Unload every transient handle reported by TPM_CAP_HANDLES

.gitignore

@@ -82,6 +82,8 @@ tests/packet_auth.test
 tests/packet_auth.log
 tests/signature_padding.test
 tests/signature_padding.log
+tests/transient_unload.test
+tests/transient_unload.log
 tests/spdm_config.test
 tests/spdm_config.log
 tests/spdm_ctrl.test

examples/pqc/pqc_ctrl.c

@@ -120,40 +120,6 @@ static const char* mlkemName(TPMI_MLKEM_PARAMETER_SET ps)
         "768";
 }
 
-/* Reclaim the transient object table by flushing exactly the handles the TPM
- * reports as loaded. Parts with a small object table (e.g. SealSQ QVault TPM)
- * hit TPM_RC_OBJECT_MEMORY when a key plus a sign/verify sequence object are
- * live at once. wolfTPM2_UnloadHandles_AllTransient() only covers
- * MAX_HANDLE_NUM (3) fixed handles, so query the actual loaded set instead. */
-static int pqc_flush_transient(WOLFTPM2_DEV* dev)
-{
-    int rc;
-    word32 i;
-    GetCapability_In in;
-    GetCapability_Out out;
-    FlushContext_In flushCtx;
-
-    (void)dev; /* operates on the active TPM context */
-    XMEMSET(&in, 0, sizeof(in));
-    XMEMSET(&out, 0, sizeof(out));
-    XMEMSET(&flushCtx, 0, sizeof(flushCtx));
-    in.capability = TPM_CAP_HANDLES;
-    in.property = TRANSIENT_FIRST;
-    in.propertyCount = MAX_CAP_HANDLES;
-    rc = TPM2_GetCapability(&in, &out);
-    if (rc != TPM_RC_SUCCESS) {
-        return rc;
-    }
-    if (out.capabilityData.capability != TPM_CAP_HANDLES) {
-        return TPM_RC_FAILURE;
-    }
-    for (i = 0; i < out.capabilityData.data.handles.count; i++) {
-        flushCtx.flushHandle = out.capabilityData.data.handles.handle[i];
-        (void)TPM2_FlushContext(&flushCtx);
-    }
-    return TPM_RC_SUCCESS;
-}
-
 static int do_caps(WOLFTPM2_DEV* dev)
 {
     int rc;
@@ -401,7 +367,7 @@ static int do_mldsa(WOLFTPM2_DEV* dev, TPMI_MLDSA_PARAMETER_SET ps)
     XMEMSET(&validation, 0, sizeof(validation));
     XMEMSET(&flushCtx, 0, sizeof(flushCtx));
 
-    (void)pqc_flush_transient(dev);
+    (void)wolfTPM2_UnloadHandles_AllTransient(dev);
 
     sig = (byte*)XMALLOC(MAX_MLDSA_SIG_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (sig == NULL)
@@ -495,7 +461,7 @@ static int do_hash_mldsa(WOLFTPM2_DEV* dev, TPMI_MLDSA_PARAMETER_SET ps)
 #endif
     digestSz = TPM2_GetHashDigestSize(preHash);
 
-    (void)pqc_flush_transient(dev);
+    (void)wolfTPM2_UnloadHandles_AllTransient(dev);
 
     sig = (byte*)XMALLOC(MAX_MLDSA_SIG_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (sig == NULL)
@@ -571,7 +537,7 @@ static int do_mlkem(WOLFTPM2_DEV* dev, TPMI_MLKEM_PARAMETER_SET ps)
     XMEMSET(ss1, 0, sizeof(ss1));
     XMEMSET(ss2, 0, sizeof(ss2));
 
