On Fri, 2024-09-13 at 13:05 -0700, Ross Philipson wrote: > Expose a sysfs interface to allow user mode to set and query the > default locality set for the TPM chip. What does a user need this for? It somewhat conflicts with the idea of running the kernel and user space TPM access in separate localities for the purposes of key release, so we can seal keys to only release in the kernel by policy. When I last talked about this I thought we'd probably use 0 for user and, say 2, for the kernel (mainly because prior incarnations of this patch set seemed to access the TPM in locality 2 from the kernel). It really doesn't matter *what* locality we use for the kernel and the user as long as it's known ahead of time and the user can't gain access to the kernel locality. Regards, James
