Re: [PATCH v9 00/22] Enable FRED with KVM VMX

[Xin Li <xin@zytor.com>]

> On Apr 23, 2026, at 7:35 AM, David Woodhouse <dwmw2@infradead.org> wrote:
> 
> On Sun, 2025-10-26 at 13:18 -0700, Xin Li (Intel) wrote:
>> This patch set enables the Intel flexible return and event delivery
>> (FRED) architecture with KVM VMX to allow guests to utilize FRED.
> 
> This could do with having a *lot* of KVM selftests.

Hi David,

Thanks, I will integrate your tests into this FRED test:
https://lore.kernel.org/kvm/20240207172646.3981-26-xin3.li@intel.com/


> 
> Here's one to get you started (untested as I haven't found suitable
> hardware to test it on).

Same here for me now :(

> 
> From bd465aabebcb124e09a26fe9f4c861354febabe4 Mon Sep 17 00:00:00 2001
> From: David Woodhouse <dwmw@amazon.co.uk>
> Date: Thu, 23 Apr 2026 15:20:11 +0100
> Subject: [PATCH] KVM: selftests: Add FRED event type classification test
> 
> Test that software-generated events deliver the correct FRED event
> type in the FRED stack frame.
> 
> In FRED mode, the CPU pushes event metadata including the event type
> into the FRED stack frame. Different instruction types should produce
> different event types:
>  - ICEBP (INT1): EVENT_TYPE_PRIV_SWEVT (5)
>  - INT3:         EVENT_TYPE_SWEXC (6)
>  - INT n:        EVENT_TYPE_SWINT (4)
> 
> The test sets up a guest in FRED mode by enabling CR4.FRED and
> configuring the FRED MSRs, with a hand-written FRED entry point that
> extracts the event type from the FRED SS field. It exercises each
> software event type and verifies the classification is correct.
> 
> Requires KVM guest FRED support (the FRED KVM VMX series) and
> hardware FRED support. Skips if either is unavailable.
> 
> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
> ---
> tools/testing/selftests/kvm/Makefile.kvm      |   1 +
> .../selftests/kvm/x86/int1_fred_test.c        | 225 ++++++++++++++++++
> 2 files changed, 226 insertions(+)
> create mode 100644 tools/testing/selftests/kvm/x86/int1_fred_test.c
> 
> diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
> index 148d427ff24b..62e76617f82f 100644
> --- a/tools/testing/selftests/kvm/Makefile.kvm
> +++ b/tools/testing/selftests/kvm/Makefile.kvm
> @@ -74,6 +74,7 @@ TEST_GEN_PROGS_x86 += x86/feature_msrs_test
> TEST_GEN_PROGS_x86 += x86/exit_on_emulation_failure_test
> TEST_GEN_PROGS_x86 += x86/fastops_test
> TEST_GEN_PROGS_x86 += x86/fix_hypercall_test
> +TEST_GEN_PROGS_x86 += x86/int1_fred_test
> TEST_GEN_PROGS_x86 += x86/hwcr_msr_test
> TEST_GEN_PROGS_x86 += x86/hyperv_clock
> TEST_GEN_PROGS_x86 += x86/hyperv_cpuid
> diff --git a/tools/testing/selftests/kvm/x86/int1_fred_test.c b/tools/testing/selftests/kvm/x86/int1_fred_test.c
> new file mode 100644
> index 000000000000..7ffb54b56047
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/x86/int1_fred_test.c
> @@ -0,0 +1,225 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Test FRED event type classification for software-generated events.
> + *
> + * In FRED mode, the CPU pushes event metadata including the event type
> + * into the FRED stack frame SS field. This test verifies the correct
> + * event type for:
> + *   - ICEBP (INT1, opcode 0xF1): EVENT_TYPE_PRIV_SWEXC (5)
> + *   - INT3 (opcode 0xCC):        EVENT_TYPE_SWEXC (6)
> + *   - INT n (opcode 0xCD nn):    EVENT_TYPE_SWINT (4)
