sevctl
sevctl copied to clipboard
'sevctl ok' should report problems relevant to the current host hardware as default behaviour
The docs for the 'ok' command are minimal but naively I'd expect it to tell me whether the machine I'm using is correctly setup for use of SEV.
On a Rome machine I get
$ sevctl ok
[ PASS ] - AMD CPU
[ PASS ] - Microcode support
[ PASS ] - Secure Memory Encryption (SME)
[ PASS ] - Secure Encrypted Virtualization (SEV)
[ PASS ] - Encrypted State (SEV-ES)
[ FAIL ] - Secure Nested Paging (SEV-SNP)
[ SKIP ] - VM Permission Levels
[ SKIP ] - Number of VMPLs
[ PASS ] - Physical address bit reduction: 47
[ PASS ] - C-bit location: 47
[ PASS ] - Number of encrypted guests supported simultaneously: 509
[ PASS ] - Minimum ASID value for SEV-enabled, SEV-ES disabled guest: 10
[ PASS ] - SEV enabled in KVM: enabled
[ PASS ] - Reading /dev/sev: /dev/sev readable
[ PASS ] - Writing /dev/sev: /dev/sev writable
[ PASS ] - Page flush MSR
[ PASS ] - KVM supported: API version: 12
[ PASS ] - Memlock resource limit: Soft: 65536 | Hard: 65536
error: One or more tests in sevctl-ok reported a failure
caused by: invalid data
This FAIL reported against SEV-SNP is inappropriate given this hardware is not expected to have SEV-SNP support.
I can use the specific sub command sevctl ok es and it'll skip the SNP checks, but IMHO it should not be necessary to do that. The default behaviour with no subcommand should be to report correctly based on whatever generation of SEV hardware is present.