Re: [PATCH RFC 0/3] security: ima: support TSM measurement registers

On 10/1/2026 10:24 PM, Yeoreum Yun wrote:

Hi Roberto,

quoted

On Thu, 2026-10-01 at 13:27 +0200, Roberto Sassu wrote:

quoted

On Wed, 2026-09-30 at 14:43 +0100, Yeoreum Yun wrote:

quoted

Confidential computing guests without a TPM can use TSM measurement
registers to record IMA measurement digests instead of TPM PCRs.

+ Gong Ruiqi, of course.

Roberto

Hi Roberto,

Thank you for involving me!

quoted

quoted

Hi Yeoreum

a similar patch set has been sent to the linux-integrity mailing list:

https://lore.kernel.org/linux-integrity/20250630125928.765285-1-gongruiqi1@huawei.com/ (local)

Could you please work with Gong Ruiqi to have a unified proposal?

Thanks

Roberto

Thanks for letting me know and I think the proposal is almost the same
with the different terminology only.

@Gong, what do you think?

Hi Yeoreum,

Nice to see this topic picked up again — I'm glad the IMA RoT framework
series I posted last year is still of interest.

Yes, I'd be happy to work with you on a unified proposal. It's been a
while since I last worked on that series, so I'll first revisit my
previous patch set, and then follow up with you to discuss the code details.

Looking forward to working with you.

BR,
Ruiqi

quoted

quoted

quoted

This series introduces in-kernel interfaces for accessing TSM
measurement registers, abstracts IMA's measurement-register operations,
and adds a TSM backend for Intel TDX and Arm CCA.

The following mappings between TPM PCR indices and TSM measurement
registers are defined for Intel TDX [0] and proposed for Arm CCA [1]:

  TPM PCR index | Intel TDX register | Arm CCA register
  --------------+--------------------+-----------------
  0             | MRTD               | RIM
  1, 7          | RTMR[0]            | REM[0]
  2-6           | RTMR[1]            | REM[1]
  8-15          | RTMR[2]            | REM[2]

These mappings allow IMA to translate PCR indices into the corresponding
TSM measurement registers.

The TPM backend remains preferred when it is available at IMA
initialization. Otherwise, IMA falls back to a supported TSM backend.
Only one backend is selected; IMA measurements are not extended to both
TPM PCRs and TSM measurement registers.

The attestation proccess for guest with TSM measurement register will
be done with Confidential Compute Event Log (CCEL) which is exported by
/sys/firmware/acpi/tables/data/CCEL. Here is brief process in arm64:

  Verifier                 Realm guest              RMM / Platform
     |                         |                           |
     |--- Challenge (nonce) -->|                           |
     |                         |--- Request token -------->|
     |                         |    with challenge         |
     |                         |                           |
     |                         |<-- CCA token T -----------|
     |<-- CCA token T ---------|                           |
     |<-- CCEL event log ------|                           |
     |<-- IMA measurement log -|                           |
     |                         |                           |
 Verify token T:               |                           |
  - signatures                 |                           |
  - Platform/Realm             |                           |
    token binding              |                           |
  - challenge freshness        |                           |
  - platform/RIM policy        |                           |
  - verify measurement logs    |                           |
     |                         |                           |
     | ----ACCEPT / REJECT---->|                           |

This patch based on arm-cca-mr series [3].

Link: [0] https://uefi.org/specs/UEFI/2.11/38_Confidential_Computing.html#intel-trust-domain-extension
Link: [1] https://github.com/tianocore/edk2/issues/11383
Link: [2] https://github.com/tianocore/edk2/issues/11384
Link: [3] https://lore.kernel.org/all/20260929-arm_cca_mr-v2-0-1d98bba187fd@arm.com/ (local)

---
Yeoreum Yun (3):
      virt: coco: introduce tsm_default_tm() and tsm_mr_read()/write()
      security: IMA: introduce ima_mr structure
      security: IMA: use TSM measurement registers

 drivers/virt/coco/guest/tsm-mr.c          | 159 +++++++++++++---
 include/linux/tsm-mr.h                    |  26 +++
 security/integrity/ima/Makefile           |   3 +-
 security/integrity/ima/ima.h              |   7 +-
 security/integrity/ima/ima_api.c          |   4 +-
 security/integrity/ima/ima_crypto.c       | 137 +++++---------
 security/integrity/ima/ima_fs.c           |  16 +-
 security/integrity/ima/ima_init.c         |   7 +-
 security/integrity/ima/ima_mr.c           |  48 +++++
 security/integrity/ima/ima_mr.h           |  76 ++++++++
 security/integrity/ima/ima_mr_tpm.c       | 155 ++++++++++++++++
 security/integrity/ima/ima_mr_tsm.c       | 290 ++++++++++++++++++++++++++++++
 security/integrity/ima/ima_queue.c        |  39 ++--
 security/integrity/ima/ima_template.c     |   4 +-
 security/integrity/ima/ima_template_lib.c |   2 +-
 15 files changed, 819 insertions(+), 154 deletions(-)
---
base-commit: b561246f45174b7472c24b75358ea95bae72b7b8
change-id: 20260929-ima_tgx_integration_v2-1c54aeeaeaee

Best regards,