---
name: "Fapi_Provision"
section: "3"
platform: "linux"
package: "tpm2-tss"
version: "4.2.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Fapi_Provision"
---

# Fapi\_Provision(3)

Fapi\_Provision

## NAME

Fapi\_Provision - Fapi\_Provision

## SYNOPSIS

### Functions

TSS2\_RC **Fapi\_Provision** (**FAPI\_CONTEXT** \*context, char const \*authValueEh, char const \*authValueSh, char const \*authValueLockout)\
 TSS2\_RC **Fapi\_Provision\_Async** (**FAPI\_CONTEXT** \*context, char const \*authValueEh, char const \*authValueSh, char const \*authValueLockout)\
 TSS2\_RC **Fapi\_Provision\_Finish** (**FAPI\_CONTEXT** \*context)\

## Detailed Description

FAPI functions to invoke Provision either as one-call or in an asynchronous manner.

## Function Documentation

### TSS2\_RC Fapi\_Provision (FAPI\_CONTEXT \* context, char const \* authValueEh, char const \* authValueSh, char const \* authValueLockout)

One-Call function for the initial FAPI provisioning.

Provisions a TSS with its TPM. This includes the setting of important passwords and policy settings as well as the readout of the EK and its certificate and the initialization of the system-wide keystore.

**Parameters**

*context* The **FAPI\_CONTEXT**. \
 *authValueEh* The authorization value for the endorsement hierarchy. May be NULL \
 *authValueSh* The authorization value for the storage hierarchy. Should be NULL \
 *authValueLockout* The authorization value for lockout.

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_NO\_CERT* if no certificate was found for the computed EK. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if public key of the EK does not match the configured certificate or the configured fingerprint does not match the computed EK. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if an I/O operation is not finished yet and this function needs to be called again. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if a key was not found. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_PATH\_ALREADY\_EXISTS* if the object already exists in object store.

### TSS2\_RC Fapi\_Provision\_Async (FAPI\_CONTEXT \* context, char const \* authValueEh, char const \* authValueSh, char const \* authValueLockout)

Asynchronous function for the initial FAPI provisioning.

Provisions a TSS with its TPM. This includes the setting of important passwords and policy settings as well as the readout of the EK and its certificate and the initialization of the system-wide keystore.

Call Fapi\_Provision\_Finish to finish the execution of this command.

**Parameters**

*context* The **FAPI\_CONTEXT**. \
 *authValueEh* The authorization value for the endorsement hierarchy. May be NULL \
 *authValueSh* The authorization value for the storage hierarchy. Should be NULL \
 *authValueLockout* The authorization value for lockout.

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization.

### TSS2\_RC Fapi\_Provision\_Finish (FAPI\_CONTEXT \* context)

Asynchronous finish function for Fapi\_Provision

This function should be called after a previous Fapi\_Provision\_Async.

**Parameters**

*context* The **FAPI\_CONTEXT**

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_NO\_CERT* if no certificate was found for the computed EK. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if public key of the EK does not match the configured certificate or the configured fingerprint does not match the computed EK. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if the asynchronous operation is not yet complete. Call this function again later. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if a key was not found. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters. \
 *TSS2\_FAPI\_RC\_PATH\_ALREADY\_EXISTS* if the object already exists in object store.

\< Certificates will be stored at even address

\< RSA template

\< ECC template

## Author

Generated automatically by Doxygen for tpm2-tss from the source code.