Trying to get the secure-boot-example boot.img to run before I dig into initramfs. It should be able to run and seems to be helping me in catching more goofs.
lawik
Nerves Core Team
lawik
Nerves Core Team
lawik
Nerves Core Team
This was an experiment I didn’t really expect to work but had mild hopes for.
I took the standard nerves_system_rpi4. Baked a firmware image with it and did fwup -d boot.img bla-bla-bla.fw and it does produce a boot.img but it is not one that works. Probably as you aluded to Frank, it expects the FAT archive and this is something else:
RPi: BOOTLOADER release VERSION:e608a69d DATE: 2024/04/15 TIME: 14:12:14
BOOTMODE: 0x06 partition 0 build-ts BUILD_TIMESTAMP=1713186734 serial 2f2a72cf boardrev b03141 stc 477024
PM_RSTS: 0x00001000
part 00000000 reset_info 00000000
uSD voltage 3.3V
Initialising SDRAM 'Samsung' 16Gb x1 total-size: 16 Gbit 3200
DDR 3200 0 0 16 152
Boot mode: SD (01) order f2564
SD HOST: 200000000 CTL0: 0x00800000 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
SD HOST: 200000000 CTL0: 0x00800f00 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
EMMC
SD retry 1 oc 0
SD HOST: 200000000 CTL0: 0x00800000 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
OCR c0ff8080 [0]
CID: 001501003847544634520680754ad9ca
SD HOST: 200000000 CTL0: 0x00800f04 BUS: 25000000 Hz actual: 25000000 HZ div: 8 (4) status: 0x1fff0000 delay: 4
SD HOST: 200000000 CTL0: 0x00800f04 BUS: 50000000 Hz actual: 50000000 HZ div: 4 (2) status: 0x1fff0000 delay: 2
MBR: 0x0000003f, 716800 type: 0x0c
MBR: 0x00168000, 289044 type: 0x83
MBR: 0x001f5228,13217240 type: 0x83
MBR: 0x00000000, 0 type: 0x00
Trying partition: 0
type: 32 lba: 63 oem: 'MSDOS5.0' volume: ' NO NAME '
rsc 32 fat-sectors 5601 c-count 705566 c-size 1
root dir cluster 2 sectors 0 entries 0
FAT32 clusters 705566
Trying partition: 0
type: 32 lba: 63 oem: 'MSDOS5.0' volume: ' NO NAME '
rsc 32 fat-sectors 5601 c-count 705566 c-size 1
root dir cluster 2 sectors 0 entries 0
FAT32 clusters 705566
secure-boot
Loading boot.img ...
SIG boot.sig 4c5a9740190c57241651194413b3db7fd5c64acff948563bcea02a1c23fac22a 1716540259
Error 1 loading boot.img
Boot mode: USB-MSD (04) order f256
PCIe timeout: 0x0000008f
USB xHC init failed
Boot mode: NVME (06) order f25
PCIe timeout: 0x0000008f
Failed to open device: 'nvme'
Retry NVME 1
PCIe timeout: 0x0000008f
Failed to open device: 'nvme'
Boot mode: BCM-USB-MSD (05) order f2
XHCI-STOP
xHC ver: 272 HCS: 01000140 0c0000f1 07ff000a HCC: 0220fe65
xHC ports 1 slots 64 intrs 1
XHCI-STOP
xHC ver: 272 HCS: 01000140 0c0000f1 07ff000a HCC: 0220fe65
USBSTS 0
USB MSD stopped. Timeout: 25 seconds
Boot mode: NETWORK (02) order f
GENET: RESET_PHY 1
CTL 1140 PHY ID 600d 84a2
MII_CONTROL 1140
MII APD 0021 SCTL3 0021 IDDQ 0000
NETWORK: 2c:cf:67:0a:8a:f7 wait for link TFTP: 0.0.0.0
Now people should at least be able to find it by the error code.
0
lawik
Nerves Core Team
Next approach is a Nerves System that essentially build as usual but uses the scripts and config from raspberry pi buildroot as a post-build.sh and generates a boot.img in the process. This would still produce a .fw which I guess would still be fine for development.
If I get it working (setting it up is a bit tedious) then I would be able to build my system by essentially building two Nerves systems.
