[tip: x86/urgent] x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware
From: tip-bot2 for Ashish Kalra
Date: Wed Nov 04 2026 - 22:53:19 EST
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 2803a7993d4cd9354f851dfcab46991d676f4e6b
Gitweb: https://git.kernel.org/tip/2803a7993d4cd9354f851dfcab46991d676f4e6b
Author: Ashish Kalra <ashish.kalra@xxxxxxx>
AuthorDate: Wed, 28 Oct 2026 19:49:22
Committer: Borislav Petkov (AMD) <bp@xxxxxxxxx>
CommitterDate: Wed, 04 Nov 2026 17:09:14 -08:00
x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware
Segmented RMP support is advertised via X86_FEATURE_SEGMENTED_RMP, and the
firmware enables it via MSR_AMD64_RMP_CFG[SEG_RMP_ENABLED]. The latter can be
cleared in platform BIOS by the user, in which case the system runs in
contiguous RMP setting.
snp_probe_rmptable_info() does not clear X86_FEATURE_RMPOPT in the
advertised-but-firmware-disabled case.
As a result, this does not prevent snp_enable_rmpopt() from trying to program
MSR_AMD64_RMPOPT_BASE, which raises a #GP on the MSR access.
Make sure X86_FEATURE_RMPOPT is cleared in all cases where segmented RMP is
not enabled.
[ bp:
- Put the commit message on Ozempic
- Simplify snp_probe_rmptable_info()
- Fix feature check order in snp_enable_rmpopt()
- Add RMPOPT feature dependency on SEV_SNP ]
Fixes: 15d974be0a3b ("x86/sev: Initialize RMPOPT configuration MSRs")
Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Link: https://patch.msgid.link/56da047d63b22f03a7e709fc172a5543da894d67.1793216372.git.ashish.kalra@xxxxxxx
---
arch/x86/kernel/cpu/cpuid-deps.c | 1 +
arch/x86/virt/svm/sev.c | 17 +++++------------
2 files changed, 6 insertions(+), 12 deletions(-)
diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
index 99801e8..acbcec3 100644
--- a/arch/x86/kernel/cpu/cpuid-deps.c
+++ b/arch/x86/kernel/cpu/cpuid-deps.c
@@ -93,6 +93,7 @@ static const struct cpuid_dep cpuid_deps[] = {
{ X86_FEATURE_SPEC_CTRL_SSBD, X86_FEATURE_SPEC_CTRL },
{ X86_FEATURE_LASS, X86_FEATURE_SMAP },
{ X86_FEATURE_INVLPGB, X86_FEATURE_PCID },
+ { X86_FEATURE_RMPOPT, X86_FEATURE_SEV_SNP },
{}
};
diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
index bd70c4d..417e6a4 100644
--- a/arch/x86/virt/svm/sev.c
+++ b/arch/x86/virt/svm/sev.c
@@ -669,10 +669,10 @@ void snp_enable_rmpopt(void)
u64 base;
int cpu;
- if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
+ if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
return;
- if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
+ if (!cpu_feature_enabled(X86_FEATURE_RMPOPT))
return;
if (!rmpopt_soft_init)
@@ -819,18 +819,11 @@ bool snp_probe_rmptable_info(void)
{
if (cpu_feature_enabled(X86_FEATURE_SEGMENTED_RMP)) {
rdmsrq(MSR_AMD64_RMP_CFG, rmp_cfg);
-
- if (rmp_cfg & MSR_AMD64_SEG_RMP_ENABLED) {
- if (probe_segmented_rmptable_info())
- return true;
-
- setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
- return false;
- }
- } else {
- setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
+ if (rmp_cfg & MSR_AMD64_SEG_RMP_ENABLED)
+ return probe_segmented_rmptable_info();
}
+ setup_clear_cpu_cap(X86_FEATURE_RMPOPT);
return probe_contiguous_rmptable_info();
}