linux-kernel - Re: [PATCH] xen/balloon: add runtime control for scrubbing ballooned out pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Sep 2018 22:31:28 +0200
From:   Marek Marczykowski-Górecki 
        <marmarek@...isiblethingslab.com>
To:     Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc:     xen-devel@...ts.xenproject.org, Juergen Gross <jgross@...e.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] xen/balloon: add runtime control for scrubbing ballooned
 out pages

On Thu, Sep 06, 2018 at 04:14:50PM -0400, Boris Ostrovsky wrote:
> On 09/06/2018 11:33 AM, Marek Marczykowski-Górecki wrote:
> > Scrubbing pages on initial balloon down can take some time, especially
> > in nested virtualization case (nested EPT is slow). When HVM/PVH guest is
> > started with memory= significantly lower than maxmem=, all the extra
> > pages will be scrubbed before returning to Xen. But since most of them
> > weren't used at all at that point, Xen needs to populate them first
> > (from populate-on-demand pool). In nested virt case (Xen inside KVM)
> > this slows down the guest boot by 15-30s with just 1.5GB needed to be
> > returned to Xen.
> >
> > Add runtime parameter to enable/disable it, to allow initially disabling
> > scrubbing, then enable it back during boot (for example in initramfs).
> > Such usage relies on assumption that a) most pages ballooned out during
> > initial boot weren't used at all, and b) even if they were, very few
> > secrets are in the guest at that time (before any serious userspace
> > kicks in).
> >
> > Default behaviour is unchanged.
> >
> > Signed-off-by: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>
> >
> > ---
> > Is module_param() a good thing for this? Other xen-balloon parameters are
> > in /sys/devices/system/xen_memory, so maybe it would make sense to put
> > this one there too? But then, cmdline parameter would need to be added
> > separately and comment about core_param() suggests it shouldn't be used
> > if not absolutely necessary (is it?).
> 
> 
> You can also use cmdline_find_option() in the balloon driver.
> 
> I would prefer that all tunables for the balloon driver live in the same
> place. (Note that in that case
> Documentation/ABI/stable/sysfs-devices-system-xen_memory will need to be
> updated).

Ok, will move that. This will also mean that it will affect only balloon
driver, not other users of mem-reservation.c (grant allocator). But
given the reason for this tunable, I think that's fine.

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)