Program Header Table
Why This Matters
The kernel doesn't load an ELF file byte-by-byte. It reads the program header table to find which parts of the file map to which memory regions. Without program headers, the loader wouldn't know what to load or where to put it.
A Simple Model
Think of program headers as a list of "load this chunk here" instructions. Each program header entry describes one segment — a contiguous region of the file that gets mapped into memory.
- LOAD segments — actual code and data to map
- DYNAMIC segment — dynamic linker info
- INTERP segment — path to the dynamic linker
- NOTE segment — auxiliary notes (build ID, etc.)
The Actual Detail
Each 64-bit program header entry is 56 bytes:
| Field | Size | Description |
|---|---|---|
| p_type | 4 | Segment type (PT_LOAD=1, PT_DYNAMIC=2, PT_INTERP=3, ...) |
| p_flags | 4 | Permissions: PF_X=1, PF_W=2, PF_R=4 |
| p_offset | 8 | File offset where segment starts |
| p_vaddr | 8 | Virtual address to map to |
| p_paddr | 8 | Physical address (usually same as p_vaddr) |
| p_filesz | 8 | Size of segment in the file |
| p_memsz | 8 | Size of segment in memory (may be larger for .bss) |
| p_align | 8 | Alignment requirement |
A Real Example
Program Headers: Type Offset VirtAddr FileSiz MemSiz Flg Align PHDR 0x000040 0x0000000000000040 0x000278 0x000278 R 0x8 INTERP 0x0002b8 0x00000000000002b8 0x00001c 0x00001c R 0x1 LOAD 0x000000 0x0000000000000000 0x0005e8 0x0005e8 R 0x1000 LOAD 0x001000 0x0000000000001000 0x001a52 0x001a52 R E 0x1000 LOAD 0x003000 0x0000000000003000 0x000ba0 0x000ba0 R 0x1000 LOAD 0x003dc0 0x0000000000004dc0 0x000260 0x000260 RW 0x1000 DYNAMIC 0x003e28 0x0000000000004e28 0x0001f0 0x0001f0 RW 0x8 NOTE 0x0002d8 0x00000000000002d8 0x000030 0x000030 R 0x8
The first LOAD segment is read-only (code and read-only data). The second LOAD is executable (the .text section). The last LOAD is read-write (data and BSS).
Check Your Understanding
What does a PT_LOAD segment with p_memsz > p_filesz indicate?
Apply It
If p_vaddr is 0x4000 and p_offset is 0x0, what's the file offset of the first byte in the segment?
Connect
Program headers define segments. But segments and sections are different things — segments are for the loader, sections are for tools. The next concepts explore this distinction.