LD(1)

💖 LD(1) — The GNU linker 💖

manual name: LD(1) 🌸 · section: GNU Development Tools 💅

---

✨ NAME ✨

ld — The GNU linker 🫶

🎀 SYNOPSIS 🎀

ld [options] objfile ...

💅 DESCRIPTION 💅

okay bestie, so ld is literally the linker: it combines a bunch of object and archive files, relocates their data, and ties up symbol references. Usually the last step in compiling a program is to run ld. periodt. 🦋

ld accepts Linker Command Language files written in a superset of AT&T's Link Editor Command Language syntax, to provide explicit and total control over the linking process. iconic behavior, honestly. ✨

This man page does not describe the command language; see the ld entry in info for full details on the command language and on other aspects of the GNU linker. iykyk. 📖

This version of ld uses the general purpose BFD libraries to operate on object files. This allows ld to read, combine, and write object files in many different formats---for example, COFF or a.out. Different formats may be linked together to produce any available kind of object file. slay. 🌈

Aside from its flexibility, the GNU linker is more helpful than other linkers in providing diagnostic information. Many linkers abandon execution immediately upon encountering an error; whenever possible, ld continues executing, allowing you to identify other errors (or, in some cases, to get an output file in spite of the error). not me being emotionally supported by a linker 😭💖

The GNU linker ld is meant to cover a broad range of situations, and to be as compatible as possible with other linkers. As a result, you have many choices to control its behavior. choices, choices, choices 💅

🌸 OPTIONS 🌸

The linker supports a plethora of command-line options, but in actual practice few of them are used in any particular context. For instance, a frequent use of ld is to link standard Unix object files on a standard, supported Unix system. On such a system, to link a file hello.o:

        ld -o <output> /lib/crt0.o hello.o -lc

This tells ld to produce a file called output as the result of linking the file /lib/crt0.o with hello.o and the library libc.a, which will come from the standard search directories. (See the discussion of the -l option below.) 🍓

Some of the command-line options to ld may be specified at any point in the command line. However, options which refer to files, such as -l or -T, cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. Repeating non-file options with a different argument will either have no further effect, or override prior occurrences (those further to the left on the command line) of that option. Options which may be meaningfully specified more than once are noted in the descriptions below. 🧚

Non-option arguments are object files or archives which are to be linked together. They may follow, precede, or be mixed in with command-line options, except that an object file argument may not be placed between an option and its argument. rude but valid 💀

Usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. If no binary input files at all are specified, the linker does not produce any output, and issues the message No input files. 🫠

If the linker cannot recognize the format of an object file, it will assume that it is a linker script. A script specified in this way augments the main linker script used for the link (either the default linker script or the one specified by using -T). This feature permits the linker to link against a file which appears to be an object or an archive, but actually merely defines some symbol values, or uses INPUT or GROUP to load other objects. Specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script; use the -T option to replace the default linker script entirely, but note the effect of the INSERT command. plot twist ✨

For options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them. no space, no problem 💅

For options whose names are multiple letters, either one dash or two can precede the option name; for example, -trace-symbol and --trace-symbol are equivalent. Note---there is one exception to this rule. Multiple letter options that start with a lower case o can only be preceded by two dashes. This is to reduce confusion with the -o option. So for example -omagic sets the output file name to magic whereas --omagic sets the NMAGIC flag on the output. the lore is lore-ing 📚

Arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. For example, --trace-symbol foo and --trace-symbol=foo are equivalent. Unique abbreviations of the names of multiple-letter options are accepted. abbrev slay 🔥

Note---if the linker is being invoked indirectly, via a compiler driver (e.g. gcc) then all the linker command-line options should be prefixed by -Wl, (or whatever is appropriate for the particular compiler driver) like this:

          gcc -Wl,--start-group foo.o bar.o -Wl,--end-group

This is important, because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. Confusion may also arise when passing options that require values through a driver, as the use of a space between option and argument acts as a separator, and causes the driver to pass only the option to the linker and the argument to the compiler. In this case, it is simplest to use the joined forms of both single- and multiple-letter options, such as:

          gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.map

Here is a table of the generic command-line switches accepted by the GNU linker: 👑

• @file — Read command-line options from file. The options read are inserted in place of the original @file option. If file does not exist, or cannot be read, then the option will be treated literally, and not removed.

