* Re: [RFD] clear virtual machine memory when virtual machine is turned off [not found] <CAMgLiBskDz7XW9-0=azOgVJ00t8zFOXjdGaH7NLpKDfNH9wsGQ@mail.gmail.com> @ 2021-12-02 12:47 ` David Hildenbrand 2021-12-02 17:27 ` Mike Kravetz 2021-12-03 2:56 ` fei luo 0 siblings, 2 replies; 6+ messages in thread From: David Hildenbrand @ 2021-12-02 12:47 UTC (permalink / raw) To: fei luo, akpm, mike.kravetz, arnd, linux-kernel, linux-mm, linux-arch On 02.12.21 11:19, fei luo wrote: > Hi, > > When running the kvm virtual machine in Linux, because the virtual > > machine may contain sensitive data, the user may not want these > > data to remain in the memory after the virtual machine is turned off. > Hi, yes, just like if the VM is running. > > Although this part of memory will be cleared before being reused by > > user-mode programs , But the sensitive data staying in the memory > > for a long time will undoubtedly increase the risk of information leakage, > > so I wonder whether it is possible to add a flag (like MAP_UNMAPZERO) > > to the mmap(2) system call to indicate that the mapped memory needs > > to be cleared zero when unmap called or when the program exits. > it's not immediately clear to me why data of user space program #1 should be more important than data of user space program #2 and why the program should make that decision. > > Of course, the page clear operation not only occurs when unmap called > > or program exits, but also need to consider scenes such as page migration, > > swap, balloon etc. What about page migration (who clears the old memory location?), swapping (who clears the swap space, also considering zram?), writeback (who clears file storage)? Also, as you indicate, MADV_DONTNEED, MADV_FREE, FALLOC_FL_PUNCH_HOLE would need care ... To disable swapping you can use mlock(). To handle file storage ... don't use files. You'd still have to handle any cases where physical memory locations might be freed and land in the buddy, and for that we do have ... > > > When reusing the page that has been cleared, there is no need to clear it > > again, which also speeds up the memory allocation of user-mode programs. > > > Is this feature feasible? "init_on_free=1" for the system as a whole, which might sounds like what might tackle part of your use case. -- Thanks, David / dhildenb ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFD] clear virtual machine memory when virtual machine is turned off 2021-12-02 12:47 ` [RFD] clear virtual machine memory when virtual machine is turned off David Hildenbrand @ 2021-12-02 17:27 ` Mike Kravetz 2021-12-03 18:20 ` David Hildenbrand 2021-12-03 2:56 ` fei luo 1 sibling, 1 reply; 6+ messages in thread From: Mike Kravetz @ 2021-12-02 17:27 UTC (permalink / raw) To: David Hildenbrand, fei luo, akpm, arnd, linux-kernel, linux-mm, linux-arch Cc: Joao Martins On 12/2/21 04:47, David Hildenbrand wrote: > On 02.12.21 11:19, fei luo wrote: >> >> When reusing the page that has been cleared, there is no need to clear it >> >> again, which also speeds up the memory allocation of user-mode programs. >> >> >> Is this feature feasible? > > "init_on_free=1" for the system as a whole, which might sounds like what > might tackle part of your use case. > Certainly init_on_free will not make much difference if VMs are backed by hugetlb pages. We (Joao and myself) have thought about clearing hugetlb pages from user space in an attempt speed up launching of VMs backed by hugetlb pages. -- Mike Kravetz ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFD] clear virtual machine memory when virtual machine is turned off 2021-12-02 17:27 ` Mike Kravetz @ 2021-12-03 18:20 ` David Hildenbrand 0 siblings, 0 replies; 6+ messages in thread From: David Hildenbrand @ 2021-12-03 18:20 UTC (permalink / raw) To: Mike Kravetz, fei luo, akpm, arnd, linux-kernel, linux-mm, linux-arch Cc: Joao Martins On 02.12.21 18:27, Mike Kravetz wrote: > On 12/2/21 04:47, David Hildenbrand wrote: >> On 02.12.21 11:19, fei luo wrote: >>> >>> When reusing the page that has been cleared, there is no need to clear it >>> >>> again, which also speeds up the memory allocation of user-mode programs. >>> >>> >>> Is this feature feasible? >> >> "init_on_free=1" for the system as a whole, which might sounds like what >> might tackle part of your use case. >> > > Certainly init_on_free will not make much difference if VMs are backed by > hugetlb pages. We (Joao and myself) have thought about clearing hugetlb > pages from user space in an attempt speed up launching of VMs backed by > hugetlb pages. > I remember that discussion. And I also recall a discussion regarding extending init_on_free semantics to hugetlbfs. -- Thanks, David / dhildenb ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFD] clear virtual machine memory when virtual machine is turned off 2021-12-02 12:47 ` [RFD] clear virtual machine memory when virtual machine is turned off David Hildenbrand 2021-12-02 17:27 ` Mike Kravetz @ 2021-12-03 2:56 ` fei luo 2021-12-03 18:20 ` David Hildenbrand 1 sibling, 1 reply; 6+ messages in thread From: fei luo @ 2021-12-03 2:56 UTC (permalink / raw) To: david Cc: akpm, mike.kravetz, arnd, linux-kernel, linux-mm, linux-arch, xiaofeng.yan2012 David Hildenbrand <david@redhat.com> 于2021年12月2日周四 20:47写道： > > > > > Although this part of memory will be cleared before being reused by > > > > user-mode programs , But the sensitive data staying in the memory > > > > for a long time will undoubtedly increase the risk of information leakage, > > > > so I wonder