TPM 2.0 hardware error DA lockout mode

Question

I'm getting same error as mentioned in this post: TPM 2.0 simulator error DA lockout mode but with a discrete hardware tpm 2.0 module instead of simulator.

Tried clearing ownership:

# tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership

Tried clearing dictionary lockout:

# tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout

Neither works.

The error id decode says:

linux-hf35:~ # tpm2_rc_decode 0x921
error layer
  hex: 0x0
  identifier: TSS2_TPM_RC_LAYER
  description: Error produced by the TPM
format 0 warning code
  hex: 0x21
  name: TPM2_RC_LOCKOUT
  description: authorizations for objects subject to DA protection are not allowed at this time because the TPM is in DA lockout mode

Can't figure out how to get out of this lockout state. Has someone came across same error before? How to fix it? Thanks.

Answer 1

This might be related to switching off the tpm without sending the TPM_SHUTDOWN command beforehand.

The following counter values may give you a better picture:

tpm2 getcap properties-variable | grep TPM2_PT_MAX_AUTH_FAIL
tpm2 getcap properties-variable | grep TPM2_PT_LOCKOUT_INTERVAL
tpm2 getcap properties-variable | grep TPM2_PT_LOCKOUT_RECOVERY

You can reset the lockout counter for TPM_PT_MAX_AUTH_FAIL using the following (setting --max-tries to the highest possible value means you will probably not see the problem again):

tpm2_dictionarylockout --setup-parameters --max-tries=4294967295 --clear-lockout