NetBSD Problem Report #60619

From www@netbsd.org  Tue Aug 18 21:34:31 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 2EAB21A923B
	for <gnats-bugs@gnats.NetBSD.org>; Tue, 18 Aug 2026 21:34:31 +0000 (UTC)
Message-Id: <20260818213430.0AF441A923E@mollari.NetBSD.org>
Date: Tue, 18 Aug 2026 21:34:29 +0000 (UTC)
From: vezhlys@gmail.com
Reply-To: vezhlys@gmail.com
To: gnats-bugs@NetBSD.org
Subject: L2 cache associativity not decoded properly on VIA/Zhaoxin CPUs, panic on Zhaoxin KX-7000
X-Send-Pr-Version: www-1.0
X-From4GNATS: "vezhlys@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60619
>Category:       port-amd64
>Synopsis:       L2 cache associativity not decoded properly on VIA/Zhaoxin CPUs, panic on Zhaoxin KX-7000
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    andvar
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 18 21:35:00 +0000 2026
>Closed-Date:    Wed Sep 02 10:36:17 +0000 2026
>Last-Modified:  Wed Sep 02 10:36:17 +0000 2026
>Originator:     Andrius V
>Release:        NetBSD 11.0
>Organization:
>Environment:
>Description:
On a KX-7000 CPU I hit the panic:

"desired number of cache colors 21 is > 1, but not even!",

which revealed a couple of problems with cache detection on Centaur (VIA/Zhaoxin) CPUs:

First issue:
L2 cache associativity is not decoded correctly.

Current Centaur (VIA/Zhaoxin) cache probe reads cache parameters from cpuid function 0x80000006 (for Nehemiah and later CPUs). It is apparently using "AMD" way to encode parameters. The problem is that associativity bits hold the encoded value (cai->cai_associativity = VIA_L2N_ECX_C_ASSOC(descs[2]);), and need an AMD style table lookup  to decode an actual one in the same way AMD cpu probe does (defined by AMD_L2L3CACHE_INFO in https://nxr.netbsd.org/xref/src/sys/arch/x86/include/cacheinfo.h?r=1.31#344). Meaning, that it currently returns values like A for C7 and used directly as is, but actually means 32-way (not 10-way). In a same manner 8 for Nehemiah means 16-way (not 8-way). VIA datasheets state that actual decimal value is stored, but in reality it is not the case, which I can confirm from my own samples and InstLatx64 CPUID dumps. In KX-7000 case it was 6, which by AMD table is 8-way (matching CPU specs). 

The page color is counted as atop(cai_totalsize) / cai_associativity, so a wrong associativity yields a wrong color count (can be either bigger or smaller than the actual, depending on the model). Only by pure luck we didn't hit the panic before, since color calculation was still matching a power of two (just not the expected one). Wrong L2 associativity can be seen with using cpuctl utility (if L2 cache data is shown).

Second issue:
Newer CPU models support and prefer function 4 to get cache parameters.

With the more recent models, CPUID function 4 is the preferred way to get cache parameters which are stored in the "Intel" way instead. 
(https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a2aa578fec8c29436bce5e6c15e1e31729d539a3). 

Looks like function 4 is supported from the CNQ generation VIA Nano CPUs (Nano/Eden 4xxx) or family 6 model F stepping C (6FC) models and all 7 family CPUs (used by Zhaoxin) based on InstLatx64 dumps, including KX-7000.

Additionally, L3 cache is reported by CPUID function 4 only. 0x80000006 always reports L3 as 0 KB on these CPUs. L3 only appeared in relatively recent Zhaoxin models (ignoring unreleased Centaur CNS CPUs).

Thus we need to map cache data for newer CPUs using CPUID function 4 to get more reliable data.
I believe probing it and verifying non-zero value is more preferred way in comparison to CPU family/stepping check.
>How-To-Repeat:
Panics during boot on KX-7000.
Silently miscalculate on others (Nehemiah (C3), Esther (C7), Isaiah (Nano)).
Wrong L2 associativity reported by cpuctl (if shown).
>Fix:
Use AMD_L2L3CACHE_INFO to map correct associativity value for Nehemiah and higher CPUs, same way as AMD probe does.

Use CPUID function 4 to query cache parameters and use intel way decoding it for more recent models where function 4 is available and contains non-zero value.

Map L3 value when available.

No patch yet...

