void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
 {
 	/*
@@ -521,6 +590,10 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
 	srcu_read_unlock(&kvm->srcu, idx);
 }
 
+/*
+ * 在以下使用kvm_mmu_notifier_ops:
+ *   - virt/kvm/kvm_main.c|567| <<kvm_init_mmu_notifier>> kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
+ */
 static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
 	.flags			= MMU_INVALIDATE_DOES_NOT_BLOCK,
 	.invalidate_range_start	= kvm_mmu_notifier_invalidate_range_start,
@@ -532,6 +605,10 @@ static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
 	.release		= kvm_mmu_notifier_release,
 };
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|758| <<kvm_create_vm>> r = kvm_init_mmu_notifier(kvm);
+ */
 static int kvm_init_mmu_notifier(struct kvm *kvm)
 {
 	kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
@@ -598,6 +675,10 @@ static void kvm_free_memslots(struct kvm *kvm, struct kvm_memslots *slots)
 	kvfree(slots);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|817| <<kvm_destroy_vm>> kvm_destroy_vm_debugfs(kvm);
+ */
 static void kvm_destroy_vm_debugfs(struct kvm *kvm)
 {
 	int i;
@@ -614,6 +695,10 @@ static void kvm_destroy_vm_debugfs(struct kvm *kvm)
 	}
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|3609| <<kvm_dev_ioctl_create_vm>> if (kvm_create_vm_debugfs(kvm, r) < 0) {
+ */
 static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
 {
 	char dir_name[ITOA_MAX_LEN * 2];
@@ -664,6 +749,10 @@ void __weak kvm_arch_pre_destroy_vm(struct kvm *kvm)
 {
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|3666| <<kvm_dev_ioctl_create_vm>> kvm = kvm_create_vm(type);
+ */
 static struct kvm *kvm_create_vm(unsigned long type)
 {
 	int r, i;
@@ -774,6 +863,10 @@ static void kvm_destroy_devices(struct kvm *kvm)
 	}
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|859| <<kvm_put_kvm>> kvm_destroy_vm(kvm);
+ */
 static void kvm_destroy_vm(struct kvm *kvm)
 {
 	int i;
@@ -819,6 +912,26 @@ void kvm_get_kvm(struct kvm *kvm)
 }
 EXPORT_SYMBOL_GPL(kvm_get_kvm);
 
+/*
+ * called by:
+ *   - arch/powerpc/kvm/book3s_64_mmu_hv.c|1943| <<kvm_htab_release>> kvm_put_kvm(ctx->kvm);
+ *   - arch/powerpc/kvm/book3s_64_mmu_hv.c|1977| <<kvm_vm_ioctl_get_htab_fd>> kvm_put_kvm(kvm);
+ *   - arch/powerpc/kvm/book3s_64_mmu_hv.c|2022| <<debugfs_htab_release>> kvm_put_kvm(p->kvm);
+ *   - arch/powerpc/kvm/book3s_64_vio.c|278| <<kvm_spapr_tce_release>> kvm_put_kvm(stt->kvm);
+ *   - arch/powerpc/kvm/book3s_hv.c|1876| <<debugfs_timings_release>> kvm_put_kvm(p->vcpu->kvm);
+ *   - drivers/gpu/drm/i915/gvt/kvmgt.c|1427| <<kvmgt_guest_exit>> kvm_put_kvm(info->kvm);
+ *   - virt/kvm/async_pf.c|113| <<async_pf_execute>> kvm_put_kvm(vcpu->kvm);
+ *   - virt/kvm/async_pf.c|140| <<kvm_clear_async_pf_completion_queue>> kvm_put_kvm(vcpu->kvm);
+ *   - virt/kvm/async_pf.c|221| <<kvm_setup_async_pf>> kvm_put_kvm(work->vcpu->kvm);
+ *   - virt/kvm/kvm_main.c|870| <<kvm_vm_release>> kvm_put_kvm(kvm);
+ *   - virt/kvm/kvm_main.c|2821| <<kvm_vcpu_release>> kvm_put_kvm(vcpu->kvm);
+ *   - virt/kvm/kvm_main.c|2926| <<kvm_vm_ioctl_create_vcpu>> kvm_put_kvm(kvm);
+ *   - virt/kvm/kvm_main.c|3262| <<kvm_device_release>> kvm_put_kvm(kvm);
+ *   - virt/kvm/kvm_main.c|3349| <<kvm_ioctl_create_device>> kvm_put_kvm(kvm);
+ *   - virt/kvm/kvm_main.c|3702| <<kvm_dev_ioctl_create_vm>> kvm_put_kvm(kvm);
+ *   - virt/kvm/kvm_main.c|4169| <<kvm_debugfs_open>> kvm_put_kvm(stat_data->kvm);
+ *   - virt/kvm/kvm_main.c|4182| <<kvm_debugfs_release>> kvm_put_kvm(stat_data->kvm);
+ */
 void kvm_put_kvm(struct kvm *kvm)
 {
 	if (refcount_dec_and_test(&kvm->users_count))
@@ -827,6 +940,9 @@ void kvm_put_kvm(struct kvm *kvm)
 EXPORT_SYMBOL_GPL(kvm_put_kvm);
 
