>Synopsis: amd64: GPF panic at boot on KVM guests lacking
MSR_DE_CFG (AMD family 17h)
>Category: amd64
>Environment:
System : OpenBSD 7.9
Details : OpenBSD 7.9 (GENERIC.MP) #15: Sun Sep 27 02:47:36
MDT 2026
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
Architecture: OpenBSD.amd64
Machine : amd64
>Description:
OpenBSD 7.9/amd64 (and, judging from the source, 8.0 as well) panics
very early during boot on a KVM-based VPS (hoster 1blu.de, Virtuozzo)
with an AMD EPYC (Zen 1) CPU. Both bsd.rd from install79.iso and
miniroot79.img fail the same way, before the installer starts:
fatal protection fault in supervisor mode
trap type 4 code 0 rip ... cs 8 rflags ... cr2 0 cpl e
panic: trap type 4, code=0, pc=...
CPU as seen by a FreeBSD 15.1 guest on the same VM:
Origin="AuthenticAMD" Id=0x800f12 Family=0x17 Model=0x1 Stepping=2
Features2=...<...,HV>
Hypervisor: Origin = "KVMKVMKVM"
The hypervisor does not implement MSR_DE_CFG (0xc0011029). Reading it
from the FreeBSD guest faults:
# cpucontrol -m 0xc0011029 /dev/cpuctl0
cpucontrol: ioctl(/dev/cpuctl0, CPUCTL_RDMSR (0xc0011029)): Bad address
In cpu_init() (sys/arch/amd64/amd64/cpu.c), the "Mitigation G-2"
block reads MSR_DE_CFG unconditionally on all AMD families >= 10h
(except 11h). The two newer MSR blocks below it (Zenbleed and FPDSS)
already skip the access when CPUIDECX_HV is set, but the G-2 block
does not, so the unguarded rdmsr() raises #GP and the kernel panics.
FreeBSD and Linux boot fine on the same VM, since they access this MSR
in a fault-tolerant way.
The hoster declined to change the virtual CPU model.
Note: the system information attached by sendbug is from a different
(working) machine, since OpenBSD cannot be booted on the affected VM.
>How-To-Repeat:
Boot bsd.rd (install79.iso or miniroot79.img, amd64) on a KVM guest
with an AMD family 17h CPU where the hypervisor does not provide
MSR_DE_CFG (0xc0011029), e.g. a 1blu.de "VPS R24" instance.
The kernel panics during CPU identification with trap type 4.
Whether the MSR is available can be checked from another guest OS,
e.g. FreeBSD: cpucontrol -m 0xc0011029 /dev/cpuctl0
>Fix:
Read MSR_DE_CFG with rdmsr_safe() so the mitigation is still applied
where the MSR is available (bare metal, or hypervisors that emulate
it) and is skipped where the access faults:
File sys/arch/amd64/amd64/cpu.c
* This MSR is available on all AMD families >= 10h, except 11h
* where LFENCE is always serializing.
+ * Hypervisors may not implement it, so read it carefully.
*/
- if (family >= 0x10 && family != 0x11) {
- nmsr = msr = rdmsr(MSR_DE_CFG);
- nmsr |= DE_CFG_SERIALIZE_LFENCE;
+ if (family >= 0x10 && family != 0x11 &&
+ rdmsr_safe(MSR_DE_CFG, &msr) == 0) {
+ nmsr = msr | DE_CFG_SERIALIZE_LFENCE;
if (msr != nmsr)
wrmsr(MSR_DE_CFG, nmsr);
}
An alternative would be to add a (cpu_ecxfeature & CPUIDECX_HV) == 0
check, as done for the Zenbleed and FPDSS blocks, but that would drop
the mitigation on hypervisors that do implement the MSR.
This is untested since I only have limited access to the VM.
dmesg:
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p4 releng/15.1-n283627-e38a7085f3a8 GENERIC amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git
llvmorg-19.1.7-0-gcd708029e0b2)
VT(vga): text 80x25
WARNING: sysctl vfs.zfs.arc_max is deprecated. Use vfs.zfs.arc.max instead.
