From patchwork Tue May 7 11:34:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eslam Elnikety X-Patchwork-Id: 10932835 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4E86314DB for ; Tue, 7 May 2019 11:36:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38FDB28757 for ; Tue, 7 May 2019 11:36:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2BE892892E; Tue, 7 May 2019 11:36:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_ADSP_ALL, DKIM_INVALID,DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 52E4228757 for ; Tue, 7 May 2019 11:36:16 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hNyMV-00033F-HY; Tue, 07 May 2019 11:34:19 +0000 Received: from us1-rack-dfw2.inumbo.com ([104.130.134.6]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hNyMT-00033A-Vj for xen-devel@lists.xenproject.org; Tue, 07 May 2019 11:34:18 +0000 X-Inumbo-ID: 0bb14b21-70bc-11e9-843c-bc764e045a96 Received: from smtp-fw-9101.amazon.com (unknown [207.171.184.25]) by us1-rack-dfw2.inumbo.com (Halon) with ESMTPS id 0bb14b21-70bc-11e9-843c-bc764e045a96; Tue, 07 May 2019 11:34:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1557228856; x=1588764856; h=from:to:cc:subject:date:message-id:mime-version; bh=AsXdEHf9OsfLDTU2Wq2dl9o6XZrqQJVboWFSf4g7lNs=; b=TGqeUz2OtOvBvHRVaHn9kNc5JhWn5Un8/NUKL5Foe/rSzOOgDrmJu799 sl6lk5bR1YRZBnWmChJdL4gtnbLuTbyOXYZFQDo653ZoYNgFmXXuwjznH QShSEEv1weOFApFvjtlTXOyTS/jsLtYkeWMDxYnoXACZxBxwdQW0oLRzv M=; X-IronPort-AV: E=Sophos;i="5.60,441,1549929600"; d="scan'208";a="803287876" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-1d-f273de60.us-east-1.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 07 May 2019 11:34:13 +0000 Received: from EX13MTAUEA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-1d-f273de60.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id x47BY9sO120716 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 7 May 2019 11:34:10 GMT Received: from EX13D18EUA004.ant.amazon.com (10.43.165.164) by EX13MTAUEA001.ant.amazon.com (10.43.61.82) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 7 May 2019 11:34:10 +0000 Received: from EX13MTAUEA001.ant.amazon.com (10.43.61.82) by EX13D18EUA004.ant.amazon.com (10.43.165.164) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 7 May 2019 11:34:08 +0000 Received: from dev-dsk-elnikety-1c-28a13cba.eu-west-1.amazon.com (10.15.5.186) by mail-relay.amazon.com (10.43.61.243) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Tue, 7 May 2019 11:34:07 +0000 Received: by dev-dsk-elnikety-1c-28a13cba.eu-west-1.amazon.com (Postfix, from userid 6438462) id 91FAA463CF; Tue, 7 May 2019 11:34:07 +0000 (UTC) From: Eslam Elnikety To: Date: Tue, 7 May 2019 11:34:05 +0000 Message-ID: <20190507113405.71851-1-elnikety@amazon.com> X-Mailer: git-send-email 2.15.3.AMZN MIME-Version: 1.0 Precedence: Bulk Subject: [Xen-devel] [PATCH v2] mm: option to _always_ scrub freed domheap pages X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Stefano Stabellini , Wei Liu , Konrad Rzeszutek Wilk , George Dunlap , Andrew Cooper , Ian Jackson , Eslam Elnikety , Tim Deegan , Julien Grall , Jan Beulich , Amit Shah Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Give the administrator further control on when to scrub domheap pages by adding an option to always scrub. This is a safety feature that, when enabled, prevents a (buggy) domain from leaking secrets if it accidentally frees a page without proper scrubbing. Signed-off-by: Eslam Elnikety Acked-by: George Dunlap --- Changes in v2: - Renamed parameter to scrub-domheap, and now at the right place - Used "bool __read_mostly", no zero init, and correct comment style - Added George's A-b --- docs/misc/xen-command-line.pandoc | 8 ++++++++ xen/common/page_alloc.c | 9 +++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc index 6db82f302e..771333fc8a 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -1779,6 +1779,14 @@ sockets, &c. This will reduce performance somewhat, particularly on systems with hyperthreading enabled, but should reduce power by enabling more sockets and cores to go into deeper sleep states. +### scrub-domheap +> `= ` + +> Default: `false` + +Scrub domains' freed pages. This is a safety net against a (buggy) domain +accidentally leaking secrets by releasing pages without proper sanitization. + ### serial_tx_buffer > `= ` diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index be44158033..9c12d71fc1 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -214,6 +214,10 @@ custom_param("bootscrub", parse_bootscrub_param); static unsigned long __initdata opt_bootscrub_chunk = MB(128); size_param("bootscrub_chunk", opt_bootscrub_chunk); + /* scrub-domheap -> Domheap pages are scrubbed when freed */ +static bool __read_mostly opt_scrub_domheap; +boolean_param("scrub-domheap", opt_scrub_domheap); + #ifdef CONFIG_SCRUB_DEBUG static bool __read_mostly scrub_debug; #else @@ -2378,9 +2382,10 @@ void free_domheap_pages(struct page_info *pg, unsigned int order) /* * Normally we expect a domain to clear pages before freeing them, * if it cares about the secrecy of their contents. However, after - * a domain has died we assume responsibility for erasure. + * a domain has died we assume responsibility for erasure. We do + * scrub regardless if option scrub_domheap is set. */ - scrub = d->is_dying || scrub_debug; + scrub = d->is_dying || scrub_debug || opt_scrub_domheap; } else {