[tpm2] Re: Lifecycle of handles and contexts

Windows was with one process not exiting.  

BTW, I do this with scripts by running through the TPM proxy.

AFAIK, only the Intel RM is somewhat TCG compliant.  Even then,
the interface is proprietary to the Intel SAPI.  Neither the Windows
RM nor the Linux RM comply with abrmd or any TCG spec.

Windows, as you see, can create a large number of objects for
each process.

The Linux RM can create 3 objects per process, but many processes
can create 3 objects.


> -----Original Message-----
> From: Roberts, William C <william.c.roberts(a)intel.com>
> Sent: Monday, July 25, 2022 2:57 PM
> To: tpm2(a)bitzap.e4ward.com; Kenneth Goldman <kgoldman(a)us.ibm.com>;
> tpm2(a)lists.01.org
> Subject: [EXTERNAL] Re: [tpm2] Re: Lifecycle of handles and contexts
> 
> On Tue, 2022-07-19 at 22:17 +0000, Kenneth Goldman wrote:
> > > On Mon, 2022-07-18 at 17:36 +0000, Kenneth Goldman wrote:
> > > > It depends.
> > > >
> > > > Windows seems to have a large keystore, so you probably don't have
> > > > to ever flush.
> > > >
> > > > Linux in kernel RM manages keys across processes but not within
> > > > processes, so you still have to flush.
> > >
> > > This is also how TBS works on Windows.
> >
> > Not on my Windows 10.  I just created 32 keys with one process.  Now
> > there are
> > 32 loaded keys.
> 
> Did the process exit? I always thought TBS was spec compliant:
> "The RM also monitors connections, and removes table entries and
> ContextFlushes leftover sessions when the caller closes a connection." from
> Section 2.3.3 of:

> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__trustedcomputinggroup.org_wp-2Dcontent_uploads_TSS-5F2p0-5FTAB-
> 5FResourceManager-5Fv1p0-5Fr18-5F04082019-
> 5Fpub.pdf&d=DwIGaQ&c=jf_iaSHvJObTbx-
> siA1ZOg&r=DZCVG43VcL8GTneMZb8k8lEwb-O1GZktFfre1-
> mlmiA&m=MEqMRdEayqeSC_C_e9M_iXINVdIi7f1gunYT4cXhKxkUh0rqaGP1W
> SR150eCjLz7&s=R6HfwGLoJJyp923npcfsGOh6-VhE_Iha47FJ_5vtGQ4&e=
> 
> The table entries include transient handles and their associated virtual
> mapping.
> 
> > OK, the Windows RM swaps them out, but the application never sees
> > that.
> >
> > I don't know what the RM limit is, but it's certainly far more than
> > the TPM itself.
> >
> > getcapability.exe -cap 1 -pr 80000000
> > 32 handles
> >         80ffffe0
> >         80ffffe1
> >         80ffffe2
> >         80ffffe3
> >         80ffffe4
> >         80ffffe5
> >         80ffffe6
> >         80ffffe7
> >         80ffffe8
> >         80ffffe9
> >         80ffffea
> >         80ffffeb
> >         80ffffec
> >         80ffffed
> >         80ffffee
> >         80ffffef
> >         80fffff0
> >         80fffff1
> >         80fffff2
> >         80fffff3
> >         80fffff4
> >         80fffff5
> >         80fffff6
> >         80fffff7
> >         80fffff8
> >         80fffff9
> >         80fffffa
> >         80fffffb
> >         80fffffc
> >         80fffffd
> >         80fffffe
> >         80ffffff
> 
> These look like virtual handles. The spec also states, "In responses that return
> handles, these handles MUST be virtualized before returning the response to
> the caller:
>  These virtual handles MUST be unique per connection".
> I don't think anyone actually makes them unique per connection.