Notes on LUKS + EFISTUB

Running off of an encrypted root filesystem has been one of those things that never seemed to float to the top of the todo list. However, back in December (2018, this article lived in the drafts bin for quite some time), it finally made it to the top of the todo list. At the time, one was preparing the Dell XPS 15 9550 to replace the Ideapad s405 for travel. Encrypting everything seemed prudent for a travel laptop.

As of the writing of this article, LUKS is the standard way of encrypting a filesystem in Linux. Generally, a boot loader is used to kick off an initramfs which loads the basics (need LVM, dm-crypt, and LUKS) and prompts for the passphrase for decrypting the root filesystem. If you’re fine with running a boot loader, most guides will get you going with LUKS quite quickly.

However, running a full boot loader on UEFI systems feels archaic. There is just something about using the kernel’s built-in EFISTUB that feels more elegant. And, this is where things divert from the bog-standard path. Typically, when using the EFISTUB, one does not bother with an initramfs (compile the kernel for you known hardware set and you’re good to go). However, an initramfs is integral to having an encrypted root partition.

initramfs Woes

The first problem started with trying to get a working initramfs. Since one had not used an initramfs with EFISTUB previously, there were a few hurdles to overcome. Initially, one tried to use an external initramfs. However, the 9550 does not allow/pass UEFI parameters nicely, and using the built-in kernel command line to specify an external initrfamfs in the EFI boot partition did not work. So, the initramfs needs to be built into the kernel for the XPS15 9550. This lead to a second problem.

Initially, the initramfs that genkernel builds was tried. Unfortunately, it appears this is (as of late 2018) broken/not-suitable for situations where the initramfs needs to be bundled into the kernel. Luckily, betterinitramfs can be bundled into the kernel.

Naturally, there is one gotcha to keep in mind regarding betterinitramfs. As distributed, betterinitramfs does not populate /dev/disk/by-uuid et al. as it does not provide udev (or eudev). The end result is real root needs to be specified using /dev/BLOCKDEVICENAME rather than using PARTUUID.

Conclusion

While the setup of using EFISTUB with an LUKS encrypted root partition is a little esoteric, it is possible to get working. There are a bunch of UEFI related pitfalls waiting to snare you—different platforms will have a different mix of issues. Then again, all UEFI systems should be able to use the initramfs embedded in the kernel when using the EFISTUB boot loader. Regardless, this path is not advised for those learning about/using LUKS for the first time.

-John Havlik

XPS 15 9550

When the last generation of XPS 13 laptops came out with the infinity display, I eagerly awaited an update to the XPS 15 that offered the same minimal bezel design. The Dell XPS 15 9550 is said machine. I had been looking for a 14″ laptop back when looking to replace my Vostro 1400. While I settled for the XPS 15 9530 in the last go around, the new XPS 15 9550 is best described as a 14″ laptop with a 15″ screen.

Continue reading

XPS 15 9530

While I bought an IdeaPad s405 back in June, it was never intended to replace my daily use laptop (Vostro 1400). So I was still looking for a new laptop. Even though the Dell XPS 14 ultrabook with a Haswell core would theoretically meet my requirements, such a laptop does not exist. However, the next closest thing, the Dell XPS 15 9530 (2013 edition of XPS 15) with a really sweet screen does exist.

The Hardware

The XPS 15 9530 is a high end laptop, though the model I have is not the top model. Those looking for the “professional” equivalent see the Precision M3800, it has nearly the same internals (swap the Geforce for the equivalent Quadro and it looks like the PCH in the M3800 has a heat spreader).

