ok: add verbose option#187
Conversation
tylerfanelli
left a comment
tylerfanelli
left a comment
There was a problem hiding this comment.
Change LGTM, but the error messages shown here.
ERROR: One or more tests in snphost ok reported a failure
Error: One or more tests in snphost ok reported a failure
Are unnecessary now. Could you add a commit to this PR removing them?
DGonzalezVillal
left a comment
DGonzalezVillal
left a comment
There was a problem hiding this comment.
LGTM, please just add a sign-off to your commits and address Tyler comment above
… functionality Signed-off-by: Katherine Kin <kkin@amd.com>
Add --verbose flag that displays test results grouped by category descriptions, fix hints for failures, and a detected issues summary. Signed-off-by: Amanda Liem <aliem@amd.com> Signed-off-by: Katherine Kin <kkin@amd.com>
e5c15b7 to
708a832
Compare
Thanks for the feedback, I can revert the change on main.rs and keep the one in ok.rs to keep this PR cleaner. I had noticed when running other commands like I was initially thinking removing the logic from main would also make it so only a single error message show, but also in retrospect feel that that could be a bigger change that would require more comprehensive testing. Would love to hear your thoughts. |
Signed-off-by: Katherine Kin <kkin@amd.com>
708a832 to
8679c11
Compare
You could rework the subcommands to return some type of |
4 participants
Overview
Add output option to snphost ok command, where user can pass in json to get the snphost ok results in json format. This change is building on top of changes in this PR: #184. See additional discussion in #184 (comment).
The
--verboseflag groups test results by category (CPU Support, BIOS Configured, Platform Initialized, etc.) to help users quickly assess specific areas of system validation, as well as provide hints on how to address the failures. With the change in this MR, theokcommand can be run with no flags, and either--shortor--verbosebut not both.This PR also includes refactoring
run_test, so that it focuses solely on executing tests and building a result structure (Vec) and removes all output/rendering logic. This separation of concerns:Example outputs
sudo target/debug/snphost ok
sudo target/debug/snphost ok --verbose
=== CPU Support === [ PASS ] AMD CPU Checks CPU vendor string via CPUID is "AuthenticAMD" [ PASS ] Microcode support Verifies processor brand string contains "EPYC" (server-class CPU required) [ PASS ] Secure Memory Encryption (SME) Checks CPUID 0x8000001F EAX bit 0 for SME hardware support [ PASS ] Secure Encrypted Virtualization (SEV) Checks CPUID 0x8000001F EAX bit 1 for SEV hardware support [ PASS ] Encrypted State (SEV-ES) Checks CPUID 0x8000001F EAX bit 3 for SEV-ES hardware support [ PASS ] Secure Nested Paging (SEV-SNP) Checks CPUID 0x8000001F EAX bit 4 for SEV-SNP hardware support [ PASS ] VM Permission Levels Checks CPUID 0x8000001F EAX bit 5 for VMPL hardware support === CPU Info === [ PASS ] Number of VMPLs: 4 Reads CPUID 0x8000001F EBX bits 15:12 for VMPL count (expected: 4) [ PASS ] Physical address bit reduction: 6 Reads CPUID 0x8000001F EBX bits 11:6 for PA bit reduction value [ PASS ] C-bit location: 51 Reads CPUID 0x8000001F EBX bits 5:0 for encryption bit position in page tables [ PASS ] Number of encrypted guests supported simultaneously: 1006 Reads CPUID 0x8000001F ECX for maximum encrypted guest