Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Jason Gunthorpe]

On Wed, Oct 21, 2026 at 08:48:28AM -0400, James Bottomley wrote:

> initializing its own TPM driver.  I've often thought that if we could
> prevent that and have a separate callback to kill the UEFI TPM driver
> (or probably one before ExitBootServices to say please keep this driver
> and then another to say I'm done), we could effectively use that for
> early kernel measurements and then engineer a handover to the in-kernel
> driver and then not be too worried about when the in-kernel driver
> attaches.  Of course, doing all this would require a UEFI spec update,
> which means it's not a quick or easy thing.

This is effectively what DRTM is for. My plan is for th launch to
capture enough measurements as part of the launch so that kernel can
run along far enough to naturally load the TPM/ROT driver. This is
aligned with how ARM DRTM is sketched out where you can get to ACPI
TPM discovery entirely on the secure launch data.

I'm pretty against "early TPM" for DRTM, and I think non-DRTM flows
should be similar and measure enough stuff prior to Exit Boot Services
so that the kernel does not need early TPM.

Jason