#include <Uefi.h>
#include <Guid/AppleVariable.h>
#include <Protocol/AppleImg4Verification.h>
#include <Library/BaseLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/DebugLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/OcAppleKeysLib.h>
#include <Library/OcCryptoLib.h>
#include <Library/OcAppleImg4Lib.h>
#include <Library/OcMiscLib.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiRuntimeServicesTableLib.h>
#include "libDER/oids.h"
#include "libDERImg4/libDERImg4.h"
#include "libDERImg4/Img4oids.h"

Data Structures
struct	OC_SB_MODEL_DESC_

Typedefs
typedef struct OC_SB_MODEL_DESC_	OC_SB_MODEL_DESC

Functions
STATIC OC_SB_MODEL_DESC *	InternalGetModelInfo (IN CONST CHAR8 *Model)

bool	DERImg4VerifySignature (DERByte Modulus, DERSize ModulusSize, uint32_t Exponent, const uint8_t Signature, size_t SignatureSize, uint8_t Data, size_t DataSize, const DERItem AlgoOid)

CONST CHAR8 *	OcAppleImg4GetHardwareModel (IN CONST CHAR8 *ModelRequest)

EFI_STATUS EFIAPI	OcAppleImg4Verify (IN APPLE_IMG4_VERIFICATION_PROTOCOL This, IN UINT32 ObjType, IN CONST VOID ImageBuffer, IN UINTN ImageSize, IN UINT8 SbMode, IN CONST VOID ManifestBuffer, IN UINTN ManifestSize, OUT UINT8 HashDigest OPTIONAL, OUT UINTN DigestSize OPTIONAL)

VOID	OcAppleImg4RegisterOverride (IN CONST UINT8 OriginalDigest, IN CONST UINT8 Image, IN UINT32 ImageSize)

EFI_STATUS	OcAppleImg4BootstrapValues (IN CONST CHAR8 *Model, IN UINT64 Ecid OPTIONAL)

APPLE_IMG4_VERIFICATION_PROTOCOL *	OcAppleImg4VerificationInstallProtocol (IN BOOLEAN Reinstall)

Variables
GLOBAL_REMOVE_IF_UNREFERENCED const UINT8 *	DERImg4RootCertificate = gAppleX86SecureBootRootCaCert

GLOBAL_REMOVE_IF_UNREFERENCED const UINTN *	DERImg4RootCertificateSize = &gAppleX86SecureBootRootCaCertSize

STATIC CHAR8	mCryptoDigestMethod [16] = "sha2-384"

STATIC DERImg4Environment	mEnvInfo

STATIC OC_SB_MODEL_DESC	mModelInformation []

STATIC BOOLEAN	mHasDigestOverride

STATIC UINT8	mOriginalDigest [SHA384_DIGEST_SIZE]

STATIC UINT8	mOverrideDigest [SHA384_DIGEST_SIZE]

Detailed Description

This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at http://opensource.org/licenses/bsd-license.php

THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

Definition in file OcAppleImg4Lib.c.

Typedef Documentation

◆ OC_SB_MODEL_DESC

typedef struct OC_SB_MODEL_DESC_ OC_SB_MODEL_DESC

Function Documentation

◆ DERImg4VerifySignature()

bool DERImg4VerifySignature	(	DERByte *	Modulus,
		DERSize	ModulusSize,
		uint32_t	Exponent,
		const uint8_t *	Signature,
		size_t	SignatureSize,
		uint8_t *	Data,
		size_t	DataSize,
		const DERItem *	AlgoOid )

Definition at line 112 of file OcAppleImg4Lib.c.

◆ InternalGetModelInfo()

STATIC OC_SB_MODEL_DESC * InternalGetModelInfo ( IN CONST CHAR8 * Model )

Definition at line 75 of file OcAppleImg4Lib.c.

◆ OcAppleImg4BootstrapValues()

EFI_STATUS OcAppleImg4BootstrapValues	(	IN CONST CHAR8 *	Model,
		IN UINT64 Ecid	OPTIONAL )

Bootstrap NVRAM and library values for secure booting.

Parameters

[in]	Model	Secure boot model (without ap suffix in lower-case).
[in]	Ecid	Secure boot ECID identifier for this model, optional.

Returns: Installed or located protocol.

Return values

NULL	There was an error locating or installing the protocol.

< Checked by calling OcAppleImg4GetHardwareModel.

Definition at line 341 of file OcAppleImg4Lib.c.

◆ OcAppleImg4GetHardwareModel()

CONST CHAR8 * OcAppleImg4GetHardwareModel ( IN CONST CHAR8 * ModelRequest )

Obtain hardware model for secure booting from the model request.

Parameters

[in] ModelRequest Raw model.

Return values

Model	in lower case on success.
NULL	on failure

Definition at line 156 of file OcAppleImg4Lib.c.

◆ OcAppleImg4RegisterOverride()

VOID OcAppleImg4RegisterOverride	(	IN CONST UINT8 *	OriginalDigest,
		IN CONST UINT8 *	Image,
		IN UINT32	ImageSize )

Register digest override with SHA-384 hash. This allows to replace one image with another.

Parameters

[in]	OriginalDigest	Original SHA-384 digest.
[in]	Image	Pointer to new image.
[in]	ImageSize	Image size.