Inner: The first one for my actual firmware and application, which produces the boot.img and a .fw. This would have the
Outer: And the next one that packages the boot.img and boot.sig for secure boot and produces a .fw for the eMMC/SD card.
@fhunleth does this make sense?
Since the boot.img is also signed we won’t ever be able to change data inside it without also updating the boot.sig. So upgrade should hit the “outer” one.
0
lawik
Nerves Core Team
Every time I read the original response I understand a bit more. The amount of “I have to try or I don’t understand” is ridiculous today.
1
lawik
Nerves Core Team
Trying to unfurl all this without deep insight into linux booting is “fun”.
- The bootloader, managed with
usbbootandrpiboot. This determines whether secure-boot is ON. - The partition table, on the SD card/eMMC:
- Boot A - Initial boot partition, a FAT32 filesystem containing stuff required to boot.
config.txta Raspberry Pi special saying how this boot should happen, after the bootloader. Should haveboot_ramdisk=1apparently which is not really in the docs. This makes it bootboot.img.boot.imga Raspberry Pi special, this is a file that if doing secure-boot will be loaded as a ramdisk and the linux inside it will be started.- (more to come)
boot.sigsignature for theboot.imgto ensure it matches with the expected public key stored in the bootloader EEPROM.
- Boot B - Secondary boot partition if an update has shipped.
- same as Boot A, essentially.
- Root A - Root partition. This is our Nerves Linux system where all the fun happens and where we want to be. This starts the BEAM and all that.
- Boot A - Initial boot partition, a FAT32 filesystem containing stuff required to boot.
0
lawik
Nerves Core Team
Alright. I have a system baking a proper boot.img for me:
RPi: BOOTLOADER release VERSION:e608a69d DATE: 2024/04/15 TIME: 14:12:14
BOOTMODE: 0x06 partition 0 build-ts BUILD_TIMESTAMP=1713186734 serial 2f2a72cf boardrev b03141 stc 477024
PM_RSTS: 0x00001000
part 00000000 reset_info 00000000
uSD voltage 3.3V
Initialising SDRAM 'Samsung' 16Gb x1 total-size: 16 Gbit 3200
DDR 3200 0 0 16 152
Boot mode: SD (01) order f2564
SD HOST: 200000000 CTL0: 0x00800000 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
SD HOST: 200000000 CTL0: 0x00800f00 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
EMMC
SD retry 1 oc 0
SD HOST: 200000000 CTL0: 0x00800000 BUS: 400000 Hz actual: 390625 HZ div: 512 (256) status: 0x1fff0000 delay: 276
OCR c0ff8080 [0]
CID: 001501003847544634520680754ad9ca
SD HOST: 200000000 CTL0: 0x00800f04 BUS: 25000000 Hz actual: 25000000 HZ div: 8 (4) status: 0x1fff0000 delay: 4
SD HOST: 200000000 CTL0: 0x00800f04 BUS: 50000000 Hz actual: 50000000 HZ div: 4 (2) status: 0x1fff0000 delay: 2
MBR: 0x0000003f, 716800 type: 0x0c
MBR: 0x00168000, 289044 type: 0x83
MBR: 0x001f5228,13217240 type: 0x83
MBR: 0x00000000, 0 type: 0x00
Trying partition: 0
type: 32 lba: 63 oem: 'MSDOS5.0' volume: ' NO NAME '
rsc 32 fat-sectors 5601 c-count 705566 c-size 1
root dir cluster 2 sectors 0 entries 0
FAT32 clusters 705566
Trying partition: 0
type: 32 lba: 63 oem: 'MSDOS5.0' volume: ' NO NAME '
rsc 32 fat-sectors 5601 c-count 705566 c-size 1
root dir cluster 2 sectors 0 entries 0
FAT32 clusters 705566
secure-boot
Loading boot.img ...
