---
title: "Appendix: Google Cloud Measurement Registers"
framework: Private Cloud Compute Security Guide
role: article
role_heading: Article
path: private-cloud-compute/appendix_googlecloudmeasurementregisters
---

# Appendix: Google Cloud Measurement Registers

The host TPM and guest Intel TDX registers that record a node’s boot measurements.

## Overview

Overview A node records its boot measurements in two places: the Titan Trusted Platform Module (TPM) holds the host’s measurements in its Platform Configuration Registers (PCRs), and Intel TDX holds each confidential VM’s measurements in its Runtime Measurement Registers (RTMRs). This appendix is the register-level reference for those measurements. For how a node produces that evidence and binds it together, and how a client verifies it, see Google Cloud Node Attestation. tip: To recompute the reference values for these registers from published images, follow Reproduce the measurements. Host measurements The host’s boot stages are measured as follows: The Titan TPM is reached over an IPMI bridge through the BMC. The host kernel includes an IPMI driver, and userspace carries tooling built on Google’s go-tpm library, with a local wrapper that routes TPM commands through the IPMI driver. PCR[17], PCR[19], and PCR[21] sit in the TPM’s dynamic root-of-trust range, where a register clears on a CPU warm reset instead of persisting until the next power cycle, as PCR[0] does. No CPU-initiated dynamic launch takes place on this platform, so the components above extend these registers directly: the BMC extends PCR[17], the BIOS extends PCR[21], and the host extends PCR[19]. A BMC compromised at runtime can therefore warm-reset the CPU and replay a legitimate-looking sequence into the cleared registers; Detecting a warm-reset attack covers the counter Titan keeps to make that visible. Loading a second kernel over the first is a separate concern, because it would leave PCR[21] describing a kernel that is no longer running, without disturbing any register. The Host and guest OS hardening is therefore built without the legacy kexec_load system call. Guest measurements The Intel TDX quote reflects the confidential VM’s initial memory image in its MRTD field. That image holds the guest firmware and nothing else. A node runs two confidential VMs, and both boot the same firmware binary from the host image, so both quotes report the same MRTD. The value is a SHA-384 digest, but not a digest of the binary alone. The TDX module folds in the guest-physical address of every page it adds, and the contents of the boot firmware volume alone; the configuration firmware volume, the handoff block that describes the guest’s memory layout, and the temporary memory regions contribute their addresses without their contents. Recomputing the value therefore means replaying the module’s build-time measurement, which Reproducing Google Cloud Measurements describes. Beyond MRTD, code inside the confidential VM extends the RTMRs at runtime with measurements of code and data, and a verifier parses them much as it does TPM PCRs. The registers map roughly to PCRs as follows: PCR[0] is deliberately absent from this mapping. The non-RTMR fields of the TDX quote, such as MRTD, cover the measurements that PCR[0] covers on a TPM.