[PATCH] scripts: add zboot support to extract-vmlinux

[PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Zboot compressed kernel images are used for arm kernels on various
distros.

extract-vmlinux fails with those kernels because the wrapped image is
another PE. While this could be a bit confusing, the tools primary
purpose of unwrapping and decompressing the contained vmlinux image
makes it the obvious place for this functionality.

Add a 'file' check in check_vmlinux() that detects a contained PE
image before trying readelf. Recent file implementations output
something like:

"Linux kernel ARM64 boot executable Image, little-endian, 4K pages"

Which is also a stronger statement than readelf provides so drop that
part of the comment. At the same time this means that kernel images
which don't appear to contain a compressed image will be returned
rather than reporting an error. Which matches the behavior for
existing ELF files.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
---
 scripts/extract-vmlinux | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
index 8995cd304e6e..edda1abe226c 100755
--- a/scripts/extract-vmlinux
+++ b/scripts/extract-vmlinux
@@ -12,10 +12,11 @@
 
 check_vmlinux()
 {
-	# Use readelf to check if it's a valid ELF
-	# TODO: find a better to way to check that it's really vmlinux
-	#       and not just an elf
-	readelf -h $1 > /dev/null 2>&1 || return 1
+	file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
+	if [ "$?" -ne "0" ]; then
+		# Use readelf to check if it's a valid ELF, if 'file' fails
+		readelf -h $1 > /dev/null 2>&1 || return 1
+	fi
 
 	cat $1
 	exit 0
-- 
2.49.0

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Nathan Chancellor]

Hi Jeremy,

On Thu, May 22, 2025 at 12:29:41PM -0500, Jeremy Linton wrote:
> Zboot compressed kernel images are used for arm kernels on various
> distros.
> 
> extract-vmlinux fails with those kernels because the wrapped image is
> another PE. While this could be a bit confusing, the tools primary
> purpose of unwrapping and decompressing the contained vmlinux image
> makes it the obvious place for this functionality.
> 
> Add a 'file' check in check_vmlinux() that detects a contained PE
> image before trying readelf. Recent file implementations output
> something like:
> 
> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
> 
> Which is also a stronger statement than readelf provides so drop that
> part of the comment. At the same time this means that kernel images
> which don't appear to contain a compressed image will be returned
> rather than reporting an error. Which matches the behavior for
> existing ELF files.
> 
> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
> Cc: Ard Biesheuvel <ardb@kernel.org>
> ---
>  scripts/extract-vmlinux | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
> index 8995cd304e6e..edda1abe226c 100755
> --- a/scripts/extract-vmlinux
> +++ b/scripts/extract-vmlinux
> @@ -12,10 +12,11 @@
>  
>  check_vmlinux()
>  {
> -	# Use readelf to check if it's a valid ELF
> -	# TODO: find a better to way to check that it's really vmlinux
> -	#       and not just an elf
> -	readelf -h $1 > /dev/null 2>&1 || return 1
> +	file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
> +	if [ "$?" -ne "0" ]; then

Could these two lines be simplified to:

  if file $1 | grep 'Linux kernel.*boot executable Image' > /dev/null; then

> +		# Use readelf to check if it's a valid ELF, if 'file' fails
> +		readelf -h $1 > /dev/null 2>&1 || return 1
> +	fi
>  
>  	cat $1
>  	exit 0
> -- 
> 2.49.0
> 

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Hi,

Thanks for looking at this.

