Hi all, SEV-ES and SEV-SNP attestation require a copy of the initial VMSA to validate the launch measurement. For developers dipping their toe into SEV-* work, the easiest way to get sample VMSA data for their machine is to grab it from a running VM.
There's two techniques I've seen for that: patch some printing into kernel __sev_launch_update_vmsa, or use systemtap like danpb's script here: https://gitlab.com/berrange/libvirt/-/blob/lgtm/scripts/sev-vmsa.stp Seems like this could be friendlier though. I'd like to work on this if others agree. Some ideas I've seen mentioned in passing: - debugfs entry in /sys/kernel/debug/kvm/.../vcpuX/ - new KVM ioctl - something with tracepoints - some kind of dump in dmesg that doesn't require a patch Thoughts? Thanks, Cole
