Overview
========

Decouple TPM driver features relevant for Trenchboot and make tpm-buf
robust and decoupled entity from the rest of driver. By doing this, code
can be easily linked to the early boot code.

Backlog
=======

Parts of tpm_tis should separated and decouple from the driver code so that
the slices of code can be compiled into early boot code. Since by other
means the series already has most of the gaps filled it's better to resolve
this issue before landing the series.

v3:
- I think 6.19 is a better goal for this and thus expanded the series to
  be a generic Trenchboot enablers series. This version also consolidates
  my two separate ongoing series.
v2:
- While including fixes from v1, this patch set has a refocus in order to
  do minimal changes to make code base more compatible  Trenchboot.

Jarkko Sakkinen (10):
  tpm: Cap the number of PCR banks
  tpm: Use -EPERM as fallback error code in tpm_ret_to_err
  KEYS: trusted: Use tpm_ret_to_err() in trusted_tpm2
  tpm2-sessions: Remove 'attributes' from tpm_buf_append_auth
  tpm2-sessions: Umask tpm_buf_append_hmac_session()
  KEYS: trusted: Open code tpm2_buf_append()
  tpm-buf: check for corruption in  tpm_buf_append_handle()
  tpm-buf: Remove chip parameter from tpm_buf_append_handle
  tpm-buf: Build PCR extend commands
  tpm-buf: Enable managed and stack allocations.

 drivers/char/tpm/tpm-buf.c                | 208 +++++++++++----
 drivers/char/tpm/tpm-chip.c               |  13 +-
 drivers/char/tpm/tpm-sysfs.c              |  20 +-
 drivers/char/tpm/tpm.h                    |   2 -
 drivers/char/tpm/tpm1-cmd.c               | 179 +++++--------
 drivers/char/tpm/tpm2-cmd.c               | 307 ++++++++++------------
 drivers/char/tpm/tpm2-sessions.c          | 128 +++++----
 drivers/char/tpm/tpm2-space.c             |  44 ++--
 drivers/char/tpm/tpm_vtpm_proxy.c         |  30 +--
 include/linux/tpm.h                       |  79 +++---
 include/linux/tpm_command.h               |   5 +-
 security/keys/trusted-keys/trusted_tpm1.c |  34 ++-
 security/keys/trusted-keys/trusted_tpm2.c | 237 +++++++----------
 13 files changed, 621 insertions(+), 665 deletions(-)

-- 
2.39.5

On Mon, Sep 29, 2025 at 10:48:22PM +0300, Jarkko Sakkinen wrote:
> Overview
> ========
> 
> Decouple TPM driver features relevant for Trenchboot and make tpm-buf
> robust and decoupled entity from the rest of driver. By doing this, code
> can be easily linked to the early boot code.
> 
> Backlog
> =======
> 
> Parts of tpm_tis should separated and decouple from the driver code so that
> the slices of code can be compiled into early boot code. Since by other
> means the series already has most of the gaps filled it's better to resolve
> this issue before landing the series.

I.e. goal is that redundancy is mostly in the glue not in replicated
code that we want to fix regressions at one place.

These patches address end-to-end efficient building and parsing of
PCR extends with super-relaxed mm-requirements (stack will do), and
tpm_tis is the final piece.

BR, Jarkko