BalenaOs UEFI (secure boot enabled) migration failed from ubuntu

Hello everyone,

Like the title mentions, migrating to BalenaOS from a UEFI based ubuntu failed. The screen is totally black just after rebooting from the migration stage.

I have tried both the following balena-migrate.conf configurations:

  • Enabling GRUB_INSTALL

GRUB_INSTALL=TRUE

  • Disabling GRUB_INSTALL

# GRUB_INSTALL=TRUE, means here it was commented.

I have booted with a live linux distribution in order to extract the stage 2 migration logs related to the configuration of GRUB_INSTALL=TRUE.

[LOG Wed Nov 20 09:41:12 UTC 2019]: balena-stage2-default started
[LOG Wed Nov 20 09:41:12 UTC 2019]: total memory: 3890664 kB
[LOG Wed Nov 20 09:41:12 UTC 2019]: free memory:  3682536 kB
[LOG Wed Nov 20 09:41:12 UTC 2019]: est. memory left after subtracting image & backup size: 3682536 kB 
[LOG Wed Nov 20 09:41:12 UTC 2019]: copying image from /root/home/ubuntu/192.168.100.39_migratecfg/balena.img.gz to /balena-migrate/
[LOG Wed Nov 20 09:41:13 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:13 UTC 2019]: creating mountpoint on /resin-boot
[LOG Wed Nov 20 09:41:13 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:13 UTC 2019]: creating mountpoint on /resin-data
[LOG Wed Nov 20 09:41:13 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:13 UTC 2019]: Free memory after copy to initramfs: 3407508 kB
[LOG Wed Nov 20 09:41:13 UTC 2019]: unmounting root
[LOG Wed Nov 20 09:41:13 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:13 UTC 2019]: flashing image from /balena-migrate/balena.img.gz to /dev/sda 
[LOG Wed Nov 20 09:41:13 UTC 2019]: attempting gzip -d -c /balena-migrate/balena.img.gz | dd of=/dev/sda bs=4M \n
[LOG Wed Nov 20 09:41:24 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:24 UTC 2019]: mounting resin-boot using: mount -w -t vfat /dev/sda1 /resin-boot
[LOG Wed Nov 20 09:41:24 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:24 UTC 2019]: copying network config to resin-boot 
[LOG Wed Nov 20 09:41:24 UTC 2019]: ..done
[LOG Wed Nov 20 09:41:24 UTC 2019]: setting up grub boot config: GRUB_INSTALL = INSTALL
[LOG Wed Nov 20 09:41:24 UTC 2019]: copying grub.cfg
[LOG Wed Nov 20 09:41:24 UTC 2019]: attempting grub install with type UEFI
[LOG Wed Nov 20 09:41:24 UTC 2019]: Add UEFI boot entry for starting resinOS from internal media.
[LOG Wed Nov 20 09:41:24 UTC 2019]: copying grub.cfg
[LOG Wed Nov 20 09:41:26 UTC 2019]: mounting resin-data using: mount -w -t ext4 /dev/sda6 /resin-data
[LOG Wed Nov 20 09:41:26 UTC 2019]: ..done

Appreciate your help.

Hi, could you provide a link to the method you used to run this migration? Also, could you lets know what device and Ubuntu version you are using?

Hi,

Thanks for your reply,

I’m trying to migrate MSI MS-B120 from ubuntu 16 (I added ubuntu 16 to the supported list in the balena-migrate script). The migration with legacy mode boot works fine with this device, but with UEFI, it keeps a black screen.

These are my steps run inside the MSI that i want to migrate inside the device :

1- git clone https://github.com/balena-io-playground/balena-migrate && cd balena-migrate/migratecfg
2- wget https://files.resin.io/resinos/intel-nuc/2.44.0%2Brev1.dev/image/balena.img.zip # In order to download the balenaos amd64 image.
3- cp balena-migrate-sample.conf balena-migrate.conf # then updating the IMAGE_FILE environment variable and enabling/disabling (GRUB_INSTALL=TRUE) i made 2 tries
4- ./balena-migrate
5- reboot

Thanks for the info, after rebooting, are you able to connect to the device with a serial cable? Does the device ever connect to the balenaCloud API?

No i’m neither able to connect to the device with a serial cable nor able to reach the balenaCloud API, the screen is on and it is totally black.

But with the UEFI (secure boot disabled), it works fine.
Any instructions for a deeper debugging process to ensure a working migration with UEFI (secure boot enabled) ?

I have even flashed the image into a USB key in order to flash the OS but the problem remains. It doesn’t seems to be a problem with the migration process, but with the amd64 balenaos image. I have also used a baked balenaos image (amd64 generic) but without a positive result.

Hi @omarsastec I think currently the OS can’t work with secure boot enabled, because as far as I understand it, we can’t produce a signed balenaOS build for that device as we don’t know what the signing key is for that secure boot. I think with secure boot enabled it will only allow booting of OS (even from usb) that is signed by a specific key. So for now UEFI will only work with out secure boot.