[Bug 556480] [NEW] kernel crash under KVM when on AMD Magny-Cours

[Andre Przywara]

Public bug reported:

When using Ubuntu Lucid as a KVM guest and either
a) propagating the host CPU to the guest (-cpu host) on an AMD Opteron 61xx processor (Magny-Cours) or
b) forcing the guest CPU to be a Magny-Cours (-cpu qemu64,family=16,model=9,vendor=AuthenticAMD)
the guest kernel crashes early with a panic related to a division error:
--------------
[    0.074409] CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (64 bytes/line)
[    0.075503] CPU: L2 Cache: 512K (64 bytes/line)
[    0.076227] divide error: 0000 [#1] SMP 
[    0.076870] last sysfs file: 
[    0.077332] CPU 0 
[    0.077673] Modules linked in:
[    0.078169] Pid: 0, comm: swapper Not tainted 2.6.32-16-generic #25-Ubuntu Bochs
[    0.079284] RIP: 0010:[<ffffffff8154ec6a>]  [<ffffffff8154ec6a>] init_amd+0x29c/0x3bd
[    0.080000] RSP: 0018:ffffffff817adea8  EFLAGS: 00010246
[    0.080000] RAX: 0000000000000000 RBX: ffffffff8185b380 RCX: ffff880001c00000
[    0.080000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[    0.080000] RBP: ffffffff817adef8 R08: 00000000ffffffff R09: 0000000000000001
[    0.080000] R10: 0000000000000004 R11: 0000000000000000 R12: ffffffff8185b394
[    0.080000] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000013800
[    0.080000] FS:  0000000000000000(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000
[    0.080000] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
[    0.080000] CR2: 0000000000000000 CR3: 0000000001001000 CR4: 00000000000006b0
[    0.080000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    0.080000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    0.080000] Process swapper (pid: 0, threadinfo ffffffff817ac000, task ffffffff817d4600)
[    0.080000] Stack:
[    0.080000]  ffffffff817adfa8 0000000000013800 ffffffff817adef8 ffffffff8154e1d9
[    0.080000] <0> 80802001078bfbfd 00100f9100000800 ffffffff8185b380 0000000000000000
[    0.080000] <0> ffffffff81973000 ffffffff817adfa8 ffffffff817adf18 ffffffff8154e2d4
[    0.080000] Call Trace:
[    0.080000]  [<ffffffff8154e1d9>] ? generic_identify+0x12e/0x13e
[    0.080000]  [<ffffffff8154e2d4>] identify_cpu+0xeb/0x1db
[    0.080000]  [<ffffffff8188280f>] identify_boot_cpu+0x10/0x3e
[    0.080000]  [<ffffffff818828a6>] check_bugs+0x9/0x2d
[    0.080000]  [<ffffffff8187add1>] start_kernel+0x348/0x365
[    0.080000]  [<ffffffff8187a33a>] x86_64_start_reservations+0x125/0x129
[    0.080000]  [<ffffffff8187a438>] x86_64_start_kernel+0xfa/0x109
[    0.080000] Code: 8b b3 b2 00 00 00 4d 63 f6 0f b6 d2 4a 8b 0c f5 00 b7 85 81
 48 c7 c0 f4 e3 00 00 8d 14 72 66 89 14 08 0f b7 83 b4 00 00 00 31 d2 <41> f7 f5
 66 89 93 b4 00 00 00 48 89 df e8 13 fc ff ff 81 7b 0c 
[    0.080000] RIP  [<ffffffff8154ec6a>] init_amd+0x29c/0x3bd
[    0.080000]  RSP <ffffffff817adea8>
[    0.080017] ---[ end trace a7919e7f17c0a725 ]---

This is caused by an unchecked PCI config space access in arch/x86/kernel/cpu/amd.c:amd_fixup_dcm(), which is only called when a family 10h model 9 processor (aka Magny-Cours) is detected. Since KVM does not provide an emulation of the AMD Northbridge PCI device, the resulting values are bogus and trigger a division by zero error. The upstream patch:
commit 9d260ebc09a0ad6b5c73e17676df42c7bc75ff64
Author: Andreas Herrmann <herrmann.der.user at googlemail.com>
Date:   Wed Dec 16 15:43:55 2009 +0100
removes this PCI access and replaces it with the more virtualization friendly MSR access to get the same information.

-cpu host will become the new default for KVM, so please seriously consider back-porting this patch (which simplifies the code) and is upstream since 2.6.33-rc1
If not back-ported, KVM guests with Ubuntu Lucid will not run on AMD Magny-Cours machines in the future.

** Affects: linux (Ubuntu)
     Importance: Undecided
         Status: New

-- 
kernel crash under KVM when on AMD Magny-Cours
https://bugs.launchpad.net/bugs/556480
You received this bug notification because you are a member of Kernel
Bugs, which is subscribed to linux in ubuntu.