Appendix: Google Cloud Measurement Registers

Overview

A node records its boot measurements in two places: the Titan Trusted Platform Module (TPM) holds the host’s measurements in its Platform Configuration Registers (PCRs), and Intel TDX holds each confidential VM’s measurements in its Runtime Measurement Registers (RTMRs). This appendix is the register-level reference for those measurements. For how a node produces that evidence and binds it together, and how a client verifies it, see Google Cloud Node Attestation.

Host measurements

The host’s boot stages are measured as follows:

Titan firmware

Measured by Titan’s own boot loader, which places the measurement in the signing Endorsement Key’s DICE chain rather than in a PCR. The procedure for verifying Titan firmware measurements is published with Google’s platform-attestation tooling.

BMC firmware

Titan firmware captures a digest of the baseboard management controller (BMC) firmware and extends it into PCR[0].

BIOS

The BMC captures a digest of the BIOS and extends it into PCR[17].

Host kernel

The BIOS captures a measurement of the host boot image and extends it into PCR[21]. The image is a single unified kernel image (UKI), and the kernel command line and the dm-verity root hash are hard-coded in it, so this single measurement covers them. It is the only host-OS measurement extended into the TPM, because the root file system carries everything the host needs to run the confidential VMs.

Intel TDX platform identifier

On boot, the host reads the CPU’s Intel TDX PCK certificate and extends the Binding the evidence together it carries into PCR[19]. PCR[19] holds a Canonical Event Log rather than a bare digest, and the PIID is one 16-byte record in it. Reconciling that record against the PIID in each VM’s PCK certificate is what binds the Titan-attested host to the TDX-attested guests.

The Titan TPM is reached over an IPMI bridge through the BMC. The host kernel includes an IPMI driver, and userspace carries tooling built on Google’s go-tpm library, with a local wrapper that routes TPM commands through the IPMI driver.

PCR[17], PCR[19], and PCR[21] sit in the TPM’s dynamic root-of-trust range, where a register clears on a CPU warm reset instead of persisting until the next power cycle, as PCR[0] does. No CPU-initiated dynamic launch takes place on this platform, so the components above extend these registers directly: the BMC extends PCR[17], the BIOS extends PCR[21], and the host extends PCR[19]. A BMC compromised at runtime can therefore warm-reset the CPU and replay a legitimate-looking sequence into the cleared registers; Detecting a warm-reset attack covers the counter Titan keeps to make that visible. Loading a second kernel over the first is a separate concern, because it would leave PCR[21] describing a kernel that is no longer running, without disturbing any register. The Host and guest OS hardening is therefore built without the legacy kexec_load system call.

Guest measurements

The Intel TDX quote reflects the confidential VM’s initial memory image in its MRTD field. That image holds the guest firmware and nothing else. A node runs two confidential VMs, and both boot the same firmware binary from the host image, so both quotes report the same MRTD. The value is a SHA-384 digest, but not a digest of the binary alone. The TDX module folds in the guest-physical address of every page it adds, and the contents of the boot firmware volume alone; the configuration firmware volume, the handoff block that describes the guest’s memory layout, and the temporary memory regions contribute their addresses without their contents. Recomputing the value therefore means replaying the module’s build-time measurement, which Reproducing Google Cloud Measurements describes.

Beyond MRTD, code inside the confidential VM extends the RTMRs at runtime with measurements of code and data, and a verifier parses them much as it does TPM PCRs. The registers map roughly to PCRs as follows:

RTMR[0]

Analogous to PCR[1] and PCR[7]; carries Secure Boot configuration and the TDX configuration firmware volume, including the initial EFI variable state.

RTMR[1]

Analogous to PCR[2] through PCR[5]; carries digests of the PE/COFF EFI applications.

RTMR[2]

Analogous to PCR[8] through PCR[15]; carries the measurements recorded by a boot loader, such as a kernel command line and the files the loader reads. A node boots a Unified Kernel Image as its sole EFI application, with no boot loader stage, so this register stays empty and the command line is covered by the RTMR[1] measurement of the image itself.

RTMR[3]

Used by userspace, similar to PCR[16] and above; carries events related to launching the node’s container, including the container image digest, the launch environment, and the attestation report of each attached GPU.

PCR[0] is deliberately absent from this mapping. The non-RTMR fields of the TDX quote, such as MRTD, cover the measurements that PCR[0] covers on a TPM.