[apple/xnu.git] / bsd / kern / chunklist.h

#ifndef _CHUNKLIST_H
#define _CHUNKLIST_H

#include <libkern/crypto/sha2.h>

/*
 * Boot argument for disabling trust in rev2 development key(s)
 * Set by boot.efi
 */
#define CHUNKLIST_NO_REV2_DEV           "-chunklist-no-rev2-dev"

/*
 * Boot argument for disabling trust in rev1 chunklists
 * Set by boot.efi
 */
#define CHUNKLIST_NO_REV1               "-chunklist-no-rev1"

/*
 * Boot argument for obtaining current security epoch
 * Set by boot.efi
 */
#define CHUNKLIST_SECURITY_EPOCH        "chunklist-security-epoch"
#define CHUNKLIST_MIN_SECURITY_EPOCH    0

/*
 * Chunklist file format
 */
#define CHUNKLIST_MAGIC                 0x4C4B4E43
#define CHUNKLIST_FILE_VERSION_10       1
#define CHUNKLIST_CHUNK_METHOD_10       1
#define CHUNKLIST_SIGNATURE_METHOD_REV1 1
#define CHUNKLIST_SIGNATURE_METHOD_REV2 3
#define CHUNKLIST_REV1_SIG_LEN          256
#define CHUNKLIST_REV2_SIG_LEN          808
#define CHUNKLIST_PUBKEY_LEN            (2048/8)
#define CHUNKLIST_SIGNATURE_LEN         (2048/8)

struct efi_guid_t {
	uint32_t data1;
	uint16_t data2;
	uint16_t data3;
	uint8_t  data4[8];
} __attribute__((packed));

// 45E7BC51-913C-42AC-96A2-10712FFBEBA7
#define CHUNKLIST_REV2_SIG_HASH_GUID \
{ \
    0x45E7BC51, 0x913C, 0x42AC, { 0x96, 0xA2, 0x10, 0x71, 0x2F, 0xFB, 0xEB, 0xA7 } \
};

// A7717414-C616-4977-9420-844712A735BF
#define EFI_CERT_TYPE_RSA2048_SHA256 \
{ \
    0xa7717414, 0xc616, 0x4977, { 0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } \
}

#define WIN_CERT_TYPE_EFI_GUID 0x0EF1

struct chunklist_hdr {
	uint32_t cl_magic;
	uint32_t cl_header_size;
	uint8_t  cl_file_ver;
	uint8_t  cl_chunk_method;
	uint8_t  cl_sig_method;
	uint8_t  __unused1;
	uint64_t cl_chunk_count;
	uint64_t cl_chunk_offset;
	uint64_t cl_sig_offset;
} __attribute__((packed));

struct chunklist_chunk {
	uint32_t chunk_size;
	uint8_t  chunk_sha256[SHA256_DIGEST_LENGTH];
} __attribute__((packed));

struct rev2_chunklist_certificate {
	uint32_t length;
	uint8_t  revision;
	uint8_t  security_epoch;
	uint16_t certificate_type;
	guid_t   certificate_guid;
	guid_t   hash_type_guid;
	uint8_t  rsa_public_key[CHUNKLIST_PUBKEY_LEN];
	uint8_t  rsa_signature[CHUNKLIST_SIGNATURE_LEN];
} __attribute__((packed));

struct chunklist_pubkey {
	const boolean_t is_production;
	const uint8_t key[CHUNKLIST_PUBKEY_LEN];
};

