LD(1)
💖 ld(1) — GNU Development Tools 💖
okay bestie, sit down, hydrate, because we're about to talk about ld — the GNU linker, from the GNU Development Tools family. she's the final boss of your compile pipeline and she's lowkey iconic for it. ✨
🌸 NAME 🌸
ld — The GNU linker.
🎀 SYNOPSIS 🎀
ld [options] objfile ...🦋 DESCRIPTION 🦋
okay so. ld combines a bunch of object and archive files, relocates their data, and ties up symbol references. that's the whole job description. usually the very last step in compiling a program is running ld — she's the one who actually stitches the whole fit together. 💅
ld accepts Linker Command Language files written in a superset of AT&T's Link Editor Command Language syntax, so you get explicit and total control over the linking process. total. control. she said what she said. 👑
heads up bestie: this man page does not describe the command language. for the full tea on the command language and other aspects of the GNU linker, go read theldentry ininfo. this page is the vibe, not the whole novel. 📖
this version of ld uses the general purpose BFD libraries to operate on object files. what does that mean for you?? it means ld can read, combine, and write object files in many different formats — for example, COFF or a.out. different formats can even be linked together to produce any available kind of object file. mix and match, she doesn't judge. 🌈
aside from the flexibility, the GNU linker is genuinely more helpful than other linkers when it comes to diagnostic info. lots of linkers just abandon execution immediately upon encountering an error — dramatic much? but ld keeps going whenever possible, so you can spot other errors too. and in some cases, you still get an output file in spite of the error. she's forgiving like that. 🫶
the GNU linker ld is meant to cover a broad range of situations and to be as compatible as possible with other linkers. the tradeoff?? you have so many choices to control her behavior. buckle up. 🎢
✨ OPTIONS ✨
the linker supports a plethora of command-line options, but ngl, in actual practice very few of them show up in any particular context. for instance, a frequent use of ld is linking standard Unix object files on a standard, supported Unix system. on a system like that, to link a file hello.o:
ld -o <output> /lib/crt0.o hello.o -lcthis tells ld to produce a file called output as the result of linking the file /lib/crt0.o with hello.o and the library libc.a, which will come from the standard search directories. (see the discussion of the -l option below, bestie, it's coming.) 📚
some of the command-line options to ld may be specified at any point in the command line. but — and this is the important part — options which refer to files, like -l or -T, cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. order matters, she's not flexible about that one. 🙅♀️
repeating non-file options with a different argument will either have no further effect, or override prior occurrences (the ones further to the left on the command line) of that option. options that can meaningfully be specified more than once are noted in the descriptions below. 📝
non-option arguments are object files or archives which are to be linked together. they may follow, precede, or be mixed in with command-line options — except that an object file argument may not be placed between an option and its argument. do not do that. that's illegal in this house. 💀
usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. if no binary input files at all are specified, the linker does not produce any output, and issues the message No input files. she just. doesn't work. respect that. 😭
if the linker cannot recognize the format of an object file, it will assume that it is a linker script. a script specified in this way augments the main linker script used for the link (either the default linker script or the one specified by using -T). this feature lets the linker link against a file which appears to be an object or an archive but actually merely defines some symbol values, or uses INPUT or GROUP to load other objects. specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script — use the -T option to replace the default linker script entirely, but note the effect of the INSERT command. 🧚
for options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them. no vibes in between. ✋
for options whose names are multiple letters, either one dash or two can precede the option name; for example, -trace-symbol and --trace-symbol are equivalent. note — there is one exception to this rule. multiple letter options that start with a lower case o can only be preceded by two dashes. this is to reduce confusion with the -o option. so for example -omagic sets the output file name to magic, whereas --omagic sets the NMAGIC flag on the output. yes this is confusing, no you're not dumb, this is just how it is. 🙈
arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. for example, --trace-symbol foo and --trace-symbol=foo are equivalent. unique abbreviations of the names of multiple-letter options are accepted. slay. ✨
note — if the linker is being invoked indirectly, via a compiler driver (e.g.gcc), then all the linker command-line options should be prefixed by-Wl,(or whatever is appropriate for the particular compiler driver) like this:
gcc -Wl,--start-group foo.o bar.o -Wl,--end-groupthis is important, because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. silent. dropping. the audacity. 😤
confusion may also arise when passing options that require values through a driver, as the use of a space between option and argument acts as a separator, and causes the driver to pass only the option to the linker and the argument to the compiler. in this case, it is simplest to use the joined forms of both single- and multiple-letter options, such as:
gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.maphere is a table of the generic command-line switches accepted by the GNU linker — she's serving options: 💅
@file— reads command-line options from file. the options read are inserted in place of the original@fileoption. if file does not exist, or cannot be read, then the option will be treated literally, and not removed.
options in file are separated by whitespace. a whitespace character may be included in an option by surrounding the entire option in either single or double quotes. any character (including a backslash) may be included by prefixing the character to be included with a backslash. the file may itself contain additional @file options; any such options will be processed recursively. it's giving inception. 🌀
-akeyword — this option is supported for HP/UX compatibility. the keyword argument must be one of the stringsarchive,shared, ordefault.-aarchiveis functionally equivalent to-Bstatic, and the other two keywords are functionally equivalent to-Bdynamic. this option may be used any number of times. 🔁--auditAUDITLIB — adds AUDITLIB to theDT_AUDITentry of the dynamic section. AUDITLIB is not checked for existence, nor will it use theDT_SONAMEspecified in the library. if specified multiple times,DT_AUDITwill contain a colon separated list of audit interfaces to use. if the linker finds an object with an audit entry while searching for shared libraries, it will add a correspondingDT_DEPAUDITentry in the output file. this option is only meaningful on ELF platforms supporting thertld-auditinterface. 🧐-binput-format--format=input-format —ldmay be configured to support more than one kind of object file. if yourldis configured this way, you can use the-boption to specify the binary format for input object files that follow this option on the command line. even whenldis configured to support alternative object formats, you don't usually need to specify this, asldshould be configured to expect as a default input format the most usual format on each machine. input-format is a text string, the name of a particular format supported by the BFD libraries. (you can list the available binary formats withobjdump -i.) 🔍
you may want to use this option if you are linking files with an unusual binary format. you can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format. 🎯
the default format is taken from the environment variable GNUTARGET. 🌱
you can also define the input format from a script, using the command TARGET. 📜
-cMRI-commandfile--mri-script=MRI-commandfile — for compatibility with linkers produced by MRI,ldaccepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. introduce MRI script files with the option-c; use the-Toption to run linker scripts written in the general-purposeldscripting language. if MRI-cmdfile does not exist,ldlooks for it in the directories specified by any-Loptions. 🗂️-d,-dc,-dp— these three options are equivalent; multiple forms are supported for compatibility with other linkers. they assign space to common symbols even if a relocatable output file is specified (with-r). the script commandFORCE_COMMON_ALLOCATIONhas the same effect. 🫶--depauditAUDITLIB,-PAUDITLIB — adds AUDITLIB to theDT_DEPAUDITentry of the dynamic section. AUDITLIB is not checked for existence, nor will it use theDT_SONAMEspecified in the library. if specified multiple times,DT_DEPAUDITwill contain a colon separated list of audit interfaces to use. this option is only meaningful on ELF platforms supporting thertld-auditinterface. the-Poption is provided for Solaris compatibility. ☀️--enable-linker-version— enables theLINKER_VERSIONlinker script directive, described in Output Section Data. if this directive is used in a linker script and this option has been enabled, then a string containing the linker version will be inserted at the current point. 💫
note — the location of this option on the linker command line is significant. it will only affect linker scripts that come after it on the command line, or which are built into the linker. 👀
--disable-linker-version— disables theLINKER_VERSIONlinker script directive, so that it does not insert a version string. this is the default. 🙂--enable-non-contiguous-regions— okay so normally, if an input section doesn't fit its matching output section, the linker just screams at you 💀. With this flag? It does NOT error out. Instead it tries to slot that input section into subsequent matching output sections, and only throws an error if literally no output section is big enough. Perfect for when you've got several non-contiguous memory regions lying around and your input section isn't fussy about which one it lands in 🫶.
The order in which input sections are evaluated does not change, bestie. Like, for instance:
MEMORY {
MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
mem1 : { *(.data.*); } > MEM1
mem2 : { *(.data.*); } > MEM2
mem3 : { *(.data.*); } > MEM3
}
with input sections:
.data.1: size 8
.data.2: size 0x10
.data.3: size 4
results in .data.1 affected to mem1, and .data.2 and .data.3
affected to mem2, even though .data.3 would fit in mem3.Heads up 🚨 this option is incompatible with INSERT statements, because it changes the way input sections are mapped to output sections. They simply do not vibe together.
--enable-non-contiguous-regions-warnings— turns on warnings for when--enable-non-contiguous-regionsallows possibly unexpected matches in sections mapping. Why do you care? Because those sneaky matches could potentially lead to silently discarding a section instead of failing just because it doesn't fit any output region 😭. You want the receipts, girl.-eentry,--entry=entry— use entry as the explicit symbol for beginning execution of your program, instead of the default entry point. And if there's no symbol named entry? The linker will try to parse entry as a number and use that as the entry address (interpreted in base 10; you may use a leading0xfor base 16, or a leading0for base 8 ✨). For i386 PE, entry can also be the original function name — i.e. without the leading underscore and/or the trailingstdcall @numberwhen applicable.--exclude-libslib,lib,... — gives a list of archive libraries from which symbols should not be automatically exported. The library names may be delimited by commas or colons. Hitting it with--exclude-libs ALLexcludes symbols in all archive libraries from automatic export 🚫. Available only for ELF and PE targeted ports of the linker. For PE targets, symbols explicitly listed in a.deffile are still exported, regardless of this option. For ELF targeted ports, symbols affected by this option will be treated as hidden 👻.--exclude-modules-for-implibmodule,module,... — a list of object files or archive members from which symbols should not be automatically exported, but which should still be copied wholesale into the import library being generated during the link. The module names may be delimited by commas or colons, and must match exactly the filenames used byldto open the files. For archive members, this is simply the member name; but for object files the name you list must include and match precisely any path used to specify the input file on the linker's command-line. Symbols explicitly listed in a.deffile are still exported, regardless of this option. [This option is specific to PE targeted ports of the linker]-E,--export-dynamic,--no-export-dynamic— when you're creating a dynamically linked executable,-Eor--export-dynamicmakes the linker add all symbols to the dynamic symbol table. And what even is the dynamic symbol table? It's the set of symbols visible from dynamic objects at run time, periodt 💅.
If you don't use either of these options (or you use --no-export-dynamic to restore the default behavior), the dynamic symbol table will normally contain only those symbols which are referenced by some dynamic object mentioned in the link.
If you use dlopen to load a dynamic object that needs to refer back to symbols defined by the program — rather than some other dynamic object — then you'll probably need this option when linking the program itself, no cap.
You can also use the dynamic list to control what symbols should be added to the dynamic symbol table, if the output format supports it. See the description of --dynamic-list 👀.
Note that this option is specific to ELF targeted ports. PE targets support a similar function to export all symbols from a DLL or EXE — see the description of --export-all-symbols below.
--export-dynamic-symbol=glob— when you're creating a dynamically linked executable, symbols matching glob get added to the dynamic symbol table. When you're creating a shared library, references to symbols matching glob will NOT be bound to the definitions within the shared library. This option is a no-op when creating a shared library and-Bsymbolicor--dynamic-listare not specified. Only meaningful on ELF platforms which support shared libraries 🌈.--export-dynamic-symbol-list=file— specifies a--export-dynamic-symbolfor each pattern in the file. The format of the file is the same as the version node without scope and node name. SeeVERSIONfor more info 📖.-EB— link big-endian objects. This affects the default output format.-EL— link little-endian objects. This affects the default output format.-fname,--auxiliary=name— when creating an ELF shared object, sets the internalDT_AUXILIARYfield to the specified name. This tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name.
If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_AUXILIARY field. If it resolves any symbols from the filter object, it will first check whether there is a definition in the shared object name. If there is one, it gets used instead of the definition in the filter object. The shared object name need not exist 😳. So name may be used to provide an alternative implementation of certain functions — maybe for debugging, maybe for machine-specific performance.
This option may be specified more than once. The DT_AUXILIARY entries will be created in the order in which they appear on the command line.
-Fname,--filter=name— when creating an ELF shared object, sets the internalDT_FILTERfield to the specified name. This tells the dynamic linker that the symbol table of the shared object being created should be used as a filter on the symbol table of the shared object name.
If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_FILTER field. It will resolve symbols according to the symbol table of the filter object as usual, but it will actually link to the definitions found in the shared object name ✨. So the filter object can select a subset of the symbols provided by the object name.
Some older linkers used -F all throughout a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker uses other mechanisms for this instead: the -b, --format, --oformat options, the TARGET command in linker scripts, and the GNUTARGET environment variable. The GNU linker will just ignore the -F option when it's not creating an ELF shared object 🙈.
-fini=name— when creating an ELF executable or shared object, call NAME when the executable or shared object is unloaded, by settingDT_FINIto the address of the function. By default the linker uses_finias the function to call.-g— ignored. Provided for compatibility with other tools 🤷♀️. That's it. That's the whole thing.-Gvalue,--gpsize=value— set the maximum size of objects to be optimized using the GP register to size. Only meaningful for object file formats like MIPS ELF that support putting large and small objects into different sections. Ignored for other object file formats.-hname,-soname=name— when creating an ELF shared object, sets the internalDT_SONAMEfield to the specified name. Then when an executable is linked with a shared object that has aDT_SONAMEfield, when the executable runs, the dynamic linker will attempt to load the shared object specified by theDT_SONAMEfield rather than using the file name given to the linker 🎀.-i— perform an incremental link (same as option-r).-init=name— when creating an ELF executable or shared object, call NAME when the executable or shared object is loaded, by settingDT_INITto the address of the function. By default the linker uses_initas the function to call.-lnamespec,--library=namespec— adds the archive or object file specified by namespec to the list of files to link. This option may be used any number of times, keep 'em coming 💅. If namespec is of the form:filename,ldwill search the library path for a file calledfilename; otherwise it searches the library path for a file calledlibnamespec.a.
