[teacup50]

> There is a brief period in time when data is present in the clear in memory - when it's used - but nothing can be done about it, short of moving the code to some kind of protected processor.

`mlock()` can be used to prevent the memory from being paged out, but the DMA issue itself isn't something that can be (or should be) solved in userspace; if someone can do DMA reads/writes, rewriting any code or data, there's nothing an application can do.

[java-man]

I agree, there should exists explicit OS mechanisms to prevent leakage, be it via DMA, paging, or any other way.

In the absence of such mechanisms, especially when mlock() is unavailable (if running a Java app, for example), the app designer can use tricks like one described above to increase the level of difficulty for an attacker. It is not a solution, but an additional countermeasure.

[potatosareok]

You can disable paging if you really care about that but setting swapiness to 0.

Or use something like https://github.com/LucidWorks/mlockall-agent