Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Jarkko Sakkinen]

On Thu, Oct 22, 2026 at 04:23:22PM -0300, Jason Gunthorpe wrote:
> On Thu, Oct 22, 2026 at 10:19:41PM +0300, Jarkko Sakkinen wrote:
> > On Thu, Oct 22, 2026 at 03:51:33PM -0300, Jason Gunthorpe wrote:
> > > On Thu, Oct 22, 2026 at 07:24:57AM -0400, Mimi Zohar wrote:
> > > > > Isn't the hypervisor what we are doing now? I mean multiple extension
> > > > > originators share the same register and eventually the same log. Or do
> > > > > you suggest to go even further having a "generic_registerX" exposed for
> > > > > every hw implementation allowing the user to have full abstraction?
> > > > > The "generic_registerX" would be always alias to something hw specific,
> > > > > like RTMR2 for example of TDX.
> > > > 
> > > > I definitely prefer the latter, as everything continues to work as is with
> > > > minimal, if any, change.
> > > > 
> > > > AI's wording:
> > > > • The Virtual Mapping: The [attestation] subsystem exposes "Virtual RTMRs"
> > > > (vRTMRs) internally to the kernel.
> > > > 
> > > > • IMA's Dedicated Lane: The kernel config routes IMA to vRTMR_IMA.
> > > 
> > > I was thinking something similar too
> > > 
> > > I called this "PCR policy" in my previous posting, but in-kernel I
> > > would expect something like IMA to request the "IMA PCR" from the
> > > current attestation policy.
> > > 
> > > This could be a locality 0 TPM PCR, a locality 2 PCR for a DRTM
> > > launch, a TDX RTMR, etc. It keeps the layout in one place, and lets
> > > the multiplexor steer it to different hardware.
> > 
> > 5 Authenticated hibernate [1]
> > 
> > This is on the table at least.
> 
> Yeah, any in-kernel use of PCRs has to fit into the overall system
> policy. Like maybe you don't want to use PCR 5 if you have DRTM, or
> you want to do hibernation using an alternative ROT from TPM..

Just mentioning it for completeness but it is, of course, not a
committed reservation as the patch set is still only an RFC.

I'm looking forward to test the feature as soon as I have the
bandwidth to setup a proper environment for it.

> 
> Jason

Br, Jarkko