HRESULT 0x80280085 (TPM_20_E_HIERARCHY): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the selected TPM hierarchy is disabled or is not valid for the requested operation.

Previous	Next
TPM_20_E_VALUE	TPM_20_E_KEY_SIZE

TPM_20_E_HIERARCHY

TPM hierarchies are not just labels for key storage. Owner, Endorsement, Platform and Null have different authorization and lifecycle rules, and some operations require a particular hierarchy handle. This condition means that the command selected a hierarchy that is disabled or cannot be used in the current context.

Typical contexts

TPM2_CreatePrimary receives a hierarchy handle that determines where the primary object is created and which hierarchy authorization applies.
Platform-created NV objects and platform operations can be affected by platform-hierarchy enable state.
A cached application configuration may name the right hierarchy for one machine but not for the current TPM provisioning state.

Useful evidence

Record the command code, hierarchy handle, TPM provisioning state and the exact caller identity. Do not clear or re-provision a TPM merely to test this error: that can destroy protected keys. First verify whether the application chose the intended hierarchy and whether the operation is supported by the device and its management policy.

TCG: hierarchy response codes and structures · tpm2_createprimary: hierarchy selection · tpm2-tss: Esys_CreatePrimary inputs

Looking for a different code? Search another status or error code.