I realize that it is always a bit tricky to configure devices with root disk encryption. So I was not overly surprised that this one does not boot.
However, I am having difficulty saying what exactly is wrong.
What it should do
I followed largely this howto (though not entirely since it is several years old, is for Raspberry Pi 1, not 3, and uses /boot/cmdline.txt
and /boot/config.txt
, not /boot/boot.txt
.
It should use the configuration from
/boot/boot.txt
(or, rather/boot/boot.scr
), which is# After modifying, run ./mkscr # Set root partition to the second partition of boot device #part uuid ${devtype} ${devnum}:2 uuid setenv bootargs console=ttyGS0,115200 console=${console} ip=192.168.0.10::192.168.0.1:255.255.255.0:pi:eth0:none cryptdevice=/dev/mmcblk0p3:root root=/dev/mapper/root rw rootwait loglevel=5 if load ${devtype} ${devnum}:${bootpart} ${kernel_addr_r} /Image; then if load ${devtype} ${devnum}:${bootpart} ${fdt_addr_r} /dtbs/${fdtfile}; then if load ${devtype} ${devnum}:${bootpart} ${ramdisk_addr_r} /initramfs-linux.img; then booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}; else booti ${kernel_addr_r} - ${fdt_addr_r}; fi; fi; fi
It should boot the kernel
/boot/Image
It should use initrd
/boot/initramfs-linux.img
which is generated by the following/etc/mkinitcpio.conf
# vim:set ft=sh # MODULES # The following modules are loaded before any boot hooks are # run. Advanced users may wish to specify all system modules # in this array. For instance: # MODULES="piix ide_disk reiserfs" MODULES="" # BINARIES # This setting includes any additional binaries a given user may # wish into the CPIO image. This is run last, so it may be used to # override the actual binaries included by a given hook # BINARIES are dependency parsed, so you may safely ignore libraries BINARIES="" # FILES # This setting is similar to BINARIES above, however, files are added # as-is and are not parsed in any way. This is useful for config files. FILES="" # HOOKS # This is the most important setting in this file. The HOOKS control the # modules and scripts added to the image, and what happens at boot time. # Order is important, and it is recommended that you do not change the # order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for # help on a given hook. # 'base' is _required_ unless you know precisely what you are doing. # 'udev' is _required_ in order to automatically load modules # 'filesystems' is _required_ unless you specify your fs modules in MODULES # Examples: ## This setup specifies all modules in the MODULES setting above. ## No raid, lvm2, or encrypted root is needed. # HOOKS="base" # ## This setup will autodetect all modules for your system and should ## work as a sane default # HOOKS="base udev autodetect block filesystems" # ## This setup will generate a 'full' image which supports most systems. ## No autodetection is done. # HOOKS="base udev block filesystems" # ## This setup assembles a pata mdadm array with an encrypted root FS. ## Note: See 'mkinitcpio -H mdadm' for more information on raid devices. # HOOKS="base udev block mdadm encrypt filesystems" # ## This setup loads an lvm2 volume group on a usb device. # HOOKS="base udev block lvm2 filesystems" # ## NOTE: If you have /usr on a separate partition, you MUST include the # usr, fsck and shutdown hooks. HOOKS="base udev autodetect modconf block keyboard dropbear encryptssh filesystems fsck" # COMPRESSION # Use this to compress the initramfs image. By default, gzip compression # is used. Use 'cat' to create an uncompressed image. #COMPRESSION="gzip" #COMPRESSION="bzip2" #COMPRESSION="lzma" #COMPRESSION="xz" #COMPRESSION="lzop" #COMPRESSION="lz4" # COMPRESSION_OPTIONS # Additional options for the compressor #COMPRESSION_OPTIONS=""
It should load dropbear, should appear on 192.168.0.10 and allow me to decrypt the root disk
What it does
First, it apparently loads kernel and initrd (right?)
... then it does nothing any more
... and it does not appear on the network. The LAN device lightens up though, it a cable is applied, but I cannot see anything to the IP (192.168.0.10) or the MAC of the device on the network.
Question
At what stage does it fail?
Does the kernel load successfully?
Does the initrd load successfully?
Does the network configuration fail?
Does dropbear fail?
Is there a structured way how to approach identifying the problem here?
Note
I was thinking that I probably need to include a few encryption modules in the /etc/mkinitcpio.conf
(something like MODULES="dm_crypt dm_mod ext4 aes"
). But this cannot possibly be the reason for the present problem, can it?
Update (May 16th 2017)
- including keyword
earlyprintk
in thesetenv
line in the/boot/boot.txt
above (just afterbootargs
) will produce a lot more output in the early boot process. - the
/etc/mkinitcpio.conf
must include hooknetconf
(beforedropbear
); otherwise it fails to configure the network