SIG boot.sig 9fc705ba873900c4bfc28bea92baf04ad2825519908a477406eef014478a72bd 1711932785
Verifying
RSA verify
rsa-verify pass (0x0)
MBR: 0x00000000, 0 type: 0x00
MBR: 0x00000000, 0 type: 0x00
MBR: 0x00000000, 0 type: 0x00
MBR: 0x00000000, 0 type: 0x00
Trying partition: 0
type: 16 lba: 0 oem: 'mkfs.fat' volume: ' V ^ '
rsc 4 fat-sectors 64 c-count 16343 c-size 4
root dir cluster 1 sectors 32 entries 512
FAT16 clusters 16343
Read config.txt bytes 2108 hnd 0x54
Read start4x.elf bytes 3002536 hnd 0x5c
Read fixup4x.dat bytes 8399 hnd 0x57
0x00b03141 0x00000000 0x00001fff
MEM GPU: 192 ARM: 832 TOTAL: 1024
Firmware: 30f0c5e4d076da3ab4f341d88e7d505760b93ad7 Oct 17 2023 15:40:00
Starting start4x.elf @ 0xfec00200 partition 0
+
MESS:00:00:08.785692:0: brfs: File read: /mfs/sd/config.txt
MESS:00:00:08.789221:0: brfs: File read: 2108 bytes
MESS:00:00:08.813278:0: HDMI0:EDID error reading EDID block 0 attempt 0
MESS:00:00:08.817781:0: HDMI0:EDID giving up on reading EDID block 0
MESS:00:00:08.834476:0: HDMI1:EDID error reading EDID block 0 attempt 0
MESS:00:00:08.838984:0: HDMI1:EDID giving up on reading EDID block 0
MESS:00:00:08.844344:0: brfs: File read: /mfs/sd/config.txt
MESS:00:00:08.850376:0: gpioman: gpioman_get_pin_num: pin DISPLAY_SDA not defined
MESS:00:00:08.856563:0: gpioman: gpioman_get_pin_num: pin LEDS_PWR_OK not defined
MESS:00:00:09.027896:0: gpioman: gpioman_get_pin_num: pin FLASH_0_ENABLE not defined
MESS:00:00:09.032537:0: gpioman: gpioman_get_pin_num: pin FLASH_0_INDICATOR not defined
MESS:00:00:09.040277:0: gpioman: gpioman_get_pin_num: pin FLASH_0_ENABLE not defined
MESS:00:00:09.047727:0: gpioman: gpioman_get_pin_num: pin FLASH_0_INDICATOR not defined
MESS:00:00:09.353735:0: gpioman: gpioman_get_pin_num: pin LEDS_PWR_OK not defined
MESS:00:00:09.359382:0: *** Restart logging
MESS:00:00:09.362024:0: brfs: File read: 2108 bytes
MESS:00:00:09.371775:0: hdmi: HDMI0:EDID error reading EDID block 0 attempt 0
MESS:00:00:09.376801:0: hdmi: HDMI0:EDID giving up on reading EDID block 0
MESS:00:00:09.387424:0: hdmi: HDMI0:EDID error reading EDID block 0 attempt 0
MESS:00:00:09.392453:0: hdmi: HDMI0:EDID giving up on reading EDID block 0
MESS:00:00:09.398052:0: hdmi: HDMI:hdmi_get_state is deprecated, use hdmi_get_display_state instead
MESS:00:00:09.411842:0: hdmi: HDMI1:EDID error reading EDID block 0 attempt 0
MESS:00:00:09.416873:0: hdmi: HDMI1:EDID giving up on reading EDID block 0
MESS:00:00:09.427494:0: hdmi: HDMI1:EDID error reading EDID block 0 attempt 0
MESS:00:00:09.432519:0: hdmi: HDMI1:EDID giving up on reading EDID block 0
MESS:00:00:09.438116:0: hdmi: HDMI:hdmi_get_state is deprecated, use hdmi_get_display_state instead
MESS:00:00:09.446881:0: HDMI0: hdmi_pixel_encoding: 300000000
MESS:00:00:09.452354:0: HDMI1: hdmi_pixel_encoding: 300000000
MESS:00:00:09.660020:0: brfs: File read: /mfs/sd/rootfs.cpio.zst
MESS:00:00:09.662920:0: Loaded 'rootfs.cpio.zst' to 0x0 size 0x13d2e14
MESS:00:00:09.685269:0: initramfs loaded to 0x2dc2d000 (size 0x13d2e14)
MESS:00:00:09.688791:0: gpioman: gpioman_get_pin_num: pin CAMERA_0_I2C_PORT not defined
MESS:00:00:09.700760:0: dtb_file 'bcm2711-rpi-cm4.dtb'
MESS:00:00:09.702789:0: brfs: File read: 20786708 bytes
MESS:00:00:09.708249:0: brfs: File read: /mfs/sd/bcm2711-rpi-cm4.dtb
MESS:00:00:09.713812:0: Loaded 'bcm2711-rpi-cm4.dtb' to 0x100 size 0xd84f
MESS:00:00:09.733962:0: brfs: File read: 55375 bytes
MESS:00:00:09.737926:0: brfs: File read: /mfs/sd/overlays/overlay_map.dtb
