4K sector size, cryptswap, with/-out dm-integrity?

4K sector size, cryptswap, with/-out dm-integrity?

[Thorsten Glaser]

Hi,

I’ve been looking a bit at how 4K sector sizes are passed
through the stack today, and I’m wondering a bit about
things the docs don’t have sufficiently deep details for.

AIUI, and please correct me if I’m wrong anywhere:

First, the easy(?) cases:

- HDD with 512 bytes underlying sector size ⇒ 4K sectors never ok
- SSD with 512 bytes logical sector size and no 4K listed in
  the “smartctl -c /dev/nvme0n1” / “nvme id-ns -H /dev/nvme0n1”
  output ⇒ 4K sectors likely not ok?

- HDD/SSD with 4K logical sectors ⇒ 4K sectors ok

The documentation also says that this should be:

- dm-integrity device with --sector-size 4096 in journalled mode ⇒ ok
  - does this even differ between underlying 512/512, 512/4K, 4K/4K devices?
- same but in D (direct) mode ⇒ not ok unless underlying device is
  - 4K/4K?
  - 512/4K or 4K/4K (see below)?
- same but in B (bitmap) mode ⇒ ?
- same but in I (inline) mode ⇒ only ok if the underlying device matches?
- R (recovery) mode is special anyway

Then, there’s this one:

- HDD with 512b logical and 4K physical sectors according to
  “hdparm -I”/“smartctl -i” ⇒ that ok?

And the thing I’ve really been wondering about is:

at the moment, I use encrypted swap like this (crypttab):

# <target name> <source device>         <key file>      <options>
cswp1           /dev/………                /dev/urandom    discard,cipher=aes-xts-plain64,size=512,plain,swap

Is it possible to add “,sector-size=4096” to that line and
will it help (encrypting 4K in one go is faster than eight
times 512b after all)? Does the kernel swapping subsystem
work with that? (On amd64, so my page size is 4096, though
since 4K pages on 512b devices works, 16K/64K pages on 4K
devices will likely also work for things like MIPS, ARM…)

If so, under the same circumstances as above? (Either 4K logical
device (which I seem to not have) or 4K integritysetup with journal
(also on 512/4K or 512/512 devices?) or MAYBE 512/4K devices?)

I’ve been putting integritysetup with 4K sectors and journal
under my RAID-1+LUKS recently already anyway, even if performance
is… lacking. But I should stick to J (journal) mode with this, no?

Thanks,
//mirabilos
-- 
„Cool, /usr/share/doc/mksh/examples/uhr.gz ist ja ein Grund,
mksh auf jedem System zu installieren.“
	-- XTaran auf der OpenRheinRuhr, ganz begeistert
(EN: “[…]uhr.gz is a reason to install mksh on every system.”)

Re: 4K sector size, cryptswap, with/-out dm-integrity?

[Thorsten Glaser]

On Fri, 10 Jul 2026, Thorsten Glaser wrote:

>If so, under the same circumstances as above? (Either 4K logical
>device (which I seem to not have) or 4K integritysetup with journal
>(also on 512/4K or 512/512 devices?) or MAYBE 512/4K devices?)

I just saw in the other thread that encrypted swap on dm-integrity
in J (journal) mode may be not safe.

So for encrypted swap over RAID-1 over dm-integrity, I’d need to
have a separate RAID device and the dm-integrity below that in a
different mode (is B safe for swap and does B allow this to work
with 512/4K devices?).

Questions over questions,
//mirabilos, who’ll have to repartition a few hosts…
-- 
[16:04:33] bkix: "veni vidi violini"
[16:04:45] bkix: "ich kam, sah und vergeigte"...