Re: [RFC PATCH] mm: extend memfd with ability to create "secret" memory areas

2020-08-26 Thread Florian Weimer
* Andy Lutomirski: >> I _believe_ there are also things like AES-NI that can get strong >> protection from stuff like this. They load encryption keys into (AVX) >> registers and then can do encrypt/decrypt operations without the keys >> leaving the registers. If the key was loaded from a secret

Re: [RFC PATCH] mm: extend memfd with ability to create "secret" memory areas

2020-08-26 Thread Andy Lutomirski
On Fri, Aug 14, 2020 at 11:09 AM Dave Hansen wrote: > > On 8/14/20 10:46 AM, Andy Lutomirski wrote: > > I'm a little unconvinced about the security benefits. As far as I > > know, UC memory will not end up in cache by any means (unless > > aliased), but it's going to be tough to do much with UC

Re: [RFC PATCH] mm: extend memfd with ability to create "secret" memory areas

2020-08-14 Thread Dave Hansen
On 8/14/20 10:46 AM, Andy Lutomirski wrote: > I'm a little unconvinced about the security benefits. As far as I > know, UC memory will not end up in cache by any means (unless > aliased), but it's going to be tough to do much with UC data with > anything resembling reasonable performance without

Re: [RFC PATCH] mm: extend memfd with ability to create "secret" memory areas

2020-08-14 Thread Andy Lutomirski
On Thu, Jan 30, 2020 at 8:23 AM Mike Rapoport wrote: > > Hi, > > This is essentially a resend of my attempt to implement "secret" mappings > using a file descriptor [1]. > > I've done a couple of experiments with secret/exclusive/whatever > memory backed by a file-descriptor using a chardev and