[PATCH pve-docs 7/7] sev: Describe VCEK retieval

[Christian Ludwig <christian_ludwig@genua.de>]

[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]

Describe where to find information in the API to retrieve the VCEK from
AMD's Key Distribution Server.

Signed-off-by: Christian Ludwig <christian_ludwig@genua.de>
---
 qm.adoc | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/qm.adoc b/qm.adoc
index 37950fc..54b3d42 100644
--- a/qm.adoc
+++ b/qm.adoc
@@ -856,6 +856,19 @@ Y
 The number of ASIDs gives the maximum number of confidential guests for each
 type that can run in parallel.
 
+{pve} probes the host's Secure Processor at boot and exposes the data that is
+needed to attest a confidential guest through the API:
+
+----
+# pvesh get /nodes/{node}/capabilities/qemu/sev
+----
+
+This reports the chip unique ID and the reported TCB security patch levels.
+Together they identify the Versioned Chip Endorsement Key (VCEK) that the
+firmware uses to sign attestation reports on this host. A remote attestation
+service can use this information to fetch the matching certificate from AMD's
+Key Distribution Service.
+
 *Guest Requirements:*
 
 * edk2-OVMF
-- 
2.34.1