Merge ~lvoytek/ubuntu/+source/swtpm:merge-0.7.3-lunar into ubuntu/+source/swtpm:ubuntu/devel

[Lena Voytek]

Update to 0.7.3 to fix TPM secure boot in Lunar

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-update-lunar

autopkgtest results:

autopkgtest [07:48:29]: @@@@@@@@@@@@@@@@@@@@ summary
run-tests PASS

Currently working on the FFE info for the bug

[Utkarsh Gupta (utkarsh)]

I'll take this for (pair) review with Mitchell. Lena please let us know once the FFE bug is filed. Thanks.

[Lena Voytek (lvoytek)]

FFe filed, thanks!

[Robie Basak (racb)]

[Needs verifying:] In swtpm-tools, /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca seems to have moved to /usr/bin/swtpm_localca - I assume this is desirable/intentional?

[Not a blocker for upload if we need that right now:]

Apart from this I see no substantial changes in the binary, so this seems OK from the perspective of user functionality (modulo testing for which I think we can rely on existing test automation).

But, I think the packaging updates are a little confused. I would expect one of the following:

1) That we manage our own packaging as a "first class citizen", cherry-picking or deriving packaging from Debian or upstream but only where that makes sense for our own packaging.

2) That we base our packaging on an upstream (be it Debian or upstream's debian/ directory), try to keep that in sync as much as possible, maintaining a delta where necessary but rebasing and minimising that delta regularly. Basing on Debian like this is of course what we do for the majority of packages.

Right now I think we're somewhere in between these options, and I think this hurts maintainability. Some examples inline. In particular it seems to me that some changes are cherry-picks that don't apply to our current state of packaging. So why are we taking them? If because of option 2 above, then I'd expect these changes to be picked up by a rebase, that would for example also take the changes that are required for the cherry-picks to be useful.

Ideally, what I'd like to see is either: 1a) a minimal set of packaging changes required to bring us up to 0.7.3; or 1b) divergence and clean packaging for Ubuntu going forward, but including only packaging changes that make sense for us to carry; or 2) a rebase onto either Debian or upstream and the maintenance of a minimal delta as required.

But, I appreciate that we need to get 0.7.x in Lunar now for its TPM 2.0 support. And the above concerns are about future maintenance; the current branch does seem to work correctly for now in terms of the build output. So we can upload this as-is as a stop gap if necessary.

review: Needs Information

[Robie Basak (racb)]

(sorry Utkarsh; Christian asked in standup today that we look at this before you're back)

[Lena Voytek (lvoytek)]

Thanks for the review Robie!
The move of swtpm-localca is intentional for consistency with other binaries provided by swtpm-tools. I confirmed that this is working properly with lxc, with binaries in /usr/bin/ consisting of:
/usr/bin/swtpm /usr/bin/swtpm_bios /usr/bin/swtpm_cert /usr/bin/swtpm_ioctl /usr/bin/swtpm_localca /usr/bin/swtpm_setup

I agree that I cherry picked a bit too much for this version. I've gotten rid of the unneeded new files and updated the swtpm-tools.install file since the if statement is unnecessary. I think it's best to keep our changes low for now and ideally someday be more consistent with upstream once some fundamental differences are solved. Next cycle I'll try and get Debian and Ubuntu in sync (which this upload luckily helps with) to progress to that point.

[Robie Basak (racb)]

Thanks!

I verified that this update didn't change the list of files in the output binary packages on amd64, so I think we're good to go for now.

FTR, I also checked that your PPA orig tarball matches the official one from https://github.com/stefanberger/swtpm/archive/refs/tags/v0.7.3.tar.gz exactly. seeded-in-ubuntu reports nothing for swtpm, so I believe we can upload during the current Beta freeze safely, and the FFe is approved.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: racb, lvoytek
Uploaders: racb
MP auto-approved

review: Approve

[Robie Basak (racb)]

Sponsored.

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index a5c166f..3a1a923 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -31,5 +31,8 @@ A clear and concise description of what you expected to happen.
 - gnutls:
 - ...:
 
+**Log files**
+Please attach any log files. If using a VM and it was started with libvirt, attach the logfile  found in `/var/log/swtpm/libvirt/qemu/VM-NAME-swtpm.log`.
+
 **Additional context**
 Add any other context about the problem here.
diff --git a/.gitignore b/.gitignore
index 187d102..99680cb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,7 +8,6 @@
 *.la
 *.lo
 *.o
-*.patch
 *~
 .deps
 .libs
@@ -33,18 +32,17 @@ Makefile
 /missing
 /stamp-h1
 /swtpm-*.tar.gz
-/swtpm.spec
 /m4/*
 /.pc/*
-/etc/swtpm_setup.conf
 /patches/*
 /include/swtpm.h
 /man/man3/*.3
 /man/man8/*.8
+!/man/man8/swtpm-localca.8
 /samples/swtpm-create-user-config-files
 /samples/swtpm-localca
 /samples/swtpm-localca.conf
-/samples/swtpm_localca_conf.h
+/samples/swtpm_setup.conf
 /src/selinux/*.pp.bz2
 /src/selinux/swtpm.pp
 /src/selinux/swtpm_svirt.fc
@@ -57,6 +55,8 @@ Makefile
 /src/swtpm_bios/swtpm_bios
 /src/swtpm_cert/swtpm_cert
 /src/swtpm_ioctl/swtpm_ioctl
+/src/swtpm_localca/swtpm_localca
+/src/swtpm_localca/swtpm_localca_conf.h
 src/swtpm_setup/swtpm_setup
 src/swtpm_setup/swtpm_setup_conf.h
 /test-driver
@@ -65,6 +65,7 @@ tests/*.trs
 tests/test_config
 /debian/*debhelper*
 /debian/*substvars
+/debian/autoreconf.*
 /debian/files
 /debian/swtpm
 /debian/swtpm-cuse
diff --git a/.travis.yml b/.travis.yml
index e32a149..4b16e3c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,7 +18,6 @@ addons:
         - bash
         - dh-exec
         - python3-pip
-        - python3-twisted
         - libfuse-dev
         - libglib2.0-dev
         - libjson-glib-dev
diff --git a/CHANGES b/CHANGES
index 75a6170..04231fb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,40 +1,63 @@
 CHANGES - changes for swtpm
 
-version 0.6.3:
+version 0.7.3:
+  - swtpm:
+    - Use uint64_t in tlv_data_append() to avoid integer overflows
+    - Use uint64_t to avoid integer wrap-around when adding a uint32_t
+  - build-sys:
+    - Fix configure script to support _FORTIFY_SOURCE=3
+    - Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
+
+version 0.7.2:
   - swtpm:
     - Do not chdir(/) when using --daemon
   - swtpm-localca:
     - Re-implement variable resolution for swtpm-localca.conf
   - tests:
     - Use ${WORKDIR} in config files to test env. var replacement
-  - man:
+  - man pages:
     - Add missing .config directory to path description when using ${HOME}
   - build-sys:
     - Add probing for -fstack-protector
-    - configure: Fix typo TPM2 -> TMP2
 
-version 0.6.2:
+version 0.7.1:
   - swtpm:
     - Check header size indicator against expected size (CVE-2022-23645)
-  - swtpm-localca:
+  - swtpm_localca:
     - Test for available issuercert before creating CA
-  - swtpm_setup:
-    - Report stderr as returned by external tool (swtpm-localcal)
-    - Fix exit code on error to be '1'.
 
-version 0.6.1:
+version 0.7.0:
   - swtpm:
-    - Clear keys from stack and heap
-  - swtpm-localca:
-    - Add missing else branch for pkcs11 and PIN
+    - Support for linear file storage backend (file://)
+    - Report 'tpm-1.2' & 'tpm-2.0' in --print-capabilities depending what
+      libtpms supports
+    - Add implementation of SWTPM_HMAC using OpenSSL 3.0 APIs
+    - Wipe keys from stack and heap
+    - Many other small changes
+    - Make --daemon not racy
   - swtpm_setup:
-    - Initialize Gerror and free it
-    - Replace '\\s' in regex with [[:space:]] to fix cygwin
-  - tests:
-    - Kill tpm2-abrmd with SIGKILL rather SIGTERM
+    - Only activate SHA256 PCR bank, not SHA1 bank anymore by default
+    - Support for linear file storage backend (file://)
+    - Implement option --create-config-files to create config files
+    - Use non-deprecated APIs to contruct RSA key (OSSL 3)
+    - Report stderr as returned by external tool (swtpm-localcal)
+    - Replace '+' and ',' characters in VMId's to make work with
+      common name in X509 subject
+    - Add support for --reconfigure flag to change active PCR banks
+  - swtpm_localca:
+    - Created certificates for CAs and TPM that do not expire
+  - swtpm_cert:
+    - Allow passing -1 for days to get a non-expiring certificate
+  - test:
+    - ASAN-related test changes and skipping of tests if ASAN is used
+    - Fix tests using tpm2-abrmd by preventing concurrency
+    - Skip chardev related tests after checking for chardev support
+    - exit with error code if mktemp fails
+    - OSSL 3: Make TPM 1.2 test compile; skip IBM TSS 2 test
   - build-sys:
-    - Use -DOPENSSL_SUPPRESS_DEPRECATED to suppress deprecation warnings (OSSL 3)
-    - Enable configuring with CFLAGS and passing additional CFLAGS on build
+    - Introduce --enable-sanitizers to configure
+    - Remove check for pip3 that was used by python swtpm_setup
+    - Allow passing of aditional CFLAGS during build
 
 version 0.6.0:
   - swtpm:
diff --git a/INSTALL b/INSTALL
index 90d2d7d..5d9f3b0 100644
--- a/INSTALL
+++ b/INSTALL
@@ -13,12 +13,13 @@ Building and running the swtpm has dependencies on the following packages:
 - fuse-devel
 - glib2
 - glib2-devel
+- json-glib-devel
 - net-tools
 - python3
 - python3-twisted
 - selinux-policy-devel
+- socat
 - trousers
-- tpm-tools
 - gnutls
 - gnutls-devel
 - libtasn1
@@ -35,8 +36,8 @@ Debian/Ubuntu also needs the following packages to build:
 On RHEL or Fedora use either one of the following methods to install
 the above dependencies:
 
- - sudo dnf builddep ./dist/swtpm.spec  (Fedora >= 22)
- - sudo yum install yum-utils ; sudo yum-builddep ./dist/swtpm.spec  (RHEL and Fedora <= 21)
+ - sudo dnf builddep ./swtpm.spec  (Fedora >= 22)
+ - sudo yum install yum-utils ; sudo yum-builddep ./swtpm.spec  (RHEL and Fedora <= 21)
  - sudo yum install <package name(s)>
 
 On Ubuntu use the following command:
diff --git a/Makefile.am b/Makefile.am
index 096052e..25c3068 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -5,7 +5,6 @@
 #
 
 SUBDIRS   = \
-	etc \
 	include \
 	man \
 	samples \
diff --git a/configure.ac b/configure.ac
index aa5bbfc..ccae445 100644
--- a/configure.ac
+++ b/configure.ac
@@ -23,7 +23,7 @@
 #       This file is derived from tpm-tool's configure.in.
 #
 
-AC_INIT([swtpm], [0.6.3])
+AC_INIT([swtpm],[0.7.3])
 AC_PREREQ([2.69])
 AC_CONFIG_SRCDIR(Makefile.am)
 AC_CONFIG_HEADERS([config.h])
@@ -125,12 +125,17 @@ fi
 if test "x$prefix" = "xNONE"; then
 	prefix="/usr/local"
 fi
+if test "x$exec_prefix" = "xNONE"; then
+	exec_prefix=$prefix
+fi
 SYSCONFDIR=`eval echo $sysconfdir`
 DATAROOTDIR=`eval echo $datarootdir`
 LOCALSTATEDIR=`eval echo $localstatedir`
+BINDIR=`eval echo $bindir`
 AC_SUBST([SYSCONFDIR])
 AC_SUBST([DATAROOTDIR])
 AC_SUBST([LOCALSTATEDIR])
+AC_SUBST([BINDIR])
 
 cryptolib=openssl
 
@@ -151,8 +156,6 @@ openssl)
 	AC_MSG_RESULT([Building with openssl crypto library])
 	LIBCRYPTO_LIBS=$(pkg-config --libs libcrypto)
 	AC_SUBST([LIBCRYPTO_LIBS])
-	LIBCRYPTO_EXTRA_CFLAGS="-DOPENSSL_SUPPRESS_DEPRECATED"
-	AC_SUBST([LIBCRYPTO_EXTRA_CFLAGS])
 	;;
 esac
 
@@ -237,7 +240,7 @@ AC_SUBST([GLIB_CFLAGS])
 
 GLIB_LIBS=$(pkg-config --libs glib-2.0)
 if test $? -ne 0; then
-   AC_MSG_ERROR("Is libglib-2.0-dev/glib2-devel installed? -- could not get cflags")
+   AC_MSG_ERROR("Is libglib-2.0-dev/glib2-devel installed? -- could not get libs")
 fi
 AC_SUBST([GLIB_LIBS])
 
@@ -343,6 +346,29 @@ fi
 AM_CONDITIONAL([WITH_GNUTLS], [test "x$with_gnutls" = "xyes"])
 AC_SUBST([GNUTLS_LIBS])
 
+DEFAULT_PCR_BANKS="sha256"
+AC_ARG_ENABLE([default-pcr-banks],
+              AS_HELP_STRING(
+                  [--enable-default-pcr-banks=list of PCR banks],
+                  [Have swtpm_setup activate the given PCR banks by default;
+                  default is sha256]
+              ),
+              [],
+              []
+)
+
+if test "x$enable_default_pcr_banks" != "x"; then
+    DEFAULT_PCR_BANKS="$enable_default_pcr_banks"
+fi
+AC_MSG_CHECKING([which PCR banks to activate by default])
+REGEX="^(sha1|sha256|sha384|sha512)(,(sha1|sha256|sha384|sha512)){0,3}\$"
+if bash -c "[[[ $DEFAULT_PCR_BANKS =~ $REGEX ]]] && exit 0 || exit 1"; then
+	AC_MSG_RESULT([$DEFAULT_PCR_BANKS])
+else
+	AC_MSG_ERROR([$DEFAULT_PCR_BANKS is an invalid list of PCR banks])
+fi
+AC_SUBST([DEFAULT_PCR_BANKS])
+
 AC_PATH_PROG([EXPECT], expect)
 if test "x$EXPECT" = "x"; then
 	AC_MSG_ERROR([expect is required: expect package])
@@ -370,16 +396,6 @@ fi
 
 AM_PATH_PYTHON([3.3])
 
-AC_PATH_PROG([PIP3], pip3)
-if test "x$PIP3" = "x"; then
-	AC_PATH_PROG([PIP3], pip)
-	if test "x$PIP3" = "x"; then
-		AC_MSG_WARN([pip3 is required to uninstall the built package])
-	else
-		AC_MSG_WARN([Using pip as pip3 tool])
-	fi
-fi
-
 AC_ARG_ENABLE([hardening],
   AS_HELP_STRING([--disable-hardening], [Disable hardening flags]))
 
@@ -394,11 +410,10 @@ if test "x$enable_hardening" != "xno"; then
 		HARDENING_CFLAGS="-fstack-protector-strong -Wstack-protector"
 	fi
 
-	dnl Must not have -O0 but must have a -O for -D_FORTIFY_SOURCE=2
-	TMP1="$(echo $CFLAGS | sed -n 's/.*\(-O0\).*/\1/p')"
-	TMP2="$(echo $CFLAGS | sed -n 's/.*\(-O\).*/\1/p')"
-	if test -z "$TMP1" && test -n "$TMP2"; then
-		HARDENING_CFLAGS="$HARDENING_CFLAGS -D_FORTIFY_SOURCE=2 "
+	dnl Only support -D_FORTIFY_SOURCE=2 and have higher levels passed in by user
+	dnl since they may create more overhead
+	if $CC $CFLAGS -Werror -D_FORTIFY_SOURCE=2 $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null; then
+		HARDENING_CFLAGS="$HARDENING_CFLAGS -D_FORTIFY_SOURCE=2"
 	fi
 	dnl Check linker for 'relro' and 'now'
 	save_CFLAGS="$CFLAGS"
@@ -431,6 +446,23 @@ if test "x$enable_test_coverage" = "xyes"; then
 	COVERAGE_LDFLAGS="-fprofile-arcs"
 fi
 
+AC_ARG_ENABLE([sanitizers],
+  AS_HELP_STRING([--enable-sanitizers], [Enable address/undefined sanitizers]))
+
+if test "x$enable_sanitizers" = "xyes"; then
+	save_CFLAGS="$CFLAGS"
+	CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
+	AC_MSG_CHECKING([whether linker supports sanitizer])
+	AC_LINK_IFELSE(
+		[AC_LANG_SOURCE([[int main() { return 0; }]])],
+		[SANITIZER_CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
+		 SANITIZER_LDFLAGS="-fsanitize=address,undefined"
+		 AC_MSG_RESULT(yes)],
+		[AC_MSG_RESULT(no)]
+	)
+	CFLAGS="$save_CFLAGS"
+fi
+
 AC_ARG_WITH([tss-user],
             AS_HELP_STRING([--with-tss-user=TSS_USER],[The tss user to use]),
             [TSS_USER="$withval"],
@@ -466,9 +498,9 @@ AC_SUBST([TSS_GROUP])
 CFLAGS="$CFLAGS -Wreturn-type -Wsign-compare -Wswitch-enum"
 CFLAGS="$CFLAGS -Wmissing-prototypes -Wall -Werror"
 CFLAGS="$CFLAGS -Wformat -Wformat-security"
-CFLAGS="$CFLAGS $GNUTLS_CFLAGS $COVERAGE_CFLAGS"
+CFLAGS="$CFLAGS $GNUTLS_CFLAGS $COVERAGE_CFLAGS $SANITIZER_CFLAGS"
 
-LDFLAGS="$LDFLAGS $COVERAGE_LDFLAGS"
+LDFLAGS="$LDFLAGS $COVERAGE_LDFLAGS $SANITIZER_LDFLAGS"
 
 dnl Simulate the following for systems with pkg-config < 0.28:
 dnl PKG_CHECK_VAR([libtpms_cryptolib], [libtpms], [cryptolib],
@@ -500,11 +532,6 @@ linux-*)
                      [whether to build in vTPM proxy support (Linux only)])
 esac
 
-case $host_os in
-cygwin)
-  CFLAGS="$CFLAGS -D__USE_LINUX_IOCTL_DEFS"
-esac
-
 dnl Seccomp profile using -lseccomp (Linux only)
 case $host_os in
 linux-*)
@@ -545,12 +572,10 @@ AC_SUBST([MY_LDFLAGS])
 AC_CONFIG_FILES([Makefile                   \
 		debian/swtpm-tools.postinst \
 		swtpm.spec                  \
-		etc/Makefile                \
-		etc/swtpm_setup.conf        \
 		samples/Makefile            \
 		samples/swtpm-localca.conf  \
 		samples/swtpm-create-user-config-files \
-		samples/swtpm_localca_conf.h \
+		samples/swtpm_setup.conf    \
 		include/Makefile            \
 		include/swtpm/Makefile      \
 		include/swtpm.h             \
@@ -560,6 +585,8 @@ AC_CONFIG_FILES([Makefile                   \
 		src/swtpm_bios/Makefile     \
 		src/swtpm_cert/Makefile     \
 		src/swtpm_ioctl/Makefile    \
+		src/swtpm_localca/Makefile  \
+		src/swtpm_localca/swtpm_localca_conf.h \
 		src/swtpm_setup/Makefile    \
 		src/swtpm_setup/swtpm_setup_conf.h \
 		src/utils/Makefile          \
@@ -569,6 +596,8 @@ AC_CONFIG_FILES([Makefile                   \
 		tests/Makefile              \
 		tests/test_config           \
 		])
+AC_CONFIG_FILES([samples/swtpm-localca],
+                [chmod 755 samples/swtpm-localca])
 AC_OUTPUT
 
 echo
@@ -578,6 +607,8 @@ printf "with_cuse       : %5s  (no = no CUSE interface)\n" $with_cuse
 printf "with_chardev    : %5s  (no = no chardev interface)\n" $with_chardev
 printf "with_vtpm_proxy : %5s  (no = no vtpm proxy support; Linux only)\n" $with_vtpm_proxy
 printf "with_seccomp    : %5s  (no = no seccomp profile; Linux only)\n" $with_seccomp
+printf "\n"
+printf "active PCR banks  : %s\n" $DEFAULT_PCR_BANKS
 echo
 echo "Version to build  : $PACKAGE_VERSION"
 echo "Crypto library    : $cryptolib"
diff --git a/debian/changelog b/debian/changelog
index 23a49b3..8f3d87c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+swtpm (0.7.3-0ubuntu1) lunar; urgency=medium
+
+  * New upstream release 0.7.3:
+    - Bug fixes include:
+      + Fix secure boot failure - TPM 2.0 not supported (LP: #2012028)
+  * Add new debian/ files from upstream
+    - d/clean: Clean man and gch files from source tree during build
+    - d/not-installed: Do not install .la lib files with package
+    - d/swtpm-libs.install: Install swtpm .so files with swtpm-libs package
+  * d/rules: Add dh_clean and dh_makeshlibs overrides from upstream
+  * d/swtpm-tools.install: Update installation of swtpm-tools files for 0.7
+  * d/control: Remove unneeded dependencies for 0.7
+  * Remove d/p/0001-Install-swtpm-localca-to-the-correct-path.patch as it is
+    no longer needed to change swtpm-localca's path
+  * d/p/no-autoconf-in-debian.patch: Refresh to clean fuzz
+  * d/p/openssl-not-certtool.patch: Update and refresh to apply with 0.7
+
+ -- Lena Voytek <[e-mail]>  Wed, 22 Mar 2023 14:03:19 -0700
+
 swtpm (0.6.3-0ubuntu5) lunar; urgency=medium
 
