Expose the SEV chip ID and the raw reported SNP TCB security patch
levels collected by query-machine-capabilities, so that a remote
attestation client can construct the AMD KDS URL for this host's VCEK
certificate.

If query-machine-capabilities has not run yet, report no data instead
of failing the request.

Signed-off-by: Christian Ludwig <christian_ludwig@genua.de>
---
 src/PVE/API2/Qemu/Makefile |  2 +-
 src/PVE/API2/Qemu/Sev.pm   | 63 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 src/PVE/API2/Qemu/Sev.pm

diff --git a/src/PVE/API2/Qemu/Makefile b/src/PVE/API2/Qemu/Makefile
index c348af75..12821bb0 100644
--- a/src/PVE/API2/Qemu/Makefile
+++ b/src/PVE/API2/Qemu/Makefile
@@ -2,7 +2,7 @@ DESTDIR=
 PREFIX=/usr
 PERLDIR=$(PREFIX)/share/perl5
 
-SOURCES=Agent.pm CPU.pm CPUFlags.pm HMPPerms.pm Machine.pm
+SOURCES=Agent.pm CPU.pm CPUFlags.pm HMPPerms.pm Machine.pm Sev.pm
 
 .PHONY: install
 install:
diff --git a/src/PVE/API2/Qemu/Sev.pm b/src/PVE/API2/Qemu/Sev.pm
new file mode 100644
index 00000000..7f8ce9d7
--- /dev/null
+++ b/src/PVE/API2/Qemu/Sev.pm
@@ -0,0 +1,63 @@
+package PVE::API2::Qemu::Sev;
+
+use strict;
+use warnings;
+
+use PVE::JSONSchema qw(get_standard_option);
+use PVE::RESTHandler;
+
+use PVE::QemuServer::CPUConfig;
+
+use base qw(PVE::RESTHandler);
+
+my $sev_status_properties = {
+    'sev-chip-id' => {
+        type => 'string',
+        default => '',
+        description => "Hex-encoded SEV chip unique ID."
+            . " Empty if unavailable.",
+    },
+    'sev-snp-tcb-version' => {
+        type => 'string',
+        default => '',
+        description => "Hex-encoded raw reported SNP TCB version."
+	    . " Empty if unavailable.",
+    },
+};
+
+__PACKAGE__->register_method({
+    name => 'index',
+    path => '',
+    method => 'GET',
+    proxyto => 'node',
+    description => "Get this node's SEV chip identity and reported SNP TCB.",
+    permissions => {
+        check => ['perm', '/nodes/{node}', ['Sys.Audit']],
+    },
+    parameters => {
+        additionalProperties => 0,
+        properties => {
+            node => get_standard_option('pve-node'),
+        },
+    },
+    returns => {
+        type => 'object',
+        properties => $sev_status_properties,
+    },
+    code => sub {
+        my ($param) = @_;
+
+        # may not have probed yet (e.g. early boot); treat as no data, not an error
+        my $hw_caps = eval { PVE::QemuServer::CPUConfig::get_hw_capabilities() };
+        my $sev = $hw_caps->{'amd-sev'} // {};
+
+        my $res = {};
+        for my $key (keys %$sev_status_properties) {
+            $res->{$key} = $sev->{$key} // $sev_status_properties->{$key}->{default};
+        }
+
+        return $res;
+    },
+});
+
+1;
-- 
2.34.1