Hi,

KSM is a powerful tool for deduplicating memory, reducing usage by merging

identical pages across processes. However, there are certain interface and

implementation aspect that prevents its deployment in our use case; wherein

security and efficiency (CPU overhead - due to background scanning) are of

greater importance.

We propose Selective KSM, a mechanism to control when the merging takes

place and what pages can be merged together. We do this by partitioning the

merge-space as per security-domains and carryout the merging as part of a

synchronous syscall. Doing so, we ensure sensitive-content is not merged

with non-sensitive content.

Our overall goal is to optimize the memory utilization in a virtualized

environment, wherein there exists significant duplications across guest

instances (e.g., kernel). With the better ability of the operator to  group
pages

as per security and similarity, Selective KSM improves security and
efficiency.

Other than virtualized environments, we also want Selective KSM to work

well in containerized environments.

An example API could look like this ( Alternatively we can do it through
sysfs

without adding syscalls):

// This feature shall be gated by a KConfig: “CONFIG_SELECTIVE_KSM”

// Create a unique identifier known to userland.

char *ksm_name = “some_name”;

// ksm_open() creates and opens a new, or opens an existing, ksm partition
obj.

// flags is a bit mask to determine if the merging is sync, etc.

// KSM_SYNC: Carryout synchronous merging (no-background scanning).

// KSM_CREAT: Creates a KSM partition obj if it does not exist.

// KSM_EXCL: If KSM partition obj with name already exists and

// KSM_CREAT is also specified, return err.

// modes is used to handle permissions:

// O_RDONLY, O_WRONLY, O_RDWR, S_IRUSR, S_IWUSR, S_IXUSR

// On success, returns a file descriptor (a nonnegative integer) and
creates the

// sysfs path:

// /sys/kernel/mm/ksm/partition/<ksm_name>/

// On failure, it returns -1 and sets errno to indicate the error.

int ksm_fd = ksm_open(ksm_name, flag, mode);

// Destroy the name. The named object will be removed only after all open

// references are closed. On success, ksm_unlink() returns 0.

//  On failure, it returns -1 and sets errno to indicate the error.

ksm_unlink(ksm_name);

// Trigger merge. Only valid if KSM_SYNC is set during ksm_open().

ksm_merge(ksm_fd, pid, addr, size);

// Trigger unmerge. Only valid if KSM_SYNC is set during ksm_open().

ksm_unmerge(ksm_fd, pid, addr, size);

With regards,

Sourav Panda