| Previous | Next |
| TPM_20_E_EXPIRED | TPM_20_E_BINDING |
TPM_20_E_POLICY_CC
This code is specific to command-code policy restrictions. A policy can bind authorization to one TPM command through TPM2_PolicyCommandCode. The TPM rejects an unsupported command code when that policy step is created, and rejects an authorization attempt when the command code recorded in the session does not match the command now being executed.
How it differs from a generic policy failure
TPM_20_E_POLICY_FAIL can cover a digest or cpHash mismatch. TPM_20_E_POLICY_CC points directly to the command-code constraint. The same object may be usable for one command, such as unsealing, and unusable for another command when its policy session was deliberately restricted.
Checks that avoid a false diagnosis
- Log the numeric
TPM_CCpassed to the policy command and the numeric command code of the failing operation. - Confirm that the target TPM implements the requested command; host libraries may know a command identifier that the device does not implement.
- Start a fresh policy session when the application switches to another authorized command path; do not reuse an old command-restricted session.
TCG: TPM2_PolicyCommandCode · tpm2_policycommandcode · tpm2_startauthsession
Looking for a different code? Search another status or error code.