tpm_buf_append_hmac_session(9)

💅 tpm_buf_append_hmac_session (9) — from the Kernel API Manual, bestie

okay so picture this: it's a kernel API manual page, it's gorgeous, and it's about to become your whole personality. we're in the TPM corner of the kernel, and this function is the one that slides a session element into your command buffer. no cap.

---

✨ NAME ✨

tpm_buf_append_hmac_session — appends a TPM session element. that's it, that's the whole vibe 🎀

---

🦋 SYNOPSIS 🦋

void tpm_buf_append_hmac_session (struct tpm_chip *chip , struct tpm_buf
*buf , u8 attributes , u8 *passphrase , int passphrase_len );

she takes five args and returns void. lowkey iconic of her.

---

🌸 ARGUMENTS 🌸

• chip — the TPM chip structure. your main character, the whole reason we're here 💖
• buf — the buffer you're appending to. it's giving "the destination of all my hopes and dreams".
• attributes — the session attributes. this is the dial that decides what kind of session you're getting, so like… choose wisely bestie.
• passphrase — the session authority. it can be NULL if there isn't one (NULL if none, fr).
• passphrase_len — the length of that session authority, and it's 0 if none. match her with the passphrase, okay? 🫶

---

🔥 DESCRIPTION 🔥

so what does she actually do. she fills in a session structure inside the TPM command buffer — except for the HMAC. and why is the HMAC getting left out, you ask? because the HMAC literally cannot be computed until the command buffer is complete. math doesn't do vibes, she does facts. 😭

the type of session is controlled by attributes, and the main ones are:

• TPM2_SA_CONTINUE_SESSION — means the session won't terminate after tpm_buf_check_hmac_response. she stays, she's committed. 💅
• TPM2_SA_DECRYPT — means this buffer's first parameter should be encrypted with a session key.
• TPM2_SA_ENCRYPT — means the response buffer's first parameter needs to be decrypted.

and yes, those last two are confusing — but that's on purpose-adjacent, because the defines are written from the point of view of the TPM, not from yours. so like, flip your brain around before you read them ngl 🙈

⚠️ real talk: any session appended by this command must be finalized by calling tpm_buf_fill_hmac_session. if you don't, the HMAC will be incorrect and the TPM will straight-up reject the command. not a drill, not a vibe, a rejection. 💀

and as with most tpm_buf operations, success is just… assumed. because failure here would be caused by an incorrect programming model, and you'd get told about it via a kernel message. so if you messed up the model, the kernel will let you know loudly. 👑

---

🧚 SEE ALSO 🧚

Kernel file ./drivers/char/tpm/tpm2-sessions.c, plus her whole friend group:

• tpm_buf_append_name(9)
• tpm_buf_fill_hmac_session(9)
• tpm_buf_check_hmac_response(9)
• tpm2_end_auth_session(9)
• tpm2_start_auth_session(9)
• tpm2_parse_create_primary(9)
• tpm2_create_primary(9)
• tpm2_sessions_init(9)

---

🌈 mwah, that's the page!! brought to you from ./drivers/char/tpm and dated October 2026 — the Kernel API Manual said "it's giving documentation" and honestly? she ate. periodt. 💜✨