   * d/usr.bin.swtpm: Allow swtpm to also access /run/libvirt/qemu/swtpm/*.pid
diff --git a/debian/clean b/debian/clean
new file mode 100644
index 0000000..494005d
--- /dev/null
+++ b/debian/clean
@@ -0,0 +1,3 @@
+include/swtpm/*.gch
+man/*/*.3
+man/*/*.8
diff --git a/debian/control b/debian/control
index a62d3d8..429a050 100644
--- a/debian/control
+++ b/debian/control
@@ -10,11 +10,9 @@ Build-Depends: libtool,
 	       libfuse-dev,
 	       libglib2.0-dev,
 	       libjson-glib-dev,
-	       libgmp-dev,
 	       expect,
 	       libtasn1-dev,
 	       socat,
-	       python3-twisted,
 	       gnutls-dev,
 	       gnutls-bin,
 	       libssl-dev,
diff --git a/debian/patches/0001-Install-swtpm-localca-to-the-correct-path.patch b/debian/patches/0001-Install-swtpm-localca-to-the-correct-path.patch
deleted file mode 100644
index 990d2dd..0000000
--- a/debian/patches/0001-Install-swtpm-localca-to-the-correct-path.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From e2e987443d475f472d50150aaf4aa87ebf584003 Mon Sep 17 00:00:00 2001
-From: Steve Langasek <[e-mail]>
-Date: Sat, 23 Oct 2021 01:14:23 -0700
-Subject: [PATCH] Install swtpm-localca to the correct path.
-
-This is an auxiliary executable, not data; it belongs in the libexecdir
-path, not datarootdir.
----
- configure.ac                          | 8 ++++----
- etc/swtpm_setup.conf.in               | 2 +-
- src/swtpm_setup/swtpm_setup_conf.h.in | 2 +-
- src/swtpm_setup/swtpm_setup_utils.c   | 2 +-
- 4 files changed, 7 insertions(+), 7 deletions(-)
-
-Index: swtpm/configure.ac
-===================================================================
---- swtpm.orig/configure.ac
-+++ swtpm/configure.ac
-@@ -116,8 +116,8 @@
- if test "$prefix" = "/usr" && test "$sysconfdir" = '${prefix}/etc'; then
- 	sysconfdir="/etc"
- fi
--if test "$prefix" = "" && test "$datarootdir" = '${prefix}/share'; then
--	datarootdir="/usr/share"
-+if test "$prefix" = "" && test "$libexecdir" = '${prefix}/libexec'; then
-+	libexecdir="/usr/libexec"
- fi
- if test "$prefix" = "/usr" && test "$localstatedir" = '${prefix}/var'; then
- 	localstatedir="/var"
-@@ -126,10 +126,10 @@
- 	prefix="/usr/local"
- fi
- SYSCONFDIR=`eval echo $sysconfdir`
--DATAROOTDIR=`eval echo $datarootdir`
-+LIBEXECDIR=`eval echo $libexecdir`
- LOCALSTATEDIR=`eval echo $localstatedir`
- AC_SUBST([SYSCONFDIR])
--AC_SUBST([DATAROOTDIR])
-+AC_SUBST([LIBEXECDIR])
- AC_SUBST([LOCALSTATEDIR])
- 
- cryptolib=openssl
-Index: swtpm/etc/swtpm_setup.conf.in
-===================================================================
---- swtpm.orig/etc/swtpm_setup.conf.in
-+++ swtpm/etc/swtpm_setup.conf.in
-@@ -1,4 +1,4 @@
- # Program invoked for creating certificates
--create_certs_tool= @DATAROOTDIR@/swtpm/swtpm-localca
-+create_certs_tool= @LIBEXECDIR@/swtpm/swtpm-localca
- create_certs_tool_config = @SYSCONFDIR@/swtpm-localca.conf
- create_certs_tool_options = @SYSCONFDIR@/swtpm-localca.options
-Index: swtpm/samples/Makefile.am
-===================================================================
---- swtpm.orig/samples/Makefile.am
-+++ swtpm/samples/Makefile.am
-@@ -7,7 +7,7 @@
- samplesconfdir = $(datadir)/@PACKAGE@
- samplessysconfdir = $(sysconfdir)
- # swtpm-localca was always installed in /usr/samples/swtpm-localca
--bindir = $(samplesconfdir)
-+bindir = $(pkglibexecdir)
- 
- samplesconf_SCRIPTS = \
- 	swtpm-create-tpmca \
diff --git a/debian/patches/no-autoconf-in-debian.patch b/debian/patches/no-autoconf-in-debian.patch
index 7f78e71..ed0cf52 100644
--- a/debian/patches/no-autoconf-in-debian.patch
+++ b/debian/patches/no-autoconf-in-debian.patch
@@ -4,15 +4,13 @@ Description: don't modify debian directory from upstream configure script
 Author: Steve Langasek <[e-mail]>
 Last-Update: 2021-10-23
 
-Index: swtpm/configure.ac
-===================================================================
---- swtpm.orig/configure.ac
-+++ swtpm/configure.ac
-@@ -540,7 +540,6 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -570,7 +570,6 @@
  AC_SUBST([MY_LDFLAGS])
  
  AC_CONFIG_FILES([Makefile                   \
 -		debian/swtpm-tools.postinst \
  		swtpm.spec                  \
- 		etc/Makefile                \
- 		etc/swtpm_setup.conf        \
+ 		samples/Makefile            \
+ 		samples/swtpm-localca.conf  \
diff --git a/debian/patches/openssl-not-certtool.patch b/debian/patches/openssl-not-certtool.patch
index 77eb269..0e2c975 100644
--- a/debian/patches/openssl-not-certtool.patch
+++ b/debian/patches/openssl-not-certtool.patch
@@ -14,7 +14,7 @@ Last-Update: 2021-11-05
 
 --- a/configure.ac
 +++ b/configure.ac
-@@ -310,6 +310,11 @@ if test "x$with_gnutls" != "xno"; then
+@@ -313,6 +313,11 @@
      AC_MSG_RESULT([yes])
  fi
  
@@ -26,9 +26,9 @@ Last-Update: 2021-11-05
  if test "x$with_gnutls" != "xno"; then
      ORIG_CFLAGS="$CFLAGS"
      GNUTLS_CFLAGS=$(pkg-config gnutls --cflags)
---- a/man/man8/swtpm-localca.pod
-+++ b/man/man8/swtpm-localca.pod
-@@ -28,12 +28,6 @@ swtpm-localca-rootca-cert.pem respective
+--- a/man/man8/swtpm_localca.pod
++++ b/man/man8/swtpm_localca.pod
+@@ -28,12 +28,6 @@
  SWTPM_ROOTCA_PASSWORD can be set for the password of the root CA's
  private key.
  
@@ -41,9 +41,9 @@ Last-Update: 2021-11-05
  The following options are supported:
  
  =over 4
---- a/samples/swtpm_localca.c
-+++ b/samples/swtpm_localca.c
-@@ -39,11 +39,7 @@ gchar *gl_LOGFILE = NULL;
+--- a/src/swtpm_localca/swtpm_localca.c
++++ b/src/swtpm_localca/swtpm_localca.c
+@@ -39,11 +39,7 @@
  #define LOCALCA_OPTIONS "swtpm-localca.options"
  #define LOCALCA_CONFIG  "swtpm-localca.conf"
  
@@ -56,8 +56,8 @@ Last-Update: 2021-11-05
  
  /* initialize the path of the options and config files */
  static int init(gchar **options_file, gchar **config_file)
-@@ -83,10 +79,10 @@ static int init(gchar **options_file, gc
-     return ret;
+@@ -65,10 +61,10 @@
+     return 0;
  }
  
 -/* Run the certtool command line prepared in cmd. Display error message
@@ -69,7 +69,7 @@ Last-Update: 2021-11-05
  {
      g_autofree gchar *standard_error = NULL;
      gint exit_status;
-@@ -120,11 +116,12 @@ static int create_localca_cert(const gch
+@@ -102,11 +98,12 @@
      int lockfd;
      int ret = 1;
      struct stat statbuf;
@@ -87,7 +87,7 @@ Last-Update: 2021-11-05
  
      lockfd = lock_file(lockfile);
      if (lockfd < 0)
-@@ -140,25 +137,36 @@ static int create_localca_cert(const gch
+@@ -122,25 +119,36 @@
          g_autofree gchar *cakey = g_strjoin(G_DIR_SEPARATOR_S, directory, "swtpm-localca-rootca-privkey.pem", NULL);
          g_autofree gchar *cacert = g_strjoin(G_DIR_SEPARATOR_S, directory, "swtpm-localca-rootca-cert.pem", NULL);
          const gchar *swtpm_rootca_password = g_getenv("SWTPM_ROOTCA_PASSWORD");
@@ -129,7 +129,7 @@ Last-Update: 2021-11-05
              goto error;
  
          if (chmod(cakey, S_IRUSR | S_IWUSR | S_IRGRP) != 0) {
-@@ -166,32 +174,71 @@ static int create_localca_cert(const gch
+@@ -148,32 +156,71 @@
              goto error;
          }
  
@@ -151,7 +151,7 @@ Last-Update: 2021-11-05
 -        filecontent = "cn=swtpm-localca-rootca\n"
 -                      "ca\n"
 -                      "cert_signing_key\n"
--                      "expiration_days = 3600\n";
+-                      "expiration_days = -1\n";
 -        template1_file_fd = write_to_tempfile(&template1_file,
 -                                              (const unsigned char *)filecontent, strlen(filecontent));
 -        if (template1_file_fd < 0)
@@ -216,7 +216,7 @@ Last-Update: 2021-11-05
              goto error;
  
          g_free(cmd);
-@@ -199,13 +246,22 @@ static int create_localca_cert(const gch
+@@ -181,13 +228,22 @@
          /* create the intermediate CA's key */
          cmd = concat_arrays(NULL,
                              (gchar *[]) {
@@ -244,14 +244,14 @@ Last-Update: 2021-11-05
              goto error;
  
          if (chmod(signkey, S_IRUSR | S_IWUSR | S_IRGRP) != 0) {
-@@ -213,54 +269,67 @@ static int create_localca_cert(const gch
+@@ -195,54 +251,67 @@
              goto error;
          }
  
 -        filecontent = "cn=swtpm-localca\n"
 -                      "ca\n"
 -                      "cert_signing_key\n"
--                      "expiration_days = 3600\n";
+-                      "expiration_days = -1\n";
 -        if (swtpm_rootca_password != NULL && signkey_password != NULL)
 -            fc = g_strdup_printf("%spassword = %s\n", filecontent, swtpm_rootca_password);
 -        else
@@ -347,7 +347,7 @@ Last-Update: 2021-11-05
  
 --- a/tests/test_swtpm_setup_create_cert
 +++ b/tests/test_swtpm_setup_create_cert
-@@ -98,7 +98,7 @@ if [ ! -r "${CERTSERIAL}" ]; then
+@@ -97,7 +97,7 @@
  	exit 1
  fi
  
@@ -356,9 +356,9 @@ Last-Update: 2021-11-05
  	echo "Error: Root CA's private key should be encrypted"
  	cat ${workdir}/swtpm-localca-rootca-privkey.pem
  	exit 1
---- a/tests/test_tpm2_samples_swtpm_localca
-+++ b/tests/test_tpm2_samples_swtpm_localca
-@@ -75,24 +75,24 @@ do
+--- a/tests/test_tpm2_swtpm_localca
++++ b/tests/test_tpm2_swtpm_localca
+@@ -75,24 +75,24 @@
    fi
  
    # Signing key should always be password protected
@@ -387,7 +387,7 @@ Last-Update: 2021-11-05
    fi
  
    if [ ! -r "${workdir}/ek.cert" ]; then
-@@ -133,7 +133,7 @@ do
+@@ -133,7 +133,7 @@
    fi
  
    # Delete all keys to have CA re-created
@@ -398,10 +398,10 @@ Last-Update: 2021-11-05
  echo "Test 1: OK"
 --- a/tests/test_tpm2_swtpm_setup_create_cert
 +++ b/tests/test_tpm2_swtpm_setup_create_cert
-@@ -102,6 +102,7 @@ for keysize in $(echo $keysizes); do
+@@ -118,6 +118,7 @@
  	fi
  
- 	rm -rf ${SIGNINGKEY} ${ISSUERCERT} ${CERTSERIAL}
+ 	rm -rf "${SIGNINGKEY}" "${ISSUERCERT}" "${CERTSERIAL}" ${USER_CERTSDIR}/ek-*.crt
 +	rm -rf "$workdir/serial" "$workdir/index.txt"
  done
  
diff --git a/debian/patches/series b/debian/patches/series
index 96cf98d..13a3a26 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,2 @@
-0001-Install-swtpm-localca-to-the-correct-path.patch
 no-autoconf-in-debian.patch
 openssl-not-certtool.patch
diff --git a/debian/rules b/debian/rules
index 030599d..23735cf 100755
--- a/debian/rules
+++ b/debian/rules
@@ -16,3 +16,9 @@ override_dh_auto_test:
 ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
 	SWTPM_TEST_SECCOMP_OPT="--seccomp action=none" make -j4 check VERBOSE=1
 endif
+
+override_dh_clean:
+	dh_clean --exclude=man/man8/swtpm-localca.8
+
+override_dh_makeshlibs:
+	dh_makeshlibs --no-scripts
diff --git a/debian/swtpm-tools.install b/debian/swtpm-tools.install
index 48b9c42..d0aae01 100644
--- a/debian/swtpm-tools.install
+++ b/debian/swtpm-tools.install
@@ -2,17 +2,20 @@
 /usr/bin/swtpm_cert
 /usr/bin/swtpm_setup
 /usr/bin/swtpm_ioctl
+/usr/bin/swtpm_localca
 /usr/share/man/man8/swtpm_bios.8*
 /usr/share/man/man8/swtpm_cert.8*
 /usr/share/man/man8/swtpm_ioctl.8*
+/usr/share/man/man8/swtpm_localca.8*
+/usr/share/man/man8/swtpm-create-tpmca.8*
 /usr/share/man/man8/swtpm-localca.conf.8*
 /usr/share/man/man8/swtpm-localca.options.8*
 /usr/share/man/man8/swtpm-localca.8*
 /usr/share/man/man8/swtpm_setup.8*
 /usr/share/man/man8/swtpm_setup.conf.8*
-/usr/share/man/man8/swtpm_setup.sh.8*
-/usr/lib/*/swtpm/swtpm-localca
+/usr/share/swtpm/swtpm-create-tpmca
 /usr/share/swtpm/swtpm-create-user-config-files
+/usr/share/swtpm/swtpm-localca
 /etc/swtpm-localca.conf
 /etc/swtpm-localca.options
 /etc/swtpm_setup.conf
diff --git a/etc/Makefile.am b/etc/Makefile.am
deleted file mode 100644
index 94db65b..0000000
--- a/etc/Makefile.am
+++ /dev/null
@@ -1,13 +0,0 @@
-#
-# etc/Makefile.am
-#
-# For the license, see the LICENSE file in the root directory.
-#
-
-swtpmsysconfdir = $(sysconfdir)
-
-swtpmsysconf_DATA = \
-	swtpm_setup.conf
-
-EXTRA_DIST= \
-	swtpm_setup.conf
diff --git a/include/Makefile.am b/include/Makefile.am
index 584cf4b..80c1c34 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -7,7 +7,9 @@
 SUBDIRS = swtpm
 
 noinst_HEADERS = \
+	compiler_dependencies.h \
 	sys_dependencies.h
 
 EXTRA_DIST = \
+	compiler_dependencies.h \
 	sys_dependencies.h
diff --git a/include/compiler_dependencies.h b/include/compiler_dependencies.h
new file mode 100644
index 0000000..97129f1
--- /dev/null
+++ b/include/compiler_dependencies.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/*
+ * compiler_dependencies.h: Compiler-dependent defines etc.
+ *
+ * Author: Stefan Berger, [e-mail]
+ *
+ * Copyright (c) IBM Corporation, 2021
+ */
+
+#ifndef _SWTPM_COMPILER_DEPENDENCIES_H
+#define _SWTPM_COMPILER_DEPENDENCIES_H
+
+#ifdef __GNUC__ /* gcc and clang */
+# define SWTPM_ATTR_UNUSED __attribute__((unused))
+#endif
+
+#endif /* _SWTPM_COMPILER_DEPENDENCIES_H */
diff --git a/include/swtpm/tpm_ioctl.h b/include/swtpm/tpm_ioctl.h
index 4316a1f..0093a7c 100644
--- a/include/swtpm/tpm_ioctl.h
+++ b/include/swtpm/tpm_ioctl.h
@@ -8,6 +8,10 @@
 #ifndef _TPM_IOCTL_H_
 #define _TPM_IOCTL_H_
 
+#if defined(__CYGWIN__)
+# define __USE_LINUX_IOCTL_DEFS
+#endif
+
 #include <stdint.h>
 #include <sys/uio.h>
 #include <sys/types.h>
diff --git a/include/sys_dependencies.h b/include/sys_dependencies.h
index dbda445..7871c08 100644
--- a/include/sys_dependencies.h
+++ b/include/sys_dependencies.h
@@ -58,6 +58,14 @@
 # define htobe32(x) OSSwapHostToBigInt32(x)
 # define htobe64(x) OSSwapHostToBigInt64(x)
 
+# define le16toh(x) OSSwapLittleToHostInt16(x)
+# define le32toh(x) OSSwapLittleToHostInt32(x)
+# define le64toh(x) OSSwapLittleToHostInt64(x)
+
+# define htole16(x) OSSwapHostToLittleInt16(x)
+# define htole32(x) OSSwapHostToLittleInt32(x)
+# define htole64(x) OSSwapHostToLittleInt64(x)
+
 #else
 # include <endian.h>
 #endif
diff --git a/man/man8/Makefile.am b/man/man8/Makefile.am
index 5644a46..1869b3d 100644
--- a/man/man8/Makefile.am
+++ b/man/man8/Makefile.am
@@ -11,37 +11,43 @@ man8_PODS = \
 	swtpm_cert.pod \
 	swtpm_cuse.pod \
 	swtpm_ioctl.pod \
+	swtpm_localca.pod \
 	swtpm_setup.pod \
-	swtpm_setup.conf.pod
+	swtpm_setup.conf.pod \
 	swtpm-create-tpmca.pod \
-	swtpm-localca.pod \
 	swtpm-localca.options.pod \
 	swtpm-localca.conf.pod
 
-man8_MANS = \
+man8_generated_MANS = \
 	swtpm.8 \
 	swtpm_bios.8 \
 	swtpm_cert.8 \
 	swtpm_ioctl.8 \
+	swtpm_localca.8 \
 	swtpm_setup.8 \
 	swtpm_setup.conf.8 \
-	swtpm_setup.sh.8 \
 	swtpm-create-tpmca.8 \
-	swtpm-localca.8 \
 	swtpm-localca.options.8 \
 	swtpm-localca.conf.8
 
 if WITH_CUSE
-man8_MANS += \
+man8_generated_MANS += \
 	swtpm_cuse.8
 endif
 
+man8_static_MANS = \
+	swtpm-localca.8
+
+man8_MANS = \
+	$(man8_generated_MANS) \
+	$(man8_static_MANS)
+
 %.8 : %.pod
 	@pod2man -r "swtpm" \
 		-c "" \
 		-n $(basename $@) \
 		--section=8 $< > $@
 
-EXTRA_DIST = $(man8_MANS) $(man8_PODS)
+EXTRA_DIST = $(man8_static_MANS) $(man8_PODS)
 
-CLEANFILES = swtpm_cuse.8
+CLEANFILES = $(man8_generated_MANS)
diff --git a/man/man8/swtpm-create-tpmca.pod b/man/man8/swtpm-create-tpmca.pod
index 13647ff..36caad6 100644
--- a/man/man8/swtpm-create-tpmca.pod
+++ b/man/man8/swtpm-create-tpmca.pod
@@ -1,6 +1,6 @@
 =head1 NAME
 
-swtpm-create-tpmca
+swtpm-create-tpmca - Tool to create a local CA for swtpm_localca
 
 =head1 SYNOPSIS
 
@@ -9,7 +9,7 @@ B<swtpm-create-tpmca [OPTIONS]>
 =head1 DESCRIPTION
 
 B<swtpm-create-tpmca> is a tool to create a TPM 1.2 based CA that
-can be used by B<swtpm-localca> to sign EK and platform certificates.
+can be used by B<swtpm_localca> to sign EK and platform certificates.
 The CA uses a GnuTLS key to sign certificates. To do this,
 GnuTLS talks to the TPM 1.2 using the B<tcsd> (TrouSerS) daemon.
 
@@ -41,7 +41,7 @@ Overwrite the contents of the output directory.
 =item B<--register>
 
 Register the key with TCSD. For the key to be available for signing,
-the same user that created the TPM CA has to run the swtpm-localca
+the same user that created the TPM CA has to run the swtpm_localca tool
 later on. If this option is not passed, the private key is written
 into a file and can be used by others as well.
 
@@ -109,7 +109,7 @@ Display the help screen and exit.
 =head1 EXAMPLE
 
 The following example creates an intermediate TPM CA and writes the keys
-into /var/lib/swtpm-localca and the swtpm-localca configuration to
+into /var/lib/swtpm-localca and the swtpm_localca configuration to
 /etc/swtpm-localca.conf. It can then be used for signing certificates of
 newly created B<swtpm> TPMs.
 
@@ -161,7 +161,7 @@ parameter.
 
 To test either one of the above TPM CAs, run the following command:
 
- #> /usr/share/swtpm/swtpm-localca \
+ #> swtpm_localca \
 	--type ek --ek x=11,y=13 \
 	--dir /tmp --vmid test --tpm2 \
 	--tpm-spec-family 2.0 --tpm-spec-revision 146 --tpm-spec-level 00 \
@@ -185,7 +185,7 @@ certificates since the TPM does not accept authenticated commands.
 
 =head1 SEE ALSO
 
-B<swtpm-localca>, B<swtpm-localca.conf>, B<tcsd>
+B<swtpm_localca>, B<swtpm-localca.conf>, B<tcsd>
 
 =head1 REPORTING BUGS
 
diff --git a/man/man8/swtpm-localca.8 b/man/man8/swtpm-localca.8
new file mode 100644
index 0000000..a9d3f4b
--- /dev/null
+++ b/man/man8/swtpm-localca.8
@@ -0,0 +1 @@
+.so man8/swtpm_localca.8
diff --git a/man/man8/swtpm-localca.conf.pod b/man/man8/swtpm-localca.conf.pod
index a0e3ac3..10933dc 100644
--- a/man/man8/swtpm-localca.conf.pod
+++ b/man/man8/swtpm-localca.conf.pod
@@ -1,11 +1,11 @@
 =head1 NAME
 
-swtpm-localca.conf - Configuration file for swtpm-localca
+swtpm-localca.conf - Configuration file for swtpm_localca
 
 =head1 DESCRIPTION
 
 The file I</etc/swtpm-localca.conf> contains configuration variables
-for the I<swtpm-localca> program.
+for the I<swtpm_localca> program.
 
 Entries may contain environment variables that will be resolved. All
 environment variables must be formatted like this: '${varname}'.
@@ -82,7 +82,7 @@ With a PKCS11 URI it may look like this:
 
 =head1 SEE ALSO
 
-B<swtpm-localca>
+B<swtpm_localca>
 
 =head1 REPORTING BUGS
 
diff --git a/man/man8/swtpm-localca.options.pod b/man/man8/swtpm-localca.options.pod
index f2f2872..ff71277 100644
--- a/man/man8/swtpm-localca.options.pod
+++ b/man/man8/swtpm-localca.options.pod
@@ -1,6 +1,6 @@
 =head1 NAME
 
-swtpm-localca.options - Options file for swtpm-localca
+swtpm-localca.options - Options file for swtpm_localca
 
 =head1 DESCRIPTION
 
@@ -23,7 +23,7 @@ An example I<swtpm-localca.options> file may look as follows:
 
 =head1 SEE ALSO
 
-B<swtpm-localca>
+B<swtpm_localca>
 
 =head1 REPORTING BUGS
 
diff --git a/man/man8/swtpm.pod b/man/man8/swtpm.pod
index b5e72f5..7879d7c 100644
--- a/man/man8/swtpm.pod
+++ b/man/man8/swtpm.pod
@@ -150,14 +150,23 @@ The following options are support by all interfaces:
 
 =over 4
 
-=item B<--tpmstate dir=E<lt>dirE<gt>[,mode=E<lt>0...E<gt>]>
+=item B<--tpmstate dir=E<lt>dirE<gt>[,mode=E<lt>0...E<gt>]|backend-uri=E<lt>uriE<gt>>
 
 Use the given path rather than using the environment variable TPM_PATH.
 
-The TPM state files will be written with the given file mode bits.
-This value must be given as an octal number starting with a '0'.
+If I<dir> is specified, the TPM state files will be written to the I<dir> with
+the given file I<mode> bits. This value must be given as an octal number starting with a '0'.
 The default value is 0640.
 