On 5/22/25 6:10 PM, Nathan Chancellor wrote:
> Hi Jeremy,
> 
> On Thu, May 22, 2025 at 12:29:41PM -0500, Jeremy Linton wrote:
>> Zboot compressed kernel images are used for arm kernels on various
>> distros.
>>
>> extract-vmlinux fails with those kernels because the wrapped image is
>> another PE. While this could be a bit confusing, the tools primary
>> purpose of unwrapping and decompressing the contained vmlinux image
>> makes it the obvious place for this functionality.
>>
>> Add a 'file' check in check_vmlinux() that detects a contained PE
>> image before trying readelf. Recent file implementations output
>> something like:
>>
>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>
>> Which is also a stronger statement than readelf provides so drop that
>> part of the comment. At the same time this means that kernel images
>> which don't appear to contain a compressed image will be returned
>> rather than reporting an error. Which matches the behavior for
>> existing ELF files.
>>
>> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
>> Cc: Ard Biesheuvel <ardb@kernel.org>
>> ---
>>   scripts/extract-vmlinux | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
>> index 8995cd304e6e..edda1abe226c 100755
>> --- a/scripts/extract-vmlinux
>> +++ b/scripts/extract-vmlinux
>> @@ -12,10 +12,11 @@
>>   
>>   check_vmlinux()
>>   {
>> -	# Use readelf to check if it's a valid ELF
>> -	# TODO: find a better to way to check that it's really vmlinux
>> -	#       and not just an elf
>> -	readelf -h $1 > /dev/null 2>&1 || return 1
>> +	file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
>> +	if [ "$?" -ne "0" ]; then
> 
> Could these two lines be simplified to:
> 
>    if file $1 | grep 'Linux kernel.*boot executable Image' > /dev/null; then

Yes, but it needs, a '!', which applies to the last operator in the 
pipeline and for clarity should probably drop the redirection, so I 
think it ends up:

if ! file $1 | grep -q 'Linux kernel.*boot executable Image'; then

But it mixes the condition checking and the execution, which is common 
but maybe not the best idea.

Although, if I'm going to reroll this, i think the " Image" should be 
dropped since it can also have zImage and possibly other reports in the 
future and AFAIK there isn't any reason to exclude them.




> 
>> +		# Use readelf to check if it's a valid ELF, if 'file' fails
>> +		readelf -h $1 > /dev/null 2>&1 || return 1
>> +	fi
>>   
>>   	cat $1
>>   	exit 0
>> -- 
>> 2.49.0
>>

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Masahiro Yamada]

On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>
> Zboot compressed kernel images are used for arm kernels on various
> distros.

Are you talking about arm 32 bit here?
(arch/arm/boot/zImage)

> extract-vmlinux fails with those kernels because the wrapped image is
> another PE. While this could be a bit confusing, the tools primary
> purpose of unwrapping and decompressing the contained vmlinux image
> makes it the obvious place for this functionality.
>
> Add a 'file' check in check_vmlinux() that detects a contained PE
> image before trying readelf. Recent file implementations output
> something like:
>
> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"

Are you talking about arm64 here?

I am confused, as arm64 adopts a simple-compressed image.


Apparently, this patch did not work for me.

$ ./scripts/extract-vmlinux  arch/arm/boot/zImage
extract-vmlinux: Cannot find vmlinux.

The 'file' command says, it is "data".
Is my 'file' command too old?

$ file arch/arm/boot/Image
arch/arm/boot/Image: data


> Which is also a stronger statement than readelf provides so drop that
> part of the comment. At the same time this means that kernel images
> which don't appear to contain a compressed image will be returned
> rather than reporting an error. Which matches the behavior for
> existing ELF files.
>
> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
> Cc: Ard Biesheuvel <ardb@kernel.org>
> ---
>  scripts/extract-vmlinux | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
> index 8995cd304e6e..edda1abe226c 100755
> --- a/scripts/extract-vmlinux
> +++ b/scripts/extract-vmlinux
> @@ -12,10 +12,11 @@
>
>  check_vmlinux()
>  {
> -       # Use readelf to check if it's a valid ELF
> -       # TODO: find a better to way to check that it's really vmlinux
> -       #       and not just an elf
> -       readelf -h $1 > /dev/null 2>&1 || return 1
> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
> +       if [ "$?" -ne "0" ]; then
> +               # Use readelf to check if it's a valid ELF, if 'file' fails
> +               readelf -h $1 > /dev/null 2>&1 || return 1
> +       fi
>
>         cat $1
>         exit 0
> --
> 2.49.0
>


-- 
Best Regards
Masahiro Yamada

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Hi,

Thanks for looking at this.