Options in file are separated by whitespace. A whitespace character may be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) may be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options will be processed recursively. 🌀

• -a keyword — This option is supported for HP/UX compatibility. The keyword argument must be one of the strings archive, shared, or default. -aarchive is functionally equivalent to -Bstatic, and the other two keywords are functionally equivalent to -Bdynamic. This option may be used any number of times. 💖
• --audit AUDITLIB — Adds AUDITLIB to the DT_AUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. If specified multiple times DT_AUDIT will contain a colon separated list of audit interfaces to use. If the linker finds an object with an audit entry while searching for shared libraries, it will add a corresponding DT_DEPAUDIT entry in the output file. This option is only meaningful on ELF platforms supporting the rtld-audit interface. 🦋
• -b input-format, --format=input-format — ld may be configured to support more than one kind of object file. If your ld is configured this way, you can use the -b option to specify the binary format for input object files that follow this option on the command line. Even when ld is configured to support alternative object formats, you don't usually need to specify this, as ld should be configured to expect as a default input format the most usual format on each machine. input-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i.)

You may want to use this option if you are linking files with an unusual binary format. You can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format.

The default format is taken from the environment variable GNUTARGET.

You can also define the input format from a script, using the command TARGET; 📦

• -c MRI-commandfile, --mri-script=MRI-commandfile — For compatibility with linkers produced by MRI, ld accepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. Introduce MRI script files with the option -c; use the -T option to run linker scripts written in the general-purpose ld scripting language. If MRI-cmdfile does not exist, ld looks for it in the directories specified by any -L options. 🌸
• -d, -dc, -dp — These three options are equivalent; multiple forms are supported for compatibility with other linkers. They assign space to common symbols even if a relocatable output file is specified (with -r). The script command FORCE_COMMON_ALLOCATION has the same effect. 💅
• --depaudit AUDITLIB, -P AUDITLIB — Adds AUDITLIB to the DT_DEPAUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. If specified multiple times DT_DEPAUDIT will contain a colon separated list of audit interfaces to use. This option is only meaningful on ELF platforms supporting the rtld-audit interface. The -P option is provided for Solaris compatibility. ☀️
• --enable-linker-version — Enables the LINKER_VERSION linker script directive, described in Output Section Data. If this directive is used in a linker script and this option has been enabled then a string containing the linker version will be inserted at the current point.

Note - this location of this option on the linker command line is significant. It will only affect linker scripts that come after it on the command line, or which are built into the linker. ⚠️

• --disable-linker-version — Disables the LINKER_VERSION linker script directive, so that it does not insert a version string. This is the default. 🚫
• --enable-non-contiguous-regions — okay so bestie, this one stops the linker from throwing a tantrum when an input section can't fit into a matching output section 🫶. Instead of just erroring out, the linker tries to tuck that input section into the next matching output section, and only gets mad if literally no output section is big enough. The way this slaps is when you've got multiple non-contiguous memory regions and your input section doesn't need any specific one. The evaluation order of input sections stays the same, no cap. Like, check it:

MEMORY {
  MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
  MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
  MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
  mem1 : { *(.data.*); } > MEM1
  mem2 : { *(.data.*); } > MEM2
  mem3 : { *(.data.*); } > MEM3
}

and then imagine these input sections:

.data.1: size 8
.data.2: size 0x10
.data.3: size 4

so what happens is .data.1 goes to mem1, and .data.2 and .data.3 both go to mem2 — even though .data.3 would've fit in mem3. That's just how the evaluation order plays out, periodt.

Heads up: this option is incompatible with INSERT statements because it literally changes how input sections get mapped to output sections. They do not vibe together 💀.

• --enable-non-contiguous-regions-warnings — this one turns on warnings when --enable-non-contiguous-regions is out here allowing possibly unexpected matches in section mapping. The danger? It could silently discard a section instead of failing because it doesn't fit any output region 😭. So like, if you want that heads-up, use this. If you're brave, don't.
• -e entry and --entry=entry — use entry as the explicit symbol for where your program starts executing, instead of the default entry point. If there's no symbol named entry (the linker is looking for it fr fr), it'll try to parse entry as a number and use that as the entry address. And listen: that number is interpreted in base 10 — you can use a leading 0x for base 16, or a leading 0 for base 8. For i386 PE, entry can also be the original function name (without the leading underscore and/or the trailing stdcall @number when applicable) ✨.
• --exclude-libs lib,lib,... — this lets you list archive libraries from which symbols should not be automatically exported. The library names can be separated by commas or colons, either way works 💅. If you go --exclude-libs ALL, it excludes symbols in all archive libraries from automatic export. This option is only available for ELF and PE targeted ports of the linker, iykyk. For PE targets, symbols explicitly listed in a .def file are still exported regardless of this option — they don't care. For ELF targeted ports, symbols affected by this get treated as hidden 👀.
• --exclude-modules-for-implib module,module,... — specify a list of object files or archive members where symbols should not be automatically exported, but that should still be copied wholesale into the import library generated during the link. The module names can be delimited by commas or colons, and they must match exactly the filenames used by ld to open the files. For archive members, this is just the member name. For object files, the name listed must include and match precisely any path used to specify the input file on the linker's command-line — so no shortcuts, bestie. Symbols explicitly listed in a .def file are still exported regardless of this option. [This option is specific to PE targeted ports of the linker] 🎀.
• -E, --export-dynamic, and --no-export-dynamic — when you're creating a dynamically linked executable, using -E or --export-dynamic makes the linker add all symbols to the dynamic symbol table. The dynamic symbol table is basically the set of symbols visible from dynamic objects at run time, and it's giving main character energy 👑.

