You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Apr 15, 2022. It is now read-only.
The docs for the 'ok' command are minimal but naively I'd expect it to tell me whether the machine I'm using is correctly setup for use of SEV.
On a Rome machine I get
$ sevctl ok
[ PASS ] - AMD CPU
[ PASS ] - Microcode support
[ PASS ] - Secure Memory Encryption (SME)
[ PASS ] - Secure Encrypted Virtualization (SEV)
[ PASS ] - Encrypted State (SEV-ES)
[ FAIL ] - Secure Nested Paging (SEV-SNP)
[ SKIP ] - VM Permission Levels
[ SKIP ] - Number of VMPLs
[ PASS ] - Physical address bit reduction: 47
[ PASS ] - C-bit location: 47
[ PASS ] - Number of encrypted guests supported simultaneously: 509
[ PASS ] - Minimum ASID value for SEV-enabled, SEV-ES disabled guest: 10
[ PASS ] - SEV enabled in KVM: enabled
[ PASS ] - Reading /dev/sev: /dev/sev readable
[ PASS ] - Writing /dev/sev: /dev/sev writable
[ PASS ] - Page flush MSR
[ PASS ] - KVM supported: API version: 12
[ PASS ] - Memlock resource limit: Soft: 65536 | Hard: 65536
error: One or more tests in sevctl-ok reported a failure
caused by: invalid data
This FAIL reported against SEV-SNP is inappropriate given this hardware is not expected to have SEV-SNP support.
I can use the specific sub command sevctl ok es and it'll skip the SNP checks, but IMHO it should not be necessary to do that. The default behaviour with no subcommand should be to report correctly based on whatever generation of SEV hardware is present.
The text was updated successfully, but these errors were encountered:
The docs for the 'ok' command are minimal but naively I'd expect it to tell me whether the machine I'm using is correctly setup for use of SEV.
On a Rome machine I get
This
FAIL
reported against SEV-SNP is inappropriate given this hardware is not expected to have SEV-SNP support.I can use the specific sub command
sevctl ok es
and it'll skip the SNP checks, but IMHO it should not be necessary to do that. The default behaviour with no subcommand should be to report correctly based on whatever generation of SEV hardware is present.The text was updated successfully, but these errors were encountered: