Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1241

The ELF Binary Format

ELF stands forExecutable and Linkable Format. It is the file format used for executable files, object files,

and libraries. It has long established itself as the standard format under Linux and has replaced the

a.out format of the early years. The particular benefit of ELF is that the same file format can be

used on practically all architectures supported by the kernel. This simplifies not only the creation

of userspace tools, but also programming of the kernel itself — for example, when it is necessary

to generate load routines for executable files. However, the fact that the fileformatis the same does

notmean that binary compatibility exists between the programs of different systems — between

FreeBSD and Linux, for instance, both of which use ELF as their binary format. Although bothorga-

nizethe data in their files in the same way, there are still differences in the system call mechanism

and in the semantics of the system calls. This is the reason why FreeBSD programs cannot run under

Linux without an intermediate emulation layer (the reverse is naturally also true). Understandably,

binary programs cannot be swapped between different architectures (for example, Linux binaries

compiled for Alpha CPUs cannot execute on Sparc Linux), because the underlying architectures

are totally different. However, thanks to ELF, the way in which information on programs and their

components is coded in the binary file is the same in all cases.

Linux employs ELF not only for userspace applications and libraries, but also to build modules. The

kernel itself is also generated in ELF.

ELF is an open format whose specification is freely available (also on the Web site associated with

this book). This appendix is structured in the same way as the specification and summarizes infor-

mation that is relevant.

E.1 Layout and Structure

As Figure E-1 shows, ELF files consist of various parts. Note that in this context, a distinction must

be made between link objects and executable files:

❑ In addition to a few bytes that identify the file as an ELF file, the ELF header holds infor-

mation on the file type and size or on the entry point at which program execution starts

when the file is loaded.