10

Getting a new laptop with SSD tomorrow. I need to know about the current status of dm-crypt and TRIM. I have seen several conflicting reports and most activity around this question seems to be > 1 year old. Some say that dm-crypt TRIM passthrough has been included in multiple recent kernel versions (which is not a problem for me, since I use Arch). Some say that the support still does not exist. Can I get a clear, well-sourced answer on the status of dm-crypt TRIM support? git commits or mailing list announcements that mention this feature would be ideal.

The answer to this question has big potential to influence the way I architect my new laptop's disks. Hopefully it will be useful to some others to have a decent, up-to-date answer.

4 Answers 4

12

For the record, this functionality did NOT exist when I first posted this question. I asked on the mailing list and was informed by Milan Broz that discard passthrough for dm-crypt targets still had not been implemented. Milan indicated that he intended to implement this at some point, but did not state when.

After digging around in dm-crypt.c and related files for a while, it appeared that TRIM support would be fairly trivial to add. I wrote the list asking for their general advisement on the task before I jumped in. The next day, Milan submitted a patch that implements TRIM pass-through on dm-crypt and this has been staged into linux-next. It should be included in the Linux 3.1 kernel.

TRIM passthrough must be enabled explicitly. There are potential security issues in using TRIM on a dm-crypt'd device, because TRIM sends information about block usage to the firmware on the device which then marks recently freed areas as usable (as I understand it, anyway). This means that an interested party can derive information about patterns of disk usage. For instance, it was postulated that an attacker could almost definitely learn what filesystem was in use on the encrypted medium through this data. An attacker may also be able to learn more useful information, like that you had a lot of big files saved until recently (big contiguous TRIM'd blocks).

Please see these threads for reference:

http://www.redhat.com/archives/dm-devel/2011-June/msg00093.html

http://www.redhat.com/archives/dm-devel/2011-July/msg00042.html

http://www.redhat.com/archives/dm-devel/2011-July/msg00088.html

tl;dr: TRIM passthrough support for dm-crypt targets will exist in Linux >= 3.1 but must be enabled manually via cryptsetup and/or dmsetup due to data leakage that may allow profiling based on disk usage patterns.

1
  • Thanks for the explanation! Most of us don't care if the "attacker" can guess what filesystem we use (due to the data layout on disk) or can guess that we've deleted lots of big files (lots of trim zeroed space). Those worries may matter for some corporation. But for home users, SSD health matters more: USE TRIM. Without TRIM, the SSD (yes, even "garbage collection" ones) will have to shuffle around all that dead, unused data in the wrongful belief that it may be used later. That leads to lots of useless writes and earlier SSD death. It also reduces SSD write-performance over time. Commented Feb 26, 2021 at 22:05
4

As of kernel 3.2.x, dm-crypt + brtfs is supposed to be safe. See the reply to my question from Chris Mason:

http://permalink.gmane.org/gmane.comp.file-systems.btrfs/15554 and http://permalink.gmane.org/gmane.comp.file-systems.btrfs/15564

0

According to this post...

My question is: What happens, if a dm-crypt-layer is between the filesystem and the real block-device? Will the trim be passed through, or will it be discarded?

It guess it will be passed through. I'm using btrfs on a SSD which is encrypted with LUKS/dmcrypt, and it works great. Btrfs uses ata trim quite a while.

You might also need discard in mount options of the filesystem.

5
  • Thanks, but that answer is still non-definitive and over a year old. I would like a definitive, recent answer. I guess I will have to mail the list, just hoping SU would be a quick shortcut :p Commented Jun 27, 2011 at 18:14
  • Well, if it already worked a year ago... Commented Jun 27, 2011 at 18:28
  • "I guess it works because my SSD is not slow" is not really a reliable indicator of whether TRIM support is actually functional. Commented Jun 28, 2011 at 4:14
  • Which is exactly what I have never said. Commented Jun 28, 2011 at 9:11
  • That's what the post you've quoted says. Commented Jul 20, 2011 at 7:04
0

well there's this thread

https://bbs.archlinux.org/viewtopic.php?id=114924

and this tool

http://sourceforge.net/tracker/index.php?func=detail&aid=2997551&group_id=136732&atid=736684

I haven't used it yet, but I'm also interested in this problem.

1
  • Thanks honig, I had found that before. Please see the answer I just added, it provides detail on real discard support for dm-crypt targets. Commented Aug 4, 2011 at 4:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .