[PATCH v2 0/2] x86/amd_node: Fixes for virtualized systems

[PATCH v2 0/2] x86/amd_node: Fixes for virtualized systems

[Jason Andryuk]

For v2, swap the patch order.

On my test system, I see SMN accesses from:
amd_pmf_probe() - read
amd_pmc_probe() - read
acp_acp70_audio_probe() - write

Jason Andryuk (2):
  x86/amd_node: Avoid divide by zero on virtualized systems
  x86/amd_node: Remove smn_exclusive

 arch/x86/kernel/amd_node.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

-- 
2.55.0

[PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

On a virtualized system, the number of nodes does not have a
relationship to the number of roots.  A Xen PVH dom0 can calculate
roots_per_node as 0, which crashes with a divide by zero in:

    if (count++ % roots_per_node)

The issue is seen with Xen, but it could affect other systems.

Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
warning when this is performed for non-virtualized systems.

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Cc: stable@vger.kernel.org
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
v2:
Print as a warning instead of error
Use "!" instead of "== 0".

X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
---
 arch/x86/kernel/amd_node.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 0be01725a2a4..c3e214925d9c 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
 		return -ENOMEM;
 
 	roots_per_node = num_roots / num_nodes;
+	if (!roots_per_node) {
+		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
+			pr_warn(FW_BUG "Error detecting roots per node.");
+		roots_per_node = 1;
+	}
 
 	count = 0;
 	node = 0;
-- 
2.55.0

Re: [PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

Hi,

On 2026-08-14 17:42, Jason Andryuk wrote:
> On a virtualized system, the number of nodes does not have a
> relationship to the number of roots.  A Xen PVH dom0 can calculate
> roots_per_node as 0, which crashes with a divide by zero in:
> 
>      if (count++ % roots_per_node)
> 
> The issue is seen with Xen, but it could affect other systems.
> 
> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
> warning when this is performed for non-virtualized systems.
> 
> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
> Cc: stable@vger.kernel.org
> Suggested-by: Borislav Petkov <bp@alien8.de>
> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>

Any feedback here?

Thanks,
Jason

> ---
> v2:
> Print as a warning instead of error
> Use "!" instead of "== 0".
> 
> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
> ---
>   arch/x86/kernel/amd_node.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 0be01725a2a4..c3e214925d9c 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>   		return -ENOMEM;
>   
>   	roots_per_node = num_roots / num_nodes;
> +	if (!roots_per_node) {
> +		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
> +			pr_warn(FW_BUG "Error detecting roots per node.");
> +		roots_per_node = 1;
> +	}
>   
>   	count = 0;
>   	node = 0;

Re: [PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Yazen Ghannam]

On Mon, Aug 24, 2026 at 04:05:40PM -0400, Jason Andryuk wrote:
> Hi,
> 
> On 2026-08-14 17:42, Jason Andryuk wrote:
> > On a virtualized system, the number of nodes does not have a
> > relationship to the number of roots.  A Xen PVH dom0 can calculate
> > roots_per_node as 0, which crashes with a divide by zero in:
> > 
> >      if (count++ % roots_per_node)
> > 
> > The issue is seen with Xen, but it could affect other systems.
> > 
> > Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
> > warning when this is performed for non-virtualized systems.
> > 
> > Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
> > Cc: stable@vger.kernel.org
> > Suggested-by: Borislav Petkov <bp@alien8.de>
> > Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
> 
> Any feedback here?
> 
> Thanks,
> Jason
> 
> > ---
> > v2:
> > Print as a warning instead of error
> > Use "!" instead of "== 0".
> > 
> > X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
> > ---
> >   arch/x86/kernel/amd_node.c | 5 +++++
> >   1 file changed, 5 insertions(+)
> > 
> > diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> > index 0be01725a2a4..c3e214925d9c 100644
> > --- a/arch/x86/kernel/amd_node.c
> > +++ b/arch/x86/kernel/amd_node.c
> > @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
> >   		return -ENOMEM;
> >   	roots_per_node = num_roots / num_nodes;
> > +	if (!roots_per_node) {
> > +		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
> > +			pr_warn(FW_BUG "Error detecting roots per node.");
> > +		roots_per_node = 1;
> > +	}

Minor nit: add a newline after the closing brace.

