Vmlinux

On Linux systems, vmlinux is a statically linked executable file that contains the Linux kernel in one of the executable file formats supported by Linux, including ELF, COFF and a.out. The "vmlinux" file might be required for kernel debugging, generating symbol table or other operations, but must be made bootable before being used as an operating system kernel by adding a multiboot header, bootsector and setup routines.

Location

Traditionally, the kernel is located in the root directory of the filesystem hierarchy; however, as the bootloader must use BIOS drivers to access the hard disk, limitations on some i386 systems meant only the first 1024 cylinders of the hard disk were addressable.

To overcome this, Linux distributors encouraged users to create a partition at the beginning of their drives specifically for storing bootloader and kernel related files. GRUB, LILO and SYSLINUX are common bootloaders.

By convention, this partition is mounted on the filesystem hierarchy as /boot. This was later standardised by the Filesystem Hierarchy Standard, or "FHS", which now requires the Linux kernel image to be located in either / or /boot, although there is no technical restriction enforcing this. See [http://www.pathname.com/fhs/pub/fhs-2.3.html#BOOTSTATICFILESOFTHEBOOTLOADER section 3.5.2 of FHS 2.3]

Compression

Traditionally, when creating a bootable kernel image, the kernel is also compressed using the zlib algorithm, which requires a very small decompression stub to be included in the resulting image. The stub decompresses the kernel code, on some systems printing dots to the console to indicate progress, and then continues the boot process.

The decompression routine is a negligible factor in boot time, and prior to the development of the "bzImage", the size constraints of some architectures, notably i386, were extremely limiting, making compression a necessity.

On the SPARC architecture, the vmlinux file is compressed using simple gzip, because the SILO boot loader transparently decompresses gzipped images.

The filename of the bootable image is not important, but by convention it is called vmlinux or zImage.

bzImage

As the Linux kernel matured, the size of the kernels generated by users grew beyond the limits imposed by some architectures, where the space available to store the compressed kernel code is limited.

The "bzImage" ("big zImage") format was developed to overcome this limitation by cleverly splitting the kernel over discontiguous memory regions.

The "bzImage" format is still compressed using the zlib algorithm. Although there is the popular misconception that the "bz-" prefix means that bzip2 compression is used (the bzip2 package is often distributed with tools prefixed with bz-, such as bzless, bzcat, etc.), this is not the case.

The bzImage file is in a specific format: It contains concatenated bootsect.o + setup.o + misc.o + piggy.o.

piggy.o contains the gzipped vmlinux file in its data section (ELF) (see compressed/Makefile piggy.o). All source files mentioned are in arch/i386/boot/.

No specific tool exists to unpack the bzImage file, but there exists a script named [http://www.cs.caltech.edu/~weixl/research/fast-mon/scripts/extract-ikconfig extract-ikconfig] , which decompresses the image and extracts build configuration directives from the image. One may modify it to get the decompressed image directly. Some distributions (e.g. Red Hat and clones) may come with a kernel-debuginfo RPM that contains the vmlinux file for the matching kernel RPM, it typically gets installed under /usr/lib/debug/lib/modules/`uname -r`/vmlinux

See also [http://www.ussg.iu.edu/hypermail/linux/kernel/9909.3/0625.html this LKML post] and [http://www.cpqlinux.com/binary-kernel.html this article] .

Etymology

Traditionally, UNIX platforms called the kernel image /unix. With the development of virtual memory, kernels that supported this feature were given the vm- prefix to differentiate them. The name "vmlinux" is a mutation of vmunix, while in "vmlinuz" the letter z at the end denotes that it is compressed.

Executable format

This is the ELF header from an i386 2.6.7 executable kernel image.

$ readelf -h vmlinuxELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0xc019d000 Start of program headers: 52 (bytes into file) Start of section headers: 3135092 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 3 Size of section headers: 40 (bytes) Number of section headers: 33 Section header string table index: 30

See also

*Linux kernel
*Module (Linux)

External links

* [http://www.faqs.org/docs/Linux-HOWTO/Kernel-HOWTO.html#kernel_files_info Kernel HOWTO]
* [http://www.faqs.org/docs/kernel_2_4/lki-1.html Boot process]