Fapi_Provision(3)

📦
version 4.1.5 · 8 versions
, in fedora 44

💅 Fapi_Provision(3) — the glam Library Functions Manual entry, bestie

okay so this is the Fapi_Provision page from the Library Functions Manual, and honestly? It's the "get your TPM all set up and cute" page. Let's get into it ✨

🌸 NAME 🌸

Fapi_Provision — yes, that's literally just the name again. The manpage is being mysterious. I respect it. 💅

🦋 SYNOPSIS 🦋

Functions

TSS2_RC Fapi_Provision (FAPI_CONTEXT *context, char const *authValueEh,
    char const *authValueSh, char const *authValueLockout)
TSS2_RC Fapi_Provision_Async (FAPI_CONTEXT *context, char const
    *authValueEh, char const *authValueSh, char const *authValueLockout)
TSS2_RC Fapi_Provision_Finish (FAPI_CONTEXT *context)

🎀 Detailed Description 🎀

These are the FAPI functions that invoke Provision, and you can run it two ways: as a one-call situation, or in an asynchronous manner. Pick your fighter. 🥊

💖 Function Documentation 💖

🌟 TSS2_RC Fapi_Provision (FAPI_CONTEXT * context, char const * authValueEh, char const * authValueSh, char const * authValueLockout)

Bestie. This is the one-call function for the initial FAPI provisioning. The main character of the page. 👑

So what does it actually do? It provisions a TSS with its TPM — which includes setting the important passwords and policy settings, readout of the EK and its certificate, and the initialization of the system-wide keystore. That's a lot of slaying in one call, ngl. ✨

Parameters

  • context — The FAPI_CONTEXT.
  • authValueEh — The authorization value for the endorsement hierarchy. May be NULL.
  • authValueSh — The authorization value for the storage hierarchy. Should be NULL.
  • authValueLockout — The authorization value for lockout.

Return values

  • TSS2_RC_SUCCESS if the function call was a success. 🎉
  • TSS2_FAPI_RC_BAD_REFERENCE if context is NULL.
  • TSS2_FAPI_RC_BAD_CONTEXT if context corruption is detected.
  • TSS2_FAPI_RC_BAD_SEQUENCE if the context has an asynchronous operation already pending.
  • TSS2_FAPI_RC_NO_CERT if no certificate was found for the computed EK.
  • TSS2_FAPI_RC_BAD_KEY if public key of the EK does not match the configured certificate or the configured fingerprint does not match the computed EK.
  • TSS2_FAPI_RC_IO_ERROR if the data cannot be saved.
  • TSS2_FAPI_RC_MEMORY if the FAPI cannot allocate enough memory for internal operations or return parameters.
  • TSS2_FAPI_RC_NO_TPM if FAPI was initialized in no-TPM-mode via its config file.
  • TSS2_FAPI_RC_TRY_AGAIN if an I/O operation is not finished yet and this function needs to be called again.
  • TSS2_FAPI_RC_BAD_VALUE if an invalid value was passed into the function.
  • TSS2_FAPI_RC_AUTHORIZATION_UNKNOWN if a required authorization callback is not set.
  • TSS2_FAPI_RC_AUTHORIZATION_FAILED if the authorization attempt fails.
  • TSS2_FAPI_RC_GENERAL_FAILURE if an internal error occurred.
  • TSS2_FAPI_RC_POLICY_UNKNOWN if policy search for a certain policy digest was not successful.
  • TSS2_FAPI_RC_PATH_NOT_FOUND if a FAPI object path was not found during authorization.
  • TSS2_FAPI_RC_KEY_NOT_FOUND if a key was not found.
  • TSS2_ESYS_RC_* possible error codes of ESAPI.
  • TSS2_FAPI_RC_BAD_PATH if the path is used in inappropriate context or contains illegal characters.
  • TSS2_FAPI_RC_NOT_PROVISIONED FAPI was not provisioned.
  • TSS2_FAPI_RC_PATH_ALREADY_EXISTS if the object already exists in object store.

🌈 TSS2_RC Fapi_Provision_Async (FAPI_CONTEXT * context, char const * authValueEh, char const * authValueSh, char const * authValueLockout)

The asynchronous function for the initial FAPI provisioning. Same assignment, different schedule. 🕐

It provisions a TSS with its TPM — setting of important passwords and policy settings, readout of the EK and its certificate, and initialization of the system-wide keystore. All that good stuff, just not right this second.

Then you call Fapi_Provision_Finish to finish the execution of this command. Don't leave it hanging, bestie. 😭

Parameters

  • context — The FAPI_CONTEXT.
  • authValueEh — The authorization value for the endorsement hierarchy. May be NULL.
  • authValueSh — The authorization value for the storage hierarchy. Should be NULL.
  • authValueLockout — The authorization value for lockout.

Return values

  • TSS2_RC_SUCCESS if the function call was a success. 🎉
  • TSS2_FAPI_RC_BAD_REFERENCE if context is NULL.
  • TSS2_FAPI_RC_BAD_CONTEXT if context corruption is detected.
  • TSS2_FAPI_RC_BAD_SEQUENCE if the context has an asynchronous operation already pending.
  • TSS2_FAPI_RC_IO_ERROR if the data cannot be saved.
  • TSS2_FAPI_RC_MEMORY if the FAPI cannot allocate enough memory for internal operations or return parameters.
  • TSS2_FAPI_RC_NO_TPM if FAPI was initialized in no-TPM-mode via its config file.
  • TSS2_FAPI_RC_BAD_VALUE if an invalid value was passed into the function.
  • TSS2_FAPI_RC_BAD_PATH if the path is used in inappropriate context or contains illegal characters.
  • TSS2_FAPI_RC_PATH_NOT_FOUND if a FAPI object path was not found during authorization.

🧚 TSS2_RC Fapi_Provision_Finish (FAPI_CONTEXT * context)

The asynchronous finish function for Fapi_Provision. The closer. The finale. The "okay we're done here" moment. 💫

This function should be called after a previous Fapi_Provision_Async. That's the whole vibe — async first, finish second. iykyk.

Parameters

  • context — The FAPI_CONTEXT

Return values

  • TSS2_RC_SUCCESS if the function call was a success. 🎉
  • TSS2_FAPI_RC_BAD_REFERENCE if context is NULL.
  • TSS2_FAPI_RC_BAD_CONTEXT if context corruption is detected.
  • TSS2_FAPI_RC_BAD_SEQUENCE if the context has an asynchronous operation already pending.
  • TSS2_FAPI_RC_NO_CERT if no certificate was found for the computed EK.
  • TSS2_FAPI_RC_BAD_KEY if public key of the EK does not match the configured certificate or the configured fingerprint does not match the computed EK.
  • TSS2_FAPI_RC_IO_ERROR if the data cannot be saved.
  • TSS2_FAPI_RC_MEMORY if the FAPI cannot allocate enough memory for internal operations or return parameters.
  • TSS2_FAPI_RC_TRY_AGAIN if the asynchronous operation is not yet complete. Call this function again later.
  • TSS2_FAPI_RC_BAD_VALUE if an invalid value was passed into the function.
  • TSS2_FAPI_RC_AUTHORIZATION_UNKNOWN if a required authorization callback is not set.
  • TSS2_FAPI_RC_AUTHORIZATION_FAILED if the authorization attempt fails.
  • TSS2_FAPI_RC_GENERAL_FAILURE if an internal error occurred.
  • TSS2_FAPI_RC_POLICY_UNKNOWN if policy search for a certain policy digest was not successful.
  • TSS2_FAPI_RC_PATH_NOT_FOUND if a FAPI object path was not found during authorization.
  • TSS2_FAPI_RC_KEY_NOT_FOUND if a key was not found.
  • TSS2_ESYS_RC_* possible error codes of ESAPI.
  • TSS2_FAPI_RC_NOT_PROVISIONED FAPI was not provisioned.
  • TSS2_FAPI_RC_BAD_PATH if the path is used in inappropriate context or contains illegal characters.
  • TSS2_FAPI_RC_PATH_ALREADY_EXISTS if the object already exists in object store.

And then there's these three little lines that the manpage just drops in with zero context, and we're keeping them verbatim because facts are facts, bestie: 🫶

  • < Certificates will be stored at even address
  • < RSA template
  • < ECC template

👑 Author 👑

Generated automatically by Doxygen for tpm2-tss from the source code. Not a human author, just Doxygen doing Doxygen things. 🤖✨

And that's the page, babe — brought to you by tpm2-tss, Version 4.1.5. Go provision something iconic. 💜🦋

📦 where this page comes from