MESS:00:00:09.769259:0: brfs: File read: 4775 bytes
MESS:00:00:09.771135:0: brfs: File read: /mfs/sd/config.txt
MESS:00:00:09.776665:0: dtparam: i2c_arm=on
MESS:00:00:09.788988:0: dtparam: spi=on
MESS:00:00:09.797928:0: dtparam: audio=on
MESS:00:00:09.803852:0: brfs: File read: 2108 bytes
MESS:00:00:09.807024:0: brfs: File read: /mfs/sd/overlays/vc4-kms-v3d-pi4.dtbo
MESS:00:00:09.875247:0: Loaded overlay 'vc4-kms-v3d'
MESS:00:00:10.029190:0: brfs: File read: 3913 bytes
MESS:00:00:10.033338:0: brfs: File read: /mfs/sd/overlays/dwc2.dtbo
MESS:00:00:10.043147:0: Loaded overlay 'dwc2'
MESS:00:00:10.055240:0: brfs: File read: 801 bytes
MESS:00:00:10.057627:0: brfs: File read: /mfs/sd/overlays/ramoops-pi4.dtbo
MESS:00:00:10.067378:0: Loaded overlay 'ramoops'
MESS:00:00:10.076351:0: brfs: File read: 741 bytes
MESS:00:00:10.080395:0: brfs: File read: /mfs/sd/overlays/dwc2.dtbo
MESS:00:00:10.090240:0: Loaded overlay 'dwc2'
MESS:00:00:10.091483:0: dtparam: dr_mode=host
MESS:00:00:10.113801:0: brfs: File read: 801 bytes
MESS:00:00:10.115571:0: brfs: File read: /mfs/sd/cmdline.txt
MESS:00:00:10.121006:0: Read command line from file 'cmdline.txt':
MESS:00:00:10.126762:0: 'rootwait console=tty0 console=serial0,115200 root=/dev/ram0'
MESS:00:00:10.245118:0: brfs: File read: 550 bytes
MESS:00:00:10.289923:0: brfs: File read: /mfs/sd/zImage
MESS:00:00:10.292039:0: Loaded 'zImage' to 0x80000 size 0x5236d4
MESS:00:00:11.021463:0: Kernel relocated to 0x200000
MESS:00:00:11.023318:0: Device tree loaded to 0x2dc1f200 (size 0xdd73)
MESS:00:00:11.031502:0: uart: Set PL011 baud rate to 103448.300000 Hz
MESS:00:00:11.038642:0: uart: Baud rate change done...
MESS:00:00:11.040665:0:[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd083]
[ 0.000000] Linux version 6.1.73-v8 (buildroot@buildroot) (aarch64-nerves-linux-gnu-gcc (crosstool-NG UNKNOWN) 13.2.0, GNU ld (crosstool-NG UNKNOWN) 2.40) #1 SMP PREEMPT Mon Apr 1 00:53:05 UTC 2024
[ 0.000000] random: crng init done
[ 0.000000] Machine model: Raspberry Pi Compute Module 4 Rev 1.1
[ 0.000000] Reserved memory: created CMA memory pool at 0x000000000dc00000, size 512 MiB
[ 0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000000000000-0x000000003fffffff]
[ 0.000000] DMA32 [mem 0x0000000040000000-0x000000007fffffff]
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000033ffffff]
[ 0.000000] node 0: [mem 0x0000000040000000-0x000000007fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000007fffffff]
[ 0.000000] On node 0, zone DMA32: 16384 pages in unavailable ranges
[ 0.000000] percpu: Embedded 25 pages/cpu s64680 r8192 d29528 u102400
[ 0.000000] Detected PIPT I-cache on CPU0
[ 0.000000] CPU features: detected: Spectre-v2
[ 0.000000] CPU features: detected: Spectre-v4
[ 0.000000] CPU features: detected: Spectre-BHB
[ 0.000000] CPU features: detected: ARM errata 1165522, 1319367, or 1530923
[ 0.000000] alternatives: applying boot alternatives
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 467712
[ 0.000000] Kernel command line: coherent_pool=1M 8250.nr_uarts=1 snd_bcm2835.enable_headphones=0 snd_bcm2835.enable_hdmi=1 snd_bcm2835.enable_hdmi=0 smsc95xx.macaddr=2C:CF:67:0A:8A:F7 vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000 rootwait console=tty0 console=ttyS0,115200 root=/dev/ram0
[ 0.000000] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.000000] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
[ 0.000000] software IO TLB: area num 4.
