Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Jason Gunthorpe <jgg@nvidia.com>]

On Sat, Oct 17, 2026 at 11:55:05PM +0300, Jarkko Sakkinen wrote:
> On Sat, Oct 17, 2026 at 05:34:07PM -0300, Jason Gunthorpe wrote:
> > > +Jarkko
> > > The TPM driver is pretty entrenched and heavily used by different user
> > > space applications, so it seems really ambitious to bundle in TPM
> > > here.
> > 
> > By "ROT agility" I mean if you want to do an extend operation you
> > should not have to know the details of the HW holding the "PCR".
> > 
> > One of the APIs offered here is a HW agnostic extend that can be used
> > to build ROT agility into user space programs that are doing
> > logging. That's systemd-pcr-extend for example.
> > 
> > The extent of the TPM support is to be able to issue a PCR extend
> > triggered with a TPM command by the agnostic API. Not ambitious at
> > all.
> 
> I wish I had a better picture what is going on.
> 
> I don't have capacity to heavily on this but can help sorting out
> issues if they are put better into nutshell.

No worries, thank you. The eventual TPM commands are probably the
easiest thing here. The really big investment was mapping out the
capabilities for a wide range of a HW types and come with with a
reasonable language to describe all of it

> I would recommend to at least check out tpm2-protocol because when
> I did it my main use case was exactly protocol interceptor. It is
> designed from the bottom for that one use case. Plus zero cost
> memory usage can be casted to a raw pointer.

Currently we don't have an intention to flow TPM command packets
through this. Anything would be a high level operation like 'extend'

Jason