Program Loading

Bedrock ELF program loading follows the ordinary ELF segment model. This ELF ABI defines executable mapping, loader-visible object rules, and entry-image state.

Loading Rules

The loader may execute ET_EXEC and executable ET_DYN images. It honors PT_INTERP, maps each loadable segment at its declared page alignment, and rejects an alignment below 4096 bytes. For a segment whose p_memsz exceeds p_filesz, the loader fills every byte in the half-open range \([\texttt{p\_vaddr}+\texttt{p\_filesz}, \texttt{p\_vaddr}+\texttt{p\_memsz})\) with zero. Object and section alignment requirements remain binding. The zero-filled gap may begin at any byte alignment.

Page Permissions

Every PT_LOAD shall set PF_R. A loader rejects a PT_LOAD whose flags are zero or pair PF_W or PF_X with a clear PF_R. For an accepted segment, its flags select one Normal leaf AM as shown below. The loader rejects PF_R|PF_W|PF_X because the available leaf AMs separate writable and executable mappings.

ELF Segment Permission Mapping

ELF Flags	Leaf AM and Fields	Meaning
PF_R	AM=R, P, U	readable user page
PF_R|PF_W	AM=RW, P, U	readable writable user page
PF_R|PF_X	AM=RX, P, U	readable executable user page

Execution Environment

The ELF contract interprets e_entry, p_vaddr, symbol values, relocation places, and linked code and data addresses in one stable pre-segment virtual-address coordinate. Every ABI-permitted path that consumes one such coordinate preserves its arithmetic and linkage meaning and resolves an actual access to the intended byte of the intended object. At transfer to e_entry, the code context must permit fetch from the entry address, the data context must cover the mapped ordinary data regions, and the stack context must permit reads and writes to the entry stack.

The loader maps each post-segment linear range required by these coordinates to the intended physical pages with the AM and U permissions required by the ELF image. Process entry, dynamic linking, module transitions, TLS paths, unwind and debugger state, JIT publication, and shared pointer conventions preserve the same coordinate invariants.

Executable images and ordinary shared objects form one ABI-visible near-call linkage domain. Their function symbols use pre-segment code addresses. The ordinary dynamic-linking contract covers near calls, and a linker-supplied veneer brings a segment-changing transfer into that domain.

Program Entry State

Before transferring control, the loader completes image relocations and publishes executable bytes. At transfer, PC equals the run-time value of e_entry; SP names a writable entry stack with 16-byte alignment; and the code, data, and stack segment contexts provide the image described above. A TLS image uses GS0 as its thread-pointer base.

The loader clears FLAGS, FSTATUS, and FFLAGS. General, floating-point, vector, and predicate registers outside the stated entry contract carry unspecified values. An external process-entry ABI defines the entry-stack payload and the interpretation of initial arguments. This language-independent state permits an ELF entry point to establish the run-time convention selected by its implementation language.

Language-Independent ELF Program Entry State

Property	Contract
Entry PC	PC = e_entry
Entry stack	SP, 16-byte aligned, read/write
Segment contexts	CS/DS/SS
TLS base	GS0
Readiness	relocations complete, executable bytes published
Cleared state	FLAGS, FFLAGS, FSTATUS
Stack payload owner	external-process-entry-abi