On systems which support shared libraries, ld may also search for files other than libnamespec.a. Specifically, on ELF and SunOS systems, ld will search a directory for a library called libnamespec.so before searching for one called libnamespec.a. (By convention, a .so extension indicates a shared library.) Note that this behavior does not apply to :filename, which always specifies a file called filename 💯.
The linker will search an archive only once, at the location where it is specified on the command line. If the archive defines a symbol which was undefined in some object that appeared before the archive on the command line, the linker will include the appropriate file(s) from the archive. However, an undefined symbol in an object appearing later on the command line will not cause the linker to search the archive again 😭. Order matters, bestie.
See the -( option for a way to force the linker to search archives multiple times.
You may list the same archive multiple times on the command line 🫶.
-Lsearchdir,--library-path=searchdir — bestie, this one adds searchdir to the list of paths thatldis gonna go dig through when it's hunting for archive libraries andldcontrol scripts. ✨
Use it as many times as your heart desires — no cap, you can stack it. The directories get searched in the exact order you put them on the command line, and anything you list on the command line gets searched before the default directories. Also, and this is the part people sleep on: all -L options apply to all -l options, no matter what order they show up in. The one exception? -L options do not affect how ld searches for a linker script unless the -T option is specified. 💅
If searchdir starts with = or $SYSROOT, that lil prefix gets swapped out for the sysroot prefix — controlled by the --sysroot option, or by whatever was specified when the linker was configured. 🌸
The default set of paths (the ones you get without ever touching -L) depends on which emulation mode ld is using, and sometimes on how it was configured too. 🦋
You can also drop paths into a link script with the "SEARCH_DIR" command. Directories specified that way get searched at the point where that linker script shows up on the command line. iykyk.
-memulation — emulate the emulation linker, bestie. You can see the whole list of available emulations with the--verboseor-Voptions. 👑
If you don't use -m at all, the emulation comes from the "LDEMULATION" environment variable — that is, if it's defined. 🫶
Otherwise? The default emulation just depends on how the linker was configured. That's it, that's the tea.
--remap-inputs=pattern=filename,--remap-inputs-file=file — these two let you rename input files before the linker even tries to open them. Not me casually rewriting your file names mid-link 😭
So --remap-inputs=foo.o=bar.o means any attempt to load a file called foo.o will instead try to load bar.o. And wildcards are allowed in that first filename — so --remap-inputs=foo*.o=bar.o renames any input file matching foo*.o into bar.o. Slay. ✨
There's another form, --remap-inputs-file=filename, which reads your remappings straight out of a file. Each line in that file holds a single remapping. Blank lines are ignored (we love a no-drama file). Anything from a hash character (#) to the end of the line counts as a comment and gets ignored too. The mapping pattern can be separated from the filename by whitespace or an equals (=) character. 💖
You can specify these options multiple times and their contents accumulate. The remappings get processed in the order they occur on the command line, and if they came from a file, in the order they occur in the file. Once a match is made, no further checking happens for that filename. Done, dusted, periodt. 👑
Oh and — if the replacement filename is /dev/null or just NUL, then the remapping actually causes the input file to be ignored. Which is a genuinely convenient way to experiment with removing input files from a complicated build environment. Like, chef's kiss for debugging. 🍓
Heads up: this option is position dependent and only affects filenames that come after it on the command line. So this:
ld foo.o --remap-inputs=foo.o=bar.owill have no effect, whereas this:
ld --remap-inputs=foo.o=bar.o foo.owill rename the input file foo.o to bar.o. 💅
Note — these options also affect files referenced by INPUT statements in linker scripts. But since linker scripts are processed after the entire command line is read, the position of the remap options on the command line is not significant in that case. 🧚
If the verbose option is enabled, any mappings that match get reported — though again, verbose needs to be enabled on the command line before the remapped filenames appear. Timing is everything, bestie.
And if -Map or --print-map are enabled, the remapping list will be included in the map output. 🌈
-M,--print-map— prints a link map to standard output. A link map is literally just the receipts of the link, and it tells you:- Where object files are mapped into memory. 🗺️
- How common symbols are allocated.
- All archive members included in the link, with a shoutout to the symbol that caused the archive member to be brought in.
- The values assigned to symbols.
Note — symbols whose values are computed by an expression that involves a reference to a previous value of the same symbol may not have their correct result displayed in the link map. Why? Because the linker discards intermediate results and only keeps the final value of an expression. 😭 In those situations the linker displays the final value enclosed by square brackets. So for example, a linker script containing:
foo = 1
foo = foo * 4
foo = foo + 8will produce the following output in the link map if the -M option is used:
0x00000001 foo = 0x1
[0x0000000c] foo = (foo * 0x4)
[0x0000000c] foo = (foo + 0x8)See Expressions for more information about expressions in linker scripts. 💜
- How GNU properties are merged.
When the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties get removed or updated. These actions are reported in the link map. For example:
Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)This indicates that property 0xc0000002 is removed from output when merging properties in foo.o, whose property 0xc0000002 value is 0x1, and bar.o, which doesn't have property 0xc0000002. 🙈
Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)This indicates that property 0xc0010001 value is updated to 0x1 in output when merging properties in foo.o, whose 0xc0010001 property value is 0x1, and bar.o, whose 0xc0010001 property value is 0x1. ✨
- On some ELF targets, a list of fixups inserted by
--relax:
foo.o: Adjusting branch at 0x00000008 towards "far" in section .textThis indicates that the branch at 0x00000008 in foo.o, targeting the symbol "far" in section .text, has been replaced by a trampoline. 🎀
--print-map-discarded,--no-print-map-discarded— print (or do not print) the list of discarded and garbage collected sections in the link map. Enabled by default, so this is already happening unless you tell it otherwise. 💅--print-map-locals,--no-print-map-locals— print (or do not print) local symbols in the link map. Local symbols get the text(local)printed before their name, and they'll be listed after all of the global symbols in a given section. Temporary local symbols (typically those that start with.L) will not be included in the output. Disabled by default. 🌸-n,--nmagic— turns off page alignment of sections, and disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as"NMAGIC". 🦋-N,--omagic— sets the text and data sections to be readable and writable. It also does not page-align the data segment, and it disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as"OMAGIC".
Note: although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. 👀
--no-omagic— this option negates most of the effects of the-Noption. It sets the text section to be read-only, and forces the data segment to be page-aligned.
Note — this option does not enable linking against shared libraries. Use -Bdynamic for that. 😭
-ooutput,--output=output — use output as the name for the program produced byld. If you don't specify this option, the namea.outis used by default. The script command"OUTPUT"can also specify the output file name. 💖
Note — the linker will delete the output file before it starts to write to it. It will do this even if it turns out that the link cannot be completed due to errors. 😳
Note — the linker will check to make sure that the output file name does not match the name of any of the input files, but that is all. In particular it will not complain if the output file might overwrite a source file or some other important file. Therefore, in build systems it is recommended to use the -o option as the last option on the linker command line. For example consider:
ld -o $(EXE) $(OBJS)
ld $(OBJS) -o $(EXE)If the EXE variable is not defined for some reason, the first version of the linker command could end up deleting one of the object files (the first one in the OBJS list), whereas the second version of the linker command will generate an error message and not delete anything. 🙏
--dependency-file=depfile — write a dependency file to depfile. This file contains a rule suitable for"make"describing the output file and all the input files that were read to produce it. The output is similar to the compiler's output with-M -MP. 👑
Note that there is no option like the compiler's -MM, to exclude "system files" — which is not a well-specified concept in the linker, unlike "system headers" in the compiler. So the output from --dependency-file is always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. 🫶
-Olevel — if level is a numeric value greater than zero,ldoptimizes the output. This might take significantly longer, and therefore probably should only be enabled for the final binary. At the moment this option only affects ELF shared library generation. Future releases of the linker may make more use of this option. Also, currently there is no difference in the linker's behaviour for different non-zero values of this option. Again, this may change with future releases. ✨
If level is zero, or the literal string fast, then ld just skips all the optional operations instead — you get a faster link, but the binaries it spits out are slower and chunkier. Right now the one and only operation it skips is combining mergeable sections, but lowkey that list may grow in the future, so don't get too attached to it. 🫶
If level is the string default, or literally just the - character, then you get the linker's default behaviour: neither optimizing nor skipping anything. Neutral. Balanced. The unbothered queen of link modes. ⚖️
-plugin name— brings a plugin into the linking process, bestie. The name parameter is the absolute filename of the plugin. Usually this gets added automatically by the compiler when you're doing link time optimization, but you're absolutely allowed to add your own plugins if that's the vibe you want. ✨
Heads up though: the place where compiler-originated plugins live is different from the place where ar, nm and ranlib go looking for their plugins. So if you want those commands to actually use a compiler based plugin, you first have to copy it into the ${libdir}/bfd-plugins directory. All gcc based linker plugins are backward compatible, so it's enough to just copy in the newest one. No cap. 💅
--push-state— this one preserves the current state of all the flags that govern input file handling, so you can bring the whole vibe back later with one matching--pop-stateoption. Snapshot, but for flags. 📸
The options covered are: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, --link-mapless, --no-link-mapless, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a.
One very real target for this is pkg-config specifications. When you use the --libs option, all possibly needed libraries get listed and then possibly linked the entire time. It's way better to return something like:
-Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state--pop-state— undoes the whole effect of--push-state, restoring the previous values of the flags that govern input file handling. The rewind button of linker flags. ⏪-q,--emit-relocs— leaves relocation sections and their contents in fully linked executables. Post link analysis and optimization tools may need that info to correctly modify executables, so it's giving very considerate. The tradeoff? Bigger executables, periodt. 😭
This option is currently only supported on ELF platforms, iykyk.
--force-dynamic— forces the output file to have dynamic sections. This one is specific to VxWorks targets. 🌸-r,--relocatable— generates relocatable output, meaning you get an output file that can in turn serve as input to ld. Everyone calls this partial linking. As a side effect, in environments that support standard Unix magic numbers, this option also sets the output file's magic number to"OMAGIC". If you don't specify this option, an absolute file gets produced instead. And when you're linking C++ programs, this option will not resolve references to constructors — for that you want-Ur. 💀
When an input file doesn't have the same format as the output file, partial linking is only supported if that input file doesn't contain any relocations. Different output formats can have further restrictions too; for example, some "a.out"-based formats don't support partial linking with input files in other formats at all. Rude, but okay.
When the relocatable output contains both contents which require link-time optimization (LTO) and contents which don't require LTO, a .gnu_object_only section will be created to contain a relocatable object file, as if -r is applied to all relocatable inputs which don't require LTO. When processing a relocatable input with a .gnu_object_only section, the linker will extract the .gnu_object_only section as a separate input. 🧚
Also note that since -r groups some sections from different input files together, there may be negative impacts on code size and locality in the final executable or shared library. Just so you know.
This option does the same thing as -i.
-R filename,--just-symbols=filename— reads symbol names and their addresses from filename, but does not relocate it or include it in the output. This lets your output file refer symbolically to absolute locations of memory defined in other programs. You may use this option more than once. 👑
For compatibility with other ELF linkers, if the -R option is followed by a directory name rather than a file name, it gets treated as the -rpath option. Little plot twist for you there.
--rosegment,--no-rosegment— attempts to ensure that only a single read-only, non-code segment gets created. Only useful when used in conjunction with the-z separate-codeoption. The resulting binaries should be smaller than if-z separate-codeis used on its own. Without this option, or if--no-rosegmentis specified, the-z separate-codeoption will create two read-only segments — one before the code segment and one after it. 🌈
The names of these options are misleading, but they were chosen so the linker stays compatible with the LLD and GOLD linkers. Blame the ancestors. 😭
These options are only supported by ELF targets.
-s,--strip-all— omits all symbol information from the output file. Gone. Ghosted. 💅-S,--strip-debug— omits debugger symbol information from the output file, but not all symbols. Selective stripping, we love to see it. ✨--strip-discarded,--no-strip-discarded— omits (or does not omit) global symbols defined in discarded sections. Enabled by default. 🎀-plugin-save-temps— stores the plugin"temporary"intermediate files permanently. No takebacks, bestie.-t,--trace— prints the names of the input files as ld processes them. If-tis given twice, then members within archives also get printed. This output is lowkey so useful for generating a list of all the object files and scripts involved in linking — for example, when packaging files for a linker bug report. 🌸-T scriptfile,--script=scriptfile— uses scriptfile as the linker script. This script replaces ld's default linker script rather than adding to it, unless the script contains"INSERT"— so commandfile must specify everything necessary to describe the output file. 👑
If scriptfile doesn't exist in the current directory, "ld" goes looking for it in the directories specified by any preceding -L options.
Command line options that appear before the -T option can affect the script, but command line options that appear after it do not. Order matters, always has. ✨
Multiple -T options will accumulate if they are augmenting the current script; otherwise the last, non-augmenting, -T option will be used.
There are other ways of specifying linker scripts. See
ok genuinely the source text just stops after "See" and moves on 💀 bestie I cannot invent a cross-reference that isn't there, so take this exactly as printed.
-dT scriptfile,--default-script=scriptfile— uses scriptfile as the default linker script. 🌷
This option is similar to the --script option, except that processing of the script is delayed until after the rest of the command line has been processed. That delay is the whole point: it lets options placed after the --default-script option on the command line affect the behaviour of the linker script, which can be super important when the linker command line can't be directly controlled by the user. (eg because the command line is being constructed by another tool, such as gcc). 🫶
-u symbol,--undefined=symbol— forces symbol to be entered in the output file as an undefined symbol. Doing this may, for example, trigger linking of additional modules from standard libraries.-umay be repeated with different option arguments to enter additional undefined symbols. This option is equivalent to the"EXTERN"linker script command. 💜
If you're using this option to force additional modules to be pulled into the link, and if it's an error for the symbol to remain undefined, then you should use --require-defined instead. Fr fr, that's the move.
--require-defined=symbol— requires that symbol is defined in the output file. This option is the same as the--undefinedoption, except that if symbol isn't defined in the output file then the linker will issue an error and exit. 😭
The same effect can be achieved in a linker script by using "EXTERN", "ASSERT" and "DEFINED" together. This option can be used multiple times to require additional symbols.
-Ur— for programs that don't use constructors or destructors, or for ELF based systems, this option is equivalent to-r: it generates relocatable output, meaning an output file that can in turn serve as input to ld. For other binaries, however, the-Uroption is similar to-rbut it also resolves references to constructors and destructors. ✨
For those systems where -r and -Ur behave differently, it does not work to use -Ur on files that were themselves linked with -Ur — once the constructor table has been built, it cannot be added to. So use -Ur only for the last partial link, and -r for the others. No cap.
--orphan-handling=MODE— controls how orphan sections are handled. An orphan section is one that isn't specifically mentioned in a linker script. 🦋
MODE can have any of the following values:
"place"— orphan sections are placed into a suitable output section following the strategy described in Orphan Sections. The option--uniquealso affects how sections are placed."discard"— all orphan sections are discarded, by placing them in the/DISCARD/section."warn"— the linker will place the orphan section as for"place"and also issue a warning."error"— the linker will exit with an error if any orphan section is found.
The default if --orphan-handling is not given is "place". 💅
--unique[=SECTION]— creates a separate output section for every input section matching SECTION, or if the optional wildcard SECTION argument is missing, for every orphan input section. An orphan section is one not specifically mentioned in a linker script. 👑
You may use this option multiple times on the command line; it prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script. Chaotic, but on purpose.
-v,--version,-V— displays the version number for ld. The-Voption also lists the supported emulations. See also the description of the--enable-linker-versionin Options,,Command-line Options, which can be used to insert the linker version string into a binary. 💖-x,--discard-all— deletes all local symbols. Bye bestie, you will not be missed. ✨-X,--discard-locals— bestie, we're yeeting ALL the temporary local symbols 💅 (these are the ones that start with those system-specific local label prefixes — usually.Lon ELF systems, or justLon those classic a.out systems).-ysymbol, `--trace-symbol=symbol — this one literally prints out the name of every linked file where symbol shows up. And the way you can use it? As many times as you want ✨ no cap. Heads up though: on a lot of systems you gotta slap an underscore in front of it.
Okay so when is this iconic? When you've got an undefined symbol in your link and you're sitting there like "who is referencing this?? where is it coming from??" 😭 — this is the one that tells you. iykyk.
-Ypath — drops path into the default library search path. This one only exists for Solaris compatibility, so it's giving "legacy tea" 🫖.-zkeyword — okay so this is the big one, the main character of the whole-zworld 👑. Here's every keyword it knows about:call-nop=prefix-addr,call-nop=suffix-nop,call-nop=prefix-byte,call-nop=suffix-byte— these decide what that 1-byte "NOP" padding looks like when an indirect call gets transformed into a call to a locally defined function,foo, through its GOT slot. So:call-nop=prefix-addrgenerates "0x67 call foo".call-nop=suffix-nopgenerates "call foo 0x90".call-nop=prefix-bytegenerates "byte call foo". Andcall-nop=suffix-bytegenerates "call foo byte". Supported for i386 and x86_64 🎀cet-report=none,cet-report=warning,cet-report=error— these control how the linker reports missingGNU_PROPERTY_X86_FEATURE_1_IBTandGNU_PROPERTY_X86_FEATURE_1_SHSTKproperties in the input.note.gnu.propertysection.cet-report=noneis the default, and it makes the linker NOT report missing properties in input files.cet-report=warningmakes it throw a warning for missing properties in input files.cet-report=errormakes it throw a straight-up error for missing properties in input files. Also note:ibtwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_IBTproperty report, andshstkwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_SHSTKproperty report. Supported for Linux/i386 and Linux/x86_64 💜combreloc,nocombreloc— combines a bunch of dynamic relocation sections and sorts them so dynamic symbol lookup caching gets better. Don't do the combining ifnocombreloc. Simple as that 💅common,nocommon— generate common symbols withSTT_COMMONtype during a relocatable link. If you wantSTT_OBJECTtype instead? That'snocommon.- `common-page-size=value — sets the page size that's most commonly used to value. The memory image layout gets optimized to minimize memory pages, assuming your system is running pages of that size 🧚
defs— reports unresolved symbol references coming from regular object files. And it does this EVEN if the linker is off creating a non-symbolic shared library. This option is the exact inverse of-z undefs, fyi.dynamic-undefined-weak,nodynamic-undefined-weak— these make undefined weak symbols dynamic when you're building a dynamic object, but only if they're referenced from a regular object file AND not forced local by symbol visibility or versioning. Want them to stay non-dynamic?nodynamic-undefined-weak. And if you give neither option, a target may default to either one being in force, or it might do some other selection of undefined weak symbols to make dynamic. Not all targets support these, so vibe check your target first 🙈execstack— marks the object as requiring an executable stack. dramatic but ok 💀global— only meaningful when building a shared object, bestie. It makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries 🌈globalaudit— also only meaningful in one specific case: building a dynamic executable. It marks the executable as requiring global auditing by setting the"DF_1_GLOBAUDIT"bit in the"DT_FLAGS_1"dynamic tag. And global auditing requires that any auditing library defined via the--depauditor-Pcommand-line options gets run for ALL dynamic objects loaded by the application. no skipping, periodt 👑ibtplt— generates Intel Indirect Branch Tracking (IBT) enabled PLT entries. Supported for Linux/i386 and Linux/x86_64 ✨ibt— generatesGNU_PROPERTY_X86_FEATURE_1_IBTin the.note.gnu.propertysection to indicate compatibility with IBT. This also impliesibtplt. Supported for Linux/i386 and Linux/x86_64.indirect-extern-access,noindirect-extern-access— generatesGNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESSin the.note.gnu.propertysection, telling everyone that the object file requires canonical function pointers and cannot be used with copy relocation. This option also impliesnoextern-protected-dataandnocopyreloc. Supported for i386 and x86-64. Andnoindirect-extern-access? That one removesGNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESSfrom the.note.gnu.propertysection. poof, gone 🦋initfirst— only meaningful when building a shared object (we love a specialist 💅). It marks the object so its runtime initialization happens BEFORE the runtime initialization of any other objects brought into the process at the same time. And symmetrically, the object's runtime finalization happens AFTER the runtime finalization of any other objects. first in, last out, main character energy fr fr ✨interpose— tells the dynamic loader to modify its symbol search order so that symbols in this shared library interpose ALL other shared libraries that aren't marked like this. iconic behavior 👑unique,nounique— when generating a shared library or some other dynamically loadable ELF object, this marks it as one that should (by default) only ever be loaded once, and only in the main namespace (when using"dlmopen"). This is mostly for fundamental libraries likelibc,libpthreadet al — the ones that don't really function correctly unless they're the sole instance of themselves 😭 This behavior can be overridden by the"dlmopen"caller, and it doesn't apply to certain loading mechanisms (like audit libraries). Alsonouniqueexists, so.lam-u48— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U48in the.note.gnu.propertysection to indicate compatibility with Intel LAM_U48. Supported for Linux/x86_64 💖lam-u57— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U57in the.note.gnu.propertysection to indicate compatibility with Intel LAM_U57. Supported for Linux/x86_64 💖lam-u48-report=none,lam-u48-report=warning,lam-u48-report=error— controls how the linker reports the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48property in the input.note.gnu.propertysection.lam-u48-report=noneis the default, and makes the linker not report missing properties in input files.lam-u48-report=warningmakes it issue a warning for missing properties in input files.lam-u48-report=errormakes it issue an error for missing properties in input files. Supported for Linux/x86_64 🌸lam-u57-report=none,lam-u57-report=warning,lam-u57-report=error— same deal, but for the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U57property in the input.note.gnu.propertysection.lam-u57-report=noneis the default and means the linker won't report missing properties in input files.lam-u57-report=warning= a warning for missing properties in input files.lam-u57-report=error= an error for missing properties in input files. Supported for Linux/x86_64 🌸lam-report=none,lam-report=warning,lam-report=error— the two-for-one version, bestie 🎀 this controls how the linker reports the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48ANDGNU_PROPERTY_X86_FEATURE_1_LAM_U57properties in the input.note.gnu.propertysection.lam-report=noneis the default (linker doesn't report missing properties in input files).lam-report=warning= warning for missing properties in input files.lam-report=error= error for missing properties in input files. Supported for Linux/x86_64.lazy— when generating an executable or shared library, this marks it to tell the dynamic linker to defer function call resolution to the point when the function is actually called (that's lazy binding), instead of at load time. Also fun fact: lazy binding IS the default 👑loadfltr— says the object's filters get processed immediately at runtime. no waiting around 💅- `max-page-size=value — sets the maximum memory page size supported to value.
mark-plt,nomark-plt— marks PLT entries with dynamic tags:DT_X86_64_PLT,DT_X86_64_PLTSZandDT_X86_64_PLTENT. And here's the vibe-check warning ⚠️ since this option stores a non-zero value in ther_addendfield ofR_X86_64_JUMP_SLOTrelocations, the resulting executables and shared libraries are incompatible with dynamic linkers — like the ones in older versions of glibc that don't ignorer_addendinR_X86_64_GLOB_DATandR_X86_64_JUMP_SLOTrelocations. Those old ones just don't ignore ther_addendfield ofR_X86_64_JUMP_SLOTrelocations, periodt. Supported for x86_64 💀muldefs— allows multiple definitions. yeah. that's it. take it or leave it 💅nocopyreloc— disables linker-generated.dynbssvariables that get used in place of variables defined in shared libraries. Heads up: this may result in dynamic text relocations 😬nodefaultlib— specifies that the dynamic loader's search for dependencies of this object should ignore ALL default library search paths. none of them. bye 👋nodelete— specifies that the object shouldn't be unloaded at runtime. it stays. forever. 🫶nodlopen— specifies that the object is not available to"dlopen".nodump— specifies that the object can not be dumped by"dldump".noexecstack— marks the object as NOT requiring an executable stack. the opposite ofexecstack, obviously ✨noextern-protected-data— don't treat protected data symbols as external when building a shared library. This option overrides the linker backend default, and you can use it to work around incorrect relocations against protected data symbols that the compiler generated. Careful though: updates on protected data symbols by another module aren't visible to the resulting shared library 👀 Supported for i386 and x86-64.
noreloc-overflow— turns OFF the relocation overflow check. only do this if you're certain there's not gonna be a dynamic relocation overflow at run-time, bestie. Supported for x86_64.memory-seal,nomemory-seal— tells the executable or shared library that allPT_LOADsegments should be sealed so nobody can mess with them afterwards (like flipping the protection flags, changing the segment size, or just straight up unmapping them 💀). it's a security hardening thing and it needs system support to actually work. it generatesGNU_PROPERTY_MEMORY_SEALin the.note.gnu.propertysection. sealed like a letter, periodt.now— when you're generating an executable or shared library, this marks it to tell the dynamic linker "hey, resolve ALL the symbols when the program starts, or when the shared library gets loaded by dlopen" instead of being lazy and waiting until the function is actually called for the first time. no deferred function call resolution here, we're doing it upfront. 💅origin— says the object needs$ORIGINhandling in its paths. that's it, that's the whole vibe.pack-relative-relocs,nopack-relative-relocs— generates compact relative relocation in position-independent executables and shared libraries. it addsDT_RELR,DT_RELRSZandDT_RELRENTentries to the dynamic section. it gets ignored when you're building a position-dependent executable or relocatable output.nopack-relative-relocsis the default, and it disables compact relative relocation. when you're linking against the GNU C Library, aGLIBC_ABI_DT_RELRsymbol version dependency on the shared C Library gets added to the output. Supported for i386 and x86-64.relro,norelro— creates an ELFPT_GNU_RELROsegment header in the object. this specifies a memory segment that should be made read-only after relocation, if it's supported. heads up though: specifyingcommon-page-sizesmaller than the system page size will render this protection ineffective 🚨.norelromeans don't create thatPT_GNU_RELROsegment.report-relative-reloc— reports dynamic relative relocations generated by the linker. Supported for Linux/i386 and Linux/x86_64.sectionheader,nosectionheader— generate the section header.nosectionheadermeans don't generate it.sectionheaderis the default ✨.separate-code,noseparate-code— creates a separate codePT_LOADsegment header in the object. this specifies a memory segment that should contain only instructions and must live in wholly disjoint pages from any other data.noseparate-codemeans don't create that separate codePT_LOADsegment.shstk— generatesGNU_PROPERTY_X86_FEATURE_1_SHSTKin the.note.gnu.propertysection to show compatibility with Intel Shadow Stack. Supported for Linux/i386 and Linux/x86_64.stack-size=value— specify a stack size for an ELFPT_GNU_STACKsegment. specifying zero will override any default non-zero sizedPT_GNU_STACKsegment creation.start-stop-gc,nostart-stop-gc— okay so when--gc-sectionsis in effect, a reference from a retained section to__start_SECNAMEor__stop_SECNAMEcauses all input sections namedSECNAMEto also be retained, ifSECNAMEis representable as a C identifier and either__start_SECNAMEor__stop_SECNAMEis synthesized by the linker.-z start-stop-gcdisables that effect, letting sections get garbage collected as if those special synthesized symbols were never defined.-z start-stop-gchas no effect on a definition of__start_SECNAMEor__stop_SECNAMEin an object file or linker script. a definition like that will prevent the linker from providing a synthesized__start_SECNAMEor__stop_SECNAMErespectively, and therefore blocks the special treatment by garbage collection for those references. iykyk.start-stop-visibility=value— specify the ELF symbol visibility for synthesized__start_SECNAMEand__stop_SECNAMEsymbols.valuemust be exactlydefault,internal,hidden, orprotected. if you don't give a-z start-stop-visibilityoption at all,protectedis used for compatibility with historical practice. however, it's highly recommended to use-z start-stop-visibility=hiddenin new programs and shared libraries so these symbols don't get exported between shared objects — which is not usually what's intended. 🫶text,notext,textoff— reports an error ifDT_TEXTRELis set, aka if the position-independent or shared object has dynamic relocations in read-only sections.notextortextoffmeans don't report that error.undefs— don't report unresolved symbol references from regular object files, whether you're creating an executable or a shared library. this option is the inverse of-z defs.unique-symbol,nounique-symbol— avoids duplicated local symbol names in the symbol string table. ifunique-symbolis used, it appends"."number""to duplicated local symbol names.nounique-symbolis the default.x86-64-baseline,x86-64-v2,x86-64-v3,x86-64-v4— specify the x86-64 ISA level needed in the.note.gnu.propertysection.x86-64-baselinegeneratesGNU_PROPERTY_X86_ISA_1_BASELINE.x86-64-v2generatesGNU_PROPERTY_X86_ISA_1_V2.x86-64-v3generatesGNU_PROPERTY_X86_ISA_1_V3.x86-64-v4generatesGNU_PROPERTY_X86_ISA_1_V4. Supported for Linux/i386 and Linux/x86_64.isa-level-report=none,isa-level-report=all,isa-level-report=needed,isa-level-report=used— specify how to report x86-64 ISA levels in input relocatable files.isa-level-report=none, which is the default, makes the linker not report x86-64 ISA levels in input files at all.isa-level-report=allmakes the linker report needed and used x86-64 ISA levels in input files.isa-level-report=neededmakes the linker report needed x86-64 ISA levels in input files.isa-level-report=usedmakes the linker report used x86-64 ISA levels in input files. Supported for Linux/i386 and Linux/x86_64.
Other keywords are ignored for Solaris compatibility. (not us being generous, it's just a compat thing ✨)
--gnu-tls-tag,--no-gnu-tls-tag— adds aGLIBC_ABI_GNU_TLSversion tag dependency in output programs and shared libraries when linking against glibc, if the input relocatable object files call___tls_get_addr. heads up: the output will fail to load and run at run-time against glibc that doesn't define theGLIBC_ABI_GNU_TLSversion tag. unless it's disabled by the--disable-gnu-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add theGLIBC_ABI_GNU_TLSversion tag dependency if inputs have a___tls_get_addrcall andlibc.sodefines theGLIBC_ABI_GNU_TLSversion tag. Supported for Linux/i386.--gnu2-tls-tag,--no-gnu2-tls-tag— adds aGLIBC_ABI_GNU2_TLSversion tag dependency in output programs and shared libraries when linking against glibc, if the input relocatable object files have anR_386_TLS_DESC_CALLorR_X86_64_TLSDESC_CALLrelocation. again, the output will fail to load and run at run-time against glibc that doesn't define theGLIBC_ABI_GNU2_TLSversion tag. unless disabled by the--disable-gnu2-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add theGLIBC_ABI_GNU2_TLSversion tag dependency if inputs have anR_386_TLS_DESC_CALLorR_X86_64_TLSDESC_CALLrelocation andlibc.sodefines theGLIBC_ABI_GNU2_TLSversion tag. Supported for Linux/i386 and Linux/x86_64.
-(archives-),--start-grouparchives--end-group— the archives should be a list of archive files, bestie. they can be explicit file names, or-loptions.
the specified archives get searched repeatedly until no new undefined references are created. normally an archive is only searched once, in the order it shows up on the command line. so if a symbol in that archive is needed to resolve an undefined symbol referred to by an object in an archive that appears later on the command line, the linker would just... not be able to resolve that reference 😭. by grouping the archives, they all get searched repeatedly until all possible references are resolved. slay
this option is not allowed within a--start-lib/--end-liboption pair.
using this option has a significant performance cost. it's best to use it only when there are unavoidable circular references between two or more archives. be mindful, queen.
--start-libobjects--end-lib— the objects should be a list of object files.
the specified objects are treated as if they were members of an archive whose name has been placed at the location of --start-lib on the command line. all the usual linker archive handling properties and command line options apply to such an artificial archive. 🎀
this option may be used multiple times, in which case each set of the objects specified gets treated as an individual archive. nesting this option is not allowed though.
options that affect archive processing are not allowed between --start-lib and --end-lib — it would make no sense to apply them midway through handling an archive. these options include: -(/--start-group, -)/--end-group, --whole-archive, and --no-whole-archive, as well as --pop-state where it would change the state of the --whole-archive setting.
--accept-unknown-input-arch,--no-accept-unknown-input-arch— tells the linker to accept input files whose architecture can't be recognised. the assumption is that you know what you're doing and deliberately want to link in these unknown input files 🙈. this was the default behaviour of the linker before release 2.14. the default behaviour from release 2.14 onwards is to reject such input files, and so the--accept-unknown-input-archoption was added to restore the old behaviour.--as-needed,--no-as-needed— okay so this one is obsessed territory because it changes whether aDT_NEEDEDtag gets slapped onto an ELF for dynamic libraries mentioned on the command line after the--as-neededoption. Normally? The linker is out here adding aDT_NEEDEDtag for every single dynamic library you mention, bestie, whether or not it's actually needed. Rude, honestly.--as-neededsays: only emit aDT_NEEDEDtag for a library that, at that exact point in the link, satisfies a non-weak undefined symbol reference from a regular object file — or, if the library isn't found in theDT_NEEDEDlists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. And the way that object files or libraries appearing on the command line after the library in question do not affect whether the library is seen as needed — it's giving archive-extraction rules, fr fr.--no-as-neededrestores the default behaviour.
Note: on Linux based systems,--as-neededalso has an affect on the behaviour of the--rpathand--rpath-linkoptions. Go peek at the description of--rpath-linkfor the details, iykyk. 💅
--add-needed,--no-add-needed— these two have been deprecated 😭 because their names are just too similar to--as-neededand--no-as-needed(chaos). They got replaced by--copy-dt-needed-entriesand--no-copy-dt-needed-entries. Periodt.-assertkeyword — this option is ignored for SunOS compatibility. That's it, that's the whole vibe. 🙈-Bdynamic,-dy,-call_shared— link against dynamic libraries. Only meaningful on platforms where shared libraries are supported (so, not everywhere, bestie). On those platforms this is normally the default. The different variants exist for compatibility with various systems — same energy, different names. You can use this option multiple times on the command line: it affects library searching for-loptions which follow it. 👑-Bgroup— sets the"DF_1_GROUP"flag in the"DT_FLAGS_1"entry in the dynamic section. This makes the runtime linker handle lookups in this object and its dependencies only inside the group.--unresolved-symbols=report-allis implied. Only meaningful on ELF platforms which support shared libraries. ✨-Bstatic,-dn,-non_shared,-static— do not link against shared libraries. Again, only meaningful on platforms for which shared libraries are supported, and again the variants are for compatibility with various systems. Use it multiple times on the command line if you want: it affects library searching for-loptions which follow it. This option also implies--unresolved-symbols=report-all. Fun fact: it can be used with-shared— doing so means a shared library is being created but all of the library's external references must be resolved by pulling in entries from static libraries. Slay. 🔥-Bsymbolic— when creating a shared library, bind references to global symbols to the definition within the shared library, if any. Normally it's possible for a program linked against a shared library to override the definition inside it — this says nope, we're staying home. Only meaningful on ELF platforms which support shared libraries. 💜-Bsymbolic-functions— same idea, but only for global function symbols: bind references to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries. 🦋-Bno-symbolic— cancels previously specified-Bsymbolicand-Bsymbolic-functions. Undo button, basically. 🎀--dynamic-list=*dynamic-list-file*— hand the linker the name of a dynamic list file. Typically used when creating shared libraries to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library, or when creating dynamically linked executables to specify a list of symbols which should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries.
The format of the dynamic list is the same as the version node without scope and node name. See VERSION for more info. 📝
--dynamic-list-data— include all global data symbols to the dynamic list. All of them. No cap. 🌈--dynamic-list-cpp-new— provide the builtin dynamic list for C++operator newanddelete. Mainly useful for building sharedlibstdc++. ⭐--dynamic-list-cpp-typeinfo— provide the builtin dynamic list for C++ runtime type identification. 💫--check-sections,--no-check-sections— asks the linker not to check section addresses after they've been assigned to see if there are any overlaps. Normally the linker does perform this check, and if it finds overlaps it produces suitable error messages (iconic behaviour honestly). The linker does know about, and does make allowances for, sections in overlays. Default behaviour can be restored with--check-sections. Also, section overlap is not usually checked for relocatable links — you can force checking in that case by using--check-sections. 🫶--copy-dt-needed-entries,--no-copy-dt-needed-entries— this affects how dynamic libraries referred to byDT_NEEDEDtags inside ELF dynamic libraries mentioned on the command line get treated. Normally the linker won't add aDT_NEEDEDtag to the output binary for each library mentioned in aDT_NEEDEDtag in an input dynamic library. With--copy-dt-needed-entriesthough? Any dynamic libraries that follow it will have theirDT_NEEDEDentries added. Default behaviour comes back with--no-copy-dt-needed-entries.
It also affects symbol resolution in dynamic libraries. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line get recursively searched — following their DT_NEEDED tags to other libraries — in order to resolve symbols required by the output binary. With the default setting, the searching of dynamic libraries that follow it stops with the dynamic library itself, and no DT_NEEDED links will be traversed to resolve symbols. Vibe check: recursive vs. not. 🌀
--cref— output a cross reference table. If a linker map file is being generated, the cross reference table gets printed to the map file; otherwise it goes to standard output. 📋
The format is intentionally simple, so it can be easily processed by a script if necessary. Symbols are printed out, sorted by name. For each symbol, a list of file names is given. If the symbol is defined, the first file listed is the location of the definition. If the symbol is defined as a common value, then any files where this happens appear next. Finally, any files that reference the symbol are listed. Sorted, structured, organized. 💚
--ctf-variables,--no-ctf-variables— so the CTF debuginfo format supports a section which encodes the names and types of variables found in the program which do not appear in any symbol table. These variables clearly can't be looked up by address by conventional debuggers, so the space used for their types and names is usually wasted: the types are usually small but the names are often not.--ctf-variablescauses the generation of such a section. Default behaviour can be restored with--no-ctf-variables. 🧚--ctf-share-types=*method*— adjusts the method used to share types between translation units in CTF. Pick your fighter:share-unconflicted— put all types that do not have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default. 🎀share-duplicated— put only types that occur in multiple translation units into the shared dictionary: types with only one definition go into per-translation-unit dictionaries. Types with ambiguous definitions in multiple translation units always go into per-translation-unit dictionaries. This tends to make the CTF larger, but may reduce the amount of CTF in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime. ⚡
--no-define-common— inhibits the assignment of addresses to common symbols. The script command"INHIBIT_COMMON_ALLOCATION"has the same effect.
This option allows decoupling the decision to assign addresses to Common symbols from the choice of the output file type; otherwise a non-Relocatable output type forces assigning addresses to Common symbols. Using --no-define-common allows Common symbols that are referenced from a shared library to be assigned addresses only in the main program. This eliminates the unused duplicate space in the shared library, and also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution. Declutter queen. 💅
--force-group-allocation— causes the linker to place section group members like normal input sections, and to delete the section groups. This is the default behaviour for a final link, but this option can be used to change the behaviour of a relocatable link (-r). The script command"FORCE_GROUP_ALLOCATION"has the same effect. 🧩--defsym=*symbol*=*expression*— create a global symbol in the output file, containing the absolute address given by expression. You may use this option as many times as necessary to define multiple symbols on the command line. A limited form of arithmetic is supported for the expression in this context: you may give a hexadecimal constant or the name of an existing symbol, or use+and-to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider using the linker command language from a script.
Note: there should be no white space between symbol, the equals sign ("="), and expression. Zero. None. 🌸
The linker processes --defsym arguments and -T arguments in order, bestie. So if you put --defsym before -T, your symbol gets defined before the linker script from -T is even processed. Put --defsym after -T and the symbol lands after the script's been processed. Same flags, different order, different outcome — and that difference actually matters for any expressions inside the linker script that reference your --defsym symbols. Which order is "correct" depends entirely on what you're trying to do, so like… think about it. 🙈
--demangle[=style],--no-demangle— these control whether symbol names get demangled in error messages and other output. When demangling is on, the linker tries to make symbol names actually readable: it strips leading underscores if the object file format uses them, and converts C++ mangled names back into the human-readable ones you'd recognize. Different compilers use different mangling styles, so that optional style argument lets you pick the right one for your compiler. Fun fact: the linker demangles by default unless the environment variableCOLLECT_NO_DEMANGLEis set — and these options let you override that default. ✨-Ifile,--dynamic-linker=file— sets the name of the dynamic linker. This only means anything when you're generating dynamically linked ELF executables. The default dynamic linker is normally correct, so lowkey don't touch this unless you actually know what you're doing. 💅--no-dynamic-linker— when you're producing an executable, this omits the request for a dynamic linker to be used at load-time. Only meaningful for ELF executables that contain dynamic relocations, and it usually requires entry point code capable of processing those relocations. So, niche but iconic.--embedded-relocs— basically the--emit-relocsoption's cousin, except the relocs get stored in a target-specific section. Heads up: only the BFIN, CR16 and M68K targets support this one.--disable-multiple-abs-defs— does literally what it says: it does not allow multiple definitions with symbols included in the filename invoked by-Ror--just-symbols.--fatal-warnings,--no-fatal-warnings— treat every single warning as an error. Living dangerously? The default behaviour can be brought back with--no-fatal-warnings.-w,--no-warnings— do not display any warning or error messages. This overrides--fatal-warningsif that's been turned on. Sounds chaotic but it's genuinely useful when you already know the output binary won't work and you still need to create it anyway. 🤷--force-exe-suffix— makes sure an output file has a.exesuffix.
So the deal is: if a successfully built fully linked output file doesn't have a .exe or .dll suffix, this option forces the linker to copy the output file to one of the same name with a .exe suffix. It's a lifesaver when you're using unmodified Unix makefiles on a Microsoft Windows host, because some versions of Windows just will not run an image unless it ends in .exe. periodt.
--gc-sections,--no-gc-sections— enables garbage collection of unused input sections. On targets that don't support it, it just gets ignored. Want the default back (aka no garbage collection at all)? Pass--no-gc-sectionson the command line. One note: garbage collection for COFF and PE format targets is supported, but the implementation is currently considered experimental. 🙈
So how does --gc-sections decide which input sections count as "used"? It examines symbols and relocations. The section containing the entry symbol gets kept, and so does every section containing symbols that were left undefined on the command-line, plus sections containing symbols referenced by dynamic objects. When you're building shared libraries, the linker has to assume any visible symbol is referenced. Once that initial set is locked in, the linker recursively marks as used any section referenced by their relocations. Peep --entry, --undefined, and --gc-keep-exported. 👑
This option can be set when doing a partial link (enabled with option -r). If you do that, the root of symbols kept must be explicitly specified — either by one of --entry, --undefined, or --gc-keep-exported, or by an ENTRY command in the linker script.