On 6/7/25 11:04 AM, Masahiro Yamada wrote:
> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Zboot compressed kernel images are used for arm kernels on various
>> distros.
> 
> Are you talking about arm 32 bit here?
> (arch/arm/boot/zImage)

No, it should be arm64.

> 
>> extract-vmlinux fails with those kernels because the wrapped image is
>> another PE. While this could be a bit confusing, the tools primary
>> purpose of unwrapping and decompressing the contained vmlinux image
>> makes it the obvious place for this functionality.
>>
>> Add a 'file' check in check_vmlinux() that detects a contained PE
>> image before trying readelf. Recent file implementations output
>> something like:
>>
>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
> 
> Are you talking about arm64 here?
> 
> I am confused, as arm64 adopts a simple-compressed image.

No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self 
decompresses a contained kernel similar to x86, but is for !x86 EFI 
architectures. This patch extends this utility to work for those images 
as well.


> 
> 
> Apparently, this patch did not work for me.
> 
> $ ./scripts/extract-vmlinux  arch/arm/boot/zImage
> extract-vmlinux: Cannot find vmlinux.
> 
> The 'file' command says, it is "data".
> Is my 'file' command too old?
> 
> $ file arch/arm/boot/Image
> arch/arm/boot/Image: data
> 
> 
>> Which is also a stronger statement than readelf provides so drop that
>> part of the comment. At the same time this means that kernel images
>> which don't appear to contain a compressed image will be returned
>> rather than reporting an error. Which matches the behavior for
>> existing ELF files.
>>
>> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
>> Cc: Ard Biesheuvel <ardb@kernel.org>
>> ---
>>   scripts/extract-vmlinux | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
>> index 8995cd304e6e..edda1abe226c 100755
>> --- a/scripts/extract-vmlinux
>> +++ b/scripts/extract-vmlinux
>> @@ -12,10 +12,11 @@
>>
>>   check_vmlinux()
>>   {
>> -       # Use readelf to check if it's a valid ELF
>> -       # TODO: find a better to way to check that it's really vmlinux
>> -       #       and not just an elf
>> -       readelf -h $1 > /dev/null 2>&1 || return 1
>> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
>> +       if [ "$?" -ne "0" ]; then
>> +               # Use readelf to check if it's a valid ELF, if 'file' fails
>> +               readelf -h $1 > /dev/null 2>&1 || return 1
>> +       fi
>>
>>          cat $1
>>          exit 0
>> --
>> 2.49.0
>>
> 
> 

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Masahiro Yamada]

On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>
> Hi,
>
> Thanks for looking at this.
>
> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
> > On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
> >>
> >> Zboot compressed kernel images are used for arm kernels on various
> >> distros.
> >
> > Are you talking about arm 32 bit here?
> > (arch/arm/boot/zImage)
>
> No, it should be arm64.
>
> >
> >> extract-vmlinux fails with those kernels because the wrapped image is
> >> another PE. While this could be a bit confusing, the tools primary
> >> purpose of unwrapping and decompressing the contained vmlinux image
> >> makes it the obvious place for this functionality.
> >>
> >> Add a 'file' check in check_vmlinux() that detects a contained PE
> >> image before trying readelf. Recent file implementations output
> >> something like:
> >>
> >> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
> >
> > Are you talking about arm64 here?
> >
> > I am confused, as arm64 adopts a simple-compressed image.
>
> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
> decompresses a contained kernel similar to x86, but is for !x86 EFI
> architectures. This patch extends this utility to work for those images
> as well.

The commit description does not explain why this is useful.

Extracing vmlinux ELF is useful for debugging purposes.

In this case, the extracted file is
arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.




