Traditionally, UNIX platforms called the kernel image/unix. With the development of virtual memory, kernels that supported this feature were given the vm-prefix to differentiate them. The name vmlinux is a mutation of vmunix, while in vmlinuz the letter z at the end denotes that it is compressed.
Location
Traditionally, the kernel was located in the root directory of the filesystem hierarchy; however, as the bootloader must use BIOS drivers to access the hard disk, limitations on some i386 systems meant only the first 1024 cylinders of the hard disk were addressable. To overcome this, Linux distributors encouraged users to create a partitionat the beginning of their drives specifically for storing bootloader and kernel related files. GRUB, LILO and SYSLINUX are common bootloaders. By convention, this partition is mounted on the filesystem hierarchy as /boot. This was later standardised by the Filesystem Hierarchy Standard which now requires the Linux kernel image to be located in either / or /boot, although there is no technical restriction enforcing this.
Compression
Traditionally, when creating a bootable kernel image, the kernel is also compressed using gzip, or since Linux 2.6.30, using LZMA or bzip2, which requires a very small decompression stub to be included in the resulting image. The stub decompresses the kernel code, on some systems printing dots to the console to indicate progress, and then continues the boot process. Support for LZO, xz and LZ4 compression was added later. The decompression routine is a negligible factor in boot time, and prior to the development of the bzImage, the size constraints of some architectures, notably i386, were extremely limiting, making compression a necessity. On the SPARC architecture, the vmlinux file is compressed using simple gzip, because the SILOboot loader transparently decompresses gzipped images. The filename of the bootable image is not important, but many popular distributions use vmlinuz.
bzImage
As the Linux kernel matured, the size of the kernels generated by users grew beyond the limits imposed by some architectures, where the space available to store the compressed kernel code is limited. The bzImage format was developed to overcome this limitation by splitting the kernel over discontiguous memory regions. The bzImage was compressed using gzip until Linux 2.6.30 which [|introduced more algorithms]. Although there is the popular misconception that the bz prefix means that bzip2 compression is used, this is not the case. The bzImage file is in a specific format. It contains concatenated bootsect.o + setup.o + misc.o + piggy.o. piggy.o contains the gzipped vmlinux file in its data section . All source files mentioned are in arch/i386/boot/. The script found under scripts/ in the kernel sources decompresses a kernel image. Some distributions may come with a kernel-debuginfoRPM that contains the vmlinux file for the matching kernel RPM, and it typically gets installed under /usr/lib/debug/lib/modules/`uname -r`/vmlinux or /usr/lib/debug/lib64/modules/`uname -r`/vmlinux.
Object format
This is the ELF header from an x86-64 Gentoo 2.6.29 executable kernel image: $ readelf -h vmlinux ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x1000000 Start of program headers: 64 Start of section headers: 13951312 Flags: 0x0 Size of this header: 64 Size of program headers: 56 Number of program headers: 5 Size of section headers: 64 Number of section headers: 45 Section header string table index: 42