> + *
> + * The FRED stack page is evicted via MADV_DONTNEED before each test
> + * to also exercise EPT/NPT fault handling during FRED frame push.
> + *
> + * This test requires KVM guest FRED support and hardware FRED support.
> + * It will skip if either is unavailable.
> + */
> +#include <stdint.h>
> +#include <string.h>
> +#include <sys/mman.h>
> +
> +#include "test_util.h"
> +#include "kvm_util.h"
> +#include "processor.h"
> +
> +/* FRED: CPUID.(EAX=7,ECX=1):EAX bit 17 */
> +#define X86_FEATURE_FRED KVM_X86_CPU_FEATURE(7, 1, EAX, 17)
> +
> +/* FRED MSRs */
> +#define MSR_IA32_FRED_RSP0 0x1cc
> +#define MSR_IA32_FRED_STKLVLS 0x1d0
> +#define MSR_IA32_FRED_CONFIG 0x1d4
> +
> +/* FRED event types (from arch/x86/include/asm/trapnr.h) */
> +#define EVENT_TYPE_SWINT 4 /* INT n */
> +#define EVENT_TYPE_PRIV_SWEXC 5 /* INT1 (ICEBP) */
> +#define EVENT_TYPE_SWEXC 6 /* INTO, INT3 */
> +
> +/* FRED SS field layout */
> +#define FRED_SS_TYPE_SHIFT 48
> +#define FRED_SS_TYPE_MASK (0xfULL << FRED_SS_TYPE_SHIFT)
> +#define FRED_SS_VECTOR_SHIFT 32
> +#define FRED_SS_VECTOR_MASK (0xffULL << FRED_SS_VECTOR_SHIFT)
> +
> +/* CR4.FRED (bit 32) */
> +#define X86_CR4_FRED (1ULL << 32)
> +
> +/* Guest memory layout */
> +#define FRED_STACK_GPA 0xc0000000ULL
> +#define FRED_STACK_SIZE PAGE_SIZE
> +
> +/*
> + * FRED stack frame as pushed by the CPU on event delivery.
> + * Layout from low address (RSP) to high address:
> + *
> + *   RSP+0x00: error code
> + *   RSP+0x08: RIP (return address)
> + *   RSP+0x10: CS (with auxiliary info in upper bits)
> + *   RSP+0x18: RFLAGS
> + *   RSP+0x20: RSP (original)
> + *   RSP+0x28: SS (with event type/vector in upper bits)
> + */
> +struct fred_stack_frame {
> + uint64_t error_code;
> + uint64_t rip;
> + uint64_t cs;
> + uint64_t rflags;
> + uint64_t rsp;
> + uint64_t ss;
> +};
> +
> +/* Shared result area */
> +static volatile uint64_t fred_ss_value;
> +static volatile uint64_t fred_saved_rip;
> +static volatile bool fred_handler_called;
> +
> +static void __used fred_handler(struct fred_stack_frame *frame)
> +{
> + fred_ss_value = frame->ss;
> + fred_saved_rip = frame->rip;
> + fred_handler_called = true;
> +}
> +
> +/*
> + * FRED entry points. MSR_IA32_FRED_CONFIG points to the page-aligned
> + * base. Ring 3 events enter at base+0, ring 0 events at base+0x100.
> + * Since ICEBP executes in ring 0, the CPU enters at fred_entrypoint
> + * + 256 = fred_entrypoint_kernel.
> + */
> +extern void fred_entrypoint(void);
> +
> +asm(
> + ".pushsection .text\n"
> + ".global fred_entrypoint\n"
> + ".balign 4096\n"
> +"fred_entrypoint:\n"
> + /* Ring 3 entry — unused, no userspace in this test */
> + "ud2\n"
> + /* Pad to +256 for ring 0 entry */
> + ".org fred_entrypoint + 256, 0xcc\n"
> +"fred_entrypoint_kernel:\n"
> + "movq %rsp, %rdi\n"
> + "call fred_handler\n"
> + ".byte 0xf2, 0x0f, 0x01, 0xca\n" /* ERETS */
> + ".popsection\n"
> +);
> +
> +static void check_fred_event(uint64_t expected_rip, uint8_t expected_vector,
> +     uint8_t expected_type, const char *name)
> +{
> + uint64_t event_type, event_vector;
> +
> + GUEST_ASSERT(fred_handler_called);
> + GUEST_ASSERT_EQ(fred_saved_rip, expected_rip);
> +
> + event_type = (fred_ss_value & FRED_SS_TYPE_MASK) >> FRED_SS_TYPE_SHIFT;
> + event_vector = (fred_ss_value & FRED_SS_VECTOR_MASK) >> FRED_SS_VECTOR_SHIFT;
