[v1] tpm: restore timeout for key creation commands

[PATCH v1] tpm: restore timeout for key creation commands

Posted by Baoli.Zhang 2 months, 1 week ago

After the per-command duration map was introduced, TPM2 key creation
commands (`CREATE_PRIMARY`, `CREATE`, `CREATE_LOADED`) were limited to
30 seconds.

On some platforms this is not sufficient and key creation can time out.
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
inadvertently reduced these command timeouts from 300 seconds to 30
seconds. Restore them to 300 seconds to avoid spurious failures.

Fixes: 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")

Signed-off-by: Baoli.Zhang <baoli.zhang@linux.intel.com>
Co-developed-by: lili.li <lili.li@intel.com>
---
 drivers/char/tpm/tpm2-cmd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 3a77be7ebf4aa..430022f695f24 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -71,9 +71,9 @@ static const struct {
 	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
 	{TPM2_CC_GET_CAPABILITY, 750},
 	{TPM2_CC_NV_READ, 2000},
-	{TPM2_CC_CREATE_PRIMARY, 30000},
-	{TPM2_CC_CREATE, 30000},
-	{TPM2_CC_CREATE_LOADED, 30000},
+	{TPM2_CC_CREATE_PRIMARY, 300000},
+	{TPM2_CC_CREATE, 300000},
+	{TPM2_CC_CREATE_LOADED, 300000},
 };
 
 /**
-- 
2.43.0

Re: [PATCH v1] tpm: restore timeout for key creation commands

Posted by Jarkko Sakkinen 2 months ago

On Fri, Apr 10, 2026 at 09:49:39AM +0800, Baoli.Zhang wrote:
> After the per-command duration map was introduced, TPM2 key creation
> commands (`CREATE_PRIMARY`, `CREATE`, `CREATE_LOADED`) were limited to
> 30 seconds.
> 
> On some platforms this is not sufficient and key creation can time out.
> Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
> inadvertently reduced these command timeouts from 300 seconds to 30
> seconds. Restore them to 300 seconds to avoid spurious failures.

Is this like pre-silicon (FPGA) type of situation? I have doubts these
latencies happening on ASIC.

If it is pre-release hardware, maybe there should be option to extend
the delay, or does this happen on actual production hardware?

Just want to understand this better...

> 
> Fixes: 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
> 

Extra empty line.

> Signed-off-by: Baoli.Zhang <baoli.zhang@linux.intel.com>
> Co-developed-by: lili.li <lili.li@intel.com>

"Co-developed-by: states that the patch was co-created by several
developers; it is a used to give attribution to co-authors (in addition
to the author attributed by the From: tag) when multiple people work on
a single patch. Every Co-developed-by: must be immediately followed by a
Signed-off-by: of the associated co-author. Details and examples can be
found in Documentation/process/submitting-patches.rst." [1]

[1] https://docs.kernel.org/process/5.Posting.html

> ---
>  drivers/char/tpm/tpm2-cmd.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index 3a77be7ebf4aa..430022f695f24 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -71,9 +71,9 @@ static const struct {
>  	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
>  	{TPM2_CC_GET_CAPABILITY, 750},
>  	{TPM2_CC_NV_READ, 2000},
> -	{TPM2_CC_CREATE_PRIMARY, 30000},
> -	{TPM2_CC_CREATE, 30000},
> -	{TPM2_CC_CREATE_LOADED, 30000},
> +	{TPM2_CC_CREATE_PRIMARY, 300000},
> +	{TPM2_CC_CREATE, 300000},
> +	{TPM2_CC_CREATE_LOADED, 300000},
>  };
>  
>  /**
> -- 
> 2.43.0
> 

BR, Jarkko

Re: [PATCH v1] tpm: restore timeout for key creation commands

Posted by Paul Menzel 2 months, 1 week ago

Dear Baoli,


Thank you for your patch. Some formalities:

Am 10.04.26 um 03:49 schrieb Baoli.Zhang:
> After the per-command duration map was introduced, TPM2 key creation
> commands (`CREATE_PRIMARY`, `CREATE`, `CREATE_LOADED`) were limited to
> 30 seconds.
> 
> On some platforms this is not sufficient and key creation can time out.
> Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
> inadvertently reduced these command timeouts from 300 seconds to 30
> seconds. Restore them to 300 seconds to avoid spurious failures.

