| Summary: | SSD TRIM doesn't work on luks encrypted partitions inside an LVM | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Pete Dan <10cc> |
| Component: | RPM Packages | Assignee: | Kernel and Drivers maintainers <kernel> |
| Status: | NEW --- | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, doktor5000, fri, marja11, northsoft, sysadmin-bugs, thierry.vignaud |
| Version: | Cauldron | Keywords: | 6sta1 |
| Target Milestone: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Source RPM: | util-linux | CVE: | |
| Status comment: | |||
|
Description
Pete Dan
2016-07-29 07:03:24 CEST
Pete Dan
2016-07-29 09:24:51 CEST
Component:
Release (media or process) =>
RPM Packages Thank you for the investigation. I am just another user with some interest in this. Possible workarounds: 1) Have you tried if encrypting the pv instead works? Anyway, for a secure system you will probably like to have swap and maybe even /etc and possibly other (I used to have /home, /, and swap in an encrypted LVM, and only /boot separately), so put all partitions you want to encrypt in the LVM. 2) instead of continuous trim there is a script that could be run nightly to trim "all at once" preferable when you computer is not much used. Actually that will make your system have more performance the rest of time as trimming each file deletion makes the drive a bit busy that little time. CC:
(none) =>
fri No distro does that automatically AFAIC. Those instructions are valid for all distros (FC, Debian/Ubuntu, ...) There's nothing critical there CC:
(none) =>
thierry.vignaud (In reply to Morgan Leijström from comment #1) > Thank you for the investigation. > I am just another user with some interest in this. > > Possible workarounds: > > 1) Have you tried if encrypting the pv instead works? > Anyway, for a secure system you will probably like to have swap and maybe > even /etc and possibly other (I used to have /home, /, and swap in an > encrypted LVM, and only /boot separately), so put all partitions you want to > encrypt in the LVM. So far I have tried with an encrypted LVM setup as you described. > 2) instead of continuous trim there is a script that could be run nightly to > trim "all at once" preferable when you computer is not much used. Actually > that will make your system have more performance the rest of time as > trimming each file deletion makes the drive a bit busy that little time. I believe even running fstrim once per month could be sufficient in most scenarios. Of course, in this case you can't run fstrim at all. (In reply to Thierry Vignaud from comment #2) > No distro does that automatically AFAIC. > Those instructions are valid for all distros (FC, Debian/Ubuntu, ...) > There's nothing critical there To add clarity to my original report, this is not a problem of not doing it automatically, but of following those instructions and fstrim still not working. (In reply to Pete Dan from comment #4) > (In reply to Thierry Vignaud from comment #2) > > No distro does that automatically AFAIC. > > Those instructions are valid for all distros (FC, Debian/Ubuntu, ...) > > There's nothing critical there > > To add clarity to my original report, this is not a problem of not doing it > automatically, but of following those instructions and fstrim still not > working. Assigning to maintainer Source RPM:
(none) =>
util-linux FWIW OP added the workaround on the forums thread in https://forums.mageia.org/en/viewtopic.php?p=65451#p65451 which is basically to open the LUKS partition via "cryptsetup luksOpen --allow-discards /dev/sdX some_name" when booted from any live media. It seems we're not doing this in initrd even when /etc/lvm.conf contains "issue_discards = 1" and /etc/crypttab contains "discard" in the last field (options) and after initrd were recreated, which seems the actual problem for people trying to enable it manually for LVM over LUKS, probably the same for LUKS over LVM though. CC:
(none) =>
doktor5000
Dave Hodgins
2020-06-28 17:18:33 CEST
CC:
(none) =>
davidwhodgins (In reply to Florian Hubold from comment #6) > It seems we're not doing this in initrd Hello, I face the same problem, Cauldron. I'm ready to give some information, maybe with some debug output if the instruction is given. CC:
(none) =>
northsoft |