How do I demonstrate the type of kernel compression in practice?

Question

I have to find out the type of compression of the linux kernel of my arch linux system, but I can't find a way to get it more than the theory: now bzip2 (bz), formerly gzip (z).

In my computer I run the command:

$ file /boot/vmlinuz-linux
/boot/vmlinuz-linux: Linux kernel x86 boot executable bzImage, version 5.3.11-arch1-1 (linux@archlinux) #1 SMP PREEMPT Tue, 12 Nov 2019 22:19:48 +0000, RO-rootFS, swap_dev 0x5, Normal VGA

Looking at the theory, I see that bzImage must be compressed by gzip (z), but I can't prove it:

The bzImage was compressed using gzip until Linux 2.6.30 which introduced more algorithms. Although there is the popular misconception that the bz prefix means that bzip2 compression is used (the bzip2 package is often distributed with tools prefixed with bz, such as bzless, bzcat, etc.), this is not the case.

Is there any way to prove it on my own machine? or is the theory itself, in this case, "empirical"?

Answer 1

Your Wikipedia quote,

Although there is the popular misconception that the bz prefix means that bzip2 compression is used [...], this is not the case.

says the opposite of your theory: the bz in bzImage has no relation to bzip2, and bzImage doesn’t have to be compressed with bzip2. In fact, the kernel’s default compression mode is still gzip, and there is little reason to use bzip2 nowadays — it is slower than LZMA and xz but doesn’t compress as well.

To conclusively determine what compression was used for a given kernel image, without needing to run it or find its configuration, you can follow the approach used by the kernel’s own extract-vmlinux script:

• look for the compressor’s signature in the image:

  • gunzip: \037\213\010
  • xz: \3757zXZ\000
  • bzip2: BZh
  • lzma: \135\0\0\0
  • lzo: \211\114\132
  • lz4: \002!L\030
  • zstd: (\265/\375

• try to extract the data from the image, starting at the offset of any signature you’ve found;

• check that the result (if any) is an ELF image.

I’ve adapted the script here so that it only reports the compression type. I’m not including it here because it is licensed under the GPL 2 only.

Answer 2

You can look at what compression methods your kernel supports. Only one can be selected, so that'll prove which one it is.

Here, I'm using gzip:

$ zgrep CONFIG_KERNEL_ /proc/config.gz
CONFIG_KERNEL_GZIP=y
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set

Answer 3

VMlinuz has been compressed in gzip as you can see in the following links:

http://www.linfo.org/vmlinuz.html

https://www.ibm.com/developerworks/community/blogs/mhhaque/entry/anatomy_of_the_initrd_and_vmlinuz?lang=en

https://en.wikipedia.org/wiki/Vmlinux

Ironically, the webpage says that a lot of people confuses the extension with bzip2 as you can see bellow:

A compiled kernel named zImage file is created on some older systems and is retained on newer ones for backward compatibility. Both zImage and bzImage are compressed with gzip. The difference is that zImage decompresses into low memory (i.e., the first 640kB), and bzImage decompresses into high memory (more than 1MB). There is a common misconception that bzImage is compressed with the bzip2 utility; actually, the b just stands for big.

I hope that you will find the information helpful.