On Thu, 2026-10-01 at 13:27 +0200, Roberto Sassu wrote: > On Wed, 2026-09-30 at 14:43 +0100, Yeoreum Yun wrote: > > Confidential computing guests without a TPM can use TSM measurement > > registers to record IMA measurement digests instead of TPM PCRs.
+ Gong Ruiqi, of course. Roberto > Hi Yeoreum > > a similar patch set has been sent to the linux-integrity mailing list: > > https://lore.kernel.org/linux-integrity/[email protected]/ > > Could you please work with Gong Ruiqi to have a unified proposal? > > Thanks > > Roberto > > > This series introduces in-kernel interfaces for accessing TSM > > measurement registers, abstracts IMA's measurement-register operations, > > and adds a TSM backend for Intel TDX and Arm CCA. > > > > The following mappings between TPM PCR indices and TSM measurement > > registers are defined for Intel TDX [0] and proposed for Arm CCA [1]: > > > > TPM PCR index | Intel TDX register | Arm CCA register > > --------------+--------------------+----------------- > > 0 | MRTD | RIM > > 1, 7 | RTMR[0] | REM[0] > > 2-6 | RTMR[1] | REM[1] > > 8-15 | RTMR[2] | REM[2] > > > > These mappings allow IMA to translate PCR indices into the corresponding > > TSM measurement registers. > > > > The TPM backend remains preferred when it is available at IMA > > initialization. Otherwise, IMA falls back to a supported TSM backend. > > Only one backend is selected; IMA measurements are not extended to both > > TPM PCRs and TSM measurement registers. > > > > The attestation proccess for guest with TSM measurement register will > > be done with Confidential Compute Event Log (CCEL) which is exported by > > /sys/firmware/acpi/tables/data/CCEL. Here is brief process in arm64: > > > > Verifier Realm guest RMM / Platform > > | | | > > |--- Challenge (nonce) -->| | > > | |--- Request token -------->| > > | | with challenge | > > | | | > > | |<-- CCA token T -----------| > > |<-- CCA token T ---------| | > > |<-- CCEL event log ------| | > > |<-- IMA measurement log -| | > > | | | > > Verify token T: | | > > - signatures | | > > - Platform/Realm | | > > token binding | | > > - challenge freshness | | > > - platform/RIM policy | | > > - verify measurement logs | | > > | | | > > | ----ACCEPT / REJECT---->| | > > > > This patch based on arm-cca-mr series [3]. > > > > Link: [0] > > https://uefi.org/specs/UEFI/2.11/38_Confidential_Computing.html#intel-trust-domain-extension > > Link: [1] https://github.com/tianocore/edk2/issues/11383 > > Link: [2] https://github.com/tianocore/edk2/issues/11384 > > Link: [3] > > https://lore.kernel.org/all/[email protected]/ > > > > --- > > Yeoreum Yun (3): > > virt: coco: introduce tsm_default_tm() and tsm_mr_read()/write() > > security: IMA: introduce ima_mr structure > > security: IMA: use TSM measurement registers > > > > drivers/virt/coco/guest/tsm-mr.c | 159 +++++++++++++--- > > include/linux/tsm-mr.h | 26 +++ > > security/integrity/ima/Makefile | 3 +- > > security/integrity/ima/ima.h | 7 +- > > security/integrity/ima/ima_api.c | 4 +- > > security/integrity/ima/ima_crypto.c | 137 +++++--------- > > security/integrity/ima/ima_fs.c | 16 +- > > security/integrity/ima/ima_init.c | 7 +- > > security/integrity/ima/ima_mr.c | 48 +++++ > > security/integrity/ima/ima_mr.h | 76 ++++++++ > > security/integrity/ima/ima_mr_tpm.c | 155 ++++++++++++++++ > > security/integrity/ima/ima_mr_tsm.c | 290 > > ++++++++++++++++++++++++++++++ > > security/integrity/ima/ima_queue.c | 39 ++-- > > security/integrity/ima/ima_template.c | 4 +- > > security/integrity/ima/ima_template_lib.c | 2 +- > > 15 files changed, 819 insertions(+), 154 deletions(-) > > --- > > base-commit: b561246f45174b7472c24b75358ea95bae72b7b8 > > change-id: 20260929-ima_tgx_integration_v2-1c54aeeaeaee > > > > Best regards,