 
+/*
+ * struct file_operations kvm_vm_fops.release = kvm_vm_release()
+ */
 static int kvm_vm_release(struct inode *inode, struct file *filp)
 {
 	struct kvm *kvm = filp->private_data;
@@ -1286,6 +1402,12 @@ EXPORT_SYMBOL_GPL(kvm_get_dirty_log_protect);
  * @kvm:	pointer to kvm instance
  * @log:	slot id and address from which to fetch the bitmap of dirty pages
  */
+/*
+ * called by:
+ *   - arch/mips/kvm/mips.c|1037| <<kvm_vm_ioctl_clear_dirty_log>> r = kvm_clear_dirty_log_protect(kvm, log, &flush);
+ *   - arch/x86/kvm/x86.c|4670| <<kvm_vm_ioctl_clear_dirty_log>> r = kvm_clear_dirty_log_protect(kvm, log, &flush);
+ *   - virt/kvm/arm/arm.c|1241| <<kvm_vm_ioctl_clear_dirty_log>> r = kvm_clear_dirty_log_protect(kvm, log, &flush);
+ */
 int kvm_clear_dirty_log_protect(struct kvm *kvm,
 				struct kvm_clear_dirty_log *log, bool *flush)
 {
@@ -1353,11 +1475,19 @@ int kvm_clear_dirty_log_protect(struct kvm *kvm,
 EXPORT_SYMBOL_GPL(kvm_clear_dirty_log_protect);
 #endif
 
