Shared libraries and how dynamic loading works

Understanding Shared libraries and how dynamic loading works

A static archive is a bag of .o files: the linker copies the members you actually use into your executable and afterwards the archive is irrelevant. A shared object is different, because the linker only checks that the symbols exist and records the library's soname in a DT_NEEDED entry, so the machine code stays inside libfoo.so and is mapped into every process that needs it. That is why the library must still be present and findable on every run, and why it must be compiled with -fPIC: the same pages appear at different addresses in different processes, so the code cannot hold hard-coded absolute addresses and instead reaches its globals through a per-process Global Offset Table.

Starting a dynamically linked program is a two-stage affair. The kernel sees a PT_INTERP entry in the ELF header, loads ld-linux.so first and hands control to it; the loader then walks the DT_NEEDED list, searching DT_RPATH/DT_RUNPATH, then LD_LIBRARY_PATH, then the ldconfig cache in /etc/ld.so.cache, then the default directories. Each library it finds is mapped and its data relocations applied, but calls are normally left lazy: the first call to a library function jumps through the PLT into the loader, which resolves the symbol and patches the GOT so every later call goes straight to the target. Setting LD_BIND_NOW=1 forces that work up front, which turns a missing symbol from a crash halfway through the run into a failure before main starts.

dlopen is the same machinery driven by hand instead of at startup. dlopen returns a handle (or NULL, with the reason available from dlerror), dlsym looks up one symbol in that library and its dependencies, and dlclose drops a reference count. RTLD_LAZY defers binding while RTLD_NOW resolves everything immediately so an unresolvable symbol is reported at load time, and RTLD_GLOBAL additionally publishes the library's symbols into the global scope for libraries loaded later. Because dlsym returns a void * and a legitimate symbol may itself hold the value NULL, the reliable error check is dlerror() to clear, then dlsym, then dlerror again.

/* build: gcc -Wall -o dyn dyn.c -ldl     note: no -lm anywhere */
#include <stdio.h>
#include <dlfcn.h>

int main(void)
{
    double (*cube_root)(double);
    const char *err;
    void *h;

    h = dlopen("libm.so.6", RTLD_LAZY);
    if (h == NULL) {
        fprintf(stderr, "dlopen: %s\n", dlerror());
        return 1;
    }

    dlerror();                                /* drop any stale message */
    *(void **)&cube_root = dlsym(h, "cbrt");  /* POSIX cast workaround */

    err = dlerror();
    if (err != NULL) {
        fprintf(stderr, "dlsym: %s\n", err);
        dlclose(h);
        return 1;
    }

    printf("cbrt(27) = %.1f\n", cube_root(27.0));
    printf("cbrt(1000) = %.1f\n", cube_root(1000.0));

    dlclose(h);
    return 0;
}

Worked examples

/* counter.c
   gcc -Wall -fPIC -c counter.c
   gcc -shared -o libcounter.so counter.o                        */
#include <stdio.h>

static int calls = 0;

__attribute__((constructor))
static void on_load(void) { printf("libcounter loaded\n"); }

__attribute__((destructor))
static void on_unload(void)
{
    printf("libcounter unloaded after %d calls\n", calls);
}

int bump(void) { return ++calls; }

/* main.c
   gcc -Wall -o app main.c -L. -lcounter -Wl,-rpath,'$ORIGIN'    */
#include <stdio.h>

int bump(void);   /* normally this declaration lives in counter.h */

int main(void)
{
    printf("bump -> %d\n", bump());
    printf("bump -> %d\n", bump());
    return 0;
}

#define _GNU_SOURCE
#include <stdio.h>
#include <dlfcn.h>

int main(void)
{
    void *p = dlsym(RTLD_DEFAULT, "puts");
    void *q = dlsym(RTLD_DEFAULT, "no_such_function");

    printf("puts resolved: %s\n", p != NULL ? "yes" : "no");
    printf("no_such_function resolved: %s\n", q != NULL ? "yes" : "no");
    return 0;
}

#include <stdio.h>
#include <dlfcn.h>

int main(void)
{
    void *first  = dlopen("libm.so.6", RTLD_LAZY);
    void *second = dlopen("libm.so.6", RTLD_LAZY);

    if (first == NULL || second == NULL) {
        fprintf(stderr, "dlopen: %s\n", dlerror());
        return 1;
    }

    printf("same handle: %s\n", first == second ? "yes" : "no");

    dlclose(first);
    printf("cbrt still reachable: %s\n",
           dlsym(second, "cbrt") != NULL ? "yes" : "no");

    dlclose(second);
    return 0;
}

Important notes

Common mistakes

Try it yourself