[PATCH v2 0/2] tpm: Handle transient NitroTPM unavailability

[Surendran Kanagaraj <surenkj@amazon.com>]

TPM commands need to complete within the duration defined in the
TPM2 spec or keep answering TPM2_RC_RETRY for at most TPM2_DURATION_LONG
(2s).

Devices that have different timeout requirements than the TPM2 spec
can either exhaust the retry budget or delay the command completion.
NitroTPM can very rarely enter a mode where it either sends
TPM2_RC_RETRY for more than 2s or completes the command late.

When this happens in tpm2_load_null() during auth session start, the
driver sets TPM_CHIP_FLAG_DISABLE and fails all subsequent TPM requests.

    tpm tpm0: in retry loop
    tpm tpm0: tpm2_load_context: failed with a TPM error 0x0922

Add support to override command durations and TPM2_RC_RETRY budget
based on chip->duration. tpm2_get_timeouts() fills the array with TPM2
defaults and lets the driver adjust the durations (patch 1) as TPM 1.x
does. Raise the TPM_SHORT, TPM_MEDIUM and TPM_LONG durations to 30s for
NitroTPM (patch 2).

V1 -> V2:
- Drop chip->busy_timeout_ms. TPM2 durations and the TPM2_RC_RETRY
  budget now come from chip->duration.
- Map TPM2_CC_SELF_TEST and TPM2_CC_VERIFY_SIGNATURE to TPM_LONG with
  floors of 3s and 30s since their durations do not fit SHORT, MEDIUM,
  LONG durations.
- Keep the TPM2 defaults for commands sent before tpm2_get_timeouts()
  has run such as the one in tpm2_probe() and keep the 2s retry
  budget for TPM 1.x chips.
- Keep the first TPM2_RC_RETRY wait at TPM2_DURATION_SHORT instead of
  chip->duration[TPM_SHORT]. No TPM2 command maps to TPM_SHORT today
  and a driver that raises TPM_SHORT for its commands should not also
  lengthen the first retry wait.
- Return early from tpm_tis_update_durations() for TPM2 chips, since
  its overrides are for TPM 1.x.
- Raise TPM_SHORT, TPM_MEDIUM and TPM_LONG to 30s for NitroTPM.
- Replace the vendor quirk table in tpm_crb with a plain vendor ID
  check.
- Use the TPM_CRB_ prefix for the new tpm_crb macros.
- Rename the patches from "tpm: Add per-chip timeout for transient
  unavailability" and "tpm_crb: Raise timeouts for Amazon NitroTPM".

Tested on an EC2 instance with NitroTPM by inducing unavailability
windows under HMAC session workloads and in QEMU with swtpm on
tpm_crb, tpm_tis, tpm_tis_i2c, tpm_ibmvtpm and tpm_vtpm_proxy.

v1: https://lore.kernel.org/linux-integrity/20260923142834.16786-1-surenkj@amazon.com/

Surendran Kanagaraj (2):
  tpm: Add support for updating TPM2 durations
  tpm_crb: Raise durations for Amazon NitroTPM

 drivers/char/tpm/tpm-interface.c | 11 ++--
 drivers/char/tpm/tpm.h           |  2 +-
 drivers/char/tpm/tpm2-cmd.c      | 90 ++++++++++++++++++++++++--------
 drivers/char/tpm/tpm_crb.c       | 44 ++++++++++++++++
 drivers/char/tpm/tpm_tis_core.c  |  4 ++
 5 files changed, 125 insertions(+), 26 deletions(-)


base-commit: 9708d29f225bd326165bfec1962d13f0a00b91ba
-- 
2.47.3