+/*
+ * called by:
+ *   - arch/x86/kvm/x86.c|9662| <<kvm_arch_create_memslot>> !kvm_largepages_enabled()) {
+ */
 bool kvm_largepages_enabled(void)
 {
 	return largepages_enabled;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/vmx.c|8602| <<hardware_setup>> kvm_disable_largepages();
+ */
 void kvm_disable_largepages(void)
 {
 	largepages_enabled = false;
@@ -1831,6 +1961,11 @@ static void kvm_cache_gfn_to_pfn(struct kvm_memory_slot *slot, gfn_t gfn,
 	cache->generation = gen;
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|1991| <<kvm_map_gfn>> return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map,
+ *   - virt/kvm/kvm_main.c|1998| <<kvm_vcpu_map>> return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map,
+ */
 static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
 			 struct kvm_host_map *map,
 			 struct gfn_to_pfn_cache *cache,
@@ -1894,6 +2029,12 @@ int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
 }
 EXPORT_SYMBOL_GPL(kvm_map_gfn);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|631| <<nested_cache_shadow_vmcs12>> if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcs12->vmcs_link_pointer), &map))
+ *   - arch/x86/kvm/vmx/nested.c|2715| <<nested_vmx_check_vmcs_link_ptr>> if (CC(kvm_vcpu_map(vcpu, gpa_to_gfn(vmcs12->vmcs_link_pointer), &map)))
+ *   - arch/x86/kvm/vmx/nested.c|2939| <<nested_get_vmcs12_pages>> if (!kvm_vcpu_map(vcpu, gpa_to_gfn(vmcs12->virtual_apic_page_addr), map)) {
+ */
 int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
 {
 	return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map,
@@ -2079,6 +2220,22 @@ int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len)
 }
 EXPORT_SYMBOL_GPL(kvm_read_guest);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/hyperv.c|1570| <<kvm_hvcall_signal_event>> ret = kvm_vcpu_read_guest(vcpu, gpa, &param, sizeof(param));
+ *   - arch/x86/kvm/svm.c|3167| <<nested_svm_intercept_ioio>> if (kvm_vcpu_read_guest(&svm->vcpu, gpa, &val, iopm_len))
+ *   - arch/x86/kvm/svm.c|3192| <<nested_svm_exit_handled_msr>> if (kvm_vcpu_read_guest(&svm->vcpu, svm->nested.vmcb_msrpm + offset, &value, 4))
+ *   - arch/x86/kvm/svm.c|3507| <<nested_svm_vmrun_msrpm>> if (kvm_vcpu_read_guest(&svm->vcpu, offset, &value, 4))
+ *   - arch/x86/kvm/vmx/nested.c|847| <<nested_vmx_load_msr>> if (kvm_vcpu_read_guest(vcpu, gpa + i * sizeof(e),
+ *   - arch/x86/kvm/vmx/nested.c|881| <<nested_vmx_store_msr>> if (kvm_vcpu_read_guest(vcpu,
+ *   - arch/x86/kvm/vmx/nested.c|3921| <<nested_vmx_restore_host_state>> if (kvm_vcpu_read_guest(vcpu, gpa, &g, sizeof(g))) {
+ *   - arch/x86/kvm/vmx/nested.c|3930| <<nested_vmx_restore_host_state>> if (kvm_vcpu_read_guest(vcpu, gpa, &h, sizeof(h))) {
+ *   - arch/x86/kvm/vmx/nested.c|4982| <<nested_vmx_check_io_bitmaps>> if (kvm_vcpu_read_guest(vcpu, bitmap, &b, 1))
+ *   - arch/x86/kvm/vmx/nested.c|5044| <<nested_vmx_exit_handled_msr>> if (kvm_vcpu_read_guest(vcpu, bitmap + msr_index/8, &b, 1))
+ *   - arch/x86/kvm/vmx/nested.c|5144| <<nested_vmx_exit_handled_vmcs_access>> if (kvm_vcpu_read_guest(vcpu, bitmap + field/8, &b, 1))
+ *   - arch/x86/kvm/x86.c|5354| <<kvm_read_guest_phys_system>> int r = kvm_vcpu_read_guest(vcpu, addr, val, bytes);
+ *   - arch/x86/kvm/x86.c|5534| <<read_emulate>> return !kvm_vcpu_read_guest(vcpu, gpa, val, bytes);
+ */
 int kvm_vcpu_read_guest(struct kvm_vcpu *vcpu, gpa_t gpa, void *data, unsigned long len)
 {
 	gfn_t gfn = gpa >> PAGE_SHIFT;
@@ -2193,6 +2350,15 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
 }
 EXPORT_SYMBOL_GPL(kvm_write_guest);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/vmx/nested.c|903| <<nested_vmx_store_msr>> if (kvm_vcpu_write_guest(vcpu,
+ *   - arch/x86/kvm/vmx/nested.c|4462| <<handle_vmclear>> kvm_vcpu_write_guest(vcpu,
+ *   - arch/x86/kvm/x86.c|2486| <<xen_hvm_config>> if (kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE))
+ *   - arch/x86/kvm/x86.c|5379| <<kvm_write_guest_virt_helper>> ret = kvm_vcpu_write_guest(vcpu, gpa, data, towrite);
+ *   - arch/x86/kvm/x86.c|5500| <<emulator_write_phys>> ret = kvm_vcpu_write_guest(vcpu, gpa, val, bytes);
+ *   - arch/x86/kvm/x86.c|7735| <<enter_smm>> kvm_vcpu_write_guest(vcpu, vcpu->arch.smbase + 0xfe00, buf, sizeof(buf));
+ */
 int kvm_vcpu_write_guest(struct kvm_vcpu *vcpu, gpa_t gpa, const void *data,
 		         unsigned long len)
 {
@@ -2375,6 +2541,14 @@ void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn)
 }
 EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);
 
