What does HRESULT 0x80280148 (TPM_20_E_NV_LOCKED) mean?

TPM_20_E_NV_LOCKED

TPM_20_E_NV_LOCKED means that an NV operation reached a defined index but the TPM will not allow the requested read or write at this time. This is a state or attribute decision, not evidence that the index is missing or that its authorization value is necessarily wrong.

Common causes

• The index has a read or write lock state established by an NV lock command or by attributes that control access after startup or after a write.
• A workflow intentionally locks an index after provisioning so a later operation cannot alter the protected value.
• An application retries a write after a state transition without re-reading the index attributes and current lifecycle expectations.

How to diagnose it

• Inspect the public NV attributes and identify whether the failing operation is a read, write, increment, extend, or another type-specific command.
• Check whether the relevant TPMA_NV_* attributes cause the lock to clear at the next TPM2_Startup(TPM_SU_CLEAR), whether it is tied to a global write lock, or whether it is part of an irreversible provisioning policy.
• Keep TPM_20_E_NV_LOCKED separate from TPM_20_E_NV_AUTHORIZATION: a correct authorization session cannot override an access state that the index policy has locked.

Do not treat this as cleanup

Removing and redefining the index can destroy protected state and can change the index Name and policy. First establish whether the lock is an expected security boundary and whether a documented restart or reprovisioning procedure is appropriate.

References: TCG TPM 2.0 Library Part 3: Commands, tpm2_nvreadlock, and tpm2_nvwritelock.

Looking for a different code? Search another status or error code.