Linux RFC proposes common attestation API and TDX provider

Linux still exposes attestation through technology-specific interfaces, so evidence retrieval, measurement registers, and device state look different for TPM2, Intel TDX, AMD SEV-SNP, Arm CCA, and related hardware.

Jiri Pirko of NVIDIA has posted an RFC series that adds a common attestation subsystem and a first TDX provider. The stated goal is one model for platform, TEE, and device providers, including later TPM2, SEV-SNP, Arm CCA, Caliptra, and PCI/TSM-backed devices. Existing native TDX report and measurement interfaces would stay independent for now. Only the TDX paths needed for the first ABI are in scope; broader evidence classes, dynamic registers, verdict recording, and device-security transitions are deferred.

Userspace would talk to attestation devices through CTLV, a schema-driven character-device TLV interface. One validated request runs atomically, rather than stitching a transaction across sysfs or configfs files. An open device fd carries authority and lifetime, can be delegated like a normal fd, and owns its event queue. The design also generates UAPI constants and docs from checked-in schemas, enforces type, bounds, nesting, and required-field checks, and supports runtime introspection, family inheritance, fragmented queries with generation checks, large blobs, and per-fd event subscription with overflow and removal notices.

Review on the linux-kernel list has been heavy. Yeoreum Yun of Arm reported that a maximum nest depth of 32 blew the kernel stack on Arm FVP in kunit tests (on the order of hundreds of bytes per level). Pirko agreed to cut the limit sharply for an initial version. Jason Gunthorpe argued for clearer top-down schema layout, ordinary driver-style TDX wiring instead of special linkages, simpler private-data relationships, and compile-out debug asserts. Dave Jiang exercised a TDX Connect device-attestation proof of concept on Pirko’s wider work-in-progress tree and reported the model worked in QEMU and on hardware, while noting that evidence-generation checks could accept stale appraised evidence after a later refresh. Gunthorpe’s counter was blunt: “We don’t care about freshness of measurements. What we care about is that the device has remained continuously locked while we are doing this.”

The series remains an RFC under active redesign, not a merged ABI.