From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A64233AB28E for ; Mon, 10 Aug 2026 09:03:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.92.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786352632; cv=none; b=hfjqnB5fnqQXfgotPBE8IuSUMtGEDHPXSRqUpCrO07z33MpS6CX+HrtiSyrvD9RRSCLcScU0QDv0acA7MTqM/sxWPeahCvnJlBeruurbEhPKx//J0RDCDJKE9p01WrMDsjjuLVQKp/A2caJ3JykXCQDNvqDU+hWSFEaQ8LxZQvM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786352632; c=relaxed/simple; bh=6K3pKSPAnEM18hqX7c3gKsZvqndqn01s9FRnk6sz8Sg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Jc1ZLpLZhg/7be2MfX/mwzFTkMBi2LHRsMFVu6S1CpfqBPoIAovO7ErSsj82+DQVBQmZ46Q17qasSLGC7/xbP48ikI+wFkHunsWYP0195hFTWQEfyICmOaeMUTJmMunSmdU2Jq7OIzbpaYOEUwryk6eJiZfUuZ26xVR7I12+U0k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=pass smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=QC9CNEJd; arc=none smtp.client-ip=90.155.92.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="QC9CNEJd" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=h/a3R8tteMer79d2QbL/7EJbYHYvbiZzanJguitF7TU=; b=QC9CNEJdr1mHXqQyADQY+sVH1d MP3eYS2cPzKF2nwegaGRZuLK1/1ZK3PV24duAGxItGNioizWdlnElctBxvin4a4jqNRsG0gyGn61g X9G9C8bLMSPT0z7P5OcOF85FFzc/KT4lww/6YXqnZNGBd6KglZ3hreequsmARj2Q+Mn2sTSWUrjEV NtxviRQOqUHAodd5hTSKs7oFJeUzMgWMW9PI6kw9ugARZgJx+Zix+/kFYDKRf8EaHsS2Y0FVuRmgF 74foxoEul2pDaQl7ZKkkfjpq+Ux4/q4lIMcPK448rD42lORqvDH9SRxbowjErMF2lF1atXisprZ8/ EF0qGbUA==; Received: from 77-249-17-252.cable.dynamic.v4.ziggo.nl ([77.249.17.252] helo=noisy.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.99.2 #2 (Red Hat Linux)) id 1wtLv9-0000000DeKJ-3bDo; Mon, 10 Aug 2026 09:03:48 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 36D243030A6; Mon, 10 Aug 2026 11:03:47 +0200 (CEST) Date: Mon, 10 Aug 2026 11:03:47 +0200 From: Peter Zijlstra To: Sergey Senozhatsky Cc: Thomas Gleixner , "H. Peter Anvin" , x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: x86: missing FRED #PF event data? Message-ID: <20260810090347.GS48970@noisy.programming.kicks-ass.net> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Mon, Aug 10, 2026 at 05:58:18PM +0900, Sergey Senozhatsky wrote: > On (26/08/10 16:38), Sergey Senozhatsky wrote: > > [..] > > > All the crashes are reported as NULL ptr derefs, however, I believe this > > > is not exactly the case. In all crashes CR2 is 0x1000 aligned (we always > > > crash accessing first byte of a page). It seems that csum_partial() calls > > > load_unaligned_zeropad() and we hit what load_unaligned_zeropad() comment > > > describes as very unlikely) case: "word being a page-crosser and the > > > next page not being mapped"). So instead of reading 4 remaining bytes > > > of the page and zeroes for trailing 4 bytes, we panic(). It appears that > > > FRED #PF is set to 0 while CR2 points to a correct page address. I added > > > a simple printk to exc_page_fault: > > > > > > address = cpu_feature_enabled(X86_FEATURE_FRED) ? fred_event_data(regs) : read_cr2(); > > > /* Fall back to CR2 if FRED event data was empty */ > > > if (unlikely(!address)) { > > > address = read_cr2(); > > > pr_err(":: fixed up address to %lx [[fred: %lx cr2: %lx]]\n", address, fred_event_data(regs), read_cr2()); > > > } > > > > > > and got the following while running my tests (and well, we don't crash > > > anymore): > > > > > > [ 254.040223] :: fixed up address to ffff9c4d64af4000 [[fred: 0 cr2: ffff9c4d64af4000]] > > > ... > > > [ 1821.904563] :: fixed up address to ffff9c4e9dd0a000 [[fred: 0 cr2: ffff9c4e9dd0a000]] > > > > > > Does any of this make sense to you? > > > > I think the explanation is some pKVM shenanigans. Sorry for the noise. > > No, I think we are back at square one. I thought that maybe pKVM > was disabling FRED and that was causing issues. But I actually see > that both cpu_feature_enabled(X86_FEATURE_FRED) and (cr4 & X86_CR4_FRED) > claim FRED is enabled, yet fred #PF data is 0 while CR2 holds the correct > address. Can you reproduce on real hardware? I mean, you were babbling about pKVM (whatever that is), so I'm thinking you're on some dodgy virt thing. Not that I have any actual FRED hardware to test anything on :/