From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE6B6C1B08C for ; Wed, 14 Jul 2021 22:40:06 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 605E061396 for ; Wed, 14 Jul 2021 22:40:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 605E061396 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A4E916B00E1; Wed, 14 Jul 2021 18:40:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9FE2B6B00E2; Wed, 14 Jul 2021 18:40:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 877A66B00E3; Wed, 14 Jul 2021 18:40:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0168.hostedemail.com [216.40.44.168]) by kanga.kvack.org (Postfix) with ESMTP id 5F68F6B00E1 for ; Wed, 14 Jul 2021 18:40:06 -0400 (EDT) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 48CDB182B3B9D for ; Wed, 14 Jul 2021 22:40:05 +0000 (UTC) X-FDA: 78362662770.07.674A8FE Received: from mail-io1-f47.google.com (mail-io1-f47.google.com [209.85.166.47]) by imf19.hostedemail.com (Postfix) with ESMTP id EA12BB0001A8 for ; Wed, 14 Jul 2021 22:40:04 +0000 (UTC) Received: by mail-io1-f47.google.com with SMTP id g22so4147390iom.1 for ; Wed, 14 Jul 2021 15:40:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=R4folDUDICkUURmaxRdd97kJ1DDYqeb4hdwNbT+pwyY=; b=c+/78aYldlz56IMFQTUGpvtOXrSnRqfxRP0K69s+NUewdaICOTLcGuSFhnKZO3Vwni FijSkmYS82HMZLcPRGgiFL2lEIeh//BeVwGuAdYDy+c79cY5Jo34eMPHQuZ9jdp5kbb3 Zjl3GPk5Ets/VJQJmE/ZSqd03xVhXNILf5Gaw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=R4folDUDICkUURmaxRdd97kJ1DDYqeb4hdwNbT+pwyY=; b=cRpd6JbaiEXgIYTBWnOk0EHMi9l54h9fL9v2KuZLHZXZpTWJcB70wjxHUHd1Wm98rw Q2udlL1bxPLc/SKzeftN7LpyLEe9O0M7FKi/TLNUJxA9s4bqwyMMqSAzfuEddK2Djd8X 0z3N/duWyQamXxsbDuc76dkKv5UAeCXi9e3JM5Vt+zc07IhlMOA/W9+mYqYtArzhvfQ5 wRuL6TFfgA3LSDnInc25L/2ciGnHlulA3HBEDZy+xdQAS3VZkoB3u6bfbKN24lbwsx7X mxjf6Tc0LiMMYur9wjmx5nG78HUoKyQPRkqE0mr4wzOxGkS/2TXyRCq9/gyMYQACFu43 UaVw== X-Gm-Message-State: AOAM533LD4z3LIxRIZWUde2GjVm6fbYGDY589mJmSAycx6GPhEi+tgXF g33AAOfCdsOXyMnYx9xXelUfrfRjV+rnEA== X-Google-Smtp-Source: ABdhPJz+OIu/c254XrOmAkPBx2CKlM7Cn7H9Vaoh9H2J6Ho730FToJBjHHmWN85axlwTve/xM5+qBg== X-Received: by 2002:a05:6602:2245:: with SMTP id o5mr353912ioo.20.1626302404077; Wed, 14 Jul 2021 15:40:04 -0700 (PDT) Received: from mail-io1-f43.google.com (mail-io1-f43.google.com. [209.85.166.43]) by smtp.gmail.com with ESMTPSA id n14sm1908966ili.22.2021.07.14.15.40.01 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Jul 2021 15:40:02 -0700 (PDT) Received: by mail-io1-f43.google.com with SMTP id z11so4182195iow.0 for ; Wed, 14 Jul 2021 15:40:01 -0700 (PDT) X-Received: by 2002:a6b:7719:: with SMTP id n25mr313562iom.37.1626302401031; Wed, 14 Jul 2021 15:40:01 -0700 (PDT) MIME-Version: 1.0 References: <20210709105012.v2.1.I09866d90c6de14f21223a03e9e6a31f8a02ecbaf@changeid> In-Reply-To: From: Evan Green Date: Wed, 14 Jul 2021 15:39:25 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v2] mm: Enable suspend-only swap spaces To: Michal Hocko Cc: Andrew Morton , David Hildenbrand , Pavel Machek , Alex Shi , Alistair Popple , Jens Axboe , Johannes Weiner , Joonsoo Kim , "Matthew Wilcox (Oracle)" , Miaohe Lin , Minchan Kim , Vlastimil Babka , LKML , linux-mm@kvack.org, linux-api@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: EA12BB0001A8 X-Stat-Signature: ezpbt4iik7bcxg4scg5y5gy9iguewce4 Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="c+/78aYl"; spf=pass (imf19.hostedemail.com: domain of evgreen@chromium.org designates 209.85.166.47 as permitted sender) smtp.mailfrom=evgreen@chromium.org; dmarc=pass (policy=none) header.from=chromium.org X-HE-Tag: 1626302404-208913 X-Bogosity: Ham, tests=bogofilter, spamicity=0.001269, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jul 13, 2021 at 10:42 PM Michal Hocko wrote: > > On Mon 12-07-21 14:32:05, Evan Green wrote: > > On Mon, Jul 12, 2021 at 12:03 AM Michal Hocko wrote: > > > > > > [Cc linux-api] > > > > > > On Fri 09-07-21 10:50:48, Evan Green wrote: > > > > Currently it's not possible to enable hibernation without also enabling > > > > generic swap for a given swap area. These two use cases are not the > > > > same. For example there may be users who want to enable hibernation, > > > > but whose drives don't have the write endurance for generic swap > > > > activities. > > > > > > > > Add a new SWAP_FLAG_NOSWAP that adds a swap region but refuses to allow > > > > generic swapping to it. This region can still be wired up for use in > > > > suspend-to-disk activities, but will never have regular pages swapped to > > > > it. > > > > > > Could you expand some more on why a strict exclusion is really > > > necessary? I do understand that one might not want to have swap storage > > > available all the time but considering that swapon is really a light > > > operation so something like the following should be a reasonable > > > workaround, no? > > > swapon storage/file > > > s2disk > > > swapoff storage > > > > Broadly, it seemed like a reasonable thing for the kernel to be able > > to do. The workaround you suggest does work for some use cases, but it > > seems like a gap the kernel could more naturally fill. > > > > Without getting too off into the weeds, there a handful of factors > > that make this change particularly useful to me: > > > > * Slicing off part of your SSD to be SLC (single level cell) is > > expensive. From what I understand you gain endurance and speed at the > > cost of 3-4x capacity. In other words for every 1GB of SLC space you > > need for swap, it costs you 3-4GB of storage space out of the primary > > namespace. So I'm incentivized to size this region as small as > > possible. Hibernate's speed/endurance requirements are not quite as > > harsh as regular swap. Steering them separately gives me the ability > > to put the hibernate image in regular storage, and not be forced to > > oversize expensive/fast swap space. > > OK, this is likely true but it doesn't really explain/justify a > dedicated swap storage for hibernation. Wait, yes it does. Hibernation has less stringent write endurance and speed requirements than swap, so it makes sense to point it at storage that doesn't pay the 3x capacity penalty, and save the fancy fast stuff for swap. The exclusivity makes sense since you're trying not to wear out your higher capacity storage with unnecessary writes. I'd argue the API addition is worth it for this reason by itself. Usermode has valid reasons for wanting to disentangle these. > > > * Even with the workaround, swap can end up in the hibernate region. > > Hibernate starts by allocating its giant 50%-of-memory region, which > > is often the forcing function for pushing things into swap. With the > > workaround, even if my hibernate region is in last priority, there's > > still a reasonable chance I'll end up swapping into it. > > Right there is no guarantee but why does that matter at all. From the > kernel point of view it doesn't really makes much difference what was > the source of the swapout. > > > If I have > > different security designs for swap space and hibernate, then even a > > chance of some swap leaking into this region is a problem. > > Could you expand some more about the this part please? Offline attacks (ie manipulating storage from underneath the machine) are a major concern when enabling both swap and hibernate. But the approach of adding integrity to mitigate offline attacks may differ between swap and hibernate in the interest of performance. Swap for instance essentially needs a per-page dictionary of hashes for integrity, since pages can be added and removed arbitrarily. Hibernate however just needs a single hash across the entire image to provide integrity. If you have swap leaking onto a region where you don't have integrity enabled (because say you handled integrity at the image level for hibernate, and at the block layer for swap), your swap integrity story is compromised. There's a (likely defunct) series from Matthew Garrett that expounds a bit on some of this, though it's also partially tangential: https://lore.kernel.org/lkml/20210220013255.1083202-1-matthewgarrett@google.com/ > > > * I also want to limit the online attack surface that swap presents. > > I can make headway here by disallowing open() calls on active swap > > regions (via an LSM), and permanently disabling swapon/swapoff system > > calls after early init. The workaround isn't great for me because I > > want to set everything up at early init time and then not touch it. By > > suspend time, on my system I no longer have the ability to make > > swapon/swapoff calls. > > This is clearly a policy call. The goal was to show examples of why the workaround was insufficient. Yes, the response to any particular example could be "just don't choose to do that", but I'm hoping to show examples from several different angles of how the flag is a valuable knob for usermode to have. > > All that being said, I am still missing any justification for the > dedicated swap storage. This is an ABI thing so the reasoning should be > really solid. I'm hoping it is. I sympathize with the awkwardness of "swapon, but don't swap!". But from what I can there is no other route that wouldn't be hugely disruptive and risk breaking compatibility for folks who want to continue to combine their hibernate and swap regions. I don't think this digs the design hole deeper. Yes, the ship on this design has long ago sailed. But if we ever did try to dig ourselves out of the swap/hibernate hole by providing new APIs to handle them separately, this flag would serve as a good cutover to divert out of the swap code and into the new shiny hibernate-only code. The APIs are never going to be totally disentangled, so a clean cutover opportunity is the best one can hope for. -Evan