And as a GNU extension: ELF input sections marked with the SHF_GNU_RETAIN flag will not be garbage collected. Slay.
--print-gc-sections,--no-print-gc-sections— lists every section removed by garbage collection, printed onstderr. Only effective if garbage collection has actually been enabled via the--gc-sectionsoption. Default behaviour (not listing removed sections) comes back with--no-print-gc-sectionson the command line.--gc-keep-exported— when--gc-sectionsis enabled, this stops garbage collection of unused input sections that contain global symbols with default or protected visibility. It's meant for executables where unreferenced sections would otherwise get garbage collected regardless of the external visibility of the symbols inside them. Note that it has no effect when linking shared objects, because that's already the default behaviour there. Also: only supported for ELF format targets.--print-output-format— prints the name of the default output format (which may be influenced by other command-line options). That's the exact string that would show up in anOUTPUT_FORMATlinker script command.--print-memory-usage— prints the used size, total size and used size of memory regions created with theMEMORYcommand. Super handy on embedded targets when you want a quick read on how much free memory you've got left. The output is one headline plus one line per region, and it's both human readable and easily parsable by tools. Here's what it looks like:
Memory region Used Size Region Size %age Used
ROM: 256 KB 1 MB 25.00%
RAM: 32 B 2 GB 0.00%Note: if you're trying to find out about the memory usage of the linker itself, that's what the --stats option is for. Different vibe entirely. 💜
--help— prints a summary of the command-line options on the standard output and exits. baby's first flag 🫶--target-help— prints a summary of all target-specific options on the standard output and exits.-Map=mapfile— prints a link map to the file mapfile. (See the description of the-Moption, above.) If mapfile is just the character-, the map gets written tostdoutinstead.
And here's a fun twist: specifying a directory as mapfile makes the linker write the map as a file inside that directory. Normally the name of that file is computed as the basename of the output file with .map appended. But if the special character % is used, it gets replaced by the full path of the output file. And if there are any characters after the % symbol, then .map is no longer appended. Watch how this plays out:
-o foo.exe -Map=bar [Creates ./bar]
-o ../dir/foo.exe -Map=bar [Creates ./bar]
-o foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o foo.exe -Map=% [Creates ./foo.exe.map]
-o ../dir/foo.exe -Map=% [Creates ../dir/foo.exe.map]
-o foo.exe -Map=%.bar [Creates ./foo.exe.bar]
-o ../dir/foo.exe -Map=%.bar [Creates ../dir/foo.exe.bar]
-o ../dir2/foo.exe -Map=../dir/% [Creates ../dir/../dir2/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]Specifying more than one % character is an error. 😤
If the map file already exists, it will be overwritten by this operation. You've been warned.
--no-keep-memory—ldnormally optimizes for speed over memory usage by caching symbol tables of input files in memory. This option flips that: it tellsldto optimize for memory usage instead by rereading symbol tables as necessary. You might need this ifldruns out of memory while linking a large executable. 😭--no-undefined,-z defs— reports unresolved symbol references from regular object files. It does this even if the linker is creating a non-symbolic shared library. The switch--[no-]allow-shlib-undefinedcontrols the behaviour for reporting unresolved references found in shared libraries being linked in.
The effects of this option can be reverted by using -z undefs.
--allow-multiple-definition,-z muldefs— normally when a symbol is defined multiple times, the linker reports a fatal error. These options allow multiple definitions, and the first definition will be used.--allow-shlib-undefined,--no-allow-shlib-undefined— allows or disallows undefined symbols in shared libraries. This is similar to--no-undefinedexcept it decides behaviour when the undefined symbols live in a shared library rather than a regular object file. It does not affect how undefined symbols in regular object files are handled.
Default behaviour: report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable — but allow them if the linker is being used to create a shared library.
And why would you ever allow undefined symbol references in shared libraries specified at link time? Two reasons, bestie:
- A shared library specified at link time may not be the same as the one available at load time, so the symbol might actually be resolvable at load time.
- There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are just… normal.
The BeOS kernel, for example, patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for instance, to dynamically select an appropriate memset function. iconique 🌸
--error-handling-script=scriptname— okay so bestie, if you pass this, the linker literally calls up scriptname every single time it hits an error. 💅 As of rn only two kinds of error get this treatment tho: missing symbols and missing libraries. The script gets handed two args — the keyword"undefined-symbol"or"missing-lib", plus the name of the undefined symbol or the missing library. The whole vibe is that your script goes "omg here's where that thing might be??" and then after it finishes, the normal linker error message still shows up anyway (the script is a suggestion bestie, not a replacement 🫶).
Real talk: whether this option even exists is controlled by a configure-time switch, so some builds just won't have it. It's giving optional, not guaranteed. 😭
--no-undefined-version— normally when a symbol has an undefined version, the linker just ignores it. ✨ This option says "absolutely not" and makes it a fatal error instead. no thoughts, just consequences.--default-symver— creates and uses a default symbol version (the soname, bestie) for all your unversioned exported symbols. 🎀--default-imported-symver— same energy, opposite direction: creates and uses a default symbol version (again, the soname) for unversioned imported symbols. 💖--no-warn-mismatch— so normallyldthrows a lil error if you try to link input files that are mismatched for some reason — maybe they got compiled for different processors, or different endiannesses, you know how it is. 😭 This option tellsldto just silently allow those possible errors. lowkey wild.
⚠️ This one should only be used with care, and only in cases where you've already taken some special action that makes sure the linker errors are inappropriate. It's giving "I know what I'm doing" and if you don't know what you're doing... bestie. 🩷
--no-warn-search-mismatch— normallyldgives you a warning if it finds an incompatible library during a library search. This one just silences that warning. shhh, no thoughts, no warnings. 🤫--no-whole-archive— turns OFF the effect of--whole-archivefor the archive files that come after it. 🦋
Not allowed inside a--start-lib/--end-liboption pair, bestie. don't try it. 💀
--no-link-mapless— rejects archives that lack an index aka symbol map, for all the subsequent archives mentioned on the command line. If such a file shows up, boom, a link error occurs. This is the traditional behavior, periodt. 👑--noinhibit-exec— keeps the executable output file whenever it's still usable. Normally the linker is like "nope, errors happened" and won't produce an output file at all — it exits without writing one if it issues any error whatsoever. This option is the "okay but keep it anyway, it still works" energy. 🔥-nostdlib— only searches library directories that were explicitly specified on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line, yes those too) are just ignored. 💅--oformat=output-format—ldcan be configured to support more than one kind of object file, and if yours is, you can use--oformatto pick the binary format for the output object file. ✨
Even with alternative object formats supported, you don't usually need to set this, bc ld should already be configured to default to the most usual format on each machine. output-format is a text string — the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i, iykyk.) 🧚
The script command OUTPUT_FORMAT can also specify the output format, but this option overrides it. main character energy override, honestly.
--out-implib file— creates an import library in file corresponding to the executable the linker is generating (eg. a DLL or ELF program). This import library (which should be called*.dll.aor*.afor DLLs) can be used to link clients against the generated executable, and this whole behavior makes it possible to skip a separate import library creation step (eg.dlltoolfor DLLs). ate that. 💅
Only available for the PE and ELF targetted ports of the linker. 🎀
-pie,--pic-executable— creates a position independent executable. rn this is only supported on ELF platforms. 🦋
Position independent executables get relocated by the dynamic linker to the virtual address the OS chooses for them, and that address can vary between invocations. They're marked ET_DYN in the ELF file header, but bestie, they differ from shared libraries in a bunch of ways. In particular: defined symbols in a PIE can not be overridden by another object by default, whereas they can in a shared library. 💖
-no-pie— creates a position dependent executable. This is the default, no cap. ✨-qmagic— this option is ignored, for Linux compatibility. literally just vibes, does nothing. 💀-Qy— this option is ignored, for SVR4 compatibility. same energy, bestie. 🎀--relax,--no-relax— an option with machine dependent effects. Only supported on a few targets, so vibe check your platform first. 🌈
On some platforms --relax performs target specific, global optimizations that become possible once the linker resolves addressing in the program — stuff like relaxing address modes, synthesizing new instructions, selecting shorter versions of current instructions, and combining constant values. it's giving glow-up ✨
On some platforms these link time global optimizations may make symbolic debugging of the resulting executable impossible. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors. 😭
On platforms where the feature is supported, --no-relax disables it. On platforms where the feature is not supported, both --relax and --no-relax are accepted... but ignored. 🙈
--retain-symbols-file=filename— retains only the symbols listed in filename, discarding all the others. filename is just a flat file, one symbol name per line. 📄
This one's especially useful in environments (like VxWorks, shoutout) where a large global symbol table gets accumulated gradually, so you can conserve run-time memory. 💜
--retain-symbols-file does not discard undefined symbols, or symbols needed for relocations. 🫶
You may only specify--retain-symbols-fileonce on the command line. It overrides-sand-S. periodt. 💅
-rpath=dir— adds a directory to the runtime library search path. This is used when linking an ELF executable with shared objects. All-rpatharguments get concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime. 🦋
-rpath is also used when locating shared objects that are needed by shared objects explicitly included in the link — see the description of the -rpath-link option. Searching -rpath this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option. ✨
If -rpath is not used when linking an ELF executable, the contents of the environment variable LD_RUN_PATH will be used if it is defined. 👀
-rpath can also be used on SunOS. By default, on SunOS, the linker forms a runtime search path out of all the -L options it's given. If a -rpath option is used, the runtime search path gets formed exclusively using the -rpath options, ignoring the -L options. This can be useful when using gcc, which adds many -L options that may be on NFS mounted file systems. 😮💨
For compatibility with other ELF linkers: if the -R option is followed by a directory name rather than a file name, it's treated as the -rpath option. 💖
-rpath-link=dir— when using ELF or SunOS, one shared library may require another. This happens when anld -sharedlink includes a shared library as one of the input files. 👑
When the linker encounters such a dependency while doing a non-shared, non-relocatable link, it'll automatically try to locate the required shared library and include it in the link, if it's not included explicitly. In such a case, several directories are searched, as described below. The -rpath-link option specifies the first set of directories to search. This option may specify a sequence of directory names either by providing a list of names separated by colons, or by appearing multiple times. 💅
The tokens $ORIGIN and $LIB can appear in these search directories. They'll be replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN, and either lib — for 32-bit binaries — or lib64 — for 64-bit binaries — in the case of $LIB. 🎀
The alternative form of these tokens — ${ORIGIN} and ${LIB} — can also be used. The token $PLATFORM is not supported. 🙈
The --rpath-link option should be used with caution as it overrides the search path that may have been hard compiled into a shared library. In such a case it's possible to unintentionally use a different search path than the runtime linker would have used. fr fr, be careful. ⚠️
When additional shared libraries are required, the linker searches directories in the order listed below to find them. Note however that this only applies to additional libraries needed to satisfy already included shared libraries. It does not apply to libraries included via the -l command line option. Searches for -l libraries are only conducted in directories specified by the -L option. ok order time, bestie:
- Any directories specified by
-rpath-linkoptions. 🥇 - Any directories specified by
-rpathoptions. The difference between-rpathand-rpath-linkis that directories specified by-rpathoptions are included in the executable and used at runtime, whereas-rpath-linkis only effective at link time. Searching-rpaththis way is only supported by native linkers and cross linkers which have been configured with the--with-sysrootoption. 🥈 - On an ELF system, for native linkers, if the
-rpathand-rpath-linkoptions were not used, search the contents of the environment variableLD_RUN_PATH. 🥉 - On SunOS, if the
-rpathoption was not used, search any directories specified using-Loptions. 🌸 - For a native linker, search the contents of the environment variable
LD_LIBRARY_PATH. 💜 - For a native ELF linker, the directories in
DT_RUNPATHorDT_RPATHof a shared library are searched for shared libraries needed by it. TheDT_RPATHentries are ignored ifDT_RUNPATHentries exist. 🔥
- If you're linking for a Linux system and the file
/etc/ld.so.confexists, bestie, the linker reads the list of directories in that file. ✨ Heads up though: the path to this file gets the"sysroot"value prefixed onto it (if one is defined), and then any"prefix"string if the linker was configured with the--prefix=<path>option. - For a native linker on a FreeBSD system: whatever directories the
"_PATH_ELF_HINTS"macro says, the one defined in theelf-hints.hheader file. 🦋 - Any directories given by a
"SEARCH_DIR"command inside a linker script handed to you on the command line — that includes scripts passed with-Tbut not-dT. - The default directories, which are normally
/liband/usr/lib. (The classics. 💅) - Any directories specified by a plugin, via
LDPT_SET_EXTRA_LIBRARY_PATH. - Any directories specified by a
"SEARCH_DIR"command in a default linker script.
Note though, on Linux-based systems there's an extra little caveat: if the --as-needed option is active, and a shared library is found that would normally satisfy the search, but this library does not have a DT_NEEDED tag for libc.so, and there's another shared library later on in the set of search directories that also satisfies the search and this second one does have a DT_NEEDED tag for libc.so, then the second library gets picked instead of the first. Okay?? Plot twist. 😭
And if the required shared library just isn't found at all? The linker issues a warning and keeps the link going. No crash, no drama, just a lil heads up. 🫶
--section-ordering-file=script— this one lets you augment the current linker script with extra mapping of input sections to output sections. 🌸 The file has to use the exact same syntax for"SECTIONS"as normal linker scripts do, but like... it should do absolutely nothing else besides place input sections into output sections.@pxref{SECTIONS}
Here's the second constraint, bestie, and it's important: the section ordering script can only reference output sections that are already defined by whichever linker script is currently in use (i.e. the default linker script, or a script specified on the command line). The glow-up here is that the input sections get mapped to the start of the output sections, so you can guarantee the ordering of sections within the output section. 👑
For example, imagine the default linker script looks like this:
SECTIONS {
.text : { *(.text.hot) ; *(.text .text.*) }
.data : { *(.data.big) ; *(.data .data.*) }
}Then if a section ordering file like this is used:
.text : { *(.text.first) ; *(.text.z*) }
.data : { foo.o(.data.first) ; *(.data.small) }That would be equivalent to a linker script like this:
SECTIONS {
.text : { *(.text.first) ; *(.text.z*) ; *(.text.hot) ; *(.text .text.*) }
.data : { foo.o(.data.first) ; *(.data.small) ; *(.data.big) ; *(.data .data.*) }
}And the whole point? The section ordering file lets you order the sections you care about without having to stress over any other sections, or memory regions, or literally anything else. Main character energy for real. ✨
-shared,-Bshareable— makes a shared library. 🎀 Right now this is only supported on ELF, XCOFF and SunOS platforms. On SunOS, the linker will automatically create a shared library if the-eoption isn't used and there are undefined symbols in the link. Not me getting a library for free 🫶--sort-common,--sort-common=ascending,--sort-common=descending— tellsldto sort the common symbols by alignment, either ascending or descending, when it drops them into the appropriate output sections. 💖 The symbol alignments it considers are sixteen-byte or larger, eight-byte, four-byte, two-byte, and one-byte. Why? To prevent gaps between symbols caused by alignment constraints — no awkward dead air in your layout. If you don't specify a sorting order then descending is what you get. Periodt.--sort-section=name— this applies"SORT_BY_NAME"to every wildcard section pattern in the linker script. 🔥--sort-section=alignment— this applies"SORT_BY_ALIGNMENT"to every wildcard section pattern in the linker script. 🌈--spare-dynamic-tags=count— sets how many empty slots to leave in the.dynamicsection of ELF shared objects. Those empty slots might be needed by post-processing tools, like the prelinker. 💅 The default is5.--split-by-file[=size]— similar to--split-by-reloc, except it creates a new output section for each input file oncesizeis reached. If you don't give asize, it defaults to a size of1. 🍓--split-by-reloc[=count]— tries to create extra sections in the output file so that no single output section contains more thancountrelocations. 🌸 Super useful when you're generating huge relocatable files to download into certain real time kernels using the COFF object file format — because COFF cannot represent more than65535relocations in a single section. 😭
Careful though: this will fail to work with object file formats that don't support arbitrary sections. And the linker won't split up individual input sections for redistribution, so if one single input section has more than count relocations, one output section is gonna contain that many relocations. No cap.
count defaults to a value of 32768.
--stats[=filename]— computes and displays statistics about how the linker operated, like execution time and memory usage. 📊
If you don't supply the optional filename argument, only basic info gets reported, and it goes to the standard error output stream. If you do supply filename, extended information gets written to the named file. If filename is set to just the - symbol, then the extended info goes to the standard output stream. And if filename starts with + then the file is opened in append mode instead of overwrite mode. 💜
If the -Map option has been enabled then the information is also recorded in the map file as well. Note: if both the --stats option and the -Map options have been given filename arguments and those arguments match, then the information only gets written out once, not twice. We love efficiency. ✨
If the "LD_STATS" environment variable is defined then this behaves like the --stats option. If the variable's value is a string then that gets used as the name of a file into which the information should be recorded. Otherwise the info goes to the standard output stream. Using the environment variable means you can record stats without having to alter the linker's command line — so sneaky, so convenient. Note: if both the environment variable and the --stats option are used, the --stats option takes precedence. 👑
The extended information reported includes the cpu time used and, if the getrusage() system library call is available, then maximum set size and the user and system run times as well. And on top of that, if the mallinfo or mallinfo2 system library calls are available then the total memory usage gets reported.
The info is displayed for individual parts of the linking process, which are referred to as phases. 🦋 Note that individual phases can contain or overlap with each other, so please don't assume that the overall resources used by the linker is the sum of the resources used by the individual phases. It's giving loosely correlated, not additive.
Also, the information gets reported for a special phase called ALL, which covers the entire linking process. 🌈
When extended information is being reported, the linker version, command line arguments and linker start time are also included. That makes it way easier to handle the situation where multiple links are being invoked by a build system, and to identify exactly which arguments were responsible for producing the statistics that are reported. 🔍
The extended output looks something like this:
Stats: linker version: (GNU Binutils) 2.44.50.20250401
Stats: linker started: Wed Apr 2 09:36:41 2025
Stats: args: ld -z norelro -z nomemory-seal -z no-separate-code -o a.out [...]
Stats: phase cpu time rss user time system time memory
Stats: name (microsec) (KiB) (seconds) (seconds) (KiB)
Stats: ALL 390082 217740 0 0 25219440
Stats: ctf processing 12 0 0 0 0
Stats: string merge 1324 0 0 0 406544
Stats: parsing 349 288 0 0 119792
Stats: plugins 1 0 0 0 0
Stats: processing files 259616 214524 0 0 31569120
Stats: write 116493 0 0 0 48096--no-stats— disables the reporting of usage statistics, in case it got enabled via the--statscommand line option or theLD_STATSenvironment variable. Turning the vibes back off. 🙈--sysroot=directory— use directory as the location of the sysroot, overriding the configure-time default. 🎀 This option is only supported by linkers that were configured using--with-sysroot. Sorry to the rest of y'all.--task-link— this is used by COFF/PE based targets to create a task-linked object file where all of the global symbols have been converted to statics. 💅--traditional-format— for some targets, the output oflddiffers in some ways from the output of some existing linker. This switch asksldto use the traditional format instead. 🌸
For example, on SunOS, ld combines duplicate entries in the symbol string table. That can shrink an output file with full debugging information by over 30 percent. 🔥 Unfortunately the SunOS "dbx" program can't read the resulting program ("gdb" has no trouble though 💀). The --traditional-format switch tells ld to not combine duplicate entries.
--section-start=sectionname=org— bestie, this pins a section in the output file to an absolute address, the one you hand over asorg. You can use it as many times as you want to nail down multiple sections on the same command line.orghas to be a single hexadecimal integer, and for compat with other linkers you can totally skip the leading0xthat hex usually comes with. 💅
Heads up: there must be no white space betweensectionname, the equals sign (=), andorg. None. Zero. Not even one little space. 🙈
--image-base=org— the base-address move, but it behaves differently depending on your format:- With ELF, it's the same as
-Ttext-segment, and honestly both options are effectively setting the base address of your ELF executable. - With PE, you use the value as the base address of your program or dll. That's the lowest memory location used when your program or dll gets loaded. To cut down on relocating and make your dlls faster, each one should have its own unique base address and not overlap any other dlls. Default is
0x400000for executables, and0x10000000for dlls. ✨
- With ELF, it's the same as
-Tbss=org— same as--section-start, with.bssas thesectionname.-Tdata=org— same as--section-start, with.dataas thesectionname.-Ttext=org— same as--section-start, with.textas thesectionname.-Ttext-segment=org— when you're creating an ELF executable, this sets the address of the first byte of the first segment. And here's the tea: when-pieis used together with-Ttext-segment=org, the output executable is markedET_EXEC, so the address of that first byte of the text segment is guaranteed to beorgat run time. 👑-Trodata-segment=org— when you're creating an ELF executable or shared object for a target where the read-only data lives in its own segment, separate from the executable text, this sets the address of the first byte of that read-only data segment.-Tldata-segment=org— when you're creating an ELF executable or shared object for the x86-64 medium memory model, this sets the address of the first byte of the ldata segment.--unresolved-symbols=method— this is the "what do we do about unresolved symbols" dial. There are four possible values for method:ignore-all— do not report any unresolved symbols. Like, pretend they don't exist. 💀report-all— report all unresolved symbols. This is the default.ignore-in-object-files— report unresolved symbols that are contained in shared libraries, but ignore them if they come from regular object files.ignore-in-shared-libs— report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. This is lowkey useful when you're creating a dynamic binary and you know all the shared libraries it should be referencing are already on the linker's command line.
The behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option.
Normally the linker generates an error message for each reported unresolved symbol, but the --warn-unresolved-symbols option can turn that into a warning instead. 🫶
--dll-verbose,--verbose[=NUMBER]— shows you the version number forldand lists the linker emulations supported. It also displays which input files can and cannot be opened, plus the linker script the linker is using. And if the optionalNUMBERargument is> 1, plugin symbol status gets displayed too. So much info, slay. 🌈--version-script=version-scriptfile— names the version script you're handing to the linker. Typically used when creating shared libraries, to specify extra info about the version hierarchy for the library being created. It's only fully supported on ELF platforms that support shared libraries — seeVERSION. It's partially supported on PE platforms, which can use version scripts to filter symbol visibility in auto-export mode: any symbols marked local in the version script will not be exported.--warn-common— warns when a common symbol gets combined with another common symbol, or with a symbol definition. Unix linkers allow this kinda sloppy practice, but linkers on some other operating systems do not. So this option helps you find potential problems from combining global symbols. Sadly, some C libraries use this practice, so you may get warnings about symbols in the libraries as well as in your programs. 😭
There are three kinds of global symbols, illustrated here by C examples:
int i = 1;A definition, which goes in the initialized data section of the output file.
extern int i;An undefined reference, which does not allocate space. There must be either a definition or a common symbol for the variable somewhere.
int i;A common symbol. If there are only (one or more) common symbols for a variable, it goes in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol. If they're of different sizes, it picks the largest size. The linker turns a common symbol into a declaration, if there's a definition of the same variable.
The --warn-common option can produce five kinds of warnings. Each warning is a pair of lines: the first describes the symbol just encountered, and the second describes the previous symbol encountered with the same name. One or both of the two symbols will be a common symbol.
- Turning a common symbol into a reference, because there's already a definition for the symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by definition
<file>(<section>): warning: defined here- Turning a common symbol into a reference, because a later definition for the symbol is encountered. Same as the previous case, except the symbols are encountered in a different order.
<file>(<section>): warning: definition of `<symbol>'
overriding common
<file>(<section>): warning: common is here- Merging a common symbol with a previous same-sized common symbol.
<file>(<section>): warning: multiple common
of `<symbol>'
<file>(<section>): warning: previous common is here- Merging a common symbol with a previous larger common symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by larger common
<file>(<section>): warning: larger common is here- Merging a common symbol with a previous smaller common symbol. Same as the previous case, except the symbols are encountered in a different order.
<file>(<section>): warning: common of `<symbol>'
overriding smaller common
<file>(<section>): warning: smaller common is here--warn-constructors— warns if any global constructors are used. This is only useful for a few object file formats. For formats like COFF or ELF, the linker literally cannot detect the use of global constructors. So don't expect magic here. 🦋--warn-execstack,--warn-execstack-objects,--no-warn-execstack— on ELF platforms the linker may generate warning messages if it's asked to create an output file that contains an executable stack. (Security girlies, this is the moment. 🚨) There are three possible states:- Do not generate any warnings.
- Always generate warnings, even if the executable stack is requested via the
-z execstackcommand line option. - Only generate a warning if an object file requests an executable stack, but not if the
-z execstackoption is used.
The default state depends on how the linker was configured when it was built. The --no-warn-execstack option always puts the linker into the no-warnings state. The --warn-execstack option puts the linker into the warn-always state. The --warn-execstack-objects option puts the linker into the warn-for-object-files-only state.
Note: ELF format input files can specify that they need an executable stack by having a.note.GNU-stacksection with the executable bit set in its section flags. They can specify that they do not need an executable stack by having that same section, but without the executable flag bit set. If an input file does not have a.note.GNU-stacksection, then the default behaviour is target specific. For some targets, the absence of such a section implies that an executable stack is required. This is often a problem for hand crafted assembler files. 🙈
--error-execstack,--no-error-execstack— if the linker is going to generate a warning message about an executable stack, then--error-execstackchanges that warning into an error instead. But note — this option does not change the linker's execstack warning generation state. Use--warn-execstackor--warn-execstack-objectsto set a specific warning state. The--no-error-execstackoption restores the default behaviour of generating warning messages. 💜--warn-multiple-gp— warns if multiple global pointer values are required in the output file. Only meaningful for certain processors, like the Alpha. Specifically: some processors put large-valued constants in a special section. A special register (the global pointer) points into the middle of this section, so constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g., 16 bits), that limits the max size of the constant pool. So in large programs, it's often necessary to use multiple global pointer values to address all possible constants. This option causes a warning whenever that case occurs. ⭐--warn-once— only warns once for each undefined symbol, rather than once per module that refers to it. Obsessed with the efficiency honestly.--warn-rwx-segments,--no-warn-rwx-segments— warns if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set. Such a segment represents a potential security vulnerability. On top of that, warnings will be generated if a thread local storage segment is created with the execute permission flag set — regardless of whether or not it has the read and/or write flags set. 🎀
These warnings are on by default bestie, periodt. You can turn them off with --no-warn-rwx-segments and pop them right back on with --warn-rwx-segments. ✨
--error-rwx-segments,--no-error-rwx-segments— okay so if the linker is about to give you a warning message about an executable, writeable segment, or about an executable TLS segment, then--error-rwx-segmentsupgrades that lil warning into a full-blown error instead 😭. And--no-error-rwx-segmentsputs it back to the default vibe of just warning you. 💅
ngl, heads up:--error-rwx-segmentsdoes not by itself turn on the warnings about these segments. Those warnings come either from the default (if the linker was configured that way) or from the--warn-rwx-segmentscommand line option. iykyk 🫶
--warn-section-align— warns you if the address of an output section got changed because of alignment. Usually that alignment comes from an input section. The address only gets changed if it wasn't explicitly specified, meaning: if theSECTIONScommand didn't give a start address for that section. 🎯--warn-textrel— warns you if the linker addsDT_TEXTRELto a position-independent executable or shared object. not me keeping an eye on that 👀--warn-alternate-em— warns you if an object has alternate ELF machine code. 🦋--warn-unresolved-symbols— so normally, if the linker is about to report an unresolved symbol (see the option--unresolved-symbols), it will generate an error. This option makes it generate a warning instead. softer vibes fr 💖--error-unresolved-symbols— this one restores the linker's default behaviour of generating errors when it's reporting unresolved symbols. back to business 😤
👑 --whole-archive
For each archive mentioned on the command line after the --whole-archive option, include every object file in the archive in the link, rather than searching the archive for the required object files. This is normally used to turn an archive file into a shared library, forcing every object to be included in the resulting shared library. Slay. This option may be used more than once. 💅
This option is not allowed within a--start-lib/--end-liboption pair. 🚫
Two notes bestie, for when you're using this option from gcc:
- First,
gccdoesn't know about this option, so you have to use-Wl,-whole-archive. - Second, don't forget to use
-Wl,-no-whole-archiveafter your list of archives, becausegccwill add its own list of archives to your link and you may not want this flag to affect those as well. 😭
--link-mapless— accepts archives that lack an index aka symbol map for all the subsequent archives referred on the command line. If it's missing, such an index is made internally on the fly at performance cost. This is the default. ✨
🧚 --wrap=symbol
Use a wrapper function for symbol. Any undefined reference to symbol will be resolved to __wrap_symbol. Any undefined reference to __real_symbol will be resolved to symbol. iconic behaviour honestly 🫶
This can be used to provide a wrapper for a system function. The wrapper function should be called __wrap_symbol. If it wishes to call the system function, it should call __real_symbol.