+If I<backend-uri> is specified, the TPM state data will be stored to the URI.
+Currently I<backend-uri=dir://<path_to_dir>> and I<backend-uri=file://<path_to_dir>>
+are available. For 'dir://', the URI should specify the path to the directory where
+files are stored. If I<path_to_dir> starts with a '/' then the path is interpreted
+as an absolute path, otherwise it is a path relative to the current directory.
+For 'file://', the URI should specify a single file or block device where TPM state
+will be stored. A blockdevice must exist already and be big enough to store all
+state. (since v0.7)
+
 =item B<--tpm2>
 
 Choose TPM 2 functionality; by default a TPM 1.2 is chosen.
@@ -290,51 +299,107 @@ may contain the following:
     {
       "type": "swtpm",
       "features": [
+        "tpm-1.2",
+        "tpm-2.0",
         "cmdarg-seccomp",
         "cmdarg-key-fd",
         "cmdarg-pwd-fd",
+        "cmdarg-print-states",
+        "nvram-backend-dir",
+        "nvram-backend-file",
         "tpm-send-command-header",
         "flags-opt-startup",
         "rsa-keysize-1024",
         "rsa-keysize-2048",
         "rsa-keysize-3072"
-      ]
+      ],
+      "version": "0.7.0"
     }
 
+The version field is available since v0.7.
+
 The meaning of the feature verbs is as follows:
 
 =over 4
 
-=item B<cmdarg-seccomp>
+=item B<tpm-1.2> (since v0.7)
+
+TPM 1.2 emulation is supported (libtpms is compiled with 1.2 support).
+
+=item B<tpm-2.0> (since v0.7)
+
+TPM 2 emulation is supported (libtpms is compiled with 2.0 support).
+
+(the I<--tpm2> option is supported)
+
+=item B<cmdarg-seccomp> (since v0.2)
 
 The I<--seccomp> option is supported.
 
-=item B<cmdarg-key-fd>
+=item B<cmdarg-key-fd> (since v0.2)
 
 The I<--key> option supports the I<fd=> parameter.
 
-=item B<cmdarg-pwd-fd>
+=item B<cmdarg-pwd-fd> (since v0.2)
 
 The I<--key> option supports the I<pwdfd=> parameter.
 
-=item B<tpm-send-command-header>
+=item B<cmdarg-print-states> (since v0.7)
+
+The I<--print-states> option is supported.
+
+=item B<nvram-backend-dir> (since v0.7)
+
+The I<--tpmstate> option supports the I<backend-uri=dir://...>
+parameter.
+
+=item B<nvram-backend-file> (since v0.7)
+
+The I<--tpmstate> option supports the I<backend-uri=file://...>
+parameter.
+
+=item B<tpm-send-command-header> (since v0.2)
 
 The TPM 2 commands may be prefixed by a header that carries a 4-byte
 command, 1 byte for locality, and 4-byte TPM 2 command length indicator.
 The TPM 2 will respond by preprending a 4-byte response indicator and a
 4-byte trailer. All data is sent in big endian format.
 
-=item B<flags-opt-startup>
+=item B<flags-opt-startup> (since v0.3)
 
 The I<--flags> option supports the I<startup-...> options.
 
-=item B<rsa-keysize-2048>
+=item B<rsa-keysize-2048> (since v0.4)
 
 The TPM 2 supports the shown RSA key sizes. If none of the
 rsa-keysize verbs is shown then only RSA 2048 bit keys are supported.
 
 =back
 
+=item B<--print-states> (since v0.7)
+
+This option allows to print out the TPM 1.2 or TPM 2 state blobs
+that are currently stored in a storage backend. This option requires
+that the storage backend be specified using the I<--tpmstate> option
+and if TPM 2 state blobs are supposed to be shown, the I<--tpm2>
+option must be passed.
+
+The following shows the JSON output of this option. It indicates that
+the 'permall' and 'volatile' states are available.
+
+    {
+      "type": "swtpm",
+      "states": [
+        {
+          "name": "permall",
+          "size": 6013
+        }, {
+          "name": "volatile",
+          "size": 1087
+        }
+      ]
+    }
+
 =item B<-h|--help>
 
 Display usage info.
diff --git a/man/man8/swtpm_cert.pod b/man/man8/swtpm_cert.pod
index 62df636..2fce2ef 100644
--- a/man/man8/swtpm_cert.pod
+++ b/man/man8/swtpm_cert.pod
@@ -157,9 +157,12 @@ The output may contain the following:
       "features": [
         "cmdarg-signkey-pwd",
         "cmdarg-parentkey-pwd"
-      ]
+      ],
+      "version": "0.7.0"
     }
 
+The version field is available since 0.7.
+
 The maining of the feature verbs is as follows:
 
 =over 4
diff --git a/man/man8/swtpm_cuse.pod b/man/man8/swtpm_cuse.pod
index 8cf981d..e2d4a77 100644
--- a/man/man8/swtpm_cuse.pod
+++ b/man/man8/swtpm_cuse.pod
@@ -175,9 +175,12 @@ may contain the following:
       "features": [
         "cmdarg-seccomp",
         "cmdarg-key-fd"
-      ]
+      ],
+      "version": "0.7.0"
     }
 
+The version field is available since 0.7.
+
 The meaning of the feature verbs is as follows:
 
 =over 4
diff --git a/man/man8/swtpm-localca.pod b/man/man8/swtpm_localca.pod
similarity index 94%
rename from man/man8/swtpm-localca.pod
rename to man/man8/swtpm_localca.pod
index 202908e..dffec0c 100644
--- a/man/man8/swtpm-localca.pod
+++ b/man/man8/swtpm_localca.pod
@@ -1,14 +1,14 @@
 =head1 NAME
 
-swtpm-localca  - Local CA to create EK and platform certs for swtpm
+swtpm_localca  - Local CA to create EK and platform certs for swtpm
 
 =head1 SYNOPSIS
 
-B<swtpm-localca [OPTIONS]>
+B<swtpm_localca [OPTIONS]>
 
 =head1 DESCRIPTION
 
-B<swtpm-localca> is a tool to create TPM Endorsement Key (EK) and platform
+B<swtpm_localca> is a tool to create TPM Endorsement Key (EK) and platform
 certificates on the host. It uses the I<swtpm_cert> program to create
 the certificates.
 
@@ -18,7 +18,7 @@ a variable needs to be set that points to this program.
 It implements command line options that the I<swtpm_setup>
 program uses to provide the necessary parameters to it.
 
-B<swtpm-localca> will automatically try to create the signing key and
+B<swtpm_localca> will automatically try to create the signing key and
 certificate if the configuration points to a missing signing key.
 Since this certificate must be signed by a CA, a root certificate authority
 will also be created and will sign this certificate. The root CA's
diff --git a/man/man8/swtpm_setup.conf.pod b/man/man8/swtpm_setup.conf.pod
index a5b237b..cb97709 100644
--- a/man/man8/swtpm_setup.conf.pod
+++ b/man/man8/swtpm_setup.conf.pod
@@ -89,6 +89,12 @@ that will be passed to the invoked program using the --optsfile
 option described above. If omitted, the invoked program will use
 the default options file.
 
+=item B<active_pcr_banks> (since v0.7)
+
+This keyword is to be followed by a comma-separated list
+of names of PCR banks. The list must not contain any spaces.
+Valid PCR bank names are sha1, sha256, sha384, and sha512.
+
 =back
 
 =head1 SEE ALSO
diff --git a/man/man8/swtpm_setup.pod b/man/man8/swtpm_setup.pod
index 13e8464..636e35d 100644
--- a/man/man8/swtpm_setup.pod
+++ b/man/man8/swtpm_setup.pod
@@ -17,7 +17,7 @@ The following options are supported:
 
 =item B<--runas <userid>>
 
-Use this userid to run swtpm_setup.sh as. Only 'root' can use this option.
+Use this userid to run swtpm_setup as. Only 'root' can use this option.
 
 =item B<--config <file>>
 
@@ -34,8 +34,8 @@ will be used.
 
 =item B<--tpm-state <dir>> or B<--tpmstate <dir>>
 
-Path to a directory where the TPM's state will be written into;
-this is a mandatory argument
+Path where the TPM's state will be written to; this is a mandatory argument.
+Prefix with dir:// to use directory backend, or file:// to use linear file.
 
 =item B<--tpm <path to executable>>
 
@@ -164,8 +164,12 @@ used for creating the certificates and may be required by that tool.
 =item B<--pcr-banks <PCR banks>>
 
 Optional comma-separated list of PCR banks to activate. Providing '-'
-allows a user to skip the selection and activates all PCR banks. By default
-the sha1 and sha256 banks are activated.
+allows a user to skip the selection and activates all PCR banks.
+If this option is not provided, the I<swtpm_setup.conf> configuration
+file will be consulted for the active_pcr_banks entry. If no such
+entry is found then the default set of PCR banks will be activated.
+The default set of PCR banks can be determined using the I<--help>
+option.
 
 =item B<--swtpm_ioctl <executable>>
 
@@ -184,6 +188,11 @@ the I<--print-capabilities> option. The default size is 2048 bits for
 both TPM 1.2 and TPM 2. If 'max' is passed, the largest possible key
 size is used.
 
+=item B<--reconfigure> (since v0.7)
+
+This option allows the reconfiguration of the active PCR banks of a
+TPM 2 using the I<--pcr-banks> option.
+
 =item B<--print-capabilities> (since v0.2)
 
 Print capabilities that were added to swtpm_setup after version 0.1.
@@ -194,37 +203,114 @@ The output may contain the following:
       "features": [
         "cmdarg-keyfile-fd",
         "cmdarg-pwdfile-fd",
+        "cmdarg-write-ek-cert-files",
+        "cmdarg-create-config-files",
+	"cmdarg-reconfigure-pcr-banks",
         "tpm2-rsa-keysize-2048",
         "tpm2-rsa-keysize-3072",
-        "tpm12-not-need-root"
-      ]
+        "tpm12-not-need-root",
+        "tpm-1.2",
+        "tpm-2.0"
+      ],
+      "version": "0.7.0"
     }
 
+The version field is available since v0.7.
+
 The meaning of the feature verbs is as follows:
 
 =over 4
 
-=item B<cmdarg-key-fd>
+=item B<cmdarg-key-fd> (since v0.2)
 
 The I<--keyfile-fd> option is supported.
 
-=item B<cmdarg-pwd-fd>
+=item B<cmdarg-pwd-fd> (since v0.2)
 
 The I<--pwdfile-fd> option is supported.
 
-=item B<tpm2-rsa-keysize-2048, ...>
+=item B<cmdarg-write-ek-cert-files> (since v0.7)
+
+The I<--write-ek-cert-files> option is supported.
+
+=item B<cmdarg-create-config-files> (since v0.7)
+
+The I<--create-config-files> option is supported.
+
+=item B<cmdarg-reconfigure-pcr-banks> (since v0.7)
+
+The I<--reconfigure> option is supported and allows the reconfiguration of
+the active PCR banks.
+
+=item B<tpm2-rsa-keysize-2048, ...> (since v0.4)
 
 The shown RSA key sizes are supported for a TPM 2's EK key. If none of the
 tpm2-rsa-keysize verbs is shown then only RSA 2048 bit keys are supported.
 
-=item B<tpm12-not-need-root> (since 0.4.0)
+=item B<tpm12-not-need-root> (since v0.4)
 
 This option implies that any user can setup a TPM 1.2. Previously only root
 or the 'tss' user, depending on configuration and availability of this account,
 could do that.
 
+=item B<tpm-1.2> (since v0.7)
+
+TPM 1.2 setup is supported (libtpms is compiled with TPM 1.2 support).
+
+=item B<tpm-2.0> (since v0.7)
+
+TPM 2 setup is supported (libtpms is compiled with TPM 2 support).
+
 =back
 
+=item B<--write-ek-cert-files <directory>> (since v0.7)
+
+This option causes endorsement key (EK) files to be written into the provided
+directory. The files contain the DER-formatted EKs that were written into the
+NVRAM locations of the TPM 1.2 or TPM 2. The EK files have the filename pattern
+of ek-<key type>.crt. Example for filenames are ek-rsa2048.crt, ek-rsa3072.crt,
+and ek-secp384r1.crt.
+
+The keys that are written for a TPM 2 may change over time as the default
+strength of the EK keys changes. This means that one should look for all
+files with the above filename pattern when looking for the EKs.
+
+=item B<--create-config-files [[overwrite][,root][,skip-if-exist]]> (since v0.7)
+
+This option allows a user to create configuration files for swtpm_setup and
+swtpm-localca under the $XDG_CONFIG_HOME or $HOME/.config directories.
+
+The configuration files will not be created if any one of them already
+exists and in this case the program will report the first file it finds
+and exit with an error code.
+
+The meaning of the options is as follows:
+
+=over 4
+
+=item B<overwrite>
+
+Overwrite any existing configuration files.
+
+=item B<root>
+
+Create the configuration files even under the root account. These
+configuration files may then shadow any other existing configuration files,
+such as /etc/swtpm-localca.conf for example.
+
+=item B<skip-if-exist>
+
+Do nothing if any one of the configuration files that would be created already
+exists. The program will exit without error code.
+
+=back
+
+Note: The case when a user is part of the group that is allowed to access
+the default configuration files' paths is currently not handled. On many
+systems this may be the case when a user is part of the 'tss' group. In
+this case it is recommended that the user replace the swtpm-localca.conf
+created with this command with a symbolic link to /etc/swtpm-localca.conf.
+
 =item B<--help, -h>
 
 Display the help screen
@@ -241,7 +327,7 @@ To simulate manufacturing of a TPM, one would typically run the following comman
 Note: since v0.4 TPM 1.2 setup does not require root rights anymore.
 
 Any user can also simulate the manufacturing of a TPM using the
-swtpm-localca plugin. The following example assumes that the user has
+swtpm_localca utility. The following example assumes that the user has
 set the environment variable XDG_CONFIG_HOME as follows (using bash for
 example):
 
diff --git a/man/man8/swtpm_setup.sh.8 b/man/man8/swtpm_setup.sh.8
deleted file mode 100644
index 7574f18..0000000
--- a/man/man8/swtpm_setup.sh.8
+++ /dev/null
@@ -1 +0,0 @@
-.so man8/swtpm_setup.8
diff --git a/samples/Makefile.am b/samples/Makefile.am
index dcbc9b6..383c395 100644
--- a/samples/Makefile.am
+++ b/samples/Makefile.am
@@ -6,47 +6,20 @@
 
 samplesconfdir = $(datadir)/@PACKAGE@
 samplessysconfdir = $(sysconfdir)
-# swtpm-localca was always installed in /usr/samples/swtpm-localca
-bindir = $(samplesconfdir)
 
 samplesconf_SCRIPTS = \
 	swtpm-create-tpmca \
-	swtpm-create-user-config-files
+	swtpm-create-user-config-files \
+	swtpm-localca
 
 samplessysconf_DATA = \
 	swtpm-localca.conf \
-	swtpm-localca.options
-
-noinst_HEADERS = \
-	swtpm_localca.h \
-	swtpm_localca_utils.h
-
-bin_PROGRAMS = \
-	swtpm-localca
+	swtpm-localca.options \
+	swtpm_setup.conf
 
 $(top_builddir)/src/utils/libswtpm_utils.la:
 	$(MAKE) -C$(dir $@)
 
-swtpm_localca_DEPENDENCIES = \
-	$(top_builddir)/src/utils/libswtpm_utils.la
-
-swtpm_localca_SOURCES = \
-	swtpm_localca.c \
-	swtpm_localca_utils.c
-
-swtpm_localca_LDADD = \
-	$(top_builddir)/src/utils/libswtpm_utils.la
-
-swtpm_localca_LDFLAGS = \
-	-L$(top_builddir)/src/utils -lswtpm_utils \
-	$(HARDENING_LDFLAGS) \
-	$(GLIB_LIBS)
-
-swtpm_localca_CFLAGS = \
-	-I$(top_srcdir)/src/utils \
-	$(HARDENING_CFLAGS) \
-	$(GLIB_CFLAGS)
-
 install-data-local:
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/swtpm-localca
 	if test -z $(DESTDIR); then \
@@ -58,4 +31,5 @@ EXTRA_DIST= \
 	swtpm-create-tpmca \
 	swtpm-create-user-config-files \
 	swtpm-localca.conf \
-	swtpm-localca.options
+	swtpm-localca.options \
+	swtpm_setup.conf
diff --git a/samples/swtpm-create-user-config-files.in b/samples/swtpm-create-user-config-files.in
index b86a4b7..f38f45c 100755
--- a/samples/swtpm-create-user-config-files.in
+++ b/samples/swtpm-create-user-config-files.in
@@ -1,19 +1,5 @@
 #!/usr/bin/env bash
 
-if [ -z "${XDG_CONFIG_HOME}" ]; then
-	echo "Environment variable XDG_CONFIG_HOME is not set. Using \${HOME}/.config."
-	XDG_CONFIG_HOME="${HOME}/.config"
-fi
-
-SWTPM_LOCALCA_DIR="${XDG_CONFIG_HOME}/var/lib/swtpm-localca"
-
-SWTPM_SETUP_CONF="${XDG_CONFIG_HOME}/swtpm_setup.conf"
-SWTPM_LOCALCA_CONF="${XDG_CONFIG_HOME}/swtpm-localca.conf"
-SWTPM_LOCALCA_OPTIONS="${XDG_CONFIG_HOME}/swtpm-localca.options"
-
-FLAG_OVERWRITE=1
-FLAG_ROOT=2
-
 function help() {
 	cat <<_EOF_
 Usage: $1 [options]
@@ -30,62 +16,23 @@ _EOF_
 }
 
 function main() {
-	local flags=0
+	local flags=""
 
 	while [ $# -ne 0 ]; do
 		case "$1" in
-		--overwrite) flags=$((flags | FLAG_OVERWRITE));;
-		--root) flags=$((flags | FLAG_ROOT));;
+		--overwrite) flags="${flags},overwrite";;
+		--root) flags="${flags},root";;
+		--skip-if-exist) flags="${flags},skip-if-exist";;
 		--help|-h|-?) help $0; exit 0;;
 		*) echo -e "Unknown option $1\n" >&2; help $0; exit 1;;
 		esac
 		shift
 	done
 
-	if [ "$(id -u)" = "0" ]; then
-		if [[ $((flags & FLAG_ROOT)) -eq 0 ]]; then
-			echo "Requiring the --root flag since the configuration files will shadow"
-			echo "those in @SYSCONFDIR@."
-			exit 1
-		fi
-	fi
-
-	if [[ $((flags & FLAG_OVERWRITE)) -eq 0 ]]; then
-		for f in "${SWTPM_SETUP_CONF}" \
-			"${SWTPM_LOCALCA_CONF}" \
-			"${SWTPM_LOCALCA_OPTIONS}"; do
-			if [ -f "${f}" ]; then
-				echo "File ${f} already exists. Refusing to overwrite." >&2
-				exit 1
-			fi
-		done
-	fi
-
-	mkdir -p "${SWTPM_LOCALCA_DIR}"
-
-	echo "Writing ${SWTPM_SETUP_CONF}."
-	cat <<_EOF_ > "${SWTPM_SETUP_CONF}"
-create_certs_tool = @DATAROOTDIR@/swtpm/swtpm-localca
-create_certs_tool_config = ${SWTPM_LOCALCA_CONF}
-create_certs_tool_options = ${SWTPM_LOCALCA_OPTIONS}
-_EOF_
-
-	echo "Writing ${SWTPM_LOCALCA_CONF}."
-	cat <<_EOF_ > "${SWTPM_LOCALCA_CONF}"
-statedir = ${SWTPM_LOCALCA_DIR}
-signingkey = ${SWTPM_LOCALCA_DIR}/signkey.pem
-issuercert = ${SWTPM_LOCALCA_DIR}/issuercert.pem
-certserial = ${SWTPM_LOCALCA_DIR}/certserial
-_EOF_
-
-	echo "Writing ${SWTPM_LOCALCA_OPTIONS}."
-	cat <<_EOF_ > "${SWTPM_LOCALCA_OPTIONS}"
---platform-manufacturer $(uname -s | tr " " "_")
---platform-version $(uname -r | tr " " "_")
---platform-model $(uname -s | tr " " "_")
-_EOF_
+	[ "${flags:0:1}" = "," ] && flags=${flags:1}
 
-	exit 0
+	@BINDIR@/swtpm_setup --create-config-files ${flags}
+	exit $?
 }
 
 main "$@"
diff --git a/samples/swtpm-localca.in b/samples/swtpm-localca.in
new file mode 100755
index 0000000..ee90695
--- /dev/null
+++ b/samples/swtpm-localca.in
@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+
+@BINDIR@/swtpm_localca "$@"
+
+exit $?
diff --git a/etc/swtpm_setup.conf.in b/samples/swtpm_setup.conf.in
similarity index 60%
rename from etc/swtpm_setup.conf.in
rename to samples/swtpm_setup.conf.in
index 68d7e6f..3ae77e4 100644
--- a/etc/swtpm_setup.conf.in
+++ b/samples/swtpm_setup.conf.in
@@ -1,4 +1,6 @@
 # Program invoked for creating certificates
-create_certs_tool= @DATAROOTDIR@/swtpm/swtpm-localca
+create_certs_tool= @BINDIR@/swtpm_localca
 create_certs_tool_config = @SYSCONFDIR@/swtpm-localca.conf
 create_certs_tool_options = @SYSCONFDIR@/swtpm-localca.options
+# Comma-separated list (no spaces) of PCR banks to activate by default
+active_pcr_banks = @DEFAULT_PCR_BANKS@
diff --git a/src/Makefile.am b/src/Makefile.am
index dba32c8..9e03c78 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -10,6 +10,7 @@ SUBDIRS = \
 	swtpm_bios \
 	swtpm_cert \
 	swtpm_ioctl \
+	swtpm_localca \
 	swtpm_setup
 
 if WITH_SELINUX
diff --git a/src/selinux/Makefile.am b/src/selinux/Makefile.am
index 7c1f63c..4bf1d8d 100644
--- a/src/selinux/Makefile.am
+++ b/src/selinux/Makefile.am
@@ -71,7 +71,7 @@ selinux-uninstall:
 	cp $^ ./ 2>/dev/null || true
 	make -f /usr/share/selinux/devel/Makefile $@
 	$(RM) -r ./tmp/
-	if test $(shell pwd) != $(abspath $(top_srcdir)/src/selinux); then \
+	if test $(abspath $(shell pwd)) != $(abspath $(top_srcdir)/src/selinux); then \
 		$(RM) *.te *.fc *.if; \
 	fi
 
diff --git a/src/swtpm/Makefile.am b/src/swtpm/Makefile.am
index 8f6c6d8..5454a6f 100644
--- a/src/swtpm/Makefile.am
+++ b/src/swtpm/Makefile.am
@@ -17,14 +17,15 @@ noinst_HEADERS = \
 	main.h \
 	mainloop.h \
 	options.h \
-	osx.h \
+	daemonize.h \
 	pidfile.h \
 	seccomp_profile.h \
 	server.h \
 	swtpm_aes.h \
 	swtpm_debug.h \
 	swtpm_io.h \
-	swtpm_nvfile.h \
+	swtpm_nvstore.h \
+	swtpm_nvstore_linear.h \
 	threadpool.h \
 	tlv.h \
 	tpmlib.h \
@@ -49,7 +50,10 @@ libswtpm_libtpms_la_SOURCES = \
 	swtpm_aes.c \
 	swtpm_debug.c \
 	swtpm_io.c \
-	swtpm_nvfile.c \
+	swtpm_nvstore.c \
+	swtpm_nvstore_dir.c \
+	swtpm_nvstore_linear.c \
+	swtpm_nvstore_linear_file.c \
 	tlv.c \
 	tpmlib.c \
 	tpmstate.c \
@@ -64,12 +68,12 @@ libswtpm_libtpms_la_CFLAGS = \
 	-I$(top_builddir)/include \
 	-I$(top_srcdir)/include \
 	-I$(top_srcdir)/include/swtpm \
+	-I$(top_srcdir)/src/utils \
 	$(MY_CFLAGS) \
 	$(CFLAGS) \
 	$(HARDENING_CFLAGS) \
 	$(GLIB_CFLAGS) \
-	$(LIBSECCOMP_CFLAGS) \
-	$(LIBCRYPTO_EXTRA_CFLAGS)
+	$(LIBSECCOMP_CFLAGS)
 
 libswtpm_libtpms_la_LDFLAGS = \
 	$(MY_LDFLAGS) \
@@ -91,7 +95,7 @@ swtpm_DEPENDENCIES = $(privlib_LTLIBRARIES)
 
 swtpm_SOURCES = \
 		main.c \
-		osx.c \
+		daemonize.c \
 		swtpm.c \
 		swtpm_chardev.c
 if WITH_CUSE
@@ -102,6 +106,7 @@ swtpm_CFLAGS = \
 	-I$(top_builddir)/include \
 	-I$(top_srcdir)/include \
 	-I$(top_srcdir)/include/swtpm \
+	-I$(top_srcdir)/src/utils \
 	$(MY_CFLAGS) \
 	$(HARDENING_CFLAGS) \
 	$(GLIB_CFLAGS) \
@@ -126,7 +131,9 @@ swtpm_cuse_SOURCES = \
 
 swtpm_cuse_CFLAGS = \
 	-I$(top_builddir)/include \
+	-I$(top_srcdir)/include \
 	-I$(top_srcdir)/include/swtpm \
+	-I$(top_srcdir)/src/utils \
 	$(MY_CFLAGS) \
 	$(GLIB_CFLAGS) \
 	$(LIBFUSE_CFLAGS) \
diff --git a/src/swtpm/capabilities.c b/src/swtpm/capabilities.c
index c6e358f..c528a8c 100644
--- a/src/swtpm/capabilities.c
+++ b/src/swtpm/capabilities.c
@@ -43,9 +43,11 @@
 #include <string.h>
 
 #include <libtpms/tpm_library.h>
+#include <libtpms/tpm_error.h>
 
 #include "capabilities.h"
 #include "logging.h"
+#include "swtpm_nvstore.h"
 
 /* Convert the RSA key size indicators supported by libtpms into capability
  * strings.
@@ -68,7 +70,7 @@ static int get_rsa_keysize_caps(char **keysizecaps)
     int n;
 
     if (!info_data)
-        goto oom;
+        goto cleanup;
 
     start = strstr(info_data, needle);
     if (start) {
@@ -122,24 +124,39 @@ int capabilities_print_json(bool cusetpm)
 #else
     const char *cmdarg_seccomp = "";
 #endif
+    const char *with_tpm1 = "";
+    const char *with_tpm2 = "";
     char *keysizecaps = NULL;
+    const char *nvram_backend_dir = "\"nvram-backend-dir\", ";
+    const char *nvram_backend_file = "\"nvram-backend-file\"";
 
     ret = get_rsa_keysize_caps(&keysizecaps);
     if (ret < 0)
         goto cleanup;
 
+    if (TPMLIB_ChooseTPMVersion(TPMLIB_TPM_VERSION_1_2) == TPM_SUCCESS)
+        with_tpm1 = "\"tpm-1.2\", ";
+    if (TPMLIB_ChooseTPMVersion(TPMLIB_TPM_VERSION_2) == TPM_SUCCESS)
+        with_tpm2 = "\"tpm-2.0\", ";
+
     n =  asprintf(&string,
          "{ "
          "\"type\": \"swtpm\", "
          "\"features\": [ "
-             "%s%s%s%s%s%s"
-          " ] "
+             "%s%s%s%s%s%s%s%s%s%s%s"
+          " ], "
+         "\"version\": \"" VERSION "\" "
          "}",
+         with_tpm1,
+         with_tpm2,
          !cusetpm     ? "\"tpm-send-command-header\", ": "",
          !cusetpm     ? "\"flags-opt-startup\", "      : "",
          cmdarg_seccomp,
          true         ? "\"cmdarg-key-fd\", "          : "",
-         true         ? "\"cmdarg-pwd-fd\""            : "",
+         true         ? "\"cmdarg-pwd-fd\", "          : "",
+         true         ? "\"cmdarg-print-states\", "    : "",
+         nvram_backend_dir,
+         nvram_backend_file,
          keysizecaps  ? keysizecaps                    : ""
     );
 
diff --git a/src/swtpm/common.c b/src/swtpm/common.c
index fcbf2c9..722ff65 100644
--- a/src/swtpm/common.c
+++ b/src/swtpm/common.c
@@ -37,6 +37,7 @@
 
 #include "config.h"
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
@@ -62,7 +63,7 @@
 #include "key.h"
 #include "locality.h"
 #include "logging.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
 #include "pidfile.h"
 #include "tpmstate.h"
 #include "ctrlchannel.h"
@@ -144,6 +145,10 @@ static const OptionDesc tpmstate_opt_desc[] = {
         .name = "mode",
         .type = OPT_TYPE_MODE_T,
     },
+    {
+        .name = "backend-uri",
+        .type = OPT_TYPE_STRING,
+    },
     END_OPTION_DESC
 };
 
@@ -618,15 +623,18 @@ handle_pid_options(char *options)
  * @options: the 'pid' options to parse
  * @tpmstatedir: Point to pointer for tpmstatedir
  * @mode: the mode of the TPM's state files
+ * @tpmbackend_uri: Point to pointer for backend URI
  *
  * Returns 0 on success, -1 on failure.
  */
 static int
-parse_tpmstate_options(char *options, char **tpmstatedir, mode_t *mode)
+parse_tpmstate_options(char *options, char **tpmstatedir, mode_t *mode,
+                       char **tpmbackend_uri)
 {
     OptionValues *ovs = NULL;
     char *error = NULL;
     const char *directory = NULL;
+    const char *backend_uri = NULL;
 
     ovs = options_parse(options, tpmstate_opt_desc, &error);
     if (!ovs) {
@@ -636,16 +644,25 @@ parse_tpmstate_options(char *options, char **tpmstatedir, mode_t *mode)
     }
 
     directory = option_get_string(ovs, "dir", NULL);
-    if (!directory) {
-        logprintf(STDERR_FILENO,
-                  "The file parameter is required for the tpmstate option.\n");
-        goto error;
-    }
     *mode = option_get_mode_t(ovs, "mode", 0640);
+    backend_uri = option_get_string(ovs, "backend-uri", NULL);
 
-    *tpmstatedir = strdup(directory);
-    if (!*tpmstatedir) {
-        logprintf(STDERR_FILENO, "Out of memory.");
+    if (directory) {
+        *tpmstatedir = strdup(directory);
+        if (!*tpmstatedir) {
+            logprintf(STDERR_FILENO, "Out of memory.");
+            goto error;
+        }
+    } else if (backend_uri) {
+        *tpmbackend_uri = strdup(backend_uri);
+        if (!*tpmbackend_uri) {
+            logprintf(STDERR_FILENO, "Out of memory.");
+            goto error;
+        }
+    } else {
+        logprintf(STDERR_FILENO,
+                  "The dir or backend-uri parameters is required "
+                  "for the tpmstate option.\n");
         goto error;
     }
 
@@ -672,20 +689,52 @@ int
 handle_tpmstate_options(char *options)
 {
     char *tpmstatedir = NULL;
+    char *tpmbackend_uri = NULL;
+    char *temp_uri = NULL;
     int ret = 0;
     mode_t mode;
 
     if (!options)
         return 0;
 
-    if (parse_tpmstate_options(options, &tpmstatedir, &mode) < 0)
-        return -1;
-
-    if (tpmstate_set_dir(tpmstatedir) < 0 ||
-        tpmstate_set_mode(mode) < 0)
+    if (parse_tpmstate_options(options, &tpmstatedir, &mode,
+                               &tpmbackend_uri) < 0) {
         ret = -1;
+        goto error;
+    }
+
+    if (tpmstatedir) {
+        /* Default tpmstate store dir backend */
+        if (asprintf(&temp_uri, "dir://%s", tpmstatedir) < 0) {
+            logprintf(STDERR_FILENO,
+                      "Could not asprintf TPM backend uri\n");
+            ret = -1;
+            temp_uri = NULL;
+            goto error;
+        }
+
+        if (tpmstate_set_backend_uri(temp_uri) < 0 ||
+            tpmstate_set_mode(mode) < 0) {
+            ret = -1;
+            goto error;
+        }
+    } else {
+        if (tpmstate_set_backend_uri(tpmbackend_uri) < 0) {
+            ret = -1;
+            goto error;
+        }
+        if ((strncmp(tpmbackend_uri, "dir://", 6) == 0 ||
+            strncmp(tpmbackend_uri, "file://", 7)) &&
+            tpmstate_set_mode(mode) < 0) {
+            ret = -1;
+            goto error;
+        }
+    }
 
+error:
     free(tpmstatedir);
+    free(tpmbackend_uri);
+    free(temp_uri);
 
     return ret;
 }
@@ -1310,4 +1359,4 @@ int handle_seccomp_options(char *options, unsigned int *seccomp_action)
 
     return 0;
 }
-#endif /* WITH_SECCOMP */
\ No newline at end of file
+#endif /* WITH_SECCOMP */
diff --git a/src/swtpm/common.h b/src/swtpm/common.h
index e1c20a3..f284028 100644
--- a/src/swtpm/common.h
+++ b/src/swtpm/common.h
@@ -41,6 +41,8 @@
 
 #include <stdbool.h>
 
+#include "compiler_dependencies.h"
+
 int handle_log_options(char *options);
 int handle_key_options(char *options);
 int handle_migration_key_options(char *options);
@@ -56,8 +58,8 @@ int handle_flags_options(char *options, bool *need_init_cmd,
 #ifdef WITH_SECCOMP
 int handle_seccomp_options(char *options, unsigned int *seccomp_action);
 #else
-static inline int handle_seccomp_options(char *options,
-                                         unsigned int *seccomp_action)
+static inline int handle_seccomp_options(char *options SWTPM_ATTR_UNUSED,
+                                         unsigned int *seccomp_action SWTPM_ATTR_UNUSED)
 {
     return 0;
 }
diff --git a/src/swtpm/ctrlchannel.c b/src/swtpm/ctrlchannel.c
index 1f26233..d50c6f3 100644
--- a/src/swtpm/ctrlchannel.c
+++ b/src/swtpm/ctrlchannel.c
@@ -56,11 +56,12 @@
 #include "logging.h"
 #include "tpm_ioctl.h"
 #include "tpmlib.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
 #include "locality.h"
 #include "mainloop.h"
 #include "utils.h"
 #include "swtpm_debug.h"
+#include "swtpm_utils.h"
 
 /* local variables */
 
@@ -790,8 +791,7 @@ int ctrlchannel_process_fd(int fd,
             goto err_bad_input;
         }
 
-        mlp->flags = MAIN_LOOP_FLAG_USE_FD | MAIN_LOOP_FLAG_KEEP_CONNECTION |
-                       MAIN_LOOP_FLAG_END_ON_HUP;
+        mlp->flags |= MAIN_LOOP_FLAG_USE_FD | MAIN_LOOP_FLAG_KEEP_CONNECTION;
         mlp->fd = *data_fd;
 
         *res_p = htobe32(TPM_SUCCESS);
diff --git a/src/swtpm/cuse_tpm.c b/src/swtpm/cuse_tpm.c
index fbf4d86..d577d88 100644
--- a/src/swtpm/cuse_tpm.c
+++ b/src/swtpm/cuse_tpm.c
@@ -70,7 +70,7 @@
 #include "locality.h"
 #include "logging.h"
 #include "tpm_ioctl.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
 #include "tpmlib.h"
 #include "main.h"
 #include "utils.h"
@@ -78,6 +78,7 @@
 #include "seccomp_profile.h"
 #include "options.h"
 #include "capabilities.h"
+#include "swtpm_utils.h"
 
 /* maximum size of request buffer */
 #define TPM_REQ_MAX 4096
@@ -218,10 +219,10 @@ static const char *usage =
 "                       the log file can be reset (truncate)\n"
 "--pid file=<path>|fd=<filedescriptor>\n"
 "                    :  write the process ID into the given file\n"
-"--tpmstate dir=<dir>[,mode=0...]\n"
-"                    :  set the directory where the TPM's state will be written\n"
+"--tpmstate dir=<dir>[,mode=0...]|backend-uri=<uri>\n"
+"                    :  set the directory or uri where the TPM's state will be written\n"
 "                       into; the TPM_PATH environment variable can be used\n"
-"                       instead;\n"
+"                       instead of dir option;\n"
 "                       mode allows a user to set the file mode bits of the state\n"
 "                       files; the default mode is 0640;\n"
 "--flags [not-need-init][,startup-clear|startup-state|startup-deactivated|startup-none]\n"
@@ -241,11 +242,13 @@ static const char *usage =
 "                       blacklisted syscall is executed; default is kill\n"
 #endif
 "--print-capabilites : print capabilities and terminate\n"
+"--print-states      : print existing TPM states and terminate\n"
 "-h|--help           :  display this help screen and terminate\n"
 "\n";
 
 static TPM_RESULT
-ptm_io_getlocality(TPM_MODIFIER_INDICATOR *loc, uint32_t tpmnum)
+ptm_io_getlocality(TPM_MODIFIER_INDICATOR *loc,
+                   uint32_t tpmnum SWTPM_ATTR_UNUSED)
 {
     *loc = locality;
     return TPM_SUCCESS;
@@ -396,7 +399,7 @@ static int cached_stateblob_copy(void *dest, size_t destlen,
 /*
  * worker_thread: the worker thread
  */
-static void worker_thread(gpointer data, gpointer user_data)
+static void worker_thread(gpointer data, gpointer user_data SWTPM_ATTR_UNUSED)
 {
     struct thread_message *msg = (struct thread_message *)data;
 
@@ -431,7 +434,8 @@ static int tpm_start(uint32_t flags, TPMLIB_TPMVersion l_tpmversion,
                      TPM_RESULT *res)
 {
     DIR *dir;
-    const char *tpmdir = tpmstate_get_dir();
+    const char *uri = tpmstate_get_backend_uri();
+    const char *tpmdir = uri + strlen("dir://");
 
     *res = TPM_FAIL;
 
@@ -499,7 +503,8 @@ static void ptm_write_fatal_error_response(TPMLIB_TPMVersion l_tpmversion)
 /*
  * ptm_send_startup: Send a TPM/TPM2_Startup
  */
-static int ptm_send_startup(uint16_t startupType, TPMLIB_TPMVersion l_tpmversion)
+static int ptm_send_startup(uint16_t startupType,
+                            TPMLIB_TPMVersion l_tpmversion SWTPM_ATTR_UNUSED)
 {
     uint32_t command_length;
     unsigned char command[sizeof(struct tpm_startup)];
@@ -597,8 +602,8 @@ static void ptm_read_stateblob(fuse_req_t req, size_t size)
  * Depending on the current state of the transfer interface (read/write)
  * return either the results of TPM commands or a data of a TPM state blob.
  */
-static void ptm_read(fuse_req_t req, size_t size, off_t off,
-                     struct fuse_file_info *fi)
+static void ptm_read(fuse_req_t req, size_t size, off_t off SWTPM_ATTR_UNUSED,
+                     struct fuse_file_info *fi SWTPM_ATTR_UNUSED)
 {
     switch (tx_state.state) {
     case TX_STATE_RW_COMMAND:
@@ -918,7 +923,8 @@ cleanup:
  *            on what is being transferred using the write()
  */
 static void ptm_write(fuse_req_t req, const char *buf, size_t size,
-                      off_t off, struct fuse_file_info *fi)
+                      off_t off SWTPM_ATTR_UNUSED,
+                      struct fuse_file_info *fi SWTPM_ATTR_UNUSED)
 {
     switch (tx_state.state) {
     case TX_STATE_RW_COMMAND:
@@ -959,7 +965,8 @@ static void ptm_open(fuse_req_t req, struct fuse_file_info *fi)
  *            needed buffer
  */
 static void ptm_ioctl(fuse_req_t req, int cmd, void *arg,
-                      struct fuse_file_info *fi, unsigned flags,
+                      struct fuse_file_info *fi SWTPM_ATTR_UNUSED,
+                      unsigned flags SWTPM_ATTR_UNUSED,
                       const void *in_buf, size_t in_bufsz, size_t out_bufsz)
 {
     TPM_RESULT res = TPM_FAIL;
@@ -1448,6 +1455,7 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
 #endif
         {"print-capabilities"
                          ,       no_argument, 0, 'a'},
+        {"print-states"  ,       no_argument, 0, 'e'},
         {NULL            , 0                , 0, 0  },
     };
     struct cuse_info cinfo;
@@ -1458,11 +1466,12 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
     char *cinfo_argv[1] = { 0 };
     unsigned int num;
     struct passwd *passwd;
-    const char *tpmdir;
+    const char *uri = NULL;
     int n, tpmfd;
     char path[PATH_MAX];
     int ret = 0;
     bool printcapabilities = false;
+    bool printstates = false;
     bool need_init_cmd = true;
     TPM_RESULT res;
 
@@ -1561,6 +1570,9 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
         case 'a':
             printcapabilities = true;
             break;
+        case 'e':
+            printstates = true;
+            break;
         case 'v': /* version */
             fprintf(stdout, "TPM emulator CUSE interface version %d.%d.%d, "
                     "Copyright (c) 2014-2015 IBM Corp.\n",
@@ -1578,23 +1590,61 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
         goto exit;
     }
 
-    /*
-     * choose the TPM version early so that getting/setting
-     * buffer size works.
-     */
-    if (TPMLIB_ChooseTPMVersion(tpmversion) != TPM_SUCCESS) {
-        logprintf(STDERR_FILENO,
-                  "Error: Could not choose TPM version.\n");
+    if (setuid(0)) {
+        logprintf(STDERR_FILENO, "Error: Unable to setuid root. uid = %d, "
+                  "euid = %d, gid = %d\n", getuid(), geteuid(), getgid());
+        ret = -4;
+        goto exit;
+    }
+
+    if (param.runas) {
+        if (!(passwd = getpwnam(param.runas))) {
+            logprintf(STDERR_FILENO, "User '%s' does not exist\n",
+                      param.runas);
+            ret = -5;
+            goto exit;
+        }
+    }
+
+    if (handle_log_options(param.logging) < 0) {
         ret = EXIT_FAILURE;
         goto exit;
     }
 
     if (printcapabilities) {
+        /*
+         * Choose the TPM version so that getting/setting buffer size works.
+         * Ignore failure, for backward compatibility when TPM 1.2 is disabled.
+         */
+        TPMLIB_ChooseTPMVersion(tpmversion);
         ret = capabilities_print_json(true) ? EXIT_FAILURE : EXIT_SUCCESS;
         goto exit;
     }
 
-    SWTPM_NVRAM_Set_TPMVersion(tpmversion);
+    if (TPMLIB_ChooseTPMVersion(tpmversion) != TPM_SUCCESS) {
+        logprintf(STDERR_FILENO,
+                  "Error: Could not choose TPM version.\n");
+        ret = EXIT_FAILURE;
+        goto exit;
+    }
+
+    tpmstate_set_version(tpmversion);
+
+    if (printstates) {
+        if (handle_tpmstate_options(param.tpmstatedata) < 0) {
+            ret = EXIT_FAILURE;
+            goto exit;
+        }
+        if (param.tpmstatedata == NULL) {
+            logprintf(STDERR_FILENO,
+                      "Error: --tpmstate option is required for --print-states\n");
+            ret = EXIT_FAILURE;
+            goto exit;
+        }
+        ret = SWTPM_NVRAM_PrintJson();
+        ret = ret ? EXIT_FAILURE : EXIT_SUCCESS;
+        goto exit;
+    }
 
     if (!cinfo.dev_info_argv) {
         logprintf(STDERR_FILENO, "Error: device name missing\n");
@@ -1602,8 +1652,7 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
         goto exit;
     }
 
-    if (handle_log_options(param.logging) < 0 ||
-        handle_key_options(param.keydata) < 0 ||
+    if (handle_key_options(param.keydata) < 0 ||
         handle_migration_key_options(param.migkeydata) < 0 ||
         handle_pid_options(param.piddata) < 0 ||
         handle_tpmstate_options(param.tpmstatedata) < 0 ||
@@ -1615,24 +1664,8 @@ int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *ifac
         goto exit;
     }
 
