Doug S (foo.delete@this.bar.bar) on July 29, 2022 10:43 am wrote:
>
> And in addition to this you have stuff where an individual server loses power because a power supply fails
> (and yes that happens with N+1 supplies, I've seen that many times) or because the system crashes.

Side note: "the system crashes" is a real issue, and having IO that just works as memory can be really really scary in that situation.

Bugs happen. You have wild pointers. You don't want a random wild pointer access to trash your data on disk by mistake.

Sometimes it's an advantage to have an IO path that requires a bit of setup. Think of it not as a security thing, but as a "protect against accidents" thing. Disk corruption can still happen (due to both hardware and software problems), but it's still a barrier.

And yes, people did special "you can write protect this region of memory and have to use a special mapping when you actually write to it", but that kind of shows how in many situations you really want memory to memory, and disk to be disk. The two are not the same.

That, btw, is true of any non-volatile memory situation in general.

You simply don't want a situation where all your memory is your long-term image. The whole "if you lose power, you reboot and just continue" thing is mindless blathering. Exactly because it makes a fundamental mistake in assuming that everything is always perfect and bug-free.

In many situations, you not only want most of your memory to be "scratch RAM", you absolutely require it. Security and tampering is one reason for it.

So even if we ever end up in a situation where your CPU caches are simply huge, and all "memory" outside the caches is nonvolatile and could be used as a long-term disk, you would absolutely require some of it to be encrypted with a one-time key so that you can literally treat it as being ephemeral, and know that when you power the machine down (intentionally or unintentionally), you're not leaving random stuff around.

Non-volatility tends to be sold as this unquestionably good feature. But as pretty much everything in engineering, there's another side to it.

Linus