code wiki / _hdl_build / nx_efivars_enrol.nx
`nx_efivars_enrol.nx` source

↩ module page · 460 lines · 21474 B
1// nx_efivars_enrol.nx -- F103e RUNG 11b: enrol OUR key into a UEFI variable store.
2//
3// The last software rung. Builds an EFI_SIGNATURE_LIST around our self-signed cert and writes PK,
4// KEK and db into a varstore derived from the EMPTY (setup-mode) OVMF varstore. Booting secboot
5// firmware against it should put the machine in USER MODE with OUR key as the authority -- so the
6// decisive test is a PAIR: our SIGNED image accepted, an UNSIGNED image refused. Either alone proves
7// nothing (a varstore that failed to load would accept both; a broken one would refuse both).
8//
9// ★★★★★★EVERY CONSTANT IS TAKEN FROM THE ARTIFACT, NOT FROM MEMORY. `OVMF_VARS_4M.ms.fd` has PK/KEK/db
10//  already enrolled, so the vendor GUIDs, the attribute word, and even EFI_CERT_X509_GUID (which is
11//  literally the first 16 bytes of the real `db` data) are READ OUT OF IT. Writing a UEFI GUID from
12//  recall is a fabricated constant, and a wrong one here fails in a way that looks like "Secure Boot
13//  just doesn't like us".
14//
15// EFI_SIGNATURE_LIST: SignatureType[16] | SignatureListSize[4] | SignatureHeaderSize[4] |
16//                     SignatureSize[4] | (header) | { SignatureOwner[16] | SignatureData[] }...
17//
18// Usage: nx_efivars_enrol build <empty_vars.fd> <ms_vars.fd> <out_vars.fd>
19//        nx_efivars_enrol selftest <empty_vars.fd> <ms_vars.fd>
20// Exit:  0 GREEN | 1 RED | 3 UNPROVEN.
21// license_tier: ORIGINAL
22import "nx_syscalls.nx"
23import "nx_sha256.nx"
24import "nx_u2048.nx"
25import "nx_u2048_mul.nx"
26import "nx_rsa2048_mod.nx"
27import "nx_rsa2048_mod_exp.nx"
28import "nx_rsa2048_mont.nx"
29import "nx_rsa2048_mod_exp_big.nx"
30import "nx_asn1.nx"
31import "nx_x509.nx"
32import "nx_rsa_pkcs1_v1_5_sha256.nx"
33import "nx_u2048_millerrabin.nx"
34import "nx_u2048_smallops.nx"
35import "nx_rsa_keygen.nx"
36import "nx_rsa_pkcs1_sign.nx"
37import "nx_x509_emit.nx"
38import "nx_efivarstore.nx"
39import "nx_pe_authhash.nx"
40const EN_MAGIC_4096: i64 = 4096
41const EN_MAGIC_20260808: i64 = 20260808
42const EN_MAGIC_1024: i64 = 1024
43const EN_MAGIC_8192: i64 = 8192
44const EN_MAGIC_65537: i64 = 65537
45const EN_MAGIC_4097: i64 = 4097
46const EN_MAGIC_16384: i64 = 16384
47
48const EN_ATTRS: i64 = 39             // MEASURED from the MS varstore: NV|BS|RT|TIME_BASED_AUTH_WRITE
49
50func en_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
51func en_fp(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
52func en_fn(fd: i64, v: i64) -> i64 {
  let bb: *u8 = sys_mmap(28); var m: i64 = v
  if m < 0 { m = 0 - m; bb[0] = 45 as u8; sys_write(fd, bb, 1) }
  let t: *u8 = sys_mmap(28); var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(fd, bb, k); return 0
61}
62func en_eq_str(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
67}
68func en_w32(b: *u8, o: i64, v: i64) -> i64 {
  b[o] = (v & 0xff) as u8; b[o+1] = ((v >> 8) & 0xff) as u8
  b[o+2] = ((v >> 16) & 0xff) as u8; b[o+3] = ((v >> 24) & 0xff) as u8
  return 0
72}
73
74// Build an EFI_SIGNATURE_LIST holding one X.509 cert. `x509guid` is the 16-byte SignatureType read
75// out of the real MS db. Returns total length.
