Debian encrypted root on rockpi4, remote unlocking (SOLVED)

Hi,
since the EFF recommend rockchip CPUs and the rk3399 supports AES hardware acceleration (both as opposed to ie raspi, great job radxa!) we bought a rockpi4 to use as a backup server. The debian image provided worked out of the box from both sdcard and emmc (though maybe time for a dist-upgrade), and now i want to set up (1) encrypted root fs with luks, followed by (2) remote unlocking of said fs over ssh. Booting from sdcard i dd:ed the debian image to the emmc, then overwrote the root partition with a luks drive, unlocked and formatted it and copied the system from the sdcard to the new, encrypted root partition. After mounting /boot, /proc, /sys and /dev i chrooted in, added/edited crypttab and fstab entries using the same device names as when mounting and successfully ran ‘update-initramfs -u’.

Time for a first boot attempt! I connect to the serial port via minicom from my laptop and can successfully unlock the encrypted root, but then i’m thrown into the initramfs shell:

Loading, please wait…
Starting version 247.3-6
Begin: Loading essential drivers … done.
Begin: Running /scripts/init-premount … done.
Begin: Mounting root file system … Begin: Running /scripts/local-top … IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
Please unlock disk cryptrootfs: IP-Config: no response after 2 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
IP-Config: no response after 3 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
IP-Config: no response after 4 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
IP-Config: no response after 6 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP

IP-Config: no response after 9 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
IP-Config: no response after 16 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP
cryptsetup: cryptrootfs: set up successfully
done.
Begin: Running /scripts/local-premount … done.
Begin: Waiting for root file system … Begin: Running /scripts/local-block … done.
done.
Gave up waiting for root file system device. Common problems:

  • Boot args (cat /proc/cmdline)
    • Check rootdelay= (did the system wait long enough?)
  • Missing modules (cat /proc/modules; ls /dev)
    ALERT! UUID=3eff3098-0936-4a20-8e2f-f6048d96509a does not exist. Dropping to a shell!

BusyBox v1.30.1 (Debian 1:1.30.1-6+b3) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

(initramfs) IP-Config: no response after 25 secs - giving up
IP-Config: eth0 hardware address 2e:b6:85:62:15:27 mtu 1500 DHCP RARP

Please ignore the IP-Config messages messing up the log, they’re just because i installed but haven’t configured sshd for the next step. Anyway /proc/cmdline confirms the problem:

earlyprintk console=ttyFIQ0,1500000n8 rw init=/sbin/init rootfstype=ext4 rootwait root=UUID=3eff3098-0936-4a20-8e2f-f6048d96509a console=ttyS2,1500000n8

On x86 the kernel command line is in /etc/default/grub.cfg but arm has no grub. I’ve been searching but can’t find where or how to change the kernel command line, anyone? I’m almost there, dammit! :smiley:

since the EFF recommend rockchip CPUs and the rk3399 supports AES hardware acceleration

Where is the news from?

https://www.fsf.org/resources/hw/single-board-computers < FSF article on SBCs and software freedom. RK3399 is specifically mentioned as the best available option at the time of latest update (2021-03). Oh it was not the EFF, rather FSF. Almost right :wink:

By the way i got it to work, at least the ugly-hack way. The image you provide use the extlinux bootloader, a version of syslinux. I found the config file at /boot/extlinux/extlinux.conf and just updated the kernel command line root parameter to point to the unlocked crypto volume instead and it worked! Remote unlocking was also easier than i expected, might do a write-up someday. Or just duckduckgo like i did :slight_smile: