Re: [PATCH 05/17] tpm: Add a kernel attestation key and signed audit digest retrieval

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2026-10-08 at 06:20 -0700, Matthew Garrett wrote:
[...]
> +/**
> + * tpm2_create_kernel_ak() - create the kernel attestation key
> + * @chip:	the TPM chip
> + * @handle:	set to the transient handle of the AK on success
> + * @x:		if not NULL, filled with the X coordinate of the AK
> public key
> + * @y:		if not NULL, filled with the Y coordinate of the AK
> public key
> + *
> + * Creates the kernel AK as a primary key in the owner hierarchy
> using a
> + * fixed template, so the same key is returned on every call until
> the
> + * TPM is cleared.  The owner hierarchy must have an empty auth
> value.
> + * The caller must hold the chip's ops lock and is responsible for
> + * flushing @handle with tpm2_flush_context().
> + *
> + * Return:
> + * * 0		- OK
> + * * -errno	- A system error
> + * * TPM_RC	- A TPM error
> + */
> +int tpm2_create_kernel_ak(struct tpm_chip *chip, u32 *handle, u8 *x,
> u8 *y)

Oof, there's a lot of duplication in here.  Basically you're creating a
signing primary key (technically it's not an attestation key because
they're supposed to be non-primary; this isn't a criticism because the
only consumer is the machine owner who doesn't need to use privacy
preserving AKs because they know all about the TPM in their own
machine).  The primary generation routines that exist in tpm2-
sessions.c:tpm2_create_primary() et al. already does most of this.  The
only real current difference is that it creates an encryption key not a
signing key, but that could have an additional bool argument
(signing=true/encryption=false) rather than duplicating the entire
routine set.

Regards,

James