Hello, I’m attempting to integrate efi-secure-boot with Mender on an intel-corei7-64 Yocto target platform. I can get to the point where the UEFI firmware is validating GRUB (bootx64.efi) and grub.cfg but bzImage validation fails. It appears the issue is that bzImage and bzImage.p7b are in /boot in…

Hi @esscrb Thanks for touching upon that topic. Just wanted to give you a short heads up that I can try and look into it, but not until mid of next week as Easter is coming up. I’ll get back to once I have something to share. Greetz, Josef

Thank you @TheYoctoJester . I’ve been trying to figure out how to solve this for over a week, to no avail. Any pointers you or anyone else can provide are greatly appreciated!

Hi @esscrb , Sorry for not yet having proper news. By thinking a bit more about it, the key problem is that the Mender A/B scheme needs the kernel to be on the system partition in order to update it. Can you maybe share the partition layout of the device in question? If the search is defined by Grub…

Hi @TheYoctoJester , Here is our partition layout: /dev/sda1 (boot partition) is mounted under /boot/efi /dev/sda2 is the A partition /dev/sda3 is the B partition /dev/sda4 (data partition) is mounted under /data We do boot via Grub. I still think the issue is that SELoader requires bzImage to…

No, sorry. That project got put on hold and the work was never finished up.

@TheYoctoJester and others: I’ve been looking into one possible solution suggested by meta-mender-kernel to solve the kernel being located in /boot. It solves the problem by using shim & MOK to verify the kernel. However, the solution requires INITRAMFS_IMAGE_BUNDLE and our system isn’t using an ini…

Hi @esscrb ! The idea is not bad, but involves a number of drawbacks as far as I understand it. First, you probably can’t get rid of the initramfs, because this is where the crypto access happens. Second, pulling the bundled kernel out of the partition means that upgrading it needs additional magic…

Hi @TheYoctoJester et al: I thought I should post an update after some weeks of working through this problem. After talking with Josef we came to the conclusion that since the devices in question are using USB updates rather than OTA, the need for A/B rollback isn’t strictly necessary. After all, …

Mender and efi-secure-boot on intel-corei7-64

General Discussions

esscrb April 26, 2022, 3:43pm 7

@drewmoseley I came across your replies in thread Mender and efi-secure-boot when researching my current issue. Were you ever able to get mender and efi-secure-boot working on intel-corei7-64?

Topic		Replies	Views
Mender and efi-secure-boot General Discussions	3	1095	May 22, 2020
U-boot EFI on intel-corei7-64 General Discussions yocto , intel , u-boot	4	38	March 31, 2026
Error: grub-mender-grubenv:do_sign failed General Discussions yocto	13	343	August 27, 2024
Boot device not found after integration mender into yocto General Discussions yocto , intel , thud	23	4219	September 6, 2019
OTA update with mender on ubuntu 22.04 fails with no match between root and boot partitions Debian family mender-convert , mender-server , grub , uefi	0	265	March 13, 2024

Mender and efi-secure-boot on intel-corei7-64

Related topics