Bugfix: Fix TPM auth retry, counter error handling, and NV error surfacing

[tlaurion]

This PR fixes regressions introduced by PR #2068, merged to origin/master on 2026-04-07.

Regressions fixed (present in origin/master post-PR #2068):

• No "out of resources" (0x15) TPM counter error detection: caused generic DIE "Unable to create TPM counter" instead of setting tpm_reset_required.
• TPM2 counter increment had no auth retry on wrong passphrase: failed immediately instead of retrying up to 3 times.
• TPM1 counter increment had no error handling: fell through to raw exec tpm with no retry or error checking.
• tpm1_seal silenced NV define/write errors via 2>&1 | DEBUG and || true, hiding failures from users.
• Duplicate TPM1/TPM2 retry loops across seal, counter create, and increment functions (~100 lines of redundant code).
• $pass: command not found bug in retry logic due to mishandled passphrase variables.
• No tpm_reset_required flag set on 0x15 non-auth counter errors.

Fixes implemented:

• Add shared _tpm_auth_retry helper for TPM1 (stdout errors, -pwdo/-pwdc flags) and TPM2 (stderr errors, -P flag) with up to 3 auth retry attempts.
• check_tpm_counter only triggers set_tpm_reset_required on 0x15 errors, not auth failures.
• tpm1_seal surfaces NV define/write errors with a retry loop instead of silencing them.
• Simplify reset_tpm to verify tpmr.sh reset exit code and fix indentation.
• Update documentation: doc/tpm.md (0x15 error recovery), doc/ux-patterns.md (TPM error UX patterns).

Copilot review fixes:

• Fix counter_present dead code: add counter_read check in increment_tpm_counter to properly distinguish "readable but not incrementable" from missing counter.
• Fix doc references: tpmr -> tpmr.sh for consistency with actual binary name.

Docs: unify script name references

• Update all initrd/bin/* and initrd/etc/* references in doc/* to use .sh extension, matching the actual filenames (scripts were renamed in older PR, docs didn't follow).

---

Testing: Verified with tlaurion-bugfix-tpm_increment_on_seal-seal.log and tlaurion-bugfix-tpm_increment_on_seal-review.log — no regressions, counter increments succeed, no TPM reset required.

[Copilot]

Pull request overview

This PR addresses TPM regressions introduced in PR #2068 by reworking TPM counter creation/increment error handling and auth retry behavior, and updating GUI flows/docs to surface TPM reset-required states more clearly.

Changes:

• Add shared TPM auth-retry helper logic and refactor TPM1/TPM2 counter operations in tpmr.sh.
• Improve rollback counter creation/increment handling and propagate TPM “out of resources (0x15)” into a tpm_reset_required marker + targeted UX.
• Update GUI flows and documentation to support “Reset the TPM” gate-bypass patterns and clearer recovery guidance.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
initrd/etc/gui_functions.sh	Exit integrity investigation loop when update_checksums triggers tpm_reset_required.
initrd/etc/functions.sh	Detect TPM 0x15 on counter_create and adjust TPM counter increment plumbing.
initrd/bin/tpmr.sh	Introduce _tpm_auth_retry, refactor TPM counter ops, and surface TPM1 stdout quirks.
initrd/bin/gui-init.sh	Improve UX around checksum update failure and gate bypass for TPM reset; verify TPM reset result.
doc/ux-patterns.md	Document the reset gate-bypass UX pattern.
doc/tpm.md	Document 0x15 recovery behavior and TPM1 stdout behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

initrd/etc/functions.sh:1901

• The comment above the counter_increment pipeline says stdout is captured “while still letting stdout appear on the console”, but the current pipeline ends with tee /tmp/counter-... >/dev/null, which discards stdout from the console entirely. Either update the comment to match the behavior, or adjust the pipeline if the intent really is to keep stdout visible to the user.

	# Try to increment the counter.  We normally hide the verbose
	# output of tpmr.sh commands to avoid overwhelming the console, but we
	# must *not* swallow any interactive prompts.  The previous implementation
	# redirected the entire `tpmr.sh counter_create` invocation to a file and
	# /dev/null, which meant that when the counter was missing the password
	# prompt could not be seen by the user even though tpmr.sh printed it to the
	# controlling terminal.  Instead, capture just the stdout in a temporary
	# file while still letting stdout appear on the console (and logging
	# stderr to debug log).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

initrd/etc/functions.sh:1901

• The comment above the counter increment pipeline says stdout is captured “while still letting stdout appear on the console”, but the actual pipeline sends stdout into tee ... >/dev/null, which suppresses console output. Either adjust the redirection to match the comment (if console output is desired) or update the comment to reflect that stdout is intentionally hidden and only logged/stored.

	# Try to increment the counter.  We normally hide the verbose
	# output of tpmr.sh commands to avoid overwhelming the console, but we
	# must *not* swallow any interactive prompts.  The previous implementation
	# redirected the entire `tpmr.sh counter_create` invocation to a file and
	# /dev/null, which meant that when the counter was missing the password
	# prompt could not be seen by the user even though tpmr.sh printed it to the
	# controlling terminal.  Instead, capture just the stdout in a temporary
	# file while still letting stdout appear on the console (and logging
	# stderr to debug log).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tlaurion]

Wating for +1