Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Btrfs with hibernation in a swapfile

nwb.sh

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Arch Linux Btrfs with hibernation in a swapfile

#21

Post by rhn_mk1 »

SkyMarshal wrote: post #2

Fwiw I no longer use disk swap files for anything, but ZRAM swap instead. It's mature, it's in the linux kernel, it's faster, and less wearing on SSDs, and RAM is cheap. I don't have a linux laptop though, so don't know how it affects hibernation. Anyone know how/if hibernation works on a laptop using ZRAM swap instead of disk-based swap?

Repeat after me:

ZRAM is not swap.

ZRAM uses the same OS interface as swap does, and that interface is called "swap" but really is more about composing system memory out of tiered backing memory. One of those tiers can be swap.

With ZRAM and no swap, all your system memory is volatile. As long as Linux requires nonvolatile system memory to hibernate, it will be impossible to hibernate in this setup.

Re: Arch Linux Btrfs with hibernation in a swapfile

#22

Post by rhn_mk1 »

Nursie wrote: post #19
voidfunc wrote: post #13

Earlier quoted context omitted.

What's the point of encrypting /boot exactly? From an Encrypt All The Things! perspective I get it, but practically... it seems overkill?

As the other poster mentioned, without secure boot, there are no guarantees about a kernel or initramfs that are sitting out there in plaintext (and yes, someone could mess with my grub install). It was mostly because "this should be possible, right?" So yeah - Encrypt all the things :)

You don't need to encrypt anything to verify those images, you just need to sign them. See how Heads does this.

https://github.com/osresearch/heads

Re: Arch Linux Btrfs with hibernation in a swapfile

#23

Post by Arnavion »

Nursie wrote: post #11
Arnavion wrote: post #7

Earlier quoted context omitted.

An alternative to MokManager/shim is to enroll your own key. You'll also need to convince your kernel package to create a UKI under /efi instead of regular initramfs under /boot, and to sign the UKI with your key. Eg on my OpenSUSE system, the kernel package runs dracut to build the initramfs in /boot, and it's three lines of config to co-opt dracut to build a UKI in /efi and sign it with my key instead. So installin…

> An alternative to MokManager/shim is to enroll your own key. I was under the impression that that was exactly what I was doing with mokmanager/shim? dropping into a utility that would perform key enrolment? Perhaps I have seriously misunderstood!

As you already discovered in the other comment, the root Secure Boot key is the PK, and the MOK is a concept that shim made up. shim was created so that people didn't have to enroll their own PK, if their firmware even let them do that in the first place. Every distro that uses shim was able to get it signed by Microsoft (MS would not sign each and every bootloader in existence, and especially not any version of grub), and then shim does its own verification of the next stage application using the MOK DB.

Re: Arch Linux Btrfs with hibernation in a swapfile

#24

Post by _piif »

SkyMarshal wrote: post #2

Fwiw I no longer use disk swap files for anything, but ZRAM swap instead. It's mature, it's in the linux kernel, it's faster, and less wearing on SSDs, and RAM is cheap. I don't have a linux laptop though, so don't know how it affects hibernation. Anyone know how/if hibernation works on a laptop using ZRAM swap instead of disk-based swap?

Same here. I was using zswap at one point merely for hibernation but got tired of the dice roll on whether my system would wake up, would wake up but with locked up graphics, would show me a black screen, would show me a blinking cursor or would kernel panic (on my hardware with an Intel iGPU at least). I just gave up on hibernation altogether and been happily using zram ever since.

Re: Arch Linux Btrfs with hibernation in a swapfile

#25

Post by chronogram »

pkulak wrote: post #20
SkyMarshal wrote: post #2

Fwiw I no longer use disk swap files for anything, but ZRAM swap instead. It's mature, it's in the linux kernel, it's faster, and less wearing on SSDs, and RAM is cheap. I don't have a linux laptop though, so don't know how it affects hibernation. Anyone know how/if hibernation works on a laptop using ZRAM swap instead of disk-based swap?

Seems silly to set aside ram to use when your ram runs out. What am I missing here?

You don't set it aside, unused pages just get compressed to save space.

Re: Arch Linux Btrfs with hibernation in a swapfile

#26

Post by ChuckNorris89 »

lars_francke wrote: post #16

I just did this last week and ran into an issue with LUKS: https://lore.kernel.org/cryptsetup/CAD-Ua_hPjBLHK0cyEz3k7KYB... LUKS wouldn't accept my password, no matter how simple it was. Turns out a BIOS update somehow messed up RAM settings which caused memory errors. And as LUKS needs a lot of memory for some of it's description operations bit flips can cause all of that to fail. That was frustrating!