> >   	count = 0;
> >   	node = 0;
> 

Overall, looks good to me.

Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>

Thanks,
Yazen

Re: [PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

On 2026-08-24 17:04, Yazen Ghannam wrote:
> On Mon, Aug 24, 2026 at 04:05:40PM -0400, Jason Andryuk wrote:
>> Hi,
>>
>> On 2026-08-14 17:42, Jason Andryuk wrote:
>>> On a virtualized system, the number of nodes does not have a
>>> relationship to the number of roots.  A Xen PVH dom0 can calculate
>>> roots_per_node as 0, which crashes with a divide by zero in:
>>>
>>>       if (count++ % roots_per_node)
>>>
>>> The issue is seen with Xen, but it could affect other systems.
>>>
>>> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
>>> warning when this is performed for non-virtualized systems.
>>>
>>> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
>>> Cc: stable@vger.kernel.org
>>> Suggested-by: Borislav Petkov <bp@alien8.de>
>>> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
>>
>> Any feedback here?
>>
>> Thanks,
>> Jason
>>
>>> ---
>>> v2:
>>> Print as a warning instead of error
>>> Use "!" instead of "== 0".
>>>
>>> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
>>> ---
>>>    arch/x86/kernel/amd_node.c | 5 +++++
>>>    1 file changed, 5 insertions(+)
>>>
>>> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
>>> index 0be01725a2a4..c3e214925d9c 100644
>>> --- a/arch/x86/kernel/amd_node.c
>>> +++ b/arch/x86/kernel/amd_node.c
>>> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>>>    		return -ENOMEM;
>>>    	roots_per_node = num_roots / num_nodes;
>>> +	if (!roots_per_node) {
>>> +		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
>>> +			pr_warn(FW_BUG "Error detecting roots per node.");
>>> +		roots_per_node = 1;
>>> +	}
> 
> Minor nit: add a newline after the closing brace.

There is an existing newline that is preserved here in the original 
posting.  It seems when I replied in Thunderbird the context here was 
corrupted.

>>>    	count = 0;
>>>    	node = 0;
>>
> 
> Overall, looks good to me.
> 
> Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Thank you.

Jason

Re: [PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Borislav Petkov]

On Fri, Aug 14, 2026 at 05:42:52PM -0400, Jason Andryuk wrote:
> On a virtualized system, the number of nodes does not have a
> relationship to the number of roots.  A Xen PVH dom0 can calculate
> roots_per_node as 0, which crashes with a divide by zero in:
> 
>     if (count++ % roots_per_node)
> 
> The issue is seen with Xen, but it could affect other systems.
> 
> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
> warning when this is performed for non-virtualized systems.
> 
> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
> Cc: stable@vger.kernel.org
> Suggested-by: Borislav Petkov <bp@alien8.de>
> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
> ---
> v2:
> Print as a warning instead of error
> Use "!" instead of "== 0".
> 
> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
> ---
>  arch/x86/kernel/amd_node.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 0be01725a2a4..c3e214925d9c 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>  		return -ENOMEM;
>  
>  	roots_per_node = num_roots / num_nodes;
> +	if (!roots_per_node) {
> +		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
> +			pr_warn(FW_BUG "Error detecting roots per node.");
> +		roots_per_node = 1;
> +	}
>  
>  	count = 0;
>  	node = 0;
> -- 

https://sashiko.dev/#/patchset/20260814214255.83127-1-jason.andryuk%40amd.com

And this one specifically (the other two are being addressed):

"Are we missing a newline character at the end of this warning message?
Without a trailing \n in the format string, subsequent kernel messages might
be appended to the same line, resulting in malformed dmesg output."

