Earlier quoted context omitted.
On some Lenovo machines (x86) deleting the key database can brick the machine. So while you can technically do it in practice you can't.
This sounds worrisome. Could you explain more? How can this brick a machine?
Linux boot partitions and how to set them up
171–180 of 184 posts
Re: Linux boot partitions and how to set them up
#172Earlier quoted context omitted.
Do you have a reference? Deleting the key database can not be done programmatically (unless UEFI has a bug). In all machines I have looked it's an option in the BIOS. So that should be clear case of warranty repair. Which of course does not help you if you do it after warranty has ended.
https://forums.lenovo.com/t5/ThinkPad-T400-T500-and-newer-T-... It's an option in the UEFI.
I guess it remains unclear whether it was a firmware bug that has since been corrected or whether it depends on how exactly the user installs their own keys.
The reply the UEFI itself would be signed and if you delete the matching keys from the relevant DB UEFI would no longer start does not sound right to me.
Good the see that the option exists for AMD, too. I guess AMD had no dominating market share when secure boot was introduced. So they would probably not be legally obliged to provide it? Hopefully market power of those requiring independence of Microsoft is big enough to keep it that way.
Re: Linux boot partitions and how to set them up
#173Earlier quoted context omitted.
In fact, I was bitten once by corruption because the _unmount_ operation was interrupted mid-write. Not that surprising considering it's a much less tested scenario on fs code.
Okay, that hadn't occurred to me. I did wonder if mounting was a problem, if VFAT has "last mounted time" or other metadata that gets written per-mount.
Re: Linux boot partitions and how to set them up
#174Earlier quoted context omitted.
Also some dumb firmware may write to such disks, Asrock boards were reported in past to do that. Efi+boot partitions usually take less than 2G of space, and can be made like 200MBs total, while mainstream disk capacity is hundreds of GBs nowadays. This "loss of useful space" is immaterial in most cases. Maybe if you have something like a 2GB drive from 1990s that you want to use (why?) then it makes sense to shave of…
There are more reasons to set it up more or less like that. Think of an expensive, super fast but considerably small SSD, and some cheap big mass storage (maybe even on spinning rust) along that. You'll likely try to use the expensive SSD as efficiently as possible. Every GB counts if you have "only", say, 0.5 TB. A boot partition on such expensive and small (but fast) media is pure wastage. Also this kind of setup s…
It doesn't. You can make the overhead partition take 200MB. That's immaterial fraction of 0.5TB. You ain't gonna see impact of this loss. Additionally, by partitioning the drive, you protect it from dumb programs who like to create partition tables.
Yes, there are reasons for not partitioning your OS disk, like full disk encryption. But it is more work.
> when you mess up the data alignment on them. In case of FDE with partitions (maybe on top of LVM even) the alignment issues isn't trivial.
This sounds interesting. What are these alignment issues? Why do you think they are present on disk with partitions (I never had those issues) and why do you think they are not present on disk without partitions (may be they are, due to compression/encryption)?
Re: Linux boot partitions and how to set them up
#175I'm a huge fan of UKI - it's part of the underlying 'magic' of ZFSBootMenu ( https://github.com/zbm-dev/zfsbootmenu/ ). We ship a single EFI file that is a full Linux kernel, a semi-custom initramfs and an embedded command line. With that, we can fully support root-on-ZFS because we don't have to re-implement a complex filesystem in a bootloader ... like GRUB. Because we're not trying to re-implement ZFS (or any othe…
UEFI as such is horrible. (Just have a look at the spec; 2.5 k pages of stuff that looks like copy&paste of Windows APIs) But its boot mechanic, and the added crypto stuff (secure / attested boot) is really nice. Using UKIs is like boot should have worked since the beginning: You just copy a (signed) boot image onto the (firmware managed) boot partition. Done.
Re: Linux boot partitions and how to set them up
#1761. Find physical disks that may be a part of a managed volume group/pool 2. Find logical volumes and file systems on the volume pools 3. Mount a filesystem by some configurable logic 4. Load and execute a kernel from the filesystem
Having to allocate the first "blocks" on the imaginary "sectors" of my SSD (or even worse, a virtual disk drive) for some arbitrary amount of space formatted in possibly the most barebones filesystem still in mainstream use feels quaint and irritating and limits my ability to use that disk in a larger storage pool.
UEFI is an overcomplicated specification with lots of wintel baggage, but most of it doesn't personally offend me. What does is that UEFI had the chance to abolish disk partitioning, but instead enshrined it. And added mandatory FAT32 to add insult to injury.
My main laptop and desktop each have a separate disk for the EFI system partition. The former uses systemd-boot and the latter ZFSBootMenu. This way I have a maximum of one partition per disk. It's not ideal, but I like it better than the usual solution.
The disks in my zpool show up as having partitions 1 and 9, but I consider that an implementation detail since I never need to treat the disks as anything other than entire disks in a pool
Re: Linux boot partitions and how to set them up
#177Earlier quoted context omitted.
There are more reasons to set it up more or less like that. Think of an expensive, super fast but considerably small SSD, and some cheap big mass storage (maybe even on spinning rust) along that. You'll likely try to use the expensive SSD as efficiently as possible. Every GB counts if you have "only", say, 0.5 TB. A boot partition on such expensive and small (but fast) media is pure wastage. Also this kind of setup s…
> Every GB counts if you have "only", say, 0.5 TB. It doesn't. You can make the overhead partition take 200MB. That's immaterial fraction of 0.5TB. You ain't gonna see impact of this loss. Additionally, by partitioning the drive, you protect it from dumb programs who like to create partition tables. Yes, there are reasons for not partitioning your OS disk, like full disk encryption. But it is more work. > when you me…
Alignment issues are only really relevant in case of SSDs. The FS blocks need to align with the "physical" blocks of the chips used. (Actually this are also "only logical blocks", presented to you by the SSD controller, but at least this is fully transparent). If the alignment is messed up the SSD needs to consider at least 2 "physical" blocks (as presented by the controller to the OS) when accessing a single FS block. This leads to doubling the wear and halves the performance. (At least, in really unhappy scenarios this can even triple the access effort).
