target/i386: SEV: Ensure SEV features are only set through qemu cli or IGVM
In preparation for qemu being able to set SEV features through the cli, add a check to ensure that SEV features are not also set if using IGVM files. Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://lore.kernel.org/r/6939de99f13d7170af68b74e711eb9f03f32f682.1779281646.git.naveen@kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Naveen N Rao (AMD) committed
May 20, 2026 at 18:57 UTC
a593e468dac5e3d7815eba8993304909efb16f9e
1 file changed
+10
target/i386/sev.c
+10
@@ -1904,6 +1904,16 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
1904
* as SEV_STATE_UNINIT.
1905
*/
1906
if (x86machine->igvm) {
1907
+ /*
1908
+ * Test only the user-set SEV features by masking out
1909
+ * SVM_SEV_FEAT_SNP_ACTIVE which is set by default.
1910
+ */
1911
+ if (sev_common->sev_features & ~SVM_SEV_FEAT_SNP_ACTIVE) {
1912
+ error_setg(errp,
1913
+ "%s: SEV features can't be specified when using IGVM files",
1914
+ __func__);
1915
+ return -1;
1916
+ }
1917
if (IGVM_CFG_GET_CLASS(x86machine->igvm)
1918
->process(x86machine->igvm, machine, true, errp) == -1) {
1919
return -1;