tpm: restore timeout for key creation commands

PATCH Applied Baoli Zhang 2 participants 6 messages Apr 21 – May 12

Subsystems (2)

Keys-trusted TPM device driver

lore

Share & tools

lore

Baoli Zhang

author

2026-04-21 00:59 UTC #0 lore raw

PATCH v2 1/1 tpm: restore timeout for key creation commands

From: "Baoli Zhang" <[email protected]>

Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.

This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.

Fixes 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")

Co-developed-by Lili Li <[email protected]>

Signed-off-by Lili Li <[email protected]>

Signed-off-by Baoli Zhang <[email protected]>

---
Changes in v2:
- Add description of intermittent nature of the timeout issue.
- Fix Co-developed-by and Signed-off-by tag ordering.

v1: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/

 drivers/char/tpm/tpm2-cmd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/char/tpm/tpm2-cmd.c +3 -3

index 3a77be7ebf4aa..430022f695f24 100644
@@ -71,9 +71,9 @@ static const struct {
 	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
 	{TPM2_CC_GET_CAPABILITY, 750},
 	{TPM2_CC_NV_READ, 2000},
-	{TPM2_CC_CREATE_PRIMARY, 30000},
-	{TPM2_CC_CREATE, 30000},
-	{TPM2_CC_CREATE_LOADED, 30000},
+	{TPM2_CC_CREATE_PRIMARY, 300000},
+	{TPM2_CC_CREATE, 300000},
+	{TPM2_CC_CREATE_LOADED, 300000},
 };
 
 /**

Signature · 1 line

2.43.0

Jarkko Sakkinen

maintainer

2026-04-21 18:24 UTC #1 lore raw

Quoted 46 lines · Baoli Zhang

From: "Baoli Zhang" <[email protected]>
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.
This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.
Fixes 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
Co-developed-by Lili Li <[email protected]>
Signed-off-by Lili Li <[email protected]>
Signed-off-by Baoli Zhang <[email protected]>
---
Changes in v2:
- Add description of intermittent nature of the timeout issue.
- Fix Co-developed-by and Signed-off-by tag ordering.
v1: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/
 drivers/char/tpm/tpm2-cmd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm2-cmd.c +3 -3
index 3a77be7ebf4aa..430022f695f24 100644
@@ -71,9 +71,9 @@ static const struct {
 	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
 	{TPM2_CC_GET_CAPABILITY, 750},
 	{TPM2_CC_NV_READ, 2000},
-	{TPM2_CC_CREATE_PRIMARY, 30000},
-	{TPM2_CC_CREATE, 30000},
-	{TPM2_CC_CREATE_LOADED, 30000},
+	{TPM2_CC_CREATE_PRIMARY, 300000},
+	{TPM2_CC_CREATE, 300000},
+	{TPM2_CC_CREATE_LOADED, 300000},
 };
 
 /**
Signature · 1 line
2.43.0

Much better! I'm fine with this and it is a regression.

On travel right now but I do have one SLB9670 connected to RPi4.

I'll do peer testing once at home (next week).

BR, Jarkko

Jarkko Sakkinen

maintainer

2026-05-04 15:13 UTC #2 lore raw

In reply to Baoli Zhang

Quoted 11 lines · Baoli Zhang

From: "Baoli Zhang" <[email protected]>
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.
This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.

Is this a production case?

I'm not sure if there is anything to fix tbh. I mean it is pretty much the same as "maintaining compatibility to OTT driver" to addresses issues on undisclosed hardware.

Please correct me if I'm wrong. Otherwise, I'd carry out internal patch to tweak this for pre-production hardware (presumably).

Quoted 35 lines

Fixes 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
Co-developed-by Lili Li <[email protected]>
Signed-off-by Lili Li <[email protected]>
Signed-off-by Baoli Zhang <[email protected]>
---
Changes in v2:
- Add description of intermittent nature of the timeout issue.
- Fix Co-developed-by and Signed-off-by tag ordering.
v1: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/
 drivers/char/tpm/tpm2-cmd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm2-cmd.c +3 -3
index 3a77be7ebf4aa..430022f695f24 100644
@@ -71,9 +71,9 @@ static const struct {
 	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
 	{TPM2_CC_GET_CAPABILITY, 750},
 	{TPM2_CC_NV_READ, 2000},
-	{TPM2_CC_CREATE_PRIMARY, 30000},
-	{TPM2_CC_CREATE, 30000},
-	{TPM2_CC_CREATE_LOADED, 30000},
+	{TPM2_CC_CREATE_PRIMARY, 300000},
+	{TPM2_CC_CREATE, 300000},
+	{TPM2_CC_CREATE_LOADED, 300000},
 };
 
 /**
Signature · 1 line
2.43.0

BR, Jarkko

Zhang, Baoli

author

2026-05-07 05:36 UTC #3 lore raw

Quoted 12 lines · Jarkko Sakkinen

Quoted 11 lines · Baoli Zhang
From: "Baoli Zhang" <[email protected]>
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.
This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.

