Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1251

Appendix E: The ELF Binary Format

Because the architecture-specific code must alwaysclearly define integer data types with their sign and

bit number, the data types required by the ELF standard can be implemented as direct typedefs with

little effort.

E.2.2 Headers

A separate data structure for 32-bit and 64-bit systemsis available for the various headers in ELF format:

ELF Header

On 32-bit architectures, the identification headeris represented by the following data structure:

<elf.h>

typedef struct elf32_hdr{

unsigned char e_ident[EI_NIDENT];

Elf32_Half e_type;

Elf32_Half e_machine;

Elf32_Word e_version;

Elf32_Addr e_entry; /* Entry point */

Elf32_Off e_phoff;

Elf32_Off e_shoff;

Elf32_Word e_flags;

Elf32_Half e_ehsize;

Elf32_Half e_phentsize;

Elf32_Half e_phnum;

Elf32_Half e_shentsize;

Elf32_Half e_shnum;

Elf32_Half e_shstrndx;

} Elf32_Ehdr;

The entries have the following meanings:

❑ e_identaccepts 16 (EI_NIDENT) bytes represented by thechardata type on all architectures. The

first four bytes hold a null byte and the letters E, L, and F, as discussed previously. A number of

other bit positions have specific meanings.

❑ EI_CLASS(4) identifies the class of the file to distinguish between 32-bit and 64-bit files.

Currently, defined values are thereforeELFCLASS32andELFCLASS64.^8

❑ EI_DATA(5) specifies which endian the format uses.ELFDATA2LSBstands forleast significant

byte(and therefore, little endian), andELFDATA2MSBstands formost significant byte(and

therefore, big endian).

❑ EI_VERSION(6) indicates the file version of the ELF header (this version is potentially inde-

pendent of the data section version). Currently, onlyEV_CURRENT— which corresponds to

the first version — is permitted.

❑ As ofEI_PAD(7), the identification part of the header is padded with null bytes because the

remaining positions are not needed (at the moment).

❑ e_typedistinguishes between the various ELF file types listed in Table E-1.

(^8) In this case, and many other cases, the ELF standard defines constants that stand for ‘‘undefined‘‘ or ‘‘invalid.’’ For the sake of sim-
plicity, they are not included in this description.