I realize that it is always a bit tricky to configure devices with root disk encryption. So I was not overly surprised that this one does not boot.

However, I am having difficulty saying what exactly is wrong.

What it should do

I followed largely this howto (though not entirely since it is several years old, is for Raspberry Pi 1, not 3, and uses /boot/cmdline.txt and /boot/config.txt, not /boot/boot.txt.

  • It should use the configuration from /boot/boot.txt (or, rather /boot/boot.scr), which is

    # After modifying, run ./mkscr
    # Set root partition to the second partition of boot device
    #part uuid ${devtype} ${devnum}:2 uuid
    setenv bootargs console=ttyGS0,115200 console=${console} ip= cryptdevice=/dev/mmcblk0p3:root root=/dev/mapper/root rw rootwait loglevel=5
    if load ${devtype} ${devnum}:${bootpart} ${kernel_addr_r} /Image; then
      if load ${devtype} ${devnum}:${bootpart} ${fdt_addr_r} /dtbs/${fdtfile}; then
        if load ${devtype} ${devnum}:${bootpart} ${ramdisk_addr_r} /initramfs-linux.img; then
          booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r};
          booti ${kernel_addr_r} - ${fdt_addr_r};
  • It should boot the kernel /boot/Image

  • It should use initrd /boot/initramfs-linux.img which is generated by the following /etc/mkinitcpio.conf

    # vim:set ft=sh
    # The following modules are loaded before any boot hooks are
    # run.  Advanced users may wish to specify all system modules
    # in this array.  For instance:
    #     MODULES="piix ide_disk reiserfs"
    # This setting includes any additional binaries a given user may
    # wish into the CPIO image.  This is run last, so it may be used to
    # override the actual binaries included by a given hook
    # BINARIES are dependency parsed, so you may safely ignore libraries
    # FILES
    # This setting is similar to BINARIES above, however, files are added
    # as-is and are not parsed in any way.  This is useful for config files.
    # HOOKS
    # This is the most important setting in this file.  The HOOKS control the
    # modules and scripts added to the image, and what happens at boot time.
    # Order is important, and it is recommended that you do not change the
    # order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
    # help on a given hook.
    # 'base' is _required_ unless you know precisely what you are doing.
    # 'udev' is _required_ in order to automatically load modules
    # 'filesystems' is _required_ unless you specify your fs modules in MODULES
    # Examples:
    ##   This setup specifies all modules in the MODULES setting above.
    ##   No raid, lvm2, or encrypted root is needed.
    #    HOOKS="base"
    ##   This setup will autodetect all modules for your system and should
    ##   work as a sane default
    #    HOOKS="base udev autodetect block filesystems"
    ##   This setup will generate a 'full' image which supports most systems.
    ##   No autodetection is done.
    #    HOOKS="base udev block filesystems"
    ##   This setup assembles a pata mdadm array with an encrypted root FS.
    ##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
    #    HOOKS="base udev block mdadm encrypt filesystems"
    ##   This setup loads an lvm2 volume group on a usb device.
    #    HOOKS="base udev block lvm2 filesystems"
    ##   NOTE: If you have /usr on a separate partition, you MUST include the
    #    usr, fsck and shutdown hooks.
    HOOKS="base udev autodetect modconf block keyboard dropbear encryptssh filesystems fsck"
    # Use this to compress the initramfs image. By default, gzip compression
    # is used. Use 'cat' to create an uncompressed image.
    # Additional options for the compressor
  • It should load dropbear, should appear on and allow me to decrypt the root disk

What it does

First, it apparently loads kernel and initrd (right?) First, it apparently loads kernel and initrd (right?)

... then it does nothing any more ... then it does nothing any more

... and it does not appear on the network. The LAN device lightens up though, it a cable is applied, but I cannot see anything to the IP ( or the MAC of the device on the network.


At what stage does it fail?

Does the kernel load successfully?

Does the initrd load successfully?

Does the network configuration fail?

Does dropbear fail?

Is there a structured way how to approach identifying the problem here?


I was thinking that I probably need to include a few encryption modules in the /etc/mkinitcpio.conf (something like MODULES="dm_crypt dm_mod ext4 aes"). But this cannot possibly be the reason for the present problem, can it?

Update (May 16th 2017)

  • including keyword earlyprintk in the setenv line in the /boot/boot.txt above (just after bootargs) will produce a lot more output in the early boot process.
  • the /etc/mkinitcpio.conf must include hook netconf (before dropbear); otherwise it fails to configure the network

Regarding the questions

  • kernel and initrd were loading successfully
  • the boot process failed to configure the network and did therefore prompt for the LUKS password in the local tty
  • dropbear should work fine once the network configuration is successful

Diagnosing the problem

  • including keyword earlyprintk in the setenv line in the /boot/boot.txt above (just after bootargs) will produce a lot more output in the early boot process.
  • in the present case, this offered a bit more insight on the matter what was actually missing (both network configuration and modules for running the network device)
  • in the absence of a clear idea what is wrong or how to solve it, the process involves a lot of trial and error (always removing the flash disk from the Raspberry Pi and mounting it in a laptop).


Both network configuration and modules for running the network device were missing.


I included a number of modules and more than one additional hook. I am not absolutely sure they are all necessary.

  • the /etc/mkinitcpio.conf must include hook netconf (maybe also net) (before dropbear); otherwise it fails to configure the network.
  • the driver for the network device (in my case smsc95xx) must be included as module.
  • the network device is (internally) a usb device; therefore we also need usb drivers (also as modules: g_cdc usb_f_acm usb_f_ecm (maybe also g_ether)).

Alltogether /etc/mkinitcpio.conf would look like so (uncommented lines only):

MODULES="<any encryption and filesystem modules you may need> g_cdc usb_f_acm usb_f_ecm smsc95xx g_ether"
HOOKS="base udev autodetect modconf block keyboard net netconf dropbear encryptssh filesystems fsck"
  • The net hook is not required before the netconf hook which can be seen when comparing /usr/lib/initcpio/{install,hooks}/net to /usr/lib/initcpio/{install,hooks}/netconf: They both add ipconfig to the initial ramdisk and call this during boot to configure a network device. – Binabik Dec 8 '18 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.