Definition at line 325 of file OcAppleImg4Lib.c.

◆ OcAppleImg4VerificationInstallProtocol()

APPLE_IMG4_VERIFICATION_PROTOCOL * OcAppleImg4VerificationInstallProtocol ( IN BOOLEAN Reinstall )

Install and initialise the Apple IMG4 verification protocol.

Parameters

[in] Reinstall Replace any installed protocol.

Returns: Installed or located protocol.

Return values

NULL	There was an error locating or installing the protocol.

Definition at line 511 of file OcAppleImg4Lib.c.

◆ OcAppleImg4Verify()

EFI_STATUS EFIAPI OcAppleImg4Verify	(	IN APPLE_IMG4_VERIFICATION_PROTOCOL *	This,
		IN UINT32	ObjType,
		IN CONST VOID *	ImageBuffer,
		IN UINTN	ImageSize,
		IN UINT8	SbMode,
		IN CONST VOID *	ManifestBuffer,
		IN UINTN	ManifestSize,
		OUT UINT8 **HashDigest	OPTIONAL,
		OUT UINTN *DigestSize	OPTIONAL )

Verify the signature of ImageBuffer against Type of its IMG4 Manifest.

Parameters

[in]	This	The pointer to the current protocol instance.
[in]	ObjType	The IMG4 object type to validate against.
[in]	ImageBuffer	The buffer to validate.
[in]	ImageSize	The size, in bytes, of ImageBuffer.
[in]	SbMode	The requested IMG4 Secure Boot mode.
[in]	ManifestBuffer	The buffer of the IMG4 Manifest.
[in]	ManifestSize	The size, in bytes, of ManifestBuffer.
[out]	HashDigest	On output, a pointer to ImageBuffer's digest.
[out]	DigestSize	On output, the size, in bytes, of *HashDigest.

Return values

EFI_SUCCESS	ImageBuffer is correctly signed.
EFI_INVALID_PARAMETER	One or more required parameters are NULL.
EFI_OUT_OF_RESOURCES	Not enough resources are available.
EFI_SECURITY_VIOLATION	ImageBuffer's signature is invalid.

Definition at line 172 of file OcAppleImg4Lib.c.

Variable Documentation

◆ DERImg4RootCertificate

GLOBAL_REMOVE_IF_UNREFERENCED const UINT8* DERImg4RootCertificate = gAppleX86SecureBootRootCaCert

Definition at line 35 of file OcAppleImg4Lib.c.

◆ DERImg4RootCertificateSize

GLOBAL_REMOVE_IF_UNREFERENCED const UINTN* DERImg4RootCertificateSize = &gAppleX86SecureBootRootCaCertSize

Definition at line 36 of file OcAppleImg4Lib.c.

◆ mCryptoDigestMethod

STATIC CHAR8 mCryptoDigestMethod[16] = "sha2-384"

Definition at line 43 of file OcAppleImg4Lib.c.

◆ mEnvInfo

STATIC DERImg4Environment mEnvInfo

Definition at line 44 of file OcAppleImg4Lib.c.

◆ mHasDigestOverride

STATIC BOOLEAN mHasDigestOverride

Definition at line 69 of file OcAppleImg4Lib.c.

◆ mModelInformation

STATIC OC_SB_MODEL_DESC mModelInformation[]

Initial value:

= {
  { "j132",             0x0C }, 
  { "j137",             0x0A }, 
  { "j140a",            0x37 }, 
  { "j140k",            0x17 }, 
  { "j152f",            0x3A }, 
  { "j160",             0x0F }, 
  { "j174",             0x0E }, 
  { "j185",             0x22 }, 
  { "j185f",            0x23 }, 
  { "j213",             0x18 }, 
  { "j214k",            0x3E }, 
  { "j215",             0x38 }, 
  { "j223",             0x3B }, 
  { "j230k",            0x3F }, 
  { "j680",             0x0B }, 
  { "j780",             0x07 }, 
  { OC_SB_MODEL_LEGACY, 0xF0 }, 
}

List of model mapping to board identifiers. Alphabetically sorted (!), for release order refer to the documentation.

Definition at line 49 of file OcAppleImg4Lib.c.

◆ mOriginalDigest

STATIC UINT8 mOriginalDigest[SHA384_DIGEST_SIZE]

Definition at line 70 of file OcAppleImg4Lib.c.

◆ mOverrideDigest

STATIC UINT8 mOverrideDigest[SHA384_DIGEST_SIZE]

Definition at line 71 of file OcAppleImg4Lib.c.

Data Structures

Typedefs

Functions

Variables

Detailed Description

Typedef Documentation

◆ OC_SB_MODEL_DESC

Function Documentation

◆ DERImg4VerifySignature()

◆ InternalGetModelInfo()

◆ OcAppleImg4BootstrapValues()

◆ OcAppleImg4GetHardwareModel()

◆ OcAppleImg4RegisterOverride()

◆ OcAppleImg4VerificationInstallProtocol()

◆ OcAppleImg4Verify()

Variable Documentation

◆ DERImg4RootCertificate

◆ DERImg4RootCertificateSize

◆ mCryptoDigestMethod

◆ mEnvInfo

◆ mHasDigestOverride

◆ mModelInformation

◆ mOriginalDigest

◆ mOverrideDigest