[PATCH v10 09/28] KVM: VMX: Save/restore guest FRED RSP0

From: Sohil Mehta

Date: Fri Sep 11 2026 - 17:44:18 EST


From: "Xin Li (Intel)" <xin@xxxxxxxxx>

Save guest FRED RSP0 in vmx_prepare_switch_to_host() and restore it
in vmx_prepare_switch_to_guest() because MSR_IA32_FRED_RSP0 is passed
through to the guest, thus is volatile/unknown.

Note, host FRED RSP0 is restored in arch_exit_to_user_mode_prepare(),
regardless of whether it is modified in KVM.

Signed-off-by: Xin Li (Intel) <xin@xxxxxxxxx>
Signed-off-by: Sohil Mehta <sohil.mehta@xxxxxxxxx>
Reviewed-by: Chao Gao <chao.gao@xxxxxxxxx>
Reviewed-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
---
v10:
- No change

Note, an equivalent TDX side implementation is missing. No TDX module
with FRED support exists yet so this would be an issue for future
platforms. A generic discussion regarding this is ongoing at:
https://lore.kernel.org/kvm/20260827031837.2863609-1-binbin.wu@xxxxxxxxxxxxxxx/
---
arch/x86/kvm/vmx/vmx.c | 13 +++++++++++++
arch/x86/kvm/vmx/vmx.h | 1 +
2 files changed, 14 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 09bbbc680aa7..b6b73ab9cfb7 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1395,6 +1395,9 @@ void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
}

wrmsrq(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+
+ if (guest_cpu_cap_has(vcpu, X86_FEATURE_FRED))
+ wrmsrns(MSR_IA32_FRED_RSP0, vmx->msr_guest_fred_rsp0);
#else
savesegment(fs, fs_sel);
savesegment(gs, gs_sel);
@@ -1439,6 +1442,16 @@ static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
invalidate_tss_limit();
#ifdef CONFIG_X86_64
wrmsrq(MSR_KERNEL_GS_BASE, vmx->vt.msr_host_kernel_gs_base);
+
+ if (guest_cpu_cap_has(&vmx->vcpu, X86_FEATURE_FRED)) {
+ vmx->msr_guest_fred_rsp0 = read_msr(MSR_IA32_FRED_RSP0);
+ /*
+ * Synchronize the current value in hardware to the kernel's
+ * local cache. The desired host RSP0 will be set when the
+ * CPU exits to userspace (RSP0 is a per-task value).
+ */
+ fred_sync_rsp0(vmx->msr_guest_fred_rsp0);
+ }
#endif
load_fixmap_gdt(raw_smp_processor_id());
vmx->vt.guest_state_loaded = false;
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 7a22e1b1a273..14fd3f57d5c1 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -222,6 +222,7 @@ struct vcpu_vmx {
bool guest_uret_msrs_loaded;
#ifdef CONFIG_X86_64
u64 msr_guest_kernel_gs_base;
+ u64 msr_guest_fred_rsp0;
#endif

u64 spec_ctrl;
--
2.43.0