[ 0.000000] software IO TLB: mapped [mem 0x0000000030000000-0x0000000034000000] (64MB)
[ 0.000000] Memory: 1237600K/1900544K available (7872K kernel code, 1270K rwdata, 2036K rodata, 1728K init, 597K bss, 138656K reserved, 524288K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] trace event string verifier disabled
[ 0.000000] rcu: Preemptible hierarchical RCU implementation.
[ 0.000000] rcu: RCU event tracing is enabled.
[ 0.000000] Trampoline variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] Root IRQ handler: gic_handle_irq
[ 0.000000] GIC: Using split EOI/Deactivate mode
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] arch_timer: cp15 timer(s) running at 54.00MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xc743ce346, max_idle_ns: 440795203123 ns
[ 0.000001] sched_clock: 56 bits at 54MHz, resolution 18ns, wraps every 4398046511102ns
[ 0.000209] Console: colour dummy device 80x25
[ 0.000570] printk: console [tty0] enabled
[ 0.000621] Calibrating delay loop (skipped), value calculated using timer frequency.. 108.00 BogoMIPS (lpj=216000)
[ 0.000650] pid_max: default: 32768 minimum: 301
[ 0.000867] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.000910] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.001719] cgroup: Disabling memory control group subsystem
[ 0.002690] cblist_init_generic: Setting adjustable number of callback queues.
[ 0.002715] cblist_init_generic: Setting shift to 2 and lim to 1.
[ 0.002932] rcu: Hierarchical SRCU implementation.
[ 0.002948] rcu: Max phase no-delay instances is 1000.
[ 0.003944] smp: Bringing up secondary CPUs ...
[ 0.004447] Detected PIPT I-cache on CPU1
[ 0.004587] CPU1: Booted secondary processor 0x0000000001 [0x410fd083]
[ 0.005129] Detected PIPT I-cache on CPU2
[ 0.005247] CPU2: Booted secondary processor 0x0000000002 [0x410fd083]
[ 0.005749] Detected PIPT I-cache on CPU3
[ 0.005873] CPU3: Booted secondary processor 0x0000000003 [0x410fd083]
[ 0.005954] smp: Brought up 1 node, 4 CPUs
[ 0.006023] SMP: Total of 4 processors activated.
