[PATCH v8 05/10] nx: add memory attribute get/set API

[Mate Kukri]

For NX, we need to set the page access permission attributes for write
and execute permissions.

This patch adds two new primitives, grub_set_mem_attrs() and
grub_clear_mem_attrs(), and associated constant definitions, to be used
for that purpose.

For most platforms, it adds a dummy implementation.

On EFI platforms, it implements the primitives using the EFI
Memory Attribute Protocol (defined in UEFI 2.10 specification).

Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
Signed-off-by: Mate Kukri <mate.kukri@canonical.com>
---
 grub-core/kern/efi/mm.c | 109 ++++++++++++++++++++++++++++++++++++++++
 include/grub/efi/api.h  |  25 +++++++++
 include/grub/mm.h       |  35 +++++++++++++
 3 files changed, 169 insertions(+)

diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
index df7bf2869..bc97ecd47 100644
--- a/grub-core/kern/efi/mm.c
+++ b/grub-core/kern/efi/mm.c
@@ -689,3 +689,112 @@ grub_efi_get_ram_base(grub_addr_t *base_addr)
   return GRUB_ERR_NONE;
 }
 #endif
+
+static grub_uint64_t
+grub_mem_attrs_to_uefi_mem_attrs (grub_mem_attr_t attrs)
+{
+  grub_efi_uint64_t ret = GRUB_EFI_MEMORY_RP | GRUB_EFI_MEMORY_RO | 
GRUB_EFI_MEMORY_XP;
+
+  if (attrs & GRUB_MEM_ATTR_R)
+    ret &= ~GRUB_EFI_MEMORY_RP;
+
+  if (attrs & GRUB_MEM_ATTR_W)
+    ret &= ~GRUB_EFI_MEMORY_RO;
+
+  if (attrs & GRUB_MEM_ATTR_X)
+    ret &= ~GRUB_EFI_MEMORY_XP;
+
+  return ret;
+}
+
+static grub_mem_attr_t
+uefi_mem_attrs_to_grub_mem_attrs (grub_efi_uint64_t attrs)
+{
+  grub_mem_attr_t ret = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X;
+
+  if (attrs & GRUB_EFI_MEMORY_RP)
+    ret &= ~GRUB_MEM_ATTR_R;
+
+  if (attrs & GRUB_EFI_MEMORY_RO)
+    ret &= ~GRUB_MEM_ATTR_W;
+
+  if (attrs & GRUB_EFI_MEMORY_XP)
+    ret &= ~GRUB_MEM_ATTR_X;
+
+  return ret;
+}
+
+grub_err_t
+grub_get_mem_attrs (grub_addr_t addr, grub_size_t size, grub_mem_attr_t *attrs)
+{
+  grub_efi_memory_attribute_protocol_t *proto;
+  grub_efi_physical_address_t physaddr = addr;
+  static grub_guid_t protocol_guid = GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID;
+  grub_efi_status_t efi_status;
+  grub_efi_uint64_t efi_attrs;
+
+  if (physaddr & (GRUB_EFI_PAGE_SIZE - 1) || size & (GRUB_EFI_PAGE_SIZE - 1) 
|| size == 0 || attrs == NULL)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "%s() called with invalid 
arguments", __FUNCTION__);
+
+  proto = grub_efi_locate_protocol (&protocol_guid, 0);
+  if (proto == NULL)
+    {
+      /* No protocol -> do nothing, all memory is RWX in boot services */
+      *attrs = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X;
+      return GRUB_ERR_NONE;
+    }
+
+  efi_status = proto->get_memory_attributes (proto, physaddr, size, 
&efi_attrs);
+  if (efi_status != GRUB_EFI_SUCCESS)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "%s() called with invalid 
arguments", __FUNCTION__);
+
+  *attrs = uefi_mem_attrs_to_grub_mem_attrs (efi_attrs);
+
+  grub_dprintf ("nx", "get 0x%" PRIxGRUB_ADDR "-0x%" PRIxGRUB_ADDR ":%c%c%c\n",
+               addr, addr + size - 1,
+               (*attrs & GRUB_MEM_ATTR_R) ? 'r' : '-',
+               (*attrs & GRUB_MEM_ATTR_W) ? 'w' : '-',
+               (*attrs & GRUB_MEM_ATTR_X) ? 'x' : '-');
+
+  return GRUB_ERR_NONE;
+}
+
+grub_err_t
+grub_update_mem_attrs (grub_addr_t addr, grub_size_t size,
+                      grub_mem_attr_t set_attrs, grub_mem_attr_t clear_attrs)
+{
+  grub_efi_memory_attribute_protocol_t *proto;
+  grub_efi_physical_address_t physaddr = addr;
+  static grub_guid_t protocol_guid = GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID;
+  grub_efi_status_t efi_status = GRUB_EFI_SUCCESS;
+  grub_efi_uint64_t uefi_set_attrs, uefi_clear_attrs;
+
+  if (physaddr & (GRUB_EFI_PAGE_SIZE - 1) || size & (GRUB_EFI_PAGE_SIZE - 1) 
|| size == 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "%s() called with invalid 
arguments", __FUNCTION__);
+
+  proto = grub_efi_locate_protocol (&protocol_guid, 0);
+  if (proto == NULL)
+    /* No protocol -> do nothing, all memory is RWX in boot services */
+    return GRUB_ERR_NONE;
+
+  uefi_set_attrs = grub_mem_attrs_to_uefi_mem_attrs (set_attrs);
+  uefi_clear_attrs = grub_mem_attrs_to_uefi_mem_attrs (clear_attrs);
+  if (uefi_set_attrs)
+    efi_status = proto->set_memory_attributes (proto, physaddr, size, 
uefi_set_attrs);
+  if (efi_status == GRUB_EFI_SUCCESS && uefi_clear_attrs)
+    efi_status = proto->clear_memory_attributes (proto, physaddr, size, 
uefi_clear_attrs);
+
+  if (efi_status != GRUB_EFI_SUCCESS)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "%s() called with invalid 
arguments", __FUNCTION__);
+
+  grub_dprintf ("nx", "set +%s%s%s -%s%s%s on 0x%" PRIxGRUB_ADDR "-0x%" 
PRIxGRUB_ADDR "\n",
+               (set_attrs & GRUB_MEM_ATTR_R) ? "r" : "",
+               (set_attrs & GRUB_MEM_ATTR_W) ? "w" : "",
+               (set_attrs & GRUB_MEM_ATTR_X) ? "x" : "",
+               (clear_attrs & GRUB_MEM_ATTR_R) ? "r" : "",
+               (clear_attrs & GRUB_MEM_ATTR_W) ? "w" : "",
+               (clear_attrs & GRUB_MEM_ATTR_X) ? "x" : "",
+               addr, addr + size - 1);
+
+  return GRUB_ERR_NONE;
+}
diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h
index d44d00ad7..b686e8afe 100644
--- a/include/grub/efi/api.h
+++ b/include/grub/efi/api.h
@@ -379,6 +379,11 @@
     {0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f } \
   }
 
+#define GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID \
+  { 0xf4560cf6, 0x40ec, 0x4b4a, \
+    { 0xa1, 0x92, 0xbf, 0x1d, 0x57, 0xd0, 0xb1, 0x89 } \
+  }
+
 struct grub_efi_sal_system_table
 {
   grub_uint32_t signature;
@@ -1815,4 +1820,24 @@ struct initrd_media_device_path {
 } GRUB_PACKED;
 typedef struct initrd_media_device_path initrd_media_device_path_t;
 
+struct grub_efi_memory_attribute_protocol
+{
+  grub_efi_status_t (__grub_efi_api *get_memory_attributes) (
+                           struct grub_efi_memory_attribute_protocol *this,
+                           grub_efi_physical_address_t base_address,
+                           grub_efi_uint64_t length,
+                           grub_efi_uint64_t *attributes);
+  grub_efi_status_t (__grub_efi_api *set_memory_attributes) (
+                           struct grub_efi_memory_attribute_protocol *this,
+                           grub_efi_physical_address_t base_address,
+                           grub_efi_uint64_t length,
+                           grub_efi_uint64_t attributes);
+  grub_efi_status_t (__grub_efi_api *clear_memory_attributes) (
+                           struct grub_efi_memory_attribute_protocol *this,
+                           grub_efi_physical_address_t base_address,
+                           grub_efi_uint64_t length,
+                           grub_efi_uint64_t attributes);
+};
+typedef struct grub_efi_memory_attribute_protocol 
grub_efi_memory_attribute_protocol_t;
+
 #endif /* ! GRUB_EFI_API_HEADER */
diff --git a/include/grub/mm.h b/include/grub/mm.h
index f3bf87fa0..e1336d1c2 100644
--- a/include/grub/mm.h
+++ b/include/grub/mm.h
@@ -23,6 +23,7 @@
 #include <grub/err.h>
 #include <grub/types.h>
 #include <grub/symbol.h>
+#include <grub/err.h>
 #include <config.h>
 
 #ifndef NULL
@@ -56,6 +57,40 @@ void *EXPORT_FUNC(grub_realloc) (void *ptr, grub_size_t 
size);
 void *EXPORT_FUNC(grub_memalign) (grub_size_t align, grub_size_t size);
 #endif
 
+typedef grub_uint64_t grub_mem_attr_t;
+
+#define GRUB_MEM_ATTR_R        ((grub_mem_attr_t) 0x0000000000000004)
+#define GRUB_MEM_ATTR_W        ((grub_mem_attr_t) 0x0000000000000002)
+#define GRUB_MEM_ATTR_X        ((grub_mem_attr_t) 0x0000000000000001)
+
+#ifdef GRUB_MACHINE_EFI
+grub_err_t EXPORT_FUNC(grub_get_mem_attrs) (grub_addr_t addr,
+                                           grub_size_t size,
+                                           grub_mem_attr_t *attrs);
+grub_err_t EXPORT_FUNC(grub_update_mem_attrs) (grub_addr_t addr,
+                                              grub_size_t size,
+                                              grub_mem_attr_t set_attrs,
+                                              grub_mem_attr_t clear_attrs);
+#else /* !GRUB_MACHINE_EFI */
+static inline grub_err_t
+grub_get_mem_attrs (grub_addr_t addr __attribute__((__unused__)),
+                   grub_size_t size __attribute__((__unused__)),
+                   grub_mem_attr_t *attrs)
+{
+  *attrs = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X;
+  return GRUB_ERR_NONE;
+}
+
+static inline grub_err_t
+grub_update_mem_attrs (grub_addr_t addr __attribute__((__unused__)),
+                      grub_size_t size __attribute__((__unused__)),
+                      grub_mem_attr_t set_attrs __attribute__((__unused__)),
+                      grub_mem_attr_t clear_attrs __attribute__((__unused__)))
+{
+  return GRUB_ERR_NONE;
+}
+#endif /* GRUB_MACHINE_EFI */
+
 void grub_mm_check_real (const char *file, int line);
 #define grub_mm_check() grub_mm_check_real (GRUB_FILE, __LINE__);
 
-- 
2.39.2