Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Jason Gunthorpe <jgg@nvidia.com>]

On Thu, Oct 22, 2026 at 07:24:57AM -0400, Mimi Zohar wrote:
> > Isn't the hypervisor what we are doing now? I mean multiple extension
> > originators share the same register and eventually the same log. Or do
> > you suggest to go even further having a "generic_registerX" exposed for
> > every hw implementation allowing the user to have full abstraction?
> > The "generic_registerX" would be always alias to something hw specific,
> > like RTMR2 for example of TDX.
> 
> I definitely prefer the latter, as everything continues to work as is with
> minimal, if any, change.
> 
> AI's wording:
> • The Virtual Mapping: The [attestation] subsystem exposes "Virtual RTMRs"
> (vRTMRs) internally to the kernel.
> 
> • IMA's Dedicated Lane: The kernel config routes IMA to vRTMR_IMA.

I was thinking something similar too

I called this "PCR policy" in my previous posting, but in-kernel I
would expect something like IMA to request the "IMA PCR" from the
current attestation policy.

This could be a locality 0 TPM PCR, a locality 2 PCR for a DRTM
launch, a TDX RTMR, etc. It keeps the layout in one place, and lets
the multiplexor steer it to different hardware.

The policy would outline all the in-kernel users, and probably provide
some how give a recommendation to userspace like 'systemd log goes
here'

Jason