Re: [PATCH v2] xen: Strip xen.efi by default

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 12/06/2025 11:07 am, Frediano Ziglio wrote:
> For xen.gz file we strip all symbols and have an additional
> xen-syms file version with all symbols.
> Make xen.efi more coherent stripping all symbols too.
> xen.efi.elf can be used for debugging.
>
> Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxx>
> ---
> Changes since v1:
> - avoid leaving target if some command fails

CC-ing the EFI maintainers, as this is an EFI change.

At the recent QubesOS hackathon, Michał Żygowski (3mdeb) found that
stripping Xen was the difference between the system booting and not.

With debugging symbols, xen.efi was ~32M and is placed above the 4G
boundary by the EFI loader, hitting Xen's sanity check that it's below 4G.

Xen does still have a requirement to live below the 4G boundary.  At a
minimum, idle_pg_table needs to be addressable with a 32bit %cr3, but I
bet that isn't the only restriction we have.

So, either we find a way of telling the EFI loader (using PE+ headers
only) that we require to be below 4G (I have no idea if this is
possible), or we strip xen.efi by default.

I don't think making Xen.efi safe to operate above the 4G boundary is a
viable option at this point.

As Xen's defaults are broken on modern systems, this is also a bugfix
candidate for 4.21, so CC Oleksii.

~Andrew

(Retaining full patch for those CC'd into the thread)