Please document such a platform.

> Fixes: 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
> 
> Signed-off-by: Baoli.Zhang <baoli.zhang@linux.intel.com>

It’d be great if you remove the dot from your name:

     git config --global user.name "Baoli Zhang"

> Co-developed-by: lili.li <lili.li@intel.com>

Same here. Maybe spell it Lili Li?

     git commit --amend --author="BaoliZhang 
<baoli.zhang@linux.intel.com>" -s

> ---
>   drivers/char/tpm/tpm2-cmd.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index 3a77be7ebf4aa..430022f695f24 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -71,9 +71,9 @@ static const struct {
>   	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
>   	{TPM2_CC_GET_CAPABILITY, 750},
>   	{TPM2_CC_NV_READ, 2000},
> -	{TPM2_CC_CREATE_PRIMARY, 30000},
> -	{TPM2_CC_CREATE, 30000},
> -	{TPM2_CC_CREATE_LOADED, 30000},
> +	{TPM2_CC_CREATE_PRIMARY, 300000},
> +	{TPM2_CC_CREATE, 300000},
> +	{TPM2_CC_CREATE_LOADED, 300000},
>   };
>   
>   /**

Re: [PATCH v1] tpm: restore timeout for key creation commands

Posted by Zhang, Baoli 2 months, 1 week ago

On 4/10/2026 2:49 PM, Paul Menzel wrote:
> Dear Baoli,
>
>
> Thank you for your patch. Some formalities:
>
> Am 10.04.26 um 03:49 schrieb Baoli.Zhang:
>> After the per-command duration map was introduced, TPM2 key creation
>> commands (`CREATE_PRIMARY`, `CREATE`, `CREATE_LOADED`) were limited to
>> 30 seconds.
>>
>> On some platforms this is not sufficient and key creation can time out.
>> Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
>> inadvertently reduced these command timeouts from 300 seconds to 30
>> seconds. Restore them to 300 seconds to avoid spurious failures.
>
> Please document such a platform.
Thanks for your comments, I will add the platform after the internal 
alignment.
>
>> Fixes: 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
>>
>> Signed-off-by: Baoli.Zhang <baoli.zhang@linux.intel.com>
>
> It’d be great if you remove the dot from your name:
>
>     git config --global user.name "Baoli Zhang"
>
Yes,  will remove it in v2.
>> Co-developed-by: lili.li <lili.li@intel.com>
>
> Same here. Maybe spell it Lili Li?
>
>     git commit --amend --author="BaoliZhang 
> <baoli.zhang@linux.intel.com>" -s
>
Yes, her name is Lili Li. Will also remove  dot from her name.
>> ---
>>   drivers/char/tpm/tpm2-cmd.c | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
>> index 3a77be7ebf4aa..430022f695f24 100644
>> --- a/drivers/char/tpm/tpm2-cmd.c
>> +++ b/drivers/char/tpm/tpm2-cmd.c
>> @@ -71,9 +71,9 @@ static const struct {
>>       {TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
>>       {TPM2_CC_GET_CAPABILITY, 750},
>>       {TPM2_CC_NV_READ, 2000},
>> -    {TPM2_CC_CREATE_PRIMARY, 30000},
>> -    {TPM2_CC_CREATE, 30000},
>> -    {TPM2_CC_CREATE_LOADED, 30000},
>> +    {TPM2_CC_CREATE_PRIMARY, 300000},
>> +    {TPM2_CC_CREATE, 300000},
>> +    {TPM2_CC_CREATE_LOADED, 300000},
>>   };
>>     /**
>
>