From patchwork Tue Aug 8 21:45:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Ostrovsky X-Patchwork-Id: 9889133 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C69CD603F2 for ; Tue, 8 Aug 2017 21:46:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B92F02890F for ; Tue, 8 Aug 2017 21:46:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ADF3F2892F; Tue, 8 Aug 2017 21:46:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 2078328A30 for ; Tue, 8 Aug 2017 21:46:10 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dfCHC-000837-KC; Tue, 08 Aug 2017 21:42:58 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dfCHB-00081h-C2 for xen-devel@lists.xen.org; Tue, 08 Aug 2017 21:42:57 +0000 Received: from [85.158.137.68] by server-4.bemta-3.messagelabs.com id 97/FA-04533-0603A895; Tue, 08 Aug 2017 21:42:56 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupgkeJIrShJLcpLzFFi42KZM10+UDfeoCv S4MYlSYslHxezODB6HN39mymAMYo1My8pvyKBNaN79zGmgh2qFUfnPmRrYGyX7WLk4hASmMQk 0ftvNQuE84dR4mP7J1YIZz2jxLP2ViYIp4dRYt3jG2xdjJwcbAJGEmePTmcEsUUEpCWufb7MC FLELDCNSWLvt3dgCWEBC4nlm+cDzeXgYBFQlZj3SRIkzCvgLbF2wRuwEgkBBYkpD98zg9icQP GZF/6ygNhCAl4SMyZPZYaoMZZof3uRbQIj3wJGhlWM6sWpRWWpRbqWeklFmekZJbmJmTm6hgb GermpxcWJ6ak5iUnFesn5uZsYgaFSz8DAuIPx9U+nQ4ySHExKorybtDsjhfiS8lMqMxKLM+KL SnNSiw8xynBwKEnwsut3RQoJFqWmp1akZeYAgxYmLcHBoyTCyw2S5i0uSMwtzkyHSJ1i1OV4N eH/NyYhlrz8vFQpcd4skCIBkKKM0jy4EbAIusQoKyXMy8jAwCDEU5BalJtZgir/ilGcg1FJmD cOZApPZl4J3KZXQEcwAR0R4dsJckRJIkJKqoFRvWMGu3HT/sJK/tKdQV9d1yyL3+L7s/nCzNw XYU8V5kiuzg39dUxvz1/Htl2P3jvsLV3IOvlo4bpnTukdm0Q/Ptrtcff6c+Pp218Xrjr66xDb 3+M14fKyZYs8JnznX75ojdPGyjtrg5nm6yzcOSUmqYHP0zMu55vmitfz3vncF8n6u2Wt8q19T EosxRmJhlrMRcWJAGX+snObAgAA X-Env-Sender: boris.ostrovsky@oracle.com X-Msg-Ref: server-2.tower-31.messagelabs.com!1502228573!97475506!1 X-Originating-IP: [156.151.31.81] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogMTU2LjE1MS4zMS44MSA9PiAyODgzMzk=\n X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 65003 invoked from network); 8 Aug 2017 21:42:55 -0000 Received: from userp1040.oracle.com (HELO userp1040.oracle.com) (156.151.31.81) by server-2.tower-31.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 8 Aug 2017 21:42:55 -0000 Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v78Lgkm6032432 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 8 Aug 2017 21:42:47 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v78Lgk5p027859 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 8 Aug 2017 21:42:46 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v78Lgjim002137; Tue, 8 Aug 2017 21:42:45 GMT Received: from ovs104.us.oracle.com (/10.149.76.204) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 08 Aug 2017 14:42:45 -0700 From: Boris Ostrovsky To: xen-devel@lists.xen.org Date: Tue, 8 Aug 2017 17:45:07 -0400 Message-Id: <1502228707-31883-10-git-send-email-boris.ostrovsky@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1502228707-31883-1-git-send-email-boris.ostrovsky@oracle.com> References: <1502228707-31883-1-git-send-email-boris.ostrovsky@oracle.com> X-Source-IP: aserv0022.oracle.com [141.146.126.234] Cc: sstabellini@kernel.org, wei.liu2@citrix.com, George.Dunlap@eu.citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, tim@xen.org, julien.grall@arm.com, jbeulich@suse.com, Boris Ostrovsky Subject: [Xen-devel] [PATCH v7 9/9] mm: Make sure pages are scrubbed X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Add a debug Kconfig option that will make page allocator verify that pages that were supposed to be scrubbed are, in fact, clean. Signed-off-by: Boris Ostrovsky Reviewed-by: Jan Beulich --- xen/Kconfig.debug | 7 ++++++ xen/common/page_alloc.