Re: [PATCH v16 4/5] x86/sev: Perform RMP optimizations asynchronously

[Kalra, Ashish]

Hello Boris,

On 9/18/2026 5:23 PM, Borislav Petkov wrote:
> On Wed, Sep 16, 2026 at 10:15:14PM +0000, Ashish Kalra wrote:
>> Changes in v15:
>> - Move the workqueue allocation and the (fixed) optimization range
>>   computation to an initcall; snp_enable_rmpopt() now only programs the
>>   RMPOPT_BASE MSRs and queues the optimization pass.
>> - Gate rmpopt_capable() on a static rmpopt_enabled bool set when the
>>   workqueue is allocated, instead of an if (rmpopt_wq) check, and drop
>>   rmpopt_wq_mutex.
>> - Queue both the initial and the teardown pass with mod_delayed_work().
>>  arch/x86/virt/svm/sev.c | 99 +++++++++++++++++++++++++++++++++++++++--
>>  1 file changed, 95 insertions(+), 4 deletions(-)
> 
> Some scrubbing to this one too:
> 
> Author: Ashish Kalra <ashish.kalra@xxxxxxx>
> Date:   Wed Sep 16 22:15:14 2026 +0000
> 
>     x86/sev: Perform RMP optimizations asynchronously
>     
>     When SNP is enabled, all writes to memory are checked to ensure memory
>     integrity. This imposes performance overhead on the whole system.
>     
>     RMPOPT is a new instruction that minimizes the performance overhead of
>     RMP checks on the hypervisor and on non-SNP guests by allowing such checks to
>     be skipped for 1GB regions of memory that are known not to contain any SNP
>     guest memory.
>     
>     Add support for performing RMP optimizations asynchronously using a dedicated
>     per-CPU workqueue.  Shortly after SNP initialization, run an optimization pass
>     over all physical memory.
>     
>     As SNP guests are launched, RMPUPDATE assigns their private pages to
>     guest-owned state; when such a page falls within an optimized 1GB region, the
>     hardware clears that region's RMPOPT optimization and RMP checks resume there
>     to protect the guest memory.
>     
>     Since launching SNP guests clears these optimizations, perform them again
>     asynchronously using the dedicated workqueue.
>     
>       [ bp:
>        - Massage commit message and comments
>        - simplify code
>        - redo some of the logic ]
>     
>     Suggested-by: Thomas Lendacky <thomas.lendacky@xxxxxxx>
>     Suggested-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
>     Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
>     Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
>     Link: https://patch.msgid.link/daa513fbe8f0672b00bc5e026e4399244be6dc72.1789594774.git.ashish.kalra@xxxxxxx
> 
> diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
> index 1fecd246ce5f..94754f2986d3 100644
> --- a/arch/x86/virt/svm/sev.c
> +++ b/arch/x86/virt/svm/sev.c
> @@ -19,6 +19,7 @@
>  #include <linux/iommu.h>
>  #include <linux/amd-iommu.h>
>  #include <linux/nospec.h>
> +#include <linux/workqueue.h>
>  
>  #include <asm/sev.h>
>  #include <asm/processor.h>
> @@ -124,7 +125,27 @@ static void *rmp_bookkeeping __ro_after_init;
>  
>  static u64 probed_rmp_base, probed_rmp_size;
>  
> -static phys_addr_t rmpopt_pa_start;
> +static u64 rmpopt_pa_start, rmpopt_pa_end;
> +
> +enum rmpopt_op_type {
> +	RMPOPT_OP_VERIFY_AND_REPORT_STATUS,
> +	RMPOPT_OP_REPORT_STATUS
> +};
> +
> +static struct workqueue_struct *rmpopt_wq;
> +static struct delayed_work rmpopt_delayed_work;
> +
> +/* Software RMPOPT facilities initialized */
> +static bool rmpopt_soft_init;
> +
> +/*
> + * Delay, in milliseconds, before the RMP re-optimization pass runs after an
> + * SNP guest is torn down. This coalesces a burst of teardowns into a single
> + * scan and gives each guest's pages time to be converted back to the shared,
> + * hypervisor-owned state.  The 10 second value is a heuristic trading
