# NuttX Binary Loader Last Updated: August 22, 2014

# Table of Contents

1.0 Introduction
2.0 Binary Loader Interface

2.1 Binary Loader Header Files
2.2 Binary Loader Data Structures
2.3 Binary Loader Function Interfaces

3.0 Symbol Tables

3.1 Symbol Table Header Files
3.2 Symbol Table Data Structures
3.3 Symbol Table Function Interfaces

4.0 Configuration Variables

# 1.0 Introduction

Binary Loaders. The purpose of a binary loader is to load and execute modules in various binary formats that reside in a file system. Loading refers instantiating the binary module in some fashion, usually copy all or some of the binary module into memory and then linking the module with other components. In most architectures, it is the base FLASH code that is the primary component that the binary module must link with because that is where the RTOS and primary tasks reside. Program modules can then be executed after they have been loaded.

Binary Formats. The binary loader provides generic support for different binary formats. It supports a registration interface that allows the number of support binary formats to be loaded at run time. Each binary format provides a common, interface for use by the binary loader. When asked to load a binary, the binary loader will query each registered binary format, providing it with the path of the binary object to be loaded. The binary loader will stop when first binary format the recognizes the binary object and successfully loads it or when all registered binary formats have attempt loading the binary object and failed.

At present, the following binary formats are support by NuttX:

- ELF. Standard ELF formatted files.
- NXFLAT. NuttX NXFLAT formatted files. More information about the NXFLAT binary format can be found in the NXFLAT documentation.

Executables and Libraries The generic binary loader logic does not care what it is that it being loaded. It could load an executable program or a library. There are no strict rules, but a library will tend to export symbols and a program will tend to import symbols: The program will use the symbols exported by the library. However, at this point in time, none of the supported binary formats support exporting of symbols.

binfmt. In the NuttX source code, the short name `binfmt` is used to refer to the NuttX binary loader. This is the name of the directory containing the binary loader and the name of the header files and variables used by the binary loader.

The name `binfmt` is the same name used by the Linux binary loader. However, the NuttX binary loader is an independent development and shares nothing with the Linux binary loader other the same name and the same basic functionality.

# 2.0 Binary Loader Interface

## 2.1 Binary Loader Header Files

The interface to the binary loader is described in the header file `include/nuttx/binfmt/binfmt.h`. A brief summary of the data structurs and interfaces prototyped in that header file are listed below.

## 2.2 Binary Loader Data Structures

When a binary format registers with the binary loader, it provides a pointer to a write-able instance of the following data structure:

    struct binfmt_s
    {
      FAR struct binfmt_s *next;             /* Supports a singly-linked list */
      int (*load)(FAR struct binary_s *bin); /* Verify and load binary into memory */
    };

The `load` method is used to load the binary format into memory. It returns either `OK` (0) meaning that the binary object was loaded successfully, or a negated `errno` indicating why the object was not loaded.

The type `struct binary_s` is use both to (2) describe the binary object to be loaded, and if successfully loaded, (2) to provide information about where and how the binary object was loaded. That structure is shown below:

    struct symtab_s;
    struct binary_s
    {
      /* Information provided to the loader to load and bind a module */

      FAR const char *filename;            /* Full path to the binary to be loaded */
      FAR const char **argv;               /* Argument list */
      FAR const struct symtab_s *exports;  /* Table of exported symbols */
      int nexports;                        /* The number of symbols in exports[] */

      /* Information provided from the loader (if successful) describing the
       * resources used by the loaded module.
       */

      main_t entrypt;                      /* Entry point into a program module */
      FAR void *mapped;                    /* Memory-mapped, address space */
      FAR void *alloc[BINFMT_NALLOC];      /* Allocated address spaces */

      /* Constructors/destructors */

    #ifdef CONFIG_BINFMT_CONSTRUCTORS
      FAR binfmt_ctor_t *ctors;            /* Pointer to a list of constructors */
      FAR binfmt_dtor_t *dtors;            /* Pointer to a list of destructors */
      uint16_t nctors;                     /* Number of constructors in the list */
      uint16_t ndtors;                     /* Number of destructors in the list */
    #endif

      /* Address environment.
       *
       * addrenv - This is the handle created by up_addrenv_create() that can be
       *   used to manage the tasks address space.
       */

    #ifdef CONFIG_ARCH_ADDRENV
      group_addrenv_t addrenv;             /* Task group address environment */
    #endif

      size_t mapsize;                      /* Size of the mapped address region (needed for munmap) */

      /* Start-up information that is provided by the loader, but may be modified
       * by the caller between load_module() and exec_module() calls.
       */

      uint8_t priority;                    /* Task execution priority */
      size_t stacksize;                    /* Size of the stack in bytes (unallocated) */
    };

1The `filename` must be the full, absolute path to the file to be executed unless `CONFIG_BINFMT_EXEPATH` is defined. In that case, `filename` may be a relative path; a set of candidate absolute paths will be generated using the `PATH` environment variable and `load_module()` will attempt to load each file that is found at those absolute paths.

