[PATCH v3 0/2] x86/amd_node: Fixes for virtualized systems

[PATCH v3 0/2] x86/amd_node: Fixes for virtualized systems

[Jason Andryuk]

For v3, Add newline to warning.  R-b Yazen.

For v2, swap the patch order.

On my test system, I see SMN accesses from:
amd_pmf_probe() - read
amd_pmc_probe() - read
acp_acp70_audio_probe() - write

Jason Andryuk (2):
  x86/amd_node: Avoid divide by zero on virtualized systems
  x86/amd_node: Remove smn_exclusive

 arch/x86/kernel/amd_node.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

-- 
2.55.0

[PATCH v3 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

On a virtualized system, the number of nodes does not have a
relationship to the number of roots.  A Xen PVH dom0 can calculate
roots_per_node as 0, which crashes with a divide by zero in:

    if (count++ % roots_per_node)

The issue is seen with Xen, but it could affect other systems.

Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
warning when this is performed for non-virtualized systems.

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Cc: stable@vger.kernel.org
Suggested-by: Borislav Petkov <bp@alien8.de>
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
v3:
Add newline to warning.
R-b: Yazen

v2:
Print as a warning instead of error
Use "!" instead of "== 0".

X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
---
 arch/x86/kernel/amd_node.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 0be01725a2a4..408b9fd48349 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
 		return -ENOMEM;
 
 	roots_per_node = num_roots / num_nodes;
+	if (!roots_per_node) {
+		if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
+			pr_warn(FW_BUG "Error detecting roots per node.\n");
+		roots_per_node = 1;
+	}
 
 	count = 0;
 	node = 0;
-- 
2.55.0

Re: [PATCH v3 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Borislav Petkov]

On Tue, Aug 25, 2026 at 05:48:02PM -0400, Jason Andryuk wrote:
> On a virtualized system, the number of nodes does not have a
> relationship to the number of roots.  A Xen PVH dom0 can calculate
> roots_per_node as 0, which crashes with a divide by zero in:
> 
>     if (count++ % roots_per_node)
> 
> The issue is seen with Xen, but it could affect other systems.
> 
> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
> warning when this is performed for non-virtualized systems.
> 
> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
> Cc: stable@vger.kernel.org
> Suggested-by: Borislav Petkov <bp@alien8.de>
> Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
> ---
> v3:
> Add newline to warning.
> R-b: Yazen
> 
> v2:
> Print as a warning instead of error
> Use "!" instead of "== 0".
> 
> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
> ---
>  arch/x86/kernel/amd_node.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 0be01725a2a4..408b9fd48349 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>  		return -ENOMEM;
>  
>  	roots_per_node = num_roots / num_nodes;

Hold on - the only way this is fixing something on Xen - and you say that
roots_per_node becomes 0 - which means that num_roots is 0.

But a couple of lines above, we have

        if (!num_roots)
                return -ENODEV;

So we would've exited already.

num_nodes can't be 0 because you'd explode even with this patch.

What am I missing?

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v3 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Jason Andryuk]

On 2026-08-26 00:45, Borislav Petkov wrote:
> On Tue, Aug 25, 2026 at 05:48:02PM -0400, Jason Andryuk wrote:
>> On a virtualized system, the number of nodes does not have a
>> relationship to the number of roots.  A Xen PVH dom0 can calculate
>> roots_per_node as 0, which crashes with a divide by zero in:
>>
>>      if (count++ % roots_per_node)
>>
>> The issue is seen with Xen, but it could affect other systems.
>>
>> Change roots_per_node == 0 to 1 to allow the system to boot.  Print a
>> warning when this is performed for non-virtualized systems.
>>
>> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
>> Cc: stable@vger.kernel.org
>> Suggested-by: Borislav Petkov <bp@alien8.de>
>> Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
>> Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
>> ---
>> v3:
>> Add newline to warning.
>> R-b: Yazen
>>
>> v2:
>> Print as a warning instead of error
>> Use "!" instead of "== 0".
>>
>> X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
>> ---
>>   arch/x86/kernel/amd_node.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
>> index 0be01725a2a4..408b9fd48349 100644
>> --- a/arch/x86/kernel/amd_node.c
>> +++ b/arch/x86/kernel/amd_node.c
>> @@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
>>   		return -ENOMEM;
>>   
>>   	roots_per_node = num_roots / num_nodes;
> 
> Hold on - the only way this is fixing something on Xen - and you say that
> roots_per_node becomes 0 - which means that num_roots is 0.
> 
> But a couple of lines above, we have
> 
>          if (!num_roots)
>                  return -ENODEV;
> 
> So we would've exited already.
> 
> num_nodes can't be 0 because you'd explode even with this patch.
> 
> What am I missing?
num_roots is 1, but num_nodes is 2.  Integer division gives 0 for 
roots_per_node.