+/*
+ * called by:
+ *   - arch/mips/kvm/mips.c|453| <<kvm_arch_vcpu_ioctl_run>> kvm_sigset_activate(vcpu);
+ *   - arch/powerpc/kvm/powerpc.c|1811| <<kvm_arch_vcpu_ioctl_run>> kvm_sigset_activate(vcpu);
+ *   - arch/s390/kvm/kvm-s390.c|3580| <<kvm_arch_vcpu_ioctl_run>> kvm_sigset_activate(vcpu);
+ *   - arch/x86/kvm/x86.c|8425| <<kvm_arch_vcpu_ioctl_run>> kvm_sigset_activate(vcpu);
+ *   - virt/kvm/arm/arm.c|693| <<kvm_arch_vcpu_ioctl_run>> kvm_sigset_activate(vcpu);
+ */
 void kvm_sigset_activate(struct kvm_vcpu *vcpu)
 {
 	if (!vcpu->sigset_active)
@@ -2398,6 +2572,10 @@ void kvm_sigset_deactivate(struct kvm_vcpu *vcpu)
 	sigemptyset(&current->real_blocked);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2628| <<kvm_vcpu_block>> grow_halt_poll_ns(vcpu);
+ */
 static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
 {
 	unsigned int old, val, grow;
@@ -2455,6 +2633,20 @@ static int kvm_vcpu_check_block(struct kvm_vcpu *vcpu)
 /*
  * The vCPU has executed a HLT instruction with in-kernel mode enabled.
  */
+/*
+ * called by:
+ *   - arch/arm/kvm/handle_exit.c|83| <<kvm_handle_wfx>> kvm_vcpu_block(vcpu);
+ *   - arch/arm64/kvm/handle_exit.c|110| <<kvm_handle_wfx>> kvm_vcpu_block(vcpu);
+ *   - arch/mips/kvm/emulate.c|978| <<kvm_mips_emul_wait>> kvm_vcpu_block(vcpu);
+ *   - arch/powerpc/kvm/book3s_pr.c|355| <<kvmppc_set_msr_pr>> kvm_vcpu_block(vcpu);
+ *   - arch/powerpc/kvm/book3s_pr_papr.c|382| <<kvmppc_h_pr>> kvm_vcpu_block(vcpu);
+ *   - arch/powerpc/kvm/booke.c|704| <<kvmppc_core_prepare_to_enter>> kvm_vcpu_block(vcpu);
+ *   - arch/powerpc/kvm/powerpc.c|245| <<kvmppc_kvm_pv>> kvm_vcpu_block(vcpu);
+ *   - arch/s390/kvm/interrupt.c|1085| <<kvm_s390_handle_wait>> kvm_vcpu_block(vcpu);
+ *   - arch/x86/kvm/x86.c|8028| <<vcpu_block>> kvm_vcpu_block(vcpu);
+ *   - arch/x86/kvm/x86.c|8236| <<kvm_arch_vcpu_ioctl_run>> kvm_vcpu_block(vcpu);
+ *   - virt/kvm/arm/psci.c|92| <<kvm_psci_vcpu_suspend>> kvm_vcpu_block(vcpu);
+ */
 void kvm_vcpu_block(struct kvm_vcpu *vcpu)
 {
 	ktime_t start, cur;
@@ -2463,6 +2655,21 @@ void kvm_vcpu_block(struct kvm_vcpu *vcpu)
 	u64 block_ns;
 
 	start = cur = ktime_get();
+	/*
+	 * 在实际业务中,guest执行HLT指令是导致虚拟化overhead的一个重要原因.
+	 *
+	 * KVM halt polling特性就是为了解决这一个问题被引入的,它在Linux 4.3-rc1被合入主干内核,
+	 * 其基本原理是当guest idle发生vm-exit时,host 继续polling一段时间,用于减少guest的业务时延.
+	 * 进一步讲,在vcpu进入idle之后,guest内核默认处理是执行HLT指令,就会发生vm-exit,
+	 * host kernel并不马上让出物理核给调度器,而是poll一段时间,若guest在这段时间内被唤醒,便可以
+	 * 马上调度回该vcpu线程继续运行.
+	 *
+	 * polling机制带来时延上的降低,至少是一个线程调度周期,通常是几微妙,但最终的性能提升是跟
+	 * guest内业务模型相关的.如果在host kernel polling期间,没有唤醒事件发生或是运行队列里面
+	 * 其他任务变成runnable状态,那么调度器就会被唤醒去干其他任务的事.因此,halt polling机制对
+	 * 于那些在很短时间间隔就会被唤醒一次的业务特别有效.
+
+	 */
 	if (vcpu->halt_poll_ns && !kvm_arch_no_poll(vcpu)) {
 		ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
 
