Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[James Bottomley]

On Thu, 2026-10-22 at 16:23 -0300, Jason Gunthorpe wrote:
> On Thu, Oct 22, 2026 at 10:19:41PM +0300, Jarkko Sakkinen wrote:
> > On Thu, Oct 22, 2026 at 03:51:33PM -0300, Jason Gunthorpe wrote:
> > > On Thu, Oct 22, 2026 at 07:24:57AM -0400, Mimi Zohar wrote:
> > > > > Isn't the hypervisor what we are doing now? I mean multiple
> > > > > extension originators share the same register and eventually
> > > > > the same log. Or do you suggest to go even further having a
> > > > > "generic_registerX" exposed for every hw implementation
> > > > > allowing the user to have full abstraction?
> > > > > The "generic_registerX" would be always alias to something hw
> > > > > specific, like RTMR2 for example of TDX.
> > > > 
> > > > I definitely prefer the latter, as everything continues to work
> > > > as is with minimal, if any, change.
> > > > 
> > > > AI's wording:
> > > > • The Virtual Mapping: The [attestation] subsystem exposes
> > > > "Virtual RTMRs" (vRTMRs) internally to the kernel.
> > > > 
> > > > • IMA's Dedicated Lane: The kernel config routes IMA to
> > > > vRTMR_IMA.
> > > 
> > > I was thinking something similar too
> > > 
> > > I called this "PCR policy" in my previous posting, but in-kernel
> > > I would expect something like IMA to request the "IMA PCR" from
> > > the current attestation policy.
> > > 
> > > This could be a locality 0 TPM PCR, a locality 2 PCR for a DRTM
> > > launch, a TDX RTMR, etc. It keeps the layout in one place, and
> > > lets the multiplexor steer it to different hardware.
> > 
> > 5 Authenticated hibernate [1]
> > 
> > This is on the table at least.
> 
> Yeah, any in-kernel use of PCRs has to fit into the overall system
> policy. Like maybe you don't want to use PCR 5 if you have DRTM, or
> you want to do hibernation using an alternative ROT from TPM..

Right; for DRTM launch we'd absolutely use localities.  The PCR5 scheme
is just a poor man substitute for the fact that in non-DRTM launch on
x86 the localities get restricted to just 0 so we can't use them to
distinguish in-kernel from userspace use of the TPM.

Regards,

James