Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ELF Output

Whistler produces standard ELF64 little-endian relocatable object files (ET_REL) with e_machine = EM_BPF (247). These are compatible with libbpf, bpftool, and the Whistler loader.

Section layout

A typical Whistler-generated .bpf.o contains these sections:

SectionTypeDescription
Program sectionsSHT_PROGBITSBPF bytecode (one per defprog)
.mapsSHT_PROGBITSMap definitions (32 bytes each)
licenseSHT_PROGBITSLicense string (null-terminated)
.BTFSHT_PROGBITSBTF type information (if present)
.BTF.extSHT_PROGBITSBTF ext info (if present)
.strtabSHT_STRTABString table for symbols
.symtabSHT_SYMTABSymbol table
.rel<section>SHT_RELRelocations (one per program)
.shstrtabSHT_STRTABSection header string table

Program sections

Each defprog produces a section named after its :section option (e.g., xdp, kprobe/__x64_sys_execve, tracepoint/sched/sched_process_fork). The section contains raw BPF instructions (8 bytes each), marked SHF_ALLOC | SHF_EXECINSTR.

For multi-program ELF files (e.g., tail call dispatch), each program gets its own section and a STT_FUNC symbol.

Maps section

The .maps section contains 32-byte entries:

OffsetSizeField
04map_type
44key_size
84value_size
124max_entries
164map_flags
2012reserved

Each map has a corresponding STT_OBJECT global symbol in .symtab.

Relocations

Map references in BPF instructions use R_BPF_64_64 relocations. Each relocation entry is 16 bytes (SHT_REL, not RELA):

r_offset (8 bytes) -- byte offset of the ld_imm64 instruction
r_info   (8 bytes) -- ELF64_R_INFO(symbol_index, R_BPF_64_64)

The loader resolves these by patching the ld_imm64 instruction's src_reg to BPF_PSEUDO_MAP_FD and setting the immediate to the map FD.

Symbol table

The symbol table contains:

  1. Null symbol (index 0)
  2. Section symbols (STT_SECTION, STB_LOCAL) -- one per program section
  3. Map symbols (STT_OBJECT, STB_GLOBAL) -- one per map, pointing into .maps
  4. Function symbols (STT_FUNC, STB_GLOBAL) -- one per program, named after the defprog name (underscored)