devtool: added strip command

Added `devtool strip` command. This command can strip debug symbols
from Firecracker release binaries. The command can be parameterized by
`--target-libc (musl|gnu)`, which sets the libc used by a specific
toolchain (e.g. x86_64-uknown-linux-${libc_flavor}).

Signed-off-by: Iulian Barbu <[email protected]>

Author: Iulian Barbu

CHANGELOG.md

@@ -17,6 +17,8 @@
 - Added experimental JSON response format support for MMDS guest applications
   requests.
 - Added metrics for the vsock device. 
+- Added devtool strip command which removes debug symbols from the release
+  binaries.
 
 ### Fixed
 

tests/host_tools/cargo_build.py

@@ -69,6 +69,11 @@ def get_firecracker_binaries():
     fc_bin_path = "{}/{}".format(out_dir, FC_BINARY_NAME)
     jailer_bin_path = "{}/{}".format(out_dir, JAILER_BINARY_NAME)
 
+    utils.run_cmd(
+        "strip --strip-debug {} {}"
+        .format(fc_bin_path, jailer_bin_path)
+    )
+
     return fc_bin_path, jailer_bin_path
 
 

tests/integration_tests/build/test_binary_size.py

@@ -11,16 +11,31 @@
 MACHINE = platform.machine()
 """ Platform definition used to select the correct size target"""
 
-FC_BINARY_SIZE_TARGET = 2751144 if MACHINE == "x86_64" else 3132008
+SIZES_DICT = {
+    "x86_64": {
+        "FC_BINARY_SIZE_TARGET": 1648616,
+        "JAILER_BINARY_SIZE_TARGET": 1439512,
+        "FC_BINARY_SIZE_LIMIT": 2052927,
+        "JAILER_BINARY_SIZE_LIMIT": 1511488,
+    },
+    "aarch64": {
+        "FC_BINARY_SIZE_TARGET": 1619432,
+        "JAILER_BINARY_SIZE_TARGET": 1338312,
+        "FC_BINARY_SIZE_LIMIT": 2024290,
+        "JAILER_BINARY_SIZE_LIMIT": 1511488,
+    }
+}
+
+FC_BINARY_SIZE_TARGET = SIZES_DICT[MACHINE]["FC_BINARY_SIZE_TARGET"]
 """Firecracker target binary size in bytes"""
 
-FC_BINARY_SIZE_LIMIT = 3100000 if MACHINE == "x86_64" else 3500000
+FC_BINARY_SIZE_LIMIT = SIZES_DICT[MACHINE]["FC_BINARY_SIZE_LIMIT"]
 """Firecracker maximum binary size in bytes"""
 
-JAILER_BINARY_SIZE_TARGET = 2483592 if MACHINE == "x86_64" else 2714528
+JAILER_BINARY_SIZE_TARGET = SIZES_DICT[MACHINE]["JAILER_BINARY_SIZE_TARGET"]
 """Jailer target binary size in bytes"""
 
-JAILER_BINARY_SIZE_LIMIT = 3000000
+JAILER_BINARY_SIZE_LIMIT = SIZES_DICT[MACHINE]["JAILER_BINARY_SIZE_LIMIT"]
 """Jailer maximum binary size in bytes"""
 
 BINARY_SIZE_TOLERANCE = 0.05

tools/devtool

@@ -139,8 +139,8 @@ say_noln() {
 #
 say_err() {
     [ -t 2 ] && [ -n "$TERM" ] \
-        && echo "$(tput setaf 1)[$MY_NAME] $*$(tput sgr0)" 1>&2 \
-        || echo "[$MY_NAME] $*" 1>&2
+        && echo -e "$(tput setaf 1)[$MY_NAME] $*$(tput sgr0)" 1>&2 \
+        || echo -e "[$MY_NAME] $*" 1>&2
 }
 
 # Send a warning-highlighted text to stdout
@@ -234,6 +234,19 @@ ensure_build_dir() {
     done
 }
 
+# Makes sure that Firecracker release binaries were built.
+# This is relevant in the context of stripping the already built release binaries.
+ensure_release_binaries_exist() {
+    target=$1
+    profile=$2
+    firecracker_bin_path="$CARGO_TARGET_DIR/$target/$profile/firecracker"
+    jailer_bin_path="$CARGO_TARGET_DIR/$target/$profile/jailer"
+
+    # Both binaries must exist for the stripping to be succesgitsful.
+    [ -f $firecracker_bin_path ] && [ -f $jailer_bin_path ] || \
+    die "Missing release binaries. Needed files:\n* $firecracker_bin_path\n* $jailer_bin_path."
+}
+
 # Fix build/ dir permissions after a privileged container run.
 # Since the privileged cotainer runs as root, any files it creates will be
 # owned by root. This fixes that by recursively changing the ownership of build/
@@ -385,6 +398,15 @@ cmd_help() {
     echo "        -l, --libc musl|gnu   Choose the libc flavor against which Firecracker will"
     echo "                              be linked. Default is musl."
     echo ""
+    echo "    strip [--target-libc musl|gnu]"
+    echo "        Strip debug symbols from the Firecracker release binaries."
+    echo ""
+    echo "        --target-libc musl|gnu   Choose the target libc flavor which determines the"
+    echo "                                 toolchain used to build Firecracker release binaries."
+    echo "                                 Stripping will occur only for the Firecracker release"
+    echo "                                 binaries corresponding to the inferred toolchain. Default"
+    echo "                                 is musl."
+    echo ""
     echo "    fmt"
     echo "        Auto-format all Rust source files, to match the Firecracker requirements."
     echo "        This should be used as the last step in every commit, to ensure that the"
@@ -504,6 +526,55 @@ cmd_build() {
     return $ret
 }
 
+cmd_strip() {
+    profile="release"
+    libc="musl"
+    target="$(uname -m)-unknown-linux-${libc}"
+
+    # Parse any command line args.
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            "-h"|"--help")  { cmd_help; exit 1;     } ;;
+            "--target-libc")
+                shift
+                [[ "$1" =~ ^(musl|gnu)$ ]] || \
+                    die "Invalid libc: $1. Valid options are \"musl\" and \"gnu\"."
+                libc="$1"
+                target="$(uname -m)-unknown-linux-${libc}"
+                ;;
+            *)
+                die "Unknown argument: $1. Please use --help for help."
+            ;;
+        esac
+        shift
+    done
+
+    # Check prerequisites
+    ensure_devctr
+    ensure_build_dir
+    ensure_release_binaries_exist $target $profile
+
+    say "Starting stripping the debug symbols for $profile binaries built against $target target."
+    strip_flags="--strip-debug"
+    say "Strip flags: $strip_flags."
+
+    run_devctr \
+      --user "$(id -u):$(id -g)" \
+      -- \
+      strip $strip_flags\
+        "$CTR_CARGO_TARGET_DIR/$target/$profile/firecracker" \
+        "$CTR_CARGO_TARGET_DIR/$target/$profile/jailer"
+    ret=$?
+
+    [ $ret -eq 0 ] && {
+        cargo_bin_dir="$CARGO_TARGET_DIR/$target/$profile"
+        say "Stripping was successful."
+        say "Stripped binaries placed under $cargo_bin_dir."
+    }
+
+    return $ret
+}
+
 # `$0 test` - run integration tests
 # Please see `$0 help` for more information.
 #