From 75747c8a399967fa5d815a8f70f724436d035652 Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Sat, 1 Jan 2022 16:37:27 +0100
Subject: [PATCH 1/2] boot: Use objcopy to align sections

Not aligning these can create gaps in the section table. Some
firmware does not handle this nicely resulting in secure boot
signature fails.
Using objcopy ensures that any new sections in the future will be
properly aligned.

Fixes: #21956
---
 src/boot/efi/meson.build   | 1 +
 src/boot/efi/secure-boot.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build
index ab970001e4..8587b11cd6 100644
--- a/src/boot/efi/meson.build
+++ b/src/boot/efi/meson.build
@@ -405,6 +405,7 @@ foreach tuple : [['systemd_boot.so', systemd_boot_efi_name, systemd_boot_objects
                            '-j', '.sdata',
                            '-j', '.sdmagic',
                            '-j', '.text',
+                           '--section-alignment=512',
                            efi_format,
                            '@INPUT@', '@OUTPUT@'],
                 install : true,
diff --git a/src/boot/efi/secure-boot.c b/src/boot/efi/secure-boot.c
index efea145719..ab2d256031 100644
--- a/src/boot/efi/secure-boot.c
+++ b/src/boot/efi/secure-boot.c
@@ -30,7 +30,7 @@ SecureBootMode secure_boot_mode(void) {
 }
 
 #ifdef SBAT_DISTRO
-static const char sbat[] _used_ _section_ (".sbat") _align_ (512) =
+static const char sbat[] _used_ _section_(".sbat") =
         "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md\n"
         SBAT_PROJECT ",1,The systemd Developers," SBAT_PROJECT "," PROJECT_VERSION "," PROJECT_URL "\n"
         SBAT_PROJECT "." SBAT_DISTRO "," STRINGIFY(SBAT_DISTRO_GENERATION) "," SBAT_DISTRO_SUMMARY "," SBAT_DISTRO_PKGNAME "," SBAT_DISTRO_VERSION "," SBAT_DISTRO_URL "\n";

From bbbf1c3d3229d328f1bcbf039db8e15e221a1d85 Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Sun, 2 Jan 2022 20:05:58 +0100
Subject: [PATCH 2/2] ci: Test efi binaries for section table gaps

---
 .github/workflows/build_test.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
index 78bc35a43b..cd5fcac550 100755
--- a/.github/workflows/build_test.sh
+++ b/.github/workflows/build_test.sh
@@ -132,6 +132,12 @@ for args in "${ARGS[@]}"; do
         fatal "'meson compile' failed with $args"
     fi
 
+    for loader in build/src/boot/efi/*.efi; do
+        if sbverify --list "$loader" |& grep -q "gap in section table"; then
+            fatal "$loader: Gaps found in section table"
+        fi
+    done
+
     git clean -dxf
 
     success "Build with $args passed in $SECONDS seconds"