On Wed, Dec 24, 2025 at 10:35:19PM +0530, Sudhakar Kuppusamy wrote: > When creating the core image with an unaligned appended signature size (e.g., > 479)
s/(e.g., 479)/,e.g. 479,/ > for PowerPC, the grub-mkimage aligns the appended signature size to a > multiple of > 4 bytes, but it does not find and add the padding needed to align a multiple > of 4 s/find and add the padding/add a padding/ s/to align a/to align to/ > bytes appended signature size in the appended signature ELF note. Therefore, > After s/After/after/ > signing and installing this core image, the firmware tries to read the magic > string > "~Module signature appended~" from the appended signature ELF note but gets > the > partial magic string like "Module signature appended~", and it leads to the > appended s/, and it/. It/ > signature magic string matching failing. s/matching failing/match failure/ > Example: > grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \ The -d argument does not matter here and s#/grub2#/grub#. > kernel.der --appended-signature-size 479 ... > > sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed > > Without padding: hexdump -C ./core.elf.signed > . > . > 00383550 00 00 00 13 00 00 01 e0 41 53 69 67 41 70 70 65 |........ASigAppe| > 00383560 6e 64 65 64 2d 53 69 67 6e 61 74 75 72 65 00 00 |nded-Signature..| > . > . > 003836f0 dd 47 cd ed 02 8e 15 af 5b 09 2e 44 6f da 67 88 |.G......[..Do.g.| > 00383700 4d 94 17 31 26 9d 47 95 d8 7c ad 36 00 d2 9c 53 |M..1&.G..|.6...S| > 00383710 20 e0 af 60 78 cd 22 e6 ed 45 1e b1 e7 7e cf b5 | ..`x."..E...~..| > 00383720 fc 58 ec df 1b ab 7a 00 00 02 00 00 00 00 00 00 |.X....z.........| > 00383730 00 01 b7 7e 4d 6f 64 75 6c 65 20 73 69 67 6e 61 |...~Module signa| > 00383740 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ture appended~.| > > To fix this, find and include the padding required to align a multiple of 4 > bytes of > appended signature size in the appended signature ELF note. Fix this by adding a padding required to align appended signature size in the appended signature ELF note to multiple of 4 bytes. > Example: > grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \ Same comment as for grub-mkimage above... > kernel.der --appended-signature-size 479 ... > > sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed > > With padding: hexdump -C ./core.elf.signed > . > . > 00137460 62 00 00 00 00 00 00 13 00 00 01 ec 41 53 69 67 |b...........ASig| > 00137470 41 70 70 65 6e 64 65 64 2d 53 69 67 6e 61 74 75 |Appended-Signatu| > . > . > 00137610 b7 07 cd b6 c8 ca 9a 5b 7c 13 8c 75 1d 1c 54 81 |.......[|..u..T.| > 00137620 7f c4 9a 8b bd d7 73 8d 2f 7d d2 e6 d1 3c 52 a9 |......s./}...<R.| > 00137630 4e 0b e5 24 ba 0a 82 aa 8e c5 86 fa e1 19 50 ec |N..$..........P.| > 00137640 9f a7 9a ed e5 ed 13 35 00 00 02 00 00 00 00 00 |.......5........| > 00137650 00 00 01 c2 7e 4d 6f 64 75 6c 65 20 73 69 67 6e |....~Module sign| > 00137660 61 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ature appended~.| > > Signed-off-by: Sudhakar Kuppusamy <[email protected]> If you fix these minor issues you can add my RB to the patch... Daniel _______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
