Re: [PATCH 2/2] tpm: Disable a TPM whose hwrng reads keep failing

[Jarkko Sakkinen <jarkko@kernel.org>]

On Wed, Nov 11, 2026 at 01:57:34AM -0800, Breno Leitao wrote:
> The hwrng core retries a failed read every 10 seconds, forever. When the
> TPM keeps answering GetRandom with an error, each retry logs a line:
> 
>   tpm tpm0: A TPM error (256) occurred attempting get random
>   tpm tpm0: A TPM error (256) occurred attempting get random
>   ...
> 
> Neither clears on its own, and the TPM does answer, so the timeout check
> in tpm_transmit() never fires.
> 
> After 60 failed reads in a row, ~ten minutes of retries on my system,
> set TPM_CHIP_FLAG_DISABLE as tpm_transmit() does for a TPM that stopped
> responding. Later reads then fail in tpm_try_get_ops() without sending
> the TPM a command. A successful read resets the count. A handful of
> failures is not enough, since some TPMs stall for half a minute and then
> recover.
> 
> This also takes the TPM away from userspace, which could otherwise
> still send TPM2_Startup or query the failure mode. Rebinding the driver
> brings it back.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  drivers/char/tpm/tpm-chip.c | 20 +++++++++++++++++++-
>  include/linux/tpm.h         |  1 +
>  2 files changed, 20 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> index 0be5dbfaa72ebf..d94ea462a5ef0c 100644
> --- a/drivers/char/tpm/tpm-chip.c
> +++ b/drivers/char/tpm/tpm-chip.c
> @@ -466,11 +466,29 @@ static int tpm_add_legacy_sysfs(struct tpm_chip *chip)
>  	return 0;
>  }
>  
> +#define TPM_HWRNG_MAX_FAILURES	60	/* ~10 minutes of retries */
> +
>  static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
>  {
>  	struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng);
> +	int rc;
> +
> +	rc = tpm_get_random(chip, data, max);
> +	if (rc > 0) {
> +		chip->hwrng_failures = 0;
> +		return rc;
> +	}
> +
> +	if (++chip->hwrng_failures == TPM_HWRNG_MAX_FAILURES &&
> +	    !(chip->flags & TPM_CHIP_FLAG_DISABLE)) {
> +		dev_err(&chip->dev, "hwrng: %u reads failed in a row, disabling the TPM\n",
> +			chip->hwrng_failures);
> +		mutex_lock(&chip->tpm_mutex);
> +		chip->flags |= TPM_CHIP_FLAG_DISABLE;
> +		mutex_unlock(&chip->tpm_mutex);
> +	}
>  
> -	return tpm_get_random(chip, data, max);
> +	return rc;
>  }
>  
>  static bool tpm_is_hwrng_enabled(struct tpm_chip *chip)
> diff --git a/include/linux/tpm.h b/include/linux/tpm.h
> index 4264c87a04d98c..402b5160db962c 100644
> --- a/include/linux/tpm.h
> +++ b/include/linux/tpm.h
> @@ -129,6 +129,7 @@ struct tpm_chip {
>  
>  	char hwrng_name[64];
>  	struct hwrng hwrng;
> +	unsigned int hwrng_failures;	/* consecutive failed reads */
>  
>  	struct mutex tpm_mutex;	/* tpm is processing */
>  	unsigned int nr_timeouts;	/* consecutive command timeouts */
> 
> -- 
> 2.53.0-Meta
> 

I'm thinking here that why not disable on first failure?

Br, Jarkko