> On 22 Dec 2025, at 3:06 PM, Daniel Kiper <[email protected]> wrote: > > On Sat, Dec 20, 2025 at 10:40:35PM +0530, Sudhakar Kuppusamy wrote: >>> On 20 Dec 2025, at 7:17 PM, Daniel Kiper <[email protected]> wrote: >>> On Wed, Dec 03, 2025 at 08:00:36PM +0530, Sudhakar Kuppusamy wrote: >>>> The grub-mkimage does not add zero padding when creating core.elf with an >>>> appended signature size that is not aligned to a multiple of 4 bytes. >>>> Firmware is unable to read the magic string "~Module signature appended~" >>>> from core.elf. >>>> >>>> To fix this, round an appended signature size + appended signature ELF note >>>> size up to the nearest multiple of a 4-byte alignment and truncate it to >>>> the >>>> appended signature size. >>>> >>>> Example: >>>> grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \ >>>> kernel.der --appended-signature-size 490 ... >>>> >>>> Signed-off-by: Sudhakar Kuppusamy <[email protected]> >>>> --- >>>> util/grub-mkimagexx.c | 8 +++++++- >>>> 1 file changed, 7 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c >>>> index 7fe2e35e6..07a80a36d 100644 >>>> --- a/util/grub-mkimagexx.c >>>> +++ b/util/grub-mkimagexx.c >>>> @@ -248,7 +248,13 @@ SUFFIX (grub_mkimage_generate_elf) (const struct >>>> grub_install_image_target_desc >>>> if (appsig_size) >>>> { >>>> phnum++; >>>> - footer_size += ALIGN_UP (sizeof (struct >>>> grub_appended_signature_note), 4); >>>> + /* >>>> + * Rounds a appended signature size + appended signature note size >>>> up to >>>> + * the nearest multiple of a 4-byte alignment. >>>> + */ >>>> + footer_size += ALIGN_UP (sizeof (struct >>>> grub_appended_signature_note) + appsig_size, 4); >>>> + /* Truncating to appended signature size. */ >>>> + footer_size -= appsig_size; >>> >>> Should not this be >>> >>> footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4); >>> appsig_size += ALIGN_UP (appsig_size, 4); >>> >>> ? >> >> Thank you Daniel for the review. >> >> Did you meant footer_size += ALIGN_UP (appsig_size, 4); if yes, then it >> should be like >> >> footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4); >> footer_size += ALIGN_UP (appsig_size, 4); >> footer_size -= appsig_size; > > This subtraction makes me very suspicious. Something is off or not > sufficiently explained. E.g. the commit message does not say anything > which part of ELF file has to be aligned.
Sorry Daniel. I will correct the commit message and add the proper comments for subtraction. We should manually truncate the core Image with appsig_size after creating the core image before signing it if we do not subtract the appsig_size with footer_size. Example: grub-mkimage -O powerpc-ieee1275 -o ./core.elf -d grub-core -p /grub2 -x \ kernel.der --appended-signature-size 490 ... truncate -s -490 ./core.elf sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed If subtract the appsig_size from the footer_size, then it reduce one step for GRUB image signing. Example: grub-mkimage -O powerpc-ieee1275 -o ./core.elf -d grub-core -p /grub2 -x \ kernel.der --appended-signature-size 490 ... sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed Thanks, Sudhakar > > Daniel _______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
