9 ELF Program Headers

Segments can be stored anywhere in an ELF file. In case of relocatable objects, both sections and segments are present in the file, and they most certainly overlap. The ELF file contains a table, called the program header table, whose entries describe each segment. This table is sized and linked from the ELF header via the e_phoff field. The program header table is available in the phdr field of Elf32_File and Elf64_File.

The Poke types denoting entries in the program header table are Elf32_Phdr and Elf64_Phdr for ELF32 and ELF64 respectively.

9.1 Overview

type Elf32_Phdr =
  struct
  {
    Elf_Word p_type;
    Elf32_Off p_offset;
    Elf32_Addr p_vaddr;
    Elf32_Addr p_paddr;
    offset<Elf_Word,B> p_filesz;
    offset<Elf_Word,B> p_memsz;
    Elf_Word p_flags;
    offset<Elf_Word,B> p_align;
  };

  type Elf64_Phdr =
  struct
  {
    Elf_Word p_type;
    Elf_Word p_flags;
    Elf64_Off p_offset;
    Elf64_Addr p_vaddr;
    Elf64_Addr p_paddr;
    offset<Elf64_Xword,B> p_filesz;
    offset<Elf64_Xword,B> p_memsz;
    offset<Elf64_Xword,B> p_align;
  };

9.2 Fields

p_type

Is a code identifying the type of the segment. This is one of the ELF_PT_* values.

The type of a segment determines what kind of contents a segment has. These are the types defined in the base spec:

ELF_PT_NULL

This entry in the program header table is unused, and is ignored by ELF readers.

ELF_PT_LOAD

The segment is loadable.

The stored file size is in p_filesz, and the loaded size is in p_memsz. These sizes can be different in certain situations; for example, when the loaded data has to fulfill different alignment constraints than the stored data. However, the stored size shall not be larger than the loaded size. This is checked by a constraint.

ELF_PT_DYNAMIC

The segment contains dynamic linking information in the form of a sequence of dynamic tags. This is an array of Elf64_Dyn or Elf32_Dyn.

ELF_PT_INTERP

The segment contains a null-terminated path name that the kernel uses to invoke as an interpreter.

This segment should not occur more than once in a file. If it is present, it must precede any loadable segment entry. There is a constraint in Elf32_File and Elf64_File that checks for this.

ELF_PT_NOTE

The segment contains notes. These are flexible annotations that are usually used in order to reflect certain “auxiliary” attributes of the ELF file. For example, the name and full version of the compiler that generated it. The format in which the notes are encoded is well defined, and supported by the elf pickles. See ELF Notes.

ELF_PT_SHLIB

This value for p_type is reserved by the ELF specification and has undefined semantics.

ELF_PT_PHDR

Segment contains the program header table itself, in both file and memory.

This segment type may not occur more than once in a file. If it is present, it must precede any loadable segment entry. There is a constraint in Elf32_File and Elf64_File that checks for this.

ELF_PT_TLS

The segment contains a thread local storage template.

p_flags

Is a bitmap where each enabled bit flags some particular property of the segment described by this entry. This is one of the ELF_PF_* values. These are the segment flags defined in the base spec:

ELF_PF_X

The segment is executable.

ELF_PF_W

The segment is writable.

ELF_PF_R

The segment is readable.

p_offset

This is the file offset of the start of the segment contents.

p_vaddr

This is the virtual address of the start of the loaded segment contents.

p_paddr

This is the physical address of the start of the loaded segment. Since sys-v ignores physical addressing for application programs (which use virtual memory) this field has unspecified contents in executables and shared objects.

p_filesz

Size of the segment in the file in bytes. This may be zero for some segments.

p_memsz

Loaded size of the segment in memory. This can be bigger than p_filesz. See above.

p_align

This is the alignment of the segment contents in both file and memory.

If this field is either 0 or 1, no alignment is applied. Otherwise it must contain a power of two, and p_vaddr == p_offset % p_align. This is checked by a constraint in Elf32_Phdr and Elf64_Phdr.