I've verified that this fixes my issue. Thanks, Haozhong! You can add: Tested-by: Ross Zwisler <ross.zwisler@xxxxxxxxxxxxxxx> On Thu, Jan 11, 2018 at 6:06 AM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > On 10/01/2018 14:44, Haozhong Zhang wrote: >> When a guest expection is already pending, injecting APF may result in >> guest #DF. >> >> For example, when two APF's for page ready happen after an exit, the >> first APF will be pending. If injecting the second one regardless of >> the pending one, the second APF injection will be converted an >> injection of #DF. > > Queued, thanks (with updated commit message). > > Paolo > >> >> Reported-by: Ross Zwisler <zwisler@xxxxxxxxx> >> Message-ID: <CAOxpaSUBf8QoOZQ1p4KfUp0jq76OKfGY4Uxs-Gg8ngReD99xww@xxxxxxxxxxxxxx> >> Reported-by: Alec Blayne <ab@xxxxxxxxx> >> Signed-off-by: Haozhong Zhang <haozhong.zhang@xxxxxxxxx> >> --- >> arch/x86/kvm/mmu.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c >> index 89da688784fa..a8d0230ea40d 100644 >> --- a/arch/x86/kvm/mmu.c >> +++ b/arch/x86/kvm/mmu.c >> @@ -3781,7 +3781,8 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn) >> bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu) >> { >> if (unlikely(!lapic_in_kernel(vcpu) || >> - kvm_event_needs_reinjection(vcpu))) >> + kvm_event_needs_reinjection(vcpu) || >> + vcpu->arch.exception.pending)) >> return false; >> >> if (!vcpu->arch.apf.delivery_as_pf_vmexit && is_guest_mode(vcpu)) >> >