>
> >
> >
> > Apparently, this patch did not work for me.
> >
> > $ ./scripts/extract-vmlinux  arch/arm/boot/zImage
> > extract-vmlinux: Cannot find vmlinux.
> >
> > The 'file' command says, it is "data".
> > Is my 'file' command too old?
> >
> > $ file arch/arm/boot/Image
> > arch/arm/boot/Image: data
> >
> >
> >> Which is also a stronger statement than readelf provides so drop that
> >> part of the comment. At the same time this means that kernel images
> >> which don't appear to contain a compressed image will be returned
> >> rather than reporting an error. Which matches the behavior for
> >> existing ELF files.
> >>
> >> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
> >> Cc: Ard Biesheuvel <ardb@kernel.org>
> >> ---
> >>   scripts/extract-vmlinux | 9 +++++----
> >>   1 file changed, 5 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
> >> index 8995cd304e6e..edda1abe226c 100755
> >> --- a/scripts/extract-vmlinux
> >> +++ b/scripts/extract-vmlinux
> >> @@ -12,10 +12,11 @@
> >>
> >>   check_vmlinux()
> >>   {
> >> -       # Use readelf to check if it's a valid ELF
> >> -       # TODO: find a better to way to check that it's really vmlinux
> >> -       #       and not just an elf
> >> -       readelf -h $1 > /dev/null 2>&1 || return 1
> >> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
> >> +       if [ "$?" -ne "0" ]; then
> >> +               # Use readelf to check if it's a valid ELF, if 'file' fails
> >> +               readelf -h $1 > /dev/null 2>&1 || return 1
> >> +       fi
> >>
> >>          cat $1
> >>          exit 0
> >> --
> >> 2.49.0
> >>
> >
> >
>
>


-- 
Best Regards
Masahiro Yamada

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Hi,

Thanks for looking at this.

On 6/24/25 12:56 PM, Masahiro Yamada wrote:
> On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Hi,
>>
>> Thanks for looking at this.
>>
>> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
>>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>
>>>> Zboot compressed kernel images are used for arm kernels on various
>>>> distros.
>>>
>>> Are you talking about arm 32 bit here?
>>> (arch/arm/boot/zImage)
>>
>> No, it should be arm64.
>>
>>>
>>>> extract-vmlinux fails with those kernels because the wrapped image is
>>>> another PE. While this could be a bit confusing, the tools primary
>>>> purpose of unwrapping and decompressing the contained vmlinux image
>>>> makes it the obvious place for this functionality.
>>>>
>>>> Add a 'file' check in check_vmlinux() that detects a contained PE
>>>> image before trying readelf. Recent file implementations output
>>>> something like:
>>>>
>>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>>
>>> Are you talking about arm64 here?
>>>
>>> I am confused, as arm64 adopts a simple-compressed image.
>>
>> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
>> decompresses a contained kernel similar to x86, but is for !x86 EFI
>> architectures. This patch extends this utility to work for those images
>> as well.
> 
> The commit description does not explain why this is useful.
> 
> Extracing vmlinux ELF is useful for debugging purposes.

Right,

> 
> In this case, the extracted file is
> arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.

$ file vmlinux.bin
vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K 
pages
$ readpe -S vmlinux.bin
Sections
     Section
         Name:                            .text
         Virtual Size:                    0x2860000 (42336256 bytes)
         Virtual Address:                 0x10000
         Size Of Raw Data:                0x2860000 (42336256 bytes)
         Pointer To Raw Data:             0x10000
         Number Of Relocations:           0
         Characteristics:                 0x60000020
         Characteristic Names
                                              IMAGE_SCN_CNT_CODE
                                              IMAGE_SCN_MEM_EXECUTE
...(trimming remainder of output)

Its another complete PE boot image which can be used by UEFI/grub/etc as 
well as any PE debugging and analysis utilities.

So, this change effectively removes the zboot wrapper. The resulting 
image is still useful for a certain amount of debugging (ex string 
extraction, manually matching crash points, version checking, etc) in a 
distro based environment where the user doesn't have a kernel build tree 
handy. As well as any boot debugging, which could be caused by the ZBOOT 
wrapper itself, and I'm sure a long list of other things.