[ 0.006037] CPU features: detected: 32-bit EL0 Support
[ 0.006051] CPU features: detected: CRC32 instructions
[ 0.006135] CPU: All CPU(s) started at EL2
[ 0.006148] alternatives: applying system-wide alternatives
[ 0.007241] devtmpfs: initialized
[ 0.016077] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.016139] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.028664] pinctrl core: initialized pinctrl subsystem
[ 0.029514] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.031063] DMA: preallocated 1024 KiB GFP_KERNEL pool for atomic allocations
[ 0.031319] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.031748] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.032194] thermal_sys: Registered thermal governor 'step_wise'
[ 0.032239] cpuidle: using governor menu
[ 0.032392] ASID allocator initialised with 65536 entries
[ 0.032471] Serial: AMBA PL011 UART driver
[ 0.032877] pstore: Registered ramoops as persistent store backend
[ 0.032895] ramoops: using 0x10000@0xb000000, ecc: 0
[ 0.040253] bcm2835-mbox fe00b880.mailbox: mailbox enabled
[ 0.052102] raspberrypi-firmware soc:firmware: Attached to firmware from 2023-10-17T15:40:00, variant start_x
[ 0.056111] raspberrypi-firmware soc:firmware: Firmware hash is 30f0c5e4d076da3ab4f341d88e7d505760b93ad7
[ 0.090443] bcm2835-dma fe007000.dma: DMA legacy API manager, dmachans=0x1
[ 0.093081] SCSI subsystem initialized
[ 0.093244] usbcore: registered new interface driver usbfs
[ 0.093296] usbcore: registered new interface driver hub
[ 0.093370] usbcore: registered new device driver usb
[ 0.093542] usb_phy_generic phy: supply vcc not found, using dummy regulator
[ 0.093788] pps_core: LinuxPPS API ver. 1 registered
[ 0.093805] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.093833] PTP clock support registered
[ 0.094699] vgaarb: loaded
[ 0.095024] clocksource: Switched to clocksource arch_sys_counter
[ 0.101953] NET: Registered PF_INET protocol family
[ 0.102247] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.104665] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear)
[ 0.104717] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.104789] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.104915] TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear)
[ 0.105434] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.105596] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear)
[ 0.105643] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear)
[ 0.105804] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.105849] PCI: CLS 0 bytes, default 64
[ 0.106262] Trying to unpack rootfs image as initramfs...
[ 0.123814] Initialise system trusted keyrings
[ 0.124102] workingset: timestamp_bits=46 max_order=19 bucket_order=0
[ 0.129713] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.131147] Key type asymmetric registered
[ 0.131185] Asymmetric key parser 'x509' registered
[ 0.131262] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[ 0.131852] irq_brcmstb_l2: registered L2 intc (/soc/interrupt-controller@7ef00100, parent irq: 23)
[ 0.136663] gpio-507 (ant1): hogged as output/high
[ 0.138011] gpio-511 (ant2): hogged as output/low
[ 0.138948] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges:
[ 0.138985] brcm-pcie fd500000.pcie: No bus range found for /scb/pcie@7d500000, using [bus 00-ff]
[ 0.139077] brcm-pcie fd500000.pcie: MEM 0x0600000000..0x063fffffff -> 0x00c0000000
[ 0.139124] brcm-pcie fd500000.pcie: IB MEM 0x0000000000..0x007fffffff -> 0x0400000000
[ 0.139633] brcm-pcie fd500000.pcie: setting SCB_ACCESS_EN, READ_UR_MODE, MAX_BURST_SIZE
[ 0.139908] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00
[ 0.139933] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 0.139955] pci_bus 0000:00: root bus resource [mem 0x600000000-0x63fffffff] (bus address [0xc0000000-0xffffffff])
[ 0.140010] pci 0000:00:00.0: [14e4:2711] type 01 class 0x060400
[ 0.140103] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 0.143850] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.144064] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator
[ 0.144163] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator
[ 0.144196] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator
[ 0.571073] brcm-pcie fd500000.pcie: link down
[ 0.571379] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.571421] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.571499] pci_bus 0000:01: busn_res: [bus 01] is released
[ 0.571946] pci_bus 0000:00: busn_res: [bus 00-ff] is released
[ 0.577255] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled
[ 0.578674] iproc-rng200 fe104000.rng: hwrng registered
[ 0.578869] vc-mem: phys_addr:0x00000000 mem_base=0x3ec00000 mem_size:0x40000000(1024 MiB)
[ 0.586497] brd: module loaded
[ 0.590324] loop: module loaded
[ 0.590864] Loading iSCSI transport class v2.0-870.
