[RFC PATCH] use objcopy for riscv64 with gnu-efi > 4.0

[Quirin Gylstorff]

From: Quirin Gylstorff <quirin.g...@siemens.com>

With gnu-efi > 4.0 the binary copy no longer works as it leads to
non working efi binaries. The binaries are from type data instead
of PE32+ executable for EFI. This can be check with the command
`file <path to the efibootguard binary>`

This fixes Debian bug 1130324 [1].

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130324

Signed-off-by: Quirin Gylstorff <quirin.g...@siemens.com>
---
configure.ac | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/configure.ac b/configure.ac
index 1779661..6a238f6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -247,10 +247,10 @@ AC_SUBST([OBJCOPY_HAS_EFI_APP_TARGET], [$($OBJCOPY --info | $GREP -q pei- 2>/dev

# Use objcopy -O binary on riscv64, arm, and aarch64 with gnu-efi 3.0.15
AM_CONDITIONAL([OBJCOPY_USE_BINARY_COPY],
- [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])
+ [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" -a $GNU_EFI_VERSION -lt 4000000 || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])

# Ensure objcopy supports target=efi-app for x86 across the board(s) and aarch64 with gnu-efi > 3.0.15
-if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0; then
+if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0 || test "$ARCH" = "riscv64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 4000000; then
AC_MSG_ERROR([objcopy doesn't support --target=efi-app but that is needed by gnu-efi])
fi

--
2.53.0

[Jan Kiszka]

On 26.06.26 13:55, 'Quirin Gylstorff' via EFI Boot Guard wrote:
> From: Quirin Gylstorff <quirin.g...@siemens.com>
>
> With gnu-efi > 4.0 the binary copy no longer works as it leads to
> non working efi binaries. The binaries are from type data instead
> of PE32+ executable for EFI. This can be check with the command
> `file <path to the efibootguard binary>`
>
> This fixes Debian bug 1130324 [1].
>
> [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130324
>
> Signed-off-by: Quirin Gylstorff <quirin.g...@siemens.com>
> ---
> configure.ac | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/configure.ac b/configure.ac
> index 1779661..6a238f6 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -247,10 +247,10 @@ AC_SUBST([OBJCOPY_HAS_EFI_APP_TARGET], [$($OBJCOPY --info | $GREP -q pei- 2>/dev
>
> # Use objcopy -O binary on riscv64, arm, and aarch64 with gnu-efi 3.0.15

Comment suggests that 3.0.15 is the upper limit for all arch, but the
code looks different. Can we please align this?

> AM_CONDITIONAL([OBJCOPY_USE_BINARY_COPY],
> - [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])
> + [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" -a $GNU_EFI_VERSION -lt 4000000 || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])

I would use that chance and unify over "||" and "&&", rather than mixing
with "-a". Brackets would also increase readability.

Does arm work without objcopy on gnu-efi 4.0?

>
> # Ensure objcopy supports target=efi-app for x86 across the board(s) and aarch64 with gnu-efi > 3.0.15

Outdated comment.

> -if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0; then
> +if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0 || test "$ARCH" = "riscv64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 4000000; then
> AC_MSG_ERROR([objcopy doesn't support --target=efi-app but that is needed by gnu-efi])
> fi
>

Also here: mixed operator types.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Quirin Gylstorff]

On 6/27/26 9:32 AM, Jan Kiszka wrote:
> On 26.06.26 13:55, 'Quirin Gylstorff' via EFI Boot Guard wrote:
>> From: Quirin Gylstorff <quirin.g...@siemens.com>
>>
>> With gnu-efi > 4.0 the binary copy no longer works as it leads to
>> non working efi binaries. The binaries are from type data instead
>> of PE32+ executable for EFI. This can be check with the command
>> `file <path to the efibootguard binary>`
>>
>> This fixes Debian bug 1130324 [1].
>>
>> [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130324
>>
>> Signed-off-by: Quirin Gylstorff <quirin.g...@siemens.com>
>> ---
>> configure.ac | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/configure.ac b/configure.ac
>> index 1779661..6a238f6 100644
>> --- a/configure.ac
>> +++ b/configure.ac
>> @@ -247,10 +247,10 @@ AC_SUBST([OBJCOPY_HAS_EFI_APP_TARGET], [$($OBJCOPY --info | $GREP -q pei- 2>/dev
>>
>> # Use objcopy -O binary on riscv64, arm, and aarch64 with gnu-efi 3.0.15
>
> Comment suggests that 3.0.15 is the upper limit for all arch, but the
> code looks different. Can we please align this?