Thanks

>>>
>>> Apparently, this patch did not work for me.
>>>
>>> $ ./scripts/extract-vmlinux  arch/arm/boot/zImage
>>> extract-vmlinux: Cannot find vmlinux.
>>>
>>> The 'file' command says, it is "data".
>>> Is my 'file' command too old?
>>>
>>> $ file arch/arm/boot/Image
>>> arch/arm/boot/Image: data
>>>
>>>
>>>> Which is also a stronger statement than readelf provides so drop that
>>>> part of the comment. At the same time this means that kernel images
>>>> which don't appear to contain a compressed image will be returned
>>>> rather than reporting an error. Which matches the behavior for
>>>> existing ELF files.
>>>>
>>>> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
>>>> Cc: Ard Biesheuvel <ardb@kernel.org>
>>>> ---
>>>>    scripts/extract-vmlinux | 9 +++++----
>>>>    1 file changed, 5 insertions(+), 4 deletions(-)
>>>>
>>>> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
>>>> index 8995cd304e6e..edda1abe226c 100755
>>>> --- a/scripts/extract-vmlinux
>>>> +++ b/scripts/extract-vmlinux
>>>> @@ -12,10 +12,11 @@
>>>>
>>>>    check_vmlinux()
>>>>    {
>>>> -       # Use readelf to check if it's a valid ELF
>>>> -       # TODO: find a better to way to check that it's really vmlinux
>>>> -       #       and not just an elf
>>>> -       readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
>>>> +       if [ "$?" -ne "0" ]; then
>>>> +               # Use readelf to check if it's a valid ELF, if 'file' fails
>>>> +               readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       fi
>>>>
>>>>           cat $1
>>>>           exit 0
>>>> --
>>>> 2.49.0
>>>>
>>>
>>>
>>
>>
> 
> 

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Masahiro Yamada]

On Tue, Jul 8, 2025 at 6:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>
> Hi,
>
> Thanks for looking at this.
>
> On 6/24/25 12:56 PM, Masahiro Yamada wrote:
> > On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
> >>
> >> Hi,
> >>
> >> Thanks for looking at this.
> >>
> >> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
> >>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
> >>>>
> >>>> Zboot compressed kernel images are used for arm kernels on various
> >>>> distros.
> >>>
> >>> Are you talking about arm 32 bit here?
> >>> (arch/arm/boot/zImage)
> >>
> >> No, it should be arm64.
> >>
> >>>
> >>>> extract-vmlinux fails with those kernels because the wrapped image is
> >>>> another PE. While this could be a bit confusing, the tools primary
> >>>> purpose of unwrapping and decompressing the contained vmlinux image
> >>>> makes it the obvious place for this functionality.
> >>>>
> >>>> Add a 'file' check in check_vmlinux() that detects a contained PE
> >>>> image before trying readelf. Recent file implementations output
> >>>> something like:
> >>>>
> >>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
> >>>
> >>> Are you talking about arm64 here?
> >>>
> >>> I am confused, as arm64 adopts a simple-compressed image.
> >>
> >> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
> >> decompresses a contained kernel similar to x86, but is for !x86 EFI
> >> architectures. This patch extends this utility to work for those images
> >> as well.
> >
> > The commit description does not explain why this is useful.
> >
> > Extracing vmlinux ELF is useful for debugging purposes.
>
> Right,
>
> >
> > In this case, the extracted file is
> > arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.
>
> $ file vmlinux.bin
> vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K
> pages
> $ readpe -S vmlinux.bin
> Sections
>      Section
>          Name:                            .text
>          Virtual Size:                    0x2860000 (42336256 bytes)
>          Virtual Address:                 0x10000
>          Size Of Raw Data:                0x2860000 (42336256 bytes)
>          Pointer To Raw Data:             0x10000
>          Number Of Relocations:           0
>          Characteristics:                 0x60000020
>          Characteristic Names
>                                               IMAGE_SCN_CNT_CODE
>                                               IMAGE_SCN_MEM_EXECUTE
> ...(trimming remainder of output)
>
> Its another complete PE boot image which can be used by UEFI/grub/etc as
> well as any PE debugging and analysis utilities.
>
> So, this change effectively removes the zboot wrapper. The resulting
> image is still useful for a certain amount of debugging (ex string
> extraction, manually matching crash points, version checking, etc) in a
> distro based environment where the user doesn't have a kernel build tree
> handy. As well as any boot debugging, which could be caused by the ZBOOT
> wrapper itself, and I'm sure a long list of other things.

