* [PATCH v2 1/2] tpm: Disable a TPM that stops responding
2026-11-12 12:30 [PATCH v2 0/2] tpm: Stop retrying TPMs that have stopped working Breno Leitao
@ 2026-11-12 12:30 ` Breno Leitao
2026-11-12 12:30 ` [PATCH v2 2/2] tpm: Disable TPM on TPM_RC_INITIALIZE Breno Leitao
1 sibling, 0 replies; 3+ messages in thread
From: Breno Leitao @ 2026-11-12 12:30 UTC (permalink / raw)
To: Peter Huewe, Jarkko Sakkinen, Jason Gunthorpe
Cc: linux-integrity, linux-kernel, surenkj, noodles, Breno Leitao,
kernel-team
A TPM that stops responding fails each command only after the transport
timeout, and its callers keep sending more: the hwrng thread every 10
seconds forever, and userspace through /dev/tpmrm0. Each attempt holds
tpm_mutex for the whole timeout and logs an error:
tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
tpm tpm0: tpm_try_transmit: send(): error -62
tpm tpm0: tpm_try_transmit: send(): error -62
...
The core already stops using a TPM it cannot trust: tpm_try_get_ops()
fails with -EIO once TPM_CHIP_FLAG_DISABLE is set, which
tpm2_load_null() does when it cannot restore the null key. Set the same
flag once 60 commands in a row have timed out.
A completed command, whatever its TPM return code, resets the count.
Some TPMs stall for half a minute, time out a handful of commands, and
then recover, so a short streak must not disable them.
With only the hwrng retrying every 10 seconds, 60 timeouts take more
than ten minutes. A userspace poller gets there sooner, but each of its
commands still waits out the transport timeout.
The limit is the tpm.max_unanswered boot parameter, so that slow
pre-production parts, such as FPGA prototypes, can raise it, or set it
to 0 to never disable the TPM. A disabled TPM stays disabled until the
driver is rebound or the machine reboots.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
drivers/char/tpm/tpm-interface.c | 15 +++++++++++++++
include/linux/tpm.h | 1 +
2 files changed, 16 insertions(+)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index e0385b16616b46..b7865ccb799289 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -40,6 +40,11 @@ module_param_named(suspend_pcr, tpm_suspend_pcr, uint, 0644);
MODULE_PARM_DESC(suspend_pcr,
"PCR to use for dummy writes to facilitate flush on suspend.");
+static unsigned int tpm_max_unanswered = 60;
+module_param_named(max_unanswered, tpm_max_unanswered, uint, 0444);
+MODULE_PARM_DESC(max_unanswered,
+ "Disable the TPM after this many commands in a row time out (0 = never).");
+
/**
* tpm_calc_ordinal_duration() - calculate the maximum command duration
* @chip: TPM chip to use.
@@ -268,6 +273,16 @@ ssize_t tpm_transmit(struct tpm_chip *chip, u8 *buf, size_t bufsiz)
delay_msec *= 2;
memcpy(buf, save, save_size);
}
+
+ if (ret >= 0) {
+ /* we are good, reset nr_unanswered */
+ chip->nr_unanswered = 0;
+ } else if (ret == -ETIME &&
+ ++chip->nr_unanswered == tpm_max_unanswered) {
+ dev_err(&chip->dev, "%u commands in a row timed out, disabling the TPM\n",
+ chip->nr_unanswered);
+ chip->flags |= TPM_CHIP_FLAG_DISABLE;
+ }
return ret;
}
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 0db277af45c393..e8191585a68e7a 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -131,6 +131,7 @@ struct tpm_chip {
struct hwrng hwrng;
struct mutex tpm_mutex; /* tpm is processing */
+ unsigned int nr_unanswered; /* commands in a row that timed out */
unsigned long timeout_a; /* jiffies */
unsigned long timeout_b; /* jiffies */
--
2.53.0-Meta
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2 2/2] tpm: Disable TPM on TPM_RC_INITIALIZE
2026-11-12 12:30 [PATCH v2 0/2] tpm: Stop retrying TPMs that have stopped working Breno Leitao
2026-11-12 12:30 ` [PATCH v2 1/2] tpm: Disable a TPM that stops responding Breno Leitao
@ 2026-11-12 12:30 ` Breno Leitao
1 sibling, 0 replies; 3+ messages in thread
From: Breno Leitao @ 2026-11-12 12:30 UTC (permalink / raw)
To: Peter Huewe, Jarkko Sakkinen, Jason Gunthorpe
Cc: linux-integrity, linux-kernel, surenkj, noodles, Breno Leitao,
kernel-team
From: Jarkko Sakkinen <jarkko@kernel.org>
If the TPM has been spuriously disabled, the game is over. Let's reflect
this truth with TPM_CHIP_FLAG_DISABLE.
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
[leitao@debian.org: check rc before the loop breaks out on anything but
RETRY/TESTING, skip TPM2_Startup, which a TPM that is already started
fails with TPM2_RC_INITIALIZE, and fix the TPM2_RC_INITIALIZE and
chip->flags typos]
Signed-off-by: Breno Leitao <leitao@debian.org>
---
drivers/char/tpm/tpm-interface.c | 5 +++++
drivers/char/tpm/tpm2-cmd.c | 2 ++
2 files changed, 7 insertions(+)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index b7865ccb799289..144e2dbae66853 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -252,6 +252,11 @@ ssize_t tpm_transmit(struct tpm_chip *chip, u8 *buf, size_t bufsiz)
if (ret < 0)
break;
rc = be32_to_cpu(header->return_code);
+ /* A TPM that is already started fails TPM2_Startup this way. */
+ if (rc == TPM2_RC_INITIALIZE && cc != TPM2_CC_STARTUP) {
+ chip->flags |= TPM_CHIP_FLAG_DISABLE;
+ break;
+ }
if (rc != TPM2_RC_RETRY && rc != TPM2_RC_TESTING)
break;
/*
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 4b2bb2ddc321a9..65928ae85b496c 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -724,6 +724,8 @@ int tpm2_auto_startup(struct tpm_chip *chip)
goto out;
if (rc == TPM2_RC_INITIALIZE) {
+ chip->flags &= ~TPM_CHIP_FLAG_DISABLE;
+
rc = tpm2_startup(chip);
if (rc)
goto out;
--
2.53.0-Meta
^ permalink raw reply [flat|nested] 3+ messages in thread