It's secure boot. So as I understand it, the boot.img, if it matches the signature, loads up the initial ram fs and starts running /init. So this is from the initramfs which is inside of the boot.img file. If it kicks off the /init process then all of the rest of the code in there is my own code and is know to well well. It accesses the partitions in the manner that it should.
But that doesn't happen. Which suggests to me that this has failed. The main reason for a failure is the signature failure. The signature in the boot.sig file matches the boot.img file. The public key that is used to verify this should be in the eeprom inside the processor.
It's possible that when you boot from the nvme it's maybe looking in a different place for the public key. That's what I think is happening.
But.. it might be something simpler, that's what I'm hoping for. And I will attempt to find this out in the weekend. Namely I've never actually done a non secure boot boot off nvme. I'll do that next, maybe I discover something simple that solves it.
But that doesn't happen. Which suggests to me that this has failed. The main reason for a failure is the signature failure. The signature in the boot.sig file matches the boot.img file. The public key that is used to verify this should be in the eeprom inside the processor.
It's possible that when you boot from the nvme it's maybe looking in a different place for the public key. That's what I think is happening.
But.. it might be something simpler, that's what I'm hoping for. And I will attempt to find this out in the weekend. Namely I've never actually done a non secure boot boot off nvme. I'll do that next, maybe I discover something simple that solves it.
Statistics: Posted by hcfman — Fri Feb 14, 2025 10:08 am