2

I have the following partition table:

NAME            
nvme0n1         
├─nvme0n1p1           part  /boot
└─nvme0n1p2           part
  └─crypt             crypt
    ├─crypt-swap      lvm   [SWAP]
    ├─crypt-root      lvm   /
    └─crypt-home      lvm   /home

As the drive is an SSD, I would like to perform TRIM command in order to increase performance/lifetime of the disk itself.

In particular, I would like to enable periodic TRIM.

Because the second partition (i.e., nvme0n1p2) is encrypted, TRIM will be inhibited because of security implications (https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)).

However, it is possible to enable TRIM on encrypted partition by configuring encrypt on the opening.

As I my partition is opened at kernel boot, I've modified kernel parameters (i.e., allow-discards):

cryptdevice=/dev/sdaX:root:allow-discards

(Note that the partition naming and volume name are not relevant in the above snippet.).

By doing that, I was indeed successfully able to run TRIM command on the disk:

# cryptsetup luksDump /dev/nvme0n1p2 | grep Flags
Flags:   allow-discards

And:

# fstrim ...
/home: [..] trimmed on ...
/: [..] trimmed on

So far, so good.

The problem arose when I tried to restore to the original state.

I have removed the kernel parameter allow-discards, but Flags on partition still shows allow-discards and fstrim command successfully complete its job.

  • How is that possible?
  • How to restore denying of discards on the encrypted partition?
BiagioF
  • 141
  • 5

1 Answers1

2

It turned out, LUK2 can permanently store metadata in the header.

It is possible to enable allow-discards and store in the partition itself (without any further configuration -e.g., kernel parameters) with the command:

cryptsetup --allow-discards --persistent refresh root

Evidently, I issued this command in the past enabling the discarding option.

It is possible to remove the flag with:

cryptsetup --persistent refresh root

https://man7.org/linux/man-pages/man8/cryptsetup.8.html

Refreshing the device without any optional parameter will refresh the device with default setting (respective to device type).

BiagioF
  • 141
  • 5