@@ -2521,6 +2728,15 @@ void kvm_vcpu_block(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_vcpu_block);
 
+/*
+ * called by:
+ *   - arch/x86/kvm/svm.c|1218| <<avic_ga_log_notifier>> kvm_vcpu_wake_up(vcpu);
+ *   - arch/x86/kvm/svm.c|4590| <<avic_incomplete_ipi_interception>> kvm_vcpu_wake_up(vcpu);
+ *   - arch/x86/kvm/svm.c|5221| <<svm_deliver_avic_intr>> kvm_vcpu_wake_up(vcpu);
+ *   - virt/kvm/arm/arch_timer.c|115| <<kvm_timer_inject_irq_work>> kvm_vcpu_wake_up(vcpu);
+ *   - virt/kvm/kvm_main.c|275| <<kvm_make_vcpus_request_mask>> if (!(req & KVM_REQUEST_NO_WAKEUP) && kvm_vcpu_wake_up(vcpu))
+ *   - virt/kvm/kvm_main.c|2661| <<kvm_vcpu_kick>> if (kvm_vcpu_wake_up(vcpu))
+ */
 bool kvm_vcpu_wake_up(struct kvm_vcpu *vcpu)
 {
 	struct swait_queue_head *wqp;
@@ -2550,6 +2766,9 @@ void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
 
 	me = get_cpu();
 	if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
+		/*
+		 * native_smp_send_reschedule()
+		 */
 		if (kvm_arch_vcpu_should_kick(vcpu))
 			smp_send_reschedule(cpu);
 	put_cpu();
@@ -2626,6 +2845,10 @@ bool __weak kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
 	return kvm_arch_vcpu_runnable(vcpu);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2698| <<kvm_vcpu_on_spin>> if (swait_active(&vcpu->wq) && !vcpu_dy_runnable(vcpu))
+ */
 static bool vcpu_dy_runnable(struct kvm_vcpu *vcpu)
 {
 	if (kvm_arch_dy_runnable(vcpu))
@@ -2639,6 +2862,24 @@ static bool vcpu_dy_runnable(struct kvm_vcpu *vcpu)
 	return false;
 }
 
+/*
+ * called by:
+ *   - arch/arm/kvm/handle_exit.c|79| <<kvm_handle_wfx>> kvm_vcpu_on_spin(vcpu, vcpu_mode_priv(vcpu));
+ *   - arch/arm64/kvm/handle_exit.c|106| <<kvm_handle_wfx>> kvm_vcpu_on_spin(vcpu, vcpu_mode_priv(vcpu));
+ *   - arch/s390/kvm/diag.c|153| <<__diag_time_slice_end>> kvm_vcpu_on_spin(vcpu, true);
+ *   - arch/x86/kvm/hyperv.c|1644| <<kvm_hv_hypercall>> kvm_vcpu_on_spin(vcpu, true);
+ *   - arch/x86/kvm/svm.c|4518| <<pause_interception>> kvm_vcpu_on_spin(vcpu, in_kernel);
+ *   - arch/x86/kvm/vmx/vmx.c|5836| <<handle_pause>> kvm_vcpu_on_spin(vcpu, true);
+ *
+ * Intel的cpu上,使用的VMM为kvm时,当guest的vcpu变为busy-waiting状态,
+ * 也就是loop-wait状态,就会在一定情况下触发vmexit.
+ *
+ * 触发条件: 由于kvm中不会使能"PAUSE exiting"feature, 因此单一的PAUSE指令
+ * 不会导致vmexit,kvm中只使用"PAUSE-loop exiting" feature,即循环(loop-wait)中
+ * 的PAUSE指令会导致vmexit,具体情境为:当一个循环中的两次PAUSE之间的时间差不超
+ * 过PLE_gap常量,且该循环中某次PAUSE指令与第一次PAUSE指令的时间差超过了PLE_window,
+ * 那么就会产生一个vmexit,触发原因field会填为PAUSE指令.
+ */
 void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
 {
 	struct kvm *kvm = me->kvm;
@@ -2668,6 +2909,9 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
 				continue;
 			if (vcpu == me)
 				continue;
+			/*
+			 * 之前是kvm_arch_vcpu_runnable()
+			 */
 			if (swait_active(&vcpu->wq) && !vcpu_dy_runnable(vcpu))
 				continue;
 			if (yield_to_kernel_mode && !kvm_arch_vcpu_in_kernel(vcpu))
@@ -2725,6 +2969,18 @@ static int kvm_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
 	return 0;
 }
 
