Windows: add ARM64 system encryption support

src/Boot/EFI/ARM64/.gitignore

@@ -0,0 +1,3 @@
+# Release EFI resources are versioned so clean Setup builds are self-contained.
+*.map
+*.pdb

src/Boot/EFI/ARM64/README.txt

@@ -0,0 +1,19 @@
+ARM64 VeraCrypt-DCS staging directory
+=====================================
+
+The release EFI resources in this directory are versioned, as are the
+existing x64 DCS resources, so a clean VeraCrypt checkout can build Setup
+without an unrecorded staging dependency.
+
+Regenerate them from the companion VeraCrypt-DCS repository with:
+
+  Dcs_bld.bat ARM64Rel VS2022
+
+Then stage and validate the AArch64 outputs before building VeraCrypt:
+
+  powershell -ExecutionPolicy Bypass -File Stage-Dcs.ps1 `
+    -BuildOutput C:\path\to\VeraCrypt-DCS\Build\DcsPkg\RELEASE_VS2022\AARCH64
+
+The staging script rejects missing, malformed, or non-AArch64 PE images and
+prints the SHA-256 hash of every staged resource. Commit all seven refreshed
+resources together with the source revisions that produced them.

src/Boot/EFI/ARM64/Stage-Dcs.ps1

@@ -0,0 +1,59 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string] $BuildOutput,
+
+    [string] $Destination
+)
+
+$ErrorActionPreference = "Stop"
+
+if ([string]::IsNullOrWhiteSpace($Destination)) {
+    $Destination = $PSScriptRoot
+}
+
+$files = [ordered]@{
+    "DcsBml.efi"        = "DcsBml.efi"
+    "DcsBoot.efi"       = "DcsBoot.efi"
+    "DcsCfg.efi"        = "DcsCfg.dcs"
+    "DcsInfo.efi"       = "DcsInfo.dcs"
+    "DcsInt.efi"        = "DcsInt.dcs"
+    "DcsRe.efi"         = "DcsRe.efi"
+    "LegacySpeaker.efi" = "LegacySpeaker.dcs"
+}
+
+function Assert-AArch64PeImage {
+    param([Parameter(Mandatory = $true)][string] $Path)
+
+    $bytes = [System.IO.File]::ReadAllBytes($Path)
+    if (($bytes.Length -lt 64) -or ($bytes[0] -ne 0x4d) -or ($bytes[1] -ne 0x5a)) {
+        throw "'$Path' is not a PE image."
+    }
+
+    $peOffset = [BitConverter]::ToInt32($bytes, 0x3c)
+    if (($peOffset -lt 0) -or (($peOffset + 6) -gt $bytes.Length) -or ($bytes[$peOffset] -ne 0x50) -or ($bytes[$peOffset + 1] -ne 0x45) -or ($bytes[$peOffset + 2] -ne 0) -or ($bytes[$peOffset + 3] -ne 0)) {
+        throw "'$Path' has an invalid PE header."
+    }
+
+    $machine = [BitConverter]::ToUInt16($bytes, $peOffset + 4)
+    if ($machine -ne 0xaa64) {
+        throw "'$Path' targets PE machine 0x$($machine.ToString('x4')), not AArch64 (0xaa64)."
+    }
+}
+
+$buildOutputPath = (Resolve-Path -LiteralPath $BuildOutput).Path
+New-Item -ItemType Directory -Force -Path $Destination | Out-Null
+
+foreach ($entry in $files.GetEnumerator()) {
+    $source = Join-Path $buildOutputPath $entry.Key
+    if (-not (Test-Path -LiteralPath $source -PathType Leaf)) {
+        throw "Missing VeraCrypt-DCS output '$source'."
+    }
+
+    Assert-AArch64PeImage -Path $source
+    $target = Join-Path $Destination $entry.Value
+    Copy-Item -LiteralPath $source -Destination $target -Force
+
+    $hash = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash
+    Write-Host "$($entry.Value)  $hash"
+}

src/Boot/Windows/BootDefs.h

@@ -208,4 +208,83 @@ TC_HIDDEN_OS_CREATION_PHASE_WIPED = TC__HIDDEN_OS_CREATION_PHASE_WIPED
 #define EFI_BOOTARGS_REGIONS_DEFAULT EFI_BOOTARGS_REGIONS_LOW, EFI_BOOTARGS_REGIONS_HIGH
 #define EFI_BOOTARGS_REGIONS_EFI EFI_BOOTARGS_REGIONS_HIGH, EFI_BOOTARGS_REGIONS_LOW
 
