HRESULT 0x80280126 (TPM_20_E_POLICY): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

a TPM policy expression evaluated false or the supplied policy input was invalid.

Previous	Next
TPM_20_E_AUTH_MISSING	TPM_20_E_PCR

TPM_20_E_POLICY

TPM_20_E_POLICY identifies failure of a policy condition itself, rather than failure to bind a completed policy session to an object's authPolicy. The TPM returns it when a policy operation evaluates false, for example when a numeric or bitwise comparison performed by a policy command does not have the required relationship.

Where this commonly originates

TPM2_PolicyNV and TPM2_PolicyCounterTimer compare an operand, offset and operation against TPM-held data.
Policy-ticket and capability operations can also reject an input condition while leaving the policy digest unchanged.
A trial session can calculate a digest without enforcing the live condition, so a policy may look correct during construction and fail in a real policy session.

Diagnostic approach

Record the precise policy command, current policy session type, operand bytes, offset, comparison operator and TPM values used by the condition. Recreate the policy sequence in a real session, not only a trial session. This differs from TPM_20_E_POLICY_FAIL, which often indicates that an accumulated digest, cpHash or policy requirement does not match at authorization time.

TCG: policy comparison commands · tpm2_startauthsession · tpm2_policysecret

Looking for a different code? Search another status or error code.