> + * re-optimization latency against scanning too eagerly.
> + */
> +#define RMPOPT_WORK_TIMEOUT	(10 * MSEC_PER_SEC)
>  
>  static LIST_HEAD(snp_leaked_pages_list);
>  static DEFINE_SPINLOCK(snp_leaked_pages_list_lock);
> @@ -565,6 +586,9 @@ void snp_shutdown(void)
>  	if (syscfg & MSR_AMD64_SYSCFG_SNP_EN)
>  		return;
>  
> +	if (rmpopt_soft_init)
> +		cancel_delayed_work_sync(&rmpopt_delayed_work);
> +
>  	clear_rmp();
>  	on_each_cpu(mfd_reconfigure, NULL, 1);
>  
> @@ -577,21 +601,80 @@ void snp_shutdown(void)
>  }
>  EXPORT_SYMBOL_FOR_MODULES(snp_shutdown, "ccp");
>  
> -static bool rmpopt_capable(void)
> +/*
> + * RMPOPT optimizations skip RMP checks at 1GB granularity if this range of
> + * memory does not contain any SNP guest memory.
> + *
> + * @pa is a system physical address; RMPOPT operates on the containing 1GB.
> + */
> +static void rmpopt(u64 pa)
>  {
> -	return cpu_feature_enabled(X86_FEATURE_RMPOPT) &&
> -	       cc_platform_has(CC_ATTR_HOST_SEV_SNP);
> +	enum rmpopt_op_type op = RMPOPT_OP_VERIFY_AND_REPORT_STATUS;
> +	u64 pa_start = ALIGN_DOWN(pa, SZ_1G);
> +
> +	/* Supported by binutils 2.48+ */
> +	asm volatile(".byte 0xf2, 0x0f, 0x01, 0xfc"
> +		     :: "a" (pa_start), "c" (op)
> +		     : "memory", "cc");
> +}
> +
> +static void rmpopt_scan_range(void *arg)
> +{
> +	u64 pa;
> +
> +	for (pa = rmpopt_pa_start; pa < rmpopt_pa_end; pa += SZ_1G)
> +		rmpopt(pa);
>  }
>  
> +static void do_rmpopt_work(struct work_struct *work)
> +{
> +	/*
> +	 * Warm up the RMPOPT cache on this pinned per-CPU worker with interrupts
> +	 * enabled, so the IRQ-disabled fan-out below only issues cache-hit RMPOPTs.
> +	 */
> +	rmpopt_scan_range(NULL);
> +
> +	on_each_cpu_mask(cpu_primary_thread_mask, rmpopt_scan_range, NULL, true);
> +}
> +
> +static int __init rmpopt_init(void)
> +{
> +	if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
> +		return -ENODEV;
> +
> +	rmpopt_wq = alloc_workqueue("rmpopt_wq", WQ_PERCPU, 1);
> +	if (!rmpopt_wq) {
> +		pr_err("Failed to allocate RMPOPT workqueue\n");
> +		return -ENOMEM;
> +	}
> +
> +	INIT_DELAYED_WORK(&rmpopt_delayed_work, do_rmpopt_work);
> +
> +	/* The optimization range is fixed at boot; compute it once. */
> +	rmpopt_pa_start = ALIGN_DOWN(PFN_PHYS(min_low_pfn), SZ_1G);
> +	rmpopt_pa_end = ALIGN(PFN_PHYS(max_pfn), SZ_1G);
> +	if ((rmpopt_pa_end - rmpopt_pa_start) > SZ_2T)
> +		rmpopt_pa_end = rmpopt_pa_start + SZ_2T;
> +
> +	rmpopt_soft_init = true;
> +
> +	return 0;
> +}
> +device_initcall(rmpopt_init);
> +
>  void snp_enable_rmpopt(void)
>  {
>  	u64 base;
>  	int cpu;
>  
> -	if (!rmpopt_capable())
> +	if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
>  		return;
>  
> -	rmpopt_pa_start = ALIGN_DOWN(PFN_PHYS(min_low_pfn), SZ_1G);
> +	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
> +		return;
> +
> +	if (!rmpopt_soft_init)
> +		return;
>  
>  	/*
>  	 * Per-CPU RMPOPT tables cover at most 2 TB.  Program each core's
> @@ -602,6 +685,11 @@ void snp_enable_rmpopt(void)
>  		for_each_cpu(cpu, cpu_primary_thread_mask)
>  			wrmsrq_on_cpu(cpu, MSR_AMD64_RMPOPT_BASE,
>  				      rmpopt_pa_start | MSR_AMD64_RMPOPT_ENABLE);
> +
> +	mod_delayed_work(rmpopt_wq, &rmpopt_delayed_work,
> +			 msecs_to_jiffies(RMPOPT_WORK_TIMEOUT));
> +
> +	pr_info("RMPOPT optimizations enabled\n");

Looks good.

One comment here, i originally had pr_info_once() for printing this once during SNP init, 
if you change it to pr_info(), it will get printed again at every SNP guest teardown too,
i am fine with it and actually it keeps the user aware that RMPOPT optimizations are
being re-applied/re-enabled, but there may be just too many kernel messages dumped.


Thanks,
Ashish

>  }
>  EXPORT_SYMBOL_FOR_MODULES(snp_enable_rmpopt, "ccp");
>  
> 
>