Describe where to find information in the API to retrieve the VCEK from AMD's Key Distribution Server. Signed-off-by: Christian Ludwig --- qm.adoc | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/qm.adoc b/qm.adoc index 37950fc..54b3d42 100644 --- a/qm.adoc +++ b/qm.adoc @@ -856,6 +856,19 @@ Y The number of ASIDs gives the maximum number of confidential guests for each type that can run in parallel. +{pve} probes the host's Secure Processor at boot and exposes the data that is +needed to attest a confidential guest through the API: + +---- +# pvesh get /nodes/{node}/capabilities/qemu/sev +---- + +This reports the chip unique ID and the reported TCB security patch levels. +Together they identify the Versioned Chip Endorsement Key (VCEK) that the +firmware uses to sign attestation reports on this host. A remote attestation +service can use this information to fetch the matching certificate from AMD's +Key Distribution Service. + *Guest Requirements:* * edk2-OVMF -- 2.34.1