count [ PASS ] Minimum ASID value for SEV-enabled, SEV-ES disabled guest: 100 Reads CPUID 0x8000001F EDX for minimum SEV-only ASID value [ PASS ] Page flush MSR: DISABLED Checks CPUID 0x8000001F EAX bit 2 for page flush MSR optimization support === BIOS Configured === [ PASS ] SME: Enabled in MSR Reads MSR 0xC0010010 (SYSCFG) bit 23 to verify SME enabled at system level [ PASS ] SEV firmware version: 1.55 Queries /dev/sev PLATFORM_STATUS for firmware version (requires >= 1.51 for SNP) [ PASS ] SNP: Enabled in MSR Reads MSR 0xC0010010 (SYSCFG) bit 24 to verify SNP enabled at system level [ PASS ] RMP table addresses: 0xbf8d100000 - 0xc04d6fffff Reads MSRs 0xC0010132 and 0xC0010133 for RMP base/end addresses === Platform Initialized === [ PASS ] SEV-ES initialized Queries SEV platform status flags bit 8 for SEV-ES initialization [ PASS ] SEV initialized: Initialized, no guests running Queries SEV platform status state field (must be Initialized or Working) [ PASS ] SNP initialized Queries SNP_PLATFORM_STATUS state field = 1 (INIT state) [ PASS ] RMP table initialized Queries SNP platform status IS_RMP_INIT bit [ PASS ] /dev/sev readable Attempts to open /dev/sev device for reading [ PASS ] /dev/sev writable Attempts to open /dev/sev device for writing === KVM Config === [ PASS ] KVM supported: API version: 12 Opens /dev/kvm and queries KVM API version via ioctl [ PASS ] SEV enabled in KVM Reads /sys/module/kvm_amd/parameters/sev for "1" or "Y" [ PASS ] SEV-ES enabled in KVM Reads /sys/module/kvm_amd/parameters/sev_es for "1" or "Y" [ PASS ] SEV-SNP enabled in KVM Reads /sys/module/kvm_amd/parameters/sev_snp for "1" or "Y" === Compliance === [ FAIL ] Alias check Queries SNP platform status ALIAS_CHECK_COMPLETE bit (CVE-2024-21944 mitigation) Recommended: Update firmware/BIOS per AMD-SB-3015. Reboot required [ PASS ] Memlock resource limit: Soft: 8388608 | Hard: 8388608 Reads RLIMIT_MEMLOCK soft and hard limits via getrlimit syscall [ PASS ] Comparing TCB values: TCB versions match Platform TCB version: TCB Version: Microcode: 72 SNP: 23 TEE: 0 Boot Loader: 8 FMC: None Reported TCB version: TCB Version: Microcode: 72 SNP: 23 TEE: 0 Boot Loader: 8 FMC: None Compares platform_tcb_version with reported_tcb_version from SNP_PLATFORM_STATUS === DETECTED ISSUES === 1. Alias check [FAIL] Hint: Update firmware/BIOS per AMD-SB-3015. Reboot required ERROR: One or more tests in snphost ok reported a failure Error: One or more tests in snphost ok reported a failuretarget/debug/snphost ok
target/debug/snphost ok --verbose
=== CPU Support === [ PASS ] AMD CPU Checks CPU vendor string via CPUID is "AuthenticAMD" [ PASS ] Microcode support Verifies processor brand string contains "EPYC" (server-class CPU required) [ PASS ] Secure Memory Encryption (SME) Checks CPUID 0x8000001F EAX bit 0 for SME hardware support [ PASS ] Secure Encrypted Virtualization (SEV) Checks CPUID 0x8000001F EAX bit 1 for SEV hardware support [ PASS ] Encrypted State (SEV-ES) Checks CPUID 0x8000001F EAX bit 3 for SEV-ES hardware support [ PASS ] Secure Nested Paging (SEV-SNP) Checks CPUID 0x8000001F EAX bit 4 for SEV-SNP hardware support [ PASS ] VM Permission Levels Checks CPUID 0x8000001F EAX bit 5 for VMPL hardware support === CPU Info === [ PASS ] Number of VMPLs: 4 Reads CPUID 0x8000001F EBX bits 15:12 for VMPL count (expected: 4) [ PASS ] Physical address bit reduction: 6 Reads CPUID 