For the other parts, the question is what we actually want to let
user space configure.
Being able to specify "Very secure" "maximum secure" "average
secure" all doesn't really make sense to me.
Well, it doesn't to me either unless the user feels a cost/benefit, so
if max cost $100 per invocation and average cost nothing, most people
would chose average unless they had a very good reason not to. In your
migratable model, if we had separate limits for non-migratable and
migratable, with non-migratable being set low to prevent exhaustion,
max secure becomes a highly scarce resource, whereas average secure is
abundant then having the choice might make sense.
I hope that we can find a way to handle the migration part internally.
Especially, because Mike wants the default to be "as secure as
possible", so if there is a flag, it would have to be an opt-out flag.
I guess as long as we don't temporarily map it into the "owned" location
in the direct map shared by all VCPUs we are in a good positon. But this
needs more thought, of course.
The discussion regarding migratability only really popped up because
this is a user-visible thing and not being able to migrate can be a
real problem (fragmentation, ZONE_MOVABLE, ...).
I think the biggest use will potentially come from hardware
acceleration. If it becomes simple to add say encryption to a secret
page with no cost, then no flag needed. However, if we only have a
limited number of keys so once we run out no more encrypted memory then
it becomes a costly resource and users might want a choice of being
backed by encryption or not.
Right. But wouldn't HW support with configurable keys etc. need more
syscall parameters (meaning, even memefd_secret() as it is would not be
sufficient?). I suspect the simplistic flag approach might not be
sufficient. I might be wrong because I have no clue about MKTME and friends.
Anyhow, I still think extending memfd_create() might just be good enough
- at least for now. Things like HW support might have requirements we
don't even know yet and that we cannot even model in memfd_secret()
right now.
--
Thanks,
David / dhildenb
