RE: tpm2-abrmd vs kernel resource manager

> [-- Attachment #1: smime.p7m --]

Unfortunately the lore.kernel.org archive doesn't handle S/MIME signatures.
For future reference I am quoting the entirety of Moritz's email here, thou=
gh it is broken up.

>> I've seen some references in the tpm2 documentation that suggest
>> tpm2-abrmd is preferred over the kernel resource manager. For
>> instance:
>>
>> https://github.com/tpm2-software/tpm2-
>> abrmd/blob/master/README.md#tpm2-abrmd-vs-in-kernel-rm
>> "For the short term we're recommending that developers stick to using
>> the tabrmd as the default to get the most stable / widest possible
>> support."
>>
>> https://tpm2-tools.readthedocs.io/en/latest/INSTALL/
>> "To enable the new userspace resource manager, one must get
>> tpm2-tabrmd (recommended)."
>
> I would appreciate if you could open an issue on GitHub regarding this to=
 get
> a discussion started there too.
> At least in tpm2-tss I am aware of a few things in the README that are ou=
t of
> date and need updating.

I decided to open this a few minutes ago, it would be good to continue the =
discussion there.
https://github.com/tpm2-software/tpm2-abrmd/issues/855

>> In contrast, Arch now recommends against tpm2-abrm:
>> https://wiki.archlinux.org/title/Trusted_Platform_Module
>> "According to a systemd project member, using tpm2-abrmd is no longer
>> recommended."
>>
>> I was wondering if anybody directly familiar with the kernel resource
>> manager and/or tpm2-abrmd code bases would care to comment on whether
>> one of these is the preferred option, or perhaps under what
>> circumstances one might choose one resource manager over the other.
>
>
> IIRC, the driver doesn=E2=80=99t support session un-gapping:
> https://trustedcomputinggroup.org/wp-content/uploads/TSS_2p0_TAB_Resource=
Manager_v1p0_r18_04082019_pub.pdf
>
> And without it, there are cases where TPM operations can stall.

This is good to know about, and should be mentioned somewhere in the tpm2-a=
brmd repo.

From my understanding of the linked standard, this isn't a required feature=
 of compliant TPM Access Brokers as the pdf references un-gapping implement=
ed in "a layer above the RM".
Could session un-gapping be implemented as a feature in higher-level client=
 libraries such as tpm2-tss?

>> Thanks,
>>
>> Scott
>
> Moritz

Skye