+/*
+ * kvm_vcpu_release
+  ____fput
+  task_work_run
+  do_exit
+  do_group_exit
+  get_signal
+  do_signal
+  exit_to_usermode_loop
+  do_syscall_64
+  entry_SYSCALL_64_after_hwframe
+ */
 static int kvm_vcpu_release(struct inode *inode, struct file *filp)
 {
 	struct kvm_vcpu *vcpu = filp->private_data;
@@ -2745,6 +3001,10 @@ static struct file_operations kvm_vcpu_fops = {
 /*
  * Allocates an inode for the vcpu.
  */
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2842| <<kvm_vm_ioctl_create_vcpu>> r = create_vcpu_fd(vcpu);
+ */
 static int create_vcpu_fd(struct kvm_vcpu *vcpu)
 {
 	char name[8 + 1 + ITOA_MAX_LEN + 1];
@@ -2753,6 +3013,10 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu)
 	return anon_inode_getfd(name, &kvm_vcpu_fops, vcpu, O_RDWR | O_CLOEXEC);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|2828| <<kvm_vm_ioctl_create_vcpu>> r = kvm_create_vcpu_debugfs(vcpu);
+ */
 static int kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
 {
 	char dir_name[ITOA_MAX_LEN * 2];
@@ -3181,6 +3445,17 @@ struct kvm_device *kvm_device_from_filp(struct file *filp)
 	return filp->private_data;
 }
 
+/*
+ * 在以下使用kvm_device_ops_table[]:
+ *   - virt/kvm/kvm_main.c|3457| <<kvm_register_device_ops>> if (type >= ARRAY_SIZE(kvm_device_ops_table))
+ *   - virt/kvm/kvm_main.c|3460| <<kvm_register_device_ops>> if (kvm_device_ops_table[type] != NULL)
+ *   - virt/kvm/kvm_main.c|3463| <<kvm_register_device_ops>> kvm_device_ops_table[type] = ops;
+ *   - virt/kvm/kvm_main.c|3469| <<kvm_unregister_device_ops>> if (kvm_device_ops_table[type] != NULL)
+ *   - virt/kvm/kvm_main.c|3470| <<kvm_unregister_device_ops>> kvm_device_ops_table[type] = NULL;
+ *   - virt/kvm/kvm_main.c|3482| <<kvm_ioctl_create_device>> if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
+ *   - virt/kvm/kvm_main.c|3486| <<kvm_ioctl_create_device>> ARRAY_SIZE(kvm_device_ops_table));
+ *   - virt/kvm/kvm_main.c|3487| <<kvm_ioctl_create_device>> ops = kvm_device_ops_table[dev_type];
+ */
 static struct kvm_device_ops *kvm_device_ops_table[KVM_DEV_TYPE_MAX] = {
 #ifdef CONFIG_KVM_MPIC
 	[KVM_DEV_TYPE_FSL_MPIC_20]	= &kvm_mpic_ops,
@@ -3678,6 +3953,11 @@ static void hardware_enable_nolock(void *junk)
 	}
 }
 
+/*
+ * 在kvm_init()使用:
+ * 4700         r = cpuhp_setup_state_nocalls(CPUHP_AP_KVM_STARTING, "kvm/cpu:starting",
+ * 4701                                       kvm_starting_cpu, kvm_dying_cpu);
+ */
 static int kvm_starting_cpu(unsigned int cpu)
 {
 	raw_spin_lock(&kvm_count_lock);
@@ -3697,6 +3977,11 @@ static void hardware_disable_nolock(void *junk)
 	kvm_arch_hardware_disable();
 }
 
