Re: [PATCH] scripts: add zboot support to extract-vmlinux

[Jeremy Linton <jeremy.linton@arm.com>]

Hi,

On 7/7/25 6:35 PM, Masahiro Yamada wrote:
> On Tue, Jul 8, 2025 at 6:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>
>> Hi,
>>
>> Thanks for looking at this.
>>
>> On 6/24/25 12:56 PM, Masahiro Yamada wrote:
>>> On Tue, Jun 17, 2025 at 1:09 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for looking at this.
>>>>
>>>> On 6/7/25 11:04 AM, Masahiro Yamada wrote:
>>>>> On Fri, May 23, 2025 at 2:29 AM Jeremy Linton <jeremy.linton@arm.com> wrote:
>>>>>>
>>>>>> Zboot compressed kernel images are used for arm kernels on various
>>>>>> distros.
>>>>>
>>>>> Are you talking about arm 32 bit here?
>>>>> (arch/arm/boot/zImage)
>>>>
>>>> No, it should be arm64.
>>>>
>>>>>
>>>>>> extract-vmlinux fails with those kernels because the wrapped image is
>>>>>> another PE. While this could be a bit confusing, the tools primary
>>>>>> purpose of unwrapping and decompressing the contained vmlinux image
>>>>>> makes it the obvious place for this functionality.
>>>>>>
>>>>>> Add a 'file' check in check_vmlinux() that detects a contained PE
>>>>>> image before trying readelf. Recent file implementations output
>>>>>> something like:
>>>>>>
>>>>>> "Linux kernel ARM64 boot executable Image, little-endian, 4K pages"
>>>>>
>>>>> Are you talking about arm64 here?
>>>>>
>>>>> I am confused, as arm64 adopts a simple-compressed image.
>>>>
>>>> No, there is a CONFIG_EFI_ZBOOT, which is a EFI/PE image which self
>>>> decompresses a contained kernel similar to x86, but is for !x86 EFI
>>>> architectures. This patch extends this utility to work for those images
>>>> as well.
>>>
>>> The commit description does not explain why this is useful.
>>>
>>> Extracing vmlinux ELF is useful for debugging purposes.
>>
>> Right,
>>
>>>
>>> In this case, the extracted file is
>>> arch/arm64/boot/vmlinux.bin, which is just a (zero-padded) binary.
>>
>> $ file vmlinux.bin
>> vmlinux.bin: Linux kernel ARM64 boot executable Image, little-endian, 4K
>> pages
>> $ readpe -S vmlinux.bin
>> Sections
>>       Section
>>           Name:                            .text
>>           Virtual Size:                    0x2860000 (42336256 bytes)
>>           Virtual Address:                 0x10000
>>           Size Of Raw Data:                0x2860000 (42336256 bytes)
>>           Pointer To Raw Data:             0x10000
>>           Number Of Relocations:           0
>>           Characteristics:                 0x60000020
>>           Characteristic Names
>>                                                IMAGE_SCN_CNT_CODE
>>                                                IMAGE_SCN_MEM_EXECUTE
>> ...(trimming remainder of output)
>>
>> Its another complete PE boot image which can be used by UEFI/grub/etc as
>> well as any PE debugging and analysis utilities.
>>
>> So, this change effectively removes the zboot wrapper. The resulting
>> image is still useful for a certain amount of debugging (ex string
>> extraction, manually matching crash points, version checking, etc) in a
>> distro based environment where the user doesn't have a kernel build tree
>> handy. As well as any boot debugging, which could be caused by the ZBOOT
>> wrapper itself, and I'm sure a long list of other things.
> 
> OK. Then, please add a little more context regarding
> how this is useful in the commit description of v2.

Sure,

> 
> Please fix the first line of the description:
> 
> used for arm kernels -> used for arm64 kernels
Right,

> 
> 
> Lastly, how about this implementation?
> 
> check_vmlinux()
> {
>          if file $1 | grep -q 'Linux kernel.*boot executable Image' ||
>                              readelf -h $1 > /dev/null 2>&1; then
>                  cat $1
>                  exit 0
>          fi
> }

That works too.

> 
> 
> I used the -q option for grep instead of the redirection.
> 
> 
> Masahiro