76func en_siglist(out: *u8, x509guid: *u8, cert: *u8, certlen: i64) -> i64 {
  var i: i64 = 0
  while i < 16 { out[i] = x509guid[i]; i = i + 1 }
  let sigsize: i64 = 16 + certlen                    // SignatureOwner + the DER
  let total: i64 = 28 + sigsize
  en_w32(out, 16, total)                             // SignatureListSize
  en_w32(out, 20, 0)                                 // SignatureHeaderSize
  en_w32(out, 24, sigsize)                           // SignatureSize
  var j: i64 = 0
  while j < 16 { out[28 + j] = 0 as u8; j = j + 1 }   // SignatureOwner: all-zero is valid
  var k: i64 = 0
  while k < certlen { out[44 + k] = cert[k]; k = k + 1 }
  return total
89}
90
91// Append one AUTHENTICATED_VARIABLE_HEADER + name + data at `off`. Returns the next offset.
92// Layout MEASURED from the MS varstore by nx_efivarstore.
93func en_put_var(b: *u8, off: i64, name: *u8, guid: *u8, data: *u8, dlen: i64) -> i64 {
  var nl: i64 = 0
  while name[nl] != (0 as u8) { nl = nl + 1 }
  let namesize: i64 = nl * 2 + 2                     // UCS-2 including the null terminator
  b[off]     = 0xAA as u8                            // StartId 0x55AA, little-endian
  b[off + 1] = 0x55 as u8
  b[off + 2] = 0x3F as u8                            // State = VAR_ADDED
  b[off + 3] = 0x00 as u8
  en_w32(b, off + 4, EN_ATTRS)
  var z: i64 = 0
  while z < 8 { b[off + 8 + z] = 0 as u8; z = z + 1 }        // MonotonicCount
  while z < 24 { b[off + 8 + z] = 0 as u8; z = z + 1 }       // TimeStamp (EFI_TIME, 16 B)
  en_w32(b, off + 32, 0)                                      // PubKeyIndex
  en_w32(b, off + 36, namesize)
  en_w32(b, off + 40, dlen)
  var g: i64 = 0
  while g < 16 { b[off + 44 + g] = guid[g]; g = g + 1 }
  var i: i64 = 0
  while i < nl {
      b[off + 60 + i * 2]     = name[i]
      b[off + 60 + i * 2 + 1] = 0 as u8
      i = i + 1
  }
  b[off + 60 + nl * 2]     = 0 as u8
  b[off + 60 + nl * 2 + 1] = 0 as u8
  let dataoff: i64 = off + 60 + namesize
  var d: i64 = 0
  while d < dlen { b[dataoff + d] = data[d]; d = d + 1 }
  var adv: i64 = 60 + namesize + dlen
  while (adv % 4) != 0 { adv = adv + 1 }             // 4-byte alignment, as the walker assumes
  return off + adv
124}
125
126// pull the 16-byte SignatureType GUID out of the real MS `db` variable's data
127func en_x509guid_from_ms(ms: *u8, mslen: i64, out16: *u8) -> i64 {
  let sop: *i64 = sys_mmap(16) as *i64
  let first: i64 = ev_first_var(ms, mslen, sop)
  if first < 0 { return 0 - 1 }
  let fo: *i64 = sys_mmap(16) as *i64
  let fdz: *i64 = sys_mmap(16) as *i64
  let dbn: *u8 = "db" as *u8
  ev_walk(ms, mslen, first, sop[0], 0, dbn, 2, fo, fdz)
  if fo[0] < 0 { return 0 - 2 }
  let nsz: i64 = ev_r32(ms, fo[0] + 36)
  let dataoff: i64 = fo[0] + 60 + nsz
  var i: i64 = 0
  while i < 16 { out16[i] = ms[dataoff + i]; i = i + 1 }      // SignatureType of the first list
  return 0
141}
142// and the vendor GUID of a named variable, likewise from the artifact
143func en_vendor_guid(ms: *u8, mslen: i64, name: *u8, nlen: i64, out16: *u8) -> i64 {
  let sop: *i64 = sys_mmap(16) as *i64
  let first: i64 = ev_first_var(ms, mslen, sop)
  if first < 0 { return 0 - 1 }
  let fo: *i64 = sys_mmap(16) as *i64
  let fdz: *i64 = sys_mmap(16) as *i64
  ev_walk(ms, mslen, first, sop[0], 0, name, nlen, fo, fdz)
  if fo[0] < 0 { return 0 - 2 }
  var i: i64 = 0
  while i < 16 { out16[i] = ms[fo[0] + 44 + i]; i = i + 1 }
  return 0
154}
155
156// ---- THE DISCRIMINATOR -------------------------------------------------------------------------
157// db can authorise a binary by its SHA-256 Authenticode hash instead of by certificate. If a
158// hash-authorised UNSIGNED image boots, then the varstore/db/enforcement path is proven end to end
159// and the earlier failure is isolated to the PKCS#7 ENCODING ALONE. If it does NOT boot, the fault
160// is upstream of the signature and I was chasing the wrong thing.
