target/i386: SEV: Validate that SEV-ES is enabled when VMSA features are used
SEV features in the VMSA are only meaningful for SEV-ES and SEV-SNP guests, as they control aspects of the encrypted guest state that are not relevant for basic SEV guests. Add a check in check_sev_features() to ensure that SEV-ES or SEV-SNP is enabled when any SEV features are specified. Reviewed-by: Nikunj A Dadhania <nikunj@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://lore.kernel.org/r/11e34ae3db91643e45e097404d1aa949a820aa0d.1779281646.git.naveen@kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Naveen N Rao (AMD) committed
May 20, 2026 at 18:57 UTC
c93800f544dbac9ea7bf78cd802ab0731224b27f
1 file changed
+6
target/i386/sev.c
+6
@@ -523,6 +523,12 @@ static int check_sev_features(SevCommonState *sev_common, uint64_t sev_features,
523
__func__);
524
return -1;
525
}
526
+ if (sev_features && !sev_es_enabled()) {
527
+ error_setg(errp,
528
+ "%s: SEV features require either SEV-ES or SEV-SNP to be enabled",
529
+ __func__);
530
+ return -1;
531
+ }
532
if (sev_features & ~sev_common->supported_sev_features) {
533
error_setg(errp,
534
"%s: VMSA contains unsupported sev_features: %lX, "