+/*
+ * 在kvm_init()使用:
+ * 4700         r = cpuhp_setup_state_nocalls(CPUHP_AP_KVM_STARTING, "kvm/cpu:starting",
+ * 4701                                       kvm_starting_cpu, kvm_dying_cpu);
+ */
 static int kvm_dying_cpu(unsigned int cpu)
 {
 	raw_spin_lock(&kvm_count_lock);
@@ -3851,6 +4136,15 @@ static int __kvm_io_bus_write(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
 }
 
 /* kvm_io_bus_write - called under kvm->slots_lock */
+/*
+ * called by:
+ *   - arch/powerpc/kvm/book3s.c|948| <<kvmppc_h_logical_ci_store>> ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, addr, size, &buf);
+ *   - arch/powerpc/kvm/powerpc.c|1339| <<kvmppc_handle_store>> ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, run->mmio.phys_addr,
+ *   - arch/x86/kvm/vmx/vmx.c|5698| <<handle_ept_misconfig>> !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
+ *   - arch/x86/kvm/x86.c|5172| <<vcpu_mmio_write>> && kvm_io_bus_write(vcpu, KVM_MMIO_BUS, addr, n, v))
+ *   - arch/x86/kvm/x86.c|5789| <<kernel_pio>> r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
+ *   - virt/kvm/arm/mmio.c|201| <<io_mem_abort>> ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, fault_ipa, len,
+ */
 int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
 		     int len, const void *val)
 {
@@ -3943,6 +4237,22 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
 
 
 /* Caller must hold slots_lock. */
+/*
+ * called by:
+ *   - arch/powerpc/kvm/mpic.c|1450| <<map_mmio>> kvm_io_bus_register_dev(opp->kvm, KVM_MMIO_BUS,
+ *   - arch/x86/kvm/i8254.c|692| <<kvm_create_pit>> ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS,
+ *   - arch/x86/kvm/i8254.c|699| <<kvm_create_pit>> ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS,
+ *   - arch/x86/kvm/i8259.c|607| <<kvm_pic_init>> ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, 0x20, 2,
+ *   - arch/x86/kvm/i8259.c|612| <<kvm_pic_init>> ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, 0xa0, 2, &s->dev_slave);
+ *   - arch/x86/kvm/i8259.c|616| <<kvm_pic_init>> ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, 0x4d0, 2, &s->dev_eclr);
+ *   - arch/x86/kvm/ioapic.c|662| <<kvm_ioapic_init>> ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, ioapic->base_address,
+ *   - virt/kvm/arm/vgic/vgic-its.c|1679| <<vgic_register_its_iodev>> ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, iodev->base_addr,
+ *   - virt/kvm/arm/vgic/vgic-mmio-v3.c|651| <<vgic_register_redist_iodev>> ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, rd_base,
+ *   - virt/kvm/arm/vgic/vgic-mmio-v3.c|666| <<vgic_register_redist_iodev>> ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, sgi_base,
+ *   - virt/kvm/arm/vgic/vgic-mmio.c|912| <<vgic_register_dist_iodev>> ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, dist_base_address,
+ *   - virt/kvm/coalesced_mmio.c|159| <<kvm_vm_ioctl_register_coalesced_mmio>> ret = kvm_io_bus_register_dev(kvm,
+ *   - virt/kvm/eventfd.c|849| <<kvm_assign_ioeventfd_idx>> ret = kvm_io_bus_register_dev(kvm, bus_idx, p->addr, p->length,
+ */
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 			    int len, struct kvm_io_device *dev)
 {
@@ -4259,6 +4569,11 @@ static const struct file_operations *stat_fops[] = {
 	[KVM_STAT_VM]   = &vm_stat_fops,
 };
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|875| <<kvm_destroy_vm>> kvm_uevent_notify_change(KVM_EVENT_DESTROY_VM, kvm);
+ *   - virt/kvm/kvm_main.c|3864| <<kvm_dev_ioctl_create_vm>> kvm_uevent_notify_change(KVM_EVENT_CREATE_VM, kvm);
+ */
 static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
 {
 	struct kobj_uevent_env *env;
@@ -4350,6 +4665,18 @@ struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
 	return container_of(pn, struct kvm_vcpu, preempt_notifier);
 }
 
