<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hello Kevin,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Understood.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="NL" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Best Regards,</span><span lang="NL" style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Wim Vervoorn<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Eltan B.V.</span><span lang="NL" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Ambachtstraat 23<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">5481 SM Schijndel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">The Netherlands<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">T : +31-(0)73-594 46 64</span><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">E : wvervoorn@eltan.com</span><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">W : http://www.eltan.com<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">"THIS MESSAGE CONTAINS CONFIDENTIAL INFORMATION. UNLESS YOU ARE THE INTENDED RECIPIENT OF THIS MESSAGE,
ANY USE OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS MESSAGE IN ERROR, PLEASE IMMEDIATELY NOTIFY THE SENDER BY TELEPHONE +31-(0)73-5944664 OR REPLY EMAIL, AND IMMEDIATELY DELETE THIS MESSAGE AND ALL COPIES." </span><span style="font-size:11.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Stefan Berger [mailto:stefanb@us.ibm.com]
<br>
<b>Sent:</b> Tuesday, December 22, 2015 3:30 PM<br>
<b>To:</b> Wim Vervoorn <wvervoorn@eltan.com><br>
<b>Cc:</b> Kevin O'Connor <kevin@koconnor.net>; seabios@seabios.org<br>
<b>Subject:</b> RE: [SeaBIOS] SeaBIOS Digest, Vol 72, Issue 33<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt">Wim Vervoorn <<a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a>> wrote on 12/22/2015 09:15:55 AM:</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<br>
<tt>> </tt><br>
<tt>> Hello Stefan,</tt></span><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> I think it will work perfectly for the higher level functions like :
</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> tpm_smbios_measure(void) etc. Here you can easily implement tpm 1.2 </tt><br>
<tt>> and 2.0 handling. For the functions like tpm_add_measurement_to_log() </tt>
<br>
<tt>> I don’t think it is that easy or useful. For those it’s probably </tt><br>
<tt>> better to have a tpm 1.2 and a tpm 2.0 variant each with their own </tt><br>
<tt>> API but not with a wrapper.</tt></span><br>
<br>
<tt><span style="font-size:10.0pt">If TPM 2 is not operated in sha1 mode, then we may need different *internal* functions, yes (tpm2_bar()).</span></tt><br>
<tt><span style="font-size:10.0pt">Otherwise it's mostly byte streams being passed into the TPM parts to which sha1 is applied if needed; the</span></tt><br>
<tt><span style="font-size:10.0pt">exception is the BIOS API which seems to return SHA1 hashes in some structures.</span></tt><br>
<br>
<tt><span style="font-size:10.0pt">For the BIOS API functions where applications expect structures with embedded sha1 hashes, we will</span></tt><br>
<tt><span style="font-size:10.0pt">need to restrict those APIs to sha1 mode, return failure otherwise. If the standard defines structures (for BIOS)</span></tt><br>
<tt><span style="font-size:10.0pt">for sha256 etc., and possibly new API functions, then we can implement those for TPM 2 and they would result</span></tt><br>
<tt><span style="font-size:10.0pt">in an error if invoked by TPM 1.2 (which only supports sha1).</span></tt><br>
<br>
<br>
<tt><span style="font-size:10.0pt"> Stefan</span></tt><br>
<br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> Please note I did not look into all details so I might be seeing
