* [PATCH v3 1/2] x86/amd_node: Avoid divide by zero on virtualized systems
2026-08-25 21:48 [PATCH v3 0/2] x86/amd_node: Fixes for virtualized systems Jason Andryuk
@ 2026-08-25 21:48 ` Jason Andryuk
2026-08-26 4:45 ` Borislav Petkov
2026-08-25 21:48 ` [PATCH v3 2/2] x86/amd_node: Remove smn_exclusive Jason Andryuk
1 sibling, 1 reply; 4+ messages in thread
From: Jason Andryuk @ 2026-08-25 21:48 UTC (permalink / raw)
To: Borislav Petkov, Dave Hansen, H. Peter Anvin, Ingo Molnar,
Mario Limonciello, Thomas Gleixner, x86, Yazen Ghannam
Cc: Jason Andryuk, linux-kernel, Penny Zheng, stable
On a virtualized system, the number of nodes does not have a
relationship to the number of roots. A Xen PVH dom0 can calculate
roots_per_node as 0, which crashes with a divide by zero in:
if (count++ % roots_per_node)
The issue is seen with Xen, but it could affect other systems.
Change roots_per_node == 0 to 1 to allow the system to boot. Print a
warning when this is performed for non-virtualized systems.
Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Cc: stable@vger.kernel.org
Suggested-by: Borislav Petkov <bp@alien8.de>
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
v3:
Add newline to warning.
R-b: Yazen
v2:
Print as a warning instead of error
Use "!" instead of "== 0".
X86_FEATURE_XENPV is only for PV, but this is observed with a PVH dom0.
---
arch/x86/kernel/amd_node.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 0be01725a2a4..408b9fd48349 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -287,6 +287,11 @@ static int __init amd_smn_init(void)
return -ENOMEM;
roots_per_node = num_roots / num_nodes;
+ if (!roots_per_node) {
+ if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
+ pr_warn(FW_BUG "Error detecting roots per node.\n");
+ roots_per_node = 1;
+ }
count = 0;
node = 0;
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH v3 2/2] x86/amd_node: Remove smn_exclusive
2026-08-25 21:48 [PATCH v3 0/2] x86/amd_node: Fixes for virtualized systems Jason Andryuk
2026-08-25 21:48 ` [PATCH v3 1/2] x86/amd_node: Avoid divide by zero on " Jason Andryuk
@ 2026-08-25 21:48 ` Jason Andryuk
1 sibling, 0 replies; 4+ messages in thread
From: Jason Andryuk @ 2026-08-25 21:48 UTC (permalink / raw)
To: Borislav Petkov, Dave Hansen, H. Peter Anvin, Ingo Molnar,
Mario Limonciello, Thomas Gleixner, x86, Yazen Ghannam
Cc: Jason Andryuk, linux-kernel, Penny Zheng, stable,
Mario Limonciello (AMD)
amd_smn_read/write() are exported functions around __amd_smn_rw(), so
they are always available even if amd_smn_init() fails. smn_exclusive
would prevent access to __amd_smn_rw(), but it is placed too late. If
amd_smn_init() failed, amd_roots is NULL and __amd_smn_rw() will fault
over it. Replace smn_exclusive with directly checking amd_roots to
avoid the NULL pointer dereference.
commit 83518453074d ("x86/amd_node: Add SMN offsets to exclusive region
access") added smn_exclusive which indicated the calls to
pci_request_config_region_exclusive() succeeded to prevent userspace
access.
commit 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
re-ordered initialization so pci_request_config_region_exclusive() is
called earlier and a failure exits amd_smn_init() before allocating
amd_roots. Setting smn_exclusive moved to the end of amd_smn_init(),
after amd_roots is allocated. smn_exclusive became redundant to
amd_roots and can be removed.
Add a comment stating how amd_roots replaces smn_exclusive's purpose.
Fixes: 77466b798d59 ("x86/amd_node: Remove dependency on AMD_NB")
Cc: stable@vger.kernel.org
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
---
Fixes is the introduction of amd_roots, which could be a NULL deref.
v3:
No change
v2:
R-b Yazen and Mario
Add comment about amd_root taking smn_exclusive's purpose to indicate
userspace access is prevented.
Expand commit message
---
arch/x86/kernel/amd_node.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 408b9fd48349..833e5eda5d91 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -38,7 +38,6 @@ static struct pci_dev **amd_roots;
/* Protect the PCI config register pairs used for SMN. */
static DEFINE_MUTEX(smn_mutex);
-static bool smn_exclusive;
#define SMN_INDEX_OFFSET 0x60
#define SMN_DATA_OFFSET 0x64
@@ -91,11 +90,15 @@ static int __amd_smn_rw(u8 i_off, u8 d_off, u16 node, u32 address, u32 *value, b
if (node >= amd_num_nodes())
return err;
- root = amd_roots[node];
- if (!root)
+ /*
+ * non-NULL amd_roots indicates pci_request_config_region_exclusive()
+ * succeeded and userspace cannot access the registers.
+ */
+ if (!amd_roots)
return err;
- if (!smn_exclusive)
+ root = amd_roots[node];
+ if (!root)
return err;
guard(mutex)(&smn_mutex);
@@ -313,8 +316,6 @@ static int __init amd_smn_init(void)
debugfs_create_file("value", 0600, debugfs_dir, NULL, &smn_value_fops);
}
- smn_exclusive = true;
-
return 0;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread