HRESULT 0x80280907 (TPM_20_E_LOCALITY): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The command used a TPM locality that is invalid for the command or platform state.

Previous	Next
TPM_20_E_OBJECT_HANDLES	TPM_20_E_YIELDED

TPM_20_E_LOCALITY

TPM locality identifies the platform execution source

TPM_20_E_LOCALITY maps to TPM_RC_LOCALITY. TPM localities are hardware- and firmware-mediated execution contexts used to distinguish command sources, especially around measured boot, dynamic roots of trust, and platform firmware. A valid numeric locality is not automatically valid for every command or every phase of boot.

Windows TBS accepts a locality argument when submitting a command, but its public documentation states that locality zero is the normally supported application locality. Supplying another locality from user mode can therefore fail before or at the TPM depending on the stack and platform.

What to verify

Record the locality passed to Tbsip_Submit_Command and default to locality zero for ordinary applications.
Check whether the command's authorization policy includes a locality restriction.
Do not emulate a firmware locality in software; locality is intended to be enforced below the application layer.
For measured-boot failures, correlate the command with the boot phase and firmware implementation.

References

Looking for a different code? Search another status or error code.