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 69 insertions(+), 1 deletion(-) diff --git a/xen/Kconfig.debug b/xen/Kconfig.debug index 689f297..195d504 100644 --- a/xen/Kconfig.debug +++ b/xen/Kconfig.debug @@ -114,6 +114,13 @@ config DEVICE_TREE_DEBUG logged in the Xen ring buffer. If unsure, say N here. +config SCRUB_DEBUG + bool "Page scrubbing test" + default DEBUG + ---help--- + Verify that pages that need to be scrubbed before being allocated to + a guest are indeed scrubbed. + endif # DEBUG || EXPERT endmenu diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 675ac0d..83eaffb 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -170,6 +170,10 @@ boolean_param("bootscrub", opt_bootscrub); static unsigned long __initdata opt_bootscrub_chunk = MB(128); size_param("bootscrub_chunk", opt_bootscrub_chunk); +#ifdef CONFIG_SCRUB_DEBUG +static bool __read_mostly boot_scrub_done; +#endif + /* * Bit width of the DMA heap -- used to override NUMA-node-first. * allocation strategy, which can otherwise exhaust low memory. @@ -698,6 +702,43 @@ static void page_list_add_scrub(struct page_info *pg, unsigned int node, page_list_add(pg, &heap(node, zone, order)); } +/* SCRUB_PATTERN needs to be a repeating series of bytes. */ +#ifndef NDEBUG +#define SCRUB_PATTERN 0xc2c2c2c2c2c2c2c2ULL +#else +#define SCRUB_PATTERN 0ULL +#endif +#define SCRUB_BYTE_PATTERN (SCRUB_PATTERN & 0xff) + +static void poison_one_page(struct page_info *pg) +{ +#ifdef CONFIG_SCRUB_DEBUG + mfn_t mfn = _mfn(page_to_mfn(pg)); + uint64_t *ptr; + + ptr = map_domain_page(mfn); + *ptr = ~SCRUB_PATTERN; + unmap_domain_page(ptr); +#endif +} + +static void check_one_page(struct page_info *pg) +{ +#ifdef CONFIG_SCRUB_DEBUG + mfn_t mfn = _mfn(page_to_mfn(pg)); + const uint64_t *ptr; + unsigned int i; + + if ( !boot_scrub_done ) + return; + + ptr = map_domain_page(mfn); + for ( i = 0; i < PAGE_SIZE / sizeof (*ptr); i++ ) + ASSERT(ptr[i] == SCRUB_PATTERN); + unmap_domain_page(ptr); +#endif +} + static void check_and_stop_scrub(struct page_info *head) { if ( head->u.free.scrub_state == BUDDY_SCRUBBING ) @@ -932,6 +973,9 @@ static struct page_info *alloc_heap_pages( * guest can control its own visibility of/through the cache. */ flush_page_to_ram(page_to_mfn(&pg[i]), !(memflags & MEMF_no_icache_flush)); + + if ( !(memflags & MEMF_no_scrub) ) + check_one_page(&pg[i]); } spin_unlock(&heap_lock); @@ -1295,7 +1339,10 @@ static void free_heap_pages( set_gpfn_from_mfn(mfn + i, INVALID_M2P_ENTRY); if ( need_scrub ) + { pg[i].count_info |= PGC_need_scrub; + poison_one_page(&pg[i]); + } } avail[node][zone] += 1 << order; @@ -1655,7 +1702,12 @@ static void init_heap_pages( nr_pages -= n; } +#ifndef CONFIG_SCRUB_DEBUG free_heap_pages(pg + i, 0, false); +#else + free_heap_pages(pg + i, 0, boot_scrub_done); +#endif + } } @@ -1921,6 +1973,10 @@ void __init scrub_heap_pages(void) printk("done.\n"); +#ifdef CONFIG_SCRUB_DEBUG + boot_scrub_done = true; +#endif + /* Now that the heap is initialized, run checks and set bounds * for the low mem virq algorithm. */ setup_low_mem_virq(); @@ -2194,12 +2250,16 @@ void free_domheap_pages(struct page_info *pg, unsigned int order) spin_unlock_recursive(&d->page_alloc_lock); +#ifndef CONFIG_SCRUB_DEBUG /* * Normally we expect a domain to clear pages before freeing them, * if it cares about the secrecy of their contents. However, after * a domain has died we assume responsibility for erasure. */ scrub = !!d->is_dying; +#else + scrub = true; +#endif } else { @@ -2291,7 +2351,8 @@ void scrub_one_page(struct page_info *pg) #ifndef NDEBUG /* Avoid callers relying on allocations returning zeroed pages. */ - unmap_domain_page(memset(__map_domain_page(pg), 0xc2, PAGE_SIZE)); + unmap_domain_page(memset(__map_domain_page(pg), + SCRUB_BYTE_PATTERN, PAGE_SIZE)); #else /* For a production build, clear_page() is the fastest way to scrub. */ clear_domain_page(_mfn(page_to_mfn(pg)));