-    if (setuid(0)) {
-        logprintf(STDERR_FILENO, "Error: Unable to setuid root. uid = %d, "
-                  "euid = %d, gid = %d\n", getuid(), geteuid(), getgid());
-        ret = -4;
-        goto exit;
-    }
-
-    if (param.runas) {
-        if (!(passwd = getpwnam(param.runas))) {
-            logprintf(STDERR_FILENO, "User '%s' does not exist\n",
-                      param.runas);
-            ret = -5;
-            goto exit;
-        }
-    }
-
-    tpmdir = tpmstate_get_dir();
-    if (tpmdir == NULL) {
+    uri = tpmstate_get_backend_uri();
+    if (uri == NULL) {
         logprintf(STDERR_FILENO,
                   "Error: No TPM state directory is defined; "
                   "TPM_PATH is not set\n");
diff --git a/src/swtpm/daemonize.c b/src/swtpm/daemonize.c
new file mode 100644
index 0000000..5ded2c8
--- /dev/null
+++ b/src/swtpm/daemonize.c
@@ -0,0 +1,302 @@
+/*
+ * daemonize.c -- Utility functions for race-free daemonization
+ *
+ * (c) Two Sigma Open Source, LLC 2021.
+ *
+ * Author: Nicolas Williams <[e-mail]>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * Neither the names of the IBM Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "daemonize.h"
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+/*
+ * daemon(3) is racy because it fork()s and exits in the parent before the
+ * child can get ready to provide its services.
+ *
+ * Not every daemon can set up services before calling daemon(3), as some
+ * APIs are not fork-safe and must be called in the child-side of the
+ * daemon(3)'s fork() calls.
+ *
+ * Even if a daemon can set up services before calling daemon(3), it will not
+ * be able to write the correct PID into a pidfile until after daemon(3)
+ * returns.
+ *
+ * E.g.,
+ *
+ *  #!/bin/bash
+ *
+ *  # Start a service:
+ *  some-serviced --daemon --pid=... ...
+ *
+ *  # Call it:
+ *  call-some-service ping || echo "oops, we won the race but lost the game"
+ *
+ * To address this we split daemon(3) into two functions, daemonize_prep() and
+ * daemonize_finish().  A daemon program should call daemonize_prep() early
+ * when it knows it will have to daemonize (e.g., because of a --daemon
+ * command-line option), then it should do all the setup required to start
+ * providing its services, then it should call daemonize_finish().
+ *
+ * These two functions do all that daemon(3) does, but in two phases so that
+ * the original process that calls daemonize_prep() does not exit until the
+ * service is ready.
+ *
+ * daemonize_prep() calls fork(), setsid(), and then forks again, and returns
+ * in the grandchild, but exits in the original and middle processes when the
+ * grandchild calls daemonize_finish().
+ *
+ * How to use this:
+ *
+ *  if (daemonize) {
+ *      pid_t old_pid, new_pid;
+ *
+ *      old_pid = getpid();
+ *      if (daemonize_prep() == -1)
+ *          err(1, "Failed to daemonize");
+ *
+ *      // We're now in a grandchild, but the original parent should still be
+ *      // waiting.
+ *      new_pid = getpid();
+ *      assert(old_pid != new_pid);
+ *  }
+ *
+ *  // setup sockets, listen() on them, etc...
+ *  my_setup_service_and_listen_on_sockets();
+ *
+ *  // Tell the waiting parent and grandparent that we're ready:
+ *  // (doing this even if daemonize_prep() wasn't called is ok)
+ *  daemonize_finish();
+ *
+ *  // daemonize_finish() did not fork() again:
+ *  assert(new_pid == getpid());
+ *
+ * Note: the processes that exit will use _exit().  The process that
+ * daemonize_prep() returns to should be able to use exit().
+ */
+
+static int devnullfd = -1;
+static int pfd = -1;
+
+static int
+wait_or_die_like_it(pid_t pid)
+{
+    int status;
+
+    while (waitpid(pid, &status, 0) == -1) {
+        if (errno == EINTR)
+            continue;
+        /* XXX Should just use err(3). */
+        fprintf(stderr, "waitpid() failed: %s\n", strerror(errno));
+        fflush(stderr);
+        _exit(1);
+    }
+    if (WIFSIGNALED(status)) {
+        /*
+         * Child died in a fire; die like it so the parent sees the same exit
+         * status.
+         */
+        kill(getpid(), WTERMSIG(status));
+    }
+    if (!WIFEXITED(status)) {
+        /* If fire doesn't kill us, _exit(). */
+        _exit(1);
+    }
+    /* Child exited willingly. */
+    return WEXITSTATUS(status);
+}
+
+/*
+ * Prepare to daemonize.  When ready, the caller should call
+ * daemonize_finish().
+ *
+ * This arranges for the parent to exit when and only when the child is ready
+ * to service clients.
+ *
+ * This forks a grandchild and returns in the grandchild
+ * but exits in the parent and grandparent, but only once the child calls
+ * daemonize_finish() (or exits/dies, whichever comes first).
+ *
+ * Because the parent side of the fork() calls _exit(), the child can exit().
+ *
+ * Returns -1 on error (sets errno), 0 on success.
+ */
+int
+daemonize_prep(void)
+{
+    ssize_t bytes;
+    char buf;
+    int save_errno = errno;
+    int pfds[2] = { -1, -1 };
+    pid_t pid;
+
+    /*
+     * Be idempotent.  If called twice because, e.g., --daemon is given twice,
+     * do nothing the second time.
+     */
+    if (pfd != -1)
+        return 0;
+
+    /* Grand parent process. */
+    fflush(stdout);
+    fflush(stderr);
+    pid = fork();
+    if (pid == (pid_t)-1) {
+        fprintf(stderr, "Failed to daemonize: Failed to fork: %s\n",
+                strerror(errno));
+        return -1;
+    }
+
+    if (pid != 0) {
+        /*
+         * Grand parent process: exit when the grandchild is ready or die in
+         * the same way.
+         */
+        _exit(wait_or_die_like_it(pid));
+    }
+
+    /* Intermediate process.  Detach from tty, fork() again. */
+    if (setsid() == -1) {
+        fprintf(stderr, "Failed to daemonize: Failed to detach from tty: %s\n",
+                strerror(errno));
+        _exit(1);
+    }
+
+    /* Set things up so the grandchild can finish daemonizing. */
+    devnullfd = open("/dev/null", O_RDWR);
+    if (devnullfd == -1) {
+        fprintf(stderr, "Failed to daemonize: Could not open /dev/null: %s\n",
+                strerror(errno));
+        _exit(1);
+    }
+    if (pipe(pfds) == -1) {
+        fprintf(stderr, "Failed to daemonize: Could not make a pipe: %s\n",
+                strerror(errno));
+        _exit(1);
+    }
+    pfd = pfds[1];
+
+    /* Fork the grandchild so it cannot get a controlling tty by accident. */
+    pid = fork();
+    if (pid == (pid_t)-1) {
+        fprintf(stderr, "Failed to daemonize: Could not fork: %s\n",
+                strerror(errno));
+        _exit(1);
+    }
+    if (pid != 0) {
+        /*
+         * Middle process.
+         *
+         * Wait for ready notification from the child, then _exit()
+         * accordingly.
+         */
+        (void) close(pfds[1]);
+        do {
+            bytes = read(pfds[0], &buf, sizeof(buf));
+        } while (bytes == -1 && errno == EINTR);
+        if (bytes < 0) {
+            fprintf(stderr, "Failed to daemonize: "
+                    "Error reading from pipe: %s\n", strerror(errno));
+            /* Let init reap the grandchild. */
+            _exit(1);
+        }
+        if (bytes == 0) {
+            /* Die like the grandchild. */
+            _exit(wait_or_die_like_it(pid));
+        }
+        /* Ready! */
+        _exit(0);
+    }
+
+    /*
+     * We're on the grandchild side now, and we'll return with the expectation
+     * that the caller will call daemonize_finish().  The parent, which will
+     * continue executing this function, will _exit() when the child indicates
+     * that it is ready.
+     */
+    (void) close(pfds[0]);
+    errno = save_errno;
+    return 0;
+}
+
+/*
+ * Indicate that the service is now ready.
+ *
+ * Will cause the ancestor processes waiting in daemonize_prep() to _exit().
+ */
+void
+daemonize_finish(void)
+{
+    ssize_t bytes;
+    int save_errno = errno;
+
+    /* pfds[1] will be > -1 IFF daemonize_prep() was called */
+    if (pfd == -1) {
+        return;
+    }
+
+    if (dup2(devnullfd, STDOUT_FILENO) == -1) {
+        fprintf(stderr, "Failed to redirect output stream to /dev/null: %s\n",
+                strerror(errno));
+        fflush(stderr);
+        exit(1);
+    }
+    if (dup2(devnullfd, STDERR_FILENO) == -1) {
+        fprintf(stderr, "Failed to redirect error stream to /dev/null: %s\n",
+                strerror(errno));
+        fflush(stderr);
+        exit(1);
+    }
+    (void) close(devnullfd);
+    devnullfd = -1;
+
+    do {
+        bytes = write(pfd, "", sizeof(""));
+    } while (bytes == -1 && errno == EINTR);
+    if (bytes <= 0) {
+        /* There's no point writing to stderr now that it goes to /dev/null */
+        exit(1);
+    }
+    (void) close(pfd);
+    pfd = -1;
+    errno = save_errno;
+}
diff --git a/src/swtpm/osx.h b/src/swtpm/daemonize.h
similarity index 88%
rename from src/swtpm/osx.h
rename to src/swtpm/daemonize.h
index 1b569fa..92b4eda 100644
--- a/src/swtpm/osx.h
+++ b/src/swtpm/daemonize.h
@@ -1,9 +1,9 @@
 /*
- * osx.h -- OS X specifics
+ * daemonize.h -- Race-free daemoninization utilities
  *
- * (c) Copyright IBM Corporation 2018.
+ * (c) Copyright IBM Corporation 2021.
  *
- * Author: Stefan Berger <[e-mail]>
+ * Author: Nicolas Williams <[e-mail]>
  *
  * All rights reserved.
  *
@@ -38,6 +38,7 @@
 #ifndef SWTPM_OSX
 #define SWTPM_OSX
 
-int osx_daemon(int nochdir, int noclose);
+int daemonize_prep(void);
+void daemonize_finish(void);
 
-#endif /* SWTPM_OSX */
\ No newline at end of file
+#endif /* SWTPM_OSX */
diff --git a/src/swtpm/mainloop.c b/src/swtpm/mainloop.c
index 04ffa6a..44d67b7 100644
--- a/src/swtpm/mainloop.c
+++ b/src/swtpm/mainloop.c
@@ -64,6 +64,8 @@
 #include "mainloop.h"
 #include "utils.h"
 #include "sys_dependencies.h"
+#include "compiler_dependencies.h"
+#include "swtpm_utils.h"
 
 /* local variables */
 static TPM_MODIFIER_INDICATOR locality;
@@ -73,7 +75,7 @@ bool mainloop_terminate;
 
 TPM_RESULT
 mainloop_cb_get_locality(TPM_MODIFIER_INDICATOR *loc,
-                         uint32_t tpmnum)
+                         uint32_t tpmnum SWTPM_ATTR_UNUSED)
 {
     *loc = locality;
 
@@ -157,23 +159,27 @@ int mainLoop(struct mainLoopParams *mlp,
                 connection_fd.fd = mlp->fd;
 
             struct pollfd pollfds[] = {
-                {
+                [DATA_CLIENT_FD] = {
                     .fd = connection_fd.fd,
                     .events = POLLIN | POLLHUP,
                     .revents = 0,
-                }, {
+                },
+                [NOTIFY_FD] = {
                     .fd = notify_fd,
                     .events = POLLIN,
                     .revents = 0,
-                }, {
+                },
+                [CTRL_SERVER_FD] = {
                     .fd = -1,
                     .events = POLLIN,
                     .revents = 0,
-                } , {
+                },
+                [CTRL_CLIENT_FD] = {
                     .fd = ctrlclntfd,
                     .events = POLLIN | POLLHUP,
                     .revents = 0,
-                } , {
+                },
+                [DATA_SERVER_FD] = {
                     /* listen socket for accepting clients */
                     .fd = -1,
                     .events = POLLIN,
diff --git a/src/swtpm/osx.c b/src/swtpm/osx.c
deleted file mode 100644
index e06853b..0000000
--- a/src/swtpm/osx.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * osx.c -- OS X specifics
- *
- * (c) Copyright IBM Corporation 2018.
- *
- * Author: Stefan Berger <[e-mail]>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * Neither the names of the IBM Corporation nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "osx.h"
-
-#if defined __APPLE__
-
-int daemon(int, int); /* OS X deprecates it */
-
-int osx_daemon(int nochdir, int noclose)
-{
-    return daemon(nochdir, noclose);
-}
-
-#endif /* __APPLE__ */
\ No newline at end of file
diff --git a/src/swtpm/seccomp_profile.c b/src/swtpm/seccomp_profile.c
index 8ada407..e2684f3 100644
--- a/src/swtpm/seccomp_profile.c
+++ b/src/swtpm/seccomp_profile.c
@@ -47,6 +47,7 @@
 #include "logging.h"
 #include "utils.h"
 #include "seccomp_profile.h"
+#include "swtpm_utils.h"
 
 #ifdef WITH_SECCOMP
 static int create_seccomp_profile_add_rules(scmp_filter_ctx ctx,
@@ -148,7 +149,6 @@ int create_seccomp_profile(bool cusetpm, unsigned int action)
         SCMP_SYS(sched_setparam),
         SCMP_SYS(sched_setscheduler),
         SCMP_SYS(sched_setaffinity),
-        SCMP_SYS(sched_setattr),
         SCMP_SYS(vhangup),
         SCMP_SYS(sethostname),
         SCMP_SYS(setdomainname),
@@ -253,6 +253,8 @@ int create_seccomp_profile(bool cusetpm, unsigned int action)
 #ifdef __NR_clone3
         SCMP_SYS(clone3),
 #endif
+        /* misc */
+        SCMP_SYS(sched_setattr), /* caller: g_thread_pool_new() glib v2.68 */
     };
     scmp_filter_ctx ctx;
     int ret;
diff --git a/src/swtpm/swtpm.c b/src/swtpm/swtpm.c
index 8e6f52a..d4ad682 100644
--- a/src/swtpm/swtpm.c
+++ b/src/swtpm/swtpm.c
@@ -57,7 +57,7 @@
 #include "main.h"
 #include "swtpm_debug.h"
 #include "swtpm_io.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
 #include "server.h"
 #include "common.h"
 #include "logging.h"
@@ -68,7 +68,7 @@
 #include "ctrlchannel.h"
 #include "tpmstate.h"
 #include "sys_dependencies.h"
-#include "osx.h"
+#include "daemonize.h"
 #include "seccomp_profile.h"
 #include "options.h"
 #include "capabilities.h"
@@ -149,10 +149,10 @@ static void usage(FILE *file, const char *prgname, const char *iface)
     "                   allow-set-locality: accept SetLocality command\n"
     "--pid file=<path>|fd=<filedescriptor>\n"
     "                 : write the process ID into the given file\n"
-    "--tpmstate dir=<dir>[,mode=0...]\n"
-    "                 : set the directory where the TPM's state will be written\n"
+    "--tpmstate dir=<dir>[,mode=0...]|backend-uri=<uri>\n"
+    "                 : set the directory or uri where the TPM's state will be written\n"
     "                   into; the TPM_PATH environment variable can be used\n"
-    "                   instead;\n"
+    "                   instead dir option;\n"
     "                   mode allows a user to set the file mode bits of the state files;\n"
     "                   the default mode is 0640;\n"
     "--server [type=tcp][,port=port[,bindaddr=address[,ifname=ifname]]][,fd=fd][,disconnect]\n"
@@ -185,6 +185,8 @@ static void usage(FILE *file, const char *prgname, const char *iface)
 #endif
     "--print-capabilites\n"
     "                 : print capabilities and terminate\n"
+    "--print-states\n"
+    "                 : print existing TPM states and terminate\n"
     "-h|--help        : display this help screen and terminate\n"
     "\n",
     prgname, iface);
@@ -235,6 +237,7 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
 #endif
     unsigned int seccomp_action;
     bool printcapabilities = false;
+    bool printstates = false;
     static struct option longopts[] = {
         {"daemon"    ,       no_argument, 0, 'd'},
         {"help"      ,       no_argument, 0, 'h'},
@@ -257,6 +260,7 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
 #endif
         {"print-capabilities"
                      ,       no_argument, 0, 'a'},
+        {"print-states",     no_argument, 0, 'e'},
         {NULL        , 0                , 0, 0  },
     };
 
@@ -271,6 +275,11 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
         switch (opt) {
         case 'd':
             daemonize = TRUE;
+            if (daemonize_prep() == -1) {
+                logprintf(STDERR_FILENO,
+                          "Could not prepare to daemonize: %s\n", strerror(errno));
+                exit(EXIT_FAILURE);
+            }
             break;
 
         case 'p':
@@ -378,6 +387,10 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
             printcapabilities = true;
             break;
 
+        case 'e':
+            printstates = true;
+            break;
+
         case 'r':
             runas = optarg;
             break;
@@ -398,6 +411,15 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
         exit(EXIT_FAILURE);
     }
 
+    /* change process ownership before accessing files */
+    if (runas) {
+        if (change_process_owner(runas) < 0)
+            exit(EXIT_FAILURE);
+    }
+
+    if (handle_log_options(logdata) < 0)
+        exit(EXIT_FAILURE);
+
     if (mlp.fd >= 0 && mlp.fd < 3) {
         /* no std{in,out,err} */
         logprintf(STDERR_FILENO,
@@ -405,36 +427,45 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
         exit(EXIT_FAILURE);
     }
 
-    /*
-     * choose the TPM version early so that getting/setting
-     * buffer size works.
-     */
+    if (printcapabilities) {
+        /*
+         * Choose the TPM version so that getting/setting buffer size works.
+         * Ignore failure, for backward compatibility when TPM 1.2 is disabled.
+         */
+        TPMLIB_ChooseTPMVersion(mlp.tpmversion);
+        ret = capabilities_print_json(false);
+        exit(ret ? EXIT_FAILURE : EXIT_SUCCESS);
+    }
+
     if (TPMLIB_ChooseTPMVersion(mlp.tpmversion) != TPM_SUCCESS) {
         logprintf(STDERR_FILENO,
                   "Error: Could not choose TPM version.\n");
         exit(EXIT_FAILURE);
     }
 
-    if (printcapabilities) {
-        ret = capabilities_print_json(false);
-        exit(ret ? EXIT_FAILURE : EXIT_SUCCESS);
-    }
-
     if (handle_ctrlchannel_options(ctrlchdata, &mlp.cc) < 0 ||
         handle_server_options(serverdata, &server) < 0) {
         goto exit_failure;
     }
 
-    /* change process ownership before accessing files */
-    if (runas) {
-        if (change_process_owner(runas) < 0)
+    tpmstate_set_version(mlp.tpmversion);
+
+    if (printstates) {
+        if (handle_tpmstate_options(tpmstatedata) < 0)
+            goto exit_failure;
+        if (tpmstatedata == NULL) {
+            logprintf(STDERR_FILENO,
+                      "Error: --tpmstate option is required for --print-states\n");
+            goto exit_failure;
+        }
+        ret = SWTPM_NVRAM_PrintJson();
+        if (ret == 0)
+            goto exit_success;
+        else
             goto exit_failure;
     }
 
-    SWTPM_NVRAM_Set_TPMVersion(mlp.tpmversion);
-
-    if (handle_log_options(logdata) < 0 ||
-        handle_key_options(keydata) < 0 ||
+    if (handle_key_options(keydata) < 0 ||
         handle_migration_key_options(migkeydata) < 0 ||
         handle_pid_options(piddata) < 0 ||
         handle_locality_options(localitydata, &mlp.locality_flags) < 0 ||
@@ -459,17 +490,6 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
             mlp.flags |= MAIN_LOOP_FLAG_TERMINATE | MAIN_LOOP_FLAG_USE_FD;
     }
 
-    if (daemonize) {
-#ifdef __APPLE__
-        if (0 != osx_daemon(1, 0)) {
-#else
-        if (0 != daemon(1, 0)) {
-#endif
-            logprintf(STDERR_FILENO, "Error: Could not daemonize.\n");
-            goto exit_failure;
-        }
-    }
-
     if (pidfile_write(getpid()) < 0) {
         goto exit_failure;
     }
@@ -500,6 +520,10 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
     if (create_seccomp_profile(false, seccomp_action) < 0)
         goto error_seccomp_profile;
 
+    if (daemonize) {
+        daemonize_finish();
+    }
+
     rc = mainLoop(&mlp, notify_fd[0]);
 
 error_seccomp_profile:
@@ -529,4 +553,9 @@ exit_failure:
     swtpm_cleanup(mlp.cc, server);
 
     exit(EXIT_FAILURE);
+
+exit_success:
+    swtpm_cleanup(mlp.cc, server);
+
+    exit(EXIT_SUCCESS);
 }
diff --git a/src/swtpm/swtpm_aes.c b/src/swtpm/swtpm_aes.c
index 69f2101..5f74bf2 100644
--- a/src/swtpm/swtpm_aes.c
+++ b/src/swtpm/swtpm_aes.c
@@ -43,7 +43,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <openssl/aes.h>
+#include <openssl/evp.h>
 
 #include <libtpms/tpm_types.h>
 #include <libtpms/tpm_error.h>
@@ -52,9 +52,21 @@
 #include "swtpm_aes.h"
 #include "logging.h"
 
-#define printf(X ...)
+typedef const EVP_CIPHER *(*evpfunc)(void);
 
-/* TPM_SymmetricKeyData_Encrypt() is AES non-portable code to encrypt 'decrypt_data' to
+static evpfunc SWTPM_Get_AES_EVPFn(unsigned int bits)
+{
+    switch (bits) {
+    case 128:
+        return EVP_aes_128_cbc;
+    case 256:
+        return EVP_aes_256_cbc;
+    default:
+        return NULL;
+    }
+}
+
+/* SWTPM_SymmetricKeyData_Encrypt() is AES non-portable code to encrypt 'decrypt_data' to
    'encrypt_data'
 
    The stream is padded as per PKCS#7 / RFC2630
@@ -77,17 +89,18 @@ TPM_RESULT SWTPM_SymmetricKeyData_Encrypt(unsigned char **encrypt_data,   /* out
     unsigned char       ivec[SWTPM_AES256_BLOCK_SIZE];       /* initial chaining vector */
     TPM_SYMMETRIC_KEY_DATA *tpm_symmetric_key_data =
 	(TPM_SYMMETRIC_KEY_DATA *)tpm_symmetric_key_token;
-    AES_KEY key;
     size_t userKeyLength = tpm_symmetric_key_token->userKeyLength;
+    EVP_CIPHER_CTX *ctx = NULL;
+    evpfunc evpfn;
 
-    printf(" TPM_SymmetricKeyData_Encrypt: Length %u\n", decrypt_length);
     decrypt_data_pad = NULL;    /* freed @1 */
 
     if (rc == 0) {
         if (u_ivec != NULL && u_ivec_length != userKeyLength) {
-            printf("TPM_SymmetricKeyData_Encrypt: IV is %u bytes, "
-                   "but expected %u bytes\n", u_ivec_length,
-                   tpm_symmetric_key_token->userKeyLength);
+            logprintf(STDERR_FILENO,
+                      "SWTPM_SymmetricKeyData_Encrypt: IV is %u bytes, "
+                      "but expected %u bytes\n", u_ivec_length,
+                      tpm_symmetric_key_token->userKeyLength);
             rc = TPM_ENCRYPT_ERROR;
         } else {
             if (u_ivec) {
@@ -103,8 +116,6 @@ TPM_RESULT SWTPM_SymmetricKeyData_Encrypt(unsigned char **encrypt_data,   /* out
         /* calculate the pad length and padded data length */
         pad_length = userKeyLength - (decrypt_length % userKeyLength);
         *encrypt_length = decrypt_length + pad_length;
-        printf("  TPM_SymmetricKeyData_Encrypt: Padded length %u pad length %u\n",
-               *encrypt_length, pad_length);
         /* allocate memory for the encrypted response */
         *encrypt_data = malloc(*encrypt_length);
         if (!*encrypt_data) {
@@ -124,35 +135,48 @@ TPM_RESULT SWTPM_SymmetricKeyData_Encrypt(unsigned char **encrypt_data,   /* out
     }
 
     if (rc == 0) {
-        memset(&key, 0, sizeof(key)); /* coverity */
-        if (AES_set_encrypt_key(tpm_symmetric_key_data->userKey,
-                                userKeyLength * 8,
-                                &key) < 0) {
+        evpfn = SWTPM_Get_AES_EVPFn(userKeyLength * 8);
+        ctx = EVP_CIPHER_CTX_new();
+        if (!evpfn || !ctx ||
+            EVP_EncryptInit_ex(ctx, evpfn(), NULL,
+                               tpm_symmetric_key_data->userKey, ivec) != 1 ||
+            EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            logprintf(STDERR_FILENO,
+                      "Could not setup context for encryption.\n");
             rc = TPM_FAIL;
         }
     }
 