+/*
+ * kvm_sched_in
+ * __schedule
+ * schedule
+ * kvm_vcpu_block
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ */
 static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
 {
 	struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
@@ -4362,6 +4689,17 @@ static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
 	kvm_arch_vcpu_load(vcpu, cpu);
 }
 
+/*
+ * kvm_sched_out
+ * schedule
+ * kvm_vcpu_block
+ * kvm_arch_vcpu_ioctl_run
+ * kvm_vcpu_ioctl
+ * do_vfs_ioctl
+ * sys_ioctl
+ * do_syscall_64
+ * entry_SYSCALL_64_after_hwframe
+ */
 static void kvm_sched_out(struct preempt_notifier *pn,
 			  struct task_struct *next)
 {
@@ -4504,6 +4842,10 @@ struct kvm_vm_worker_thread_context {
 	int err;
 };
 
+/*
+ * 在以下使用kvm_vm_worker_thread():
+ *   - virt/kvm/kvm_main.c|4871| <<kvm_vm_create_worker_thread>> thread = kthread_run(kvm_vm_worker_thread, &init_context,
+ */
 static int kvm_vm_worker_thread(void *context)
 {
 	/*
@@ -4548,6 +4890,10 @@ static int kvm_vm_worker_thread(void *context)
 	return err;
 }
 
+/*
+ * called by:
+ *   - arch/x86/kvm/mmu.c|6447| <<kvm_mmu_post_init_vm>> err = kvm_vm_create_worker_thread(kvm, kvm_nx_lpage_recovery_worker, 0,
+ */
 int kvm_vm_create_worker_thread(struct kvm *kvm, kvm_vm_thread_fn_t thread_fn,
 				uintptr_t data, const char *name,
 				struct task_struct **thread_ptr)
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index d99850c462a1..c3b34c6770a8 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -363,6 +363,9 @@ static int kvm_vfio_has_attr(struct kvm_device *dev,
 	return -ENXIO;
 }
 
+/*
+ * static struct kvm_device_ops kvm_vfio_ops.destroy = kvm_vfio_destroy()
+ */
 static void kvm_vfio_destroy(struct kvm_device *dev)
 {
 	struct kvm_vfio *kv = dev->private;
@@ -387,6 +390,11 @@ static void kvm_vfio_destroy(struct kvm_device *dev)
 
 static int kvm_vfio_create(struct kvm_device *dev, u32 type);
 
+/*
+ * 在以下使用kvm_vfio_ops:
+ *   - virt/kvm/vfio.c|405| <<kvm_vfio_create>> if (tmp->ops == &kvm_vfio_ops)
+ *   - virt/kvm/vfio.c|422| <<kvm_vfio_ops_init>> return kvm_register_device_ops(&kvm_vfio_ops, KVM_DEV_TYPE_VFIO);
+ */
 static struct kvm_device_ops kvm_vfio_ops = {
 	.name = "kvm-vfio",
 	.create = kvm_vfio_create,
@@ -395,6 +403,9 @@ static struct kvm_device_ops kvm_vfio_ops = {
 	.has_attr = kvm_vfio_has_attr,
 };
 
+/*
+ * struct kvm_device_ops kvm_vfio_ops.create = kvm_vfio_create()
+ */
 static int kvm_vfio_create(struct kvm_device *dev, u32 type)
 {
 	struct kvm_device *tmp;
@@ -417,11 +428,19 @@ static int kvm_vfio_create(struct kvm_device *dev, u32 type)
 	return 0;
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|4781| <<kvm_init>> r = kvm_vfio_ops_init();
+ */
 int kvm_vfio_ops_init(void)
 {
 	return kvm_register_device_ops(&kvm_vfio_ops, KVM_DEV_TYPE_VFIO);
 }
 
+/*
+ * called by:
+ *   - virt/kvm/kvm_main.c|4821| <<kvm_exit>> kvm_vfio_ops_exit();
+ */
 void kvm_vfio_ops_exit(void)
 {
 	kvm_unregister_device_ops(KVM_DEV_TYPE_VFIO);
-- 
2.17.1