1 | /* |
2 | * Copyright (c) 2018 Apple Computer, Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _KERN_TRUSTCACHE_H_ |
30 | #define _KERN_TRUSTCACHE_H_ |
31 | |
32 | #include <stdint.h> |
33 | |
34 | #include <kern/cs_blobs.h> |
35 | |
36 | #include <uuid/uuid.h> |
37 | |
38 | /* Version 0 trust caches: No defined sorting order (thus only suitable for small trust caches). |
39 | * Used for loadable trust caches only, until phasing out support. */ |
40 | typedef uint8_t trust_cache_hash0[CS_CDHASH_LEN]; |
41 | struct trust_cache_module0 { |
42 | uint32_t version; |
43 | uuid_t uuid; |
44 | uint32_t num_hashes; |
45 | trust_cache_hash0 hashes[]; |
46 | } __attribute__((__packed__)); |
47 | |
48 | |
49 | /* Version 1 trust caches: Always sorted by cdhash, added hash type and flags field. |
50 | * Suitable for all trust caches. */ |
51 | |
52 | struct trust_cache_entry1 { |
53 | uint8_t cdhash[CS_CDHASH_LEN]; |
54 | uint8_t hash_type; |
55 | uint8_t flags; |
56 | } __attribute__((__packed__)); |
57 | |
58 | struct trust_cache_module1 { |
59 | uint32_t version; |
60 | uuid_t uuid; |
61 | uint32_t num_entries; |
62 | struct trust_cache_entry1 entries[]; |
63 | } __attribute__((__packed__)); |
64 | |
65 | // Trust Cache Entry Flags |
66 | #define CS_TRUST_CACHE_AMFID 0x1 // valid cdhash for amfid |
67 | |
68 | #define TC_LOOKUP_HASH_TYPE_SHIFT 16 |
69 | #define TC_LOOKUP_HASH_TYPE_MASK 0xff0000L; |
70 | #define TC_LOOKUP_FLAGS_SHIFT 8 |
71 | #define TC_LOOKUP_FLAGS_MASK 0xff00L |
72 | #define TC_LOOKUP_RESULT_SHIFT 0 |
73 | #define TC_LOOKUP_RESULT_MASK 0xffL |
74 | |
75 | #define TC_LOOKUP_FOUND 1 |
76 | #define TC_LOOKUP_FALLBACK 2 |
77 | |
78 | #ifdef XNU_KERNEL_PRIVATE |
79 | |
80 | // Serialized Trust Caches |
81 | |
82 | /* This is how iBoot delivers them to us. */ |
83 | struct serialized_trust_caches { |
84 | uint32_t num_caches; |
85 | uint32_t offsets[0]; |
86 | } __attribute__((__packed__)); |
87 | |
88 | |
89 | // Legacy Static Trust Cache |
90 | |
91 | /* This is the old legacy trust cache baked into the AMFI kext. |
92 | * We support it for a transitionary period, until external trust caches |
93 | * are fully established, and the AMFI trust cache can be removed. */ |
94 | |
95 | struct legacy_trust_cache_bucket { |
96 | uint16_t count; |
97 | uint16_t offset; |
98 | } __attribute__((__packed__)); |
99 | |
100 | #define LEGACY_TRUST_CACHE_ENTRY_LEN (CS_CDHASH_LEN-1) |
101 | #define LEGACY_TRUST_CACHE_BUCKET_COUNT (256) |
102 | |
103 | typedef uint8_t pmap_cs_legacy_stc_entry[CS_CDHASH_LEN-1]; // bucketized with first byte |
104 | |
105 | void trust_cache_init(void); |
106 | |
107 | uint32_t lookup_in_static_trust_cache(const uint8_t cdhash[CS_CDHASH_LEN]); |
108 | |
109 | bool lookup_in_trust_cache_module(struct trust_cache_module1 const * const module, |
110 | uint8_t const cdhash[CS_CDHASH_LEN], |
111 | uint8_t * const hash_type, |
112 | uint8_t * const flags); |
113 | |
114 | #endif |
115 | |
116 | #endif /* _KERN_TRUSTCACHE_H */ |
117 | |