[ 0.593292] bcmgenet fd580000.ethernet: GENET 5.0 EPHY: 0x0000
[ 1.340163] Freeing initrd memory: 20296K
[ 1.407097] unimac-mdio unimac-mdio.-19: Broadcom UniMAC MDIO bus
[ 1.408193] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[ 1.408520] usbcore: registered new interface driver usb-storage
[ 1.408650] UDC core: g_ether: couldn't find an available UDC
[ 1.408671] i2c_dev: i2c /dev entries driver
[ 1.409375] brcmstb-i2c fef04500.i2c: @97500hz registered in polling mode
[ 1.409735] brcmstb-i2c fef09500.i2c: @97500hz registered in polling mode
[ 1.411307] sdhci: Secure Digital Host Controller Interface driver
[ 1.411330] sdhci: Copyright(c) Pierre Ossman
[ 1.411552] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.413756] ledtrig-cpu: registered to indicate activity on CPUs
[ 1.413892] hid: raw HID events driver (C) Jiri Kosina
[ 1.414031] usbcore: registered new interface driver usbhid
[ 1.414047] usbhid: USB HID core driver
[ 1.414195] bcm2835_vchiq fe00b840.mailbox: there is not valid maps for state default
[ 1.419091] NET: Registered PF_INET6 protocol family
[ 1.420122] Segment Routing with IPv6
[ 1.420162] In-situ OAM (IOAM) with IPv6
[ 1.420244] NET: Registered PF_PACKET protocol family
[ 1.420578] Loading compiled-in X.509 certificates
[ 1.421013] pstore: Using crash dump compression: deflate
[ 1.423712] uart-pl011 fe201000.serial: there is not valid maps for state default
[ 1.424022] uart-pl011 fe201000.serial: cts_event_workaround enabled
[ 1.424121] fe201000.serial: ttyAMA1 at MMIO 0xfe201000 (irq = 30, base_baud = 0) is a PL011 rev2
[ 1.430011] bcm2835-aux-uart fe215040.serial: there is not valid maps for state default
[ 1.430405] printk: console [ttyS0] disabled
[ 1.430480] fe215040.serial: ttyS0 at MMIO 0xfe215040 (irq = 31, base_baud = 62500000) is a 16550
[ 2.506866] printk: console [ttyS0] enabled
[ 2.511442] bcm2835-wdt bcm2835-wdt: Broadcom BCM2835 watchdog timer
[ 2.518007] bcm2835-power bcm2835-power: Broadcom BCM2835 power domains driver
[ 2.526641] mmc-bcm2835 fe300000.mmcnr: mmc_debug:0 mmc_debug2:0
[ 2.532775] mmc-bcm2835 fe300000.mmcnr: DMA channel allocated
[ 2.563940] of_cfs_init
[ 2.566440] of_cfs_init: OK
[ 2.607675] mmc0: SDHCI controller on fe340000.mmc [fe340000.mmc] using ADMA
[ 2.615948] Freeing unused kernel memory: 1728K
[ 2.620649] Run /init as init process
[ 2.624512] Failed to execute /init (error -13)
[ 2.629131] Run /sbin/init as init process
erlinit: Cannot remount /dev
erlinit: Cannot create /dev/pts
erlinit: Cannot create /dev/shm
erlinit: error setting controlling terminal: /dev/tty1
erlinit: Cannot mount /dev/mmcblk0p1 at /boot: No such file or directory
erlinit: Cannot mount /dev/mmcblk0p3 at /root: No such file or directory
erlinit: No release found in /srv/erlang.
FATAL ERROR:
erlinit: Erlang installation not found. Check that /usr/lib/erlang exists
CANNOT CONTINUE.
[ 2.675423] mmc0: new DDR MMC card at address 0001
[ 2.680872] mmcblk0: mmc0:0001 8GTF4R 7.28 GiB
[ 2.687535] mmcblk0: p1 p2 p3
[ 2.690846] mmcblk0: mmc0:0001 8GTF4R 7.28 GiB
[ 2.695641] mmcblk0boot0: mmc0:0001 8GTF4R 4.00 MiB
[ 2.701120] mmcblk0boot1: mmc0:0001 8GTF4R 4.00 MiB
[ 2.706364] mmcblk0rpmb: mmc0:0001 8GTF4R 512 KiB, chardev (246:0)
[ 3.691420] reboot: Restarting system
So my process is:
- In secure_boot_rpi4 repo, clear out
.nervesand_build, then runmix compile. Thepost-createfs.shreferences a../usbboot/private.pem. Change as needed. - Copy the generated
build.imgandbuild.sigto../secure_outer_rpi4/images/. - In secure_outer_rpi4 repo, clear out
.nerves,imagesand_build, then runmix compile. - In your project using the
secure_outer_rpi4system as your Nerves system:mix firmware - Put the CM4 IO board into flashy mody using the jumper.
