From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 2075B1FF0AF for ; Thu, 24 Sep 2026 16:23:53 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id B45D521779; Thu, 24 Sep 2026 16:23:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1790259248; bh=lT+kNh9RmtuusERHZBbgS8QuK4nf80DZFIcwh+ZQnSM=; h=Date:From:To:Subject:References:In-Reply-To:From; b=NraF6/1gmBaji5M701eqsY/Slo2fofWsis430ODos2exHrJhYtEZBJLmV3fWpRY5V YqFzBc1v3NYj42R02ts+C/oXFAVzs8A3VrrptFRwUqdpiKyrpqDS5o61tfJu1VPnxU Qd2WrqmcKdlcKXSAe8y4uxZ+r+sqDzDIow9M5nmOM/SUl9fE1a5CmwfSjxKA2UXdgZ +ILSPB66F1LpxAuqiwx2yS0YtkMQH2bZOn/o7roASOvD+mb2h15G1vpX+lwiijgq0m 6oHkmQ1eVG2M7lz7DcEZ9+pXLdVJfXiy58o1JaUt9Bwzzi4pqEGXaTvkHK8iinMzba AxtzPCm962h/Q== Date: Thu, 24 Sep 2026 16:14:07 +0200 From: Christian Ludwig To: Subject: [PATCH qemu-server 4/7] api: add endpoint for SEV attestation data Message-ID: References: MIME-Version: 1.0 In-Reply-To: X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta09.win.genua.de (10.208.16.109) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----150F01354C1E3A34B7ABE3BD679DEE5E" X-SPAM-LEVEL: Spam detection results: 0 AWL 0.114 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: DZ355VCN2L4IYVBIUKLYD6TLGSSDIL6D X-Message-ID-Hash: DZ355VCN2L4IYVBIUKLYD6TLGSSDIL6D X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ------150F01354C1E3A34B7ABE3BD679DEE5E Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Expose the SEV chip ID and the raw reported SNP TCB security patch levels collected by query-machine-capabilities, so that a remote attestation client can construct the AMD KDS URL for this host's VCEK certificate. If query-machine-capabilities has not run yet, report no data instead of failing the request. Signed-off-by: Christian Ludwig --- src/PVE/API2/Qemu/Makefile | 2 +- src/PVE/API2/Qemu/Sev.pm | 63 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 src/PVE/API2/Qemu/Sev.pm diff --git a/src/PVE/API2/Qemu/Makefile b/src/PVE/API2/Qemu/Makefile index c348af75..12821bb0 100644 --- a/src/PVE/API2/Qemu/Makefile +++ b/src/PVE/API2/Qemu/Makefile @@ -2,7 +2,7 @@ DESTDIR= PREFIX=/usr PERLDIR=$(PREFIX)/share/perl5 -SOURCES=Agent.pm CPU.pm CPUFlags.pm HMPPerms.pm Machine.pm +SOURCES=Agent.pm CPU.pm CPUFlags.pm HMPPerms.pm Machine.pm Sev.pm .PHONY: install install: diff --git a/src/PVE/API2/Qemu/Sev.pm b/src/PVE/API2/Qemu/Sev.pm new file mode 100644 index 00000000..7f8ce9d7 --- /dev/null +++ b/src/PVE/API2/Qemu/Sev.pm @@ -0,0 +1,63 @@ +package PVE::API2::Qemu::Sev; + +use strict; +use warnings; + +use PVE::JSONSchema qw(get_standard_option); +use PVE::RESTHandler; + +use PVE::QemuServer::CPUConfig; + +use base qw(PVE::RESTHandler); + +my $sev_status_properties = { + 'sev-chip-id' => { + type => 'string', + default => '', + description => "Hex-encoded SEV chip unique ID." + . " Empty if unavailable.", + }, + 'sev-snp-tcb-version' => { + type => 'string', + default => '', + description => "Hex-encoded raw reported SNP TCB version." + . " Empty if unavailable.", + }, +}; + +__PACKAGE__->register_method({ + name => 'index', + path => '', + method => 'GET', + proxyto => 'node', + description => "Get this node's SEV chip identity and reported SNP TCB.", + permissions => { + check => ['perm', '/nodes/{node}', ['Sys.Audit']], + }, + parameters => { + additionalProperties => 0, + properties => { + node => get_standard_option('pve-node'), + }, + }, + returns => { + type => 'object', + properties => $sev_status_properties, + }, + code => sub { + my ($param) = @_; + + # may not have probed yet (e.g. early boot); treat as no data, not an error + my $hw_caps = eval { PVE::QemuServer::CPUConfig::get_hw_capabilities() }; + my $sev = $hw_caps->{'amd-sev'} // {}; + + my $res = {}; + for my $key (keys %$sev_status_properties) { + $res->{$key} = $sev->{$key} // $sev_status_properties->{$key}->{default}; + } + + return $res; + }, +}); + +1; -- 2.34.1 ------150F01354C1E3A34B7ABE3BD679DEE5E--