# Kernel signing error after mender integration in iMX 6UL

**URL:** <https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002>\
**Category:** General Discussions\
**Tags:** yocto, nxp, warrior, imx6ul-evk, secure-booting\
**Created:** [June 3, 2020, 1:24pm UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002 "2020-06-03T13:24:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![danie](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/danie/32/620_2.png) [@danie](https://hub.mender.io/u/danie)\
**Post date:** [June 3, 2020, 1:24pm UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002/1 "2020-06-03T13:24:25Z")

</div>

_Greetings all,_

I’ve successfully integrated mender into Yocto build for iMX 6UL EVK and verified the update mechanism. Now, as I try to `sign the generated u-boot and kernel` (with mender integration) it **fails at kernel verification stage** as follows,

```auto
Hit any key to stop autoboot: 0 
37183 bytes read in 125 ms (290 KiB/s)
7738296 bytes read in 522 ms (14.1 MiB/s)
Kernel image @ 0x80800000 [0x000000 - 0x7613b8]
## Flattened Device Tree blob at 83000000
   Booting using the fdt blob at 0x83000000

Authenticate image from DDR location 0x80800000...
bad magic magic=0x0 length=0x00 version=0x0
bad length magic=0x0 length=0x00 version=0x0
bad version magic=0x0 length=0x00 version=0x0
Error: Invalid IVT structure

Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0
Authenticate zImage Fail, Please check

```

The attached file contains detailed log along with u-boot environment variables: [https://github.com/danie007/imx6/blob/master/signed\_failed.log.txt](https://github.com/danie007/imx6/blob/master/signed_failed.log.txt)

Success log(_No mender integration - same build configuration_): [https://github.com/danie007/imx6/blob/master/signed\_passed.log.txt](https://github.com/danie007/imx6/blob/master/signed_passed.log.txt)

It would be much helpful if you could point me where to look at or what would have gone wrong here.

Happy to provide more details, thanks in advance.

---

<div class="post-metadata">

**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\
**Post date:** [June 4, 2020, 6:33am UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002/2 "2020-06-04T06:33:06Z")

</div>

Unclear how to help in this case.

I just wanted to highlight that with Mender integrated, it will load the Linux kernel like this,

```auto
load ${mender_uboot_root} ${fdt_addr_r} /boot/${mender_dtb_name}; 
load ${mender_uboot_root} ${kernel_addr_r} /boot/${mender_kernel_name};

```

This will load the files from the `/boot` directory in the rootfs image. Are these images signed?

---

<div class="post-metadata">

**Author:** ![danie](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/danie/32/620_2.png) [@danie](https://hub.mender.io/u/danie)\
**Post date:** [June 4, 2020, 7:03am UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002/3 "2020-06-04T07:03:17Z")

</div>

Hi,

Thanks for the reply!

So, I have a question here. Normally, iMX 6UL EVK would boot from `boot` partition so we would sign the `zImage` and copy it to the `boot` partition to implement signed boot.

I did the same here in mender integrated image (sign the `zImage` in `boot` partition). But as you said here,

> [@mirzak](#):
>
> load the files from the `/boot` directory in the rootfs image

**Do I need to sign the kernel image in** `/boot` **of rootfs A?** If so, do you mind brief the role of `boot` partition?

---

<div class="post-metadata">

**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\
**Post date:** [June 4, 2020, 7:23am UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002/4 "2020-06-04T07:23:58Z")

</div>

> [@danie](#):
>
> **Do I need to sign the kernel image in** `/boot` **of rootfs A?**

Yes, or you need to make sure that the image is signed during the build so that the images that you deploy using `.mender` files includes a signed image already.

> If so, do you mind brief the role of `boot` partition?

In your case, it probably has no role. You should be able to disable it using,

```auto
MENDER_BOOT_PART_SIZE_MB = "0"

```

---

<div class="post-metadata">

**Author:** ![danie](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/danie/32/620_2.png) [@danie](https://hub.mender.io/u/danie)\
**Post date:** [June 4, 2020, 9:18am UTC](https://hub.mender.io/t/kernel-signing-error-after-mender-integration-in-imx-6ul/2002/5 "2020-06-04T09:18:32Z")

</div>

I got it resolved by changing the signed zImage location from the conventional `boot` partition to rootfs image’s `/boot` folder.

Thanks @mirzak for pointing the difference in boot process and sheding the light on mender flow.