Skip to content
This repository has been archived by the owner on Apr 15, 2022. It is now read-only.

'sevctl ok' should report problems relevant to the current host hardware as default behaviour #93

Open
berrange opened this issue Jan 5, 2022 · 0 comments

Comments

@berrange
Copy link

berrange commented Jan 5, 2022

The docs for the 'ok' command are minimal but naively I'd expect it to tell me whether the machine I'm using is correctly setup for use of SEV.

On a Rome machine I get

$ sevctl ok
[ PASS ] - AMD CPU
[ PASS ]   - Microcode support
[ PASS ]   - Secure Memory Encryption (SME)
[ PASS ]   - Secure Encrypted Virtualization (SEV)
[ PASS ]     - Encrypted State (SEV-ES)
[ FAIL ]     - Secure Nested Paging (SEV-SNP)
[ SKIP ]       - VM Permission Levels
[ SKIP ]         - Number of VMPLs
[ PASS ]     - Physical address bit reduction: 47
[ PASS ]     - C-bit location: 47
[ PASS ]     - Number of encrypted guests supported simultaneously: 509
[ PASS ]     - Minimum ASID value for SEV-enabled, SEV-ES disabled guest: 10
[ PASS ]     - SEV enabled in KVM: enabled
[ PASS ]     - Reading /dev/sev: /dev/sev readable
[ PASS ]     - Writing /dev/sev: /dev/sev writable
[ PASS ]   - Page flush MSR
[ PASS ] - KVM supported: API version: 12
[ PASS ] - Memlock resource limit: Soft: 65536 | Hard: 65536
error: One or more tests in sevctl-ok reported a failure
caused by: invalid data

This FAIL reported against SEV-SNP is inappropriate given this hardware is not expected to have SEV-SNP support.

I can use the specific sub command sevctl ok es and it'll skip the SNP checks, but IMHO it should not be necessary to do that. The default behaviour with no subcommand should be to report correctly based on whatever generation of SEV hardware is present.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant