Re: [PATCH RFC 0/3] security: ima: support TSM measurement registers

On Tue, Oct 13, 2026 at 09:05:37PM +0800, GONG Ruiqi wrote:

I'd rather not base our work on Jiri's patch at this stage: it is
a pre-RFC draft of the new attestation subsystem, whose design is
itself still in progress. Building upon it instead of current
mainline would be quite risky — we would be rebasing on a moving
target, and merging would be blocked until the whole framework
lands, which is realistically far off.

I'm going to be strongly against any work to try and put a ROT
multiplexor into IMA. This is architecturally the wrong direction and
is clearly very a short term project that will expose uABI that will
be difficult to unwind later.

If you want this to go faster please work with Jiri.

I'd suggest we develop the proposal on current mainline, and
switch to the new attestation subsystem once it lands. As I
understand it, for us that is mostly just a matter of switching
to a different set of APIs.

It isn't, one activity is moving the policy and ROT multiplexer into a
shared subsystem, the other is building a ROT multiplexer into IMA for
only IMA to use.

Jaon