Re: [PATCH 01/17] tpm: Define a kernel-owned TPM NV index that can't be modified by userland

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2026-10-10 at 14:26 -0700, Matthew Garrett wrote:
> On Sat, Oct 10, 2026 at 11:22:34AM +0200, James Bottomley wrote:
> 
> > The reason I never really proposed such a scheme is the rollback
> > problem (old version of OS or non-Linux OS can create the NV index
> > from user space bypassing the kernel only block) which you try to
> > solve with PCR5.  Do you have any data for how widespread measuring
> > exitbootservices is?  I know edk2 does it, but I just looked on my
> > XPS13 and I only have two PCR5 events: a separator and the GPT
> > table, so it's definitely in violation, but if Dells don't do this
> > then it's indicative that many other manufacturers might not as
> > well.
> 
> Does your log replay correctly for PCR 5? It's *extremely* common for
> the extension to happen without logging, since logging needs to be
> done  into the late events table and almost nobody got that right
> until a few years ago (hence 
> https://github.com/google/go-attestation/blob/master/attest/eventlog_workarounds.go#L70
> )

It seems to.  This is what tpm2-eventlog returns (edited only to show
PCR 5):

---
version: 1
events:
- EventNum: 20
  PCRIndex: 5
  EventType: EV_SEPARATOR
  DigestCount: 2
  Digests:
  - AlgorithmId: sha1
    Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
  - AlgorithmId: sha256
    Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
  EventSize: 4
  Event: "00000000"
- EventNum: 22
  PCRIndex: 5
  EventType: EV_EFI_GPT_EVENT
  DigestCount: 2
  Digests:
  - AlgorithmId: sha1
    Digest: "bcd4ef027ee6b70a1ce07b37378da7ad02bfc545"
  - AlgorithmId: sha256
    Digest: "ed5eaf5ac436743417c862277ac71e1f202e6ff734fcf9a4ecdabc0d045d20a3"
  EventSize: 484
  Event: "4546492050415254000001005c000000de83a7fd000000000100000000000000af129e3b0000000022000000000000008e129e3b00000000fc1e83487e221840b908f829a235f48b02000000000000008000000080000000983fc1db030000000000000028732ac11ff8d211ba4b00a0c93ec93bb131ae393c3797438f4a8bf58beeaef50008000000000000ff071000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af3dc60f838472478e793d69d8477de4cde1b4fc71d4a245a89533bb0b524e9b0008100000000000ff0f5e3b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006dfd5706aba4c44384e50933c84b4f4fb29b70a77c1da04da9d7f36291c77dc000105e3b000000008e129e3b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
pcrs:
  sha256:
    5  : 0x9c41c9e22fb5275e84b88f7eda8a764961f67ede9dfad9626e84208c9f7de63c

and

jejb@lingrow:~> cat /sys/class/tpm/tpm0/pcr-sha256/5
9C41C9E22FB5275E84B88F7EDA8A764961F67EDE9DFAD9626E84208C9F7DE63C


So that's a match.

Regards,

James