From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.zytor.com (terminus.zytor.com [198.137.202.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3412C405C35 for ; Mon, 10 Aug 2026 15:41:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.137.202.136 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376472; cv=none; b=Oiu2kPhQYXm2YYFG9Uj/QSIPI8qn+qkMmonCIc50JqXtnOInAf7Ap/ue26Rnd6M7Q5bGfQDeuZrQdEOCyQd81c8TssNKulSE/jjqY2pq8aSfA0iMJwxsGvi4r2A7+XWd28pdqmRDKRxHYxVbMNYUXTkqTBgCOYlv6Bdh+AXIDaI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376472; c=relaxed/simple; bh=e2t7evXdTaR84pMSHYu5/n1euxhdUEL9Cmf7uc7C54o=; h=Date:From:To:CC:Subject:In-Reply-To:References:Message-ID: MIME-Version:Content-Type; b=D6D31tmdWHB2+HAC5/ccl13AhC24DOoiBX4Qn65AWdZXNmW895XVTQxK86rK5TnlUVIkF1BwA0NkdQwmiQ6gGBLeDVYvoi29lKfbikya9VQhh0mBX5hDd3SI0f++pdEaqXIfGr2ofWyQ/JrWYz+FBF7RJj4wKMsa6laMCGyRUh0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zytor.com; spf=pass smtp.mailfrom=zytor.com; dkim=pass (2048-bit key) header.d=zytor.com header.i=@zytor.com header.b=AVs7FXCS; arc=none smtp.client-ip=198.137.202.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zytor.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zytor.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=zytor.com header.i=@zytor.com header.b="AVs7FXCS" Received: from ehlo.thunderbird.net (c-76-133-66-138.hsd1.ca.comcast.net [76.133.66.138]) (authenticated bits=0) by mail.zytor.com (8.18.1/8.17.1) with ESMTPSA id 67AFej2W1566074 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Mon, 10 Aug 2026 08:40:46 -0700 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.zytor.com 67AFej2W1566074 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zytor.com; s=2026072801; t=1786376446; bh=kXHuwud9g//a6tO+PA4zLzHgeQioRHA6egBuiN/nEz0=; h=Date:From:To:CC:Subject:In-Reply-To:References:From; b=AVs7FXCSpYqQQCuE9Yg7TPRvVIKB1qd3Y+W+MsUsT+UhxetMbpJblMZfJtElImPTL iymRd+l2AZ2ey1aqU2RgD5eMdM2lEyLepKCS5YjgLARU2RfIiUH70dTLrBiz9pkgTj k0Sd3WNQjYrJ3Rde3XjOsm2BzRWydr/4saK0LFVVRzza9DCSQ/Q9venHO9bV6hlQ9I vO9YMJrjbuSORDJsNcZi0f/bJup1+ANbhY3ufJ7GDJIgNb2A/cPYPDSWWOhLsXooxM MG1VkXS6cffulW8Cin44xjOnLKyFqE7mi6fKjL5Isk9hUq0Tv5lQVB7823XqQK1hud NIr+5b8a9DpMg== Date: Mon, 10 Aug 2026 08:40:39 -0700 From: "H. Peter Anvin" To: Sergey Senozhatsky , Thomas Gleixner , Peter Zijlstra CC: x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: x86: missing FRED #PF event data? User-Agent: K-9 Mail for Android In-Reply-To: References: Message-ID: <29FD2DAB-C771-4E91-95C4-435B5DF90802@zytor.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On August 10, 2026 1:58:18 AM PDT, Sergey Senozhatsky wrote: >On (26/08/10 16:38), Sergey Senozhatsky wrote: >> [=2E=2E] >> > All the crashes are reported as NULL ptr derefs, however, I believe t= his >> > is not exactly the case=2E In all crashes CR2 is 0x1000 aligned (we = always >> > crash accessing first byte of a page)=2E It seems that csum_partial(= ) calls >> > load_unaligned_zeropad() and we hit what load_unaligned_zeropad() com= ment >> > describes as very unlikely) case: "word being a page-crosser and the >> > next page not being mapped")=2E So instead of reading 4 remaining by= tes >> > of the page and zeroes for trailing 4 bytes, we panic()=2E It appear= s that >> > FRED #PF is set to 0 while CR2 points to a correct page address=2E I= added >> > a simple printk to exc_page_fault: >> >=20 >> > address =3D cpu_feature_enabled(X86_FEATURE_FRED) ? fred_even= t_data(regs) : read_cr2(); >> > /* Fall back to CR2 if FRED event data was empty */ >> > if (unlikely(!address)) { >> > address =3D read_cr2(); >> > pr_err(":: fixed up address to %lx [[fred: %lx cr2: %= lx]]\n", address, fred_event_data(regs), read_cr2()); >> > } >> >=20 >> > and got the following while running my tests (and well, we don't cras= h >> > anymore): >> >=20 >> > [ 254=2E040223] :: fixed up address to ffff9c4d64af4000 [[fred: 0 c= r2: ffff9c4d64af4000]] >> > =2E=2E=2E >> > [ 1821=2E904563] :: fixed up address to ffff9c4e9dd0a000 [[fred: 0 c= r2: ffff9c4e9dd0a000]] >> >=20 >> > Does any of this make sense to you? >>=20 >> I think the explanation is some pKVM shenanigans=2E Sorry for the nois= e=2E > >No, I think we are back at square one=2E I thought that maybe pKVM >was disabling FRED and that was causing issues=2E But I actually see >that both cpu_feature_enabled(X86_FEATURE_FRED) and (cr4 & X86_CR4_FRED) >claim FRED is enabled, yet fred #PF data is 0 while CR2 holds the correct >address=2E What is pKVM? Paravirtualized KVM? In that case, it is most likely pKVM no= t filling in the relevant fields in the FRED stack frame, which would be a = very serious bug=2E I cannot think of any other way that that could possibly happen otherwise;= on bare metal those fields are set by hardware and Linux only consumes the= m=2E