linux-kernel - Re: [PATCH v3] xen/balloon: add runtime control for scrubbing ballooned out pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <36fd02b9-ba23-ddb6-787e-8dd30fca1319@suse.com>
Date:   Mon, 10 Sep 2018 13:31:30 +0200
From:   Juergen Gross <jgross@...e.com>
To:     Marek Marczykowski-Górecki 
        <marmarek@...isiblethingslab.com>, xen-devel@...ts.xenproject.org
Cc:     Jonathan Corbet <corbet@....net>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kai-Heng Feng <kai.heng.feng@...onical.com>,
        Thymo van Beers <thymovanbeers@...il.com>,
        Jiri Kosina <jkosina@...e.cz>,
        Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
        Frederic Weisbecker <frederic@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        open list <linux-kernel@...r.kernel.org>,
        "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>
Subject: Re: [PATCH v3] xen/balloon: add runtime control for scrubbing
 ballooned out pages

On 07/09/18 18:49, Marek Marczykowski-Górecki wrote:
> Scrubbing pages on initial balloon down can take some time, especially
> in nested virtualization case (nested EPT is slow). When HVM/PVH guest is
> started with memory= significantly lower than maxmem=, all the extra
> pages will be scrubbed before returning to Xen. But since most of them
> weren't used at all at that point, Xen needs to populate them first
> (from populate-on-demand pool). In nested virt case (Xen inside KVM)
> this slows down the guest boot by 15-30s with just 1.5GB needed to be
> returned to Xen.
> 
> Add runtime parameter to enable/disable it, to allow initially disabling
> scrubbing, then enable it back during boot (for example in initramfs).
> Such usage relies on assumption that a) most pages ballooned out during
> initial boot weren't used at all, and b) even if they were, very few
> secrets are in the guest at that time (before any serious userspace
> kicks in).
> Convert CONFIG_XEN_SCRUB_PAGES to CONFIG_XEN_SCRUB_PAGES_DEFAULT (also
> enabled by default), controlling default value for the new runtime
> switch.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>

Reviewed-by: Juergen Gross <jgross@...e.com>


Juergen