Building UKI with ukify fails with PEError: Not enough header space to add section

[kepstin]

systemd version the issue has been seen with

254

Used distribution

Exherbo Linux (rolling)

Linux kernel version used

6.1.37_kepstin

CPU architectures issue was seen on

x86_64

Component

systemd-stub

Expected behaviour you didn't see

UKI build should complete successfully without errors.

Unexpected behaviour you saw

When running ukify, the build fails with the following output:

# /usr/lib/systemd/ukify build --linux /lib/modules/6.1.42_kepstin/vmlinuz --initrd /lib/modules/6.1.42_kepstin/initrd --uname 6.1.42_kepstin --output /efi/EFI/Linux/106c6f89aa124a32a808eba1993bcaa1-6.1.42_kepstin.efi
Host arch 'x86_64', EFI arch 'x64'
Tool sbsign not installed!
Traceback (most recent call last):
  File "/usr/lib/systemd/ukify", line 1482, in <module>
    main()
  File "/usr/lib/systemd/ukify", line 1473, in main
    make_uki(opts)
  File "/usr/lib/systemd/ukify", line 789, in make_uki
    pe_add_sections(uki, output)
  File "/usr/lib/systemd/ukify", line 552, in pe_add_sections
    raise PEError(f'Not enough header space to add section {section.name}.')
PEError: Not enough header space to add section .osrel.

As far as I can tell, the problem seems to be related to the build of the linuxx64.efi.stub file? it seems likely that the elf2efi.py tool is not reserving sufficient header space to add all of the required new sections; I'm going to try to patch the systemd build to use the --minimum-sections option to see if that helps.

Note that I've seen this issue when building with clang 16 + lld, gcc 12 + binutils ld (bfd), both with and without lto. Additional log output contains the output of llvm-objdump -x on the stub as built with clang.

Steps to reproduce the problem

Unsure; has happened on multiple systems running Exherbo. We might have some environment-specific issue in the distro which affects this, but I haven't been able to find anything obvious.

Additional program output to the terminal or log subsystem illustrating the issue

# llvm-objdump -x /lib/systemd/boot/efi/linuxx64.efi.stub                          

/lib/systemd/boot/efi/linuxx64.efi.stub:        file format coff-x86-64
architecture: x86_64                            
start address: 0x0000000000000000               
Characteristics 0x22e                           
        executable                              
        line numbers stripped                   
        symbols stripped                                                                              
        large address aware
        debugging information removed
                                                                                                                                                                                                            
Time/Date               Sun Jul 30 11:22:19 2023
Magic                   020b    (PE32+)
MajorLinkerVersion      0
MinorLinkerVersion      0
SizeOfCode              000000000001029f
SizeOfInitializedData   0000000000002d1f
SizeOfUninitializedData 0000000000000000
AddressOfEntryPoint     0000000000003610
BaseOfCode              0000000000001000
ImageBase               000000014df90000
SectionAlignment        00001000
FileAlignment           00000200
MajorOSystemVersion     0
MinorOSystemVersion     0
MajorImageVersion       254
MinorImageVersion       0
MajorSubsystemVersion   1
MinorSubsystemVersion   1
Win32Version            00000000
SizeOfImage             00018000
SizeOfHeaders           00000200
CheckSum                00000000
Subsystem               0000000a        (EFI application)
DllCharacteristics      00000160
                                        HIGH_ENTROPY_VA
                                        DYNAMIC_BASE
                                        NX_COMPAT
SizeOfStackReserve      0000000000100000
SizeOfStackCommit       0000000000001000
SizeOfHeapReserve       0000000000100000
SizeOfHeapCommit        0000000000001000
LoaderFlags             00000000
NumberOfRvaAndSizes     00000010

The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 0000000000000000 00000000 Import Directory [parts of .idata]
Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000017000 00000080 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory 
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000000000 00000000 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved


Sections:
Idx Name          Size     VMA              Type
  0 .text         0001029f 000000014df91000 TEXT
  1 .rodata       000029a0 000000014dfa2000 DATA
  2 .data         000002d8 000000014dfa5000 DATA
  3 .sdmagic      00000027 000000014dfa6000 DATA
  4 .reloc        00000080 000000014dfa7000 TEXT, DATA

SYMBOL TABLE:

[bluca]

PEError: Not enough header space to add section .osrel.

What's the content of your /etc/os-release ?

[medhefgo]

The stub is not built with sbat information, which means the PE headers fit within (exactly) 0x200 bytes. This one section was the tipping point for more space being available for future additions. I guess we definitely wanna pass some reasonable --minimum-sections.

[kepstin]

What's the content of your /etc/os-release ?

I didn't include this initially, because the error was about the section headers not the section content, but here:

os-release

NAME="Exherbo"
PRETTY_NAME="Exherbo Linux"
ID=exherbo
ANSI_COLOR="0;32"
HOME_URL="https://www.exherbo.org/"
SUPPORT_URL="irc://irc.libera.chat/#exherbo"
BUG_REPORT_URL="https://gitlab.exherbo.org/"
BUILD_ID=6.1.42_kepstin

(It would be nice at some point to get systemd-boot to show the uname so I don't have to stick the kernel version into BUILD_ID, but that's a separate issue)

@medhefgo I've tested the changes in #28595 and have successfully built a and booted a UKI. This also fixes a … presumably related? … issue I was seeing where llvm objdump could read the stub file, but binutils objdump printed some warnings before giving an error that the file format was not recognized.