161// ★★★★★★ONE EXPERIMENT THAT SEPARATES TWO CAUSES IS WORTH MORE THAN ANY AMOUNT OF STARING AT THE
162//  ENCODER -- AND IT COSTS 30 SECONDS.
163// EFI_CERT_SHA256_GUID is READ from the MS `dbx` (76 B = 28 header + 16 owner + 32 hash = exactly
164// one sha256 signature), never typed.
165func en_sha256guid_from_ms(ms: *u8, mslen: i64, out16: *u8) -> i64 {
  let sop: *i64 = sys_mmap(16) as *i64
  let first: i64 = ev_first_var(ms, mslen, sop)
  if first < 0 { return 0 - 1 }
  let fo: *i64 = sys_mmap(16) as *i64
  let fdz: *i64 = sys_mmap(16) as *i64
  let dbxn: *u8 = "dbx" as *u8
  ev_walk(ms, mslen, first, sop[0], 0, dbxn, 3, fo, fdz)
  if fo[0] < 0 { return 0 - 2 }
  if fdz[0] != 76 { return 0 - 3 }                 // assert the shape before trusting the GUID
  let nsz: i64 = ev_r32(ms, fo[0] + 36)
  let dataoff: i64 = fo[0] + 60 + nsz
  if ev_r32(ms, dataoff + 24) != 48 { return 0 - 4 }   // SignatureSize must be 16+32
  var i: i64 = 0
  while i < 16 { out16[i] = ms[dataoff + i]; i = i + 1 }
  return 0
181}
182
183func en_build_hashdb(emptyp: *u8, msp: *u8, imgp: *u8, outp: *u8) -> i64 {
  let l1: *i64 = sys_mmap(16) as *i64
  let base: *u8 = sys_read_file(emptyp, l1)
  if l1[0] <= 0 { return 0 - 1 }
  let l2: *i64 = sys_mmap(16) as *i64
  let ms: *u8 = sys_read_file(msp, l2)
  if l2[0] <= 0 { return 0 - 1 }
  let l3: *i64 = sys_mmap(16) as *i64
  let img: *u8 = sys_read_file(imgp, l3)
  if l3[0] <= 0 { return 0 - 1 }
193
  let h: *u8 = sys_mmap(64)
  if pe_authhash(img, l3[0], h) != 0 { en_p("not a hashable PE\n" as *u8); return 0 - 2 }
  let shag: *u8 = sys_mmap(32)
  let rc: i64 = en_sha256guid_from_ms(ms, l2[0], shag)
  if rc != 0 { en_p("cannot extract EFI_CERT_SHA256_GUID rc=" as *u8); en_fn(1, rc); en_p("\n" as *u8); return 0 - 3 }
199
  // db = one sha256 signature list authorising exactly this image
  let sl: *u8 = sys_mmap(EN_MAGIC_4096)
  var i: i64 = 0
  while i < 16 { sl[i] = shag[i]; i = i + 1 }
  en_w32(sl, 16, 28 + 48)                          // SignatureListSize
  en_w32(sl, 20, 0)                                // SignatureHeaderSize
  en_w32(sl, 24, 48)                               // SignatureSize = owner + sha256
  var z: i64 = 0
  while z < 16 { sl[28 + z] = 0 as u8; z = z + 1 } // SignatureOwner
  var k: i64 = 0
  while k < 32 { sl[44 + k] = h[k]; k = k + 1 }
  let sllen: i64 = 28 + 48
212
  // PK/KEK still need a CERT (they authorise variable updates, not images)
  let x509g: *u8 = sys_mmap(32)
  if en_x509guid_from_ms(ms, l2[0], x509g) != 0 { return 0 - 4 }
  let pp: *i64 = u2048_alloc(); let qq: *i64 = u2048_alloc()
  let n: *i64 = u2048_alloc(); let d: *i64 = u2048_alloc()
  let st: *i64 = sys_mmap(16) as *i64
  st[0] = EN_MAGIC_20260808
