Re: [PATCH 0/3] arm64/virt: Add Arm CCA measurement register support

Jason Gunthorpe
2026-04-13T12:59:36Z

On Mon, Apr 13, 2026 at 09:49:54AM +0100, Sami Mujawar wrote:
> This series adds support for Arm Confidential Compute Architecture (CCA)
> measurement registers in the Linux kernel, enabling guest Realms to
> access, extend, and expose measurement values for attestation and runtime
> integrity tracking.
>
> The Realm Management Monitor (RMM) defines a set of measurement registers
> consisting of a Realm Initial Measurement (RIM) and a number of Realm
> Extensible Measurements (REMs). This series introduces the necessary
> infrastructure to interact with these registers via the RSI interface
> and exposes them to userspace through the TSM measurement framework.
>
> At a high level, the series includes:
> - Helper interfaces for reading and extending measurement
> registers via RSI
> - Definitions for Realm hash algorithms as defined by the
> RMM specification
> - Integration with the TSM measurement subsystem and sysfs
> exposure for userspace visibility and interaction
>
> After applying this series, measurement registers are exposed under:
> /sys/devices/virtual/misc/arm_cca_guest/measurements/

I'm surprised we get some random sysfs files? How does some more
generic userspace figure out to use this vs a TPM or some other
platform's version of it?

I also think exposing PCRs as was done for TPM in sysfs was something
of a mistake.. Allowing extension without logging is too low level and
is very hard to build an entire attestation system around.

I really think we are missing a subsystem here, TPM has sort of been
filling this role in a non-generic way, but we should have a
common uAPI for platform measurement & attestation:
- Discover available measurements
- Report signed measurements, with ingesting a nonce
- Report measurement logs
- Extend measurements and udpate logs
- Report certificates used in signing
- General reporting of various kinds of attestation evidence

And it would be nice for the PCI devices and others to plug into the
general framework as well instead of building a parallel TSM framework
for handling evidence.

Isn't this also sort of incomplete? Doesn't anything serious need
signed measurements? Isnt't there alot more data that comes out of RMM
than just a few measurement registers?

Jason