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: port-amd64-maintainer->andvar
Responsible-Changed-By: andvar@NetBSD.org
Responsible-Changed-When: Tue, 25 Aug 2026 21:04:46 +0000
Responsible-Changed-Why:
take

State-Changed-From-To: open->needs-pullups
State-Changed-By: andvar@NetBSD.org
State-Changed-When: Tue, 25 Aug 2026 21:08:06 +0000
State-Changed-Why:
fix committed

From: "Andrius Varanavicius" <andvar@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60619 CVS commit: src/sys/arch/x86/x86
Date: Tue, 25 Aug 2026 21:06:50 +0000

 Module Name:	src
 Committed By:	andvar
 Date:		Tue Aug 25 21:06:50 UTC 2026

 Modified Files:
 	src/sys/arch/x86/x86: identcpu.c

 Log Message:
 Decode L2 cache associativity for VIA CPUs using the AMD cache lookup table for
 the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 VIA datasheets mention that associativity is stored as a decimal value. However,
 in practice, it is encoded the AMD way and does not store the actual value.
 Using the raw value leads to an incorrect CPU colors calculation, causing a
 panic on KX-7000 (since the result is not a power of two) and incorrect CPU
 colors values on other CPU models (e.g. as visible in `vmstat -s').
 Decoding value using the AMD cache lookup table produces correct values in all
 cases I have tested or verified using CPUID dumps available online.

 Additionally, Zhaoxin and late VIA CPUs (CNQ and newer) prefer the Intel
 `cpuid leaf 4' function to get cache parameters. Check whether cpuid_level
 is equal to or greater than 4 to identify these CPUs and override cache values
 (including L1) by calling cpu_dcp_cacheinfo(ci, 4). L3 cache information is
 available only through this method.

 Fixes PR kern/60619

 Similar changes will be committed separately to the cpuctl utility.

 pullups to netbsd-11 and netbsd-10 are needed.

 Thanks to skrll@ for comments on the patch.


 To generate a diff of this commit:
 cvs rdiff -u -r1.141 -r1.142 src/sys/arch/x86/x86/identcpu.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Andrius Varanavicius" <andvar@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60619 CVS commit: src/usr.sbin/cpuctl/arch
Date: Tue, 25 Aug 2026 22:14:26 +0000

 Module Name:	src
 Committed By:	andvar
 Date:		Tue Aug 25 22:14:26 UTC 2026

 Modified Files:
 	src/usr.sbin/cpuctl/arch: i386.c

 Log Message:
 cpuctl(8): decode L2 cache associativity for VIA CPUs using the AMD cache lookup
 table for the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 Mirrors the changes from identcpu.c rev. 1.142.

 Additionally, use via_cpu_probe() and via_cpu_cacheinfo() for CPUVENDOR_IDT
 family > 6 CPUs to identify Zhaoxin CPUs and their features.
 Also, print feature 5-7 bits for CPUVENDOR_IDT, which appear to be compatible
 with Intel.

 Use vendorname = "Zhaoxin" for family 7 models.

 Tested on various 32-bit and 64-bit VIA and Zhaoxin CPUs
 (Samuel 2 / Nehemiah, Esther (32-bit), multiple Nano models, and KX-U6580/7000).

 PR kern/60619

 pullups needed to netbsd-11 and netbsd-10.


 To generate a diff of this commit:
 cvs rdiff -u -r1.148 -r1.149 src/usr.sbin/cpuctl/arch/i386.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60619 CVS commit: [netbsd-11] src
Date: Thu, 27 Aug 2026 17:10:06 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Thu Aug 27 17:10:06 UTC 2026

 Modified Files:
 	src/sys/arch/x86/x86 [netbsd-11]: identcpu.c
 	src/usr.sbin/cpuctl/arch [netbsd-11]: i386.c

 Log Message:
 Pull up following revision(s) (requested by andvar in ticket #444):

 	sys/arch/x86/x86/identcpu.c: revision 1.142
 	usr.sbin/cpuctl/arch/i386.c: revision 1.149

 Decode L2 cache associativity for VIA CPUs using the AMD cache lookup table for
 the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 VIA datasheets mention that associativity is stored as a decimal value. However,
 in practice, it is encoded the AMD way and does not store the actual value.

 Using the raw value leads to an incorrect CPU colors calculation, causing a
 panic on KX-7000 (since the result is not a power of two) and incorrect CPU
 colors values on other CPU models (e.g. as visible in `vmstat -s').

 Decoding value using the AMD cache lookup table produces correct values in all
 cases I have tested or verified using CPUID dumps available online.

