ESXi Host Fails to Communicate with Physical TPM Module

Products

• VMware vSphere ESXi

Issue/Introduction

• The ESXi host fails to communicate with the physical TPM 2.0 module. This failure prevents the execution of encryption-related commands, including esxcli system settings encryption get, and affects the host’s security attestation status.
  
  
• Analysis of /var/run/log/vmkernel.log identifies a low-level hardware interface timeout. The following error traces are observed:

tpmDriver: TpmWrite:###: still expects data after 12 bytes transfered
tpmDriver: Tpm_Transmit:###: Send to TPM failed: Failure (0xbad0001)
tpmDriver: Tpm2ResMgr_Transmit:####: Error: Tpm_Transmit failed

• The tpmdriver loads but is unable to retrieve vendor or firmware information via vsish and esxcli commands:

[root@<ESXi_host> :~ ] vsish -e get /vmkModules/tpmdriver/vendor
VSISHCmdGetInt () :Get failed: Failure

[root@<ESXi_host> :~ ] vsish -e get /vmkModules/tpmdriver/firmware/version
VSISHCmdGetInt () :Get failed: Failure
Checking the status and connectivity to the TPM module returns errors:

[root@<ESXi_host> :~ ] esxcli system settings encryption get
Unable to get the encryption mode and policy.

[root@<ESXi_host> :~ ] esxcli system settings encryption set -m TPM
Unable to change the encryption mode and policy. Verify that the current host configuration can satisfy the new requirement.

Environment

VMware vSphere ESXi 8.x

Cause

• A transient hardware interface hang occurs between the ESXi VMkernel and the physical TPM micro-controller.
• The TPM chip enters an unresponsive state where it stops acknowledging data writes after the initial packet header, resulting in a 0xbad0001 (General Failure) timeout status.

Resolution

1. Place the affected ESXi host in Maintenance Mode.
2. Perform a host reboot to trigger a hardware reset of the TPM chip and re-initialize the tpmdriver stack.
3. Verify the resolution by executing the below command in the ESXi SSH session:

vsish -e get /vmkModules/tpmdriver/vendor


4. Confirm the output successfully returns the vendor string (e.g., STM).
5. If the issue persists and the hardware buffer hang is not cleared by the reboot, contact the respective server hardware vendor to perform hardware diagnostics.

Additional Information

A host reboot performs a physical power-cycle of the TPM microcontroller and re-loads the ESXi Trusted Installation Services (TIS) interface. This process clears the hardware buffer hang identified in the TpmWrite:594 error and allows the Jumpstart plugin to successfully establish a new session with the TPM 2.0 Resource Manager.