     /* pad the decrypted clear text data */
     if (rc == 0) {
+        int outlen1 = 0;
+        int outlen2 = 0;
+
         /* unpadded original data */
         memcpy(decrypt_data_pad, decrypt_data, decrypt_length);
         /* last gets pad = pad length */
         memset(decrypt_data_pad + decrypt_length, pad_length, pad_length);
         /* encrypt the padded input to the output */
-        //TPM_PrintFour("  TPM_SymmetricKeyData_Encrypt: Input", decrypt_data_pad);
-        AES_cbc_encrypt(decrypt_data_pad,
-                        *encrypt_data,
-                        *encrypt_length,
-                        &key,
-                        ivec,
-                        AES_ENCRYPT);
-        //TPM_PrintFour("  TPM_SymmetricKeyData_Encrypt: Output", *encrypt_data);
+        //TPM_PrintFour("  SWTPM_SymmetricKeyData_Encrypt: Input", decrypt_data_pad);
+        if (EVP_EncryptUpdate(ctx,
+                              *encrypt_data, &outlen1,
+                              decrypt_data_pad, *encrypt_length) != 1 ||
+            EVP_EncryptFinal_ex(ctx, *encrypt_data + outlen1, &outlen2) != 1 ||
+            (uint32_t)(outlen1 + outlen2) != *encrypt_length) {
+            logprintf(STDERR_FILENO,
+                      "Could not encrypt %u bytes. outlen1=%d, outlen2=%d.\n",
+                      *encrypt_length, outlen1, outlen2);
+            rc = TPM_FAIL;
+        }
+        //TPM_PrintFour("  SWTPM_SymmetricKeyData_Encrypt: Output", *encrypt_data);
     }
     free(decrypt_data_pad);     /* @1 */
+    EVP_CIPHER_CTX_free(ctx);
+
     return rc;
 }
 
-/* TPM_SymmetricKeyData_Decrypt() is AES non-portable code to decrypt 'encrypt_data' to
+/* SWTPM_SymmetricKeyData_Decrypt() is AES non-portable code to decrypt 'encrypt_data' to
    'decrypt_data'
 
    The stream must be padded as per PKCS#7 / RFC2630
@@ -176,21 +200,23 @@ TPM_RESULT SWTPM_SymmetricKeyData_Decrypt(unsigned char **decrypt_data,   /* out
     unsigned char       ivec[SWTPM_AES256_BLOCK_SIZE];       /* initial chaining vector */
     TPM_SYMMETRIC_KEY_DATA *tpm_symmetric_key_data =
 	(TPM_SYMMETRIC_KEY_DATA *)tpm_symmetric_key_token;
-    AES_KEY             key;
     size_t userKeyLength = tpm_symmetric_key_token->userKeyLength;
+    EVP_CIPHER_CTX *ctx = NULL;
+    evpfunc evpfn;
 
-    printf(" TPM_SymmetricKeyData_Decrypt: Length %u\n", encrypt_length);
     /* sanity check encrypted length */
     if (rc == 0) {
         if (encrypt_length < userKeyLength) {
-            printf("TPM_SymmetricKeyData_Decrypt: Error, bad length\n");
+            logprintf(STDERR_FILENO,
+                      "SWTPM_SymmetricKeyData_Decrypt: Error, bad length\n");
             rc = TPM_DECRYPT_ERROR;
         }
     }
     if (rc == 0) {
         if (u_ivec != NULL && u_ivec_length != userKeyLength) {
-            printf("TPM_SymmetricKeyData_Decrypt: IV is %u bytes, "
-                   "but expected %u bytes\n", u_ivec_length, userKeyLength);
+            logprintf(STDERR_FILENO,
+                      "SWTPM_SymmetricKeyData_Decrypt: IV is %u bytes, "
+                      "but expected %u bytes\n", u_ivec_length, userKeyLength);
             rc = TPM_DECRYPT_ERROR;
         } else {
             if (u_ivec) {
@@ -212,35 +238,46 @@ TPM_RESULT SWTPM_SymmetricKeyData_Decrypt(unsigned char **decrypt_data,   /* out
     }
 
     if (rc == 0) {
-        memset(&key, 0, sizeof(key)); /* coverity */
-        if (AES_set_decrypt_key(tpm_symmetric_key_data->userKey,
-                                userKeyLength * 8,
-                                &key) < 0) {
+        evpfn = SWTPM_Get_AES_EVPFn(userKeyLength * 8);
+        ctx = EVP_CIPHER_CTX_new();
+        if (!evpfn || !ctx ||
+            EVP_DecryptInit_ex(ctx, evpfn(), NULL,
+                               tpm_symmetric_key_data->userKey, ivec) != 1 ||
+            EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            logprintf(STDERR_FILENO,
+                      "Could not setup context for decryption.\n");
             rc = TPM_FAIL;
         }
     }
 
     /* decrypt the input to the padded output */
     if (rc == 0) {
+        int outlen1 = 0;
+        int outlen2 = 0;
+
         /* decrypt the padded input to the output */
-        //TPM_PrintFour("  TPM_SymmetricKeyData_Decrypt: Input", encrypt_data);
-        AES_cbc_encrypt(encrypt_data,
-                        *decrypt_data,
-                        encrypt_length,
-                        &key,
-                        ivec,
-                        AES_DECRYPT);
-        //TPM_PrintFour("  TPM_SymmetricKeyData_Decrypt: Output", *decrypt_data);
+        //TPM_PrintFour("  SWTPM_SymmetricKeyData_Decrypt: Input", encrypt_data);
+        if (EVP_DecryptUpdate(ctx,
+                              *decrypt_data, &outlen1,
+                              encrypt_data, encrypt_length) != 1 ||
+            EVP_DecryptFinal_ex(ctx, *decrypt_data + outlen1, &outlen2) != 1 ||
+            (uint32_t)(outlen1 + outlen2) != encrypt_length) {
+            logprintf(STDERR_FILENO,
+                      "Could not decrypt %u bytes. outlen1=%d, outlen2=%d.\n",
+                      encrypt_length, outlen1, outlen2);
+            rc = TPM_FAIL;
+        }
+        //TPM_PrintFour("  SWTPM_SymmetricKeyData_Decrypt: Output", *decrypt_data);
     }
     /* get the pad length */
     if (rc == 0) {
         /* get the pad length from the last byte */
         pad_length = (uint32_t)*(*decrypt_data + encrypt_length - 1);
         /* sanity check the pad length */
-        printf(" TPM_SymmetricKeyData_Decrypt: Pad length %u\n", pad_length);
         if ((pad_length == 0) ||
             (pad_length > userKeyLength)) {
-            printf("TPM_SymmetricKeyData_Decrypt: Error, illegal pad length\n");
+            logprintf(STDERR_FILENO,
+                      "SWTPM_SymmetricKeyData_Decrypt: Error, illegal pad length\n");
             rc = TPM_DECRYPT_ERROR;
         }
     }
@@ -252,11 +289,14 @@ TPM_RESULT SWTPM_SymmetricKeyData_Decrypt(unsigned char **decrypt_data,   /* out
         /* sanity check the pad */
         for (i = 0 ; i < pad_length ; i++, pad_data++) {
             if (*pad_data != pad_length) {
-                printf("TPM_SymmetricKeyData_Decrypt: Error, bad pad %02x at index %u\n",
-                       *pad_data, i);
+                logprintf(STDERR_FILENO,
+                          "SWTPM_SymmetricKeyData_Decrypt: Error, bad pad %02x at index %u\n",
+                          *pad_data, i);
                 rc = TPM_DECRYPT_ERROR;
             }
         }
     }
+    EVP_CIPHER_CTX_free(ctx);
+
     return rc;
 }
diff --git a/src/swtpm/swtpm_chardev.c b/src/swtpm/swtpm_chardev.c
index 2fa2668..165d568 100644
--- a/src/swtpm/swtpm_chardev.c
+++ b/src/swtpm/swtpm_chardev.c
@@ -57,7 +57,7 @@
 #include "main.h"
 #include "swtpm_debug.h"
 #include "swtpm_io.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
 #include "common.h"
 #include "locality.h"
 #include "logging.h"
@@ -70,7 +70,7 @@
 #include "vtpm_proxy.h"
 #endif
 #include "tpmstate.h"
-#include "osx.h"
+#include "daemonize.h"
 #include "seccomp_profile.h"
 #include "options.h"
 #include "capabilities.h"
@@ -175,10 +175,10 @@ static void usage(FILE *file, const char *prgname, const char *iface)
     "                   derived from this passphrase; default kdf is PBKDF2\n"
     "--pid file=<path>|fd=<filedescriptor>\n"
     "                 : write the process ID into the given file\n"
-    "--tpmstate dir=<dir>[,mode=0...]\n"
-    "                 : set the directory where the TPM's state will be written\n"
+    "--tpmstate dir=<dir>[,mode=0...]|backend-uri=<uri>\n"
+    "                 : set the directory or uri where the TPM's state will be written\n"
     "                   into; the TPM_PATH environment variable can be used\n"
-    "                   instead;\n"
+    "                   instead of dir option;\n"
     "                   mode allows a user to set the file mode bits of the state files;\n"
     "                   the default mode is 0640;\n"
     "-r|--runas <user>: change to the given user\n"
@@ -207,6 +207,8 @@ static void usage(FILE *file, const char *prgname, const char *iface)
 #endif
     "--print-capabilites\n"
     "                 : print capabilities and terminate\n"
+    "--print-states\n"
+    "                 : print existing TPM states and terminate\n"
     "-h|--help        : display this help screen and terminate\n"
     "\n",
     prgname, iface);
@@ -294,6 +296,7 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
     bool need_init_cmd = true;
     unsigned int seccomp_action;
     bool printcapabilities = false;
+    bool printstates = false;
     static struct option longopts[] = {
         {"daemon"    ,       no_argument, 0, 'd'},
         {"help"      ,       no_argument, 0, 'h'},
@@ -317,6 +320,7 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
 #endif
         {"print-capabilities"
                      ,       no_argument, 0, 'a'},
+        {"print-states",     no_argument, 0, 'e'},
         {NULL        , 0                , 0, 0  },
     };
 
@@ -331,6 +335,11 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
         switch (opt) {
         case 'd':
             daemonize = TRUE;
+            if (daemonize_prep() == -1) {
+                logprintf(STDERR_FILENO,
+                          "Could not prepare to daemonize: %s\n", strerror(errno));
+                exit(EXIT_FAILURE);
+            }
             break;
 
         case 'c':
@@ -423,6 +432,10 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
             printcapabilities = true;
             break;
 
+        case 'e':
+            printstates = true;
+            break;
+
         case 'r':
             runas = optarg;
             break;
@@ -449,6 +462,15 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
         exit(EXIT_FAILURE);
     }
 
+    /* change process ownership before accessing files */
+    if (runas) {
+        if (change_process_owner(runas) < 0)
+            exit(EXIT_FAILURE);
+    }
+
+    if (handle_log_options(logdata) < 0)
+        exit(EXIT_FAILURE);
+
     if (handle_locality_options(localitydata, &mlp.locality_flags) < 0)
         exit(EXIT_FAILURE);
 
@@ -459,22 +481,38 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
     }
 #endif
 
-    /*
-     * choose the TPM version early so that getting/setting
-     * buffer size works.
-     */
+    if (printcapabilities) {
+        /*
+         * Choose the TPM version so that getting/setting buffer size works.
+         * Ignore failure, for backward compatibility when TPM 1.2 is disabled.
+         */
+        TPMLIB_ChooseTPMVersion(mlp.tpmversion);
+        ret = capabilities_print_json(false);
+        exit(ret ? EXIT_FAILURE : EXIT_SUCCESS);
+    }
+
     if (TPMLIB_ChooseTPMVersion(mlp.tpmversion) != TPM_SUCCESS) {
         logprintf(STDERR_FILENO,
                   "Error: Could not choose TPM version.\n");
         exit(EXIT_FAILURE);
     }
 
-    if (printcapabilities) {
-        ret = capabilities_print_json(false);
-        exit(ret ? EXIT_FAILURE : EXIT_SUCCESS);
-    }
+    tpmstate_set_version(mlp.tpmversion);
 
-    SWTPM_NVRAM_Set_TPMVersion(mlp.tpmversion);
+    if (printstates) {
+        if (handle_tpmstate_options(tpmstatedata) < 0)
+            exit(EXIT_FAILURE);
+        if (tpmstatedata == NULL) {
+            logprintf(STDERR_FILENO,
+                      "Error: --tpmstate option is required for --print-states\n");
+            exit(EXIT_FAILURE);
+        }
+        ret = SWTPM_NVRAM_PrintJson();
+        if (ret)
+            goto exit_failure;
+        else
+            goto exit_success;
+    }
 
     if (mlp.fd < 0) {
         logprintf(STDERR_FILENO,
@@ -491,14 +529,7 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
         goto exit_failure;
     }
 
-    /* change process ownership before accessing files */
-    if (runas) {
-        if (change_process_owner(runas) < 0)
-            goto exit_failure;
-    }
-
-    if (handle_log_options(logdata) < 0 ||
-        handle_key_options(keydata) < 0 ||
+    if (handle_key_options(keydata) < 0 ||
         handle_migration_key_options(migkeydata) < 0 ||
         handle_pid_options(piddata) < 0 ||
         handle_tpmstate_options(tpmstatedata) < 0 ||
@@ -508,17 +539,6 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
         goto exit_failure;
     }
 
-    if (daemonize) {
-#if defined __APPLE__
-       if (0 != osx_daemon(1, 0)) {
-#else
-       if (0 != daemon(1, 0)) {
-#endif
-           logprintf(STDERR_FILENO, "Error: Could not daemonize.\n");
-           goto exit_failure;
-       }
-    }
-
     if (pidfile_write(getpid()) < 0) {
         goto exit_failure;
     }
@@ -552,6 +572,10 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
     mlp.flags |= MAIN_LOOP_FLAG_USE_FD | MAIN_LOOP_FLAG_KEEP_CONNECTION | \
       MAIN_LOOP_FLAG_END_ON_HUP;
 
+    if (daemonize) {
+        daemonize_finish();
+    }
+
     rc = mainLoop(&mlp, notify_fd[0]);
 
 error_seccomp_profile:
@@ -581,4 +605,9 @@ exit_failure:
     swtpm_cleanup(mlp.cc);
 
     exit(EXIT_FAILURE);
+
+exit_success:
+    swtpm_cleanup(mlp.cc);
+
+    exit(EXIT_SUCCESS);
 }
diff --git a/src/swtpm/swtpm_nvfile.c b/src/swtpm/swtpm_nvstore.c
similarity index 74%
rename from src/swtpm/swtpm_nvfile.c
rename to src/swtpm/swtpm_nvstore.c
index 7f69cbd..144d897 100644
--- a/src/swtpm/swtpm_nvfile.c
+++ b/src/swtpm/swtpm_nvstore.c
@@ -68,8 +68,12 @@
 #include <libtpms/tpm_library.h>
 
 #include <openssl/sha.h>
-#include <openssl/hmac.h>
 #include <openssl/rand.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+# include <openssl/core_names.h>
+#else
+# include <openssl/hmac.h>
+#endif
 
 #if defined(__OpenBSD__)
  # define OPENSSL_OLD_API
@@ -82,13 +86,15 @@
 #include "swtpm.h"
 #include "swtpm_aes.h"
 #include "swtpm_debug.h"
-#include "swtpm_nvfile.h"
+#include "swtpm_nvstore.h"
+#include "swtpm_utils.h"
 #include "key.h"
 #include "logging.h"
 #include "tpmstate.h"
 #include "tpmlib.h"
 #include "tlv.h"
 #include "utils.h"
+#include "compiler_dependencies.h"
 
 /* local structures */
 typedef struct {
@@ -127,15 +133,10 @@ static encryptionkey migrationkey = {
 
 static uint32_t g_ivec_length;
 static unsigned char *g_ivec;
+static struct nvram_backend_ops *g_nvram_backend_ops;
 
 /* local prototypes */
 
-static TPM_RESULT SWTPM_NVRAM_GetFilenameForName(char *filename,
-                                                 size_t bufsize,
-                                                  uint32_t tpm_number,
-                                                 const char *name,
-                                                 bool is_tempfile);
-
 static TPM_RESULT SWTPM_NVRAM_EncryptData(const encryptionkey *key,
                                           tlv_data *td,
                                           size_t *td_len,
@@ -166,124 +167,86 @@ static TPM_RESULT SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
                                           uint8_t *hdrversion,
                                           bool quiet);
 
-/* A file name in NVRAM is composed of 3 parts:
-
-  1 - 'state_directory' is the rooted path to the TPM state home directory
-  2 = 'tpm_number' is the TPM instance, 00 for a single TPM
-  2 - the file name
+/* SWTPM_NVRAM_Init() is called once at startup.  It does any NVRAM required initialization.
 
-  For the IBM cryptographic coprocessor version, the root path is hard coded.
-  
-  For the Linux and Windows versions, the path comes from an environment variable.  This variable is
-  used once in TPM_NVRAM_Init().
-
-  One root path is used for all virtual TPM's, so it can be a static variable.
+   This function sets some static variables that are used by all TPM's.
 */
 
-static int lockfile_fd = -1;
-
-char state_directory[FILENAME_MAX];
-static TPMLIB_TPMVersion tpmversion = TPMLIB_TPM_VERSION_1_2;
-
-/*
- * SWTPM_NVRAM_Set_TPMVersion()  - set the version of the TPM being used
- */
-void SWTPM_NVRAM_Set_TPMVersion(TPMLIB_TPMVersion version)
-{
-    tpmversion = version;
-}
-
-static TPM_RESULT SWTPM_NVRAM_Lock_Lockfile(const char *directory,
-                                            int *fd)
+TPM_RESULT SWTPM_NVRAM_Init(void)
 {
-    TPM_RESULT rc = 0;
-    char *lockfile = NULL;
-    struct flock flock = {
-        .l_type = F_WRLCK,
-        .l_whence = SEEK_SET,
-        .l_start = 0,
-        .l_len = 0,
-    };
-
-    if (asprintf(&lockfile, "%s/.lock", directory) < 0) {
-        logprintf(STDERR_FILENO,
-                  "SWTPM_NVRAM_Lock_Lockfile: Could not asprintf lock filename\n");
-        return TPM_FAIL;
-    }
+    const char  *backend_uri;
+    TPM_RESULT  rc = 0;
+    TPM_DEBUG(" SWTPM_NVRAM_Init:\n");
 
-    *fd = open(lockfile, O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW, 0660);
-    if (*fd < 0) {
+    backend_uri = tpmstate_get_backend_uri();
+    if (!backend_uri) {
         logprintf(STDERR_FILENO,
-                  "SWTPM_NVRAM_Lock_Lockfile: Could not open lockfile: %s\n",
-                  strerror(errno));
+                  "SWTPM_NVRAM_Init: Missing backend URI.\n");
         rc = TPM_FAIL;
-        goto exit;
-    }
-
-    if (fcntl(*fd, F_SETLK, &flock) < 0) {
+    } else if (strncmp(backend_uri, "dir://", 6) == 0) {
+        g_nvram_backend_ops = &nvram_dir_ops;
+    } else if (strncmp(backend_uri, "file://", 7) == 0) {
+        g_nvram_backend_ops = &nvram_linear_ops;
+    } else {
         logprintf(STDERR_FILENO,
-                  "SWTPM_NVRAM_Lock_Lockfile: Could not lock access to lockfile: %s\n",
-                  strerror(errno));
+                  "SWTPM_NVRAM_Init: Unsupported backend.\n");
         rc = TPM_FAIL;
-        close(*fd);
-        *fd = -1;
     }
-exit:
-    free(lockfile);
+
+    if (rc == 0)
+        rc = g_nvram_backend_ops->prepare(backend_uri);
 
     return rc;
 }
 
-/* TPM_NVRAM_Init() is called once at startup.  It does any NVRAM required initialization.
+void SWTPM_NVRAM_Shutdown(void)
+{
+    if (g_nvram_backend_ops)
+        g_nvram_backend_ops->cleanup();
+    memset(&filekey, 0, sizeof(filekey));
+    memset(&migrationkey, 0, sizeof(migrationkey));
+}
 
-   This function sets some static variables that are used by all TPM's.
-*/
+/* SWTPM_NVRAM_GetFilenameForName() constructs a file name from the name.
+ * A temporary filename used to write to may be created. It should be rename()'d to
+ * the non-temporary filename.
+ */
 
-TPM_RESULT SWTPM_NVRAM_Init(void)
+TPM_RESULT
+SWTPM_NVRAM_GetFilenameForName(char *filename,       /* output: filename */
+                               size_t bufsize,
+                               uint32_t tpm_number,
+                               const char *name,     /* input: abstract name */
+                               TPM_BOOL is_tempfile) /* input: is temporary file? */
 {
-    TPM_RESULT  rc = 0;
-    const char  *tpm_state_path;
-    size_t      length;
+    TPM_RESULT res = TPM_SUCCESS;
+    int n;
+    const char *suffix = "";
 
-    TPM_DEBUG(" SWTPM_NVRAM_Init:\n");
+    TPM_DEBUG(" SWTPM_NVRAM_GetFilenameForName: For name %s\n", name);
 
-    /* TPM_NV_DISK TPM emulation stores in local directory determined by environment variable. */
-    if (rc == 0) {
-        tpm_state_path = tpmstate_get_dir();
-        if (tpm_state_path == NULL) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_Init: Error (fatal), TPM_PATH environment "
-                      "variable not set\n");
-            rc = TPM_FAIL;
-        }
+    switch (tpmstate_get_version()) {
+    case TPMLIB_TPM_VERSION_1_2:
+        break;
+    case TPMLIB_TPM_VERSION_2:
+        suffix = "2";
+        break;
     }
 
-    /* check that the directory name plus a file name will not overflow FILENAME_MAX */
-    if (rc == 0) {
-        length = strlen(tpm_state_path);
-        if ((length + TPM_FILENAME_MAX) > FILENAME_MAX) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_Init: Error (fatal), TPM state path name "
-                      "%s too large\n", tpm_state_path);
-            rc = TPM_FAIL;
-        }
+    if (is_tempfile) {
+        n = snprintf(filename, bufsize, "TMP%s-%02lx.%s", suffix, (unsigned long)tpm_number, name);
+    } else {
+        n = snprintf(filename, bufsize, "tpm%s-%02lx.%s", suffix, (unsigned long)tpm_number, name);
     }
-    if (rc == 0) {
-        strcpy(state_directory, tpm_state_path);
-        TPM_DEBUG("TPM_NVRAM_Init: Rooted state path %s\n", state_directory);
+    if ((size_t)n > bufsize) {
+        res = TPM_FAIL;
     }
 
-    if (rc == 0 && lockfile_fd < 0)
-        rc = SWTPM_NVRAM_Lock_Lockfile(state_directory, &lockfile_fd);
+    TPM_DEBUG("  SWTPM_NVRAM_GetFilenameForName: File name %s\n", filename);
 
-    return rc;
+    return res;
 }
 
-void SWTPM_NVRAM_Shutdown(void)
-{
-    memset(&filekey, 0, sizeof(filekey));
-    memset(&migrationkey, 0, sizeof(migrationkey));
-}
 
 /* Load 'data' of 'length' from the 'name'.
 