OK. Then, please add a little more context regarding
how this is useful in the commit description of v2.

Please fix the first line of the description:

used for arm kernels -> used for arm64 kernels


Lastly, how about this implementation?

check_vmlinux()
{
        if file $1 | grep -q 'Linux kernel.*boot executable Image' ||
                            readelf -h $1 > /dev/null 2>&1; then
                cat $1
                exit 0
        fi
}


I used the -q option for grep instead of the redirection.


Masahiro



-- 
Best Regards
Masahiro Yamada

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Hi,

On 7/7/25 6:35 PM, Masahiro Yamada wrote:
> On Tue, Jul 8, 2025 at 6:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Hi,
>>
>> Thanks for looking at this.
>>
>> On 6/24/25 12:56 PM, Masahiro Yamada wrote:
>>> On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for looking at this.
>>>>
>>>> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
>>>>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>>>
>>>>>> Zboot compressed kernel images are used for arm kernels on various
>>>>>> distros.
>>>>>
>>>>> Are you talking about arm 32 bit here?
>>>>> (arch/arm/boot/zImage)
>>>>
>>>> No, it should be arm64.
>>>>
>>>>>
>>>>>> extract-vmlinux fails with those kernels because the wrapped image is
>>>>>> another PE. While this could be a bit confusing, the tools primary
>>>>>> purpose of unwrapping and decompressing the contained vmlinux image
>>>>>> makes it the obvious place for this functionality.
>>>>>>
>>>>>> Add a 'file' check in check_vmlinux() that detects a contained PE
>>>>>> image before trying readelf. Recent file implementations output
>>>>>> something like:
>>>>>>
>>>>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>>>>
>>>>> Are you talking about arm64 here?
>>>>>
>>>>> I am confused, as arm64 adopts a simple-compressed image.
>>>>
>>>> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
>>>> decompresses a contained kernel similar to x86, but is for !x86 EFI
>>>> architectures. This patch extends this utility to work for those images
>>>> as well.
>>>
>>> The commit description does not explain why this is useful.
>>>
>>> Extracing vmlinux ELF is useful for debugging purposes.
>>
>> Right,
>>
>>>
>>> In this case, the extracted file is
>>> arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.
>>
>> $ file vmlinux.bin
>> vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K
>> pages
>> $ readpe -S vmlinux.bin
>> Sections
>>       Section
>>           Name:                            .text
>>           Virtual Size:                    0x2860000 (42336256 bytes)
>>           Virtual Address:                 0x10000
>>           Size Of Raw Data:                0x2860000 (42336256 bytes)
>>           Pointer To Raw Data:             0x10000
>>           Number Of Relocations:           0
>>           Characteristics:                 0x60000020
>>           Characteristic Names
>>                                                IMAGE_SCN_CNT_CODE
>>                                                IMAGE_SCN_MEM_EXECUTE
>> ...(trimming remainder of output)
>>
>> Its another complete PE boot image which can be used by UEFI/grub/etc as
>> well as any PE debugging and analysis utilities.
>>
>> So, this change effectively removes the zboot wrapper. The resulting
>> image is still useful for a certain amount of debugging (ex string
>> extraction, manually matching crash points, version checking, etc) in a
>> distro based environment where the user doesn't have a kernel build tree
>> handy. As well as any boot debugging, which could be caused by the ZBOOT
>> wrapper itself, and I'm sure a long list of other things.
> 
> OK. Then, please add a little more context regarding
> how this is useful in the commit description of v2.

Sure,

> 
> Please fix the first line of the description:
> 
> used for arm kernels -> used for arm64 kernels
Right,

> 
> 
> Lastly, how about this implementation?
> 
> check_vmlinux()
> {
>          if file $1 | grep -q 'Linux kernel.*boot executable Image' ||
>                              readelf -h $1 > /dev/null 2>&1; then
>                  cat $1
>                  exit 0
>          fi
> }

That works too.

> 
> 
> I used the -q option for grep instead of the redirection.
> 
> 
> Masahiro

Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton]

Hi,

Thanks for looking at this.

