9

wiki.ubuntuusers.de says if I want to use TRIM on an encrypted SSD, I need at least cryptsetup 1.4 and kernel 3.1. Do I need this, when creating the partitions and setting up encryption, or is upgrading afterwards enough?

2 Answers 2

9

Ubuntu 11.10 Oneiric does not ship with cryptsetup 1.4, although Precise does. I don't know whether cryptsetup can be upgraded on Oneiric or not. Since Precise will be released in a month, you can also wait for that release before considering TRIM with encrypted partitions. The kernel can always be upgraded afterwards.

From http://code.google.com/p/cryptsetup/wiki/Cryptsetup140:

Support --allow-discards option to allow discards/TRIM requests.

Since kernel 3.1, dm-crypt devices optionally (not by default) support block discards (TRIM) commands.

If you want to enable this operation, you have to enable it manually on every activation using --allow-discards

cryptsetup luksOpen --allow-discards /dev/sdb test_disk

WARNING: There are several security consequences, please read at least http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html before you enable it.

As you can see, this feature is not enabled by default because of the degraded security as mentioned in the linked blog. So, if you use cryptsetup on kernel 3.0 (the one shipped with Precise), you won't have TRIM support on your encrypted partitions. After upgrading to 3.1+, you still don't have unless you enable it.

To do so, you have to edit /etc/crypttab after installation (not sure if it's possible during installation) and add the discard option. See also crypttab(5).

7

I have posted a step by step guide to enabling TRIM with LUKS encrypted partitions in Ubuntu 12.04 or any Debian with cryptsetup 1.4+ and Kernel 3.1+. (Feel free to copy it here if some askubuntu guidelines deem it necessary.)

Example Setup

source

Notebook with SSD as the single drive, Linux installed in single ext4 LVM root partition with LVM swap partition, both over LUKS encrypted logical partition.

SSD: /dev/sda

$ sudo fdisk -l /dev/sda
/dev/sda1               # boot partition (83) (unencrypted, ext4)
/dev/sda2               # extended partition
/dev/sda5               # logical partition (83) with LUKS encryption

$ ls /dev/mapper
/dev/mapper/sda5_crypt         # encrypted LUKS device in physical /dev/sda5 partition
/dev/mapper/volumegroup-root   # root partition sda5_crypt
/dev/mapper/volumegroup-swap   # swap partition sda5_crypt

HowTo

  1. Make a backup of all your data. You're messing with your file system so having a backup is simply a good idea.

  2. Make sure you have the required kernel and cryptsetup versions (3.1 & 1.4, e.g. in Ubuntu 12.04, beware though, at time of writing 12.04 is still beta).

  3. Add discard parameter to the file system options of the encrypted LVM volume(s) in your /etc/fstab file. This makes the file system of your LVM partition aware that you want to use TRIM.

    /dev/mapper/volumegroup-root    /    ext4    discard,noatime,nodiratime,errors=remount-ro    0    1
    
  4. The last step is not enough though. As long as LUKS is not aware that you want to use TRIM it will effectively block all TRIM operations coming from the LVM partition's file system, for security reasons. Add discard parameter to the cryptdevice options in /etc/crypttab to make LUKS accept the discard behavior of the LVM partition.

    sda5_crypt UUID=e364d03f-[...]6cd7e none luks,discard
    
  5. Rebuild your initramfs. The crypttab options are stored there and used on boot.

    sudo update-initramfs -c -k all
    
  6. Reboot.

  7. Check if TRIM is now active.

    sudo dmsetup table /dev/mapper/sda5_crypt --showkeys
    
  8. If the last command shows a result like this (1 allow_discards at the end) you're all set.

    0  77656056  crypt  aes-cbc-essiv:sha256  abc[...]c7a0c  0  8:5  2056  1  allow_discards
    
2
  • Excellent write up in the link. Thanks. Works on 18.04 as well.
    – don.joey
    Nov 27, 2018 at 11:23
  • 1
    @don.joey and nem75: Is TRIM still needed with SSDs (LVM & LUKS) nowadays?
    – Filbuntu
    Aug 17, 2019 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .