2014-07-17 00:27:33 +00:00
|
|
|
#
|
|
|
|
# The Qubes OS Project, http://www.qubes-os.org
|
|
|
|
#
|
|
|
|
# Copyright (C) 2015 Marek Marczykowski-Górecki
|
|
|
|
# <marmarek@invisiblethingslab.com>
|
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
# modify it under the terms of the GNU General Public License
|
|
|
|
# as published by the Free Software Foundation; either version 2
|
|
|
|
# of the License, or (at your option) any later version.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program; if not, write to the Free Software
|
|
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
|
|
#
|
|
|
|
|
|
|
|
Name: qubes-kernel-vm-support
|
2016-01-30 10:18:33 +00:00
|
|
|
Version: @VERSION@
|
2014-07-17 00:27:33 +00:00
|
|
|
Release: 1%{?dist}
|
2019-04-07 21:02:45 +00:00
|
|
|
Summary: Qubes VM initramfs modules
|
2016-01-30 10:18:33 +00:00
|
|
|
Source0: qubes-utils-%{version}.tar.gz
|
2014-07-17 00:27:33 +00:00
|
|
|
|
|
|
|
Group: Qubes
|
|
|
|
Vendor: Invisible Things Lab
|
|
|
|
License: GPL v2 only
|
|
|
|
URL: http://www.qubes-os.org
|
|
|
|
|
|
|
|
Requires: dracut
|
|
|
|
|
|
|
|
%description
|
|
|
|
This package contains:
|
|
|
|
1. Dracut module required to setup Qubes VM root filesystem. This package is
|
|
|
|
needed in VM only when the VM uses its own kernel (via pvgrub or so). Otherwise
|
|
|
|
initrd is provided by dom0.
|
|
|
|
|
|
|
|
%prep
|
2016-01-30 10:18:33 +00:00
|
|
|
%setup -q -n qubes-utils-%{version}
|
2014-07-17 00:27:33 +00:00
|
|
|
|
|
|
|
%install
|
2015-11-09 21:28:15 +00:00
|
|
|
make install-fedora-kernel-support DESTDIR=%{buildroot}
|
2014-07-17 00:27:33 +00:00
|
|
|
|
|
|
|
%files
|
|
|
|
/usr/lib/dracut/modules.d/90qubes-vm
|
2015-11-07 23:29:55 +00:00
|
|
|
/usr/lib/dracut/modules.d/90qubes-vm-modules
|
2015-03-21 03:14:01 +00:00
|
|
|
/usr/lib/dracut/modules.d/90qubes-vm-simple
|
2019-02-24 23:31:40 +00:00
|
|
|
/usr/lib/dracut/modules.d/80xen-scrub-pages
|
2015-03-20 09:36:56 +00:00
|
|
|
/usr/sbin/qubes-prepare-vm-kernel
|
Disable scrubbing memory pages during initial balloon down
Balloon driver scrub memory page before giving it back to the
hypervisor. Normally this is a good thing, to avoid leaking VM's memory
data into Xen and other domains. But during initial startup when maxmem
is bigger than initial memory, on HVM and PVH, Populate-on-Demand (PoD) is in use.
This means every page on initial balloon down needs to be first mapped
by Xen into VM's memory (as it wasn't populated before - and in fact
didn't have any data), scrubbed by the kernel and then given back to
Xen. This is great waste of time. Such operation with default settings
(initial memory 400M, maxmem 4000M) can take few seconds, delaying every
VM startup (including DispVM). In extreme situation, when running inside
nested virtualization, the effect is much worse.
Avoid this problem by disabling memory scrubbing during initial boot,
and re-enable it as soon as user space kicks in - in initramfs, before
mounting root filesystem, to be sure it's enabled before memory contains
any kind of secrets.
This commit handle only one case - when kernel in managed by the VM
itself. It is critical to enable initramfs module whenever
xen_scrub_pages=0 kernel option is given, so make them depend on the
same condition and ship them in the same package.
Fixes QubesOS/qubes-issues#1963
2019-01-18 22:53:20 +00:00
|
|
|
%config(noreplace) /etc/default/grub.qubes-kernel-vm-support
|
|
|
|
|
|
|
|
%triggerin -- grub2-tools
|
|
|
|
if ! grep -q '/etc/default/grub.qubes-kernel-vm-support$' /etc/default/grub 2>/dev/null; then
|
|
|
|
# do not keep Qubes-related settings directly in user-controlled config,
|
|
|
|
# include another file
|
|
|
|
echo '. /etc/default/grub.qubes-kernel-vm-support' >> /etc/default/grub
|
|
|
|
fi
|
2014-07-17 00:27:33 +00:00
|
|
|
|
|
|
|
%preun
|
Disable scrubbing memory pages during initial balloon down
Balloon driver scrub memory page before giving it back to the
hypervisor. Normally this is a good thing, to avoid leaking VM's memory
data into Xen and other domains. But during initial startup when maxmem
is bigger than initial memory, on HVM and PVH, Populate-on-Demand (PoD) is in use.
This means every page on initial balloon down needs to be first mapped
by Xen into VM's memory (as it wasn't populated before - and in fact
didn't have any data), scrubbed by the kernel and then given back to
Xen. This is great waste of time. Such operation with default settings
(initial memory 400M, maxmem 4000M) can take few seconds, delaying every
VM startup (including DispVM). In extreme situation, when running inside
nested virtualization, the effect is much worse.
Avoid this problem by disabling memory scrubbing during initial boot,
and re-enable it as soon as user space kicks in - in initramfs, before
mounting root filesystem, to be sure it's enabled before memory contains
any kind of secrets.
This commit handle only one case - when kernel in managed by the VM
itself. It is critical to enable initramfs module whenever
xen_scrub_pages=0 kernel option is given, so make them depend on the
same condition and ship them in the same package.
Fixes QubesOS/qubes-issues#1963
2019-01-18 22:53:20 +00:00
|
|
|
if [ $1 -eq 0 ]; then
|
|
|
|
if grep -q '/etc/default/grub.qubes-kernel-vm-support$' /etc/default/grub 2>/dev/null; then
|
|
|
|
sed -i -e '/grub.qubes-kernel-vm-support$/d' /etc/default/grub
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2019-02-25 00:17:07 +00:00
|
|
|
%posttrans
|
|
|
|
|
|
|
|
# Rebuild all initramfs images to include updated modules
|
|
|
|
if [ -r /usr/share/qubes/marker-vm ] && [ -x /usr/bin/dracut ]; then
|
|
|
|
ret=0
|
|
|
|
for img in /boot/initramfs-*.img; do
|
|
|
|
kver="${img#*initramfs-}"
|
|
|
|
kver="${kver%.img}"
|
|
|
|
dracut -f "$img" "$kver" || ret=$?
|
|
|
|
done
|
|
|
|
if [ "$ret" -eq 0 ]; then
|
|
|
|
# "milestone" initramfs update version:
|
|
|
|
# 1 - addition of xen scrub_pages enabling code
|
|
|
|
echo 1 > /var/lib/qubes/initramfs-updated
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2014-07-17 00:27:33 +00:00
|
|
|
%changelog
|
2018-04-03 19:29:52 +00:00
|
|
|
@CHANGELOG@
|