target/i386: SEV: Refactor check_sev_features()
Refactor check_sev_features() to consolidate SEV-SNP checks to a single if block. This is also helpful when adding checks for future SEV features. While at it, move the comment about the checks being done outside of the function body and expand it to describe what this function does. Update error_setg() invocations to use a consistent format. No functional change intended. Suggested-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://lore.kernel.org/r/cae04d88adfbcdc2997e518475f3b89091adf8a9.1779281646.git.naveen@kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Naveen N Rao (AMD) committed
May 20, 2026 at 18:58 UTC
feed8bdfdc1a292fa2b6fe993cb5a9e8f2190e1f
1 file changed
+36
-31
target/i386/sev.c
+36
-31
@@ -507,40 +507,22 @@ static void sev_apply_cpu_context(CPUState *cpu)
507
}
508
}
509
510
+/*
511
+ * Ensure SEV_FEATURES is configured for correct SEV hardware and that
512
+ * the requested features are supported. In addition, ensure feature
513
+ * dependencies are satisfied (allow tsc-frequency only if secure-tsc
514
+ * is also enabled, as an example).
515
+ */
516
static int check_sev_features(SevCommonState *sev_common, uint64_t sev_features,
517
Error **errp)
518
{
513
- /*
514
- * Ensure SEV_FEATURES is configured for correct SEV hardware and that
515
- * the requested features are supported. If SEV-SNP is enabled then
516
- * that feature must be enabled, otherwise it must be cleared.
517
- */
518
- if (sev_snp_enabled() && !(sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) {
519
- error_setg(
520
- errp,
521
- "%s: SEV_SNP is enabled but is not enabled in VMSA sev_features",
522
- __func__);
523
- return -1;
524
- } else if (!sev_snp_enabled() &&
525
- (sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) {
526
- error_setg(
527
- errp,
528
- "%s: SEV_SNP is not enabled but is enabled in VMSA sev_features",
529
- __func__);
530
- return -1;
531
- }
532
- if (sev_features && sev_es_enabled() && !sev_snp_enabled()) {
533
- error_setg(errp,
534
- "%s: SEV features are not supported with SEV-ES at this time",
535
- __func__);
536
- return -1;
537
- }
519
if (sev_features && !sev_es_enabled()) {
520
error_setg(errp,
521
"%s: SEV features require either SEV-ES or SEV-SNP to be enabled",
522
__func__);
523
return -1;
524
}
525
+
526
if (sev_features & ~sev_common->supported_sev_features) {
527
error_setg(errp,
528
"%s: VMSA contains unsupported sev_features: %lX, "
@@ -548,13 +530,36 @@ static int check_sev_features(SevCommonState *sev_common, uint64_t sev_features,
530
__func__, sev_features, sev_common->supported_sev_features);
531
return -1;
532
}
551
- if (sev_snp_enabled() && SEV_SNP_GUEST(sev_common)->tsc_khz &&
552
- !(sev_features & SVM_SEV_FEAT_SECURE_TSC)) {
553
- error_setg(errp,
554
- "%s: TSC frequency can only be set if Secure TSC is enabled",
555
- __func__);
556
- return -1;
533
+
534
+ if (sev_snp_enabled()) {
535
+ if (!(sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) {
536
+ error_setg(errp,
537
+ "%s: SEV_SNP is enabled but is not enabled in VMSA sev_features",
538
+ __func__);
539
+ return -1;
540
+ }
541
+ if (SEV_SNP_GUEST(sev_common)->tsc_khz &&
542
+ !(sev_features & SVM_SEV_FEAT_SECURE_TSC)) {
543
+ error_setg(errp,
544
+ "%s: TSC frequency can only be set if Secure TSC is enabled",
545
+ __func__);
546
+ return -1;
547
+ }
548
+ } else {
549
+ if (sev_features && sev_es_enabled()) {
550
+ error_setg(errp,
551
+ "%s: SEV features are not supported with SEV-ES at this time",
552
+ __func__);
553
+ return -1;
554
+ }
555
+ if (sev_features & SVM_SEV_FEAT_SNP_ACTIVE) {
556
+ error_setg(errp,
557
+ "%s: SEV_SNP is not enabled but is enabled in VMSA sev_features",
558
+ __func__);
559
+ return -1;
560
+ }
561
}
562
+
563
return 0;
564
}
565