From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 19A4E1FF0AF for ; Thu, 24 Sep 2026 16:23:09 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 0C637216A3; Thu, 24 Sep 2026 16:23:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=genua.de; s=202307; t=1790259242; bh=zV4Ym7b09Z8MnuHUhUbZm6bbbBEmzHZuAI8j8KVHDNA=; h=Date:From:To:Subject:From; b=CAxbpElBnGawKOi2+VXYBxw0FNsxyr8pxk74FsEBAxKzcY+IrMcJejST/RdPXdAuW w5hJg+JdMLpq5YJD00MFFZMl0RL+6/5B3hloJY2L+1VZgrn2lExtMNDSSCb3Y5bHfP ab4VXWgQlBexh5rEiFnssA7/ZOZrmfAzuI2cj0C7vU3hRc/wA72d8pZ4LBlJVNHuXa KSXjlAKF5uytQNiZ8olzPtXwf9uRI+87PGROE4WM8DfY7D7yEivpwXNRRPNxb0/hqn mnBZTJ8j+gtmSKV+swUdyjyRekwwN+WqfiWPQe/+x8pqRG2LalEoTgVYmIjL60pNyB LUl8ZgvpMohjQ== Date: Thu, 24 Sep 2026 16:14:01 +0200 From: Christian Ludwig To: Subject: [PATCH 0/7] SEV: Expose chip ID and reported TCB versions Message-ID: MIME-Version: 1.0 X-Originating-IP: [192.168.217.185] X-ClientProxiedBy: kch1-mta08.win.genua.de (10.208.16.108) To kch1-mta07.win.genua.de (10.208.16.107) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----8C805C19DA0604EE7BC2C5EAC8664621" X-SPAM-LEVEL: Spam detection results: 0 AWL 0.127 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record UNPARSEABLE_RELAY 0.001 Informational: message has unparseable relay lines Message-ID-Hash: MRFVCZ7H23EEO4WQXOENFDHUTBN2VYCY X-Message-ID-Hash: MRFVCZ7H23EEO4WQXOENFDHUTBN2VYCY X-MailFrom: christian_ludwig@genua.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ------8C805C19DA0604EE7BC2C5EAC8664621 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline Hi, the SEV attestation report is signed with a private key that is unique to each machine. A remote attester needs to obtain the public key (VCEK) wrapped in a certificate from AMD's Key Distribution Service (KDS). The remote attester needs the ChipId and the reported TCB version, along with some CPUID information to ask the KDS for the correct certificate. All of the information is part of newer attestation report revisions. The remote attester can obtain the certificate in-band during the attestation process. But in some scenarios it can be beneficial to know the exact VM host during the attestation process already. For private cloud environments that allows attestation policies that pin VMs to a set of known hosts. This series exposes the SEV-SNP ChipId, the raw reported TCB versions and the missing CPUID information through the API. That information can be used to obtain the VCEK certificate out-of-band prior to attestation. Tests and feedback is very welcome. - Christian ------8C805C19DA0604EE7BC2C5EAC8664621--