Here's a trivial little example, pls admire it:
void *
__wrap_malloc (size_t c)
{
printf ("malloc called with %zu\n", c);
return __real_malloc (c);
}If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead. The call to __real_malloc in __wrap_malloc will call the real malloc function. 🌈
You may wish to provide a __real_malloc function as well, so that links without the --wrap option will succeed. If you do this, you should not put the definition of __real_malloc in the same file as __wrap_malloc; if you do, the assembler may resolve the call before the linker has a chance to wrap it to malloc. 💀
Also — only undefined references are replaced by the linker. So, translation unit internal references to symbol are not resolved to __wrap_symbol. In this next example, the call to f in g is not resolved to __wrap_f:
int
f (void)
{
return 123;
}
int
g (void)
{
return f();
}--eh-frame-hdr,--no-eh-frame-hdr— request (--eh-frame-hdr) or suppress (--no-eh-frame-hdr) the creation of.eh_frame_hdrsection and ELFPT_GNU_EH_FRAMEsegment header. pick your fighter 🥊--no-ld-generated-unwind-info— requests creation of.eh_frameunwind info for linker generated code sections like PLT. This option is on by default if linker generated unwind info is supported. 🎀--discard-sframe— discards.sframestack trace info from the output. This option also prohibits the creation of SFrame stack trace data for linker generated code sections like PLT. This option is off by default. byeeeee 🦋--enable-new-dtags,--disable-new-dtags— this linker can create the new dynamic tags in ELF. But the older ELF systems may not understand them 😭. If you specify--enable-new-dtags, the new dynamic tags will be created as needed and older dynamic tags will be omitted. If you specify--disable-new-dtags, no new dynamic tags will be created. By default, the new dynamic tags are not created. Note that those options are only available for ELF systems. 👑--hash-size=number— sets the default size of the linker's hash tables to a prime number close to number. Increasing this value can reduce the length of time it takes the linker to perform its tasks, at the expense of increasing the linker's memory requirements. Similarly, reducing this value can reduce the memory requirements at the expense of speed. The default value is4051under normal circumstances and1021if the--reduce-memory-overheadscommand line option is used. ✨--hash-style=style— sets the type of linker's hash table(s). style can be eithersysvfor classic ELF.hashsection,gnufor new style GNU.gnu.hashsection, orbothfor both the classic ELF.hashand new style GNU.gnu.hashhash tables. The default depends upon how the linker was configured, but for most Linux based systems it will beboth. 💅--compress-debug-sections=none,--compress-debug-sections=zlib,--compress-debug-sections=zlib-gnu,--compress-debug-sections=zlib-gabi,--compress-debug-sections=zstd— on ELF platforms, these options control how DWARF debug sections are compressed using zlib. 🗜️
So --compress-debug-sections=none doesn't compress DWARF debug sections. --compress-debug-sections=zlib-gnu compresses DWARF debug sections and renames them to begin with .zdebug instead of .debug. --compress-debug-sections=zlib-gabi also compresses DWARF debug sections, but rather than renaming them it sets the SHF_COMPRESSED flag in the sections' headers. 🌸
The --compress-debug-sections=zlib option is an alias for --compress-debug-sections=zlib-gabi.
And --compress-debug-sections=zstd compresses DWARF debug sections using zstd. 🔥
Note that this option overrides any compression in input debug sections, so if a binary is linked with --compress-debug-sections=none for example, then any compressed debug sections in input files will be uncompressed before they are copied into the output binary. no cap 🫶
The default compression behaviour varies depending upon the target involved and the configure options used to build the toolchain. The default can be determined by examining the output from the linker's --help option. 🔍
--reduce-memory-overheads— this option reduces memory requirements atldruntime, at the expense of linking speed. It was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage. 😮💨
Another effect of the switch is to set the default hash table size to 1021, which again saves memory at the cost of lengthening the linker's run time. This is not done however if the --hash-size switch has been used.
The --reduce-memory-overheads switch may also be used to enable other tradeoffs in future versions of the linker. 🔮
--max-cache-size=size—ldnormally caches the relocation information and symbol tables of input files in memory with the unlimited size. This option sets the maximum cache size to size. Note — if the--no-keep-memorycommand line option has been used then the linker acts as if the maximum cache size has been set to0— ie nothing is retained. 💀--build-id,--build-id=style— requests the creation of a.note.gnu.build-idELF note section or a.buildidCOFF section. The contents of the note are unique bits identifying this linked file. 🎀 style can be:uuid— use 128 random bitssha1— use a 160-bit SHA1 hashmd5— use a 128-bit MD5 hashxx— use a 128-bit XXHASH on the normative parts of the output contents0xhexstring— use a chosen bit string specified as an even number of hexadecimal digits (-and:characters between digit pairs are ignored)
If style is omitted, sha1 is used. ⭐
The md5, sha1, and xx styles produce an identifier that is always the same in an identical output file, but are almost certainly unique among all nonidentical output files. It is not intended to be compared as a checksum for the file's contents. A linked file may be changed later by other tools, but the build ID bit string identifying the original linked file does not change. 🌈
Passing none for style disables the setting from any --build-id options earlier on the command line. 🚫
--package-metadata=JSON— okay so this one asks the linker to make you a.note.packageELF note section 🎀. What lives inside that note is JSON, formatted per the package metadata spec. Wanna know more? Go look:https://systemd.io/ELF_PACKAGE_METADATA/
Now bestie, the JSON argument supports percent-encoding, and it understands this %[string] thing (where string is the name from HTML's Named Character References) 💅:
%[comma]for,%[lbrace]for{%[quot]for"%[rbrace]for}%[space]for the space character
If the JSON argument is missing or empty, that disables creating the metadata note — but only if some earlier --package-metadata had turned one on 🔥. And if your linker got built with libjansson, then the JSON string actually gets validated for you. Iconic.
So here's the tea on the PE side of things 💖: the PE linker supports the -shared option, which makes the output a dynamically linked library (a DLL, duh) instead of a regular old executable. You should name that output "*.dll" when you use this, okay? And the linker full-on supports standard "*.def" files, which you can hand it on the command line just like an object file 🦋. Lowkey important: it should come before the archives it exports symbols from, so those symbols actually get linked in — same energy as a normal object file.
On top of the options that every target shares, the PE linker also has its own extra command-line options that are only for the PE target ✨. And if an option takes a value, you can separate it from that value with either a space or an equals sign. Your call, main character.
--add-stdcall-alias— if you give this, symbols with a stdcall suffix (@nn) get exported as-is, and again with the suffix stripped off. Two for one, slay. [This option is specific to PE targeted ports of the linker]--base-filefile — use file as the name of a file to save all the base addresses of the relocations you need for generating DLLs withdlltool. [This option is specific to PE targeted ports of the linker]--dll— make a DLL instead of a regular executable 🎀. You can also use-shared, or just specify a"LIBRARY"in a given".def"file. Whatever vibes. [This option is specific to PE targeted ports of the linker]--enable-long-section-names,--disable-long-section-names— so the PE flavors of the COFF object format add an extension that lets you use section names longer than eight characters (that's the normal COFF limit, periodt). By default those names are only allowed in object files, because fully-linked executable images don't carry the COFF string table needed to support the longer names. But as a GNU extension, you can allow them in executable images too — or (probably pointlessly!) disallow them in object files — with these two options. Executable images generated with these long section names are slightly non-standard since they carry a string table, and they may spit out confusing output when examined with non-GNU PE-aware tools like file viewers and dumpers 😭. BUT. GDB relies on PE long section names to find Dwarf-2 debug information sections in an executable image at runtime, so if neither option is specified on the command-line,ldwill enable long section names — overriding the default and technically correct behaviour — when it finds debug information present while linking an executable image and not stripping symbols. [This option is specific to PE targeted ports of the linker]--enable-stdcall-fixup,--disable-stdcall-fixup— if the link finds a symbol it can't resolve, it tries doing "fuzzy linking" 👀: it looks for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall) and resolves that symbol by linking to the match. For example, the undefined symbol"_foo"might get linked to the function"_foo@12", or the undefined symbol"_bar@16"might get linked to the function"_bar". When the linker does this it prints a warning, since normally it should have failed to link — but sometimes import libraries generated from third-party dlls need this feature to even be usable. If you specify--enable-stdcall-fixup, the feature is fully on and no warnings get printed. If you specify--disable-stdcall-fixup, the feature is off and such mismatches count as errors 💀. [This option is specific to PE targeted ports of the linker]--leading-underscore,--no-leading-underscore— for most targets the default symbol-prefix is an underscore, and it's defined in the target's description. With this option you can disable/enable that default underscore symbol-prefix. [This option is specific to PE targeted ports of the linker]--export-all-symbols— give this and every global symbol in the objects used to build a DLL gets exported by the DLL ✨. Heads up though: this is the default if there otherwise wouldn't be any exported symbols. When symbols are explicitly exported via DEF files or implicitly exported via function attributes, the default is to not export anything else unless this option is given. Also note that these symbols will not be automatically exported:"DllMain@12","DllEntryPoint@0","DllMainCRTStartup@12", and"impure_ptr". Also, symbols imported from other DLLs won't get re-exported, and neither will symbols specifying the DLL's internal layout — like those beginning with"_head_"or ending with"_iname". Plus, no symbols from"libgcc","libstd++","libmingw32", or"crtX.o"get exported. Symbols whose names begin with"__rtti_"or"__builtin_"won't be exported either, to help with C++ DLLs. And finally, there's an extensive list of cygwin-private symbols that don't get exported (obviously this only applies when building DLLs for cygwin targets 🙈). Those cygwin-excludes are:"_cygwin_dll_entry@12","_cygwin_crt0_common@8","_cygwin_noncygwin_dll_entry@12","_fmode","_impure_ptr","cygwin_attach_dll","cygwin_premain0","cygwin_premain1","cygwin_premain2","cygwin_premain3", and"environ". Phew. [This option is specific to PE targeted ports of the linker]--exclude-symbolssymbol,symbol,... — hands you a way to name a list of symbols that should not be automatically exported. The symbol names can be delimited by commas or colons, flexible queen 💅. [This option is specific to PE targeted ports of the linker]--exclude-all-symbols— says no symbols should be automatically exported, at all, none, bye 🫶. [This option is specific to PE targeted ports of the linker]--file-alignment— specify the file alignment. Sections in the file will always begin at file offsets that are multiples of this number. Defaults to512. [This option is specific to PE targeted ports of the linker]--heapreserve,--heapreserve,commit — specify the number of bytes of memory to reserve (and optionally commit) for this program to use as heap 🌸. The default is1MBreserved,4Kcommitted. [This option is specific to PE targeted ports of the linker]--kill-at— give this and the stdcall suffixes (@nn) get stripped from symbols before they're exported 🔥. [This option is specific to PE targeted ports of the linker]--large-address-aware— if given, the appropriate bit in the"Characteristics"field of the COFF header gets set, flagging that this executable supports virtual addresses greater than 2 gigabytes. This should be used together with the/3GBor/USERVA=valuemegabytes switch in the"[operating systems]"section of theBOOT.INI. Otherwise this bit literally does nothing 😭. [This option is specific to the i386 PE targeted port of the linker]--disable-large-address-aware— reverts the effect of a previous--large-address-awareoption. Super useful when--large-address-awareis always set by the compiler driver (e.g. Cygwin gcc) but the executable doesn't support virtual addresses greater than 2 gigabytes. [This option is specific to the i386 PE targeted port of the linker]--major-image-versionvalue — sets the major number of the"image version". Defaults to1. [This option is specific to PE targeted ports of the linker]--major-os-versionvalue — sets the major number of the"os version". Defaults to4. [This option is specific to PE targeted ports of the linker]--major-subsystem-versionvalue — sets the major number of the"subsystem version". Defaults to4. [This option is specific to PE targeted ports of the linker]--minor-image-versionvalue — sets the minor number of the"image version". Defaults to0. [This option is specific to PE targeted ports of the linker]--minor-os-versionvalue — sets the minor number of the"os version". Defaults to0. [This option is specific to PE targeted ports of the linker]--minor-subsystem-versionvalue — sets the minor number of the"subsystem version". Defaults to0. [This option is specific to PE targeted ports of the linker]--output-deffile — the linker creates the file file, which will contain a DEF file corresponding to the DLL it's generating 🎀. This DEF file (which should be called"*.def") can be used to create an import library with"dlltool", or used as a reference to automatically or implicitly exported symbols. [This option is specific to PE targeted ports of the linker]--enable-auto-image-base,--enable-auto-image-base=value— automatically picks the image base for DLLs, optionally starting from base value, unless one is specified with the"--image-base"argument ✨. It uses a hash generated from the dllname to create unique image bases for each DLL, which dodges in-memory collisions and relocations that would otherwise delay program execution. [This option is specific to PE targeted ports of the linker]--disable-auto-image-base— don't automatically generate a unique image base. If there's no user-specified image base ("--image-base") then use the platform default 💜. [This option is specific to PE targeted ports of the linker]--dll-search-prefixstring — when linking dynamically to a dll without an import library, search for"<string><basename>.dll"in preference to"lib<basename>.dll". This lets you easily tell apart DLLs built for the various "subplatforms": native, cygwin, uwin, pw, etc. 💅 For instance, cygwin DLLs typically use"--dll-search-prefix=cyg". [This option is specific to PE targeted ports of the linker]--enable-auto-import— okay so this one does the ✨sophisticated✨ little trick of linking"_symbol"to"__imp__symbol"for DATA imports coming from DLLs, which means you can straight-up bypass the dllimport mechanism on the user side and reference unmangled symbol names. [This option is specific to PE targeted ports of the linker]
Heads up bestie: the remarks below are about the original implementation of this feature and are obsolete nowadays for Cygwin and MinGW targets.
