[tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts
Petr Gotthard <petr.gotthard at centrum.cz>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Bill, we solved this particular issue, but I expect more resource-related troubles are yet to come. Example 1: OpenSSL often duplicates hash sequences: To hash sequences A,B,C1 and then A,B,C2 they first hash A,B, then duplicate/fork the hash sequence and then complete the hash first for C1 and then for C2. This is a great performance optimization, but when too many dup (forks) are made, the TPM runs out of objects. Example 2: The CMP key update needs 4 objects to operate (old client key, new client key, server key and hash sequence), but the kernel RM (tpm_space.context_tbl) allows only 3 objects. (If I am right.) In general, the OpenSSL code often pre-loads or caches objects, which will be used later, which causes troubles with the space-constrained TPM. I was not sure whether the tpm2-openssl provider should act as another level of a resource manager and swap the objects to simulate more space than available on the TPM hardware, or whether this is something the resource manager could/should do. It's definitely a nice problem to think about and most likely something which will need to be addressed in the tpm2-openssl 2.0 Petr ______________________________________________________________ > Od: "Roberts, William C" <william.c.roberts(a)intel.com> > Komu: "Chris Newman" <chris(a)mode51.software>, "tpm2(a)lists.01.org" <tpm2(a)lists.01.org>, "Petr Gotthard" <petr.gotthard(a)centrum.cz> > Datum: 08.10.2021 17:46 > Předmět: [tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts > Thats:tpm2_rc_decode 0x00000902 tpm:warn(2.0): out of memory for object contextsAre you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd.You can set the TCTI via the TPM2OPENSSL_TCTI which AFAICT takes strings like tpm2-tools, so something like:"device:/dev/tpmrm0" or "abrmd". This also might be a bug, the provider is pretty new. Petr any other ideas I am missing? Bill From: Chris Newman <chris(a)mode51.software> Sent: Sunday, October 3, 2021 6:40 PM To: tpm2(a)lists.01.org <tpm2(a)lists.01.org> Subject: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts Hi, I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server: openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8 I get the following error: DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP DIGEST FINAL DIGEST FREE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902) DIGEST FREE DIGEST FREE DIGEST FREE CMP DEBUG: disconnected from CMP server CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts CMP error: not able to copy ctx CMP error: internal error CMP error: error sending CMP error: shutdown while in init CMP error: transfer error:request sent: IR, expected response: IP RSA FREE RAND FREE RAND FREE RAND FREE PROVIDER TEARDOWN I've tried tpm2_flushcontext -t. I recompiled tpm2-openssl with the following option and that appears to have worked around the issue: --disable-op-digest Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do? -- Chris Newman https://mode51.software <https://mode51.software> @mode51software <https://twitter.com/mode51software>
attachment.htm
(text/html, 7.5 KB)
<p style="padding:0 0 0 0; margin:0 0 0 0;">Bill,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">we solved this particular issue, but I expect more resource-related troubles are yet to come.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Example 1: OpenSSL often duplicates hash sequences: To hash sequences A,B,C1 and then A,B,C2 they first hash A,B, then duplicate/fork the hash sequence and then complete the hash first for C1 and then for C2. This is a great performance optimization, but when too many dup (forks) are made, the TPM runs out of objects.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Example 2: The CMP key update needs 4 objects to operate (old client key, new client key, server key and hash sequence), but the kernel RM (tpm_space.context_tbl) allows only 3 objects. (If I am right.)</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">In general, the OpenSSL code often pre-loads or caches objects, which will be used later, which causes troubles with the space-constrained TPM. I was not sure whether the tpm2-openssl provider should act as another level of a resource manager and swap the objects to simulate more space than available on the TPM hardware, or whether this is something the resource manager could/should do.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">It's definitely a nice problem to think about and most likely something which will need to be addressed in the tpm2-openssl 2.0</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p> <br /> <p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br /> > Od: "Roberts, William C" <[email protected]><br /> > Komu: "Chris Newman" <[email protected]>, "[email protected]" <[email protected]>, "Petr Gotthard" <[email protected]><br /> > Datum: 08.10.2021 17:46<br /> > Předmět: [tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts<br /> ></p> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: #000000;">Thats:</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: #000000;">tpm2_rc_decode 0x00000902<br /> tpm:warn(2.0): out of memory for object contexts</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: #000000;">Are you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd.</div> <div><span style="color: #000000; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">You can set the TCTI via the </span><span style="color: #24292f; font-family: ui-monospace, SFMono-Regular, &quot; sf mono&quot;, menlo, consolas, &quot;liberation mono&quot;, monospace; font-size: 13.6px; background-color: rgba(175, 184, 193, 0.2);">TPM2OPENSSL_TCTI </span><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;">which AFAICT takes strings like tpm2-tools, so something like:</span></font></div> <div><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;">"device:/dev/tpmrm0" or "abrmd".</span></font></div> <div><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;"><br /> </span></font></div> <div><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;">This also might be a bug, the provider is pretty new. Petr any other ideas I am missing?</span></font></div> <div><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;"><br /> </span></font></div> <div><font face="Calibri, Arial, Helvetica, sans-serif"><span style="background-color: #ffffff;">Bill</span></font></div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: #000000;"><span style="color: #24292f; font-family: ui-monospace, SFMono-Regular, &quot; sf mono&quot;, menlo, consolas, &quot;liberation mono&quot;, monospace;font-size: 13.6px; background-color: rgba(175, 184, 193, 0.2); display: inline !important;"><br /> </span></div> <hr /> <div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;"><strong>From:</strong> Chris Newman <[email protected]><br /> <strong>Sent:</strong> Sunday, October 3, 2021 6:40 PM<br /> <strong>To:</strong> [email protected] <[email protected]><br /> <strong>Subject:</strong> [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts</font> <div> </div> </div> <div> <p style="padding:0 0 0 0; margin:0 0 0 0;">Hi,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server:</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server <a href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234"> https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I get the following error:</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST DUP<br /> DIGEST FINAL<br /> DIGEST FREE<br /> DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST NEW<br /> DIGEST INIT<br /> DIGEST UPDATE<br /> DIGEST DUP<br /> WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error<br /> ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902)<br /> DIGEST FREE<br /> DIGEST FREE<br /> DIGEST FREE<br /> CMP DEBUG: disconnected from CMP server<br /> <strong>CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts</strong><br /> CMP error: not able to copy ctx<br /> CMP error: internal error<br /> CMP error: error sending<br /> CMP error: shutdown while in init<br /> CMP error: transfer error:request sent: IR, expected response: IP<br /> RSA FREE<br /> RAND FREE<br /> RAND FREE<br /> RAND FREE<br /> PROVIDER TEARDOWN</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I've tried tpm2_flushcontext -t.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I recompiled tpm2-openssl with the following option and that appears to have worked around the issue:</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">--disable-op-digest</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <div class="x_moz-signature">-- <br /> <br /> Chris Newman <br /> <a href="https://mode51.software">https://mode51.software</a> <br /> <a href="https://twitter.com/mode51software">@mode51software</a></div> </div>