Secure boot with Raspberry Pi CM4 and Nerves

Nerves Forum Nerves Chat
21

Finally some progress. Hooking up the right pin for two-way serial on my serial adapter (FTDI or whatever) and trying a minimal /init:

#!/bin/sh
echo "======================= Running init from rootfs_overlay"

mount -t devtmpfs none /dev
mount -t proc proc /proc
mount -t sysfs sysfs /sys

echo "Waiting for /dev/mmcblk0p2..."
until  [ -b "/dev/mmcblk0p2" ]; do
  sleep 5
done

echo "Starting shell?"
exec sh

Then I could actually see what was happening as I was getting really weird errors and the output was being swallowed.

mkdir /media/mmcblk0p2
mount /dev/mmcblk0p2 /media/mmcblk0p2
exec switch_root /media/mmcblk0p2/ /sbin/init

This gave me a proper error!

# exec switch_root /media/mmcblk0p2 /sbin/init
erlinit: Cannot remount /dev
erlinit: Cannot create /dev/pts
erlinit: Cannot create /dev/shm
erlinit: Could not create symlink '/dev/rootdisk0'->'/dev/mmcblk0': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p3'->'/dev/mmcblk0p3': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p2'->'/dev/mmcblk0p2': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p1'->'/dev/mmcblk0p1': Read-only file system
erlinit: error setting controlling terminal: /dev/tty1
erlinit: Cannot mount /dev/mmcblk0p1 at /boot: No such file or directory
erlinit: Cannot mount /dev/mmcblk0p3 at /root: No such file or directory
erlinit: Couldn't open /dev/null
erlinit: `/usr/bin/boardid` failed. Using default ID: '00000000'
erlinit: Unable to create seed directory
nbtty: Could not find a pty.

[nbtty: terminating]
erlinit: Erlang VM exited
erlinit: Sending SIGTERM to all processes
erlinit: Sending SIGKILL to all processes
erlinit: Unable to create seed directory
[ 5902.674349] reboot: Restarting system

So I need to understand what’s going on with /dev because we do need devices.
Fundamentally I think everything else fails off of that.

22

After a lot of fiddling to avoid needing to recompile for 45 minutes to modify the executable bit on init_sh I have switched root and have a shell inside my rootfs.img:

# exec switch_root /media/root/ /sbin/init_sh
======================= Running second /init
Starting second shell
# ls
var    tmp    srv    run    proc   mnt    lib64  etc    data   bin
usr    sys    sbin   root   opt    media  lib    dev    boot
# ls /dev
shm  pts  log
# mount -t devtmpfs -o rw none /dev
mount: permission denied (are you root?)
# whoami
sh: whoami: not found
# id -u
1000
23

While on original boot I am root:

======================= Running init from rootfs_overlay
Waiting for /dev/mmcblk0p2...
[    2.682475] mmc0: new DDR MMC card at address 0001
[    2.688650] mmcblk0: mmc0:0001 8GTF4R 7.28 GiB 
[    2.695090]  mmcblk0: p1 p2 p3
[    2.698437] mmcblk0: mmc0:0001 8GTF4R 7.28 GiB
[    2.703218] mmcblk0boot0: mmc0:0001 8GTF4R 4.00 MiB 
[    2.708718] mmcblk0boot1: mmc0:0001 8GTF4R 4.00 MiB 
[    2.713954] mmcblk0rpmb: mmc0:0001 8GTF4R 512 KiB, chardev (246:0)
Mounting /dev/mmcblk0p2...
Mounted /media/root
# id -u
0
24

I probably should have been root when re-compressing the darned thing after editing it…

25

I got it!

# exec switch_root /media/root/ /sbin/init_sh
======================= Running second /init
Starting second shell
# ls
var    tmp    srv    run    proc   mnt    lib64  etc    data   bin
usr    sys    sbin   root   opt    media  lib    dev    boot
# mount -t devtmpfs -o rw none /dev
# mount -t proc proc /proc
# mount -t sysfs sysfs /sys
# exec /sbin/init
[   40.991680] erlinit: Cannot mount /sys
[   41.009972] F2FS-fs (mmcblk0p3): Magic Mismatch, valid(0xf2f52010) - read(0xffffffff)
[   41.018038] F2FS-fs (mmcblk0p3): Can't find valid F2FS filesystem in 1th superblock
[   41.026147] F2FS-fs (mmcblk0p3): Magic Mismatch, valid(0xf2f52010) - read(0xffffffff)
[   41.034110] F2FS-fs (mmcblk0p3): Can't find valid F2FS filesystem in 2th superblock
[   41.042127] erlinit: Cannot mount /dev/mmcblk0p3 at /root: Invalid argument
erlinit: The shell will be launched on tty 'tty1'.
erlinit: If you would like the shell to be on this tty,
erlinit: configure erlinit with '-c ttyS0'.
erlinit: The hostname is 'nerves-72cf'.

Now to see if I can just script it without going through an interactive shell each time. Which seems to be a problem?

1 Like