I'm getting same error as mentioned in this post: TPM 2.0 simulator error DA lockout mode but with a discrete hardware tpm 2.0 module instead of simulator.

Tried clearing ownership:

# tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership

Tried clearing dictionary lockout:

# tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout

Neither works.

The error id decode says:

linux-hf35:~ # tpm2_rc_decode 0x921
error layer
  hex: 0x0
  identifier: TSS2_TPM_RC_LAYER
  description: Error produced by the TPM
format 0 warning code
  hex: 0x21
  description: authorizations for objects subject to DA protection are not allowed at this time because the TPM is in DA lockout mode

Can't figure out how to get out of this lockout state. Has someone came across same error before? How to fix it? Thanks.

1 Answer 1


This might be related to switching off the tpm without sending the TPM_SHUTDOWN command beforehand.

The following counter values may give you a better picture:

tpm2 getcap properties-variable | grep TPM2_PT_MAX_AUTH_FAIL
tpm2 getcap properties-variable | grep TPM2_PT_LOCKOUT_INTERVAL
tpm2 getcap properties-variable | grep TPM2_PT_LOCKOUT_RECOVERY

You can reset the lockout counter for TPM_PT_MAX_AUTH_FAIL using the following (setting --max-tries to the highest possible value means you will probably not see the problem again):

tpm2_dictionarylockout --setup-parameters --max-tries=4294967295 --clear-lockout 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.