On 6/24/25 12:56 PM, Masahiro Yamada wrote:
> On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Hi,
>>
>> Thanks for looking at this.
>>
>> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
>>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>
>>>> Zboot compressed kernel images are used for arm kernels on various
>>>> distros.
>>>
>>> Are you talking about arm 32 bit here?
>>> (arch/arm/boot/zImage)
>>
>> No, it should be arm64.
>>
>>>
>>>> extract-vmlinux fails with those kernels because the wrapped image is
>>>> another PE. While this could be a bit confusing, the tools primary
>>>> purpose of unwrapping and decompressing the contained vmlinux image
>>>> makes it the obvious place for this functionality.
>>>>
>>>> Add a 'file' check in check_vmlinux() that detects a contained PE
>>>> image before trying readelf. Recent file implementations output
>>>> something like:
>>>>
>>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>>
>>> Are you talking about arm64 here?
>>>
>>> I am confused, as arm64 adopts a simple-compressed image.
>>
>> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
>> decompresses a contained kernel similar to x86, but is for !x86 EFI
>> architectures. This patch extends this utility to work for those images
>> as well.
> 
> The commit description does not explain why this is useful.
> 
> Extracing vmlinux ELF is useful for debugging purposes.

Right,

> 
> In this case, the extracted file is
> arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.

$ file vmlinux.bin
vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K 
pages
$ readpe -S vmlinux.bin
Sections
     Section
         Name:                            .text
         Virtual Size:                    0x2860000 (42336256 bytes)
         Virtual Address:                 0x10000
         Size Of Raw Data:                0x2860000 (42336256 bytes)
         Pointer To Raw Data:             0x10000
         Number Of Relocations:           0
         Characteristics:                 0x60000020
         Characteristic Names
                                              IMAGE_SCN_CNT_CODE
                                              IMAGE_SCN_MEM_EXECUTE
...(trimming remainder of output)

Its another complete PE boot image which can be used by UEFI/grub/etc as 
well as any PE debugging and analysis utilities.

So, this change effectively removes the zboot wrapper. The resulting 
image is still useful for a certain amount of debugging (ex string 
extraction, manually matching crash points, version checking, etc) in a 
distro based environment where the user doesn't have a kernel build tree 
handy. As well as any boot debugging, which could be caused by the ZBOOT 
wrapper itself, and I'm sure a long list of other things.


Thanks

>>>
>>> Apparently, this patch did not work for me.
>>>
>>> $ ./scripts/extract-vmlinux  arch/arm/boot/zImage
>>> extract-vmlinux: Cannot find vmlinux.
>>>
>>> The 'file' command says, it is "data".
>>> Is my 'file' command too old?
>>>
>>> $ file arch/arm/boot/Image
>>> arch/arm/boot/Image: data
>>>
>>>
>>>> Which is also a stronger statement than readelf provides so drop that
>>>> part of the comment. At the same time this means that kernel images
>>>> which don't appear to contain a compressed image will be returned
>>>> rather than reporting an error. Which matches the behavior for
>>>> existing ELF files.
>>>>
>>>> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
>>>> Cc: Ard Biesheuvel <ardb@kernel.org>
>>>> ---
>>>>    scripts/extract-vmlinux | 9 +++++----
>>>>    1 file changed, 5 insertions(+), 4 deletions(-)
>>>>
>>>> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
>>>> index 8995cd304e6e..edda1abe226c 100755
>>>> --- a/scripts/extract-vmlinux
>>>> +++ b/scripts/extract-vmlinux
>>>> @@ -12,10 +12,11 @@
>>>>
>>>>    check_vmlinux()
>>>>    {
>>>> -       # Use readelf to check if it's a valid ELF
>>>> -       # TODO: find a better to way to check that it's really vmlinux
>>>> -       #       and not just an elf
>>>> -       readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
>>>> +       if [ "$?" -ne "0" ]; then
>>>> +               # Use readelf to check if it's a valid ELF, if 'file' fails
>>>> +               readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       fi
>>>>
>>>>           cat $1
>>>>           exit 0
>>>> --
>>>> 2.49.0
>>>>
>>>
>>>
>>
>>
> 
>