After spending some time on the official Sid installation, I want to go to stable I have a Pocket Reform with a RK3588 with an NVMe SSD M.2. My goal is to have an encrypted installation.
I went to reform.debian.net -- Debian Installer for MNT Reform to get the installer. I went with the “With Linux from trixie-backports” version. If I understand it correctly, that means I have stable Debian but with a newer kernel (correct?). I then flashed it to an SD card, and put it into the Pocket Reform. The first thing I notice is that the entire display is sideways
That’s not the case with the official installer But okay, I can tilt my head during installation. I then noticed that during the installation process it can’t use the Wifi, so I plug in Ethernet via an adapter.
Now I get to the point of choosing the partitioning scheme. I usually go with the “Guided - use entire disk and set up encrypted LVM”, but the documentation states that I need to go manual here. This is the point where I get confused. The table lists three options for the /boot partition, with the following values for my RK3588:
SD Card:
eMMC: (why is that not possible? Isn’t that what the official Sid does by default?)
NVMe:
So I can’t put it on the eMMC. If I put it on the SD Card, I would need to keep the SD card in my Pocket indefinitely, right? So should I try to put it on the NVMe? If so, how? I think that would be the way:
From my limited understanding, /boot can’t be encrypted. So I need to first create an unencrypted /boot partition on the NVMe, then make the rest of it encrypted. And then put / on that encrypted volume. Is that right?
I can’t help with a manual installation because I have never done one on my Pocket, but if you want to go the easy path, you can use the images from reform.debian.net -- MNT Reform system images .
These are meant to be written to a sdcard and then boot from them. Then, you can use the tool reform-setup-encrypted-diskwhich will transfer the running operative system to the nvme encrypted.
Altough Debian stable is not officially supported, personally I’ve been using for more than a year and I’m pretty happy with it.
Why would it not be the case with the official installer? Or do you mean that it is not the case with the official installer on other computers? If so, then yes the issue does not exist on other computers because other computers do usually not use a display which was meant to be used in portrait mode in landscape mode. Doing so requires everything to be rotated and on the text console that is done using the fbcon=rotate kernel cmdline option which bterm ignores and hence above MR.
Because the table is outdated. It was created at a time when we still considered writing to emmc to be dangerous because it could soft-brick the device.
Once that is merged and once you have that u-boot version flashed to your emmc, you can actually choose “Guided - use entire disk and set up encrypted LVM” because then u-boot will be able to read your /boot partition from nvme.
Correct.
Putting /boot on nvme will only work once rk3588 u-boot has above MR merged and released and you have it flashed to your emmc.
I agree that this is the “easy path”. But the resulting system will not be as close to a “normal” installation of Debian as when installing it the “hard way” using debian-installer.
When I don’t receive bug reports for my stuff it either means it just works or that nobody is using it. I’m happy that it works for you so far.
Thank you both for your answers I will give it another go tomorrow, need some sleep first
Re-reading my comment about tilting my head I see that it might have come off as sarcastic. It was not meant that way: It was a bit awkward to use sideways, but it was not a problem for me. This was an attempt of reporting a bug in a slightly fun way, which did not work so well. Sorry for that!
To make it very explicit: I have nothing but appreciation and respect for all the work that has gone into the hardware, software and documentation for these notebooks. Thanks a ton
Just a small observation. Booting off the SD card should not require having the SD card inserted all the time. As far as I’m aware, the only things that require the boot SD card are upgrades to the files under /boot, like installing a new kernel. So you could just unmount /boot and take out the SD card once the machine’s up and running, so long as you remember to re-insert and mount /boot before any upgrades that might affect files under /boot. If you don’t do this, the upgrades will I expect happen under the mount-point directory on the root filesystem, which is not what you want.
I know that this thread is about the Pocket Reform, but on my original Reform, I’ve followed a more conservative version of this strategy for several years: That is, I leave the SD card inserted and /boot mounted all the time, except when I want to use the card reader for something else. Then I unmount /boot and take out the card. When I’m finished using the card reader, I put the boot card back and and mount /boot again, so I don’t risk forgetting for an upgrade. I expect that the behaviour of the Pocket Reform would be the same (as any machine that can boot off SD card).
