FRED

FRED (Flexible Return and Event Delivery) replaces the way x86-64 processors enter and leave the operating system kernel. Interrupts and exceptions have long gone through the interrupt descriptor table (IDT) and returned with IRET, while system calls use SYSCALL and SYSRET. Those mechanisms leave the kernel to finish a half-made entry state (the user’s GS base, CR2, DR6) and to work around corner cases such as IRET unblocking NMIs whether or not the handler is done. FRED defines one new event-delivery mechanism and two return instructions for 64-bit operating systems.

Event delivery#

With FRED enabled (CR4 bit 32), every interrupt and exception, and also SYSCALL and SYSENTER, is delivered the same way:

• The processor jumps to one of two entry points on a page whose address is in the IA32_FRED_CONFIG MSR: one for events that happened in user mode (ring 3) and one, 256 bytes later, for events in the kernel (ring 0). The IDT is not read.
• It pushes a 64-byte frame that holds the complete old context (RIP, RSP, RFLAGS, CS, SS), the event’s type, vector and error code, and event data such as the faulting address of a page fault, which previously had to be read from CR2.
• On entry from user mode it swaps the GS base with IA32_KERNEL_GS_BASE, as SWAPGS would.

Software then dispatches on the event type and vector. The Linux documentation describes this two-level dispatch.

Stack levels#

Instead of the interrupt stack table, FRED has four stack levels, 0 to 3, each with its own stack pointer MSR (IA32_FRED_RSP0 to RSP3). The kernel assigns a minimum level to each exception vector and to maskable interrupts. An event from user mode always switches to the stack of its level; an event in the kernel switches only when its level is above the current one, and ERETS restores the old level. This replaces the non-reentrant IST stacks.

Returning#

ERETU returns to user mode and ERETS returns to the kernel; both take the frame that event delivery pushed. They restore the full RSP and can unblock NMIs explicitly, where IRET always unblocks them. With FRED enabled, ring transitions happen only through FRED: rings 1 and 2 are unreachable, and SWAPGS, SYSRET, SYSEXIT, SETSSBSY and CLRSSBSY raise #UD.

Detection and support#

FRED is CPUID.(EAX=07H,ECX=1):EAX[17]. Intel processors with FRED also have LKGS (bit 18), which a FRED kernel uses to load a user GS without SWAPGS. Linux gained FRED support in version 6.9 (May 2024); current kernel documentation lists fred=on, which enables it on processors that have it, as the default, and fred=off to disable it.

XED’s chip model has FRED in Panther Lake, Nova Lake and Diamond Rapids. Intel’s extensions reference lists Panther Lake, Clearwater Forest and Diamond Rapids as the first processors with it; XED does not list Clearwater Forest.

Instructions

CPUID and processors

XED splits FRED into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.