  if kg_keygen(EN_MAGIC_1024, pp, qq, n, d, st, 1) != 1 { return 0 - 5 }
  let cert: *u8 = sys_mmap(EN_MAGIC_8192)
  let toff: *i64 = sys_mmap(16) as *i64
  let tlen: *i64 = sys_mmap(16) as *i64
  let cn: *u8 = "Nishi Platform Key" as *u8
  let certlen: i64 = x509_emit_selfsigned(cert, n, d, EN_MAGIC_65537, cn, EN_MAGIC_4097, toff, tlen)
  let csl: *u8 = sys_mmap(EN_MAGIC_16384)
  let csllen: i64 = en_siglist(csl, x509g, cert, certlen)
228
  let dbg: *u8 = sys_mmap(32)
  let globalg: *u8 = sys_mmap(32)
  let dbn: *u8 = "db" as *u8
  let pkn: *u8 = "PK" as *u8
  let kekn: *u8 = "KEK" as *u8
  if en_vendor_guid(ms, l2[0], dbn, 2, dbg) != 0 { return 0 - 6 }
  if en_vendor_guid(ms, l2[0], pkn, 2, globalg) != 0 { return 0 - 6 }
236
  let out: *u8 = sys_mmap(l1[0] + EN_MAGIC_4096)
  var c: i64 = 0
  while c < l1[0] { out[c] = base[c]; c = c + 1 }
  let sop: *i64 = sys_mmap(16) as *i64
  let first: i64 = ev_first_var(out, l1[0], sop)
  if first < 0 { return 0 - 7 }
  var off: i64 = first
  off = en_put_var(out, off, dbn,  dbg,     sl,  sllen)     // db = HASH of the image
  off = en_put_var(out, off, kekn, globalg, csl, csllen)
  off = en_put_var(out, off, pkn,  globalg, csl, csllen)
  let fd: i64 = sys_openat_wr(outp, 0x1a4)
  if fd < 0 { return 0 - 8 }
  sys_write(fd, out, l1[0])
  sys_close(fd)
  en_p("hash-db varstore written; authorised sha256 of " as *u8); en_p(imgp); en_p("\n" as *u8)
  return sllen
253}
254
255// =================================================================================================
256func en_build(emptyp: *u8, msp: *u8, outp: *u8, quiet: i64) -> i64 {
  let l1: *i64 = sys_mmap(16) as *i64
  let base: *u8 = sys_read_file(emptyp, l1)
  if l1[0] <= 0 { en_p("cannot read empty varstore\n" as *u8); return 0 - 1 }
  let l2: *i64 = sys_mmap(16) as *i64
  let ms: *u8 = sys_read_file(msp, l2)
  if l2[0] <= 0 { en_p("cannot read ms varstore\n" as *u8); return 0 - 1 }
263
  let x509g: *u8 = sys_mmap(32)
  if en_x509guid_from_ms(ms, l2[0], x509g) != 0 { en_p("cannot extract EFI_CERT_X509_GUID\n" as *u8); return 0 - 2 }
  let dbg: *u8 = sys_mmap(32)
  let globalg: *u8 = sys_mmap(32)
  let dbn: *u8 = "db" as *u8
  let pkn: *u8 = "PK" as *u8
  if en_vendor_guid(ms, l2[0], dbn, 2, dbg) != 0 { return 0 - 3 }
  if en_vendor_guid(ms, l2[0], pkn, 2, globalg) != 0 { return 0 - 3 }
272
  // our key + cert
  let pp: *i64 = u2048_alloc(); let qq: *i64 = u2048_alloc()
  let n: *i64 = u2048_alloc(); let d: *i64 = u2048_alloc()
  let st: *i64 = sys_mmap(16) as *i64
  st[0] = EN_MAGIC_20260808
  if quiet == 0 { en_p("TEST-KEY-DO-NOT-USE: generating the deterministic platform key...\n" as *u8) }
  if kg_keygen(EN_MAGIC_1024, pp, qq, n, d, st, 1) != 1 { en_p("keygen failed\n" as *u8); return 0 - 4 }
