From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C844EC3DA7A for ; Thu, 5 Jan 2023 21:58:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236125AbjAEV6i (ORCPT ); Thu, 5 Jan 2023 16:58:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42216 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235590AbjAEV6M (ORCPT ); Thu, 5 Jan 2023 16:58:12 -0500 Received: from smtp3-g21.free.fr (smtp3-g21.free.fr [212.27.42.3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B42D67BEF; Thu, 5 Jan 2023 13:58:10 -0800 (PST) Received: from [IPV6:2a01:e35:39f2:1220:c70:c024:95ee:ebbb] (unknown [IPv6:2a01:e35:39f2:1220:c70:c024:95ee:ebbb]) by smtp3-g21.free.fr (Postfix) with ESMTPS id C4DD413F846; Thu, 5 Jan 2023 22:57:48 +0100 (CET) Message-ID: <10302240-51ec-0854-2c86-16752d67a9be@opteya.com> Date: Thu, 5 Jan 2023 22:57:48 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.4.2 Subject: Re: [PATCH v14 2/7] mm: add VM_DROPPABLE for designating always lazily freeable mappings Content-Language: fr-FR To: "Jason A. Donenfeld" , Linus Torvalds Cc: Andy Lutomirski , Ingo Molnar , linux-kernel@vger.kernel.org, patches@lists.linux.dev, tglx@linutronix.de, linux-crypto@vger.kernel.org, linux-api@vger.kernel.org, x86@kernel.org, Greg Kroah-Hartman , Adhemerval Zanella Netto , Carlos O'Donell , Florian Weimer , Arnd Bergmann , Jann Horn , Christian Brauner , linux-mm@kvack.org References: <20230101162910.710293-1-Jason@zx2c4.com> <20230101162910.710293-3-Jason@zx2c4.com> From: Yann Droneaud Organization: OPTEYA In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org Hi, Le 03/01/2023 à 21:44, Jason A. Donenfeld a écrit : > On Tue, Jan 03, 2023 at 12:15:57PM -0800, Linus Torvalds wrote: >> On Tue, Jan 3, 2023 at 12:03 PM Jason A. Donenfeld wrote: >>> That buffering cannot be done safely currently >> .. again, this is "your semantics" (the (b) in my humbug list), not >> necessarily reality for anybody else. > Yea that's fair. Except, of course, I maintain that my semantics are > important ones. :) I concur. To hold secret material, we need MADV_WIPEONFORK | MADV_DONTDUMP and the side effect of mlock() (pages' content never written to swap), inherited across fork(). And I want mlock() without paying the price. Jason's proposed semantics, which I call MADV_WIPEONSWAP, provide a mean to hold /unlimited/ amount secrets in userspace memory (not limited by RLIMIT_MEMLOCK). The only constraint for userspace is to handle the case pages are wiped, which is already the case of userspace arc4random()'s implementation. Regards. -- Yann Droneaud OPTEYA