[tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts

Roberts, William C <william.c.roberts at intel.com>
Newsgroups dev.linux.lists.tpm2
Message-ID <DM6PR11MB3434604A00F23B491CC67079B8B29@DM6PR11MB3434.namprd11.prod.outlook.com> 
Thats:
tpm2_rc_decode 0x00000902
tpm:warn(2.0): out of memory for object contexts

Are you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd.

You can set the TCTI via the TPM2OPENSSL_TCTI which AFAICT takes strings like tpm2-tools, so something like:
"device:/dev/tpmrm0" or "abrmd".

This also might be a bug, the provider is pretty new. Petr any other ideas I am missing?

Bill



________________________________
From: Chris Newman <chris(a)mode51.software>
Sent: Sunday, October 3, 2021 6:40 PM
To: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts


Hi,

I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server:

openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8

I get the following error:

DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST DUP
DIGEST FINAL
DIGEST FREE
DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST DUP
WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902)
DIGEST FREE
DIGEST FREE
DIGEST FREE
CMP DEBUG: disconnected from CMP server
CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts
CMP error: not able to copy ctx
CMP error: internal error
CMP error: error sending
CMP error: shutdown while in init
CMP error: transfer error:request sent: IR, expected response: IP
RSA FREE
RAND FREE
RAND FREE
RAND FREE
PROVIDER TEARDOWN


I've tried tpm2_flushcontext -t.

I recompiled tpm2-openssl with the following option and that appears to have worked around the issue:

--disable-op-digest

Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?


--

Chris Newman
https://mode51.software
@mode51software<https://twitter.com/mode51software>

[cid:part3.B665FF1A.CFE6FA19(a)mode51.software]


mode51 Software Ltd is registered in England and Wales
Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK

GPG Encryption key<https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc>
attachment.htm (text/html, 5.9 KB) 
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thats:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
tpm2_rc_decode 0x00000902<br>
tpm:warn(2.0): out of memory for object contexts<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Are you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=""><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">You can set the TCTI via the&nbsp;</span><span style="color: rgb(36, 41, 47); font-family: ui-monospace, SFMono-Regular, &quot;SF Mono&quot;, Menlo, Consolas, &quot;Liberation Mono&quot;, monospace; font-size: 13.6px; background-color: rgba(175, 184, 193, 0.2);">TPM2OPENSSL_TCTI
</span><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);">which AFAICT takes strings like tpm2-tools, so something like:</span></font><br>
</div>
<div style=""><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);">&quot;device:/dev/tpmrm0&quot; or &quot;abrmd&quot;.</span></font></div>
<div style=""><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);"><br>
</span></font></div>
<div style=""><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);">This also might be a bug, the provider is pretty new. Petr any other ideas I am missing?</span></font></div>
<div style=""><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);"><br>
</span></font></div>
<div style=""><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: rgb(255, 255, 255);">Bill</span></font></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(36, 41, 47);font-family:ui-monospace, SFMono-Regular, &quot;SF Mono&quot;, Menlo, Consolas, &quot;Liberation Mono&quot;, monospace;font-size:13.6px;background-color:rgba(175, 184, 193, 0.2);display:inline !important"><br>
</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Chris Newman &lt;[email protected]&gt;<br>
<b>Sent:</b> Sunday, October 3, 2021 6:40 PM<br>
<b>To:</b> [email protected] &lt;[email protected]&gt;<br>
<b>Subject:</b> [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts</font>
<div>&nbsp;</div>
</div>
<div>
<p>Hi,</p>
<p>I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server:<br>
</p>
<p>openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server
<a class="x_moz-txt-link-freetext" href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">
https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234 -secret pass:1234 -recipient &quot;/CN=mode51.software&quot; -key handle:0x81010002 -subject &quot;/CN=TestTest&quot; -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8<br>
</p>
<p>I get the following error:<br>
</p>
<p>DIGEST NEW<br>
DIGEST INIT<br>
DIGEST UPDATE<br>
DIGEST DUP<br>
DIGEST FINAL<br>
DIGEST FREE<br>
DIGEST NEW<br>
DIGEST INIT<br>
DIGEST UPDATE<br>
DIGEST NEW<br>
DIGEST INIT<br>
DIGEST UPDATE<br>
DIGEST DUP<br>
WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error<br>
ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902)<br>
DIGEST FREE<br>
DIGEST FREE<br>
DIGEST FREE<br>
CMP DEBUG: disconnected from CMP server<br>
<b>CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts</b><br>
CMP error: not able to copy ctx<br>
CMP error: internal error<br>
CMP error: error sending<br>
CMP error: shutdown while in init<br>
CMP error: transfer error:request sent: IR, expected response: IP<br>
RSA FREE<br>
RAND FREE<br>
RAND FREE<br>
RAND FREE<br>
PROVIDER TEARDOWN<br>
</p>
<p><br>
</p>
<p>I've tried tpm2_flushcontext -t.</p>
<p>I recompiled tpm2-openssl with the following option and that appears to have worked around the issue:</p>
<p>--disable-op-digest<br>
</p>
<p>Is this what &quot;?provider=tpm2,tpm2.digest!=yes&quot; should effectively do?</p>
<p><br>
</p>
<div class="x_moz-signature">-- <br>
<br>
Chris Newman <br>
<a href="https://mode51.software">https://mode51.software</a> <br>
<a href="https://twitter.com/mode51software">@mode51software</a> <br>
<br>
<img data-outlook-trace="F:1|T:1" src="cid:[email protected]">
<br>
<br>
<small><br>
mode51 Software Ltd is registered in England and Wales <br>
Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK <br>
<br>
<a href="https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc">GPG Encryption key</a>
</small></div>
</div>
</body>
</html>
hbofnihajndifnfn.png (image/png, 6.9 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.