  let cert: *u8 = sys_mmap(EN_MAGIC_8192)
  let toff: *i64 = sys_mmap(16) as *i64
  let tlen: *i64 = sys_mmap(16) as *i64
  let cn: *u8 = "Nishi Platform Key" as *u8
  let certlen: i64 = x509_emit_selfsigned(cert, n, d, EN_MAGIC_65537, cn, EN_MAGIC_4097, toff, tlen)
  if certlen <= 0 { en_p("cert emit failed\n" as *u8); return 0 - 5 }
286
  let sl: *u8 = sys_mmap(EN_MAGIC_16384)
  let sllen: i64 = en_siglist(sl, x509g, cert, certlen)
289
  // copy the empty store and append our three variables
  let out: *u8 = sys_mmap(l1[0] + EN_MAGIC_4096)
  var i: i64 = 0
  while i < l1[0] { out[i] = base[i]; i = i + 1 }
  let sop: *i64 = sys_mmap(16) as *i64
  let first: i64 = ev_first_var(out, l1[0], sop)
  if first < 0 { en_p("empty store not parseable\n" as *u8); return 0 - 6 }
  var off: i64 = first
  let kekn: *u8 = "KEK" as *u8
  off = en_put_var(out, off, dbn,  dbg,     sl, sllen)
  off = en_put_var(out, off, kekn, globalg, sl, sllen)
  off = en_put_var(out, off, pkn,  globalg, sl, sllen)   // PK last: it is what leaves SETUP mode
302
  let fd: i64 = sys_openat_wr(outp, 0x1a4)
  if fd < 0 { en_p("cannot write output\n" as *u8); return 0 - 7 }
  sys_write(fd, out, l1[0])
  sys_close(fd)
  if quiet == 0 {
      en_p("wrote " as *u8); en_p(outp); en_p(" siglist=" as *u8); en_fn(1, sllen)
      en_p(" cert=" as *u8); en_fn(1, certlen); en_p(" end_off=" as *u8); en_fn(1, off); en_p("\n" as *u8)
  }
  return sllen
312}
313
314func en_selftest(emptyp: *u8, msp: *u8) -> i64 {
  var pass: i64 = 0
  var teeth: i64 = 0
  let outp: *u8 = "/tmp/nishi_vars.fd" as *u8
318
  // T1 EFI_CERT_X509_GUID must come OUT OF the MS db, and must not be all-zero or all-FF.
  teeth = teeth + 1
  let l2: *i64 = sys_mmap(16) as *i64
  let ms: *u8 = sys_read_file(msp, l2)
  let g: *u8 = sys_mmap(32)
  var t1: i64 = 0
  if l2[0] > 0 { if en_x509guid_from_ms(ms, l2[0], g) == 0 {
      var nz: i64 = 0
      var nf: i64 = 0
      var i: i64 = 0
      while i < 16 { if (g[i] as i64) != 0 { nz = 1 } if (g[i] as i64) != 0xFF { nf = 1 } i = i + 1 }
      if nz == 1 { if nf == 1 { t1 = 1 } }
  } }
  if t1 == 1 { pass = pass + 1; en_p("EN-T1 EFI_CERT_X509_GUID extracted from the real MS db GREEN\n" as *u8) }
  else { en_p("EN-T1 RED\n" as *u8) }
334
  // T2 build the store
  teeth = teeth + 1
  let sllen: i64 = en_build(emptyp, msp, outp, 0)
  if sllen > 0 { pass = pass + 1; en_p("EN-T2 varstore built GREEN\n" as *u8) }
  else { en_p("EN-T2 RED rc=" as *u8); en_fn(1, sllen); en_p("\n" as *u8) }
340
  // T3 OUR OWN PARSER MUST READ BACK EXACTLY THREE VARIABLES, BY NAME. Writing a structure and not
  // re-reading it is how a varstore that firmware silently ignores looks like success.