Regards,
Jason

Re: [PATCH v3 1/2] x86/amd_node: Avoid divide by zero on virtualized systems

[Borislav Petkov]

On Wed, Aug 26, 2026 at 08:15:49AM -0400, Jason Andryuk wrote:
> num_roots is 1, but num_nodes is 2.  Integer division gives 0 for
> roots_per_node.

Aha, Xen has some topology knowledge and it manages to produce 2 nodes.

I'll add that to the commit message.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

[PATCH v3 2/2] x86/amd_node: Remove smn_exclusive

[Jason Andryuk]

amd_smn_read/write() are exported functions around __amd_smn_rw(), so
they are always available even if amd_smn_init() fails.  smn_exclusive
would prevent access to __amd_smn_rw(), but it is placed too late.  If
amd_smn_init() failed, amd_roots is NULL and __amd_smn_rw() will fault
over it.  Replace smn_exclusive with directly checking amd_roots to
avoid the NULL pointer dereference.

commit 83518453074d ("x86/amd_node: Add SMN offsets to exclusive region
access") added smn_exclusive which indicated the calls to
pci_request_config_region_exclusive() succeeded to prevent userspace
access.

commit 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
re-ordered initialization so pci_request_config_region_exclusive() is
called earlier and a failure exits amd_smn_init() before allocating
amd_roots.  Setting smn_exclusive moved to the end of amd_smn_init(),
after amd_roots is allocated.  smn_exclusive became redundant to
amd_roots and can be removed.

Add a comment stating how amd_roots replaces smn_exclusive's purpose.

Fixes: 77466b798d59 ("x86/amd_node: Remove dependency on AMD_NB")
Cc: stable@vger.kernel.org
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
Fixes is the introduction of amd_roots, which could be a NULL deref.

v3:
No change

v2:
R-b Yazen and Mario
Add comment about amd_root taking smn_exclusive's purpose to indicate
userspace access is prevented.
Expand commit message
---
 arch/x86/kernel/amd_node.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 408b9fd48349..833e5eda5d91 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -38,7 +38,6 @@ static struct pci_dev **amd_roots;
 
 /* Protect the PCI config register pairs used for SMN. */
 static DEFINE_MUTEX(smn_mutex);
-static bool smn_exclusive;
 
 #define SMN_INDEX_OFFSET	0x60
 #define SMN_DATA_OFFSET		0x64
@@ -91,11 +90,15 @@ static int __amd_smn_rw(u8 i_off, u8 d_off, u16 node, u32 address, u32 *value, b
 	if (node >= amd_num_nodes())
 		return err;
 
-	root = amd_roots[node];
-	if (!root)
+	/*
+	 * non-NULL amd_roots indicates pci_request_config_region_exclusive()
+	 * succeeded and userspace cannot access the registers.
+	 */
+	if (!amd_roots)
 		return err;
 
-	if (!smn_exclusive)
+	root = amd_roots[node];
+	if (!root)
 		return err;
 
 	guard(mutex)(&smn_mutex);
@@ -313,8 +316,6 @@ static int __init amd_smn_init(void)
 		debugfs_create_file("value",	0600, debugfs_dir, NULL, &smn_value_fops);
 	}
 
-	smn_exclusive = true;
-
 	return 0;
 }
 
-- 
2.55.0