Where the types `binfmt_ctor_t` and `binfmt_dtor_t` define the type of one C++ constructor or destructor:

    typedef FAR void (*binfmt_ctor_t)(void);
    typedef FAR void (*binfmt_dtor_t)(void);

## 2.3 Binary Loader Function Interfaces

### Binary format management:

2.3.1 `register_binfmt()`
2.3.2 `unregister_binfmt()`

### Basic module management:

2.3.3 `load_module()`
2.3.4 `unload_module()`
2.3.5 `exec_module()`
2.3.6 `exec()`
2.3.7 `exec()`

### `PATH` traversal logic:

2.3.8 `exepath_init()`
2.3.9 `exepath_next()`
2.3.10 `exepath_release()`

### 2.3.1 `register_binfmt()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int register_binfmt(FAR struct binfmt_s *binfmt);

Description:

Register a loader for a binary format.

Returned Value:

This is a NuttX internal function so it follows the convention that 0 (`OK`) is returned on success and a negated `errno` is returned on failure.

### 2.3.2 `unregister_binfmt()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int unregister_binfmt(FAR struct binfmt_s *binfmt);

Description:

Register a loader for a binary format.

Returned Value:

This is a NuttX internal function so it follows the convention that 0 (`OK`) is returned on success and a negated `errno` is returned on failure.

### 2.3.3 `load_module()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int load_module(FAR struct binary_s *bin);

Description:

Load a module into memory, bind it to an exported symbol take, and prep the module for execution.

`load_module()` will use the `filename` field in the `struct binary_s` in order to locate the module to be loaded from the file system. The `filename` must be the full, absolute path to the file to be executed unless `CONFIG_BINFMT_EXEPATH` is defined. In that case, `filename` may be a relative path; a set of candidate absolute paths will be generated using the `PATH` environment variable and `load_module()` will attempt to load each file that is found at those absolute paths.

Returned Value:

This is an end-user function, so it follows the normal convention: Returns 0 (`OK`) on success. On failure, it returns -1 (`ERROR`) with `errno` set appropriately.

### 2.3.4 `unload_module()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int unload_module(FAR struct binary_s *bin);

Description:

Unload a (non-executing) module from memory. If the module has been started (via `exec_module()`) and has not exited, calling this will be fatal.

However, this function must be called after the module exist. How this is done is up to your logic. Perhaps you register it to be called by `on_exit()`?

Returned Value:

This is a NuttX internal function so it follows the convention that 0 (`OK`) is returned on success and a negated `errno` is returned on failure.

### 2.3.5 `exec_module()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int exec_module(FAR const struct binary_s *bin);

Description:

Execute a module that has been loaded into memory by `load_module()`.

Returned Value:

This is an end-user function, so it follows the normal convention: Returns 0 (`OK`) on success. On failure, it returns -1 (`ERROR`) with `errno` set appropriately.

### 2.3.7 `exec()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    int exec(FAR const char *filename, FAR const char **argv,
             FAR const struct symtab_s *exports, int nexports);

Description:

This is a convenience function that wraps `load_` and `exec_module()` into one call.

Input Parameters:

- `filename`: Full path to the binary to be loaded.
- `argv`: Argument list.
- `exports`: Table of exported symbols.
- `exports`: The number of symbols in exports.

Returned Value:

This is an end-user function, so it follows the normal convention: Returns 0 (`OK`) on success. On failure, it returns -1 (`ERROR`) with `errno` set appropriately.

### 2.3.8 `exepath_init()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    #ifdef CONFIG_BINFMT_EXEPATH
    EXEPATH_HANDLE exepath_init(void);
    #endif

Description:

Initialize for the traversal of each value in the `PATH` variable. The usage is sequence is as follows:

1. Call `exepath_init()` to initialize for the traversal. `exepath_init()` will return an opaque handle that can then be provided to `exepath_next()` and `exepath_release()`.
2. Call `exepath_next()` repeatedly to examine every file that lies in the directories of the `PATH` variable.
3. Call `exepath_release()` to free resources set aside by `exepath_init()`.

Input Parameters: None

Returned Value:

On success, `exepath_init()` return a non-`NULL`, opaque handle that may subsequently be used in calls to `exepath_next()` and `exepath_release()`. On error, a `NULL` handle value will be returned. The most likely cause of an error would be that the there is no value associated with the `PATH` variable.

### 2.3.9 `exepath_next()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    #ifdef CONFIG_BINFMT_EXEPATH
    FAR char *exepath_next(EXEPATH_HANDLE handle, FAR const char *relpath);
    #endif

Description:

Traverse all possible values in the `PATH` variable in attempt to find the full path to an executable file when only a relative path is provided.

Input Parameters:

- `handle`: The handle value returned by `exepath_init()`.
- `relpath`: The relative path to the file to be found.

Returned Value:

On success, a non-`NULL` pointer to a null-terminated string is provided. This is the full path to a file that exists in the file system. This function will verify that the file exists (but will not verify that it is marked executable).

NOTE: The string pointer return in the success case points to allocated memory. This memory must be freed by the called by calling `kmm_free()`.