> +
> + GUEST_ASSERT_EQ(event_vector, expected_vector);
> + GUEST_ASSERT_EQ(event_type, expected_type);
> +}
> +
> +static void guest_code(void)
> +{
> + uint64_t expected_rip;
> +
> + /*
> + * Enable FRED:
> + *  1. Set MSR_IA32_FRED_CONFIG to our entry point
> + *  2. Set MSR_IA32_FRED_RSP0 to our FRED stack
> + *  3. Set MSR_IA32_FRED_STKLVLS (all events use stack level 0)
> + *  4. Set CR4.FRED
> + */
> + wrmsr(MSR_IA32_FRED_CONFIG, (uint64_t)fred_entrypoint);
> + wrmsr(MSR_IA32_FRED_RSP0, FRED_STACK_GPA + FRED_STACK_SIZE);
> + wrmsr(MSR_IA32_FRED_STKLVLS, 0);
> +
> + {
> + uint64_t cr4;
> + asm volatile("mov %%cr4, %0" : "=r"(cr4));
> + cr4 |= X86_CR4_FRED;
> + asm volatile("mov %0, %%cr4" :: "r"(cr4));
> + }
> +
> + /* Test 1: ICEBP (INT1) — should be EVENT_TYPE_PRIV_SWEXC (5) */
> + fred_handler_called = false;
> + asm volatile("lea 1f(%%rip), %0\n\t"
> +     ".byte 0xf1\n\t"
> +     "1:" : "=r"(expected_rip) :: "memory");
> + check_fred_event(expected_rip, DB_VECTOR, EVENT_TYPE_PRIV_SWEXC,
> + "ICEBP");
> + GUEST_SYNC(0);
> +
> + /* Test 2: INT3 — should be EVENT_TYPE_SWEXC (6) */
> + fred_handler_called = false;
> + asm volatile("lea 1f(%%rip), %0\n\t"
> +     "int3\n\t"
> +     "1:" : "=r"(expected_rip) :: "memory");
> + check_fred_event(expected_rip, BP_VECTOR, EVENT_TYPE_SWEXC, "INT3");
> + GUEST_SYNC(1);
> +
> + /* Test 3: INT $0x20 — should be EVENT_TYPE_SWINT (4) */
> + fred_handler_called = false;
> + asm volatile("lea 1f(%%rip), %0\n\t"
> +     "int $0x20\n\t"
> +     "1:" : "=r"(expected_rip) :: "memory");
> + check_fred_event(expected_rip, 0x20, EVENT_TYPE_SWINT, "INT $0x20");
> + GUEST_SYNC(2);
> +}
> +
> +static const char * const test_names[] = {
> + [0] = "ICEBP (EVENT_TYPE_PRIV_SWEXC)",
> + [1] = "INT3 (EVENT_TYPE_SWEXC)",
> + [2] = "INT $0x20 (EVENT_TYPE_SWINT)",
> +};
> +
> +int main(int argc, char *argv[])
> +{
> + struct kvm_vcpu *vcpu;
> + struct kvm_vm *vm;
> + struct ucall uc;
> + unsigned int nr_pages;
> + void *fred_stack_hva;
> + int test;
> +
> + TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_FRED));
> +
> + pr_info("Testing FRED event types with EPT fault on stack\n");
> +
> + vm = vm_create_with_one_vcpu(&vcpu, guest_code);
> +
> + /* Map the FRED stack page */
> + nr_pages = vm_calc_num_guest_pages(VM_MODE_DEFAULT, FRED_STACK_SIZE);
> + vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS,
> +    FRED_STACK_GPA, 1, nr_pages, 0);
> + virt_map(vm, FRED_STACK_GPA, FRED_STACK_GPA, nr_pages);
> + fred_stack_hva = addr_gpa2hva(vm, FRED_STACK_GPA);
> +
> + for (test = 0; test < ARRAY_SIZE(test_names); test++) {
> + /*
> + * Evict the FRED stack page so the CPU takes an EPT/NPT
> + * violation when pushing the FRED frame. KVM must handle
> + * the fault, map the page, and reinject the event.
> + */
> + madvise(fred_stack_hva, FRED_STACK_SIZE, MADV_DONTNEED);
> +
> + vcpu_run(vcpu);
> + TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
> +
> + switch (get_ucall(vcpu, &uc)) {
> + case UCALL_ABORT:
> + REPORT_GUEST_ASSERT(uc);
> + break;
> + case UCALL_SYNC:
> + TEST_ASSERT_EQ(uc.args[1], test);
> + pr_info("  %s: PASSED\n", test_names[test]);
> + break;
> + default:
> + TEST_FAIL("Unexpected ucall");
> + }
> + }
> +
> + kvm_vm_free(vm);
> + return 0;
> +}
> -- 
> 2.43.0
> 
> 
> 
>