</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> problems that aren’t there (or can be solved easily).</tt></span><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> Best Regards,</span></tt><br>
<tt><span style="font-size:10.0pt">> Wim Vervoorn</span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> Eltan B.V.</span></tt><br>
<tt><span style="font-size:10.0pt">> Ambachtstraat 23</span></tt><br>
<tt><span style="font-size:10.0pt">> 5481 SM Schijndel</span></tt><br>
<tt><span style="font-size:10.0pt">> The Netherlands</span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> T : +31-(0)73-594 46 64</span></tt><br>
<tt><span style="font-size:10.0pt">> E : <a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a></span></tt><br>
<tt><span style="font-size:10.0pt">> W : </span></tt><a href="http://www.eltan.com/"><tt><span style="font-size:10.0pt">http://www.eltan.com</span></tt></a><br>
<tt><span style="font-size:10.0pt">> "THIS MESSAGE CONTAINS CONFIDENTIAL INFORMATION. UNLESS YOU ARE THE
</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> INTENDED RECIPIENT OF THIS MESSAGE, ANY USE OF THIS MESSAGE IS </tt><br>
<tt>> STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS MESSAGE IN ERROR, </tt><br>
<tt>> PLEASE IMMEDIATELY NOTIFY THE SENDER BY TELEPHONE +31-(0)73-5944664 </tt><br>
<tt>> OR REPLY EMAIL, AND IMMEDIATELY DELETE THIS MESSAGE AND ALL COPIES." </tt></span><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> From: Stefan Berger [</span></tt><a href="mailto:stefanb@us.ibm.com"><tt><span style="font-size:10.0pt">mailto:stefanb@us.ibm.com</span></tt></a><tt><span style="font-size:10.0pt">]
</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> Sent: Tuesday, December 22, 2015 2:56 PM</tt><br>
<tt>> To: Wim Vervoorn <<a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a>></tt><br>
<tt>> Cc: Kevin O'Connor <<a href="mailto:kevin@koconnor.net">kevin@koconnor.net</a>>;
<a href="mailto:seabios@seabios.org">seabios@seabios.org</a></tt><br>
<tt>> Subject: RE: [SeaBIOS] SeaBIOS Digest, Vol 72, Issue 33</tt></span><br>
<tt><span style="font-size:10.0pt">> </span></tt><br>
<tt><span style="font-size:10.0pt">> Wim Vervoorn <<a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a>> wrote on 12/22/2015 08:43:54 AM:</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> </tt><br>
<tt>> > </tt><br>
<tt>> > Hello Stefan,</tt><br>
<tt>> > </tt><br>
<tt>> > I have my doubts. This will work fine as long as the toplevel </tt><br>
<tt>> > function tpm_foo() in your example can be implemented to have a </tt><br>
<tt>> > single API independent of the required support. If the API differs </tt><br>
<tt>> > between the tpm 1.2 and tpm 2.0 case I think it will only be </tt><br>
<tt>> confusing things.</tt><br>
<tt>> > </tt><br>
<tt>> > Given the differences between tpm 1.2 and 2.0 do you think you will </tt>
<br>
<tt>> > be able to maintain this single API?</tt><br>
<tt>> </tt><br>
<tt>> The top level function tpm_foo() will be called by other SeaBIOS </tt><br>
<tt>> code for doing TPM initialization, </tt><br>
<tt>> measurements, the menu, S3 resume, and for the BIOS API. For the API</tt><br>
<tt>> we would support the same API</tt><br>
<tt>> for TPM 1.2 and for TPM 2. The difference between the tpm12_foo and </tt><br>
<tt>> tpm2_foo functions are mainly</tt><br>
<tt>> that different TPM commands are created and sent to the TIS. So far,</tt><br>
<tt>> this works fine.</tt><br>
<tt>> </tt><br>
<tt>> Do you have concrete concerns regarding this? How else would you do it ?</tt><br>
<tt>> </tt><br>
<tt>> Regards,</tt><br>
