Give the administrator further control on when to scrub domheap pages by adding
an option to always scrub. This is a safety feature that, when enabled,
prevents a (buggy) domain from leaking secrets if it accidentally frees a page
without proper scrubbing.
Signed-off-by: Eslam Elnikety <elnik...@amazon.com>
Acked-by: George Dunlap <george.dun...@citrix.com>
---
Changes in v2:
- Renamed parameter to scrub-domheap, and now at the right place
- Used "bool __read_mostly", no zero init, and correct comment style
- Added George's A-b
---
docs/misc/xen-command-line.pandoc | 8 ++++++++
xen/common/page_alloc.c | 9 +++++++--
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/docs/misc/xen-command-line.pandoc
b/docs/misc/xen-command-line.pandoc
index 6db82f302e..771333fc8a 100644
--- a/docs/misc/xen-command-line.pandoc
+++ b/docs/misc/xen-command-line.pandoc
@@ -1779,6 +1779,14 @@ sockets, &c. This will reduce performance somewhat,
particularly on
systems with hyperthreading enabled, but should reduce power by
enabling more sockets and cores to go into deeper sleep states.
+### scrub-domheap
+> `= <boolean>`
+
+> Default: `false`
+
+Scrub domains' freed pages. This is a safety net against a (buggy) domain
+accidentally leaking secrets by releasing pages without proper sanitization.
+
### serial_tx_buffer
> `= <size>`
diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index be44158033..9c12d71fc1 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -214,6 +214,10 @@ custom_param("bootscrub", parse_bootscrub_param);
static unsigned long __initdata opt_bootscrub_chunk = MB(128);
size_param("bootscrub_chunk", opt_bootscrub_chunk);
+ /* scrub-domheap -> Domheap pages are scrubbed when freed */
+static bool __read_mostly opt_scrub_domheap;
+boolean_param("scrub-domheap", opt_scrub_domheap);
+
#ifdef CONFIG_SCRUB_DEBUG
static bool __read_mostly scrub_debug;
#else
@@ -2378,9 +2382,10 @@ void free_domheap_pages(struct page_info *pg, unsigned
int order)
/*
* Normally we expect a domain to clear pages before freeing them,
* if it cares about the secrecy of their contents. However, after
- * a domain has died we assume responsibility for erasure.
+ * a domain has died we assume responsibility for erasure. We do
+ * scrub regardless if option scrub_domheap is set.
*/
- scrub = d->is_dying || scrub_debug;
+ scrub = d->is_dying || scrub_debug || opt_scrub_domheap;
}
else
{
--
2.15.3.AMZN
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
