1  #ifndef _CHUNKLIST_H
 2  #define _CHUNKLIST_H
 3  
 4  #include <libkern/crypto/sha2.h>
 5  
 6  /*
 7   * Boot argument for disabling trust in rev2 development key(s)
 8   * Set by boot.efi
 9   */
10  #define CHUNKLIST_NO_REV2_DEV           "-chunklist-no-rev2-dev"
11  
12  /*
13   * Boot argument for disabling trust in rev1 chunklists
14   * Set by boot.efi
15   */
16  #define CHUNKLIST_NO_REV1               "-chunklist-no-rev1"
17  
18  /*
19   * Boot argument for obtaining current security epoch
20   * Set by boot.efi
21   */
22  #define CHUNKLIST_SECURITY_EPOCH        "chunklist-security-epoch"
23  #define CHUNKLIST_MIN_SECURITY_EPOCH    0
24  
25  /*
26   * Chunklist file format
27   */
28  #define CHUNKLIST_MAGIC                 0x4C4B4E43
29  #define CHUNKLIST_FILE_VERSION_10       1
30  #define CHUNKLIST_CHUNK_METHOD_10       1
31  #define CHUNKLIST_SIGNATURE_METHOD_REV1 1
32  #define CHUNKLIST_SIGNATURE_METHOD_REV2 3
33  #define CHUNKLIST_REV1_SIG_LEN          256
34  #define CHUNKLIST_REV2_SIG_LEN          808
35  #define CHUNKLIST_PUBKEY_LEN            (2048/8)
36  #define CHUNKLIST_SIGNATURE_LEN         (2048/8)
37  
38  struct efi_guid_t {
39  	uint32_t data1;
40  	uint16_t data2;
41  	uint16_t data3;
42  	uint8_t  data4[8];
43  } __attribute__((packed));
44  
45  // 45E7BC51-913C-42AC-96A2-10712FFBEBA7
46  #define CHUNKLIST_REV2_SIG_HASH_GUID \
47  { \
48      0x45E7BC51, 0x913C, 0x42AC, { 0x96, 0xA2, 0x10, 0x71, 0x2F, 0xFB, 0xEB, 0xA7 } \
49  };
50  
51  // A7717414-C616-4977-9420-844712A735BF
52  #define EFI_CERT_TYPE_RSA2048_SHA256 \
53  { \
54      0xa7717414, 0xc616, 0x4977, { 0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } \
55  }
56  
57  #define WIN_CERT_TYPE_EFI_GUID 0x0EF1
58  
59  struct chunklist_hdr {
60  	uint32_t cl_magic;
61  	uint32_t cl_header_size;
62  	uint8_t  cl_file_ver;
63  	uint8_t  cl_chunk_method;
64  	uint8_t  cl_sig_method;
65  	uint8_t  __unused1;
66  	uint64_t cl_chunk_count;
67  	uint64_t cl_chunk_offset;
68  	uint64_t cl_sig_offset;
69  } __attribute__((packed));
70  
71  struct chunklist_chunk {
72  	uint32_t chunk_size;
73  	uint8_t  chunk_sha256[SHA256_DIGEST_LENGTH];
74  } __attribute__((packed));
75  
76  struct rev2_chunklist_certificate {
77  	uint32_t length;
78  	uint8_t  revision;
79  	uint8_t  security_epoch;
80  	uint16_t certificate_type;
81  	guid_t   certificate_guid;
82  	guid_t   hash_type_guid;
83  	uint8_t  rsa_public_key[CHUNKLIST_PUBKEY_LEN];
84  	uint8_t  rsa_signature[CHUNKLIST_SIGNATURE_LEN];
85  } __attribute__((packed));
86  
87  struct chunklist_pubkey {
88  	const boolean_t is_production;
89  	const uint8_t key[CHUNKLIST_PUBKEY_LEN];
90  };
91  
92  int authenticate_root_with_chunklist(const char *rootdmg_path, boolean_t *out_enforced);
93  int authenticate_root_version_check(void);
94  int authenticate_bootkc_uuid(void);
95  int authenticate_libkern_uuid(void);
96  #endif /* _CHUNKLIST_H */