fwTPM: ContextLoad of a flushed object fails, so fwTPM can't run behind a resource manager #652

For a transient object, FwCmd_ContextSave saves only a wrapped reference to the object's handle ("The object remains in its live slot for this fwTPM context model"). After TPM2_FlushContext, TPM2_ContextLoad of that context fails with TPM_RC_HANDLE. A TPM 2.0 context holds the object itself (Part 1, "Context Management"), so it loads after a flush; libtpms and the TCG reference implementation do this.

This is what a resource manager relies on: tpm2-abrmd, and the Linux kernel's /dev/tpmrm0, save and flush every object between commands and load it back when it's used. So fwTPM can't be used behind either, and the client sees TPM_RC_HANDLE on the second command that uses an object. With tpm2-pkcs11 we work around it by connecting to fwTPM directly and building it with FWTPM_MAX_OBJECTS=128.

Reproduction (ESYS). Create an ECC P-256 primary, then call Esys_ContextSave, Esys_FlushContext and Esys_ContextLoad on it:

                              fwTPM master             swtpm 0.10.2
ContextSave                   success (200-byte blob)  success (544-byte blob)
FlushContext                  success                  success
ContextLoad after the flush   TPM_RC_HANDLE            success

I realise this may be a deliberate design choice for the firmware use case. If so, it would help to document that fwTPM doesn't support resource managers, or to offer a build option that saves the object (its public area and wrapped sensitive area) in the context blob, as #568 already does for authenticating the blob.

Environment

• wolfTPM master at d7f73b5 (also seen in v4.2.0), fwTPM built with ./configure --enable-fwtpm-only --enable-swtpm on wolfSSL v5.9.4-stable (--enable-wolftpm --enable-pkcallbacks --enable-keygen).
• fwtpm_server --port 2341 --platform-port 2342, reached through the tpm2-tss 4.2.0 swtpm TCTI (swtpm:host=127.0.0.1,port=2341).
• For comparison, the same program against swtpm 0.10.2 (libtpms).
• Found while running tpm2-pkcs11 on fwTPM.