From patchwork Thu Jun 22 18:57:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Ostrovsky X-Patchwork-Id: 9805105 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 210AC60329 for ; Thu, 22 Jun 2017 18:58:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1102E283DA for ; Thu, 22 Jun 2017 18:58:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 05D33286E1; Thu, 22 Jun 2017 18:58:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 63E52283DA for ; Thu, 22 Jun 2017 18:58:00 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dO7Gd-0005Xs-9p; Thu, 22 Jun 2017 18:55:47 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dO7Gc-0005V7-4Y for xen-devel@lists.xen.org; Thu, 22 Jun 2017 18:55:46 +0000 Received: from [85.158.137.68] by server-2.bemta-3.messagelabs.com id 33/C3-26106-1B21C495; Thu, 22 Jun 2017 18:55:45 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLLMWRWlGSWpSXmKPExsXSO6nOVXeDkE+ kwYybVhZLPi5mcWD0OLr7N1MAYxRrZl5SfkUCa0bnx1PsBedUK5p/3mJuYJwi28XIxSEkMJFJ 4uj3dawQzjdGielTHrNAOBsZJVY0LWOCcHoYJeY+n8PYxcjJwSZgJHH26HQwW0RAWuLa58uMI EXMAg1MEs/PHQRyODiEBSwk7rwJAKlhEVCV+LFzClg9r4CXxMx/Z5hAbAkBBYkpD98zg9icAt 4Sj0+9BasRAqpZ+nYtO0SNocTnjUuZJzDyLWBkWMWoUZxaVJZapGtkqpdUlJmeUZKbmJmja2h grJebWlycmJ6ak5hUrJecn7uJERgs9QwMjDsYW0/4HWKU5GBSEuXdXOwdKcSXlJ9SmZFYnBFf VJqTWnyIUYaDQ0mCV0/QJ1JIsCg1PbUiLTMHGLYwaQkOHiUR3i98QGne4oLE3OLMdIjUKUZFK XHecpA+AZBERmkeXBssVi4xykoJ8zIyMDAI8RSkFuVmlqDKv2IU52BUEuYVFwCawpOZVwI3/R XQYiagxS+OeIAsLklESEk1MPYyvFo8eeEeYT3RRC3XFS+yb4fc6NQQXqjucKXqSFPvzgUrl12 b/+7yrxOczBtOi35w2qN8XehpaviHmU/42Zl//uAsyanYzftale/5swvxT+a8uHZxj3yhTPy1 doclbn0rNWOtbdW9nuhMY7/8ror3R5la0n9B/5bLPsURDtq76oT/aZWYlCixFGckGmoxFxUnA gCy0dZSkAIAAA== X-Env-Sender: boris.ostrovsky@oracle.com X-Msg-Ref: server-11.tower-31.messagelabs.com!1498157743!76094580!1 X-Originating-IP: [141.146.126.69] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogMTQxLjE0Ni4xMjYuNjkgPT4gMjc3MjE4\n X-StarScan-Received: X-StarScan-Version: 9.4.19; banners=-,-,- X-VirusChecked: Checked Received: (qmail 14460 invoked from network); 22 Jun 2017 18:55:44 -0000 Received: from aserp1040.oracle.com (HELO aserp1040.oracle.com) (141.146.126.69) by server-11.tower-31.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 22 Jun 2017 18:55:44 -0000 Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v5MItc4K022818 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 22 Jun 2017 18:55:38 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v5MItbo7017716 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 22 Jun 2017 18:55:37 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v5MItZHH003460; Thu, 22 Jun 2017 18:55:36 GMT Received: from ovs104.us.oracle.com (/10.149.76.204) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 22 Jun 2017 11:55:35 -0700 From: Boris Ostrovsky To: xen-devel@lists.xen.org Date: Thu, 22 Jun 2017 14:57:10 -0400 Message-Id: <1498157830-21845-9-git-send-email-boris.ostrovsky@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1498157830-21845-1-git-send-email-boris.ostrovsky@oracle.com> References: <1498157830-21845-1-git-send-email-boris.ostrovsky@oracle.com> X-Source-IP: userv0022.oracle.com [156.151.31.74] Cc: sstabellini@kernel.org, wei.liu2@citrix.com, George.Dunlap@eu.citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, tim@xen.org, jbeulich@suse.com, Boris Ostrovsky Subject: [Xen-devel] [PATCH v5 8/8] mm: Make sure pages are scrubbed X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Add a debug Kconfig option that will make page allocator verify that pages that were supposed to be scrubbed are, in fact, clean. Signed-off-by: Boris Ostrovsky Reviewed-by: Jan Beulich --- Changes in v5: * Defined SCRUB_PATTERN for NDEBUG * Style chages xen/Kconfig.debug | 7 ++++++ xen/common/page_alloc.