On Mon, Dec 22, 2025 at 06:35:29PM +0530, Sudhakar Kuppusamy wrote: > > On 22 Dec 2025, at 3:06 PM, Daniel Kiper <[email protected]> wrote: > > On Sat, Dec 20, 2025 at 10:40:35PM +0530, Sudhakar Kuppusamy wrote: > >>> On 20 Dec 2025, at 7:17 PM, Daniel Kiper <[email protected]> wrote: > >>> On Wed, Dec 03, 2025 at 08:00:36PM +0530, Sudhakar Kuppusamy wrote: > >>>> The grub-mkimage does not add zero padding when creating core.elf with an > >>>> appended signature size that is not aligned to a multiple of 4 bytes. > >>>> Firmware is unable to read the magic string "~Module signature appended~" > >>>> from core.elf. > >>>> > >>>> To fix this, round an appended signature size + appended signature ELF > >>>> note > >>>> size up to the nearest multiple of a 4-byte alignment and truncate it to > >>>> the > >>>> appended signature size. > >>>> > >>>> Example: > >>>> grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \ > >>>> kernel.der --appended-signature-size 490 ... > >>>> > >>>> Signed-off-by: Sudhakar Kuppusamy <[email protected]> > >>>> --- > >>>> util/grub-mkimagexx.c | 8 +++++++- > >>>> 1 file changed, 7 insertions(+), 1 deletion(-) > >>>> > >>>> diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c > >>>> index 7fe2e35e6..07a80a36d 100644 > >>>> --- a/util/grub-mkimagexx.c > >>>> +++ b/util/grub-mkimagexx.c > >>>> @@ -248,7 +248,13 @@ SUFFIX (grub_mkimage_generate_elf) (const struct > >>>> grub_install_image_target_desc > >>>> if (appsig_size) > >>>> { > >>>> phnum++; > >>>> - footer_size += ALIGN_UP (sizeof (struct > >>>> grub_appended_signature_note), 4); > >>>> + /* > >>>> + * Rounds a appended signature size + appended signature note > >>>> size up to > >>>> + * the nearest multiple of a 4-byte alignment. > >>>> + */ > >>>> + footer_size += ALIGN_UP (sizeof (struct > >>>> grub_appended_signature_note) + appsig_size, 4); > >>>> + /* Truncating to appended signature size. */ > >>>> + footer_size -= appsig_size; > >>> > >>> Should not this be > >>> > >>> footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4); > >>> appsig_size += ALIGN_UP (appsig_size, 4); > >>> > >>> ? > >> > >> Thank you Daniel for the review. > >> > >> Did you meant footer_size += ALIGN_UP (appsig_size, 4); if yes, then it > >> should be like > >> > >> footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4); > >> footer_size += ALIGN_UP (appsig_size, 4); > >> footer_size -= appsig_size; > > > > This subtraction makes me very suspicious. Something is off or not > > sufficiently explained. E.g. the commit message does not say anything > > which part of ELF file has to be aligned. > > Sorry Daniel. I will correct the commit message and add the proper comments > for subtraction. > > We should manually truncate the core Image with appsig_size after creating > the core image before signing it > if we do not subtract the appsig_size with footer_size. > > Example: > > grub-mkimage -O powerpc-ieee1275 -o ./core.elf -d grub-core -p /grub2 -x \ > kernel.der --appended-signature-size 490 ... > > truncate -s -490 ./core.elf > > sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed > > If subtract the appsig_size from the footer_size, then it reduce one step for > GRUB image signing. > > Example: > > grub-mkimage -O powerpc-ieee1275 -o ./core.elf -d grub-core -p /grub2 -x \ > kernel.der --appended-signature-size 490 ... > > sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed
I think you are looking for this: footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4); footer_size += ALIGN_UP_OVERHEAD (appsig_size, 4); Though still commit message begs for better explanation of the issue. Daniel _______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
