Hi,

I've recompiled my kernel¹ of my raspberry pi 4 that run under Devuan rpi

::: spoiler some of the command used on the rpi to compile

apt install build-essential libncurses-dev bison flex libssl-dev libelf-dev
mkdir /RaspKernel_6_1_y && cd /RaspKernel_6_1_y
git clone --depth=1 --branch rpi-6.1.y https://github.com/raspberrypi/linux
cd linux
cp /boot/config-6.1.93 /RaspKernel_6_1_y/linux/.config
KERNEL=kernel8
make menuconfig
time make -j$((`nproc` - 2)) Image.gz modules dtbs
make -j$((`nproc` - 2)) modules_install
cp arch/arm64/boot/Image.gz /boot/broadcom/$KERNEL.img
cp arch/arm64/boot/dts/broadcom/*.dtb /boot/broadcom/
cp arch/arm64/boot/dts/overlays/*.dtb* /boot/firmware/overlays/
cp arch/arm64/boot/dts/overlays/README /boot/firmware/overlays/
reboot
apt install cryptsetup

I'm currently following this guide LUKS on Raspberry Pi ( for context my related lemmy post )

So now that the kernel has been updated, the cryptsetup benchmark -c xchacha20,aes-adiantum-plain64 command is successful

So in order to enable luks in initramfs I'm following the preparing-linux section of this guide.\
\
we can read:

initramfs has to be recreated

I followed the guidance and edited the initramfs-rebuild file to match my setup

::: spoiler initramfs-rebuild file

\#!/bin/sh -e

# Rebuild initrd.gz after kernel upgrade to include new kernel's modules.
# https://github.com/Robpol86/robpol86.com/blob/master/docs/_static/initramfs-rebuild.sh
# Save as (chmod +x): /etc/kernel/postinst.d/initramfs-rebuild

# Remove splash from cmdline.
if grep -q '\bsplash\b' /boot/cmdline.txt; then
  sed -i 's/ \?splash \?/ /' /boot/cmdline.txt
fi

# Exit if not building kernel for this Raspberry Pi's hardware version.
version="$1"
current_version="$(uname -r)"
case "${current_version}" in
  *-v7+)
    case "${version}" in
      *-v7+) ;;
      *) exit 0
    esac
  ;;
  *+)
    case "${version}" in
      *-v7+) exit 0 ;;
    esac
  ;;
esac

# Exit if rebuild cannot be performed or not needed.
[ -x /usr/sbin/mkinitramfs ] || exit 0
[ -f /boot/broadcom/initrd.gz ] || exit 0
lsinitramfs /boot/broadcom/initrd.gz |grep -q "/$version$" && exit 0  # Already in initramfs.

# Rebuild.
mkinitramfs -o /boot/broadcom/initrd.gz "$version"

grep: /boot/config-6.1.93TEST+: No such file or directory

I've did

cp /RaspKernel_6_1_y/linux/.config /boot/config-6.1.93TEST+
mkinitramfs -o /boot/broadcom/initrd.gz

rebooted. Landed in the initramfs shell as expected

but benchmark -c xchacha20,aes-adiantum-plain64 is no longer successful

Cipher xchacha20,aes-adiantum-plain64 (with 256 bit key) is not available

Any ideas where might lay the problem ?

Thanks.

1. --branch rpi-6.1.y github.com/raspberrypi/linux ↩︎

GitHub - raspberrypi/linux: Kernel source tree for Raspberry Pi-provided kernel builds. Issues unrelated to the linux kernel should be posted on the community forum at forums.raspberrypi.com/

Kernel source tree for Raspberry Pi-provided kernel builds. Issues unrelated to the linux kernel should be posted on the community forum at https://forums.raspberrypi.com/ - raspberrypi/linux

^GitHub

SpongeB0B

2025-01-11 11:57:19

boot on LUKS encrypted drive ( initramfs Vs initrd ) ?

Hi,

I'm trying to encrypt the root filesystem / of a raspberry pi 4 device running under Devuan rpi ( custom kernel )

I'm following LUKS on Raspberry Pi 2021 guide

That explain step by step how achieve this.

But the guide use initramfs and my distro seem to use initrd

So the question, is: should I migrate to initramfs ? and how check whats is inside my current initrd

or keep-up with initrd but then how insert the necessary to enable LUKS drive to be mounted by it ( initrd ) ?

Thanks.

LUKS on Raspberry Pi

Guide to perform a full disk encryption of the SD Card of a Raspberry Pi running Raspberry Pi OS

^{LUKS-on-Raspberry-Pi}