Commit 197ecb38 authored by Marek Marczykowski-Górecki's avatar Marek Marczykowski-Górecki Committed by Boris Ostrovsky

xen/balloon: add runtime control for scrubbing ballooned out pages

Scrubbing pages on initial balloon down can take some time, especially
in nested virtualization case (nested EPT is slow). When HVM/PVH guest is
started with memory= significantly lower than maxmem=, all the extra
pages will be scrubbed before returning to Xen. But since most of them
weren't used at all at that point, Xen needs to populate them first
(from populate-on-demand pool). In nested virt case (Xen inside KVM)
this slows down the guest boot by 15-30s with just 1.5GB needed to be
returned to Xen.

Add runtime parameter to enable/disable it, to allow initially disabling
scrubbing, then enable it back during boot (for example in initramfs).
Such usage relies on assumption that a) most pages ballooned out during
initial boot weren't used at all, and b) even if they were, very few
secrets are in the guest at that time (before any serious userspace
kicks in).
enabled by default), controlling default value for the new runtime
Signed-off-by: default avatarMarek Marczykowski-Górecki <>
Reviewed-by: default avatarJuergen Gross <>
Signed-off-by: default avatarBoris Ostrovsky <>
parent 87dffe86
......@@ -75,3 +75,12 @@ Contact: Konrad Rzeszutek Wilk <>
Amount (in KiB) of low (or normal) memory in the
What: /sys/devices/system/xen_memory/xen_memory0/scrub_pages
Date: September 2018
KernelVersion: 4.20
Control scrubbing pages before returning them to Xen for others domains
use. Can be set with xen_scrub_pages cmdline
parameter. Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.
......@@ -5000,6 +5000,12 @@
Disables the PV optimizations forcing the HVM guest to
run as generic HVM guest with no PV drivers.
xen_scrub_pages= [XEN]
Boolean option to control scrubbing pages before giving them back
to Xen, for use by other domains. Can be also changed at runtime
with /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.
xirc2ps_cs= [NET,PCMCIA]
......@@ -79,15 +79,19 @@ config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
This value is used to allocate enough space in internal
tables needed for physical memory administration.
bool "Scrub pages before returning them to system"
bool "Scrub pages before returning them to system by default"
depends on XEN_BALLOON
default y
Scrub pages before returning them to the system for reuse by
other domains. This makes sure that any confidential data
is not accidentally visible to other domains. Is it more
secure, but slightly less efficient.
secure, but slightly less efficient. This can be controlled with
xen_scrub_pages=0 parameter and
This option only sets the default value.
If in doubt, say yes.
......@@ -14,6 +14,10 @@
#include <xen/interface/memory.h>
#include <xen/mem-reservation.h>
#include <linux/moduleparam.h>
bool __read_mostly xen_scrub_pages = IS_ENABLED(CONFIG_XEN_SCRUB_PAGES_DEFAULT);
core_param(xen_scrub_pages, xen_scrub_pages, bool, 0);
* Use one extent per PAGE_SIZE to avoid to break down the page into
......@@ -44,6 +44,7 @@
#include <xen/xenbus.h>
#include <xen/features.h>
#include <xen/page.h>
#include <xen/mem-reservation.h>
#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
......@@ -137,6 +138,7 @@ static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay);
static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);
static DEVICE_ULONG_ATTR(retry_count, 0444, balloon_stats.retry_count);
static DEVICE_ULONG_ATTR(max_retry_count, 0644, balloon_stats.max_retry_count);
static DEVICE_BOOL_ATTR(scrub_pages, 0644, xen_scrub_pages);
static ssize_t show_target_kb(struct device *dev, struct device_attribute *attr,
char *buf)
......@@ -203,6 +205,7 @@ static struct attribute *balloon_attrs[] = {
......@@ -17,11 +17,12 @@
#include <xen/page.h>
extern bool xen_scrub_pages;
static inline void xenmem_reservation_scrub_page(struct page *page)
if (xen_scrub_pages)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment