Reducing my system's boot time

My desktop took about a minute from power button to login prompt, which I figured was a bit slow for my machine. I was able to cut it down to about half a minute.

Analysis

systemd-analyze blame blamed NetworkManager-wait-online.service for 13 seconds. That is a distraction, my login manager (ly) does not wait for it. I later found that journalctl -b -o short-monotonic shows what actually blocks the login prompt.

Three of the four LUKS volumes are unlocked in parallel with a keyfile and took ~10 seconds each. Their slots used Argon2id, so they are fighting for memory bandwidth. Only home is required by local-fs.target.

LUKS2 allows a different KDF per slot, which I could use to remove the memory bandwidth usage. The passphrase slot keeps Argon2id, the keyfile slots get PBKDF2:

sudo cryptsetup luksConvertKey --key-file /etc/crypt-automount/keyfile \
  --pbkdf pbkdf2 --pbkdf-force-iterations 1000 /dev/disk/by-uuid/<uuid>

FIDO2

I have a Yubikey and typing the LUKS passphrase took another couple of seconds. Systemd can unlock LUKS2:

sudo pacman -S libfido2
sudo systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=no /dev/disk/by-uuid/<uuid>

Add rd.luks.options=fido2-device=auto,token-timeout=15s to the kernel command line and rebuild the initrd. The passphrase stays as fallback when no key is detected.

Missing unlock prompt

After enrolling a Yubikey, boot showed a blinking cursor and nothing else. Apparently, “Please confirm presence on security token to unlock” only goes to the journal. systemd.show_status=1 shows it but buries it in unit output.

In src/shared/libfido2-util.c systemd hands that message to Plymouth. So I installed Plymouth to improve my UX, on Arch:

sudo pacman -S plymouth
# HOOKS=(base systemd plymouth ... sd-encrypt ...), add splash to the cmdline
sudo mkinitcpio -P

The BIOS

I assumed 15 seconds of firmware would be AM5 memory training. I updated the BIOS firmware, enabled Memory Context Restore and Power Down Enable, disabled CSM, and cold booted. Firmware went from 15.3 to 14.0 seconds.

Result

Linux’s share went from 36 seconds to 14.

See also

• systemd libfido2-util.c
• systemd issue #38324
• man crypttab, fido2-device= and token-timeout=