Note: using the 'auto-import' extension will make the text section of the image file writable. That does not conform to the PE-COFF format specification published by Microsoft. 👀
Note again: using'auto-import'will also cause read only data that would normally live in the.rdatasection to get yeeted into the.datasection instead. Why? To work around a problem with consts described over here:http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html
Using 'auto-import' will generally just 'just work' — but sometimes you'll get jumpscared by this message:
"variable '<var>' can't be auto-imported. Please read the
documentation for ld's "--enable-auto-import" for details."This message shows up when some (sub)expression accesses an address that ultimately comes from the sum of two constants (Win32 import tables only allow one, tragic). Places this can happen include accessing member fields of struct variables imported from a DLL, and using a constant index into an array variable imported from a DLL. Any multiword variable (arrays, structs, long long, etc) may trigger this error condition. But fr, no matter the exact data type of the offending exported variable, ld will always catch it, issue the warning, and exit. 💀
There are several ways to deal with this difficulty, no matter the data type of the exported variable:
One way is to use the --enable-runtime-pseudo-reloc switch. This hands the job of adjusting references in your client code over to the runtime environment, so this method only works when the runtime environment supports this feature.
A second solution is to force one of the 'constants' to be a variable — like, unknown and un-optimizable at compile time. For arrays there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. So:
extern type extern_array[];
extern_array[1] -->
{ volatile type *t=extern_array; t[1] }or
extern type extern_array[];
extern_array[1] -->
{ volatile int t=1; extern_array[t] }For structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the ...) variable:
extern struct s extern_struct;
extern_struct.field -->
{ volatile struct s *t=&extern_struct; t->field }or
extern long long extern_ll;
extern_ll -->
{ volatile long long * local_ll=&extern_ll; *local_ll }A third method of dealing with this difficulty is to abandon 'auto-import' for the offending symbol and mark it with "__declspec(dllimport)". But ngl, in practice that requires using compile-time #defines to indicate whether you're building a DLL, building client code that will link to the DLL, or merely building/linking to a static library. When you're choosing between the various methods of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:
Original:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}Solution 1:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
/* This workaround is for win32 and cygwin; do not "optimize" */
volatile int *parr = arr;
printf("%d\n",parr[1]);
}Solution 2:
--foo.h
/* Note: auto-export is assumed (no __declspec(dllexport)) */
#if (defined(_WIN32) || defined(__CYGWIN__)) && \
!(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
#define FOO_IMPORT __declspec(dllimport)
#else
#define FOO_IMPORT
#endif
extern FOO_IMPORT int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}And a fourth way to dodge this whole problem is to re-code your library to use a functional interface instead of a data interface for the offending variables (like set_foo() and get_foo() accessor functions). 💅
--disable-auto-import— do not attempt the sophisticated linking of"_symbol"to"__imp__symbol"for DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]--enable-runtime-pseudo-reloc— if your code contains expressions like the ones described in the--enable-auto-importsection, that is, DATA imports from DLL with non-zero offset, this switch will create a vector of'runtime pseudo relocations'that the runtime environment can use to adjust references to such data in your client code. [This option is specific to PE targeted ports of the linker]--disable-runtime-pseudo-reloc— do not create pseudo relocations for non-zero offset DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]--enable-extra-pe-debug— show extra debug info related to auto-import symbol thunking. [This option is specific to PE targeted ports of the linker]--section-alignment— sets the section alignment. Sections in memory will always start at addresses that are a multiple of this number. Defaults to0x1000. [This option is specific to PE targeted ports of the linker]--stack reserve--stack reserve,commit— specify how many bytes of memory to reserve (and optionally commit) to be used as the stack for this program. The default is2MBreserved,4Kcommitted. [This option is specific to PE targeted ports of the linker]--subsystem which--subsystem which:major--subsystem which:major.minor— specifies the subsystem your program will execute under. The legal values for which are"native","windows","console","posix", and"xbox". You can optionally set the subsystem version too. Numeric values are also accepted for which. [This option is specific to PE targeted ports of the linker]
The following options set flags in the "DllCharacteristics" field of the PE file header: [These options are specific to PE targeted ports of the linker]
--high-entropy-va--disable-high-entropy-va— the image is compatible with 64-bit address space layout randomization (ASLR). This option is enabled by default for 64-bit PE images in MinGW targets.
This option also implies --dynamicbase and --enable-reloc-section. [This options is specific to 64-bit PE targeted ports of the linker]
--dynamicbase--disable-dynamicbase— the image base address may be relocated using address space layout randomization (ASLR). This feature was introduced with MS Windows Vista. This option is enabled by default for MinGW targets but can be disabled via the--disable-dynamicbaseoption. This option also implies--enable-reloc-section.--forceinteg--disable-forceinteg— code integrity checks are enforced. This option is disabled by default.--nxcompat--disable-nxcompat— the image is compatible with the Data Execution Prevention. This feature was introduced with MS Windows XP SP2. The option is enabled by default for MinGW targets.--no-isolation--disable-no-isolation— although the image understands isolation, do not isolate the image. This option is disabled by default.--no-seh--disable-no-seh— the image does not use SEH. No SE handler may be called from this image. This option is disabled by default.--no-bind--disable-no-bind— do not bind this image. This option is disabled by default.--wdmdriver--disable-wdmdriver— the driver uses the MS Windows Driver Model. This option is disabled by default.--tsaware--disable-tsaware— the image is Terminal Server aware. This option is disabled by default.--insert-timestamp--no-insert-timestamp— insert a real timestamp into the image. This is the default behaviour because it matches legacy code and it means the image will work with other, proprietary tools. The problem with this default is that it results in slightly different images being produced every single time you link the same sources. 😭 The option--no-insert-timestampcan be used to insert a zero value for the timestamp instead, which ensures that binaries produced from identical sources will compare identically.
If --insert-timestamp is active then the time inserted is either the time the linking takes place or, if the "SOURCE_DATE_EPOCH" environment variable is defined, the number of seconds since Unix epoch as specified by that variable.
--enable-reloc-section--disable-reloc-section— create the base relocation table, which is necessary if the image is loaded at a different image base than the one specified in the PE header. This option is enabled by default.
The C6X uClinux target uses a binary format called DSBT to support shared libraries. Every shared library in the system needs to have a unique index; all executables use an index of 0. 🌈
--dsbt-size size— this option sets the number of entries in the DSBT of the current executable or shared library to size. The default is to create a table with64entries.--dsbt-index index— this option sets the DSBT index of the current executable or shared library to index. The default is0, which is appropriate for generating executables. If a shared library is generated with a DSBT index of0, the"R_C6000_DSBT_INDEX"relocs are copied into the output file.--no-merge-exidx-entries— turns OFF the merging of adjacent exidx entries inside frame unwind info. That's it, that's the whole job. tiny option, big responsibility ✨
🧵 C-SKY branch stuff (we're still in OPTIONS bestie, don't worry)
--branch-stub— this one lets the linker do branch relaxation by dropping in branch stub sections whenever they're needed to stretch how far a branch can reach. Lowkey you probably don't need it tho: C-SKY already supports branch and call instructions that can reach the entire memory range, and the compiler or assembler normally handles relaxation on its own. so this is the "just in case" option fr 💅--stub-group-size=N— for when you want finer control over linker branch stub creation 🎀 It sets the max size of a group of input sections that one single stub section can handle. And now the fun part:- a negative value of N puts the stub sections after their branches
- a positive value lets stub sections show up either before or after the branches
- values of 1 or -1 mean "linker babe, you pick something suitable", i.e. use sensible defaults 👑
🚋 68HC11 and 68HC12
The 68HC11 and 68HC12 linkers support specific options to control the memory bank switching mapping and trampoline code generation. niche? yes. iconic? also yes.
--no-trampoline— disables trampoline generation. By default a trampoline gets generated for each far function that's called with a"jsr"instruction (and that whole situation happens when a pointer to a far function is taken). So if you want zero trampolines, here's your girl 🙈--bank-window name— tells the linker the name of the memory region in theMEMORYspecification that describes the memory bank window. The linker then uses that region's definition to compute paging and addresses within the memory window. banking, but make it addressable ✨
🏦 68K GOT generation
These are the options that control how GOT generation is handled when you're linking for 68K targets.
--got=type— tells the linker which GOT generation scheme to use. type has to be one ofsingle,negative,multigotortarget. Want more? Go read the Info entry forld, bestie, that's where the lore lives 📖
🌀 MIPS microMIPS + ISA mode transitions
These options control microMIPS instruction generation and branch relocation checks for ISA mode transitions when linking for MIPS targets:
--insn32--no-insn32
These control which microMIPS instructions get used in code the linker generates — think PLT stuff, lazy binding stubs, relaxation, that whole universe. If --insn32 is on, the linker only uses 32-bit instruction encodings. By default, or if --no-insn32 is used, all instruction encodings are used, including 16-bit ones where possible. size matters 💅
--ignore-branch-isa--no-ignore-branch-isa
These control branch relocation checks for invalid ISA mode transitions. If --ignore-branch-isa is used, the linker accepts any branch relocations, and any ISA mode transition that's required gets lost in relocation calculation — except in some cases of "BAL" instructions, which meet relaxation conditions and get converted into equivalent "JALX" instructions as the associated relocation is calculated. By default, or if --no-ignore-branch-isa is used, a check is made, and losing an ISA mode transition produces an error. no vibe, just error 🚨
--compact-branches--no-compact-branches
These control the generation of compact instructions by the linker in the PLT entries for MIPS R6. compact cuties 🎀
🕰️ pdp11-aout output formats
For the pdp11-aout target, three variants of the output format can be produced, picked by the following options. Heads up on the defaults: the default variant for pdp11-aout is the --omagic option, whereas for other targets --nmagic is the default. And --imagic is defined only for the pdp11-aout target — the others are described here as they apply to the pdp11-aout target. pdp11 stays special, as she should 💜
-N,--omagic— marks the output as"OMAGIC"(0407) in the a.out header, telling everyone the text segment is not to be write-protected and shared. Since text and data sections are both readable and writable, the data section gets allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs and has been the default forldon PDP11 Unix systems from the very beginning all the way through 2.11BSD. ancient. legendary. still shipping.-n,--nmagic— marks the output as"NMAGIC"(0410) in the a.out header, meaning that when the output file is executed, the text portion will be read-only and shareable among all processes running the same file. This involves moving the data areas up to the first possible 8K byte page boundary following the end of the text. Basically: this option creates a pure executable format. read-only queen ✨-z,--imagic— marks the output as"IMAGIC"(0411) in the a.out header, meaning that when the output file is executed, the program text and data areas get loaded into separate address spaces, using the split instruction and data space feature of the memory management unit in larger models of the PDP11. This doubles the address space available to the program. The text segment is once again pure, write-protected and shareable. The only difference in output format between this and the others — besides the magic number — is that both the text and data sections start at location 0. The-zoption selected this format in 2.11BSD. This option creates a separate executable format. double the address space, double the slay 🔥--no-omagic— equivalent to--nmagicfor pdp11-aout. that's the whole description, no notes 💅
💖 ENVIRONMENT 💖
You can change how ld behaves with the environment variables "GNUTARGET", "LDEMULATION" and "COLLECT_NO_DEMANGLE".
"GNUTARGET" decides the input-file object format if you don't use -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there's no "GNUTARGET" in the environment, ld uses the natural format of the target. And if "GNUTARGET" is set to "default", then BFD tries to discover the input format by examining binary input files — this method often works, but there are potential ambiguities, since there's no way to guarantee that the magic number used to specify object-file formats is unique. spooky 👀 However! The configuration procedure for BFD on each system puts the conventional format for that system first in the search-list, so ambiguities get resolved in favor of convention. society 🤝
"LDEMULATION" decides the default emulation if you don't use the -m option. The emulation can affect all sorts of linker behaviour, especially the default linker script. You can list the available emulations with the --verbose or -V options. If -m isn't used, and "LDEMULATION" isn't defined, then the default emulation depends on how the linker was configured. mystery emulation, cute 🦋
Normally, the linker defaults to demangling symbols. But if "COLLECT_NO_DEMANGLE" is set in the environment, then it defaults to not demangling symbols. This environment variable is used in a similar fashion by the "gcc" linker wrapper program. And the default can be overridden by the --demangle and --no-demangle options. options beat environment, every time 👑
If the PE/COFF specific --insert-timestamp is active and the SOURCE_DATE_EPOCH environment variable is defined, then the timestamp value in that variable gets inserted into the COFF header instead of the current time. reproducible build girlies, this one's for you ⏰
If the "LD_STATS" environment variable is defined, then linker resource use information will be recorded — just as if the --stats option had been used. If "LD_STATS" has a string value, that string gets used as the name of a file where the info should be stored. Otherwise? The information goes to the standard output stream. stats o'clock 📊
🫶 SEE ALSO 🫶
ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld.
the whole squad, go say hi to them all 💖
📜 COPYRIGHT 📜
Copyright (c) 1991-2026 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".
fr fr, legal text is still legal text — every word kept, zero skipped, bestie. 📖💜
and that's a wrap on LD(1) 😭🫶 you made it to the end of the manpage, bestie, that's main character energy if I've ever seen it
This beauty comes from binutils-2.47, dated 2026-09-18, and yes, she's filed under LD(1) ✨ go forth and link responsibly 💅🎀
📦 where this page comes from
- ubuntu stonking: binutils-avr 2.47-0.1 · GPL-3.0-or-later
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms