title: Reducing AOSP kernel image size
body: <p>I am trying to build an AOSP kernel, but I can't make the resulting <code>boot.img</code> small enough to flash and boot it. It contains the compressed kernel with appended dtbs and the initramfs. My intention is to fuzz-test drivers using <a href="https://github.com/google/syzkaller" rel="nofollow noreferrer">Syzkaller</a>. I'm currently using a Pixel XL (marlin). I use kernel branch <code>android-msm-marlin-3.18-pie-qpr3</code> (tried related ones as well) and I'm trying various gcc-based toolchains. For AOSP I picked Pie (tag <code>android-9.0.0_r46</code>, build <code>PQ3A.190801.002</code>). However, please note that this is a general question, it's not fuzzing-, kernel- or device-specific.</p>
  
  <p>My requirements are:</p>
  
  <ul>
  <li><p>Keep vendor-introduced drivers (because they are what I want to fuzz)</p></li>
  <li><p>Enable KASAN and KCOV (and their dependencies)</p></li>
  <li><p>Enable <code>CONFIG_DEBUG_INFO</code></p></li>
  <li><p>Keep <code>printk</code> and the like</p></li>
  </ul>
  
  <p>Things I tried and ideas I have:</p>
  
  <ul>
  <li><p><strong>Tuning kernel config</strong> - This helps to some extend, but it's just not enough. I'm already using for example <code>CONFIG_CC_OPTIMIZE_FOR_SIZE=y</code>, <code>CONFIG_CORE_SMALL=y</code>, <code>CONFIG_NET_SMALL=y</code>, <code>CONFIG_KASAN_OUTLINE=y</code>, <code>CONFIG_TRIM_UNUSED_KSYMS=y</code>, <code>CONFIG_SLOB=y</code>, ...</p></li>
  <li><p><strong>Compress kernel (and/or initramfs) with xz or lzma</strong> - The idea seems promising. I noticed the kernel build system for arm64 neither supports xz nor lzma out of the box (not sure why?), so I patched it myself to get it building. The build succeeds and the resulting <code>Image.xzkern-dtb</code> or <code>Image.lzma-dtb</code> seems okay, however when attempting to boot it (serial debugging logs):</p></li>
  </ul>
  
  <pre><code>[5710] partition_enable_wp: group 0 not defined
  [5720] DTB offset is incorrect, kernel image does not have appended DTB
  [5720] Device info 0x00000131/00010001/0x00010001/0, pmic 0x20009/0x455013/0x0/0x0
  [5740] ERROR: Appended Device Tree Blob not found
  [5740] panic (frame 0x83a86848):
  ...
  </code></pre>
  
  <p>I verified that the DTBs are present and the kernel is compressed as intended. My question here: Is it possible at all? Does the Android bootloader even support xz/lzma? I hardly found any info about that online. Is there any way to use xz or lzma compressed kernels to boot Android?</p>
  
  <ul>
  <li><p><strong>Resize the boot partition</strong> - It seems difficult but possible, not sure if worth attempting. Can you recommend any resources or tools for that?</p></li>
  <li><p><strong>Removing unnecessary features from initramfs</strong></p></li>
  <li><p><strong>Link-Time Optimization</strong> - I could not get it to work with the AOSP kernel, no matter what gcc version I use. Any tips?</p></li>
  <li><p><strong>Building features as modules instead of built-in</strong> - The build won't succeed with any config I try, even when building only single features as module (with different compiler or linker errors depending on the config). Do you have any guides or tips?</p></li>
  </ul>
  
  <p>I also followed the tutorial on building a Pixel kernel with KASAN and KCOV on the AOSP homepage (<a href="https://source.android.com/devices/tech/debug/kasan-kcov" rel="nofollow noreferrer">link</a>). I had some problems with it, but eventually (using Linaro GCC 5.5.0, with some config changes and without <code>CONFIG_DEBUG_INFO</code>) I could get it building and booting. Nice as a proof-of-concept but not what I need, since I had to skip some required features.</p>
  
  <p>I'm pretty much stuck and already spent some weeks on that problem. Are there any other options? I'd be happy to get it booting in any way. I'll happily provide any details and logs, but felt like it's already a very long post. Thank you a lot in advance!</p>