initramfs, LUKS and dm_mod can't boot after upgrade

Question

My Raspberry Pi (which is 10,000 km away from me right now) works as follows:

• It is running Raspbian (July 2016's version)
• The SD card contains /boot
• An encrypted hard disk drive (using LUKS cryptsetup) contains /
• When the Pi boots, I can unlock the HDD remotely using dropbear over SSH. It asks for the HDD's password and then the boot sequence continues normally.

For more info about how I did all of this, read http://blog.romainpellerin.eu/raspberry-pi-the-ultimate-guide.html.
TL;DR here is a shortened version:

apt-get install busybox cryptsetup rsync
echo "initramfs initramfs.gz 0x00f00000" >> /boot/config.txt
sed -e "s|root=/dev/mmcblk0p2|root=/dev/mapper/hddcrypt cryptdevice=/dev/sda1:hddcrypt|" -i /boot/cmdline.txt
sed -e "s|/dev/mmcblk0p2|/dev/mapper/hddcrypt|" -i /etc/fstab
echo -e "hddcrypt\t/dev/sda1\tnone\tluks" >> /etc/crypttab
cryptsetup --verify-passphrase -c aes-xts-plain64 -s 512 -h sha256 luksFormat /dev/sda1
mkinitramfs -o /boot/initramfs.gz $(uname -r)
aptitude install dropbear
// Configuring the SSH access here...
mkinitramfs -o /boot/initramfs.gz $(uname -r)
update-initramfs -u

Problem

Up until yesterday, everything was working fine. I could reboot it and unlock the HDD over SSH. However, yesterday I did aptitude update && aptitude upgrade. As far as I know, this does not upgrade the kernel. Anyway, I rebooted it. Now, I'm stuck at the unlocking step. Even though I type the right password, it immediately says Can't change directory to <something/a kernel version> and Cannot initialize device-mapper. Is dm_mod kernel module loaded? and keeps asking again for the password.

I cannot tell you what kernel it is running as I set up a while ago and do not use it that much.

Sorry for the lack of details, I do not have a physical access to my Raspberry and I turned it off yesterday, thus I am telling from what I remember.

Supposition

I am pretty sure I could fix it by tweaking /boot/initramfs.gz but I do not know how. Can you help me please? Thank you very much.

Answer 1

I do not know what gave you the impression that aptitude upgrade would leave your kernel untouched, it simply doesn't. I had the same trouble after a kernel update on my encrypted pi. The problem is that your initramfs needs to be rebuilt. Here is how you do that on an external machine.

First, plug in your SD card with the crypted raspbian on it into your external computer and mount everything like so:

cryptsetup -v luksOpen /dev/mmcblk0p2 thunderdome
mount /dev/mapper/thunderdome /mnt
mount /dev/mmcblk0p1 /mnt/boot
mount -o bind /dev /mnt/dev
mount -t sysfs none /mnt/sys
mount -t proc  none /mnt/proc

Install qemu to emulate raspberry pi binaries:

apt-get install qemu qemu-user-static binfmt-support

Accoding to this gist, it is better to remove all lines from /mnt/etc/ld.so.preload before proceeding, this is what the sed commands do in the following:

# comment out ld.so.preload
sed -i 's/^/#/g' /mnt/etc/ld.so.preload
# copy qemu binary
cp /usr/bin/qemu-arm-static /mnt/usr/bin/

# chroot to raspbian and rebuild initramfs
chroot /mnt /bin/bash
    mkinitramfs -o /boot/initramfs.gz [NEW RASPBIAN KERNEL VERSION]
    exit

# undo damage
sed -i 's/^#//g' /mnt/etc/ld.so.preload
umount /mnt/{dev,sys,proc,boot}

You can find the new raspbian kernel version by checking out /lib/modules, inside the chroot.

After doing that, my raspberry pi booted just fine again.