Where exactly a FS block starts and ends in relation to the underlying "physical" block(s) depends on all the "headers" that are "in front" of the FS blocks (or logically sometimes "a layer up", even "physically" this also only means "in front"). Partition tables are headers. LUKS headers are obviously also headers that need to be taken into account. LVM headers (and blocks, groups, volumes) are even one more layer to consider.
To make things more fun, like said, the "physical" blocks are only an abstraction presented by the controller. In some cases their size is configurable through the SDD controller firmware. (But this shouldn't be done without looking at the chips themself). The more interesting part is: The "physical" blocks can have "funny" sizes… (Something with some factor of 3 for example). Documentation on this is frankly spare…
The usual tools just assume some values that "work most of the time". But this whole problematic is actually quite new. Older version of all the related tools didn't know anything about SSD block alignment. (Like I said, they still don't know anything for sure, there is not way to know without looking a the docs and specs of the concrete device, but now at least they try to guess some "safe values"; with a large margin).
If you use partitions you'll end up with those "funny" few MiBs large offsets, which you have seen for sure. (If you don't use offsets it's very likely that the alignment is wrong).
Without partitions the other storage layers are much easier to align. You don't need to waste a few MiBs around your partitions, and especially don't need to remember (and maybe even recalculate) this stuff when changing something.
Not many people know about this whole dance as misalignment isn't a fatal problem. It will just kill your SSD much quicker, and half the performance (at least). But SSDs are so fast that most people would not notice without doing benchmarks… (Benchmarks of the different storage layers is actually the only way to test whether you got the alignment right).
If you don't look into this yourself you can only pray that all tools used were aware of this issues and guessed some values that work by chance properly with your hardware. But if you created partitions without the "safe" offsets (usually by setting values yourself and not letting the tool chose its "best guess") the alignment is quite likely wrong.
I'm came across this issue because I was wondering why Windows' fdisk always added seemingly "random" offsets around partitions it created. It turns out it's a safety measure. Newer Unix tools will do the same when using proposed defaults.
TL;DR: If you don't create a partition table on a NVM device you can just start your block layer directly on block zero and don't have to care about much as long as you also set the logical block size of that layer to the exact same value as the (probably firmware configurable) "physical" block size of the device. If you have a (GPT) partition table in front (which is by the way of varying size to make things even more funny) you need to add "safety offsets" to your partitions. Otherwise you're torturing your NVM device, resulting in servery crippled performance and lifetime.
I hope further details are now easy to google in case anybody likes to know more about this issue.
---
> Additionally, by partitioning the drive, you protect it from dumb programs who like to create partition tables.
The better protection would be do keep drives far away form operating systems and their tools that are known to randomly shred data… ;-)
Re: Linux boot partitions and how to set them up
#178Earlier quoted context omitted.
There are more reasons to set it up more or less like that. Think of an expensive, super fast but considerably small SSD, and some cheap big mass storage (maybe even on spinning rust) along that. You'll likely try to use the expensive SSD as efficiently as possible. Every GB counts if you have "only", say, 0.5 TB. A boot partition on such expensive and small (but fast) media is pure wastage. Also this kind of setup s…
> Every GB counts if you have "only", say, 0.5 TB. It doesn't. You can make the overhead partition take 200MB. That's immaterial fraction of 0.5TB. You ain't gonna see impact of this loss. Additionally, by partitioning the drive, you protect it from dumb programs who like to create partition tables. Yes, there are reasons for not partitioning your OS disk, like full disk encryption. But it is more work. > when you me…
Re: Linux boot partitions and how to set them up
#179Earlier quoted context omitted.
> Every GB counts if you have "only", say, 0.5 TB. It doesn't. You can make the overhead partition take 200MB. That's immaterial fraction of 0.5TB. You ain't gonna see impact of this loss. Additionally, by partitioning the drive, you protect it from dumb programs who like to create partition tables. Yes, there are reasons for not partitioning your OS disk, like full disk encryption. But it is more work. > when you me…
In case you would use anyway only one partition (because boot is elsewhere) not having any partitions at all is not more but less work. Alignment issues are only really relevant in case of SSDs. The FS blocks need to align with the "physical" blocks of the chips used. (Actually this are also "only logical blocks", presented to you by the SSD controller, but at least this is fully transparent). If the alignment is mes…
Re: Linux boot partitions and how to set them up
#180Earlier quoted context omitted.
Why is initrd needed for "real storage support"? I usually have my storage drivers compiled into kernel, not as modules (because why have them as modules if you need them always).
You can compile cryptsetup into the kernel? I didn't know that. Interesting. Have you a reference for that? Or are you trying to say that you're booting without a initrd (which is said to be in general broken for decades). Also the secure boot question remains. I still don't get why complicate things in such way. Imho nothing is simpler than copying a (signed) boot-image onto the (firmware manged) boot partition, and…
Yes I'm booting without initrd, because in my case I don't need it - no cryptsetup and I don't need optional drivers because my setup doesn't change the hardware. (e.g. general distro kernel has to have it because they add modules for every hardware there is to support each user).
How is boot without initrd broken? I use it since my first kernel compilation and find it simpler than dealing with initrd.