crates/attestation/src/azure/nv_index.rs builds its TSS context with the
hardcoded default TCTI:
let conf: TctiNameConf = TctiNameConf::Device(DeviceConfig::default());
DeviceConfig::default() is the raw /dev/tpm0 device, which the kernel
hands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (/dev/tpmrm0) multiplexes clients, but there is
currently no way to select it.
Proposal: resolve the TCTI via TctiNameConf::from_environment_variable()
(which honors the conventional TPM2TOOLS_TCTI / TCTI variables, e.g.
device:/dev/tpmrm0) and keep the current default as fallback — no
behavior change unless the variable is set.
Note the azure evidence path also reaches the same hardcoded pattern
upstream through az_tdx_vtpm::vtpm (az-cvm-vtpm src/vtpm/mod.rs), so
fully honoring the variable needs the matching upstream change too — filed
as kinvolk/azure-cvm-tooling#92.
crates/attestation/src/azure/nv_index.rsbuilds its TSS context with thehardcoded default TCTI:
DeviceConfig::default()is the raw/dev/tpm0device, which the kernelhands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (
/dev/tpmrm0) multiplexes clients, but there iscurrently no way to select it.
Proposal: resolve the TCTI via
TctiNameConf::from_environment_variable()(which honors the conventional
TPM2TOOLS_TCTI/TCTIvariables, e.g.device:/dev/tpmrm0) and keep the current default as fallback — nobehavior change unless the variable is set.
Note the azure evidence path also reaches the same hardcoded pattern
upstream through
az_tdx_vtpm::vtpm(az-cvm-vtpmsrc/vtpm/mod.rs), sofully honoring the variable needs the matching upstream change too — filed
as kinvolk/azure-cvm-tooling#92.