6

I have to find out the type of compression of the linux kernel of my arch linux system, but I can't find a way to get it more than the theory: now bzip2 (bz), formerly gzip (z).

In my computer I run the command:

$ file /boot/vmlinuz-linux
/boot/vmlinuz-linux: Linux kernel x86 boot executable bzImage, version 5.3.11-arch1-1 (linux@archlinux) #1 SMP PREEMPT Tue, 12 Nov 2019 22:19:48 +0000, RO-rootFS, swap_dev 0x5, Normal VGA

Looking at the theory, I see that bzImage must be compressed by gzip (z), but I can't prove it:

The bzImage was compressed using gzip until Linux 2.6.30 which introduced more algorithms. Although there is the popular misconception that the bz prefix means that bzip2 compression is used (the bzip2 package is often distributed with tools prefixed with bz, such as bzless, bzcat, etc.), this is not the case.

Is there any way to prove it on my own machine? or is the theory itself, in this case, "empirical"?

4

Your Wikipedia quote,

Although there is the popular misconception that the bz prefix means that bzip2 compression is used [...], this is not the case.

says the opposite of your theory: the bz in bzImage has no relation to bzip2, and bzImage doesn’t have to be compressed with bzip2. In fact, the kernel’s default compression mode is still gzip, and there is little reason to use bzip2 nowadays — it is slower than LZMA and xz but doesn’t compress as well.

To conclusively determine what compression was used for a given kernel image, without needing to run it or find its configuration, you can follow the approach used by the kernel’s own extract-vmlinux script:

  • look for the compressor’s signature in the image:

    • gunzip: \037\213\010
    • xz: \3757zXZ\000
    • bzip2: BZh
    • lzma: \135\0\0\0
    • lzo: \211\114\132
    • lz4: \002!L\030
    • zstd: (\265/\375
  • try to extract the data from the image, starting at the offset of any signature you’ve found;

  • check that the result (if any) is an ELF image.

I’ve adapted the script here so that it only reports the compression type. I’m not including it here because it is licensed under the GPL 2 only.

5

You can look at what compression methods your kernel supports. Only one can be selected, so that'll prove which one it is.

Here, I'm using gzip:

$ zgrep CONFIG_KERNEL_ /proc/config.gz
CONFIG_KERNEL_GZIP=y
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set
  • In my case I have received an exit like this: # CONFIG_KERNEL_GZIP is not set # CONFIG_KERNEL_BZIP2 is not set # CONFIG_KERNEL_LZMA is not set CONFIG_KERNEL_XZ=y # CONFIG_KERNEL_LZO is not set # CONFIG_KERNEL_LZ4 is not set – balon Nov 20 at 15:46
  • The only yes is CONFIG_KERNEL_XZ, is this normal? – balon Nov 20 at 15:48
  • The kernel compression mode is a Kconfig choice, so there’s only ever one which is enabled. CONFIG_KERNEL_XZ indicates that the kernel is compressed with xz; that’s fine. – Stephen Kitt Nov 20 at 16:28
  • 2
    If XZ is selected, then XZ is what you have. What is "normal" is relative. – Andy Dalton Nov 20 at 20:23
  • 1
    I think the misunderstanding here comes from “the theory” — if your theory is that bzImage should be compressed using bzip2, the quote you give explicitly states that that is not the case. The default is gzip, but any other compression mode supported by the kernel is valid. The reason there are different modes available is that each one is a compromise; see their descriptions in the kernel source for details. – Stephen Kitt Nov 21 at 8:46
0

VMlinuz has been compressed in gzip as you can see in the following links:

http://www.linfo.org/vmlinuz.html

https://www.ibm.com/developerworks/community/blogs/mhhaque/entry/anatomy_of_the_initrd_and_vmlinuz?lang=en

https://en.wikipedia.org/wiki/Vmlinux

Ironically, the webpage says that a lot of people confuses the extension with bzip2 as you can see bellow:

A compiled kernel named zImage file is created on some older systems and is retained on newer ones for backward compatibility. Both zImage and bzImage are compressed with gzip. The difference is that zImage decompresses into low memory (i.e., the first 640kB), and bzImage decompresses into high memory (more than 1MB). There is a common misconception that bzImage is compressed with the bzip2 utility; actually, the b just stands for big.

I hope that you will find the information helpful.

  • 1
    My fault @LinuxSecurityFreak, I was not concerned of that point, my apologizes; in regad to the source, there were a lot and I have choosen due to it seemed the "official", but anyway there are a lot of more sources with that info such as ibm or wikipedia; one more time, my apologizes – Dasel Nov 20 at 16:13
  • No apology needed, we're friends here, not only collaborators... I did not mean to sound hostile. – LinuxSecurityFreak Nov 20 at 16:14
  • The Wikipedia page you link to explicitly mentions other compression formats; it’s not just gzip (although that is the default). – Stephen Kitt Nov 20 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.