---
name: "Esys_CreatePrimary"
section: "3"
platform: "linux"
package: "tpm2-tss"
version: "4.2.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Esys_CreatePrimary"
---

# Esys\_CreatePrimary(3)

The ESAPI function for the TPM2\_CreatePrimary command.

## NAME

Esys\_CreatePrimary - The ESAPI function for the TPM2\_CreatePrimary command.

## SYNOPSIS

### Functions

TSS2\_RC **Esys\_CreatePrimary\_Async** (**ESYS\_CONTEXT** \*esysContext, **ESYS\_TR** primaryHandle, **ESYS\_TR** shandle1, **ESYS\_TR** shandle2, **ESYS\_TR** shandle3, const TPM2B\_SENSITIVE\_CREATE \*inSensitive, const TPM2B\_PUBLIC \*inPublic, const TPM2B\_DATA \*outsideInfo, const TPML\_PCR\_SELECTION \*creationPCR)\
 TSS2\_RC **Esys\_CreatePrimary** (**ESYS\_CONTEXT** \*esysContext, **ESYS\_TR** primaryHandle, **ESYS\_TR** shandle1, **ESYS\_TR** shandle2, **ESYS\_TR** shandle3, const TPM2B\_SENSITIVE\_CREATE \*inSensitive, const TPM2B\_PUBLIC \*inPublic, const TPM2B\_DATA \*outsideInfo, const TPML\_PCR\_SELECTION \*creationPCR, **ESYS\_TR** \*objectHandle, TPM2B\_PUBLIC \*\*outPublic, TPM2B\_CREATION\_DATA \*\*creationData, TPM2B\_DIGEST \*\*creationHash, TPMT\_TK\_CREATION \*\*creationTicket)\
 TSS2\_RC **Esys\_CreatePrimary\_Finish** (**ESYS\_CONTEXT** \*esysContext, **ESYS\_TR** \*objectHandle, TPM2B\_PUBLIC \*\*outPublic, TPM2B\_CREATION\_DATA \*\*creationData, TPM2B\_DIGEST \*\*creationHash, TPMT\_TK\_CREATION \*\*creationTicket)\

## Detailed Description

ESAPI function to invoke the TPM2\_CreatePrimary command either as a one-call or in an asynchronous manner.

## Function Documentation

### TSS2\_RC Esys\_CreatePrimary (ESYS\_CONTEXT \* esysContext, ESYS\_TR primaryHandle, ESYS\_TR shandle1, ESYS\_TR shandle2, ESYS\_TR shandle3, const TPM2B\_SENSITIVE\_CREATE \* inSensitive, const TPM2B\_PUBLIC \* inPublic, const TPM2B\_DATA \* outsideInfo, const TPML\_PCR\_SELECTION \* creationPCR, ESYS\_TR \* objectHandle, TPM2B\_PUBLIC \*\* outPublic, TPM2B\_CREATION\_DATA \*\* creationData, TPM2B\_DIGEST \*\* creationHash, TPMT\_TK\_CREATION \*\* creationTicket)

One-Call function for TPM2\_CreatePrimary

This function invokes the TPM2\_CreatePrimary command in a one-call variant. This means the function will block until the TPM response is available. All input parameters are const. The memory for non-simple output parameters is allocated by the function implementation.

**Parameters**

*esysContext* The **ESYS\_CONTEXT**. \
 *primaryHandle* TPM2\_RH\_ENDORSEMENT, TPM2\_RH\_OWNER, TPM2\_RH\_PLATFORM+{PP}, or TPM2\_RH\_NULL. \
 *shandle1* Session handle for authorization of primaryHandle \
 *shandle2* Second session handle. \
 *shandle3* Third session handle. \
 *inSensitive* The sensitive data, see TPM 2.0 Part 1 Sensitive Values. \
 *inPublic* The public template. \
 *outsideInfo* Data that will be included in the creation data for this object to provide permanent, verifiable linkage between this object and some object owner data. \
 *creationPCR* PCR that will be used in creation data. \
 *outPublic* The public portion of the created object. (callee-allocated) \
 *creationData* Contains a TPMT\_CREATION\_DATA. (callee-allocated) \
 *creationHash* Digest of creationData using nameAlg of outPublic. (callee-allocated) \
 *creationTicket* Ticket used by TPM2\_CertifyCreation() to validate that the creation data was produced by the TPM. (callee-allocated) \
 *objectHandle* **ESYS\_TR** handle of ESYS resource for TPM2\_HANDLE.

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_ESYS\_RC\_BAD\_REFERENCE* if the esysContext or required input pointers or required output handle references are NULL. \
 *TSS2\_ESYS\_RC\_BAD\_CONTEXT* if esysContext corruption is detected. \
 *TSS2\_ESYS\_RC\_MEMORY* if the ESAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_ESYS\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_ESYS\_RC\_INSUFFICIENT\_RESPONSE* if the TPM's response does not at least contain the tag, response length, and response code. \
 *TSS2\_ESYS\_RC\_MALFORMED\_RESPONSE* if the TPM's response is corrupted. \
 *TSS2\_ESYS\_RC\_RSP\_AUTH\_FAILED* if the response HMAC from the TPM did not verify. \
 *TSS2\_ESYS\_RC\_MULTIPLE\_DECRYPT\_SESSIONS* if more than one session has the 'decrypt' attribute bit set. \
 *TSS2\_ESYS\_RC\_MULTIPLE\_ENCRYPT\_SESSIONS* if more than one session has the 'encrypt' attribute bit set. \
 *TSS2\_ESYS\_RC\_BAD\_TR* if any of the **ESYS\_TR** objects are unknown to the **ESYS\_CONTEXT** or are of the wrong type or if required **ESYS\_TR** objects are ESYS\_TR\_NONE. \
 *TSS2\_RCs* produced by lower layers of the software stack may be returned to the caller unaltered unless handled internally.