  teeth = teeth + 1
  let l3: *i64 = sys_mmap(16) as *i64
  let nv: *u8 = sys_read_file(outp, l3)
  var got: i64 = 0
  var total: i64 = 0
  if l3[0] > 0 {
      let sop: *i64 = sys_mmap(16) as *i64
      let first: i64 = ev_first_var(nv, l3[0], sop)
      if first > 0 {
          let fo: *i64 = sys_mmap(16) as *i64
          let fdz: *i64 = sys_mmap(16) as *i64
          let empty: *u8 = "" as *u8
          total = ev_walk(nv, l3[0], first, sop[0], 0, empty, 0, fo, fdz)
          let dbn: *u8 = "db" as *u8
          let kekn: *u8 = "KEK" as *u8
          let pkn: *u8 = "PK" as *u8
          ev_walk(nv, l3[0], first, sop[0], 0, dbn, 2, fo, fdz);  if fo[0] >= 0 { got = got + 1 }
          ev_walk(nv, l3[0], first, sop[0], 0, kekn, 3, fo, fdz); if fo[0] >= 0 { got = got + 1 }
          ev_walk(nv, l3[0], first, sop[0], 0, pkn, 2, fo, fdz);  if fo[0] >= 0 { got = got + 1 }
      }
  }
  if got == 3 { if total == 3 { pass = pass + 1
          en_p("EN-T3 read back PK+KEK+db, total=3 GREEN\n" as *u8) }
      else { en_p("EN-T3 RED total=" as *u8); en_fn(1, total); en_p("\n" as *u8) } }
  else { en_p("EN-T3 RED got=" as *u8); en_fn(1, got); en_p("\n" as *u8) }
368
  // T4 the db data must be a well-formed EFI_SIGNATURE_LIST whose sizes are self-consistent --
  // a length field that disagrees with the payload is exactly what firmware rejects silently.
  teeth = teeth + 1
  var t4: i64 = 0
  if l3[0] > 0 {
      let sop: *i64 = sys_mmap(16) as *i64
      let first: i64 = ev_first_var(nv, l3[0], sop)
      let fo: *i64 = sys_mmap(16) as *i64
      let fdz: *i64 = sys_mmap(16) as *i64
      let dbn: *u8 = "db" as *u8
      ev_walk(nv, l3[0], first, sop[0], 0, dbn, 2, fo, fdz)
      if fo[0] >= 0 {
          let nsz: i64 = ev_r32(nv, fo[0] + 36)
          let dof: i64 = fo[0] + 60 + nsz
          let listsize: i64 = ev_r32(nv, dof + 16)
          let hdrsize: i64 = ev_r32(nv, dof + 20)
          let sigsize: i64 = ev_r32(nv, dof + 24)
          if listsize == fdz[0] { if hdrsize == 0 { if (28 + sigsize) == listsize { t4 = 1 } } }
      }
  }
  if t4 == 1 { pass = pass + 1; en_p("EN-T4 db signature-list sizes self-consistent GREEN\n" as *u8) }
  else { en_p("EN-T4 RED\n" as *u8) }
391
  // T5 the embedded cert must still parse -- proving we wrote the DER, not a mangled copy
  teeth = teeth + 1
  var t5: i64 = 0
  if l3[0] > 0 {
      let sop: *i64 = sys_mmap(16) as *i64
      let first: i64 = ev_first_var(nv, l3[0], sop)
      let fo: *i64 = sys_mmap(16) as *i64
      let fdz: *i64 = sys_mmap(16) as *i64
      let dbn: *u8 = "db" as *u8
      ev_walk(nv, l3[0], first, sop[0], 0, dbn, 2, fo, fdz)
      if fo[0] >= 0 {
          let nsz: i64 = ev_r32(nv, fo[0] + 36)
          let dof: i64 = fo[0] + 60 + nsz
          let sigsize: i64 = ev_r32(nv, dof + 24)
          let certoff: i64 = dof + 28 + 16
          let certlen: i64 = sigsize - 16
          let xc: *X509Cert = sys_mmap(512) as *X509Cert
          if x509_parse((nv + certoff) as *u8, certlen, xc) >= 0 { t5 = 1 }
      }
  }
  if t5 == 1 { pass = pass + 1; en_p("EN-T5 the enrolled cert parses out of the varstore GREEN\n" as *u8) }
  else { en_p("EN-T5 RED\n" as *u8) }
414
  // T6 NEGATIVE CONTROL: the SOURCE empty store must still contain ZERO variables, proving T3
  // measured OUR writes and not something that was already there.