If you don't use either of those options (or you use --no-export-dynamic to restore the default behavior), the dynamic symbol table will normally contain only the symbols that are referenced by some dynamic object mentioned in the link. That's the chill default vibe 🌸.

Now, if you use "dlopen" to load a dynamic object that needs to refer back to symbols defined by the program (rather than some other dynamic object), then you will probably need this option when linking the program itself. Like, it's basically required for that use case, ngl.

You can also use the dynamic list to control what symbols get added to the dynamic symbol table if the output format supports it. See the description of --dynamic-list for more on that.

Note: this option is specific to ELF targeted ports. PE targets support a similar function to export all symbols from a DLL or EXE; see the description of --export-all-symbols below.

• --export-dynamic-symbol=glob — when creating a dynamically linked executable, symbols matching glob will be added to the dynamic symbol table ✨. When creating a shared library, references to symbols matching glob will not be bound to the definitions within the shared library. This option is a no-op when creating a shared library and -Bsymbolic or --dynamic-list are not specified — so basically it does nothing in that case, it's just there. This option is only meaningful on ELF platforms which support shared libraries, periodt.
• --export-dynamic-symbol-list=file — this specifies a --export-dynamic-symbol for each pattern in the file. The format of the file is the same as the version node without scope and node name. See VERSION for more info 💖.
• -EB — link big-endian objects. This affects the default output format. That's it, that's the whole thing 🌈.
• -EL — link little-endian objects. This affects the default output format. Also short and sweet 🦋.
• -f name and --auxiliary=name — when creating an ELF shared object, this sets the internal DT_AUXILIARY field to the specified name. This tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name 👑

If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_AUXILIARY field. If the dynamic linker resolves any symbols from the filter object, it will first check whether there's a definition in the shared object name. If there is one, it will be used instead of the definition in the filter object. The shared object name need not exist — wild, right? So the shared object name may be used to provide an alternative implementation of certain functions, maybe for debugging or for machine-specific performance. That's lowkey iconic.

This option may be specified more than once. The DT_AUXILIARY entries will be created in the order they appear on the command line 🔥.

• -F name and --filter=name — when creating an ELF shared object, this sets the internal DT_FILTER field to the specified name. This tells the dynamic linker that the symbol table of the shared object being created should be used as a filter on the symbol table of the shared object name.

If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_FILTER field. The dynamic linker will resolve symbols according to the symbol table of the filter object as usual, but it will actually link to the definitions found in the shared object name. So the filter object can be used to select a subset of the symbols provided by the object name 💅.

Some older linkers used -F option throughout a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker uses other mechanisms for this purpose: the -b, --format, --oformat options, the "TARGET" command in linker scripts, and the "GNUTARGET" environment variable. The GNU linker will ignore the -F option when not creating an ELF shared object 💀.

• -fini=name — when creating an ELF executable or shared object, call NAME when the executable or shared object is unloaded, by setting DT_FINI to the address of the function. By default, the linker uses "_fini" as the function to call 🌸.
• -g — ignored. Provided for compatibility with other tools. That's literally it, bestie, it does nothing but it's there for the vibes 🙈.
• -G value and --gpsize=value — set the maximum size of objects to be optimized using the GP register to size. This is only meaningful for object file formats such as MIPS ELF that support putting large and small objects into different sections. For other object file formats, it's ignored — so if you're not on one of those, don't even worry about it ✨.
• -h name and -soname=name — when creating an ELF shared object, this sets the internal DT_SONAME field to the specified name. When an executable is linked with a shared object that has a DT_SONAME field, then when the executable is run, the dynamic linker will attempt to load the shared object specified by the DT_SONAME field rather than using the file name given to the linker. It's giving "I know you by your government name, not your nickname" energy 😭.
• -i — perform an incremental link (same as option -r). Short, sweet, to the point 💖.
• -init=name — when creating an ELF executable or shared object, call NAME when the executable or shared object is loaded, by setting DT_INIT to the address of the function. By default, the linker uses "_init" as the function to call. Mirror image of -fini, slay 🎀.
• -l namespec and --library=namespec — add the archive or object file specified by namespec to the list of files to link. This option may be used any number of times, you can spam it fr fr.

If namespec is of the form :filename, ld will search the library path for a file called filename. Otherwise, it will search the library path for a file called libnamespec.a.

On systems which support shared libraries, ld may also search for files other than libnamespec.a. Specifically, on ELF and SunOS systems, ld will search a directory for a library called libnamespec.so before searching for one called libnamespec.a. (By convention, a .so extension indicates a shared library.) Note that this behavior does not apply to :filename, which always specifies a file called filename — no searching, just direct, periodt.