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

On 2026-08-25 00:00, Borislav Petkov wrote:
> On Fri, Aug 14, 2026 at 05:42:52PM -0400, Jason Andryuk wrote:
>> On a virtualized system, the number of nodes does not have a
>> relationship to the number of roots.  A Xen PVH dom0 can calculate
>> roots_per_node as 0, which crashes with a divide by zero in:
>>
>>      if (count++ % roots_per_node)
>>
>> The issue is seen with Xen, but it could affect other systems.
>>
>> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
>> warning when this is performed for non-virtualized systems.
>>
>> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
>> Cc: stable@vger.kernel.org
>> Suggested-by: Borislav Petkov <bp@alien8.de>
>> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
>> ---
>> v2:
>> Print as a warning instead of error
>> Use "!" instead of "== 0".
>>
>> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
>> ---
>>   arch/x86/kernel/amd_node.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
>> index 0be01725a2a4..c3e214925d9c 100644
>> --- a/arch/x86/kernel/amd_node.c
>> +++ b/arch/x86/kernel/amd_node.c
>> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>>   		return -ENOMEM;
>>   
>>   	roots_per_node = num_roots / num_nodes;
>> +	if (!roots_per_node) {
>> +		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
>> +			pr_warn(FW_BUG "Error detecting roots per node.");
>> +		roots_per_node = 1;
>> +	}
>>   
>>   	count = 0;
>>   	node = 0;
>> -- 
> 
> https://sashiko.dev/#/patchset/20260814214255.83127-1-jason.andryuk%40amd.com
> 
> And this one specifically (the other two are being addressed):
> 
> "Are we missing a newline character at the end of this warning message?
> Without a trailing \n in the format string, subsequent kernel messages might
> be appended to the same line, resulting in malformed dmesg output."

Yes, thanks.  I'll fix.

Regards,
Jason

[PATCH v2 2/2] x86/amd_node: Remove smn_exclusive

[Jason Andryuk]

amd_smn_read/write() are exported functions around __amd_smn_rw(), so
they are always available even if amd_smn_init() fails.  smn_exclusive
would prevent access to __amd_smn_rw(), but it is placed too late.  If
amd_smn_init() failed, amd_roots is NULL and __amd_smn_rw() will fault
over it.  Replace smn_exclusive with directly checking amd_roots to
avoid the NULL pointer dereference.

commit 83518453074d ("x86/amd_node: Add SMN offsets to exclusive region
access") added smn_exclusive which indicated the calls to
pci_request_config_region_exclusive() succeeded to prevent userspace
access.

commit 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
re-ordered initialization so pci_request_config_region_exclusive() is
called earlier and a failure exits amd_smn_init() before allocating
amd_roots.  Setting smn_exclusive moved to the end of amd_smn_init(),
after amd_roots is allocated.  smn_exclusive became redundant to
amd_roots and can be removed.

Add a comment stating how amd_roots replaces smn_exclusive's purpose.

Fixes: 77466b798d59 ("x86/amd_node: Remove dependency on AMD_NB")
Cc: stable@vger.kernel.org
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
Fixes is the introduction of amd_roots, which could be a NULL deref.

v2:
R-b Yazen and Mario
Add comment about amd_root taking smn_exclusive's purpose to indicate
userspace access is prevented.
Expand commit message
---
 arch/x86/kernel/amd_node.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index c3e214925d9c..14104f8c5d64 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -38,7 +38,6 @@ static struct pci_dev **amd_roots;
 
 /* Protect the PCI config register pairs used for SMN. */
 static DEFINE_MUTEX(smn_mutex);
-static bool smn_exclusive;
 
 #define SMN_INDEX_OFFSET	0x60
 #define SMN_DATA_OFFSET		0x64
@@ -91,11 +90,15 @@ static int __amd_smn_rw(u8 i_off, u8 d_off, u16 node, u32 address, u32 *value, b
 	if (node >= amd_num_nodes())
 		return err;
 
-	root = amd_roots[node];
-	if (!root)
+	/*
+	 * non-NULL amd_roots indicates pci_request_config_region_exclusive()
+	 * succeeded and userspace cannot access the registers.
+	 */
+	if (!amd_roots)
 		return err;
 
-	if (!smn_exclusive)
+	root = amd_roots[node];
+	if (!root)
 		return err;
 
 	guard(mutex)(&smn_mutex);
@@ -313,8 +316,6 @@ static int __init amd_smn_init(void)
 		debugfs_create_file("value",	0600, debugfs_dir, NULL, &smn_value_fops);
 	}
 
-	smn_exclusive = true;
-
 	return 0;
 }
 
-- 
2.55.0