linux-kernel - Re: [PATCH] xen/balloon: add runtime control for scrubbing ballooned out pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Sep 2018 16:14:50 -0400
From:   Boris Ostrovsky <boris.ostrovsky@...cle.com>
To:     Marek Marczykowski-Górecki 
        <marmarek@...isiblethingslab.com>, xen-devel@...ts.xenproject.org
Cc:     Juergen Gross <jgross@...e.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] xen/balloon: add runtime control for scrubbing ballooned
 out pages

On 09/06/2018 11:33 AM, Marek Marczykowski-Górecki wrote:
> Scrubbing pages on initial balloon down can take some time, especially
> in nested virtualization case (nested EPT is slow). When HVM/PVH guest is
> started with memory= significantly lower than maxmem=, all the extra
> pages will be scrubbed before returning to Xen. But since most of them
> weren't used at all at that point, Xen needs to populate them first
> (from populate-on-demand pool). In nested virt case (Xen inside KVM)
> this slows down the guest boot by 15-30s with just 1.5GB needed to be
> returned to Xen.
>
> Add runtime parameter to enable/disable it, to allow initially disabling
> scrubbing, then enable it back during boot (for example in initramfs).
> Such usage relies on assumption that a) most pages ballooned out during
> initial boot weren't used at all, and b) even if they were, very few
> secrets are in the guest at that time (before any serious userspace
> kicks in).
>
> Default behaviour is unchanged.
>
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>
>
> ---
> Is module_param() a good thing for this? Other xen-balloon parameters are
> in /sys/devices/system/xen_memory, so maybe it would make sense to put
> this one there too? But then, cmdline parameter would need to be added
> separately and comment about core_param() suggests it shouldn't be used
> if not absolutely necessary (is it?).


You can also use cmdline_find_option() in the balloon driver.

I would prefer that all tunables for the balloon driver live in the same
place. (Note that in that case
Documentation/ABI/stable/sysfs-devices-system-xen_memory will need to be
updated).


-boris