+#if !defined(TC_ASM_PREPROCESS)
+#define VC_ARM64_BOOT_ARGS_HANDOFF_REQUIRED_REG_VALUE_NAME L"Arm64BootArgsHandoffRequired"
+#endif
+
+#if !defined(TC_ASM_PREPROCESS) && (defined(_M_ARM64) || defined(MDE_CPU_AARCH64))
+#define VC_ARM64_BOOT_ARGS_HANDOFF_VARIABLE_NAME L"VeraCryptArm64BootArgsHandoffPayload"
+#define VC_ARM64_BOOT_ARGS_HANDOFF_GUID_INIT \
+{ 0x101f8560, 0xd73a, 0x4ff7, { 0x89, 0xf6, 0x81, 0x70, 0xf6, 0x61, 0x55, 0x87 } }
+#define VC_ARM64_BOOT_ARGS_HANDOFF_DESCRIPTOR_MAGIC 0x5643414844534332ULL
+#define VC_ARM64_BOOT_ARGS_HANDOFF_PAYLOAD_MAGIC 0x56434148504C4431ULL
+#define VC_ARM64_BOOT_ARGS_HANDOFF_ALLOCATION_TAG_MAGIC 0x564341484F574E31ULL
+#define VC_ARM64_BOOT_ARGS_HANDOFF_VERSION 2
+#define VC_ARM64_BOOT_ARGS_HANDOFF_VARIABLE_ATTRIBUTES 0x00000006UL
+#define VC_ARM64_BOOT_ARGS_HANDOFF_REGION_LENGTH 4096UL
+#define VC_ARM64_BOOT_ARGS_HANDOFF_BOOT_PARAMS_LENGTH 158UL
+#define VC_ARM64_RESCUE_DECRYPTION_COMPLETE_VARIABLE_NAME L"VeraCryptArm64RescueDecryptionComplete"
+#define VC_ARM64_RESCUE_DECRYPTION_COMPLETE_MAGIC 0x5643414852444331ULL
+#define VC_ARM64_RESCUE_DECRYPTION_COMPLETE_VERSION 1
+#define VC_ARM64_RESCUE_DECRYPTION_COMPLETE_VARIABLE_ATTRIBUTES 0x00000007UL
+
+#pragma pack (push)
+#pragma pack (1)
+typedef struct
+{
+	uint64 Magic;
+	uint32 Version;
+	uint32 Size;
+	uint32 BootArgsOffset;
+	uint32 PayloadLength;
+	uint32 PayloadCrc32;
+	uint32 Crc32;
+} VeraCryptArm64BootArgsHandoffPayloadHeader;
+
+typedef struct
+{
+	uint64 Magic;
+	uint32 Version;
+	uint32 Size;
+	uint64 PhysicalAddress;
+	uint32 RegionLength;
+	uint32 PayloadLength;
+	uint32 PayloadCrc32;
+	uint32 Crc32;
+} VeraCryptArm64BootArgsHandoffDescriptor;
+
+typedef struct
+{
+	uint64 Magic;
+	uint32 Version;
+	uint32 Size;
+	uint64 PhysicalAddress;
+	uint32 RegionLength;
+	uint32 Crc32;
+} VeraCryptArm64BootArgsHandoffAllocationTag;
+
+typedef struct
+{
+	uint64 Magic;
+	uint32 Version;
+	uint32 Size;
+	uint32 HeaderSaltCrc32;
+	uint32 Crc32;
+} VeraCryptArm64RescueDecryptionComplete;
+#pragma pack (pop)
+
+typedef char VeraCryptArm64BootArgsHandoffPayloadHeaderSizeCheck[
+	sizeof (VeraCryptArm64BootArgsHandoffPayloadHeader) == 32 ? 1 : -1];
+typedef char VeraCryptArm64BootArgsHandoffDescriptorSizeCheck[
+	sizeof (VeraCryptArm64BootArgsHandoffDescriptor) == 40 ? 1 : -1];
+typedef char VeraCryptArm64BootArgsHandoffAllocationTagSizeCheck[
+	sizeof (VeraCryptArm64BootArgsHandoffAllocationTag) == 32 ? 1 : -1];
+typedef char VeraCryptArm64RescueDecryptionCompleteSizeCheck[
+	sizeof (VeraCryptArm64RescueDecryptionComplete) == 24 ? 1 : -1];
+#define VC_ARM64_BOOT_ARGS_HANDOFF_PAYLOAD_LENGTH \
+	(sizeof (VeraCryptArm64BootArgsHandoffPayloadHeader) + VC_ARM64_BOOT_ARGS_HANDOFF_BOOT_PARAMS_LENGTH)
+#define VC_ARM64_BOOT_ARGS_HANDOFF_ALLOCATION_TAG_OFFSET \
+	(VC_ARM64_BOOT_ARGS_HANDOFF_REGION_LENGTH - sizeof (VeraCryptArm64BootArgsHandoffAllocationTag))
+#endif
+
 #endif // TC_HEADER_Boot_BootDefs