### TSS2\_RC Esys\_CreatePrimary\_Async (ESYS\_CONTEXT \* esysContext, ESYS\_TR primaryHandle, ESYS\_TR shandle1, ESYS\_TR shandle2, ESYS\_TR shandle3, const TPM2B\_SENSITIVE\_CREATE \* inSensitive, const TPM2B\_PUBLIC \* inPublic, const TPM2B\_DATA \* outsideInfo, const TPML\_PCR\_SELECTION \* creationPCR)

Asynchronous function for TPM2\_CreatePrimary

This function invokes the TPM2\_CreatePrimary command in a asynchronous variant. This means the function will return as soon as the command has been sent downwards the stack to the TPM. All input parameters are const. In order to retrieve the TPM's response call Esys\_CreatePrimary\_Finish.

**Parameters**

*esysContext* The **ESYS\_CONTEXT**. \
 *primaryHandle* TPM2\_RH\_ENDORSEMENT, TPM2\_RH\_OWNER, TPM2\_RH\_PLATFORM+{PP}, or TPM2\_RH\_NULL. \
 *shandle1* Session handle for authorization of primaryHandle \
 *shandle2* Second session handle. \
 *shandle3* Third session handle. \
 *inSensitive* The sensitive data, see TPM 2.0 Part 1 Sensitive Values. \
 *inPublic* The public template. \
 *outsideInfo* Data that will be included in the creation data for this object to provide permanent, verifiable linkage between this object and some object owner data. \
 *creationPCR* PCR that will be used in creation data.

**Return values**

*ESYS\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_ESYS\_RC\_BAD\_REFERENCE* if the esysContext or required input pointers or required output handle references are NULL. \
 *TSS2\_ESYS\_RC\_BAD\_CONTEXT* if esysContext corruption is detected. \
 *TSS2\_ESYS\_RC\_MEMORY* if the ESAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_RCs* produced by lower layers of the software stack may be returned to the caller unaltered unless handled internally. \
 *TSS2\_ESYS\_RC\_MULTIPLE\_DECRYPT\_SESSIONS* if more than one session has the 'decrypt' attribute bit set. \
 *TSS2\_ESYS\_RC\_MULTIPLE\_ENCRYPT\_SESSIONS* if more than one session has the 'encrypt' attribute bit set. \
 *TSS2\_ESYS\_RC\_BAD\_TR* if any of the **ESYS\_TR** objects are unknown to the **ESYS\_CONTEXT** or are of the wrong type or if required **ESYS\_TR** objects are ESYS\_TR\_NONE.

### TSS2\_RC Esys\_CreatePrimary\_Finish (ESYS\_CONTEXT \* esysContext, ESYS\_TR \* objectHandle, TPM2B\_PUBLIC \*\* outPublic, TPM2B\_CREATION\_DATA \*\* creationData, TPM2B\_DIGEST \*\* creationHash, TPMT\_TK\_CREATION \*\* creationTicket)

Asynchronous finish function for TPM2\_CreatePrimary

This function returns the results of a TPM2\_CreatePrimary command invoked via Esys\_CreatePrimary\_Finish. All non-simple output parameters are allocated by the function's implementation. NULL can be passed for every output parameter if the value is not required.

**Parameters**

*esysContext* The **ESYS\_CONTEXT**. \
 *outPublic* The public portion of the created object. (callee-allocated) \
 *creationData* Contains a TPMT\_CREATION\_DATA. (callee-allocated) \
 *creationHash* Digest of creationData using nameAlg of outPublic. (callee-allocated) \
 *creationTicket* Ticket used by TPM2\_CertifyCreation() to validate that the creation data was produced by the TPM. (callee-allocated) \
 *objectHandle* **ESYS\_TR** handle of ESYS resource for TPM2\_HANDLE.

**Return values**

*TSS2\_RC\_SUCCESS* on success \
 *ESYS\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_ESYS\_RC\_BAD\_REFERENCE* if the esysContext or required input pointers or required output handle references are NULL. \
 *TSS2\_ESYS\_RC\_BAD\_CONTEXT* if esysContext corruption is detected. \
 *TSS2\_ESYS\_RC\_MEMORY* if the ESAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_ESYS\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_ESYS\_RC\_TRY\_AGAIN* if the timeout counter expires before the TPM response is received. \
 *TSS2\_ESYS\_RC\_INSUFFICIENT\_RESPONSE* if the TPM's response does not at least contain the tag, response length, and response code. \
 *TSS2\_ESYS\_RC\_RSP\_AUTH\_FAILED* if the response HMAC from the TPM did not verify. \
 *TSS2\_ESYS\_RC\_MALFORMED\_RESPONSE* if the TPM's response is corrupted. \
 *TSS2\_RCs* produced by lower layers of the software stack may be returned to the caller unaltered unless handled internally.

## Author

Generated automatically by Doxygen for tpm2-tss from the source code.