I feel you. God I wish there was a company taking ownership in building, selling and supporting a batteries-included Desktop Linux distro where all these quality-of-life niceties that are working so well by default on Windows (and MacOS?), would be working out of the box on Linux without any user maintenance or need to read tutorials or wikis, and also be tested together on various hardware combos so that I have assurance that one of those components updating wouldn't brick my system.

I'd pay a $100-200 yearly subscription for such a Linux distro.

I remember wasting over an hour trying to get hibernate working on my company provided Ubuntu laptop and failing miserably. Or Gnome not having the option to disable the touchpad when an external mouse is plugged in, and the extension made to fix this not working because I'm using Wayland. I love Linux on the server side, but I just don't have time to deal with frustrating bullshit issues caused by this bazaar-engineering on the desktop side, even if it's FOSS. I'd rather pay and have something that works.

The closest thing I found was Gecko Linux (based on Opensuse Tumbleweed) or Nobara Linux (based on Fedora) but even there YMMV.

Re: Arch Linux Btrfs with hibernation in a swapfile

#27

Post by Nursie »

rhn_mk1 wrote: post #22
Nursie wrote: post #19

Earlier quoted context omitted.

As the other poster mentioned, without secure boot, there are no guarantees about a kernel or initramfs that are sitting out there in plaintext (and yes, someone could mess with my grub install). It was mostly because "this should be possible, right?" So yeah - Encrypt all the things :)

You don't need to encrypt anything to verify those images, you just need to sign them. See how Heads does this. https://github.com/osresearch/heads

Sure, and you could do that with more or less your whole installed system.

From the other angle - if it’s not a lot more difficult than encrypting the rest, why would I specifically exclude having these stored on an encrypted volume?

Re: Arch Linux Btrfs with hibernation in a swapfile

#28

Post by patrakov »

Operative0198 wrote: post #5
Nursie wrote: post #4

Interesting! I went on a similar journey recently with debian and FDE on luks2, which involved a fair amount of learning and messing around, but I got there. No Btrfs though, just plain old ext4+swap volumes using lvm on luks2, and a small uefi partition. My /boot is encrypted so I enter the LUKS2 passcode before grub can even access its config, and I've rolled an unlock key into the initramfs (which is loaded by gru…

For secureboot you may want to took a look at this project [0]. Don't think it has ever gotten easier to sign UKIs than that though systemd should have a new project (systemd-ukify) that aims to make it more integrated. Hiberation is not supported in lockdown mode because I'm assuming the kernel (maintainers) expect most people to have an unencrypted swap partition. If you have secured your swap, you can patch [1] th…

It is not because of an unencrypted swap partition. It is because, even if it is encrypted, you know the key and can thus replace the image with an arbitrary modified one, or, in theory, with a hacked version of a Windows boot loader, which would break DRM.

There were some movements to remove this restriction, on the condition that the encryption key is properly sealed in the TPM and is not extractable.

Re: Arch Linux Btrfs with hibernation in a swapfile

#29

Post by fathyb »

KingMachiavelli wrote: post #8
SkyMarshal wrote: post #2

Fwiw I no longer use disk swap files for anything, but ZRAM swap instead. It's mature, it's in the linux kernel, it's faster, and less wearing on SSDs, and RAM is cheap. I don't have a linux laptop though, so don't know how it affects hibernation. Anyone know how/if hibernation works on a laptop using ZRAM swap instead of disk-based swap?

ZRAM is amazing for cloud VMs which typically have strict disk IOPS limits which means any significant swap usage is going to destroy IO performance or even lock the system. ZRAM w/o swap completely prevents this IO condition and is much faster than disk swap anyway.

Shouldn't a cloud VM have swap disabled by default if it's using networked block storage? It is on AWS at least.

Re: Arch Linux Btrfs with hibernation in a swapfile

#30

Post by 2OEH8eoCRo0 »

ChuckNorris89 wrote: post #26
lars_francke wrote: post #16

I just did this last week and ran into an issue with LUKS: https://lore.kernel.org/cryptsetup/CAD-Ua_hPjBLHK0cyEz3k7KYB... LUKS wouldn't accept my password, no matter how simple it was. Turns out a BIOS update somehow messed up RAM settings which caused memory errors. And as LUKS needs a lot of memory for some of it's description operations bit flips can cause all of that to fail. That was frustrating!

I feel you. God I wish there was a company taking ownership in building, selling and supporting a batteries-included Desktop Linux distro where all these quality-of-life niceties that are working so well by default on Windows (and MacOS?), would be working out of the box on Linux without any user maintenance or need to read tutorials or wikis, and also be tested together on various hardware combos so that I have assu…

> I'd pay a $100-200 yearly subscription for such a Linux distro.

Same. Same for a lot of my devices really. I'd pay $100-$200 yearly for another year of Android updates or a viable alternative phone-os altogether.

Post reply on HN