From ef7b0a264936d1a8ee2b8c5467baae17e912c83c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20L=C3=B3pez?= Date: Mon, 6 Jul 2026 15:09:48 +0200 Subject: [PATCH] verify: sev: check FMC field in TCB MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verify the FMC field within the reported TCB just like it is done with other fields. The FMC field is only present for Turin and newer models. Signed-off-by: Carlos López --- src/sev.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/sev.rs b/src/sev.rs index d52294c..126c5f0 100644 --- a/src/sev.rs +++ b/src/sev.rs @@ -17,6 +17,7 @@ enum SnpOid { Tee, Snp, Ucode, + Fmc, HwId, } @@ -27,6 +28,7 @@ impl SnpOid { SnpOid::Tee => oid!(1.3.6.1.4.1.3704.1.3.2), SnpOid::Snp => oid!(1.3.6.1.4.1.3704.1.3.3), SnpOid::Ucode => oid!(1.3.6.1.4.1.3704.1.3.8), + SnpOid::Fmc => oid!(1.3.6.1.4.1.3704.1.3.9), SnpOid::HwId => oid!(1.3.6.1.4.1.3704.1.4), } } @@ -223,6 +225,20 @@ fn verify_tcb(vcek: &Certificate, report: &AttestationReport, opts: &VerifyOptio } } + if let Some(fmc) = report.reported_tcb.fmc { + if let Some(ext) = extensions.get(&SnpOid::Fmc.oid()) { + if !check_cert_extension(ext, &fmc.to_le_bytes()) { + return Err(anyhow::anyhow!( + "TCB FMC mismatch: report={} vs certificate", + fmc + )); + } + if !opts.quiet { + println!("TCB FMC matches ({})", fmc); + } + } + } + if let Some(ext) = extensions.get(&SnpOid::HwId.oid()) { if !check_cert_extension(ext, &report.chip_id) { return Err(anyhow::anyhow!("Chip ID mismatch between report and VCEK"));