> ---
>  docs/misc/efi.pandoc  |  8 +-------
>  xen/Kconfig.debug     |  9 ++-------
>  xen/Makefile          | 19 -------------------
>  xen/arch/x86/Makefile |  8 +++++---
>  4 files changed, 8 insertions(+), 36 deletions(-)
>
> diff --git a/docs/misc/efi.pandoc b/docs/misc/efi.pandoc
> index 11c1ac3346..c66b18a66b 100644
> --- a/docs/misc/efi.pandoc
> +++ b/docs/misc/efi.pandoc
> @@ -20,13 +20,7 @@ Xen to load the configuration file even if multiboot 
> modules are found.
>  Once built, `make install-xen` will place the resulting binary directly into
>  the EFI boot partition, provided `EFI_VENDOR` is set in the environment (and
>  `EFI_MOUNTPOINT` is overridden as needed, should the default of `/boot/efi` 
> not
> -match your system). When built with debug info, the binary can be quite 
> large.
> -Setting `INSTALL_EFI_STRIP=1` in the environment will cause it to be stripped
> -of debug info in the process of installing. `INSTALL_EFI_STRIP` can also be 
> set
> -to any combination of options suitable to pass to `strip`, in case the 
> default
> -ones don't do. The xen.efi binary will also be installed in 
> `/usr/lib64/efi/`,
> -unless `EFI_DIR` is set in the environment to override this default. This
> -binary will not be stripped in the process.
> +match your system).
>  
>  The binary itself will require a configuration file (names with the `.efi`
>  extension of the binary's name replaced by `.cfg`, and - until an existing
> diff --git a/xen/Kconfig.debug b/xen/Kconfig.debug
> index d14093017e..cafbb1236c 100644
> --- a/xen/Kconfig.debug
> +++ b/xen/Kconfig.debug
> @@ -147,12 +147,7 @@ config DEBUG_INFO
>         Say Y here if you want to build Xen with debug information. This
>         information is needed e.g. for doing crash dump analysis of the
>         hypervisor via the "crash" tool.
> -       Saying Y will increase the size of the xen-syms and xen.efi
> -       binaries. In case the space on the EFI boot partition is rather
> -       limited, you may want to install a stripped variant of xen.efi in
> -       the EFI boot partition (look for "INSTALL_EFI_STRIP" in
> -       docs/misc/efi.pandoc for more information - when not using
> -       "make install-xen" for installing xen.efi, stripping needs to be
> -       done outside the Xen build environment).
> +       Saying Y will increase the size of the xen-syms and xen.efi.elf
> +       binaries.
>  
>  endmenu
> diff --git a/xen/Makefile b/xen/Makefile
> index 8fc4e042ff..664c4ea7b8 100644
> --- a/xen/Makefile
> +++ b/xen/Makefile
> @@ -488,22 +488,6 @@ endif
>  .PHONY: _build
>  _build: $(TARGET)$(CONFIG_XEN_INSTALL_SUFFIX)
>  
> -# Strip
> -#
> -# INSTALL_EFI_STRIP, if defined, will cause xen.efi to be stripped before it
> -# is installed. If INSTALL_EFI_STRIP is '1', then the default option(s) below
> -# will be used. Otherwise, INSTALL_EFI_STRIP value will be used as the
> -# option(s) to the strip command.
> -ifdef INSTALL_EFI_STRIP
> -
> -ifeq ($(INSTALL_EFI_STRIP),1)
> -efi-strip-opt := --strip-debug --keep-file-symbols
> -else
> -efi-strip-opt := $(INSTALL_EFI_STRIP)
> -endif
> -
> -endif
> -
>  .PHONY: _install
>  _install: D=$(DESTDIR)
>  _install: T=$(notdir $(TARGET))
> @@ -530,9 +514,6 @@ _install: $(TARGET)$(CONFIG_XEN_INSTALL_SUFFIX)
>               ln -sf $(T)-$(XEN_FULLVERSION).efi 
> $(D)$(EFI_DIR)/$(T)-$(XEN_VERSION).efi; \
>               ln -sf $(T)-$(XEN_FULLVERSION).efi $(D)$(EFI_DIR)/$(T).efi; \
>               if [ -n '$(EFI_MOUNTPOINT)' -a -n '$(EFI_VENDOR)' ]; then \
> -                     $(if $(efi-strip-opt), \
> -                          $(STRIP) $(efi-strip-opt) -p -o 
> $(TARGET).efi.stripped $(TARGET).efi && \
> -                          $(INSTALL_DATA) $(TARGET).efi.stripped 
> $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi ||) \
>                       $(INSTALL_DATA) $(TARGET).efi 
> $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
>               elif [ "$(D)" = "$(patsubst $(shell cd $(XEN_ROOT) && 
> pwd)/%,%,$(D))" ]; then \
>                       echo 'EFI installation only partially done (EFI_VENDOR 
> not set)' >&2; \
> diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
> index ce724a9daa..e0ebc8c73e 100644
> --- a/xen/arch/x86/Makefile
> +++ b/xen/arch/x86/Makefile
> @@ -232,14 +232,16 @@ endif
>       $(MAKE) $(build)=$(@D) .$(@F).1r.o .$(@F).1s.o
>       $(LD) $(call EFI_LDFLAGS,$(VIRT_BASE)) -T $(obj)/efi.lds $< \
>             $(dot-target).1r.o $(dot-target).1s.o $(orphan-handling-y) \
> -           $(note_file_option) -o $@
> -     $(NM) -pa --format=sysv $@ \
> +           $(note_file_option) -o $@.tmp
> +     $(NM) -pa --format=sysv $@.tmp \
>               | $(objtree)/tools/symbols --all-symbols --xensyms --sysv 
> --sort \
>               > $@.map
>  ifeq ($(CONFIG_DEBUG_INFO),y)
> -     $(if $(filter --strip-debug,$(EFI_LDFLAGS)),:$(space))$(OBJCOPY) -O 
> elf64-x86-64 $@ $@.elf
> +     $(if $(filter --strip-debug,$(EFI_LDFLAGS)),:$(space))$(OBJCOPY) -O 
> elf64-x86-64 $@.tmp $@.elf
> +     $(if $(filter --strip-debug,$(EFI_LDFLAGS)),:$(space))$(STRIP) $@.tmp
>  endif
>       rm -f $(dot-target).[0-9]* $(@D)/..$(@F).[0-9]*
> +     mv -f $@.tmp $@
>  ifeq ($(CONFIG_XEN_IBT),y)
>       $(SHELL) $(srctree)/tools/check-endbr.sh $@
>  endif