Re: [PATCH v4 1/2] x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware

[Kalra, Ashish]

On 11/2/2026 6:45 PM, Borislav Petkov wrote:
> On Mon, Nov 02, 2026 at 06:07:35PM -0600, Kalra, Ashish wrote:
>> LGTM, tested on HW.
> 
> Ok, thanks.
> 
> This below is what I have now, and the code looks a lot better. If there are
> no more complaints and it looks like what you tested, you can wait for me to
> push out the two patches and then you can test tip:x86/urgent again.
> 
> Thx.
> 
> ---
> From: Ashish Kalra <ashish.kalra@xxxxxxx>
> Date: Wed, 28 Oct 2026 19:49:22 +0000
> Subject: [PATCH] x86/sev: Clear RMPOPT when segmented RMP is disabled by
>  firmware
> 
> Segmented RMP support is advertised via X86_FEATURE_SEGMENTED_RMP, and the
> firmware enables it via MSR_AMD64_RMP_CFG[SEG_RMP_ENABLED]. The latter can be
> cleared in platform BIOS by the user, in which case the system runs in
> contiguous RMP setting.
> 
> snp_probe_rmptable_info() does not clear X86_FEATURE_RMPOPT in the
> advertised-but-firmware-disabled case.
> 
> As a result, this does not prevent snp_enable_rmpopt() from trying to program
> MSR_AMD64_RMPOPT_BASE, which raises a #GP on the MSR access.
> 
> Make sure X86_FEATURE_RMPOPT is cleared in all cases where segmented RMP is
> not enabled.
> 
>   [ bp:
>    - Put the commit message on Ozempic
>    - Simplify snp_probe_rmptable_info()
>    - Fix feature check order in snp_enable_rmpopt()
>    - Add RMPOPT feature dependency on SEV_SNP ]
> 
> Fixes: 15d974be0a3b ("x86/sev: Initialize RMPOPT configuration MSRs")
> Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
> Link: https://patch.msgid.link/56da047d63b22f03a7e709fc172a5543da894d67.1793216372.git.ashish.kalra@xxxxxxx
> ---
>  arch/x86/kernel/cpu/cpuid-deps.c |  1 +
>  arch/x86/virt/svm/sev.c          | 17 +++++------------
>  2 files changed, 6 insertions(+), 12 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
> index 99801e844b30..acbcec394ef1 100644
> --- a/arch/x86/kernel/cpu/cpuid-deps.c
> +++ b/arch/x86/kernel/cpu/cpuid-deps.c
> @@ -93,6 +93,7 @@ static const struct cpuid_dep cpuid_deps[] = {
>  	{ X86_FEATURE_SPEC_CTRL_SSBD,		X86_FEATURE_SPEC_CTRL },
>  	{ X86_FEATURE_LASS,			X86_FEATURE_SMAP      },
>  	{ X86_FEATURE_INVLPGB,			X86_FEATURE_PCID      },
> +	{ X86_FEATURE_RMPOPT,			X86_FEATURE_SEV_SNP   },
>  	{}
>  };
>  
> diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
> index bd70c4d0b774..417e6a41ac60 100644
> --- a/arch/x86/virt/svm/sev.c
> +++ b/arch/x86/virt/svm/sev.c
> @@ -669,10 +669,10 @@ void snp_enable_rmpopt(void)
>  	u64 base;
>  	int cpu;
>  
> -	if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
> +	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
>  		return;
>  
> -	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
> +	if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
>  		return;
>  
>  	if (!rmpopt_soft_init)
> @@ -819,18 +819,11 @@ bool snp_probe_rmptable_info(void)
>  {
>  	if (cpu_feature_enabled(X86_FEATURE_SEGMENTED_RMP)) {
>  		rdmsrq(MSR_AMD64_RMP_CFG, rmp_cfg);
> -
> -		if (rmp_cfg & MSR_AMD64_SEG_RMP_ENABLED) {
> -			if (probe_segmented_rmptable_info())
> -				return true;
> -
> -			setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
> -			return false;
> -		}
> -	} else {
> -		setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
> +		if (rmp_cfg & MSR_AMD64_SEG_RMP_ENABLED)
> +			return probe_segmented_rmptable_info();
>  	}
>  
> +	setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
>  	return probe_contiguous_rmptable_info();
>  }
>  

LGTM.

I'll wait for you to push to tip:x86/urgent and re-test there.

Thanks,
Ashish