1/*
2 * Copyright (c) 2018 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#ifndef _KERN_TRUSTCACHE_H_
30#define _KERN_TRUSTCACHE_H_
31
32#include <stdint.h>
33
34#include <kern/cs_blobs.h>
35
36#include <uuid/uuid.h>
37
38/* Version 0 trust caches: No defined sorting order (thus only suitable for small trust caches).
39 * Used for loadable trust caches only, until phasing out support. */
40typedef uint8_t trust_cache_hash0[CS_CDHASH_LEN];
41struct trust_cache_module0 {
42 uint32_t version;
43 uuid_t uuid;
44 uint32_t num_hashes;
45 trust_cache_hash0 hashes[];
46} __attribute__((__packed__));
47
48
49/* Version 1 trust caches: Always sorted by cdhash, added hash type and flags field.
50 * Suitable for all trust caches. */
51
52struct trust_cache_entry1 {
53 uint8_t cdhash[CS_CDHASH_LEN];
54 uint8_t hash_type;
55 uint8_t flags;
56} __attribute__((__packed__));
57
58struct trust_cache_module1 {
59 uint32_t version;
60 uuid_t uuid;
61 uint32_t num_entries;
62 struct trust_cache_entry1 entries[];
63} __attribute__((__packed__));
64
65// Trust Cache Entry Flags
66#define CS_TRUST_CACHE_AMFID 0x1 // valid cdhash for amfid
67
68#define TC_LOOKUP_HASH_TYPE_SHIFT 16
69#define TC_LOOKUP_HASH_TYPE_MASK 0xff0000L;
70#define TC_LOOKUP_FLAGS_SHIFT 8
71#define TC_LOOKUP_FLAGS_MASK 0xff00L
72#define TC_LOOKUP_RESULT_SHIFT 0
73#define TC_LOOKUP_RESULT_MASK 0xffL
74
75#define TC_LOOKUP_FOUND 1
76#define TC_LOOKUP_FALLBACK 2
77
78#ifdef XNU_KERNEL_PRIVATE
79
80// Serialized Trust Caches
81
82/* This is how iBoot delivers them to us. */
83struct serialized_trust_caches {
84 uint32_t num_caches;
85 uint32_t offsets[0];
86} __attribute__((__packed__));
87
88
89// Legacy Static Trust Cache
90
91/* This is the old legacy trust cache baked into the AMFI kext.
92 * We support it for a transitionary period, until external trust caches
93 * are fully established, and the AMFI trust cache can be removed. */
94
95struct legacy_trust_cache_bucket {
96 uint16_t count;
97 uint16_t offset;
98} __attribute__((__packed__));
99
100#define LEGACY_TRUST_CACHE_ENTRY_LEN (CS_CDHASH_LEN-1)
101#define LEGACY_TRUST_CACHE_BUCKET_COUNT (256)
102
103typedef uint8_t pmap_cs_legacy_stc_entry[CS_CDHASH_LEN-1]; // bucketized with first byte
104
105void trust_cache_init(void);
106
107uint32_t lookup_in_static_trust_cache(const uint8_t cdhash[CS_CDHASH_LEN]);
108
109bool lookup_in_trust_cache_module(struct trust_cache_module1 const * const module,
110 uint8_t const cdhash[CS_CDHASH_LEN],
111 uint8_t * const hash_type,
112 uint8_t * const flags);
113
114#endif
115
116#endif /* _KERN_TRUSTCACHE_H */
117