@@ -302,101 +265,22 @@ SWTPM_NVRAM_LoadData(unsigned char **data,     /* freed by caller */
                      const char *name)
 {
     TPM_RESULT    rc = 0;
-    size_t        src;
     int           irc;
-    int           fd = -1;
-    char          filename[FILENAME_MAX]; /* rooted file name from name */
     unsigned char *decrypt_data = NULL;
     uint32_t      decrypt_length;
     uint32_t      dataoffset = 0;
     uint8_t       hdrversion = 0;
     uint16_t      hdrflags;
-    struct stat   statbuf;
+    const char    *backend_uri = NULL;
 
     TPM_DEBUG(" SWTPM_NVRAM_LoadData: From file %s\n", name);
     *data = NULL;
     *length = 0;
-    /* open the file */
-    if (rc == 0) {
-        /* map name to the rooted filename */
-        rc = SWTPM_NVRAM_GetFilenameForName(filename, sizeof(filename),
-                                            tpm_number, name, false);
-    }
 
     if (rc == 0) {
-        TPM_DEBUG("  SWTPM_NVRAM_LoadData: Opening file %s\n", filename);
-        fd = open(filename, O_RDONLY);                          /* closed @1 */
-        if (fd < 0) {     /* if failure, determine cause */
-            if (errno == ENOENT) {
-                TPM_DEBUG("SWTPM_NVRAM_LoadData: No such file %s\n",
-                         filename);
-                rc = TPM_RETRY;         /* first time start up */
-            }
-            else {
-                logprintf(STDERR_FILENO,
-                          "SWTPM_NVRAM_LoadData: Error (fatal) opening "
-                          "%s for read, %s\n", filename, strerror(errno));
-                rc = TPM_FAIL;
-            }
-        }
-    }
-
-    if (rc == 0) {
-        if (fchmod(fd, tpmstate_get_mode()) < 0) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_LoadData: Could not fchmod %s : %s\n",
-                      filename, strerror(errno));
-            rc = TPM_FAIL;
-        }
-    }
-
-    /* determine the file length */
-    if (rc == 0) {
-        irc = fstat(fd, &statbuf);
-        if (irc == -1L) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_LoadData: Error (fatal) fstat'ing %s, %s\n",
-                      filename, strerror(errno));
-            rc = TPM_FAIL;
-        }
-    }
-    if (rc == 0) {
-        *length = statbuf.st_size;              /* save the length */
-    }
-    /* allocate a buffer for the actual data */
-    if ((rc == 0) && *length != 0) {
-        TPM_DEBUG(" SWTPM_NVRAM_LoadData: Reading %u bytes of data\n", *length);
-        *data = malloc(*length);
-        if (!*data) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_LoadData: Error (fatal) allocating %u "
-                      "bytes\n", *length);
-            rc = TPM_FAIL;
-        }
-    }
-    /* read the contents of the file into the data buffer */
-    if ((rc == 0) && *length != 0) {
-        src = read(fd, *data, *length);
-        if (src != *length) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_LoadData: Error (fatal), data read of %u "
-                      "only read %lu\n", *length, (unsigned long)src);
-            rc = TPM_FAIL;
-        }
-    }
-    /* close the file */
-    if (fd >= 0) {
-        TPM_DEBUG(" SWTPM_NVRAM_LoadData: Closing file %s\n", filename);
-        irc = close(fd);               /* @1 */
-        if (irc != 0) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_LoadData: Error (fatal) closing file %s\n",
-                      filename);
-            rc = TPM_FAIL;
-        }
-        else {
-            TPM_DEBUG(" SWTPM_NVRAM_LoadData: Closed file %s\n", filename);
-        }
+        backend_uri = tpmstate_get_backend_uri();
+        rc = g_nvram_backend_ops->load(data, length, tpm_number, name,
+                                       backend_uri);
     }
 
     if (rc == 0) {
@@ -460,43 +344,14 @@ SWTPM_NVRAM_StoreData_Intern(const unsigned char *data,
                              TPM_BOOL encrypt         /* encrypt if key is set */)
 {
     TPM_RESULT    rc = 0;
-    uint32_t      lrc;
-    int           irc;
-    int           fd = -1;
-    char          tmpfile[FILENAME_MAX];  /* rooted temporary file */
-    char          filename[FILENAME_MAX]; /* rooted file name from name */
     unsigned char *filedata = NULL;
     uint32_t      filedata_length = 0;
     tlv_data      td[3];
     size_t        td_len = 0;
     uint16_t      flags = 0;
+    const char    *backend_uri = NULL;
 
     TPM_DEBUG(" SWTPM_NVRAM_StoreData: To name %s\n", name);
-    if (rc == 0) {
-        /* map name to the rooted filename */
-        rc = SWTPM_NVRAM_GetFilenameForName(filename, sizeof(filename),
-                                            tpm_number, name, false);
-    }
-
-    if (rc == 0) {
-        /* map name to the rooted temporary file */
-        rc = SWTPM_NVRAM_GetFilenameForName(tmpfile, sizeof(tmpfile),
-                                            tpm_number, name, true);
-    }
-
-
-    if (rc == 0) {
-        /* open the file */
-        TPM_DEBUG(" SWTPM_NVRAM_StoreData: Opening file %s\n", tmpfile);
-        fd = open(tmpfile, O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW,
-                  tpmstate_get_mode());                        /* closed @1 */
-        if (fd < 0) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_StoreData: Error (fatal) opening %s for "
-                      "write failed, %s\n", tmpfile, strerror(errno));
-            rc = TPM_FAIL;
-        }
-    }
 
     if (rc == 0) {
         if (encrypt && SWTPM_NVRAM_Has_FileKey()) {
@@ -527,44 +382,10 @@ SWTPM_NVRAM_StoreData_Intern(const unsigned char *data,
     if (rc == 0)
         rc = SWTPM_NVRAM_PrependHeader(&filedata, &filedata_length, flags);
 
-    /* write the data to the file */
     if (rc == 0) {
-        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Writing %u bytes of data\n", length);
-        lrc = write_full(fd, filedata, filedata_length);
-        if (lrc != filedata_length) {
-            logprintf(STDERR_FILENO,
-                      "TPM_NVRAM_StoreData: Error (fatal), data write "
-                      "of %u only wrote %u\n", filedata_length, lrc);
-            rc = TPM_FAIL;
-        }
-    }
-    if (fd >= 0) {
-        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closing file %s\n", tmpfile);
-        irc = close(fd);             /* @1 */
-        if (irc != 0) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_StoreData: Error (fatal) closing file\n");
-            rc = TPM_FAIL;
-        }
-        else {
-            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closed file %s\n", tmpfile);
-        }
-    }
-
-    if (rc == 0 && fd >= 0) {
-        irc = rename(tmpfile, filename);
-        if (irc != 0) {
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_StoreData: Error (fatal) renaming file: %s\n",
-                      strerror(errno));
-            rc = TPM_FAIL;
-        } else {
-            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Renamed file to %s\n", filename);
-        }
-    }
-
-    if (rc != 0 && fd >= 0) {
-        unlink(tmpfile);
+        backend_uri = tpmstate_get_backend_uri();
+        rc = g_nvram_backend_ops->store(filedata, filedata_length, tpm_number, name,
+                                        backend_uri);
     }
 
     tlv_data_free(td, td_len);
@@ -583,53 +404,7 @@ TPM_RESULT SWTPM_NVRAM_StoreData(const unsigned char *data,
     return SWTPM_NVRAM_StoreData_Intern(data, length, tpm_number, name, TRUE);
 }
 
-/* SWTPM_NVRAM_GetFilenameForName() constructs a rooted file name from the name.
-
-   The filename is of the form:
-
-   state_directory/tpm_number.name
-
-   A temporary filename used to write to may be created. It shold be rename()'d to
-   the non-temporary filename.
-*/
-
-static TPM_RESULT SWTPM_NVRAM_GetFilenameForName(char *filename,        /* output: rooted filename */
-                                                 size_t bufsize,
-                                                 uint32_t tpm_number,
-                                                 const char *name,      /* input: abstract name */
-                                                 bool is_tempfile)      /* input: is temporary file? */
-{
-    TPM_RESULT res = TPM_SUCCESS;
-    int n;
-    const char *suffix = "";
-
-    TPM_DEBUG(" SWTPM_NVRAM_GetFilenameForName: For name %s\n", name);
-
-    switch (tpmversion) {
-    case TPMLIB_TPM_VERSION_1_2:
-        break;
-    case TPMLIB_TPM_VERSION_2:
-        suffix = "2";
-        break;
-    }
-
-    if (is_tempfile) {
-        n = snprintf(filename, bufsize, "%s/TMP%s-%02lx.%s",
-                     state_directory, suffix, (unsigned long)tpm_number, name);
-    } else {
-        n = snprintf(filename, bufsize, "%s/tpm%s-%02lx.%s",
-                     state_directory, suffix, (unsigned long)tpm_number, name);
-    }
-    if ((size_t)n > bufsize) {
-        res = TPM_FAIL;
-    }
-
-    TPM_DEBUG("  SWTPM_NVRAM_GetFilenameForName: File name %s\n", filename);
-
-    return res;
-}
-
-/* TPM_NVRAM_DeleteName() deletes the 'name' from NVRAM
+/* SWTPM_NVRAM_DeleteName() deletes the 'name' from NVRAM
 
    Returns:
         0 on success, or if the file does not exist and mustExist is FALSE
@@ -643,26 +418,11 @@ TPM_RESULT SWTPM_NVRAM_DeleteName(uint32_t tpm_number,
                                   const char *name,
                                   TPM_BOOL mustExist)
 {
-    TPM_RESULT  rc = 0;
-    int         irc;
-    char        filename[FILENAME_MAX]; /* rooted file name from name */
+    const char *backend_uri = NULL;
+    backend_uri = tpmstate_get_backend_uri();
 
-    TPM_DEBUG(" SWTPM_NVRAM_DeleteName: Name %s\n", name);
-    /* map name to the rooted filename */
-    rc = SWTPM_NVRAM_GetFilenameForName(filename, sizeof(filename),
-                                        tpm_number, name, false);
-    if (rc == 0) {
-        irc = remove(filename);
-        if ((irc != 0) &&               /* if the remove failed */
-            (mustExist ||               /* if any error is a failure, or */
-             (errno != ENOENT))) {      /* if error other than no such file */
-            logprintf(STDERR_FILENO,
-                      "SWTPM_NVRAM_DeleteName: Error, (fatal) file "
-                      "remove failed, errno %d\n", errno);
-            rc = TPM_FAIL;
-        }
-    }
-    return rc;
+    return g_nvram_backend_ops->delete(tpm_number, name, mustExist,
+                                       backend_uri);
 }
 
 
@@ -751,6 +511,54 @@ TPM_RESULT SWTPM_NVRAM_Set_MigrationKey(const unsigned char *key,
     return rc;
 }
 
+# if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static int SWTPM_HMAC(unsigned char *md, unsigned int *md_len,
+                      const void *key, int key_len,
+                      const unsigned char *in, uint32_t in_length,
+                      const unsigned char *ivec, uint32_t ivec_length)
+{
+    OSSL_PARAM params[2];
+    EVP_MAC_CTX *ctx;
+    EVP_MAC *hmac;
+    size_t outl;
+    int ret = 0;
+
+    hmac = EVP_MAC_fetch(NULL, OSSL_MAC_NAME_HMAC, NULL);
+    if (!hmac)
+        return 0;
+
+    ctx = EVP_MAC_CTX_new(hmac);
+    if (!ctx)
+        goto err;
+
+    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
+                                                 "sha256", 0);
+    params[1] = OSSL_PARAM_construct_end();
+
+    if (!EVP_MAC_init(ctx, key, key_len, params) ||
+        !EVP_MAC_update(ctx, in, in_length))
+        goto err;
+
+    if (ivec &&
+        !EVP_MAC_update(ctx, ivec, ivec_length))
+        goto err;
+
+    if (!EVP_MAC_final(ctx, md, &outl, *md_len))
+        goto err;
+    *md_len = outl;
+
+    ret = 1;
+
+err:
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(hmac);
+
+    return ret;
+}
+
+#else
+
 static int SWTPM_HMAC(unsigned char *md, unsigned int *md_len,
                       const void *key, int key_len,
                       const unsigned char *in, uint32_t in_length,
@@ -792,6 +600,7 @@ err:
 
     return ret;
 }
+#endif /* if OPENSSL_VERSION_NUMBER >= 0x30000000L */
 
 /*
  * SWTPM_RollAndSetGlobalIvec: Create an IV for the AES CBC algorithm to use
@@ -878,8 +687,8 @@ SWTPM_CalcHMAC(const unsigned char *in, uint32_t in_length,
                const unsigned char *ivec, uint32_t ivec_length)
 {
     TPM_RESULT rc = 0;
-    unsigned int md_len;
     unsigned char md[EVP_MAX_MD_SIZE];
+    unsigned int md_len = sizeof(md);
     unsigned char *buffer = NULL;
 
     if (!SWTPM_HMAC(md, &md_len,
@@ -1409,7 +1218,7 @@ err_exit:
 TPM_RESULT SWTPM_NVRAM_SetStateBlob(unsigned char *data,
                                     uint32_t length,
                                     TPM_BOOL is_encrypted,
-                                    uint32_t tpm_number,
+                                    uint32_t tpm_number SWTPM_ATTR_UNUSED,
                                     uint32_t blobtype)
 {
     TPM_RESULT res;
@@ -1519,3 +1328,51 @@ cleanup:
 
     return res;
 }
+
+/* Example JSON output:
+ *  { "type": "swtpm",
+ *    "states": [ "permall", "volatilestate", "savestate" ]
+ *  }
+ */
+int SWTPM_NVRAM_PrintJson(void)
+{
+    TPM_RESULT rc = 0;
+    const char *backend_uri;
+    const char *states[] = {
+        TPM_PERMANENT_ALL_NAME,
+        TPM_VOLATILESTATE_NAME,
+        TPM_SAVESTATE_NAME,
+    };
+    char state_str[200] = "";
+    size_t i, n, o, blobsize;
+    int ret = -1;
+
+    rc = SWTPM_NVRAM_Init();
+    if (rc == 0) {
+        o = 0;
+        backend_uri = tpmstate_get_backend_uri();
+
+        for (i = 0; i < ARRAY_LEN(states); i++) {
+            rc = g_nvram_backend_ops->check_state(backend_uri, states[i],
+                                                  &blobsize);
+            if (rc == TPM_SUCCESS) {
+                n = snprintf(&state_str[o], sizeof(state_str) - o,
+                             "%s {\"name\": \"%s\", \"size\": %zu}",
+                             (o > 0) ? "," : "",
+                             states[i], blobsize);
+                if (n >= sizeof(state_str) - o)
+                    goto exit;
+                o += n;
+            } else if (rc != TPM_RETRY) {
+                /* Error other than ENOENT */
+                goto exit;
+            }
+        }
+        printf("{ \"type\": \"swtpm\", \"states\": [%s%s] }",
+               state_str,  (o > 0) ? " ": "");
+        ret = 0;
+    }
+
+exit:
+    return ret;
+}
diff --git a/src/swtpm/swtpm_nvfile.h b/src/swtpm/swtpm_nvstore.h
similarity index 80%
rename from src/swtpm/swtpm_nvfile.h
rename to src/swtpm/swtpm_nvstore.h
index 25c18a9..6e34891 100644
--- a/src/swtpm/swtpm_nvfile.h
+++ b/src/swtpm/swtpm_nvstore.h
@@ -36,29 +36,19 @@
 /* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.		*/
 /********************************************************************************/
 
-#ifndef _SWTPM_NVFILE_H
-#define _SWTPM_NVFILE_H
+#ifndef _SWTPM_NVSTORE_H
+#define _SWTPM_NVSTORE_H
 
+#include <stdio.h>
 #include <libtpms/tpm_types.h>
+#include <libtpms/tpm_library.h>
 
 #include "key.h"
 
-/* characters in the TPM base file name, 14 for file name, slash, NUL terminator, etc.
-
-   This macro is used once during initialization to ensure that the TPM_PATH environment variable
-   length will not cause the rooted file name to overflow file name buffers.
-*/
-
-#define TPM_FILENAME_MAX 20
-
-#include <libtpms/tpm_library.h>
-
 TPM_RESULT SWTPM_NVRAM_Init(void);
 
 void SWTPM_NVRAM_Shutdown(void);
 
-void SWTPM_NVRAM_Set_TPMVersion(TPMLIB_TPMVersion version);
-
 /*
   Basic abstraction for read and write
 */
@@ -97,6 +87,12 @@ TPM_RESULT SWTPM_NVRAM_SetStateBlob(unsigned char *data,
                                     uint32_t tpm_number,
                                     uint32_t blobtype);
 
+TPM_RESULT SWTPM_NVRAM_GetFilenameForName(char *filename,
+                                          size_t bufsize,
+                                          uint32_t tpm_number,
+                                          const char *name,
+                                          TPM_BOOL is_tempfile);
+
 size_t SWTPM_NVRAM_FileKey_Size(void);
 static inline TPM_BOOL SWTPM_NVRAM_Has_FileKey(void)
 {
@@ -109,5 +105,33 @@ static inline TPM_BOOL SWTPM_NVRAM_Has_MigrationKey(void)
     return SWTPM_NVRAM_MigrationKey_Size() > 0;
 }
 