  • Intel Core i7-4702HQ (Quad Core 2.2GHz, 3.2GHz turbo) 37W
  • 16GiB DDR3L-1600 dual channel RAM
  • 240GB Intel 530 mSATA SSD (upgrade replaced the 32GB Micron RealSSD C400)
  • 802.11ac+bluetooth (Intel Wireless AC 7260 in M.2 form factor)
  • 500GB Samsung 840 EVO (upgrade replaced the 1TB Western Digital WD10SPCX)
  • 61Wh Li-ion battery (up to 6hrs according to Dell)
  • 15.6 display (3200 x 1800 IGZO IPS: IGZO is a substrate IPS is the pixel construction)
  • Intel HD Graphics 4600 + Nvidia Geforce GT750M

The build quality exceeds that of my other two laptops. This is to be expected given the materials (carbon fiber+aluminum+glass vs plastic), and the price. Unlike the IdeaPad s405, the XPS 15 9530 does not flex when opening the lid.

Just like the IdeaPad s405, the speakers face down, reflecting sound off the surface the laptop is resting on. Not much more to say on this one.

Performance wise, it is faster than both the Vostro 1400 and the IdeaPad s405. Again, that was expected.

Caveat Emptor

Just like the IdeaPad s405, the entire bottom of the laptop must be removed to access the internal components, including battery. Unlike the s405, opening up the laptop does not void your warranty. Additionally, Dell does provide instructions for replacing components. These are two of the biggest reasons I will continue to purchase Dell laptops.

Speaking of opening up the laptop, be warned you will need a TORX T5 driver to open up the chassis. Additionally, the XPS 15 9530 is a little tricky to get apart. While Dell does provide instructions, it isn’t very clear on how to get the carbon fiber bottom separated from the aluminum palm rest (which is where all the components are attached to). After fiddling around with it for a while, I finally figured it out. Start with one of the front corners, use a thin shim to gently separate the chassis. Then use your plastic pry tool to widen the gap, move around the rest of the front and down the two sides. Lastly, move to the back corners after you get one of them, grab onto the bottom part from the front of the laptop and pull up, the last snap should release.

While the WiFi card uses the new M.2/NGFF form factor, the SSD is connected via the old mSATA connector. This is not exactly a problem today. However, within a year M.2 will be much easier to find than mSATA (almost all new SSDs to be released in 2014 are available in M.2). If you have the 91WH battery version, that means replacing that 512GB Samsung “840 pro” class mSATA will get difficult quickly.

Other Thoughts

I still don’t like track pads. While they have grown larger, and the XPS 15 has a pretty decent trackpad. I haven’t had a chance to play with it in Linux yet, so time will tell how good it is.

The touchscreen is really awesome with Windows 8.1, with all of its gestures. Again, I haven’t had a chance to play with it in Linux yet, so time will tell how awesome it is.

The ‘BIOS’ is an UEFI interface. While it defaults to secure boot, it can be easily disabled. Unlike Intel’s NUC Kit DN2820FYKH (Bay Trail-M Celeron N2820, more on that later), the XPS 15 will happily boot non-UEFI USB thumb drives. There is an option for battery charge mode, something I haven’t seen before and will have to look into it. One option that I did not find yet was a way to disable the Nvidia Geforce GT750M from the BIOS. So, it looks like I will have to use software to disable it when Linux boots (did not want the GT750M, but I did want the better screen).

-John Havlik

[end of transmission, stay tuned]

IdeaPad s405

As mentioned previously, I am looking for a new laptop. The closest to ideal new laptop will likely be a Dell XPS 14 ultrabook when the series is refreshed with Haswell core processors. However, those are not available yet. Before heading off to WordCamp Chicago this year, I decided I would not be lugging the Vostro 1400 with me. Since Lenovo was running some pretty good outlet deals, I picked up the ideapad s405 for pretty cheap. Yes, this laptop only meets the first two requirements I set forth in “What I Look for in a Laptop”.

The Hardware

The s405 is an “entry level”/”value” segment ultrabook class laptop. However, it can’t qualify as an ultrabook as it has an AMD APU rather than Intel CPU.