I can only verify that the < 4.0 -O binary should be used.

>
>> AM_CONDITIONAL([OBJCOPY_USE_BINARY_COPY],
>> - [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])
>> + [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" -a $GNU_EFI_VERSION -lt 4000000 || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])
>
> I would use that chance and unify over "||" and "&&", rather than mixing
> with "-a". Brackets would also increase readability.
>

Ok I will reformat it in a v2.

> Does arm work without objcopy on gnu-efi 4.0?

Need to test it.

> >>
>> # Ensure objcopy supports target=efi-app for x86 across the board(s) and aarch64 with gnu-efi > 3.0.15
>
> Outdated comment.
>
>> -if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0; then
>> +if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0 || test "$ARCH" = "riscv64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 4000000; then
>> AC_MSG_ERROR([objcopy doesn't support --target=efi-app but that is needed by gnu-efi])
>> fi
>>
>
> Also here: mixed operator types.

Ok I will change it.

Quirin
>
> Jan
>

[Quirin Gylstorff]

From: Quirin Gylstorff <quirin.g...@siemens.com>

With gnu-efi > 4.0 the binary copy no longer works as it leads to
non working efi binaries. The binaries are from type data instead
of PE32+ executable for EFI. This can be check with the command
`file <path to the efibootguard binary>`

This fixes Debian bug 1130324 [1].

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130324

Signed-off-by: Quirin Gylstorff <quirin.g...@siemens.com>
---

Changes v2:
- add parenthesis
- correct comments

the binary copy for armhf still works

configure.ac | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/configure.ac b/configure.ac
index 1779661..0a5227a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -245,12 +245,17 @@ AC_DEFINE_UNQUOTED([GNU_EFI_VERSION], [${GNU_EFI_VERSION}], [gnu-efi version])

AC_SUBST([OBJCOPY_HAS_EFI_APP_TARGET], [$($OBJCOPY --info | $GREP -q pei- 2>/dev/null && echo "true")])

-# Use objcopy -O binary on riscv64, arm, and aarch64 with gnu-efi 3.0.15
+# Use objcopy -O binary arm, aarch64 with gnu-efi < 3.0.16 and riscv64 < 4.0

AM_CONDITIONAL([OBJCOPY_USE_BINARY_COPY],
- [test "$ARCH" = "arm" || test "$ARCH" = "riscv64" || test "$ARCH" = "aarch64" -a $GNU_EFI_VERSION -eq 0])

-
-# Ensure objcopy supports target=efi-app for x86 across the board(s) and aarch64 with gnu-efi > 3.0.15

-if test -z "$ARCH_IS_X86_TRUE" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" || test "$ARCH" = "aarch64" -a -z "$OBJCOPY_HAS_EFI_APP_TARGET" -a $GNU_EFI_VERSION -gt 0; then

+ [test "$ARCH" = "arm" || \
+ (test "$ARCH" = "riscv64" && test $GNU_EFI_VERSION -lt 4000000) || \
+ (test "$ARCH" = "aarch64" && test $GNU_EFI_VERSION -eq 0)])
+
+# Ensure objcopy supports target=efi-app for x86 across the board(s), aarch64 with gnu-efi > 3.0.15,
+# and riscv64 > 4.0
+if (test -z "$ARCH_IS_X86_TRUE" && test -z "$OBJCOPY_HAS_EFI_APP_TARGET") || \
+ (test "$ARCH" = "aarch64" && test -z "$OBJCOPY_HAS_EFI_APP_TARGET" && test $GNU_EFI_VERSION -gt 0) || \
+ (test "$ARCH" = "riscv64" && test -z "$OBJCOPY_HAS_EFI_APP_TARGET" && test $GNU_EFI_VERSION -gt 4000000); then

AC_MSG_ERROR([objcopy doesn't support --target=efi-app but that is needed by gnu-efi])
fi

--
2.53.0