- I ran
./rpiboot -d mass-storage-gadget64(which I have signed previously) to get it to be a mass storage device. mix burnand burn it to device.
So now to mount that root filesystem and switch_root into it.
The iteration speed is painful. I have a Ryzen 5950X but the compile times are still kind of brutal compared to my sheltered life of web dev. I have built so many kernels. I know I could trim down both systems in some ways but I’m not certain enough about where. So suffer I shall.
Onward!
2
lawik
Nerves Core Team
Plenty of progress but it barely looks like it 
Gotta love trouble-shooting /init. The best part was when I had added it in the entirely wrong way and it was just failing to run it and I was trying to figure out if my messages were being swallowed.
Anyhoo. A goof in the init script means another rebuild and I’ll see where we are tomorrow.
0
lawik
Nerves Core Team
@fhunleth if you have any clue this is where I’m at currently.
(kernel log and init code)
The repo for generating the boot.img and boot.sig: GitHub - underjord/secure_boot_rpi4: Secure boot for RPi4 boot.img · GitHub
The repo for wrapping up the boot.img and boot.sig in a bootable system: GitHub - underjord/secure_outer_rpi4: Experimental rpi4 nerves system wrapping up a system for initramfs etc. · GitHub
Sample firmware that I use to build the whole darned thing: GitHub - underjord/secure_boot_sample_fw · GitHub
(full-rebuild.sh) has the starting point if that helps.
But this is the procedure:
- Build secure_boot_rpi4, that produces boot.img and boot.sig.
- Copy those two files to secure_outer_rpi4.
- Build secure_outer_rpi4 which produces are normal nerves system build.
- Build secure_boot_sample_fw with
mix firmwareto get the firmware file. - Pet the RPi IO board for CM4 the right way to get it to be a mass storage device.
- Burn firmware to it.
- Cycle power.
- Enjoy a new kernel panic.
My most recent lead that I could very well be part of it is that the outer system which holds the root filesystem I’m trying to switch_root over to, might not have the same shared libraries as the secure_boot_rpi4 build.img and initramfs expects to exist. I’m not confident that this is it. But it came up in a search.
0
lawik
Nerves Core Team
Finally some progress. Hooking up the right pin for two-way serial on my serial adapter (FTDI or whatever) and trying a minimal /init:
#!/bin/sh
echo "======================= Running init from rootfs_overlay"
mount -t devtmpfs none /dev
mount -t proc proc /proc
mount -t sysfs sysfs /sys
echo "Waiting for /dev/mmcblk0p2..."
until [ -b "/dev/mmcblk0p2" ]; do
sleep 5
done
echo "Starting shell?"
exec sh
Then I could actually see what was happening as I was getting really weird errors and the output was being swallowed.
mkdir /media/mmcblk0p2
mount /dev/mmcblk0p2 /media/mmcblk0p2
exec switch_root /media/mmcblk0p2/ /sbin/init
This gave me a proper error!
# exec switch_root /media/mmcblk0p2 /sbin/init
erlinit: Cannot remount /dev
erlinit: Cannot create /dev/pts
erlinit: Cannot create /dev/shm
erlinit: Could not create symlink '/dev/rootdisk0'->'/dev/mmcblk0': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p3'->'/dev/mmcblk0p3': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p2'->'/dev/mmcblk0p2': Read-only file system
erlinit: Could not create symlink '/dev/rootdisk0p1'->'/dev/mmcblk0p1': Read-only file system
erlinit: error setting controlling terminal: /dev/tty1
erlinit: Cannot mount /dev/mmcblk0p1 at /boot: No such file or directory
erlinit: Cannot mount /dev/mmcblk0p3 at /root: No such file or directory
erlinit: Couldn't open /dev/null
erlinit: `/usr/bin/boardid` failed. Using default ID: '00000000'
erlinit: Unable to create seed directory
nbtty: Could not find a pty.
[nbtty: terminating]
erlinit: Erlang VM exited
erlinit: Sending SIGTERM to all processes
erlinit: Sending SIGKILL to all processes
erlinit: Unable to create seed directory
[ 5902.674349] reboot: Restarting system
So I need to understand what’s going on with /dev because we do need devices.
Fundamentally I think everything else fails off of that.
0