0x8000001F EBX bits 11:6 for PA bit reduction value [ PASS ] C-bit location: 51 Reads CPUID 0x8000001F EBX bits 5:0 for encryption bit position in page tables [ PASS ] Number of encrypted guests supported simultaneously: 1006 Reads CPUID 0x8000001F ECX for maximum encrypted guest count [ PASS ] Minimum ASID value for SEV-enabled, SEV-ES disabled guest: 100 Reads CPUID 0x8000001F EDX for minimum SEV-only ASID value [ PASS ] Page flush MSR: DISABLED Checks CPUID 0x8000001F EAX bit 2 for page flush MSR optimization support === BIOS Configured === [ FAIL ] SME: MSR read failed: Error Reading MSR Reads MSR 0xC0010010 (SYSCFG) bit 23 to verify SME enabled at system level Recommended: Load MSR kernel module: sudo modprobe msr [ FAIL ] SEV firmware version: Failed to get SEV Platform Status unable to open /dev/sev Queries /dev/sev PLATFORM_STATUS for firmware version (requires >= 1.51 for SNP) Recommended: Run with sudo: sudo snphost ok [ FAIL ] SNP: MSR read failed: Error Reading MSR Reads MSR 0xC0010010 (SYSCFG) bit 24 to verify SNP enabled at system level Recommended: Load MSR kernel module: sudo modprobe msr === Platform Initialized === [ FAIL ] SEV-ES initialized: Failed to get SEV Platform Status unable to open /dev/sev Queries SEV platform status flags bit 8 for SEV-ES initialization Recommended: Run with sudo: sudo snphost ok [ FAIL ] SEV initialized: Failed to get SEV Platform Status unable to open /dev/sev Queries SEV platform status state field (must be Initialized or Working) Recommended: Run with sudo: sudo snphost ok [ FAIL ] SNP initialized: Failed to get SNP Platform status unable to open /dev/sev Queries SNP_PLATFORM_STATUS state field = 1 (INIT state) Recommended: Run with sudo: sudo snphost ok [ FAIL ] /dev/sev readable: Not readable: Permission denied (os error 13) Attempts to open /dev/sev device for reading Recommended: Run with sudo: sudo snphost ok [ FAIL ] /dev/sev writable: Not writable: Permission denied (os error 13) Attempts to open /dev/sev device for writing Recommended: Run with sudo: sudo snphost ok === KVM Config === [ FAIL ] KVM supported: Error reading /dev/kvm: (Permission denied (os error 13)) Opens /dev/kvm and queries KVM API version via ioctl Recommended: Run with sudo: sudo snphost ok === Compliance === [ PASS ] Memlock resource limit: Soft: 8388608 | Hard: 8388608 Reads RLIMIT_MEMLOCK soft and hard limits via getrlimit syscall [ FAIL ] Comparing TCB values: Failed to get SNP Platform status unable to open /dev/sev Compares platform_tcb_version with reported_tcb_version from SNP_PLATFORM_STATUS Recommended: Run with sudo: sudo snphost ok === DETECTED ISSUES === 1. SME [FAIL] Hint: Load MSR kernel module: sudo modprobe msr 2. SEV firmware version [FAIL] Hint: Run with sudo: sudo snphost ok 3. SEV-ES initialized [FAIL] Hint: Run with sudo: sudo snphost ok 4. SEV initialized [FAIL] Hint: Run with sudo: sudo snphost ok 5. SNP [FAIL] Hint: Load MSR kernel module: sudo modprobe msr 6. SNP initialized [FAIL] Hint: Run with sudo: sudo snphost ok 7. /dev/sev readable [FAIL] Hint: Run with sudo: sudo snphost ok 8. /dev/sev writable [FAIL] Hint: Run with sudo: sudo snphost ok 9. KVM supported [FAIL] Hint: Run with sudo: sudo snphost ok 10. Comparing TCB values [FAIL] Hint: Run with sudo: sudo snphost ok ERROR: One or more tests in snphost ok reported a failure Error: One or more tests in snphost ok reported a failure