Add xen_scrub_pages=0 kernel option only if initramfs was rebuilt

Rebuild initramfs on package upgrade (already done for Debian
previously) and store 1 into /var/lib/qubes/initramfs-updated. Then,
only add xen_scrub_pages=0 kernel option if
/var/lib/qubes/initramfs-updated is there (with "1" or greater number).
This way, if initramfs rebuild doesn't happen for any reason,
xen_scrub_pages=0 will not be added.

Fixes 456fe99 "Disable scrubbing memory pages during initial balloon down"
QubesOS/qubes-issues#1963

debian/qubes-kernel-vm-support.postinst

@@ -23,7 +23,11 @@ set -e
 case "${1}" in
     configure)
         if [ -x /usr/sbin/update-initramfs ]; then
-            update-initramfs -u
+            if update-initramfs -u; then
+                # "milestone" initramfs update version:
+                # 1 - addition of xen scrub_pages enabling code
+                echo 1 > /var/lib/qubes/initramfs-updated
+            fi
         fi
         ;;
 

dracut/Makefile

@@ -2,3 +2,4 @@ install:
 	$(MAKE) -C simple
 	$(MAKE) -C full-dmroot
 	$(MAKE) -C full-modules
+	$(MAKE) -C xen-balloon-scrub-pages

grub/grub.qubes-kernel-vm-support

@@ -1,5 +1,8 @@
-# add kernel options only in VM
-if [ -r /usr/share/qubes/marker-vm ]; then
+# add kernel options only in VM, and only if initramfs is updated already
+# /var/lib/qubes/initramfs-updated contains "milestone" initramfs update version:
+# 1 - addition of xen scrub_pages enabling code
+if [ -r /usr/share/qubes/marker-vm ] &&
+        [ "$(cat /var/lib/qubes/initramfs-updated 2>/dev/null || echo 0)" -ge 1 ]; then
     GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX xen_scrub_pages=0"
 fi
 

rpm_spec/qubes-kernel-vm-support.spec.in

@@ -52,6 +52,7 @@ make install-fedora-kernel-support DESTDIR=%{buildroot}
 /usr/lib/dracut/modules.d/90qubes-vm
 /usr/lib/dracut/modules.d/90qubes-vm-modules
 /usr/lib/dracut/modules.d/90qubes-vm-simple
+/usr/lib/dracut/modules.d/80xen-scrub-pages
 /usr/src/u2mfn-%{version}/
 /usr/sbin/qubes-prepare-vm-kernel
 %config(noreplace) /etc/default/grub.qubes-kernel-vm-support
@@ -75,5 +76,22 @@ if [ $1 -eq 0 ]; then
     fi
 fi
 
+%posttrans
+
+# Rebuild all initramfs images to include updated modules
+if [ -r /usr/share/qubes/marker-vm ] && [ -x /usr/bin/dracut ]; then
+    ret=0
+    for img in /boot/initramfs-*.img; do
+        kver="${img#*initramfs-}"
+        kver="${kver%.img}"
+        dracut -f "$img" "$kver" || ret=$?
+    done
+    if [ "$ret" -eq 0 ]; then
+        # "milestone" initramfs update version:
+        # 1 - addition of xen scrub_pages enabling code
+        echo 1 > /var/lib/qubes/initramfs-updated
+    fi
+fi
+
 %changelog
 @CHANGELOG@