Re: [PATCH 01/17] tpm: Define a kernel-owned TPM NV index that can't be modified by userland

[Matthew Garrett <mjg59@srcf.ucam.org>]

On Sat, Oct 10, 2026 at 11:22:34AM +0200, James Bottomley wrote:

> The reason I never really proposed such a scheme is the rollback
> problem (old version of OS or non-Linux OS can create the NV index from
> user space bypassing the kernel only block) which you try to solve with
> PCR5.  Do you have any data for how widespread measuring
> exitbootservices is?  I know edk2 does it, but I just looked on my
> XPS13 and I only have two PCR5 events: a separator and the GPT table,
> so it's definitely in violation, but if Dells don't do this then it's
> indicative that many other manufacturers might not as well.

Does your log replay correctly for PCR 5? It's *extremely* common for 
the extension to happen without logging, since logging needs to be done 
into the late events table and almost nobody got that right until a few 
years ago (hence 
https://github.com/google/go-attestation/blob/master/attest/eventlog_workarounds.go#L70)

> If we do have a problem with lack of manufacturer compliance, one other
> way I've got on my todo list is fake trusted launch: now that
> Trenchboot is heading upstream, we have the real trusted launch, but
> that's usually too fiddly for most people, so I was thinking if we
> could get enough of the TXT launch to happen to open the localities
> (without bothering too much about anything else) that might be easier
> and give us the ability to run the Kernel in locality 2.

Remember that many consumer devices don't implement TXT, it's only the 
enterprise SKUs that tend to. But that would be funny - it's the same 
sort of shape as an awful hack that's used on some of the Qualcomm 
laptops to get access to EL2. Localities are very clearly the Right Way 
to deal with this and ugh if we'd been having this conversation 20 years 
ago instead.
 
> > Reserve NV index 0x014c4853 for use by the kernel, and filter
> > commands submitted through /dev/tpm* and /dev/tpmrm* so that
> > userspace cannot undefine or modify it. Blocking definition is more
> > awkward so let's allow that for now, not being able to modify
> > ithttps://www.bbc.co.uk/sounds/play/p0pfxh72
> > means there's nothing interesting they can do there. The filter
> > simply validates which handle the relevant set of commands is
> > referring to and returns -EPERM if it's the kernel one.
> 
> As you say there are several other use cases, including mine above and
> NV PCRs, that can only be extended by the kernel, so I think this
> should be a range from the get go.

I've got a single index from the UAPI people's range right now, if we 
want more the easiest thing would probably be to ask TCG for our own 
carve out. I don't think the process would be difficult.