| Previous | Next |
| TPM_20_E_PCR | TPM_20_E_UPGRADE |
TPM_20_E_PCR_CHANGED
This response is more specific than a static PCR mismatch. The TPM remembers that a policy session checked PCR state and later sees a different PCR update counter when authorization is attempted. The state may have satisfied the policy initially, but it changed during the same session.
Why it occurs in real workflows
- Boot, measured-launch or runtime activity extends a selected PCR while the application is constructing a multi-step policy.
- A session is kept open across a long operation, suspend/resume boundary or another actor that changes platform measurements.
- A caller restores a policy session context and assumes an earlier PCR check remains current.
Correct recovery
Start or restart the policy session, read the PCR state again, rebuild the policy steps and retry only if the new measurements still meet the intended policy. Do not merely replay the protected command against the old session. This response differs from TPM_20_E_PCR: the latter is a failed PCR condition, while this code identifies a change after PCR state was checked.
TCG: PCR update-counter check · tpm2_policyrestart · tpm2_policypcr
Looking for a different code? Search another status or error code.