Re: [PATCH for-4.22] xen/x86: Always strip xen.efi

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 09/06/2026 5:30 pm, Roger Pau Monné wrote:
> On Mon, Jun 08, 2026 at 06:31:08PM +0100, Andrew Cooper wrote:
>> From: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
>>
>> xen.efi with debugging symbols is ~45MB, down to ~9.3MB when stripped.
>> Multiple firmwares (as seen by QubesOS, Trenchboot, and XenServer) are unable
>> to boot xen.efi when debugging symbols are included.
>>
>> Either way, having debug symbols by default is abnormal and contrary to how
>> the non-EFI path works.
>>
>> Produce xen-syms.efi unconditionally, just like xen-syms.  If
>> CONFIG_DEBUG_INFO is enabled, these will contain debug symbols, and if not,
>> then not.  When xen-syms is processed by mkelf32, the debug symbols are 
>> simply
>> discarded.  For xen-syms.efi, call $(STRIP) to produce xen.efi.
>>
>> Some old versions of binutils ld managed to produce efi files which the
>> matching version of strip couldn't process.  This includes Binutils 2.26
>> included in Ubuntu 16.04.  Delete the workaround for this bug, and require a
>> less broken toolchain.
> We should then bump the minimum required GNU binutils version in the
> README, as strip is also part of the binutils suite itself?
>
>> Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>> ---
>> CC: Jan Beulich <jbeulich@xxxxxxxx>
>> CC: Roger Pau Monné <roger.pau@xxxxxxxxxx>
>> CC: Teddy Astie <teddy.astie@xxxxxxxxxx>
>> CC: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
>> CC: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
>> CC: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
>> CC: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
>>
>> For 4.22.  This was posted previously as
>>
>>   
>> https://lore.kernel.org/xen-devel/20251208133945.61375-1-frediano.ziglio@xxxxxxxxxx/T/#u
>>
>> but merged the two patches and rewritten the commit message to make it clear
>> that failing to strip xen.efi is causing boot failures.
>>
>> Previously xen.efi.elf was produced but it's unclear why, and unnecessaerily
>> different, so I've dropped it.
>>
>> While this does want backporting, it can't be.  Xen 4.21 and older still 
>> build
>> test with Ubuntu 16.04 and choke
>> ---
>>  .gitignore            |  1 +
>>  CHANGELOG.md          |  3 +++
>>  docs/misc/efi.pandoc  |  8 +-------
>>  xen/Kconfig.debug     |  9 ++-------
>>  xen/Makefile          | 19 -------------------
>>  xen/arch/x86/Makefile | 11 ++++-------
>>  xen/arch/x86/arch.mk  |  7 -------
>>  7 files changed, 11 insertions(+), 47 deletions(-)
>>
>> diff --git a/.gitignore b/.gitignore
>> index bfc7bdf043c3..49e2c6961768 100644
>> --- a/.gitignore
>> +++ b/.gitignore
>> @@ -224,6 +224,7 @@ tools/flask/policy/xenpolicy-*
>>  xen/xen
>>  xen/suppression-list.txt
>>  xen/xen-syms
>> +xen/xen-syms.efi
>>  xen/xen-syms.map
>>  xen/xen.*
>>  
>> diff --git a/CHANGELOG.md b/CHANGELOG.md
>> index 5cf19372a361..71d1e9ab8c69 100644
>> --- a/CHANGELOG.md
>> +++ b/CHANGELOG.md
>> @@ -14,6 +14,9 @@ The format is based on [Keep a 
>> Changelog](https://keepachangelog.com/en/1.0.0/)
>>   - On x86:
>>     - Enable pf-fixup option by default for PVH dom0.
>>     - The libxenguest bzImage loader now uses the system liblz4 library.
>> +   - The install-time environment variable INSTALL_EFI_STRIP no longer 
>> exists.
>> +     xen.efi is always stripped, while the symbols remain available in
>> +     xen-syms.efi.
> This is not x86-only, AFAICT ARM also seems to have a rune to generate
> a xen.efi image, which will be affected by the removal of
> INSTALL_EFI_STRIP?

x86 and ARM are entirely different, with x86 being the weird one.

ARM, like every other systems codebase trying to do EFI, is a raw binary
with hand-coded MZ/PE+ headers.  In our case, it's deliberately a
polygot which is both EFI and Linux zImage.

Notice how the rule is this:

$(TARGET): $(TARGET)-syms
        $(OBJCOPY) -O binary -S $< $@
ifeq ($(CONFIG_ARM_64),y)
        ln -sf $(@F) $@.efi
endif

~Andrew