  • AMD A6-4455M APU (2.1GHz, 2.6GHz turbo) 17W with HD 7500G
  • 8GiB 1.35v DDR3-1333 single channel (upgrade, more on this later)
  • 256GB Samsung 840 Pro (upgrade)
  • 802.11bgn (Ralink RT3090 based)
  • 32 Wh Li-ion battery (up to 5hrs according to Lenovo)
  • 14 inch glossy display (1366 x 768)
  • AMD Radeon HD 7500G Graphics (256 shaders, 327MHz, 424MHz turbo)

The build quality is adequate. It’s not build like a tank, unlike the Vostro 1400, but then again it is much lighter and thinner. It does flex a little when opening the lid, and will flex a little if held from either front corner.

Like a few other ultrabooks, rather than facing up at you, the speakers face down towards the surface the s405 is sitting on. This works quite well in delivering adequate sound for such a small device. This scheme delivers at least 10X better sound than that from the Vostro 1400.

Performance wise, while the A6-4455M is slower than the C2D x9000 in the Vostro 1400, it is fast enough for day to day tasks. It has no problem streaming 1080p H.264 video over WiFi (something that can’t be said about some Pentium mobile chips from only two years ago). It took about a weekend to get Funtoo up and running (with KDE4 and fglrx working), which is about right when dealing with unfamiliar hardware.

Caveat Emptor

Unlike the Vostro 1400, the s405 does not have individual compartments for accessing and upgrading components. Instead the bottom of the laptop must be removed (there are screws hidden under the rubber feet), which while not difficult is a bit of a pain when diagnosing hardware issues.

While the memory is upgradeable, not all memory is compatible. Worst of all, memory may pass several rounds of checks on memtest86 and Microsoft’s memory tester and still cause issues in the OS. Case in point, just before heading off to WordCamp Chicago I had installed a 8GiB stick of 1.35v DDR3-1600 CL11 memory (Patriot branded stick with Micron chips). While in Chicago the laptop would BSoD anywhere between 5 and 55 minutes of use (I ran Windows 8.1 while down there which isn’t a bad OS).

After returning from Chicago, I narrowed down the issue to being with the memory (replacing it with the stock memory resolved the BSoD issues). While 4GiB is probably enough memory for this laptop, I wanted more for running VMs (with Vagrant) and using for RAMdisks when compiling. Crucial happens to have 8GiB sticks of 1.35v DDR3-1333 CL9 memory that they guarantee compatibility with the s405. Thus far, it appears that the guaranteed compatible memory from Crucial is in fact compatible with the s405 (have not had any issues with it).

The s405 only supports 7mm high drives. The included 500GB WD Scorpio Blue is very slow, so it was replaced with the only 7mm drive I had on hand (a Samsung 840 pro that was supposed to go into my workstation).

Finally, for those who do not know, Lenovo (like IBM before them and HP) have device white-lists for WiFi cards. So upgrading the card in this laptop may not be easily done (will update when I have an extra mini-pcie WiFi card on hand to test).

Other Thoughts

Battery life, while more is better, and this laptop could use more, is not too bad. While waiting for my delayed flight back from WordCamp Chicago, I was able to run the s405 for 3 hours while playing music off of a SD card and writing some code and documents. This only brought the battery down to 50% (according to Windows 8.1), while I don’t think 6 hours will be the typical battery life, it should be possible.

The trackpad is nice and large, but frankly I do not like trackpads. Within Windows the Synaptics drivers do a good job at palm detection and prevent the cursor from jumping to random areas when typing. In Linux, the Synaptics drivers are pretty good, but require calibration/configuration tweaking to get the palm detection working properly.

-John Havlik

[end of transmission, stay tuned]

What I Look for in a Laptop

After having a slight scare with the “h” key on my trusty Vostro 1400 (the key mechanism was binding slightly so that it had to be firmly pressed from the top to register), I began casually perusing the laptop market to see what was available.

Since I’ve had this laptop for over 3 years now, it is nearing the end of its normal service life. Lithium Ion batteries are only good for 3 to 5 years. Based on previous experience, I probably have about a year left before the battery stops holding a charge. Even though I could just buy a replacement battery, getting something new may be a better alternate (already have a fatigue crack near the ExpressCard slot).

Continue reading