Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Jarkko Sakkinen]

On Thu, Oct 22, 2026 at 03:51:33PM -0300, Jason Gunthorpe wrote:
> On Thu, Oct 22, 2026 at 07:24:57AM -0400, Mimi Zohar wrote:
> > > Isn't the hypervisor what we are doing now? I mean multiple extension
> > > originators share the same register and eventually the same log. Or do
> > > you suggest to go even further having a "generic_registerX" exposed for
> > > every hw implementation allowing the user to have full abstraction?
> > > The "generic_registerX" would be always alias to something hw specific,
> > > like RTMR2 for example of TDX.
> > 
> > I definitely prefer the latter, as everything continues to work as is with
> > minimal, if any, change.
> > 
> > AI's wording:
> > • The Virtual Mapping: The [attestation] subsystem exposes "Virtual RTMRs"
> > (vRTMRs) internally to the kernel.
> > 
> > • IMA's Dedicated Lane: The kernel config routes IMA to vRTMR_IMA.
> 
> I was thinking something similar too
> 
> I called this "PCR policy" in my previous posting, but in-kernel I
> would expect something like IMA to request the "IMA PCR" from the
> current attestation policy.
> 
> This could be a locality 0 TPM PCR, a locality 2 PCR for a DRTM
> launch, a TDX RTMR, etc. It keeps the layout in one place, and lets
> the multiplexor steer it to different hardware.

5 Authenticated hibernate [1]

This is on the table at least.

> 
> The policy would outline all the in-kernel users, and probably provide
> some how give a recommendation to userspace like 'systemd log goes
> here'
> 
> Jason

[1] https://lore.kernel.org/linux-integrity/20261008132532.1155166-1-matthewg@xxxxxxxxxx/

Br, Jarkko