  teeth = teeth + 1
  let l4: *i64 = sys_mmap(16) as *i64
  let eb: *u8 = sys_read_file(emptyp, l4)
  var zero: i64 = 0 - 1
  if l4[0] > 0 {
      let sop: *i64 = sys_mmap(16) as *i64
      let first: i64 = ev_first_var(eb, l4[0], sop)
      let fo: *i64 = sys_mmap(16) as *i64
      let fdz: *i64 = sys_mmap(16) as *i64
      let empty: *u8 = "" as *u8
      zero = ev_walk(eb, l4[0], first, sop[0], 0, empty, 0, fo, fdz)
  }
  if zero == 0 { pass = pass + 1; en_p("EN-T6 neg-control-source-store-was-empty GREEN\n" as *u8) }
  else { en_p("EN-T6 RED source had " as *u8); en_fn(1, zero); en_p("\n" as *u8) }
431
  en_p("EN-SELFTEST " as *u8); en_fn(1, pass); en_p("/" as *u8); en_fn(1, teeth); en_p("\n" as *u8)
  let lf: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
  if lf >= 0 {
      en_fp(lf, "EFIVARSENROL selftest teeth=" as *u8); en_fn(lf, pass)
      en_fp(lf, "of" as *u8); en_fn(lf, teeth)
      en_fp(lf, " scope=structural-NOT-yet-firmware-accepted verdict=" as *u8)
      if pass == teeth { en_fp(lf, "GREEN\n" as *u8) } else { en_fp(lf, "RED\n" as *u8) }
      sys_close(lf)
  }
  if pass == teeth { sys_exit(0); return 0 }
  sys_exit(1); return 1
443}
444
445func main(argc: i64, argv: *i64) -> i64 {
  if argc >= 4 { if en_eq_str(argv[1] as *u8, "selftest" as *u8) == 1 {
      return en_selftest(argv[2] as *u8, argv[3] as *u8) } }
  if argc >= 5 { if en_eq_str(argv[1] as *u8, "build" as *u8) == 1 {
      let r: i64 = en_build(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, 0)
      if r > 0 { sys_exit(0); return 0 }
      sys_exit(1); return 1 } }
  if argc >= 6 { if en_eq_str(argv[1] as *u8, "hashdb" as *u8) == 1 {
      let r: i64 = en_build_hashdb(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, argv[5] as *u8)
      if r > 0 { sys_exit(0); return 0 }
      en_p("hashdb failed rc=" as *u8); en_fn(1, r); en_p("\n" as *u8)
      sys_exit(1); return 1 } }
  en_p("usage: nx_efivars_enrol build <empty.fd> <ms.fd> <out.fd> | selftest <empty.fd> <ms.fd>\n" as *u8)
  en_p("       nx_efivars_enrol hashdb <empty.fd> <ms.fd> <image.efi> <out.fd>\n" as *u8)
  sys_exit(2); return 2
460}
nx_efivars_enrol.nx source

`nx_efivars_enrol.nx` source
