Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton <jeremy.linton@arm.com>]

Hi,

Thanks for looking at this.

On 6/24/25 12:56 PM, Masahiro Yamada wrote:
> On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Hi,
>>
>> Thanks for looking at this.
>>
>> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
>>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>
>>>> Zboot compressed kernel images are used for arm kernels on various
>>>> distros.
>>>
>>> Are you talking about arm 32 bit here?
>>> (arch/arm/boot/zImage)
>>
>> No, it should be arm64.
>>
>>>
>>>> extract-vmlinux fails with those kernels because the wrapped image is
>>>> another PE. While this could be a bit confusing, the tools primary
>>>> purpose of unwrapping and decompressing the contained vmlinux image
>>>> makes it the obvious place for this functionality.
>>>>
>>>> Add a 'file' check in check_vmlinux() that detects a contained PE
>>>> image before trying readelf. Recent file implementations output
>>>> something like:
>>>>
>>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>>
>>> Are you talking about arm64 here?
>>>
>>> I am confused, as arm64 adopts a simple-compressed image.
>>
>> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
>> decompresses a contained kernel similar to x86, but is for !x86 EFI
>> architectures. This patch extends this utility to work for those images
>> as well.
> 
> The commit description does not explain why this is useful.
> 
> Extracing vmlinux ELF is useful for debugging purposes.

Right,

> 
> In this case, the extracted file is
> arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.

$ file vmlinux.bin
vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K 
pages
$ readpe -S vmlinux.bin
Sections
     Section
         Name:                            .text
         Virtual Size:                    0x2860000 (42336256 bytes)
         Virtual Address:                 0x10000
         Size Of Raw Data:                0x2860000 (42336256 bytes)
         Pointer To Raw Data:             0x10000
         Number Of Relocations:           0
         Characteristics:                 0x60000020
         Characteristic Names
                                              IMAGE_SCN_CNT_CODE
                                              IMAGE_SCN_MEM_EXECUTE
...(trimming remainder of output)

Its another complete PE boot image which can be used by UEFI/grub/etc as 
well as any PE debugging and analysis utilities.

So, this change effectively removes the zboot wrapper. The resulting 
image is still useful for a certain amount of debugging (ex string 
extraction, manually matching crash points, version checking, etc) in a 
distro based environment where the user doesn't have a kernel build tree 
handy. As well as any boot debugging, which could be caused by the ZBOOT 
wrapper itself, and I'm sure a long list of other things.


Thanks

>>>
>>> Apparently, this patch did not work for me.
>>>
>>> $ ./scripts/extract-vmlinux  arch/arm/boot/zImage
>>> extract-vmlinux: Cannot find vmlinux.
>>>
>>> The 'file' command says, it is "data".
>>> Is my 'file' command too old?
>>>
>>> $ file arch/arm/boot/Image
>>> arch/arm/boot/Image: data
>>>
>>>
>>>> Which is also a stronger statement than readelf provides so drop that
>>>> part of the comment. At the same time this means that kernel images
>>>> which don't appear to contain a compressed image will be returned
>>>> rather than reporting an error. Which matches the behavior for
>>>> existing ELF files.
>>>>
>>>> Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
>>>> Cc: Ard Biesheuvel <ardb@kernel.org>
>>>> ---
>>>>    scripts/extract-vmlinux | 9 +++++----
>>>>    1 file changed, 5 insertions(+), 4 deletions(-)
>>>>
>>>> diff --git a/scripts/extract-vmlinux b/scripts/extract-vmlinux
>>>> index 8995cd304e6e..edda1abe226c 100755
>>>> --- a/scripts/extract-vmlinux
>>>> +++ b/scripts/extract-vmlinux
>>>> @@ -12,10 +12,11 @@
>>>>
>>>>    check_vmlinux()
>>>>    {
>>>> -       # Use readelf to check if it's a valid ELF
>>>> -       # TODO: find a better to way to check that it's really vmlinux
>>>> -       #       and not just an elf
>>>> -       readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       file $1 |grep 'Linux kernel.*boot executable Image' > /dev/null
>>>> +       if [ "$?" -ne "0" ]; then
>>>> +               # Use readelf to check if it's a valid ELF, if 'file' fails
>>>> +               readelf -h $1 > /dev/null 2>&1 || return 1
>>>> +       fi
>>>>
>>>>           cat $1
>>>>           exit 0
>>>> --
>>>> 2.49.0
>>>>
>>>
>>>
>>
>>
> 
>