-#endif /* _SWTPM_NVFILE_H */
-
+struct nvram_backend_ops {
+    TPM_RESULT (*prepare)(const char *uri);
+    TPM_RESULT (*load)(unsigned char **data,
+                       uint32_t *length,
+                       uint32_t tpm_number,
+                       const char *name,
+                       const char *uri);
+    TPM_RESULT (*store)(unsigned char *edata,
+                        uint32_t data_length,
+                        uint32_t tpm_number,
+                        const char *name,
+                        const char *uri);
+    TPM_RESULT (*delete)(uint32_t tpm_number,
+                         const char *name,
+                         TPM_BOOL mustExist,
+                         const char *uri);
+    TPM_RESULT (*check_state)(const char *uri,
+                              const char *name,
+                              size_t *blobsize);
+    void (*cleanup)(void);
+};
+
+/* backend interfaces */
+extern struct nvram_backend_ops nvram_dir_ops;
+extern struct nvram_backend_ops nvram_linear_ops;
+
+
+int SWTPM_NVRAM_PrintJson(void);
+
+#endif /* _SWTPM_NVSTORE_H */
diff --git a/src/swtpm/swtpm_nvstore_dir.c b/src/swtpm/swtpm_nvstore_dir.c
new file mode 100644
index 0000000..ba7bd62
--- /dev/null
+++ b/src/swtpm/swtpm_nvstore_dir.c
@@ -0,0 +1,527 @@
+/********************************************************************************/
+/*                                                                              */
+/*                      NVRAM File Abstraction Layer                            */
+/*                           Written by Ken Goldman                             */
+/*                       Adapted to SWTPM by Stefan Berger                      */
+/*                     IBM Thomas J. Watson Research Center                     */
+/*                                                                              */
+/* (c) Copyright IBM Corporation 2006, 2010, 2014, 2015.			*/
+/*										*/
+/* All rights reserved.								*/
+/* 										*/
+/* Redistribution and use in source and binary forms, with or without		*/
+/* modification, are permitted provided that the following conditions are	*/
+/* met:										*/
+/* 										*/
+/* Redistributions of source code must retain the above copyright notice,	*/
+/* this list of conditions and the following disclaimer.			*/
+/* 										*/
+/* Redistributions in binary form must reproduce the above copyright		*/
+/* notice, this list of conditions and the following disclaimer in the		*/
+/* documentation and/or other materials provided with the distribution.		*/
+/* 										*/
+/* Neither the names of the IBM Corporation nor the names of its		*/
+/* contributors may be used to endorse or promote products derived from		*/
+/* this software without specific prior written permission.			*/
+/* 										*/
+/* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS		*/
+/* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT		*/
+/* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR	*/
+/* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT		*/
+/* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,	*/
+/* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT		*/
+/* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,	*/
+/* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY	*/
+/* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT		*/
+/* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE	*/
+/* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.		*/
+/********************************************************************************/
+
+#include "config.h"
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include <libtpms/tpm_error.h>
+
+#include "swtpm.h"
+#include "swtpm_debug.h"
+#include "swtpm_nvstore.h"
+#include "key.h"
+#include "logging.h"
+#include "tpmstate.h"
+#include "utils.h"
+
+#define TPM_FILENAME_MAX 20
+
+static int lock_fd = -1;
+
+static const char *
+SWTPM_NVRAM_Uri_to_Dir(const char *uri)
+{
+    return uri + strlen("dir://");
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_Validate_Dir(const char *tpm_state_path)
+{
+    TPM_RESULT  rc = 0;
+    size_t      length;
+
+    /* TPM_NV_DISK TPM emulation stores in local directory determined by environment variable. */
+    if (rc == 0) {
+        if (tpm_state_path == NULL) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_Validate_Dir: Error (fatal), TPM_PATH environment "
+                      "variable not set\n");
+            rc = TPM_FAIL;
+        }
+    }
+
+    /* check that the directory name plus a file name will not overflow FILENAME_MAX */
+    if (rc == 0) {
+        length = strlen(tpm_state_path);
+        if ((length + TPM_FILENAME_MAX) > FILENAME_MAX) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_Validate_Dir: Error (fatal), TPM state path name "
+                      "%s too large\n", tpm_state_path);
+            rc = TPM_FAIL;
+        }
+    }
+    if (rc == 0) {
+        TPM_DEBUG("SWTPM_NVRAM_Validate_Dir: Rooted state path %s\n", tpm_state_path);
+    }
+
+    return rc;
+}
+
+static void
+SWTPM_NVRAM_Unlock_Dir(void)
+{
+    if (lock_fd >= 0) {
+        close(lock_fd);
+        lock_fd = -1;
+    }
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_Lock_Dir(const char *tpm_state_path)
+{
+    TPM_RESULT rc = 0;
+    char *lockfile = NULL;
+    struct flock flock = {
+        .l_type = F_WRLCK,
+        .l_whence = SEEK_SET,
+        .l_start = 0,
+        .l_len = 0,
+    };
+
+    if (asprintf(&lockfile, "%s/.lock", tpm_state_path) < 0) {
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_Lock_Dir: Could not asprintf lock filename\n");
+        return TPM_FAIL;
+    }
+
+    lock_fd = open(lockfile, O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW, 0660);
+    if (lock_fd < 0) {
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_Lock_Dir: Could not open lockfile: %s\n",
+                  strerror(errno));
+        rc = TPM_FAIL;
+        goto exit;
+    }
+
+    if (fcntl(lock_fd, F_SETLK, &flock) < 0) {
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_Lock_Dir: Could not lock access to lockfile: %s\n",
+                  strerror(errno));
+        rc = TPM_FAIL;
+        SWTPM_NVRAM_Unlock_Dir();
+    }
+exit:
+    free(lockfile);
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_GetFilepathForName(char *filepath,       /* output: rooted file path */
+                               size_t bufsize,
+                               uint32_t tpm_number,
+                               const char *name,     /* input: abstract name */
+                               TPM_BOOL is_tempfile, /* input: is temporary file? */
+                               const char *tpm_state_path)
+{
+    TPM_RESULT rc = 0;
+    int n;
+    char filename[FILENAME_MAX];
+
+    if (rc == 0)
+        rc = SWTPM_NVRAM_GetFilenameForName(filename, sizeof(filename),
+                                            tpm_number, name, is_tempfile);
+    if (rc == 0) {
+        n = snprintf(filepath, bufsize, "%s/%s", tpm_state_path, filename);
+        if ((size_t) n > bufsize)
+            rc = TPM_FAIL;
+    }
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_CheckState_Dir(const char *uri,
+                           const char *name,
+                           size_t *blobsize)
+{
+    TPM_RESULT    rc = 0;
+    char          filepath[FILENAME_MAX]; /* rooted file path from name */
+    struct stat   statbuf;
+    const char   *tpm_state_path = NULL;
+    uint32_t      tpm_number = 0;
+    int           rc2;
+
+    tpm_state_path = SWTPM_NVRAM_Uri_to_Dir(uri);
+    if (rc == 0) {
+        /* map name to the rooted file path */
+        rc = SWTPM_NVRAM_GetFilepathForName(filepath, sizeof(filepath),
+                                            tpm_number, name, false,
+                                            tpm_state_path);
+    }
+
+    if (rc == 0) {
+        rc2 = stat(filepath, &statbuf);
+        if (rc2 != 0 && errno == ENOENT)
+            rc = TPM_RETRY;
+        else if (rc2 != 0)
+            rc = TPM_FAIL;
+        else if (!S_ISREG(statbuf.st_mode))
+            rc = TPM_FAIL;
+
+        if (rc == 0)
+            *blobsize = statbuf.st_size;
+    }
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_Prepare_Dir(const char *uri)
+{
+    TPM_RESULT    rc = 0;
+    const char *tpm_state_path = NULL;
+
+    tpm_state_path = SWTPM_NVRAM_Uri_to_Dir(uri);
+    if (rc == 0)
+        rc = SWTPM_NVRAM_Validate_Dir(tpm_state_path);
+    if (rc == 0)
+        rc = SWTPM_NVRAM_Lock_Dir(tpm_state_path);
+
+    return rc;
+}
+
+static void
+SWTPM_NVRAM_Cleanup_Dir(void)
+{
+    SWTPM_NVRAM_Unlock_Dir();
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_LoadData_Dir(unsigned char **data,
+                         uint32_t *length,
+                         uint32_t tpm_number,
+                         const char *name,
+                         const char *uri)
+{
+    TPM_RESULT    rc = 0;
+    int           irc;
+    size_t        src;
+    int           fd = -1;
+    char          filepath[FILENAME_MAX]; /* rooted file path from name */
+    struct stat   statbuf;
+    const char    *tpm_state_path = NULL;
+
+    tpm_state_path = SWTPM_NVRAM_Uri_to_Dir(uri);
+
+    if (rc == 0) {
+        /* map name to the rooted file path */
+        rc = SWTPM_NVRAM_GetFilepathForName(filepath, sizeof(filepath),
+                                            tpm_number, name, false,
+                                            tpm_state_path);
+    }
+
+    /* open the file */
+    if (rc == 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_LoadData: Opening file %s\n", filepath);
+        fd = open(filepath, O_RDONLY);                          /* closed @1 */
+        if (fd < 0) {     /* if failure, determine cause */
+            if (errno == ENOENT) {
+                TPM_DEBUG("SWTPM_NVRAM_LoadData: No such file %s\n",
+                         filepath);
+                rc = TPM_RETRY;         /* first time start up */
+            }
+            else {
+                logprintf(STDERR_FILENO,
+                          "SWTPM_NVRAM_LoadData: Error (fatal) opening "
+                          "%s for read, %s\n", filepath, strerror(errno));
+                rc = TPM_FAIL;
+            }
+        }
+    }
+
+    if (rc == 0) {
+        if (fchmod(fd, tpmstate_get_mode()) < 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_LoadData: Could not fchmod %s : %s\n",
+                      filepath, strerror(errno));
+            rc = TPM_FAIL;
+        }
+    }
+
+    /* determine the file length */
+    if (rc == 0) {
+        irc = fstat(fd, &statbuf);
+        if (irc == -1L) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_LoadData: Error (fatal) fstat'ing %s, %s\n",
+                      filepath, strerror(errno));
+            rc = TPM_FAIL;
+        }
+    }
+    if (rc == 0) {
+        *length = statbuf.st_size;              /* save the length */
+    }
+    /* allocate a buffer for the actual data */
+    if ((rc == 0) && *length != 0) {
+        TPM_DEBUG(" SWTPM_NVRAM_LoadData: Reading %u bytes of data\n", *length);
+        *data = malloc(*length);
+        if (!*data) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_LoadData: Error (fatal) allocating %u "
+                      "bytes\n", *length);
+            rc = TPM_FAIL;
+        }
+    }
+    /* read the contents of the file into the data buffer */
+    if ((rc == 0) && *length != 0) {
+        src = read(fd, *data, *length);
+        if (src != *length) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_LoadData: Error (fatal), data read of %u "
+                      "only read %lu\n", *length, (unsigned long)src);
+            rc = TPM_FAIL;
+        }
+    }
+    /* close the file */
+    if (fd >= 0) {
+        TPM_DEBUG(" SWTPM_NVRAM_LoadData: Closing file %s\n", filepath);
+        irc = close(fd);               /* @1 */
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_LoadData: Error (fatal) closing file %s\n",
+                      filepath);
+            rc = TPM_FAIL;
+        }
+        else {
+            TPM_DEBUG(" SWTPM_NVRAM_LoadData: Closed file %s\n", filepath);
+        }
+    }
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_StoreData_Dir(unsigned char *filedata,
+                          uint32_t filedata_length,
+                          uint32_t tpm_number,
+                          const char *name,
+                          const char *uri)
+{
+    TPM_RESULT    rc = 0;
+    int           fd = -1;
+    int           dir_fd = -1;
+    uint32_t      lrc;
+    int           irc;
+    char          tmpfile[FILENAME_MAX];  /* rooted temporary file path */
+    char          filepath[FILENAME_MAX]; /* rooted file path from name */
+    const char    *tpm_state_path = NULL;
+
+#if 0
+    static bool   do_dir_fsync = true; /* turn off fsync on dir if it fails,
+                                          most likely due to AppArmor */
+#endif
+    /* don't do fsync on dir since this may cause TPM command timeouts */
+    static bool   do_dir_fsync = false;
+
+    tpm_state_path = SWTPM_NVRAM_Uri_to_Dir(uri);
+
+    if (rc == 0) {
+        /* map name to the rooted file path */
+        rc = SWTPM_NVRAM_GetFilepathForName(filepath, sizeof(filepath),
+                                            tpm_number, name, false,
+                                            tpm_state_path);
+    }
+
+    if (rc == 0) {
+        /* map name to the rooted temporary file path */
+        rc = SWTPM_NVRAM_GetFilepathForName(tmpfile, sizeof(tmpfile),
+                                            tpm_number, name, true,
+                                            tpm_state_path);
+    }
+
+    if (rc == 0) {
+        /* open the file */
+        TPM_DEBUG(" SWTPM_NVRAM_StoreData: Opening file %s\n", tmpfile);
+        fd = open(tmpfile, O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW,
+                  tpmstate_get_mode());                        /* closed @1 */
+        if (fd < 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) opening %s for "
+                      "write failed, %s\n", tmpfile, strerror(errno));
+            rc = TPM_FAIL;
+        }
+    }
+
+    /* write the data to the file */
+    if (rc == 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Writing %u bytes of data\n",
+                  filedata_length);
+        lrc = write_full(fd, filedata, filedata_length);
+        if (lrc != filedata_length) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal), data write "
+                      "of %u only wrote %u\n", filedata_length, lrc);
+            rc = TPM_FAIL;
+        }
+    }
+#if 0 // disabled due to triggering TPM timeouts
+    if (rc == 0 && fd >= 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Syncing file %s\n", tmpfile);
+        irc = fsync(fd);
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) syncing file, %s\n",
+                      strerror(errno));
+            rc = TPM_FAIL;
+        } else {
+            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Synced file %s\n", tmpfile);
+        }
+    }
+#endif
+    if (fd >= 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closing file %s\n", tmpfile);
+        irc = close(fd);             /* @1 */
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) closing file\n");
+            rc = TPM_FAIL;
+        }
+        else {
+            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closed file %s\n", tmpfile);
+        }
+    }
+
+    if (rc == 0 && fd >= 0) {
+        irc = rename(tmpfile, filepath);
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) renaming file: %s\n",
+                      strerror(errno));
+            rc = TPM_FAIL;
+        } else {
+            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Renamed file to %s\n", filepath);
+        }
+    }
+
+    /*
+     * Quote from linux man 2 fsync:
+     *  Calling fsync() does not necessarily ensure that the entry in the
+     *  directory containing the file has also reached disk. For that an
+     *  explicit fsync() on a file descriptor for the directory is also needed.
+     */
+    if (rc == 0 && fd >= 0 && do_dir_fsync) {
+        TPM_DEBUG(" SWTPM_NVRAM_StoreData: Opening dir %s\n", tpm_state_path);
+        dir_fd = open(tpm_state_path, O_RDONLY);
+        if (dir_fd < 0) {
+            do_dir_fsync = false;
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error opening %s for "
+                      "fsync failed, %s. Continuing but check AppArmor profile.\n",
+                      tpm_state_path, strerror(errno));
+        }
+    }
+    if (rc == 0 && dir_fd >= 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Syncing dir %s\n", tpm_state_path);
+        irc = fsync(dir_fd);
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) syncing dir, %s\n",
+                      strerror(errno));
+            rc = TPM_FAIL;
+        } else {
+            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Synced dir %s\n", tpm_state_path);
+        }
+    }
+    if (dir_fd >= 0) {
+        TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closing dir %s\n", tpm_state_path);
+        irc = close(dir_fd);
+        if (irc != 0) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_StoreData: Error (fatal) closing dir\n");
+            rc = TPM_FAIL;
+        } else {
+            TPM_DEBUG("  SWTPM_NVRAM_StoreData: Closed dir %s\n", tpm_state_path);
+        }
+    }
+
+    if (rc != 0 && fd >= 0) {
+        unlink(tmpfile);
+    }
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_DeleteName_Dir(uint32_t tpm_number,
+                           const char *name,
+                           TPM_BOOL mustExist,
+                           const char *uri)
+{
+    TPM_RESULT  rc = 0;
+    int         irc;
+    char        filepath[FILENAME_MAX]; /* rooted file path from name */
+    const char  *tpm_state_path = NULL;
+
+    tpm_state_path = SWTPM_NVRAM_Uri_to_Dir(uri);
+
+    TPM_DEBUG(" SWTPM_NVRAM_DeleteName: Name %s\n", name);
+    /* map name to the rooted file path */
+    rc = SWTPM_NVRAM_GetFilepathForName(filepath, sizeof(filepath),
+                                        tpm_number, name, false,
+                                        tpm_state_path);
+    if (rc == 0) {
+        irc = remove(filepath);
+        if ((irc != 0) &&               /* if the remove failed */
+            (mustExist ||               /* if any error is a failure, or */
+             (errno != ENOENT))) {      /* if error other than no such file */
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_DeleteName: Error, (fatal) file "
+                      "remove failed, errno %d\n", errno);
+            rc = TPM_FAIL;
+        }
+    }
+    return rc;
+}
+
+struct nvram_backend_ops nvram_dir_ops = {
+    .prepare = SWTPM_NVRAM_Prepare_Dir,
+    .load    = SWTPM_NVRAM_LoadData_Dir,
+    .store   = SWTPM_NVRAM_StoreData_Dir,
+    .delete  = SWTPM_NVRAM_DeleteName_Dir,
+    .cleanup = SWTPM_NVRAM_Cleanup_Dir,
+    .check_state = SWTPM_NVRAM_CheckState_Dir,
+};
diff --git a/src/swtpm/swtpm_nvstore_linear.c b/src/swtpm/swtpm_nvstore_linear.c
new file mode 100644
index 0000000..eda7793
--- /dev/null
+++ b/src/swtpm/swtpm_nvstore_linear.c
@@ -0,0 +1,480 @@
+#include "config.h"
+
+#define _GNU_SOURCE
+#include <stdlib.h>
+#include <string.h>
+
+#include <libtpms/tpm_error.h>
+#include <libtpms/tpm_nvfilename.h>
+
+#include "compiler_dependencies.h"
+#include "sys_dependencies.h"
+#include "swtpm.h"
+#include "swtpm_debug.h"
+#include "swtpm_nvstore.h"
+#include "swtpm_nvstore_linear.h"
+#include "logging.h"
+#include "utils.h"
+
+static struct {
+    TPM_BOOL      initialized;
+    char          *loaded_uri;
+    struct nvram_linear_store_ops *ops;
+
+    unsigned char *data;
+    uint32_t      length;
+    struct nvram_linear_hdr *hdr; /* points into *data */
+} state;
+
+/*
+    Attempts to flush the header of the linear state, if required by the store.
+*/
+static TPM_RESULT
+SWTPM_NVRAM_Linear_FlushHeader(const char* uri)
+{
+    if (state.ops->flush) {
+        return state.ops->flush(uri, 0, le16toh(state.hdr->hdrsize));
+    }
+    return 0;
+}
+
+/*
+    Attempts a resize and ensures that state is updated correctly and the given
+    new_size could actually be reached.
+*/
+static TPM_RESULT
+SWTPM_NVRAM_Linear_SafeResize(const char* uri, uint32_t new_size)
+{
+    TPM_RESULT rc = 0;
+    uint32_t result;
+
+    if (!state.ops->resize) {
+        return new_size < state.length ? 0 : TPM_SIZE;
+    }
+
+    rc = state.ops->resize(uri, &state.data, &result, new_size);
+    if (rc) {
+        return rc;
+    }
+
+    /* base address might have changed, update pointers */
+    state.hdr = (struct nvram_linear_hdr*)state.data;
+    state.length = result;
+
+    if (result < new_size) {
+        return TPM_SIZE;
+    }
+
+    return rc;
+}
+
+#define FILE_NR_INVALID 0xffffffff
+
+/*
+    Returns the offset into the state.hdr.files array given a TPM state name and
+    number. Will be FILE_NR_INVALID if out of bounds or unknown name.
+*/
+static uint32_t
+SWTPM_NVRAM_Linear_GetFileNr(const char *name)
+{
+    uint32_t rc = 0;
+    if (strcmp(name, TPM_PERMANENT_ALL_NAME) == 0) {
+        rc += 0;
+    } else if (strcmp(name, TPM_VOLATILESTATE_NAME) == 0) {
+        rc += 1;
+    } else if (strcmp(name, TPM_SAVESTATE_NAME) == 0) {
+        rc += 2;
+    } else {
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_Linear_GetFileOffset: Unknown name '%s'\n",
+                  name);
+        return FILE_NR_INVALID;
+    }
+    if (rc >= SWTPM_NVSTORE_LINEAR_MAX_STATES) {
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_Linear_GetFileOffset: File limit exceeded: %d\n",
+                  rc);
+        return FILE_NR_INVALID;
+    }
+    return rc;
+}
+
+/*
+    Allocate a new file entry in the linear address space of state.data.
+    The new file will be placed at the end.
+
+    Importantly, this may perform a resize, so pointers into state.data or
+    state.hdr must not be kept over this function call.
+*/
+static TPM_RESULT
+SWTPM_NVRAM_Linear_AllocFile(const char *uri, uint32_t file_nr, uint32_t size)
+{
+    TPM_RESULT rc = 0;
+    struct nvram_linear_hdr_file *file;
+    uint32_t new_offset = le16toh(state.hdr->hdrsize);
+    uint32_t new_size;
+    uint32_t cur_end;
+    uint32_t i;
+    uint32_t section_size = size;
+    ROUND_TO_NEXT_POWER_OF_2_32(section_size);
+
+    /* find end of current last file */
+    for (i = 0; i < SWTPM_NVSTORE_LINEAR_MAX_STATES; i++) {
+        file = &state.hdr->files[i];
+        if (!file->offset) {
+            continue;
+        }
+
+        cur_end = le32toh(file->offset) + le32toh(file->section_length);
+        if (cur_end > new_offset) {
+            new_offset = cur_end;
+        }
+    }
+
+    new_size = new_offset + section_size;
+    rc = SWTPM_NVRAM_Linear_SafeResize(uri, new_size);
+    if (rc) {
+        return rc;
+    }
+
+    file = &state.hdr->files[file_nr];
+    file->section_length = htole32(section_size);
+    file->data_length = htole32(size);
+    file->offset = htole32(new_offset);
+
+    TPM_DEBUG("SWTPM_NVRAM_Linear_AllocFile: allocated file %d @ %d "
+              "(len=%d section=%d)\n",
+              file_nr, new_offset, size, section_size);
+
+    return rc;
+}
+
+/*
+    Deallocate a file from state.data. It's entry in state.hdr will be zeroed,
+    and the file length adjusted accordingly (if 'resize' is TRUE).
+    If the file was not at the end, any following files will be moved forward,
+    as to not leave any holes. This simplifies the allocator strategy, since it
+    allows new files to always be placed at the end.
+
+    If resize is true, this may perform a resize, so pointers into state.data or
+    state.hdr must not be kept over this function call.
+*/
+static TPM_RESULT
+SWTPM_NVRAM_Linear_RemoveFile(const char *uri,
+                              uint32_t file_nr,
+                              TPM_BOOL resize)
+{
+    TPM_RESULT rc = 0;
+    uint32_t next_offset = 0xffffffff;
+    uint32_t state_end = 0;
+    uint32_t new_len;
+    uint32_t i, cur_offset, cur_end;
+    struct nvram_linear_hdr_file *file;
+    struct nvram_linear_hdr_file old_file = state.hdr->files[file_nr];
+
+    if (old_file.offset == 0) {
+        return 0;
+    }
+
+    TPM_DEBUG("SWTPM_NVRAM_Linear_RemoveFile: removing filenr %d (resize=%d)\n",
+              file_nr, resize);
+
+    state.hdr->files[file_nr].offset = 0;
+    state.hdr->files[file_nr].data_length = 0;
+    state.hdr->files[file_nr].section_length = 0;
+
+    /* find offset of file right after the one we remove, and adjust offsets */
+    for (i = 0; i < SWTPM_NVSTORE_LINEAR_MAX_STATES; i++) {
+        file = &state.hdr->files[i];
+        if (!file->offset) {
+            continue;
+        }
+
+        cur_offset = le32toh(file->offset);
+        if (cur_offset > le32toh(old_file.offset)) {
+            if (cur_offset < next_offset) {
+                next_offset = cur_offset;
+            }
+            cur_end = cur_offset + le32toh(file->section_length);
+            if (cur_end > state_end) {
+                state_end = cur_end;
+            }
+            file->offset = htole32(cur_offset -
+                                   le32toh(old_file.section_length));
+        }
+    }
+
+    if (next_offset != 0xffffffff) {
+        TPM_DEBUG("SWTPM_NVRAM_Linear_RemoveFile: compacting\n");
+        /* if we weren't the end, compact by moving following files forward */
+        memmove(state.data + le32toh(old_file.offset),
+                state.data + next_offset,
+                state_end - next_offset);
+    }
+
+    if (resize) {
+        new_len = state.length - le32toh(old_file.section_length);
+        rc = SWTPM_NVRAM_Linear_SafeResize(uri, new_len);
+        if (rc == 0) {
+            state.length = new_len;
+        }
+    }
+
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_Prepare_Linear(const char *uri)
+{
+    TPM_RESULT rc = 0;
+
+    TPM_DEBUG("SWTPM_NVRAM_Prepare_Linear: uri='%s'\n", uri);
+
+    if (state.initialized) {
+        if (strcmp(state.loaded_uri, uri) == 0) {
+            /* same URI loaded, this is okay, nothing to be done */
+            return 0;
+        }
+
+        logprintf(STDERR_FILENO,
+                  "SWTPM_NVRAM_PrepareLinear: Cannot prepare twice\n");
+        return TPM_FAIL;
+    }
+
+    state.loaded_uri = malloc(strlen(uri) + 1);
+    strcpy(state.loaded_uri, uri);
+
+    /* TODO: Parse URI prefixes ("iscsi://", "rbd://", etc...) */
+    state.ops = &nvram_linear_file_ops;
+
+    if ((rc = state.ops->open(uri, &state.data, &state.length))) {
+        return rc;
+    }
+
+    state.hdr = (struct nvram_linear_hdr*)state.data;
+
+    if (le64toh(state.hdr->magic) != SWTPM_NVSTORE_LINEAR_MAGIC) {
+        logprintf(STDOUT_FILENO,
+                  "Formatting '%s' as new linear NVRAM store\n",
+                  uri);
+
+        state.hdr->magic = htole64(SWTPM_NVSTORE_LINEAR_MAGIC);
+        state.hdr->version = SWTPM_NVSTORE_LINEAR_VERSION;
+        state.hdr->hdrsize = htole16(sizeof(struct nvram_linear_hdr));
+        memset(&state.hdr->files, 0, sizeof(state.hdr->files));
+
+        SWTPM_NVRAM_Linear_FlushHeader(uri);
+
+    } else {
+        /* assume valid state found */
+        if (state.hdr->version > SWTPM_NVSTORE_LINEAR_VERSION) {
+            logprintf(STDERR_FILENO,
+                      "SWTPM_NVRAM_PrepareLinear: Unknown format version: %d\n",
+                      state.hdr->version);
+            return TPM_FAIL;
+        }
+    }
+
+    state.initialized = TRUE;
+    return rc;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_LoadData_Linear(unsigned char **data,
+                            uint32_t *length,
+                            uint32_t tpm_number SWTPM_ATTR_UNUSED,
+                            const char *name,
+                            const char *uri SWTPM_ATTR_UNUSED)
+{
+    uint32_t file_nr;
+    uint32_t file_offset;
+    uint32_t file_data_len;
+    struct nvram_linear_hdr_file *file;
+
+    TPM_DEBUG("SWTPM_NVRAM_LoadData_Linear: request for %s:%d\n",
+              name, tpm_number);
+
+    file_nr = SWTPM_NVRAM_Linear_GetFileNr(name);
+    if (file_nr == FILE_NR_INVALID) {
+        return TPM_FAIL;
+    }
+
+    file = &state.hdr->files[file_nr];
+    file_offset = le32toh(file->offset);
+    file_data_len = le32toh(file->data_length);
+
+    if (!file_offset) {
+        return TPM_RETRY;
+    }
+
+    if (file_offset + file_data_len > state.length) {
+        /* shouldn't happen, but just to be safe */
+        return TPM_FAIL;
+    }
+
+    if (data == NULL) {
+        return TPM_FAIL;
+    }
+
+    /*
+        TODO: at the moment, callers require a pointer that can be 'free'd, but
+        for efficiency, it would be better to return the mapped area directly
+    */
+    *length = file_data_len;
+    *data = malloc(file_data_len);
+    if (*data == NULL) {
+        return TPM_FAIL;
+    }
+    memcpy(*data, state.data + file_offset, file_data_len);
+
+    TPM_DEBUG("SWTPM_NVRAM_LoadData_Linear: loaded %dB from %s:%d\n",
+              file_data_len, name, tpm_number);
+
+    return 0;
+}
+
+static TPM_RESULT
+SWTPM_NVRAM_StoreData_Linear(unsigned char *filedata,
+                             uint32_t filedata_length,
+                             uint32_t tpm_number SWTPM_ATTR_UNUSED,
+                             const char *name,
+                             const char *uri)
+{
+    TPM_RESULT rc = 0;
+    TPM_BOOL needs_hdr_flush = FALSE;
+    TPM_BOOL needs_full_flush = FALSE;
+    uint32_t file_nr;
+    uint32_t file_offset;
+    struct nvram_linear_hdr_file *file;
+
+    TPM_DEBUG("SWTPM_NVRAM_StoreData_Linear: request for %dB to %s:%d\n",
+              filedata_length, name, tpm_number);
+
+    file_nr = SWTPM_NVRAM_Linear_GetFileNr(name);
+    if (file_nr == FILE_NR_INVALID) {
+        return TPM_FAIL;