CPU: AMD EPYC Processor (with IBPB) (2495.25-MHz K8-class CPU)
Origin="AuthenticAMD" Id=0x800f12 Family=0x17 Model=0x1 Stepping=2
Features=0x1783fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0xfff83203<SSE3,PCLMULQDQ,SSSE3,FMA,CX16,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND,HV>
AMD Features=0x2e500800<SYSCALL,NX,MMX+,FFXSR,Page1GB,RDTSCP,LM>
AMD Features2=0x4003f3<LAHF,CMP,CR8,ABM,SSE4A,MAS,Prefetch,OSVW,Topology>
Structured Extended
Features=0x219c01ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,SHA>
Structured Extended Features2=0x4<UMIP>
XSAVE Features=0x7<XSAVEOPT,XSAVEC,XINUSE>
AMD Extended Feature Extensions ID EBX=0x2001000<IBPB,VIRT_SSBD>
Hypervisor: Origin = "KVMKVMKVM"
real memory = 25769803776 (24576 MB)
avail memory = 25079939072 (23918 MB)
Event timer "LAPIC" quality 100
ACPI APIC Table: <BOCHS BXPCAPIC>
FreeBSD/SMP: Multiprocessor System Detected: 8 CPUs
FreeBSD/SMP: 1 package(s) x 2 cache groups x 4 core(s)
random: registering fast source Intel Secure Key Seed
random: fast provider: "Intel Secure Key Seed"
random: unblocking device.
ioapic0 <Version 1.1> irqs 0-23
Launching APs: 1 7 5 4 6 2 3
random: entropy device external interface
kbd1 at kbdmux0
vtvga0: <VT VGA driver>
kvmclock0: <KVM paravirtual clock>
Timecounter "kvmclock" frequency 1000000000 Hz quality 975
kvmclock0: registered as a time-of-day clock, resolution 0.000001s
smbios0: <System Management BIOS> at iomem 0xf6130-0xf614e
smbios0: Entry point: v2.1 (32-bit), Version: 2.8, BCD Revision: 2.8
aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
acpi0: <BOCHS BXPCRSDT>
acpi0: Power Button (fixed)
cpu0: <ACPI CPU> on acpi0
atrtc0: <AT realtime clock> port 0x70-0x71,0x72-0x77 irq 8 on acpi0
atrtc0: registered as a time-of-day clock, resolution 1.000000s
Event timer "RTC" frequency 32768 Hz quality 0
hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
Timecounter "HPET" frequency 100000000 Hz quality 950
Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x608-0x60b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab0: <PCI-ISA bridge> at device 1.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel PIIX3 WDMA2 controller> port
0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xc160-0xc16f at device 1.1 on pci0
ata0: <ATA channel> at channel 0 on atapci0
ata1: <ATA channel> at channel 1 on atapci0
uhci0: <Intel 82371SB (PIIX3) USB controller> port 0xc0c0-0xc0df irq 11
at device 1.2 on pci0
usbus0 on uhci0
usbus0: 12Mbps Full Speed USB v1.0
pci0: <bridge> at device 1.3 (no driver attached)
vgapci0: <VGA-compatible display> port 0xc0e0-0xc0ff mem
0xf8000000-0xfbffffff,0xfc000000-0xfdffffff,0xfe050000-0xfe051fff irq 10
at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI (legacy) Network adapter> port 0xc100-0xc11f
mem 0xfe052000-0xfe052fff,0xfebe8000-0xfebebfff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
vtnet0: Ethernet address: c4:37:72:f4:70:09
vtnet0: netmap queues/slots: TX 1/256, RX 1/128
000.000759 [ 452] vtnet_netmap_attach vtnet attached txq=1,
txd=256 rxq=1, rxd=128
virtio_pci1: <VirtIO PCI (legacy) SCSI adapter> port 0xc000-0xc03f mem
0xfe053000-0xfe053fff,0xfebec000-0xfebeffff irq 11 at device 4.0 on pci0
vtscsi0: <VirtIO SCSI Adapter> on virtio_pci1
ehci0: <Intel 82801DB/L/M (ICH4) USB 2.0 controller> mem