whether it is possible to add a flag (like MAP_UNMAPZERO) > > > > to the mmap(2) system call to indicate that the mapped memory needs > > > > to be cleared zero when unmap called or when the program exits. > > > > it's not immediately clear to me why data of user space program #1 > should be more important than data of user space program #2 and why the > program should make that decision. > What I mean here is that by adding a flag to the mmap(2) system call to indicate that this memory will be cleared after munmap() called or the process exits, and no sensitive data will be left in the system memory, so as to avoid information leakage after the process exits.And the task of clearing memory needs to be done in the kernel > > > > Of course, the page clear operation not only occurs when unmap called > > > > or program exits, but also need to consider scenes such as page migration, > > > > swap, balloon etc. > > What about page migration (who clears the old memory location?), > swapping (who clears the swap space, also considering zram?), writeback > (who clears file storage)? Also, as you indicate, MADV_DONTNEED, > MADV_FREE, FALLOC_FL_PUNCH_HOLE would need care ... > > To disable swapping you can use mlock(). To handle file storage ... > don't use files. You'd still have to handle any cases where physical > memory locations might be freed and land in the buddy, and for that we > do have ... > Yes, this feature needs to consider when page migration, the content of the old page needs to be cleared, and the swap space needs to be cleared before swap. Of course, for security reasons, swap can be prohibited. Here I just listed some of the changes involved, not all aspects. This feature is mainly aimed at clearing the memory of the virtual machine after shutdown, so it is more aimed at anonymous mapping and huge page mapping > > > > > > When reusing the page that has been cleared, there is no need to clear it > > > > again, which also speeds up the memory allocation of user-mode programs. > > > > > > Is this feature feasible? > > "init_on_free=1" for the system as a whole, which might sounds like what > might tackle part of your use case. > This feature is mainly to prevent the used memory information from leaking, not to clear the memory before use. -- Thanks ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFD] clear virtual machine memory when virtual machine is turned off 2021-12-03 2:56 ` fei luo @ 2021-12-03 18:20 ` David Hildenbrand 0 siblings, 0 replies; 6+ messages in thread From: David Hildenbrand @ 2021-12-03 18:20 UTC (permalink / raw) To: fei luo Cc: akpm, mike.kravetz, arnd, linux-kernel, linux-mm, linux-arch, xiaofeng.yan2012 > Yes, this feature needs to consider when page migration, the content > of the old page needs to be cleared, and the swap space needs to > be cleared before swap. Of course, for security reasons, swap can be > prohibited. Here I just listed some of the changes involved, not all > aspects. This feature is mainly aimed at clearing the memory of > the virtual machine after shutdown, so it is more aimed at anonymous > mapping and huge page mapping > >>> >>> >>> When reusing the page that has been cleared, there is no need to clear it >>> >>> again, which also speeds up the memory allocation of user-mode programs. >>> >>> >>> Is this feature feasible? >> >> "init_on_free=1" for the system as a whole, which might sounds like what >> might tackle part of your use case. >> > > This feature is mainly to prevent the used memory information from leaking, > not to clear the memory before use. That's the whole purpose of init_on_free -- maybe you should give that a second look. I don't think MAP_UNMAPZERO is what we want. -- Thanks, David / dhildenb ^ permalink raw reply [flat|nested] 6+ messages in thread
* [RFD] Clear virtual machine memory when virtual machine is turned off @ 2021-12-02 10:41 fei luo 0 siblings, 0 replies; 6+ messages in thread From: fei luo @ 2021-12-02 10:41 UTC (permalink / raw) To: mike.kravetz, akpm, arnd, linux-kernel, linux-mm, linux-arch Hi, When running the kvm virtual machine in Linux, because the virtual machine may contain sensitive data, the user may not want this data to remain in the memory after the virtual machine is turned off. Although this part of memory will be cleared before being reused by user-mode programs , But the sensitive data staying in the memory for a long time will undoubtedly increase the risk of information leakage, So I wonder whether it is possible to add a flag (like MAP_UNMAPZERO) to the mmap(2) system call to indicate that the mapped memory needs to be cleared zero when munmap(2) called or when the program exits. Of course, the page clear operation not only occurs when munmap(2) called or program exits, but also needs to consider scenes such as page migration, swap, balloon etc. When reusing the page that has been cleared, there is no need to clear it again, which also speeds up the memory allocation of user-mode programs. Is this feature feasible? ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-12-03 18:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAMgLiBskDz7XW9-0=azOgVJ00t8zFOXjdGaH7NLpKDfNH9wsGQ@mail.gmail.com>
2021-12-02 12:47 ` [RFD] clear virtual machine memory when virtual machine is turned off David Hildenbrand
2021-12-02 17:27 ` Mike Kravetz
2021-12-03 18:20 ` David Hildenbrand
2021-12-03 2:56 ` fei luo
2021-12-03 18:20 ` David Hildenbrand
2021-12-02 10:41 [RFD] Clear " fei luo
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®