Hi,

the SEV attestation report is signed with a private key that is unique
to each machine. A remote attester needs to obtain the public key (VCEK)
wrapped in a certificate from AMD's Key Distribution Service (KDS). The
remote attester needs the ChipId and the reported TCB version, along
with some CPUID information to ask the KDS for the correct certificate.

All of the information is part of newer attestation report revisions.
The remote attester can obtain the certificate in-band during the
attestation process. But in some scenarios it can be beneficial to
know the exact VM host during the attestation process already. For
private cloud environments that allows attestation policies that pin VMs
to a set of known hosts.

This series exposes the SEV-SNP ChipId, the raw reported TCB versions
and the missing CPUID information through the API. That information can
be used to obtain the VCEK certificate out-of-band prior to attestation.

Tests and feedback is very welcome.


 - Christian