0xfe054000-0xfe054fff irq 11 at device 5.0 on pci0
usbus1: EHCI version 1.0
usbus1 on ehci0
usbus1: 480Mbps High Speed USB v2.0
virtio_pci2: <VirtIO PCI (legacy) Console adapter> port 0xc040-0xc07f
mem 0xfe055000-0xfe055fff,0xfebf0000-0xfebf3fff irq 10 at device 6.0 on pci0
virtio_pci3: <VirtIO PCI (legacy) Balloon adapter> port 0xc120-0xc13f
mem 0xfebf4000-0xfebf7fff irq 11 at device 7.0 on pci0
vtballoon0: <VirtIO Balloon Adapter> on virtio_pci3
virtio_pci4: <VirtIO PCI (legacy) Block adapter> port 0xc080-0xc0bf mem
0xfe056000-0xfe056fff,0xfebf8000-0xfebfbfff irq 11 at device 8.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci4
vtblk0: 614400MB (1258291200 512 byte sectors)
virtio_pci5: <VirtIO PCI (legacy) VSOCK Transport adapter> port
0xc140-0xc15f mem 0xfe057000-0xfe057fff,0xfebfc000-0xfebfffff irq 10 at
device 10.0 on pci0
acpi_syscontainer0: <System Container> on acpi0
acpi_syscontainer1: <System Container> port 0xaf00-0xaf0b on acpi0
acpi_syscontainer2: <System Container> port 0xafe0-0xafe3 on acpi0
acpi_syscontainer3: <System Container> port 0xae00-0xae13 on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
WARNING: Device "psm" is Giant locked and may be deleted before FreeBSD
16.0.
psm0: model IntelliMouse Explorer, device ID 4
fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5,0x3f7 irq 6 drq 2
on acpi0
fdc0: does not respond
device_attach: fdc0 attach returned 6
orm0: <ISA Option ROM> at iomem 0xea800-0xeffff pnpid ORM0000 on isa0
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff pnpid
PNP0900 on isa0
attimer0: <AT timer> at port 0x40 on isa0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
attimer0: non-PNP ISA device will be removed from GENERIC in FreeBSD 16.
Timecounters tick every 10.000 msec
ugen0.1: <Intel UHCI root HUB> at usbus0
ugen1.1: <Intel EHCI root HUB> at usbus1
uhub0 on usbus0
uhub0: <Intel UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus0
uhub1 on usbus1
uhub1: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus1
ZFS filesystem version: 5
ZFS storage pool version: features support (5000)
Trying to mount root from zfs:zroot/ROOT/default []...
cd0 at vtscsi0 bus 0 scbus2 target 0 lun 0
cd0: <QEMU Virtuozzo CDROM1 2.5+> Removable CD-ROM SPC-3 SCSI device
cd0: 300.000MB/s transfers
cd0: Command Queueing enabled
cd0: 521MB (266927 2048 byte sectors)
cd1 at vtscsi0 bus 0 scbus2 target 1 lun 0
cd1: <QEMU Virtuozzo CDROM2 2.5+> Removable CD-ROM SPC-3 SCSI device
cd1: 300.000MB/s transfers
cd1: Command Queueing enabled
cd1: Attempt to query device size failed: NOT READY, Medium not present
uhub0: 2 ports with 2 removable, self powered
ugen0.2: <QEMU QEMU USB Tablet> at usbus0
usbhid0 on uhub0
usbhid0: <QEMU QEMU USB Tablet, class 0/0, rev 2.00/0.00, addr 2> on usbus0
hidbus0: <HID bus> on usbhid0
Root mount waiting for: usbus1
Root mount waiting for: usbus1
uhub1: 6 ports with 6 removable, self powered
intsmb0: <Intel PIIX4 SMBUS Interface> irq 9 at device 1.3 on pci0
intsmb0: intr IRQ 9 enabled revision 0
smbus0: <System Management Bus> on intsmb0
hms0: <QEMU QEMU USB Tablet> on hidbus0
hms0: 3 buttons and [XYW] coordinates ID=0
vtcon0: <VirtIO Console Adapter> on virtio_pci2
lo0: link state changed to UP
vtnet0: link state changed to UP
pflog0: promiscuous mode enabled
Security policy loaded: MAC/ntpd (mac_ntpd)
