LUKS on Cubox (imx6 platform)

Sunday, 09 August 2015
|
Écrit par
Grégory Soutadé

Now I have a Cubox (i2ex), I wanted to encrypt my backup disks. I followed this excellent tutorial. The cipher recommendation is aes-xts-plain64. So, I created formated disk, encrypt it, copy data from my computer and connect it to the Cubox.

But, I get this error :

cryptsetup --type luks open /dev/sda1 backup
Enter passphrase for /dev/sda1: 
No key available with this passphrase.

I tried a couple of times, use a keyfile. Nothing worked !! It made me crazy. After a bunch of search, I found that the current kernel in the Debian image from Igor Pečovnik is 3.14.14 and has issues with NEON AES implementation.

I cannot blacklist the module as it's builtin. The solution is to build a new module from the latest 3.14.49 kernel (maintained by Greg Kroah-Hartman). Ouf ! I increased cra_priority to be sure to use the new implementation.

Instructions

In the Cubox :

  • Install kernel headers (already here in the image)
  • Download the latest 3.14 kernel from kernel.org
  • Decompress it
  • Apply this patch
  • Compile
  • Install
  • Reboot

Commands :

patch -p1 < crypto.patch
cd linux-3.14.49/arch/arm/crypto/
make
sudo make install
sudo echo aes-arm-bs >> /etc/modules
reboot

If you just want to test :

insmod aes-arm-bs.ko

Precompiled version

A precompiled version is available here. To manually install it :

sudo cp aes-arm-bs.ko /lib/modules/3.14.14-cubox-i/extra/
sudo depmod
sudo echo aes-arm-bs >> /etc/modules

Or just

sudo make install
sudo echo aes-arm-bs >> /etc/modules
#
1
De
Hue Holleran
, le
07 September 2015 17:09
Awesome - worked perfectly for me! I am using Igor's kernel on an imx6 quad Cubox-i and tried to use luks with failures as described. This fantastically well-written description helped me immediately - thank you Grégory for publishing it!
Répondre
Auteur :


e-mail* :


Le commentaire :


#
2
De
Greg
, le
08 September 2015 06:09
You're welcome !

I'd also thanks Igor for doing a great job by supporting a lot of boards !!
Répondre
Auteur :


e-mail* :


Le commentaire :


#
3
De
Dražen
, le
15 September 2015 15:09
This was very helpful in resolving our problem - thanks! I opened an issue to maybe solve this on Igor's image itself:

https://github.com/igorpecovnik/lib/issues/102

BTW, the path changed a bit in recent versions - it's now /lib/modules/3.14.14-cubox/. There is no "extra" folder inside. Don't know if that's relevant or not. I just got it to work now with insprobe.
Répondre
Auteur :


e-mail* :


Le commentaire :


#
4
De
Greg
, le
15 September 2015 15:09
Thanks. I think "extra" folder is needed to not confuse with other modules.
Répondre
Auteur :


e-mail* :


Le commentaire :


#
5
De
Hue Holleran
, le
15 September 2015 20:09
I noticed Igor did a website re-design and must have updated the Debian image recently - he has dropped the '-i' from the kernel flavour. update-initramfs needs an update to the entry in flash-kernel db: /etc/flash-kernel/db and add cubox to the flavours. Needed as I'm running cubox-i on Luks root and works perfectly thanks to this page by Gregory!
Répondre
Auteur :


e-mail* :


Le commentaire :


#
6
De
Greg
, le
16 September 2015 08:09
You're right ! I used the version 2.9 of Armbian while the current version is 4.2.

This is what Dražen pointed (not "-i" and no "extra" folder).
Répondre
Auteur :


e-mail* :


Le commentaire :


Auteur :


e-mail* :


Le commentaire :




* Seulement pour être notifié d'une réponse à cet article
* Only for email notification