.ELF File Format – Dynamic linking

Dynamic entry

Entries are 8 or 16 bytes. The array ends with DT_NULL. Apart from that and the order of DT_NEEDED entries, order does not matter. Addresses are not relocated in the file; the dynamic linker adds the base address. Even tags use d_ptr and odd tags d_val or nothing, except tags below DT_ENCODING and between DT_HIOS and DT_LOPROC.

Tags

M mandatory, O optional, I ignored, in executables / shared objects; * marks “level 2” tags the gABI has superseded.

GNU and Sun tags (glibc)

Tags in the DT_VALRNG range use d_val and those in the DT_ADDRRNG range d_ptr, as the names say. Processor tags for x86-64 and AArch64 are on the symbols and relocations page.

DT_FLAGS

DT_FLAGS_1 (glibc)

DT_FEATURE_1: DTF_1_PARINIT 0x1, DTF_1_CONFEXP 0x2. DT_POSFLAG_1: DF_P1_LAZYLOAD 0x1, DF_P1_GROUPPERM 0x2. The sources read give no further meaning for these GNU and Sun flags than their names.

Hash table (DT_HASH)

An array of Words, the same in 32-bit and 64-bit files:

To look up a name, compute its hash h, start at bucket[h % nbucket] and follow chain until the name matches or the index is STN_UNDEF. The hash function:

h = 0
for each byte c of the name:
    h = (h << 4) + c
    g = h & 0xF0000000
    if g != 0: h ^= g >> 24
    h &= ~g
return h

The GNU hash table (DT_GNU_HASH, SHT_GNU_HASH) has a different layout that none of the sources read describes; it is not covered here.

Symbol versioning (GNU)

Three sections: .gnu.version (SHT_GNU_versym) has one Half per dynamic symbol giving its version index; .gnu.version_d (SHT_GNU_verdef) defines versions; .gnu.version_r (SHT_GNU_verneed) lists versions needed from other files. Their structures, from glibc (the same in 32-bit and 64-bit files):

Version index values

Verdef (20 bytes)

Verdaux (8 bytes): vda_name (Word, string offset of a version or dependency name), vda_next (Word, offset to the next Verdaux).

Verneed (16 bytes)

Vernaux (16 bytes)

Syminfo and move entries (Sun)

Syminfo (4 bytes): si_boundto (Half; 0xFFFF self, 0xFFFE parent, from 0xFF00 reserved) and si_flags (Half; 0x1 direct, 0x2 pass-through, 0x4 copy, 0x8 lazy load). Move entries (32-bit form) hold m_value (Xword), m_info (Word: symbol index in the bits above 8, size in the low byte), m_poffset (Word), m_repeat and m_stride (Half each).

Dependencies and search order

• Each DT_NEEDED object is loaded once. Symbols are resolved breadth first: the executable, its dependencies in order, then theirs.
• A name with a slash is a path. Otherwise the linker searches LD_LIBRARY_PATH, then the needing object’s DT_RUNPATH (which applies to its own dependencies only), then default directories such as /usr/lib. DT_RPATH is searched before LD_LIBRARY_PATH and ignored if DT_RUNPATH exists. Set-ID programs ignore LD_LIBRARY_PATH.
• $ORIGIN (or ${ORIGIN}) in DT_NEEDED, DT_RUNPATH or dlopen() paths is the directory of the object that contains it.
• Dependencies are initialised before the objects that need them, and the executable last; DT_INIT runs before DT_INIT_ARRAY, DT_FINI_ARRAY (in reverse) before DT_FINI.

Sources

• gABI chapter 5: Dynamic Linking – dynamic entry, tags 0–34, ranges, DT_FLAGS, hash table and function, search order, $ORIGIN, initialisation order
• glibc elf.h – RELR tags, GNU and Sun tags, DF_1, DTF_1 and DF_P1 flags, versioning structures and constants, Syminfo and Move
• elf(5) – the versioning section names