Obviously, this doesn’t apply if you also have your root filesystem on the SD card.
There is nothing to be sorry about! I appreciate the bug report.
That is correct. Still a hassle though. Right now, there is no reason not to move /boot to emmc unless you want emmc to contain a pristine rescue system. After the next u-boot release, you will be able to put /boot on nvme and then you can get the best of all worlds:
self-contained rescue system (and u-boot) on emmc
sd-card slot free for you to use
self-contained OS on your nvme
One thing which didn’t make it into this u-boot release was that the pocket also tries to boot from a usb thumb drive. Reason for that is that it takes a few seconds for USB to get initialized and that would add to the boot time every time.
Yes, that’s correct. Back when I did it like that, my problem was that every second time that I put my (big) Reform in and out of my backpack, the sd-card would not be fully pushed in anymore because being in my backpack pushed it a bit in so that it comes out. If I don’t notice that this happens, I loose my sd-card (happened), the sd-card breaks (happened) or i forget to re-insert it before doing an upgrade (happened). Which platform are you on? These days, all platforms can safely have /boot on emmc.
I went with the bootable system image. I think there is a small bug: It starts the “MNT install wizard”, but an older version that gives you the choice between Sway and Wayfire (and not GNOME). I selected Sway (to see what happens), and after the wizard was done, I was booted into GNOME. In the login screen, I could choose between GNOME and Sway.
I then ran sudo reform-setup-encrypted-disk directly from the SD card. In the last step, it sets up /boot on the eMMC. Everything works. Awesome! My SSD is now 100% LUKS encrypted, and the eMMC holds the /boot and an unmounted encrypted install (which is a mirror of the initial SD card content).
Thanks to @amospalla for the hint, and to @josch for the implementation <3
The Installer Route:
Thanks for the explanation! That helps a lot. I will wait for the release of u-boot with the adjusted boot order ( patch: reorder BOOT_TARGETS to sd, nvme, emmc, usb (!17) · Merge requests · Reform / MNT Reform RK3588 U-Boot · GitLab ), and then run through the installer route to get a Debian install with only the packages installed that I want, fully installed on the NVMe with encyption It will also allow installing the main installation on the NVMe, and a rescue install on the eMMC. I’ll definitely give you feedback again when I went through it!
I’ll try to summarize the other issues described in my own words (which are both non-blockers for me), to make sure I understand it correctly:
The Pocket Reform, which uses a high-dpi portrait display in landscape mmode, requires flipping the display (fbcon=rotate). The (non-graphical) Debian installer uses bterm, and that does not support fbcon. The maintainers are informed, but have not reacted yet.
You went with providing a network installer for Debian. That does not include the Wifi Firmware for the MediaTek MT7612U built into my Pocket Reform (from my understanding, different generations of the Pocket have different network cards), which means one can’t use Wi-Fi during the installation. That’s on your roadmap.
I would love to support you in your work on Debian Stable for the Pocket. Let’s chat at 39c3, where I can help
Just wanted to quickly jump in here to say: I’m super happy on Debian Stable on my Pocket Reform <3 It is super reliable, it just works. Thanks a ton, it is a daily joy to use my tiny computer.
I did exactly that yesterday night on a311d with unreleased u-boot version. I was able to install debian to nvme with debian-installer and just choose automatic partitioning with luks. This means that /boot is on nvme and root and swap inside luks. No custom fiddling and it worked right away. IRC log here: 2026-01-10.log
This will work as well. I did my installation on a311d using wifi which requires the realtek firmware.
I have a Pocket Reform with a RK3588 with an NVMe SSD M.2. My goal is to have an encrypted installation.
But okay, I can tilt my head during installation. I then noticed that during the installation process it can’t use the Wifi, so I plug in Ethernet via an adapter.
(why is that not possible? Isn’t that what the official Sid does by default?)
I will give it another go tomorrow, need some sleep first 