zImage signing error on Yocto built image

[kanimozhi_t]

Hello all,

We've built Yocto image based on imx-4.19.35-1.1.0.xml - imx-manifest - i.MX Release Manifest  for i.MX 6UL EVK. And we've successfully signed the prodeces U-boot but when we tried signing the kernel(zImage) we're receiving the following error.

Hit any key to stop autoboot: 0
37183 bytes read in 127 ms (285.2 KiB/s)
7738296 bytes read in 525 ms (14.1 MiB/s)
Kernel image @ 0x80800000 [ 0x000000 - 0x7613b8 ]
## Flattened Device Tree blob at 83000000
Booting using the fdt blob at 0x83000000

Authenticate image from DDR location 0x80800000...
bad magic magic=0x0 length=0x00 version=0x0
bad length magic=0x0 length=0x00 version=0x0
bad version magic=0x0 length=0x00 version=0x0
Error: Invalid IVT structure

Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0
Authenticate zImage Fail, Please check
=> hab_auth_img 80800000 7c000 0

Authenticate image from DDR location 0x80800000...
bad magic magic=0x0 length=0xa000 version=0xe1
bad length magic=0x0 length=0xa000 version=0xe1
bad version magic=0x0 length=0xa000 version=0xe1
Error: Invalid IVT structure

Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0

NOTE: We tried signing the NXP reference BSP zImage (from L4.19.35_1.1.0_images_MX6UL7D) and it succeed. The difference as far as we could tell now is the size of zImage. Though we've adjusted the signing steps as per size no improvements.

reference BSP zIMage - 0x7613c0 - padded to 0x762000 - working

                 built zImage - 0x7613b8 - padded to 0x762000 - Not working

I've following questions,

1. Do we need to change the kernel configuration to be signed? If yes, how?
2. What is the meaning of the errors above? What does it mean by bad magic?
3. Why it doesn't show any hab events as supposed to be shown on signing error?

Looking forward foe your reply. Thanks in advance.

[kanimozhi_t · Accepted solution]

Thanks Yuri‌ for your reply but now the issue has been resolved. The error caused by invoking unsigned kernel in boot partition. We've integrated mender here, and that has changed the boot location causing the error in conventional method and it's resolved as signing the kernel in correct location.

REF: Kernel signing error after mender integration in iMX 6UL - General Discussions - Mender Hub 

[Yuri]

Hello,

  please try the following patch:

imx: hab: Increase CSF_SIZE for i.MX6 and i.MX7 devices (0633e134) · Commits · U-Boot / U-Boot · Git... 

Regards,

Yuri.