How can I boot the Linux kernel with U-Boot when HAB is enabled?

[spthx]

I am using the i.MX8M Nano.
I have read the uboot-imx documentation and other related materials, and I am now able to boot U-Boot with secure boot and encrypted boot enabled.

Now, I am trying to manually load a pre-built kernel and DTB and boot using the booti command. However, I encountered the following error:

I suspect that the error is due to the kernel image not being signed.

u-boot=> fatload mmc 2:1 ${loadaddr} Image
28013056 bytes read in 144 ms (185.5 MiB/s)
u-boot=> fatload mmc 2:1 ${fdt_addr} imx8mn-ddr3l-evk.dtb
40155 bytes read in 9 ms (4.3 MiB/s)
u-boot=> booti ${loadaddr} - ${fdt_addr}

Authenticate image from DDR location 0x40400000...
bad magic magic=0xff length=0xffff version=0xff
bad length magic=0xff length=0xffff version=0xff
Bad version magic=0xff length=0xffff version=0xff
Error: Invalid IVT structure
Authenticate Image Fail, Please check

How can I boot the Linux kernel with U-Boot when HAB is enabled?
If signing is required, how should I sign the kernel?

Additionally, the method described in the earlier guide seems to assume a standalone environment.
How can I generate an HAB-compatible image within Yocto?

Best regards.

[Harvey021 · Accepted solution]

Please have a reference to the <3. Authenticating additional boot images> of mx8m_secure_boot.txt for kernel signing.

About How can I generate an HAB-compatible image within Yocto?

-> Please have a reference to <10.9 Security reference design> of IMX_LINUX_USERS_GUIDE.pdf 

Regards

Harvey

[spthx]

Hi @Harvey021,

Thanks for your help.
HAB authentication passes now, but I get a kernel panic.
Do you know what might be causing this?

Best Regards,

[spthx]

Resolved.
The reason was that bootargs was not configured.