Quoted 8 lines

Is this a production case?
I'm not sure if there is anything to fix tbh. I mean it is pretty much the same as "maintaining compatibility to OTT driver" to addresses issues on undisclosed hardware.
Please correct me if I'm wrong. Otherwise, I'd carry out internal patch to tweak this for pre-production hardware (presumably).

Hi Jarkko, this is indeed a production case. We discovered this issue during validation testing for the sustaining release.

Quoted 35 lines

Quoted 34 lines
Fixes 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()")
Co-developed-by Lili Li <[email protected]>
Signed-off-by Lili Li <[email protected]>
Signed-off-by Baoli Zhang <[email protected]>
---
Changes in v2:
- Add description of intermittent nature of the timeout issue.
- Fix Co-developed-by and Signed-off-by tag ordering.
v1: https://patchwork.kernel.org/project/linux-integrity/patch/[email protected]/
  drivers/char/tpm/tpm2-cmd.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm2-cmd.c +3 -3
index 3a77be7ebf4aa..430022f695f24 100644
@@ -71,9 +71,9 @@ static const struct {
  	{TPM2_CC_HIERARCHY_CHANGE_AUTH, 2000},
  	{TPM2_CC_GET_CAPABILITY, 750},
  	{TPM2_CC_NV_READ, 2000},
-	{TPM2_CC_CREATE_PRIMARY, 30000},
-	{TPM2_CC_CREATE, 30000},
-	{TPM2_CC_CREATE_LOADED, 30000},
+	{TPM2_CC_CREATE_PRIMARY, 300000},
+	{TPM2_CC_CREATE, 300000},
+	{TPM2_CC_CREATE_LOADED, 300000},
  };
 
  /**
Signature · 1 line
2.43.0
BR, Jarkko

Jarkko Sakkinen

maintainer Applied

2026-05-09 19:07 UTC #4 lore raw

Quoted 16 lines · Baoli

Quoted 14 lines · Jarkko Sakkinen
Quoted 11 lines · Baoli Zhang
From: "Baoli Zhang" <[email protected]>
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.
This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.
Is this a production case?

Quoted 8 lines

Quoted 6 lines
I'm not sure if there is anything to fix tbh. I mean it is pretty much the same as "maintaining compatibility to OTT driver" to addresses issues on undisclosed hardware.
Please correct me if I'm wrong. Otherwise, I'd carry out internal patch to tweak this for pre-production hardware (presumably).
Hi Jarkko, this is indeed a production case. We discovered this issue during validation testing for the sustaining release.

OK, it can be considered as a backwards compatibility issue then I guess.

I applied the patch, thank you.

BR, Jarkko

Zhang, Baoli

author

2026-05-12 04:04 UTC #5 lore raw

Quoted 22 lines · Jarkko Sakkinen

Quoted 21 lines · Baoli
Quoted 20 lines · Jarkko Sakkinen
Quoted 11 lines · Baoli Zhang
From: "Baoli Zhang" <[email protected]>
Commit 207696b17f38 ("tpm: use a map for tpm2_calc_ordinal_duration()") inadvertently reduced the timeout for TPM2 key creation commands (CREATE_PRIMARY, CREATE, CREATE_LOADED) from 300 seconds to 30 seconds.
This causes intermittent timeout failures, with several failures observed across hundreds of test runs on some Intel platforms using Infineon SLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to avoid spurious failures.
Is this a production case?
I'm not sure if there is anything to fix tbh. I mean it is pretty much the same as "maintaining compatibility to OTT driver" to addresses issues on undisclosed hardware.
Please correct me if I'm wrong. Otherwise, I'd carry out internal patch to tweak this for pre-production hardware (presumably).

Quoted 8 lines

Quoted 2 lines
Hi Jarkko, this is indeed a production case. We discovered this issue during validation testing for the sustaining release.
OK, it can be considered as a backwards compatibility issue then I guess.
I applied the patch, thank you.
BR, Jarkko

Thanks Jarkko and you all for your kindly review and help.

BR/Baoli

Quoted 1 line