`NULL`relpath from any absolute path in the `PATH` variable. In this case, there is no point in calling `exepath_next()` further; `exepath_release()` must be called to release resources set aside by `expath_init()`.

### 2.3.10- `exepath_release()`

Function Prototype:

    #include <:nuttx/binfmt/binfmt.h>
    #ifdef CONFIG_BINFMT_EXEPATH
    void exepath_release(EXEPATH_HANDLE handle);
    #endif

Description:

Release all resources set aside by `exepath_init` when the handle value was created. The handle value is invalid on return from this function. Attempts to all `exepath_next()` or `exepath_release()` with such a stale handle will result in undefined (i.e., not good) behavior.

Input Parameters:

- `handle`: The handle value returned by `exepath_init()`.

Returned Value: None

# 3.0 Symbol Tables

Symbol Tables. Symbol tables are lists of name value mappings: The name is a string that identifies a symbol, and the value is an address in memory where the symbol of that name has been positioned. In most NuttX architectures symbol tables are required, as a minimum, in order to dynamically link the loaded binary object with the base code on FLASH. Since the binary object was separately built and separately linked, these symbols will appear as undefined symbols in the binary object. The binary loader will use the symbol table to look up the symbol by its name and to provide the address associated with the symbol as needed to perform the dynamic linking of the binary object to the base FLASH code.

## 3.1 Symbol Table Header Files

The interface to the symbol table logic is described in the header file `include/nuttx/binfmt/symtab.h`. A brief summary of the data structurs and interfaces prototyped in that header file are listed below.

## 3.2 Symbol Table Data Structures

`struct symbtab_s` describes one entry in the symbol table.

    struct symtab_s
    {
      FAR const char *sym_name;          /* A pointer to the symbol name string */
      FAR const void *sym_value;         /* The value associated witht the string */
    };

A symbol table is a fixed size array of `struct symtab_s`. The information is intentionally minimal and supports only:

1. Function pointers as `sym_values`. Of other kinds of values need to be supported, then typing information would also need to be included in the structure.
2. Fixed size arrays. There is no explicit provisional for dyanamically adding or removing entries from the symbol table (realloc might be used for that purpose if needed). The intention is to support only fixed size arrays completely defined at compilation or link time.

## 3.3 Symbol Table Function Interfaces

3.3.1 `symtab_findbyname()`
3.3.2 `symtab_findorderedbyname()`
3.3.3 `symtab_findbyvalue()`
3.3.4 `symtab_findorderedbyvalue()`

### 3.3.1 `symtab_findbyname()`

Function Prototype:

    #include <:nuttx/binfmt/symtab.h>
    FAR const struct symtab_s *
    symtab_findbyname(FAR const struct symtab_s *symtab,
                      FAR const char *name, int nsyms);

Description:

Find the symbol in the symbol table with the matching name. This version assumes that table is not ordered with respect to symbol name and, hence, access time will be linear with respect to `nsyms`.

Returned Value:

A reference to the symbol table entry if an entry with the matching name is found; `NULL` is returned if the entry is not found.

### 3.3.2 `symtab_findorderedbyname()`

Function Prototype:

    #include <:nuttx/binfmt/symtab.h>
    FAR const struct symtab_s *
    symtab_findorderedbyname(FAR const struct symtab_s *symtab,
                             FAR const char *name, int nsyms);

Description:

Find the symbol in the symbol table with the matching name. This version assumes that table ordered with respect to symbol name.

Returned Value:

A reference to the symbol table entry if an entry with the matching name is found; `NULL` is returned if the entry is not found.

### 3.3.3 `symtab_findbyvalue()`

Function Prototype:

    #include <:nuttx/binfmt/symtab.h>
    FAR const struct symtab_s *
    symtab_findbyvalue(FAR const struct symtab_s *symtab,
                       FAR void *value, int nsyms);

Description:

Find the symbol in the symbol table whose value closest (but not greater than), the provided value. This version assumes that table is not ordered with respect to symbol name and, hence, access time will be linear with respect to `nsyms`.

Returned Value:

A reference to the symbol table entry if an entry with the matching name is found; `NULL` is returned if the entry is not found.

### 3.3.4 `symtab_findorderedbyvalue()`

Function Prototype:

    #include <:nuttx/binfmt/symtab.h>
    FAR const struct symtab_s *
    symtab_findorderedbyvalue(FAR const struct symtab_s *symtab,
                              FAR void *value, int nsyms);

Description:

Find the symbol in the symbol table whose value closest (but not greater than), the provided value. This version assumes that table is ordered with respect to symbol name.

Returned Value:

A reference to the symbol table entry if an entry with the matching name is found; `NULL` is returned if the entry is not found.

# 4.0 Configuration Variables

`CONFIG_BINFMT_DISABLE`: By default, support for loadable binary formats is built. This logic may be suppressed be defining this setting.

`CONFIG_BINFMT_CONSTRUCTORS`: Build in support for C++ constructors in loaded modules.

`CONFIG_SYMTAB_ORDEREDBYNAME`: Symbol tables are order by name (rather than value).

Additional configuration options may be required for the each enabled binary format.