Commit 197ecb38 authored by Marek Marczykowski-Górecki's avatar Marek Marczykowski-Górecki Committed by Boris Ostrovsky
Browse files

xen/balloon: add runtime control for scrubbing ballooned out pages 



Scrubbing pages on initial balloon down can take some time, especially
in nested virtualization case (nested EPT is slow). When HVM/PVH guest is
started with memory= significantly lower than maxmem=, all the extra
pages will be scrubbed before returning to Xen. But since most of them
weren't used at all at that point, Xen needs to populate them first
(from populate-on-demand pool). In nested virt case (Xen inside KVM)
this slows down the guest boot by 15-30s with just 1.5GB needed to be
returned to Xen.

Add runtime parameter to enable/disable it, to allow initially disabling
scrubbing, then enable it back during boot (for example in initramfs).
Such usage relies on assumption that a) most pages ballooned out during
initial boot weren't used at all, and b) even if they were, very few
secrets are in the guest at that time (before any serious userspace
kicks in).
Convert CONFIG_XEN_SCRUB_PAGES to CONFIG_XEN_SCRUB_PAGES_DEFAULT (also
enabled by default), controlling default value for the new runtime
switch.

Signed-off-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
parent 87dffe86

Documentation/ABI/stable/sysfs-devices-system-xen_memory

+9 −0
Original line number Original line Diff line number Diff line
@@ -75,3 +75,12 @@ Contact: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> 
Description:

Description:

		Amount (in KiB) of low (or normal) memory in the

		Amount (in KiB) of low (or normal) memory in the

		balloon.

		balloon.



What:		/sys/devices/system/xen_memory/xen_memory0/scrub_pages

Date:		September 2018

KernelVersion:	4.20

Contact:	xen-devel@lists.xenproject.org

Description:

		Control scrubbing pages before returning them to Xen for others domains

		use. Can be set with xen_scrub_pages cmdline

		parameter. Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.

Documentation/admin-guide/kernel-parameters.txt

+6 −0
Original line number Original line Diff line number Diff line
@@ -5000,6 +5000,12 @@ 
			Disables the PV optimizations forcing the HVM guest to

			Disables the PV optimizations forcing the HVM guest to

			run as generic HVM guest with no PV drivers.

			run as generic HVM guest with no PV drivers.





	xen_scrub_pages=	[XEN]

			Boolean option to control scrubbing pages before giving them back

			to Xen, for use by other domains. Can be also changed at runtime

			with /sys/devices/system/xen_memory/xen_memory0/scrub_pages.

			Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.



	xirc2ps_cs=	[NET,PCMCIA]

	xirc2ps_cs=	[NET,PCMCIA]

			Format:

			Format:

			<irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]

			<irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]

drivers/xen/Kconfig

+7 −3
Original line number Original line Diff line number Diff line
@@ -79,15 +79,19 @@ config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT 
	  This value is used to allocate enough space in internal

	  This value is used to allocate enough space in internal

	  tables needed for physical memory administration.

	  tables needed for physical memory administration.





config XEN_SCRUB_PAGES

config XEN_SCRUB_PAGES_DEFAULT

	bool "Scrub pages before returning them to system"

	bool "Scrub pages before returning them to system by default"

	depends on XEN_BALLOON

	depends on XEN_BALLOON

	default y

	default y

	help

	help

	  Scrub pages before returning them to the system for reuse by

	  Scrub pages before returning them to the system for reuse by

	  other domains.  This makes sure that any confidential data

	  other domains.  This makes sure that any confidential data

	  is not accidentally visible to other domains.  Is it more

	  is not accidentally visible to other domains.  Is it more

	  secure, but slightly less efficient.

	  secure, but slightly less efficient. This can be controlled with

	  xen_scrub_pages=0 parameter and

	  /sys/devices/system/xen_memory/xen_memory0/scrub_pages.

	  This option only sets the default value.



	  If in doubt, say yes.

	  If in doubt, say yes.





config XEN_DEV_EVTCHN

config XEN_DEV_EVTCHN

drivers/xen/mem-reservation.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -14,6 +14,10 @@ 




#include <xen/interface/memory.h>

#include <xen/interface/memory.h>

#include <xen/mem-reservation.h>

#include <xen/mem-reservation.h>

#include <linux/moduleparam.h>



bool __read_mostly xen_scrub_pages = IS_ENABLED(CONFIG_XEN_SCRUB_PAGES_DEFAULT);

core_param(xen_scrub_pages, xen_scrub_pages, bool, 0);





/*

/*

 * Use one extent per PAGE_SIZE to avoid to break down the page into

 * Use one extent per PAGE_SIZE to avoid to break down the page into

drivers/xen/xen-balloon.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -44,6 +44,7 @@ 
#include <xen/xenbus.h>

#include <xen/xenbus.h>

#include <xen/features.h>

#include <xen/features.h>

#include <xen/page.h>

#include <xen/page.h>

#include <xen/mem-reservation.h>





#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))

#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
@@ -137,6 +138,7 @@ static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay); 
static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);

static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);

static DEVICE_ULONG_ATTR(retry_count, 0444, balloon_stats.retry_count);

static DEVICE_ULONG_ATTR(retry_count, 0444, balloon_stats.retry_count);

static DEVICE_ULONG_ATTR(max_retry_count, 0644, balloon_stats.max_retry_count);

static DEVICE_ULONG_ATTR(max_retry_count, 0644, balloon_stats.max_retry_count);

static DEVICE_BOOL_ATTR(scrub_pages, 0644, xen_scrub_pages);





static ssize_t show_target_kb(struct device *dev, struct device_attribute *attr,

static ssize_t show_target_kb(struct device *dev, struct device_attribute *attr,

			      char *buf)

			      char *buf)
@@ -203,6 +205,7 @@ static struct attribute *balloon_attrs[] = { 
	&dev_attr_max_schedule_delay.attr.attr,

	&dev_attr_max_schedule_delay.attr.attr,

	&dev_attr_retry_count.attr.attr,

	&dev_attr_retry_count.attr.attr,

	&dev_attr_max_retry_count.attr.attr,

	&dev_attr_max_retry_count.attr.attr,

	&dev_attr_scrub_pages.attr.attr,

	NULL

	NULL

};

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE