SVSM: require SNP restricted injection

To maintain security of the SVSM, require that Restricted Injection is present in the SEV features in order to boot. Signed-off-by: Jon Lange <[email protected]>
coconut-svsm · Oct 24, 2024 · e869c83 · e869c83
1 parent b2dc667
commit e869c83
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/kernel/src/sev/status.rs b/kernel/src/sev/status.rs
@@ -163,10 +163,12 @@ pub fn sev_restricted_injection() -> bool {
 }
 
 pub fn sev_status_verify() {
-    let required = SEVStatusFlags::SEV | SEVStatusFlags::SEV_ES | SEVStatusFlags::SEV_SNP;
+    let required = SEVStatusFlags::SEV
+        | SEVStatusFlags::SEV_ES
+        | SEVStatusFlags::SEV_SNP
+        | SEVStatusFlags::REST_INJ;
     let supported = SEVStatusFlags::DBGSWP
         | SEVStatusFlags::VTOM
-        | SEVStatusFlags::REST_INJ
         | SEVStatusFlags::PREV_HOST_IBS
         | SEVStatusFlags::BTB_ISOLATION
         | SEVStatusFlags::SMT_PROT;