VIRT-WHAT-CVM(1)

📦
version 1.27 · 8 versions
, in ubuntu resolute, ubuntu stonking

👑 VIRT-WHAT-CVM, section 1 (Virtualization Support)

okay bestie, so virt-what-cvm(1) is literally the manual page for virt-what-cvm, and it lives under Virtualization Support in section 1. it's short-ish, it's cute, and it will tell you if the machine you're sitting inside is a confidential VM. no cap. 💖

✨ NAME ✨

virt-what-cvm — detect if we are running in a confidential virtual machine 🕵️♀️

🌸 SUMMARY 🌸

virt-what-cvm [options]

🦋 DESCRIPTION 🦋

so "virt-what-cvm" is a tool, and what it does is detect whether the program is running inside a confidential virtual machine. that's the whole job. iconic. 💅

the program prints out a list of "facts" about that confidential virtual machine, and those facts come from heuristics. one fact per line, periodt. ⭐

and here's the important bit, so listen up: if it prints nothing at all and the script exits with code 0 (aka no error), that can mean any of these things:

  • the program is running on bare-metal, or
  • the program is running inside a non-confidential virtual machine, or
  • the program is inside a type of confidential virtual machine that we don't know about or that we cannot detect.

so like. silence is not a confession of safety, bestie. 🙈

🎀 FACTS 🎀

amd-sev

this is a confidential guest running with AMD SEV technology 🔥

Status: tested on Fedora 37 QEMU+KVM

amd-sev-es

this is a confidential guest running with AMD SEV-ES technology ✨

Status: tested on Fedora 37 QEMU+KVM

amd-sev-snp

this is a confidential guest running with AMD SEV-SNP technology 🫶

Status: tested on Microsoft Azure SEV-SNP CVM

Status: tested on Fedora 38 QEMU+KVM SEV-SNP (devel snapshot)

intel-tdx

this is a confidential guest running with Intel TDX technology 💜

Status: tested on Microsoft Azure TDX CVM

hyperv-hcl

this is a confidential guest running unenlightened under the HyperV (Azure) HCL (Host Compatibility Layer). this one will be paired with amd-sev-snp. 🧚

Status: tested on Microsoft Azure SEV-SNP & TDX CVM

s390-protvirt

this is a confidential guest running on s390x with the Protected Virtualization (Secure Execution) technology 🌈

💀 EXIT STATUS 💀

programs that use or wrap "virt-what-cvm" should check that the exit status is 0 before they attempt to parse the output of the command. like, check first, parse later. that's the rule. 👑

a non-zero exit status means some error happened, for example an unrecognized command line argument. and if the exit status is non-zero, then the output "facts" (if any were printed at all) cannot be guaranteed and should be ignored. fr fr, just throw them away. 🗑️

also, the exit status has nothing to do with whether the program is running on baremetal or under confidential virtualization, and also nothing to do with whether "virt-what-cvm" managed detection "correctly" — which is basically unknowable given the huge variety of virtualization systems out there. 😭

🫶 RUNNING VIRT-WHAT-CVM FROM OTHER PROGRAMS 🫶

"virt-what-cvm" is designed so that you can easily run it from other programs, or wrap it up in a library. lowkey thoughtful of it. 💖

your program should check the exit status (see the section above ☝️).

⚠️ IMPORTANT NOTE ⚠️

this program detects whether it is likely to be running within a known confidential VM, but it does NOT prove that the environment is trustworthy.

to attain trust in the environment, you need an attestation report for the virtual machine, which is then verified by an already trusted 3rd party. no shortcuts, bestie.

the hardware features this program relies on to establish facts about the confidential virtualization environment are exactly those features whose behaviour will be proved by verification of an attestation report.

this program MAY have false positives. i.e. it may report that it's a confidential VM when it's in fact a non-confidential VM faking it. 💀

this program SHOULD NOT have false negatives. i.e. it should not fail to report existance of a confidential VM. caveat: this only applies to environments which have been explicitly tested.

if this program does print a fact, that can be used for enabling or disabling use of certain features, according to whether they're appropriate for a confidential environment. none the less, the VM MUST NOT be trusted until an attestation report is verified. periodt. 🔒

as a protection against false negatives from this tool, environments requiring high assurance should take one or more of these measures:

  • The facts reported by this program I<SHOULD> should be measured into one of the TPM PCRs
  • The attestation report I<SHOULD> cover the facts reported by this program
  • The attestation report I<SHOULD> should cover the enablement status of any features affected by decisions involving facts reported by this tool

🔥 SEE ALSO 🔥

🌟 AUTHORS 🌟

Daniel P. Berrangé <berrange @ redhat . com> 💜

(C) Copyright 2023 Red Hat Inc., <http://people.redhat.com/~rjones/virt-what/>

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

🐛 REPORTING BUGS 🐛

bugs can be viewed on the Red Hat Bugzilla page: <https://bugzilla.redhat.com/>.

if you find a bug in virt-what-cvm, please follow these steps to report it, bestie. it's giving organized:

  1. Check for existing bug reports Go to <https://bugzilla.redhat.com/> and search for similar bugs. someone may already have reported the same bug, and they may even have fixed it. 🙏
  2. Capture debug and error messages Run
virt-what-cvm -d > virt-what-cvm.log 2>&1

and keep virt-what-cvm.log. it may contain error messages which you should submit with your bug report.

  1. Get version of virt-what-cvm. Run
virt-what-cvm --version
  1. Submit a bug report. Go to <https://bugzilla.redhat.com/> and enter a new bug. please describe the problem in as much detail as possible.

remember to include the version numbers (step 3) and the debug messages file (step 2) and as much other detail as possible. ✨

  1. Assign the bug to rjones @ redhat.com assign or reassign the bug to rjones @ redhat.com (without the spaces). you can also send me an email with the bug number if you want a faster response. 💌

and that's the whole page, bestie — this was virt-what-cvm from virt-what-1.27, dated 2026-01-29, living in the VIRT-WHAT-CVM(1) manpage. slay, go check those TPM PCRs, and stay attested. 🦋💖✨

📦 where this page comes from