-    (void)pqc_flush_transient(dev);
+    (void)wolfTPM2_UnloadHandles_AllTransient(dev);
 
     ct = (byte*)XMALLOC(MAX_MLKEM_CT_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (ct == NULL)
@@ -721,7 +687,7 @@ static int handleOpt(WOLFTPM2_DEV* dev, const char* arg, int validateOnly)
         if (validateOnly) {
             return 0;
         }
-        rc = pqc_flush_transient(dev);
+        rc = wolfTPM2_UnloadHandles_AllTransient(dev);
         if (rc != TPM_RC_SUCCESS) {
             printf("FAIL  flush  0x%x: %s\n", rc, wolfTPM2_GetRCString(rc));
             return rc;

src/tpm2_wrap.c

@@ -9450,7 +9450,62 @@ int wolfTPM2_UnloadHandles(WOLFTPM2_DEV* dev, word32 handleStart,
 
 int wolfTPM2_UnloadHandles_AllTransient(WOLFTPM2_DEV* dev)
 {
-    return wolfTPM2_UnloadHandles(dev, TRANSIENT_FIRST, MAX_HANDLE_NUM);
+    int rc;
+    int flushRc;
+    int firstFlushRc = TPM_RC_SUCCESS;
+    word32 i;
+    TPM_HANDLE next = TRANSIENT_FIRST;
+    GetCapability_In  in;
+    GetCapability_Out out;
+    TPML_HANDLE* handles = &out.capabilityData.data.handles;
+    WOLFTPM2_HANDLE handle;
+
+    if (dev == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* flush only the handles the TPM reports as loaded */
+    XMEMSET(&handle, 0, sizeof(handle));
+    wolfTPM2_CopyAuth(&handle.auth, &dev->session[0].auth);
+    for (;;) {
+        XMEMSET(&in, 0, sizeof(in));
+        in.capability = TPM_CAP_HANDLES;
+        in.property = next;
+        in.propertyCount = MAX_CAP_HANDLES;
+        rc = TPM2_GetCapability(&in, &out);
+        if (rc == TPM_RC_SUCCESS &&
+                out.capabilityData.capability != TPM_CAP_HANDLES) {
+            rc = TPM_RC_FAILURE;
+        }
+        if (rc != TPM_RC_SUCCESS) {
+            break;
+        }
+        for (i = 0; i < handles->count; i++) {
+            if (handles->handle[i] < next ||
+                    (handles->handle[i] & HR_RANGE_MASK) != HR_TRANSIENT) {
+                break;
+            }
+            next = handles->handle[i] + 1;
+            handle.hndl = handles->handle[i];
+            flushRc = wolfTPM2_UnloadHandle(dev, &handle);
+            if (flushRc != TPM_RC_SUCCESS && firstFlushRc == TPM_RC_SUCCESS) {
+                firstFlushRc = flushRc;
+            }
+        }
+        /* continue only after a non-empty page of ascending transient
+         * handles that reports more data */
+        if (!out.moreData || handles->count == 0 || i < handles->count) {
+            break;
+        }
+    }
+    TPM2_ForceZero(&handle, sizeof(handle));
+
+    /* The fixed range ignores individual flush results, so it cannot confirm
+     * anything was unloaded: try it, but report that discovery failed. */
+    if (rc != TPM_RC_SUCCESS && next == TRANSIENT_FIRST) {
+        (void)wolfTPM2_UnloadHandles(dev, TRANSIENT_FIRST, MAX_HANDLE_NUM);
+    }
+    return (rc != TPM_RC_SUCCESS) ? rc : firstFlushRc;
 }
 
 int wolfTPM2_ChangeHierarchyAuth(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* session,

tests/include.am

@@ -136,5 +136,13 @@ signature_padding_support_objects = \
 tests_signature_padding_test_LDADD = $(signature_padding_support_objects) \
     $(src_libwolftpm_la_LIBADD) $(LIB_STATIC_ADD)
 tests_signature_padding_test_DEPENDENCIES = src/libwolftpm.la
+# Scripted TPM_CAP_HANDLES pages, which a simulator cannot produce on demand.
+check_PROGRAMS += tests/transient_unload.test
+noinst_PROGRAMS += tests/transient_unload.test
+tests_transient_unload_test_SOURCES = tests/transient_unload_tests.c
+tests_transient_unload_test_CFLAGS = $(AM_CFLAGS)
+tests_transient_unload_test_LDADD = $(signature_padding_support_objects) \
+    $(src_libwolftpm_la_LIBADD) $(LIB_STATIC_ADD)
+tests_transient_unload_test_DEPENDENCIES = src/libwolftpm.la
 endif
 endif