From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B5A4C433E2 for ; Mon, 20 Jul 2020 17:47:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D3E8D20709 for ; Mon, 20 Jul 2020 17:47:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="YlqRcxTu" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D3E8D20709 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2C8D56B0002; Mon, 20 Jul 2020 13:47:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 252636B0005; Mon, 20 Jul 2020 13:47:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 119CA6B0006; Mon, 20 Jul 2020 13:47:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0104.hostedemail.com [216.40.44.104]) by kanga.kvack.org (Postfix) with ESMTP id ECC666B0002 for ; Mon, 20 Jul 2020 13:47:39 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 6A4008114CCD for ; Mon, 20 Jul 2020 17:47:39 +0000 (UTC) X-FDA: 77059186638.17.money25_510beec26f26 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id D1C53181355C1 for ; Mon, 20 Jul 2020 17:47:06 +0000 (UTC) X-HE-Tag: money25_510beec26f26 X-Filterd-Recvd-Size: 6003 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf43.hostedemail.com (Postfix) with ESMTP for ; Mon, 20 Jul 2020 17:47:06 +0000 (UTC) Received: from kernel.org (unknown [87.71.40.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 45F9D20709; Mon, 20 Jul 2020 17:46:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1595267225; bh=h7xTJHL3tD3hyqROKlN47q+7JtwYj6iU2IDwcwmnD10=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=YlqRcxTuXQfRrbeqatLbuRaOeADiac4H6X9sEArUzE5oRMfR8PHkKo5MsS8CqIiH2 30gUB8awpWvMVLHqbmwCRcCebqbRb3WB5zVyQMWCeasxnsnHVcByE17hsBPHomNYe/ 2IYK/lsU5KfUy43NS89poYLzWTie5RjpZ+F0ezt8= Date: Mon, 20 Jul 2020 20:46:50 +0300 From: Mike Rapoport To: Arnd Bergmann Cc: "linux-kernel@vger.kernel.org" , Alexander Viro , Andrew Morton , Andy Lutomirski , Borislav Petkov , Catalin Marinas , Christopher Lameter , Dan Williams , Dave Hansen , Elena Reshetova , "H. Peter Anvin" , Idan Yaniv , Ingo Molnar , James Bottomley , "Kirill A. Shutemov" , Matthew Wilcox , Mike Rapoport , Palmer Dabbelt , Paul Walmsley , Peter Zijlstra , Thomas Gleixner , Tycho Andersen , Will Deacon , Linux API , linux-arch , Linux ARM , Linux FS-devel Mailing List , Linux-MM , linux-nvdimm@lists.01.org, linux-riscv , the arch/x86 maintainers , linaro-mm-sig@lists.linaro.org, Sumit Semwal Subject: Re: [PATCH 3/6] mm: introduce secretmemfd system call to create "secret" memory areas Message-ID: <20200720174650.GD8593@kernel.org> References: <20200720092435.17469-1-rppt@kernel.org> <20200720092435.17469-4-rppt@kernel.org> <20200720142053.GC8593@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: D1C53181355C1 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam05 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jul 20, 2020 at 04:34:12PM +0200, Arnd Bergmann wrote: > On Mon, Jul 20, 2020 at 4:21 PM Mike Rapoport wrote: > > On Mon, Jul 20, 2020 at 01:30:13PM +0200, Arnd Bergmann wrote: > > > On Mon, Jul 20, 2020 at 11:25 AM Mike Rapoport wrote: > > > > > > > > From: Mike Rapoport > > > > > > > > Introduce "secretmemfd" system call with the ability to create memory areas > > > > visible only in the context of the owning process and not mapped not only > > > > to other processes but in the kernel page tables as well. > > > > > > > > The user will create a file descriptor using the secretmemfd system call > > > > where flags supplied as a parameter to this system call will define the > > > > desired protection mode for the memory associated with that file > > > > descriptor. Currently there are two protection modes: > > > > > > > > * exclusive - the memory area is unmapped from the kernel direct map and it > > > > is present only in the page tables of the owning mm. > > > > * uncached - the memory area is present only in the page tables of the > > > > owning mm and it is mapped there as uncached. > > > > > > > > For instance, the following example will create an uncached mapping (error > > > > handling is omitted): > > > > > > > > fd = secretmemfd(SECRETMEM_UNCACHED); > > > > ftruncate(fd, MAP_SIZE); > > > > ptr = mmap(NULL, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, > > > > fd, 0); > > > > > > > > Signed-off-by: Mike Rapoport > > > > > > I wonder if this should be more closely related to dmabuf file > > > descriptors, which > > > are already used for a similar purpose: sharing access to secret memory areas > > > that are not visible to the OS but can be shared with hardware through device > > > drivers that can import a dmabuf file descriptor. > > > > TBH, I didn't think about dmabuf, but my undestanding is that is this > > case memory areas are not visible to the OS because they are on device > > memory rather than normal RAM and when dmabuf is backed by the normal > > RAM, the memory is visible to the OS. > > No, dmabuf is normally about normal RAM that is shared between multiple > devices, the idea is that you can have one driver allocate a buffer in RAM > and export it to user space through a file descriptor. The application can then > go and mmap() it or pass it into one or more other drivers. > > This can be used e.g. for sharing a buffer between a video codec and the > gpu, or between a crypto engine and another device that accesses > unencrypted data while software can only observe the encrypted version. For our usecase sharing is optional from one side and there are no devices involved from the other. As James pointed out, there is no match for the userspace API and if there will emerge a usacase that requires integration of secretmem with dma-buf, we'll deal with it then. > Arnd -- Sincerely yours, Mike.