Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1245

Appendix E: The ELF Binary Format

alignment is provided for each section. A type is also specified to describe the section more precisely. The
sample program includes five different types with the following meanings:

❑ PHDRholds the program header table in memory.

❑ INTERPspecifies which interpreter must be called once the program has been mapped from the

executable file into memory. In this context, interpreter doesnotmean that the contents of the

binary file must be interpreted by a further program, as is the case with Java byte code and with

the Java Virtual Machine (JVM). It refers to a program that satisfies unresolved references by

linking additional libraries.

Normally,/lib/ld-linux.so.2,/lib/ld-linux-ia-64.so.2and so on, is used to insert the

required dynamic libraries in virtual address space. The C standard librarylibc.somust be

mapped for almost all programs, and various libraries are added to is, such as GTK, the mathe-

matical library, libjpeg, and many more.

❑ LOADdenotes a section that is mapped from the binary file into virtual address space. It holds

constant data (such as strings), the object code of the program, and so on.

❑ DYNAMICsections hold information used by the dynamic linker (i.e., by the interpreter specified

inINTERP).

❑ NOTEholds proprietary information, which is not relevant to the current topic.

The various segments in virtual address space are filled with the data of specific sections in the ELF file.
The second part of thereadelfoutput therefore specifies which sections are loaded into which segment
(Section to Segment Mapping).

These are not segments as used in IA32 processors to implement different isolated

ranges of virtual address space but are simply address space areas.

Other platforms adopt basically the same approach, but different sections are mapped into the individual
areas depending on the particular architecture, as the following IA-64 example shows:

wolfgang@meitner>readelf -l test_ia64

Elf file type is EXEC (Executable file)

Entry point 0x40000000000004e0

There are 7 program headers, starting at offset 64

Program Headers:

Type Offset VirtAddr PhysAddr

FileSiz MemSiz Flags Align

PHDR 0x0000000000000040 0x4000000000000040 0x4000000000000040

0x0000000000000188 0x0000000000000188 R E 8

INTERP 0x00000000000001c8 0x40000000000001c8 0x40000000000001c8

0x0000000000000018 0x0000000000000018 R 1

[Requesting program interpreter: /lib/ld-linux-ia64.so.2]

LOAD 0x0000000000000000 0x4000000000000000 0x4000000000000000

0x00000000000009f0 0x00000000000009f0 R E 10000

LOAD 0x00000000000009f0 0x60000000000009f0 0x60000000000009f0

0x0000000000000270 0x0000000000000280 RW 10000

DYNAMIC 0x00000000000009f8 0x60000000000009f8 0x60000000000009f8