<tt>> Stefan</tt><br>
<tt>> </tt><br>
<tt>> > </tt><br>
<tt>> > </tt><br>
<tt>> > Best Regards,</tt><br>
<tt>> > Wim Vervoorn</tt><br>
<tt>> > </tt><br>
<tt>> > Eltan B.V.</tt><br>
<tt>> > Ambachtstraat 23</tt><br>
<tt>> > 5481 SM Schijndel</tt><br>
<tt>> > The Netherlands</tt><br>
<tt>> > </tt><br>
<tt>> > T : +31-(0)73-594 46 64</tt><br>
<tt>> > E : <a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a></tt><br>
<tt>> > W : </tt></span><a href="http://www.eltan.com/"><tt><span style="font-size:10.0pt">http://www.eltan.com</span></tt></a><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> > "THIS MESSAGE CONTAINS CONFIDENTIAL INFORMATION. UNLESS YOU ARE THE </tt>
<br>
<tt>> > INTENDED RECIPIENT OF THIS MESSAGE, ANY USE OF THIS MESSAGE IS </tt><br>
<tt>> > STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS MESSAGE IN ERROR, </tt><br>
<tt>> > PLEASE IMMEDIATELY NOTIFY THE SENDER BY TELEPHONE +31-(0)73-5944664 </tt>
<br>
<tt>> > OR REPLY EMAIL, AND IMMEDIATELY DELETE THIS MESSAGE AND ALL COPIES." </tt>
<br>
<tt>> > </tt><br>
<tt>> > </tt><br>
<tt>> > </tt><br>
<tt>> > </tt><br>
<tt>> > From: Stefan Berger [</tt></span><a href="mailto:stefanb@us.ibm.com"><tt><span style="font-size:10.0pt">mailto:stefanb@us.ibm.com</span></tt></a><tt><span style="font-size:10.0pt">]
</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>> > Sent: Monday, December 21, 2015 5:50 PM</tt><br>
<tt>> > To: Kevin O'Connor <<a href="mailto:kevin@koconnor.net">kevin@koconnor.net</a>></tt><br>
<tt>> > Cc: <a href="mailto:seabios@seabios.org">seabios@seabios.org</a>; Wim Vervoorn <<a href="mailto:wvervoorn@eltan.com">wvervoorn@eltan.com</a>></tt><br>
<tt>> > Subject: Re: [SeaBIOS] SeaBIOS Digest, Vol 72, Issue 33</tt><br>
<tt>> > </tt><br>
<tt>> > "Kevin O'Connor" <<a href="mailto:kevin@koconnor.net">kevin@koconnor.net</a>> wrote on 12/17/2015 05:22:56 PM:</tt><br>
<tt>> > </tt><br>
<tt>> > > </tt><br>
<tt>> > > On Mon, Nov 30, 2015 at 11:32:05AM +0000, Wim Vervoorn wrote:</tt><br>
<tt>> > > > Hello,</tt><br>
<tt>> > > > </tt><br>
<tt>> > > > I noticed that a lot of work is going on for the TPM support in SeaBIOS.</tt><br>
<tt>> > > > </tt><br>
<tt>> > > > All of this work is TPM 1.2 based. I was wondering if there are any</tt><br>
<tt>> > > > plans to support TPM 2.0 in the future.</tt><br>
<tt>> > > </tt><br>
<tt>> > > I'm not aware of any plans.</tt><br>
<tt>> > </tt><br>
<tt>> > We're working on it...</tt><br>
<tt>> > </tt><br>
<tt>> > </tt><br>
<tt>> > So maybe you have some comments to the following:</tt><br>
<tt>> > </tt><br>
<tt>> > There will be a patch for probing the TPM TIS hardware interface for</tt><br>
<tt>> > whether there's a TPM 1.2 or a TPM 2.</tt><br>
<tt>> > We then have a patch for prefixing all TPM 1.2 functions with tpm12_</tt><br>
<tt>> > and then introduce functions like these ones here:</tt><br>
<tt>> > </tt><br>
<tt>> > static ... tpm12_foo() { ... }</tt><br>
<tt>> > static ... tpm2_foo() { ... }</tt><br>
<tt>> > </tt><br>
<tt>> > tpm_foo()</tt><br>
<tt>> > {</tt><br>
<tt>> > [...]</tt><br>
<tt>> > </tt><br>
<tt>> > switch (tpmversion) {</tt><br>
<tt>> > case TPM_VERSION_1_2:</tt><br>
<tt>> > tpm12_foo()</tt><br>
<tt>> > break;</tt><br>
<tt>> > case TPM_VERSION_2:</tt><br>
<tt>> > tpm2_foo();</tt><br>
<tt>> > break;</tt><br>
<tt>> > }</tt><br>
<tt>> > </tt><br>
<tt>> > [...]</tt><br>
<tt>> > }</tt><br>
<tt>> > </tt><br>
<tt>> > That way the probing will lead us to use either TPM1.2 or TPM 2 </tt><br>
<tt>> > specific code. There will be multiple such constructs in tcgbios.c file.</tt><br>
<tt>> > </tt><br>
<tt>> > Stefan</tt></span><o:p></o:p></p>
</div>
</body>
</html>