Re: [PATCH RFC 0/3] security: ima: support TSM measurement registers

[Roberto Sassu]

On Wed, 2026-09-30 at 14:43 +0100, Yeoreum Yun wrote:
> Confidential computing guests without a TPM can use TSM measurement
> registers to record IMA measurement digests instead of TPM PCRs.

Hi Yeoreum

a similar patch set has been sent to the linux-integrity mailing list:

https://lore.kernel.org/linux-integrity/20250630125928.765285-1-gongruiqi1@xxxxxxxxxx/

Could you please work with Gong Ruiqi to have a unified proposal?

Thanks

Roberto

> This series introduces in-kernel interfaces for accessing TSM
> measurement registers, abstracts IMA's measurement-register operations,
> and adds a TSM backend for Intel TDX and Arm CCA.
> 
> The following mappings between TPM PCR indices and TSM measurement
> registers are defined for Intel TDX [0] and proposed for Arm CCA [1]:
> 
>   TPM PCR index | Intel TDX register | Arm CCA register
>   --------------+--------------------+-----------------
>   0             | MRTD               | RIM
>   1, 7          | RTMR[0]            | REM[0]
>   2-6           | RTMR[1]            | REM[1]
>   8-15          | RTMR[2]            | REM[2]
> 
> These mappings allow IMA to translate PCR indices into the corresponding
> TSM measurement registers.
> 
> The TPM backend remains preferred when it is available at IMA
> initialization. Otherwise, IMA falls back to a supported TSM backend.
> Only one backend is selected; IMA measurements are not extended to both
> TPM PCRs and TSM measurement registers.
> 
> The attestation proccess for guest with TSM measurement register will
> be done with Confidential Compute Event Log (CCEL) which is exported by
> /sys/firmware/acpi/tables/data/CCEL. Here is brief process in arm64:
> 
>   Verifier                 Realm guest              RMM / Platform
>      |                         |                           |
>      |--- Challenge (nonce) -->|                           |
>      |                         |--- Request token -------->|
>      |                         |    with challenge         |
>      |                         |                           |
>      |                         |<-- CCA token T -----------|
>      |<-- CCA token T ---------|                           |
>      |<-- CCEL event log ------|                           |
>      |<-- IMA measurement log -|                           |
>      |                         |                           |
>  Verify token T:               |                           |
>   - signatures                 |                           |
>   - Platform/Realm             |                           |
>     token binding              |                           |
>   - challenge freshness        |                           |
>   - platform/RIM policy        |                           |
>   - verify measurement logs    |                           |
>      |                         |                           |
>      | ----ACCEPT / REJECT---->|                           |
> 
> This patch based on arm-cca-mr series [3].
> 
> Link: [0] https://uefi.org/specs/UEFI/2.11/38_Confidential_Computing.html#intel-trust-domain-extension
> Link: [1] https://github.com/tianocore/edk2/issues/11383
> Link: [2] https://github.com/tianocore/edk2/issues/11384
> Link: [3] https://lore.kernel.org/all/20260929-arm_cca_mr-v2-0-1d98bba187fd@xxxxxxx/
> 
> ---
> Yeoreum Yun (3):
>       virt: coco: introduce tsm_default_tm() and tsm_mr_read()/write()
>       security: IMA: introduce ima_mr structure
>       security: IMA: use TSM measurement registers
> 
>  drivers/virt/coco/guest/tsm-mr.c          | 159 +++++++++++++---
>  include/linux/tsm-mr.h                    |  26 +++
>  security/integrity/ima/Makefile           |   3 +-
>  security/integrity/ima/ima.h              |   7 +-
>  security/integrity/ima/ima_api.c          |   4 +-
>  security/integrity/ima/ima_crypto.c       | 137 +++++---------
>  security/integrity/ima/ima_fs.c           |  16 +-
>  security/integrity/ima/ima_init.c         |   7 +-
>  security/integrity/ima/ima_mr.c           |  48 +++++
>  security/integrity/ima/ima_mr.h           |  76 ++++++++
>  security/integrity/ima/ima_mr_tpm.c       | 155 ++++++++++++++++
>  security/integrity/ima/ima_mr_tsm.c       | 290 ++++++++++++++++++++++++++++++
>  security/integrity/ima/ima_queue.c        |  39 ++--
>  security/integrity/ima/ima_template.c     |   4 +-
>  security/integrity/ima/ima_template_lib.c |   2 +-
>  15 files changed, 819 insertions(+), 154 deletions(-)
> ---
> base-commit: b561246f45174b7472c24b75358ea95bae72b7b8
> change-id: 20260929-ima_tgx_integration_v2-1c54aeeaeaee
> 
> Best regards,