OpenBlocks VX1のTPM2.0を使ってみる

ぷらっとホーム社のIoTゲートウェイ、OpenBlocks VX1にはTPM2.0（Intel PTT）が搭載されています。OSはDevianですので、Linux上でのTPMの利用方法についてまとめます。ここではOpenBlocks VX1（以降VX1）の設定が完了し、ネットワークに接続された状態を前提として、TPMを利用するための手順をまとめます。

# 1. TPM2.0の概要

# 1-1. TPM2.0

TPM2.0には主に２つの実装方法があります。ひとつは専用のチップ、もうひとつはチップセットのファームウェアに組み込まれたものものになります。VX1の場合はIntelのAtom E3805内臓のPTT（Platform Trust Technology）を使いますので後者になります。

# 1-2. BIOSおよびBootloader

BIOSはシステム起動時に最初に動くをフトウェアになります。Trusted Bootを正しく実現するにはBIOSがTPM2.0に対応しており、プラットフォーム上で起動するソフトウェアを順次計測しTPMに記録する機能をもつ必要があります。


# 1-3. デバイスドライバ
オペレーティングシステムがTPMにアクセスするためにはデバイスドライバが必要になります。これは Linux,Windows共に対応しています。VX1にはDebian jessie (Linux Kernel 4.4.26) が搭載されており、TPM2.0のドライバが付属していますので、TPM自動的にOSに認識されます。 

    # dmesg | grep tpm
    [    1.959679] tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16)
    [    7.766968] Modules linked in: i8042(+) serio video backlight tpm_crb snd_soc_sst_acpi rfkill_gpio(+) rfkill


# 1-4. TSS2.0

TPMを使うためにライブラリとしてTPM2.0用のTSS（TCG Software Stack）が必要となります。TPM1.2とTPM2.0には互換性がないため、TPM1.2用のTSS（Linuxの場合はTrousers）は使えません。TSS2.0のオープンソース実装はIntel,Google,IBMから出ており、Debianの場合は IntelのTSS2.0が標準でサポートされています。

LinuxではVersion 4.11 かそれ以降で、TSS2.0のリソースマネージャーがユーザーランドから LinuxのKernel 内に移動します。ここでは Kernel 4.4.26 を用いるため従来のTSS2.0になります。

    $ sudo apt-get install tpm2-tools libsapi0 libsapi-dev libsapi-utils
....
$ sudo systemctl start tpm2-resourcemgr
$ tpm2_listpcrs 


# 2. TPM2.0を使ってみる

# 2-1. PCR

    $ sudo systemctl start tpm2-resourcemgr



    $ /usr/sbin/resourcemgr &
    $ tpm2_listpcrs 
    Accept socket:  0x6
    Resource Manager TPM CMD Server accepted client
    Accept socket:  0x7
    Resource Manager Other CMD Server accepted client
    
    Bank/Algorithm: TPM_ALG_SHA1(0x0004)
    PCR_00: 9e f0 b7 41 27 e0 41 8d 3e 76 32 35 57 56 f1 7a 63 dc 8d 2d
    PCR_01: b2 a8 3b 0e bf 2f 83 74 29 9a 5b 2b df c3 1e a9 55 ad 72 36
    PCR_02: b2 a8 3b 0e bf 2f 83 74 29 9a 5b 2b df c3 1e a9 55 ad 72 36
    PCR_03: b2 a8 3b 0e bf 2f 83 74 29 9a 5b 2b df c3 1e a9 55 ad 72 36
    PCR_04: 44 87 0f 11 b0 76 f5 7a 1c b3 b8 38 3d 06 7a 27 72 00 c3 4f
    PCR_05: 8e 8e 34 61 7d b2 99 ee 59 fa ff c9 0d 38 5f 8d 1c 89 a1 7a
    PCR_06: b2 a8 3b 0e bf 2f 83 74 29 9a 5b 2b df c3 1e a9 55 ad 72 36
    PCR_07: 40 37 33 6f a7 bc 0e ab e3 77 8f cf ff 5f cd 0e e6 ad cd e3
    PCR_08: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_09: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_10: c3 ed 4a c5 4c bc 0a ae 1b 16 36 6a c5 51 9c 4e bd 4e dc d6
    PCR_11: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_12: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_13: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_15: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_17: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_18: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_19: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_20: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_21: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_22: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_23: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

    Bank/Algorithm: TPM_ALG_SHA256(0x000b)
    PCR_00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_02: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_03: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_04: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_05: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_06: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_07: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_08: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_09: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_11: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_12: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_13: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_15: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    PCR_17: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_18: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_19: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_20: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_21: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_22: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    PCR_23: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    OtherCmdServer died (Other CMD), socket: 0x7.
    TpmCmdServer died (TPM CMD), rval: 0x00000000, socket: 0x6.



# 3. 関連情報

- OpenBlocks IoT VX1の製品ページ
    - http://openblocks.plathome.co.jp/products/obs_iot/vx1/
- OpenBlocks VX1のマニュアル
    - http://openblocks.plathome.co.jp/products/obs_iot/vx1/pict.html
- TPM2.0 practical usage by Davide Guerri at FOSDEM 2017
    - https://fosdem.org/2017/schedule/event/tpm2/attachments/slides/1517/export/events/attachments/tpm2/slides/1517/FOSDEM___TPM2_0_practical_usage.pdf
- Minnow Board MAXでfTPM2.0をつかえるようにする話
    - https://prosauce.org/blog/2016/1/11/minnowboard-max-enable-and-test-the-firmware-txe-tpm-20