 Additionally, Zhaoxin and late VIA CPUs (CNQ and newer) prefer the Intel
 `cpuid leaf 4' function to get cache parameters. Check whether cpuid_level
 is equal to or greater than 4 to identify these CPUs and override cache values
 (including L1) by calling cpu_dcp_cacheinfo(ci, 4). L3 cache information is
 available only through this method.

 Fixes PR kern/60619

 Similar changes will be committed separately to the cpuctl utility.
 Thanks to skrll@ for comments on the patch.

 cpuctl(8): decode L2 cache associativity for VIA CPUs using the AMD cache lookup
 table for the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 Mirrors the changes from identcpu.c rev. 1.142.

 Additionally, use via_cpu_probe() and via_cpu_cacheinfo() for CPUVENDOR_IDT
 family > 6 CPUs to identify Zhaoxin CPUs and their features.
 Also, print feature 5-7 bits for CPUVENDOR_IDT, which appear to be compatible
 with Intel.

 Use vendorname = "Zhaoxin" for family 7 models.

 Tested on various 32-bit and 64-bit VIA and Zhaoxin CPUs
 (Samuel 2 / Nehemiah, Esther (32-bit), multiple Nano models, and KX-U6580/7000).

 PR kern/60619


 To generate a diff of this commit:
 cvs rdiff -u -r1.138.2.1 -r1.138.2.2 src/sys/arch/x86/x86/identcpu.c
 cvs rdiff -u -r1.148 -r1.148.2.1 src/usr.sbin/cpuctl/arch/i386.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60619 CVS commit: [netbsd-10] src
Date: Thu, 27 Aug 2026 17:11:27 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Thu Aug 27 17:11:27 UTC 2026

 Modified Files:
 	src/sys/arch/x86/x86 [netbsd-10]: identcpu.c
 	src/usr.sbin/cpuctl/arch [netbsd-10]: i386.c

 Log Message:
 Pull up following revision(s) (requested by andvar in ticket #1334):

 	sys/arch/x86/x86/identcpu.c: revision 1.142
 	usr.sbin/cpuctl/arch/i386.c: revision 1.149

 Decode L2 cache associativity for VIA CPUs using the AMD cache lookup table for
 the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 VIA datasheets mention that associativity is stored as a decimal value. However,
 in practice, it is encoded the AMD way and does not store the actual value.

 Using the raw value leads to an incorrect CPU colors calculation, causing a
 panic on KX-7000 (since the result is not a power of two) and incorrect CPU
 colors values on other CPU models (e.g. as visible in `vmstat -s').

 Decoding value using the AMD cache lookup table produces correct values in all
 cases I have tested or verified using CPUID dumps available online.

 Additionally, Zhaoxin and late VIA CPUs (CNQ and newer) prefer the Intel
 `cpuid leaf 4' function to get cache parameters. Check whether cpuid_level
 is equal to or greater than 4 to identify these CPUs and override cache values
 (including L1) by calling cpu_dcp_cacheinfo(ci, 4). L3 cache information is
 available only through this method.

 Fixes PR kern/60619

 Similar changes will be committed separately to the cpuctl utility.
 Thanks to skrll@ for comments on the patch.

 cpuctl(8): decode L2 cache associativity for VIA CPUs using the AMD cache lookup
 table for the 0x80000006 CPUID function associativity value.

 Use `cpuid leaf 4' to get cache parameters for Zhaoxin and late VIA CPU models.

 Mirrors the changes from identcpu.c rev. 1.142.

 Additionally, use via_cpu_probe() and via_cpu_cacheinfo() for CPUVENDOR_IDT
 family > 6 CPUs to identify Zhaoxin CPUs and their features.
 Also, print feature 5-7 bits for CPUVENDOR_IDT, which appear to be compatible
 with Intel.

 Use vendorname = "Zhaoxin" for family 7 models.

 Tested on various 32-bit and 64-bit VIA and Zhaoxin CPUs
 (Samuel 2 / Nehemiah, Esther (32-bit), multiple Nano models, and KX-U6580/7000).

 PR kern/60619


 To generate a diff of this commit:
 cvs rdiff -u -r1.123.4.4 -r1.123.4.5 src/sys/arch/x86/x86/identcpu.c
 cvs rdiff -u -r1.133.2.4 -r1.133.2.5 src/usr.sbin/cpuctl/arch/i386.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: needs-pullups->closed
State-Changed-By: andvar@NetBSD.org
State-Changed-When: Wed, 02 Sep 2026 10:36:17 +0000
State-Changed-Why:
pulled up

>Unformatted:

Home	PR Database Search