Re: [PATCH RFC 0/3] security: ima: support TSM measurement registers

[Roberto Sassu]

On Thu, 2026-10-01 at 13:27 +0200, Roberto Sassu wrote:
> On Wed, 2026-09-30 at 14:43 +0100, Yeoreum Yun wrote:
> > Confidential computing guests without a TPM can use TSM measurement
> > registers to record IMA measurement digests instead of TPM PCRs.

+ Gong Ruiqi, of course.

Roberto

> Hi Yeoreum
> 
> a similar patch set has been sent to the linux-integrity mailing list:
> 
> https://lore.kernel.org/linux-integrity/20250630125928.765285-1-gongruiqi1@xxxxxxxxxx/
> 
> Could you please work with Gong Ruiqi to have a unified proposal?
> 
> Thanks
> 
> Roberto
> 
> > This series introduces in-kernel interfaces for accessing TSM
> > measurement registers, abstracts IMA's measurement-register operations,
> > and adds a TSM backend for Intel TDX and Arm CCA.
> > 
> > The following mappings between TPM PCR indices and TSM measurement
> > registers are defined for Intel TDX [0] and proposed for Arm CCA [1]:
> > 
> >   TPM PCR index | Intel TDX register | Arm CCA register
> >   --------------+--------------------+-----------------
> >   0             | MRTD               | RIM
> >   1, 7          | RTMR[0]            | REM[0]
> >   2-6           | RTMR[1]            | REM[1]
> >   8-15          | RTMR[2]            | REM[2]
> > 
> > These mappings allow IMA to translate PCR indices into the corresponding
> > TSM measurement registers.
> > 
> > The TPM backend remains preferred when it is available at IMA
> > initialization. Otherwise, IMA falls back to a supported TSM backend.
> > Only one backend is selected; IMA measurements are not extended to both
> > TPM PCRs and TSM measurement registers.
> > 
> > The attestation proccess for guest with TSM measurement register will
> > be done with Confidential Compute Event Log (CCEL) which is exported by
> > /sys/firmware/acpi/tables/data/CCEL. Here is brief process in arm64:
> > 
> >   Verifier                 Realm guest              RMM / Platform
> >      |                         |                           |
> >      |--- Challenge (nonce) -->|                           |
> >      |                         |--- Request token -------->|
> >      |                         |    with challenge         |
> >      |                         |                           |
> >      |                         |<-- CCA token T -----------|
> >      |<-- CCA token T ---------|                           |
> >      |<-- CCEL event log ------|                           |
> >      |<-- IMA measurement log -|                           |
> >      |                         |                           |
> >  Verify token T:               |                           |
> >   - signatures                 |                           |
> >   - Platform/Realm             |                           |
> >     token binding              |                           |
> >   - challenge freshness        |                           |
> >   - platform/RIM policy        |                           |
> >   - verify measurement logs    |                           |
> >      |                         |                           |
> >      | ----ACCEPT / REJECT---->|                           |
> > 
> > This patch based on arm-cca-mr series [3].
> > 
> > Link: [0] https://uefi.org/specs/UEFI/2.11/38_Confidential_Computing.html#intel-trust-domain-extension
> > Link: [1] https://github.com/tianocore/edk2/issues/11383
> > Link: [2] https://github.com/tianocore/edk2/issues/11384
> > Link: [3] https://lore.kernel.org/all/20260929-arm_cca_mr-v2-0-1d98bba187fd@xxxxxxx/
> > 
> > ---
> > Yeoreum Yun (3):
> >       virt: coco: introduce tsm_default_tm() and tsm_mr_read()/write()
> >       security: IMA: introduce ima_mr structure
> >       security: IMA: use TSM measurement registers
> > 
> >  drivers/virt/coco/guest/tsm-mr.c          | 159 +++++++++++++---
> >  include/linux/tsm-mr.h                    |  26 +++
> >  security/integrity/ima/Makefile           |   3 +-
> >  security/integrity/ima/ima.h              |   7 +-
> >  security/integrity/ima/ima_api.c          |   4 +-
> >  security/integrity/ima/ima_crypto.c       | 137 +++++---------
> >  security/integrity/ima/ima_fs.c           |  16 +-
> >  security/integrity/ima/ima_init.c         |   7 +-
> >  security/integrity/ima/ima_mr.c           |  48 +++++
> >  security/integrity/ima/ima_mr.h           |  76 ++++++++
> >  security/integrity/ima/ima_mr_tpm.c       | 155 ++++++++++++++++
> >  security/integrity/ima/ima_mr_tsm.c       | 290 ++++++++++++++++++++++++++++++
> >  security/integrity/ima/ima_queue.c        |  39 ++--
> >  security/integrity/ima/ima_template.c     |   4 +-
> >  security/integrity/ima/ima_template_lib.c |   2 +-
> >  15 files changed, 819 insertions(+), 154 deletions(-)
> > ---
> > base-commit: b561246f45174b7472c24b75358ea95bae72b7b8
> > change-id: 20260929-ima_tgx_integration_v2-1c54aeeaeaee
> > 
> > Best regards,