[PATCH RFC 0/3] security: ima: support TSM measurement registers

[Jason Gunthorpe]

On Tue, Oct 13, 2026 at 09:05:37PM +0800, GONG Ruiqi wrote:
> I'd rather not base our work on Jiri's patch at this stage: it is
> a pre-RFC draft of the new attestation subsystem, whose design is
> itself still in progress. Building upon it instead of current
> mainline would be quite risky — we would be rebasing on a moving
> target, and merging would be blocked until the whole framework
> lands, which is realistically far off.

I'm going to be strongly against any work to try and put a ROT
multiplexor into IMA. This is architecturally the wrong direction and
is clearly very a short term project that will expose uABI that will
be difficult to unwind later.

If you want this to go faster please work with Jiri.

> I'd suggest we develop the proposal on current mainline, and
> switch to the new attestation subsystem once it lands. As I
> understand it, for us that is mostly just a matter of switching
> to a different set of APIs.

It isn't, one activity is moving the policy and ROT multiplexer into a
shared subsystem, the other is building a ROT multiplexer into IMA for
only IMA to use.

Jaon