int authenticate_root_with_chunklist(const char *rootdmg_path, boolean_t *out_enforced);
int authenticate_root_version_check(void);
int authenticate_bootkc_uuid(void);
int authenticate_libkern_uuid(void);
#endif /* _CHUNKLIST_H */
Commit	Line	Data
813fb2f6 A	1	#ifndef _CHUNKLIST_H
	2	#define _CHUNKLIST_H
	3
813fb2f6 A	4	#include <libkern/crypto/sha2.h>
813fb2f6 A	5
cb323159 A	6	/*
	7	* Boot argument for disabling trust in rev2 development key(s)
	8	* Set by boot.efi
	9	*/
	10	#define CHUNKLIST_NO_REV2_DEV "-chunklist-no-rev2-dev"
	11
	12	/*
	13	* Boot argument for disabling trust in rev1 chunklists
	14	* Set by boot.efi
	15	*/
	16	#define CHUNKLIST_NO_REV1 "-chunklist-no-rev1"
	17
	18	/*
	19	* Boot argument for obtaining current security epoch
	20	* Set by boot.efi
	21	*/
	22	#define CHUNKLIST_SECURITY_EPOCH "chunklist-security-epoch"
	23	#define CHUNKLIST_MIN_SECURITY_EPOCH 0
	24
813fb2f6 A	25	/*
	26	* Chunklist file format
	27	*/
cb323159 A	28	#define CHUNKLIST_MAGIC 0x4C4B4E43
	29	#define CHUNKLIST_FILE_VERSION_10 1
	30	#define CHUNKLIST_CHUNK_METHOD_10 1
	31	#define CHUNKLIST_SIGNATURE_METHOD_REV1 1
	32	#define CHUNKLIST_SIGNATURE_METHOD_REV2 3
	33	#define CHUNKLIST_REV1_SIG_LEN 256
	34	#define CHUNKLIST_REV2_SIG_LEN 808
	35	#define CHUNKLIST_PUBKEY_LEN (2048/8)
	36	#define CHUNKLIST_SIGNATURE_LEN (2048/8)
	37
	38	struct efi_guid_t {
	39	uint32_t data1;
	40	uint16_t data2;
	41	uint16_t data3;
	42	uint8_t data4[8];
	43	} __attribute__((packed));
813fb2f6	44
cb323159 A	45	// 45E7BC51-913C-42AC-96A2-10712FFBEBA7
	46	#define CHUNKLIST_REV2_SIG_HASH_GUID \
	47	{ \
	48	0x45E7BC51, 0x913C, 0x42AC, { 0x96, 0xA2, 0x10, 0x71, 0x2F, 0xFB, 0xEB, 0xA7 } \
	49	};
	50
	51	// A7717414-C616-4977-9420-844712A735BF
	52	#define EFI_CERT_TYPE_RSA2048_SHA256 \
	53	{ \
	54	0xa7717414, 0xc616, 0x4977, { 0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } \
	55	}
	56
	57	#define WIN_CERT_TYPE_EFI_GUID 0x0EF1
813fb2f6 A	58
	59	struct chunklist_hdr {
	60	uint32_t cl_magic;
	61	uint32_t cl_header_size;
	62	uint8_t cl_file_ver;
	63	uint8_t cl_chunk_method;
	64	uint8_t cl_sig_method;
	65	uint8_t __unused1;
	66	uint64_t cl_chunk_count;
	67	uint64_t cl_chunk_offset;
	68	uint64_t cl_sig_offset;
	69	} __attribute__((packed));
	70
	71	struct chunklist_chunk {
	72	uint32_t chunk_size;
	73	uint8_t chunk_sha256[SHA256_DIGEST_LENGTH];
	74	} __attribute__((packed));
	75
cb323159 A	76	struct rev2_chunklist_certificate {
	77	uint32_t length;
	78	uint8_t revision;
	79	uint8_t security_epoch;
	80	uint16_t certificate_type;
	81	guid_t certificate_guid;
	82	guid_t hash_type_guid;
	83	uint8_t rsa_public_key[CHUNKLIST_PUBKEY_LEN];
	84	uint8_t rsa_signature[CHUNKLIST_SIGNATURE_LEN];
	85	} __attribute__((packed));
813fb2f6 A	86
813fb2f6 A	87	struct chunklist_pubkey {
cb323159	88	const boolean_t is_production;
813fb2f6 A	89	const uint8_t key[CHUNKLIST_PUBKEY_LEN];
	90	};
	91
f427ee49	92	int authenticate_root_with_chunklist(const char rootdmg_path, boolean_t out_enforced);
cb323159	93	int authenticate_root_version_check(void);
f427ee49 A	94	int authenticate_bootkc_uuid(void);
f427ee49 A	95	int authenticate_libkern_uuid(void);
cb323159	96	#endif /* _CHUNKLIST_H */