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 69 insertions(+), 1 deletion(-) diff --git a/xen/Kconfig.debug b/xen/Kconfig.debug index 689f297..195d504 100644 --- a/xen/Kconfig.debug +++ b/xen/Kconfig.debug @@ -114,6 +114,13 @@ config DEVICE_TREE_DEBUG logged in the Xen ring buffer. If unsure, say N here. +config SCRUB_DEBUG + bool "Page scrubbing test" + default DEBUG + ---help--- + Verify that pages that need to be scrubbed before being allocated to + a guest are indeed scrubbed. + endif # DEBUG || EXPERT endmenu diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index da5ffc2..5d50c2a 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -170,6 +170,10 @@ boolean_param("bootscrub", opt_bootscrub); static unsigned long __initdata opt_bootscrub_chunk = MB(128); size_param("bootscrub_chunk", opt_bootscrub_chunk); +#ifdef CONFIG_SCRUB_DEBUG +static bool __read_mostly boot_scrub_done; +#endif + /* * Bit width of the DMA heap -- used to override NUMA-node-first. * allocation strategy, which can otherwise exhaust low memory. @@ -695,6 +699,43 @@ static void page_list_add_scrub(struct page_info *pg, unsigned int node, page_list_add(pg, &heap(node, zone, order)); } +/* SCRUB_PATTERN needs to be a repeating series of bytes. */ +#ifndef NDEBUG +#define SCRUB_PATTERN 0xc2c2c2c2c2c2c2c2ULL +#else +#define SCRUB_PATTERN 0ULL +#endif +#define SCRUB_BYTE_PATTERN (SCRUB_PATTERN & 0xff) + +static void poison_one_page(struct page_info *pg) +{ +#ifdef CONFIG_SCRUB_DEBUG + mfn_t mfn = _mfn(page_to_mfn(pg)); + uint64_t *ptr; + + ptr = map_domain_page(mfn); + *ptr = ~SCRUB_PATTERN; + unmap_domain_page(ptr); +#endif +} + +static void check_one_page(struct page_info *pg) +{ +#ifdef CONFIG_SCRUB_DEBUG + mfn_t mfn = _mfn(page_to_mfn(pg)); + const uint64_t *ptr; + unsigned int i; + + if ( !boot_scrub_done ) + return; + + ptr = map_domain_page(mfn); + for ( i = 0; i < PAGE_SIZE / sizeof (*ptr); i++ ) + ASSERT(ptr[i] == SCRUB_PATTERN); + unmap_domain_page(ptr); +#endif +} + static void check_and_stop_scrub(struct page_info *head) { if ( head->u.free.scrub_state == BUDDY_SCRUBBING ) @@ -931,6 +972,9 @@ static struct page_info *alloc_heap_pages( * guest can control its own visibility of/through the cache. */ flush_page_to_ram(page_to_mfn(&pg[i]), !(memflags & MEMF_no_icache_flush)); + + if ( !(memflags & MEMF_no_scrub) ) + check_one_page(&pg[i]); } spin_unlock(&heap_lock); @@ -1294,7 +1338,10 @@ static void free_heap_pages( set_gpfn_from_mfn(mfn + i, INVALID_M2P_ENTRY); if ( need_scrub ) + { pg[i].count_info |= PGC_need_scrub; + poison_one_page(&pg[i]); + } } avail[node][zone] += 1 << order; @@ -1656,7 +1703,12 @@ static void init_heap_pages( nr_pages -= n; } +#ifndef CONFIG_SCRUB_DEBUG free_heap_pages(pg + i, 0, false); +#else + free_heap_pages(pg + i, 0, boot_scrub_done); +#endif + } } @@ -1922,6 +1974,10 @@ void __init scrub_heap_pages(void) printk("done.\n"); +#ifdef CONFIG_SCRUB_DEBUG + boot_scrub_done = true; +#endif + /* Now that the heap is initialized, run checks and set bounds * for the low mem virq algorithm. */ setup_low_mem_virq(); @@ -2195,12 +2251,16 @@ void free_domheap_pages(struct page_info *pg, unsigned int order) spin_unlock_recursive(&d->page_alloc_lock); +#ifndef CONFIG_SCRUB_DEBUG /* * Normally we expect a domain to clear pages before freeing them, * if it cares about the secrecy of their contents. However, after * a domain has died we assume responsibility for erasure. */ scrub = !!d->is_dying; +#else + scrub = true; +#endif } else { @@ -2292,7 +2352,8 @@ void scrub_one_page(struct page_info *pg) #ifndef NDEBUG /* Avoid callers relying on allocations returning zeroed pages. */ - unmap_domain_page(memset(__map_domain_page(pg), 0xc2, PAGE_SIZE)); + unmap_domain_page(memset(__map_domain_page(pg), + SCRUB_BYTE_PATTERN, PAGE_SIZE)); #else /* For a production build, clear_page() is the fastest way to scrub. */ clear_domain_page(_mfn(page_to_mfn(pg)));