Re: x86: missing FRED #PF event data?

On August 10, 2026 6:47:13 PM PDT, Sergey Senozhatsky <[email protected]> wrote:
>On (26/08/10 08:40), H. Peter Anvin wrote:
>> On August 10, 2026 1:58:18 AM PDT, Sergey Senozhatsky <[email protected]> wrote:
>> >On (26/08/10 16:38), Sergey Senozhatsky wrote:
>> >> [..]
>> >> > All the crashes are reported as NULL ptr derefs, however, I believe this
>> >> > is not exactly the case.  In all crashes CR2 is 0x1000 aligned (we always
>> >> > crash accessing first byte of a page).  It seems that csum_partial() calls
>> >> > load_unaligned_zeropad() and we hit what load_unaligned_zeropad() comment
>> >> > describes as very unlikely) case: "word being a page-crosser and the
>> >> > next page not being mapped").  So instead of reading 4 remaining bytes
>> >> > of the page and zeroes for trailing 4 bytes, we panic().  It appears that
>> >> > FRED #PF is set to 0 while CR2 points to a correct page address.  I added
>> >> > a simple printk to exc_page_fault:
>> >> > 
>> >> >         address = cpu_feature_enabled(X86_FEATURE_FRED) ? fred_event_data(regs) : read_cr2();
>> >> >         /* Fall back to CR2 if FRED event data was empty */
>> >> >         if (unlikely(!address)) {
>> >> >                 address = read_cr2();
>> >> >                 pr_err(":: fixed up address to %lx [[fred: %lx cr2: %lx]]\n", address, fred_event_data(regs), read_cr2());
>> >> >         }
>> >> > 
>> >> > and got the following while running my tests (and well, we don't crash
>> >> > anymore):
>> >> > 
>> >> > [  254.040223] :: fixed up address to ffff9c4d64af4000  [[fred: 0 cr2: ffff9c4d64af4000]]
>> >> > ...
>> >> > [ 1821.904563] :: fixed up address to ffff9c4e9dd0a000  [[fred: 0 cr2: ffff9c4e9dd0a000]]
>> >> > 
>> >> > Does any of this make sense to you?
>> >> 
>> >> I think the explanation is some pKVM shenanigans.  Sorry for the noise.
>> >
>> >No, I think we are back at square one.  I thought that maybe pKVM
>> >was disabling FRED and that was causing issues.  But I actually see
>> >that both cpu_feature_enabled(X86_FEATURE_FRED) and (cr4 & X86_CR4_FRED)
>> >claim FRED is enabled, yet fred #PF data is 0 while CR2 holds the correct
>> >address.
>> 
>> What is pKVM? Paravirtualized KVM?
>
>Protected KVM.
>
>> In that case, it is most likely pKVM not filling in the relevant fields
>> in the FRED stack frame, which would be a very serious bug.
>> 
>> I cannot think of any other way that that could possibly happen otherwise;
>> on bare metal those fields are set by hardware and Linux only consumes them.
>
>I agree.  I'll look at it from the pKVM side.  I was not aware of pKVM
>when I started this discussion, I found out about it later.

If that code calls the FRED entry from KVM routine, that routine doesn't have support for setting event_data in upstream. This would be fixed if necessary.