Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1259

Appendix E: The ELF Binary Format

❑ SHN_ABSspecifies that the symbol has an absolute value that will not change because of

relocation.

❑ SHN_UNDEFidentifies undefined symbols that must be resolved by external sources (such as

other object files or libraries).

As expected, there is a 64-bit variant of the symbol table that — with the exception of the data types

used — has the same contents as its 32-bit counterpart, as you can see here:

<elf.h>

typedef struct elf64_sym {

Elf64_Word st_name; /* Symbol name, index in string tbl */

unsigned char st_info; /* Type and binding attributes */

unsigned char st_other; /* No defined meaning, 0 */

Elf64_Half st_shndx; /* Associated section index */

Elf64_Addr st_value; /* Value of the symbol */

Elf64_Xword st_size; /* Associated symbol size */

} Elf64_Sym;

readelfcan also be used to find all symbols in the symbol table of a program. The following five entries

are especially important for thetest.oobject file (the other elements are generated automatically by the

compiler and are not relevant to this discussion):

wolfgang@meitner>readelf -s test.o

Num: Value Size Type Bind Vis Ndx Name

...

1: 00000000 0 FILE LOCAL DEFAULT ABS test.c

...

7: 00000000 26 FUNC GLOBAL DEFAULT 1 add

8: 00000000 0 NOTYPE GLOBAL DEFAULT UND printf

9: 0000001a 75 FUNC GLOBAL DEFAULT 1 main

10: 00000000 0 NOTYPE GLOBAL DEFAULT UND exit

Thenameofthesourcefileisstoredasanabsolutevalue — it is constant and is not changed by reloca-

tions. The local symbol uses theSTT_FILEtype to link an object file with the name of its source file.

The two functions defined in the file —mainandadd— are stored as global symbols of theSTT_FUNC

type. Both symbols refer to segment 1, which is the file text segment that holds the machine code of the

two functions.

Theprintfandexitsymbols are undefined references with indexUND. Therefore, they must be associ-

ated with functions in the standard library (or in some other library that defines symbols with this name)

when the program is linked. Because the compiler does not know which type of symbol is involved, the

symbol type isSTT_NOTYPE.

E.2.5 Relocation Entries

Relocationis the process by which undefined symbols in ELF files are associated with valid values. In the

standard example (test.o), this means that undefined references toprintfandaddmust be replaced

with the addresses at which the appropriate machine code is located in the virtual address space of the

process. Replacement must be performed at all points in the object file where one of the symbols is used.