The linker will search an archive only once, at the location where it is specified on the command line. If the archive defines a symbol which was undefined in some object which appeared before the archive on the command line, the linker will include the appropriate file(s) from the archive. However, an undefined symbol in an object appearing later on the command line will not cause the linker to search the archive again. So order matters, bestie 👑.

See the -( option for a way to force the linker to search archives multiple times. And yes, you may list the same archive multiple times on the command line — no cap 🌈.

okay and this whole archive-searching thing? it's literally the standard behaviour for Unix linkers, everybody does it. BUT — if you're running ld on AIX, bestie, heads up: it does not behave like the AIX linker. totally different vibe. 🙈

• -L searchdir, --library-path=searchdir — pushes searchdir onto the list of paths that ld will dig through looking for archive libraries and ld control scripts. you can use this one as many times as you want, no cap. the directories get searched in the exact order you put them on the command line, and dirs you specify on the command line get searched before the default ones. also: all -L options apply to all -l options, no matter what order the options show up in. the one exception — -L options don't change how ld hunts for a linker script unless you've specified the -T option. ✨

if searchdir starts with = or $SYSROOT, that prefix gets swapped out for the sysroot prefix — controlled by the --sysroot option, or however the linker was configured. 🎀

the default set of paths it searches (the ones you never typed with -L) depends on which emulation mode ld is in, and sometimes also on how it was configured. 🌸

you can also set paths inside a link script using the SEARCH_DIR command. those get searched at the exact point where the linker script appears on the command line. 📍

• -m emulation — emulate the emulation linker. you can list every emulation available with the --verbose or -V options. 💅

if -m isn't used at all, the emulation gets pulled from the LDEMULATION environment variable, if it's defined. otherwise the default emulation just depends on how the linker was configured. that's it, that's the whole hierarchy. 🫶

• --remap-inputs=pattern=filename, --remap-inputs-file=file — these let you rename input files before the linker even tries to open them. iconic, honestly.

so --remap-inputs=foo.o=bar.o means any attempt to load a file called foo.o will instead try to load bar.o. wildcard patterns are allowed in that first filename, so --remap-inputs=foo*.o=bar.o renames any input file matching foo*.o into bar.o. 🦋

there's an alternate form, --remap-inputs-file=filename, which reads the remappings out of a file instead. each line can hold a single remapping. blank lines are ignored. anything from a hash character (#) to the end of a line counts as a comment and gets ignored too. the mapping pattern can be separated from the filename by whitespace or by an equals sign (=). 🍓

you can specify these options multiple times — their contents accumulate. remappings get processed in the order they show up on the command line, and if they come from a file, in the order they appear in the file. and here's the kicker: if a match is made, no further checking happens for that filename. done, moved on. 💀

if the replacement filename is /dev/null or just NUL, then the remapping actually makes the input file get ignored entirely. super convenient if you wanna experiment with yanking input files out of a complicated build environment. 🙈

note — this option is position dependent and only affects filenames that come after it on the command line. so this:

ld foo.o --remap-inputs=foo.o=bar.o

has no effect, whereas this:

ld --remap-inputs=foo.o=bar.o foo.o

renames the input file foo.o to bar.o. 📌

also note — these options affect files referenced by INPUT statements in linker scripts too. BUT since linker scripts get processed after the entire command line is read, the position of the remap options on the command line isn't significant in that case. 🔥

if verbose is enabled, any mappings that match get reported — although again, verbose needs to be enabled on the command line before the remapped filenames show up. and if -Map or --print-map is enabled, the remapping list gets included in the map output too. 💖

• -M, --print-map — prints a link map to standard output. a link map is basically the receipts for your link, and it hands you:
  • where object files get mapped into memory 💾
  • how common symbols get allocated
  • every archive member included in the link, plus a mention of the symbol that dragged that archive member in
  • the values assigned to symbols. ⭐

note — symbols whose values get computed by an expression that references a previous value of the same symbol might not display the correct result in the link map. why? because the linker throws away intermediate results and only keeps the final value of an expression. in those cases the linker shows the final value wrapped in square brackets. so for example, a linker script containing:

foo = 1
foo = foo * 4
foo = foo + 8

will produce this in the link map if -M is used:

0x00000001                foo = 0x1
[0x0000000c]                foo = (foo * 0x4)
[0x0000000c]                foo = (foo + 0x8)

see Expressions for more info about expressions in linker scripts. 📚

• how GNU properties get merged. when the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties get removed or updated, and those actions get reported in the link map. for example:

Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)

this means property 0xc0000002 is removed from the output while merging properties in foo.o (whose 0xc0000002 value is 0x1) and bar.o (which straight up doesn't have property 0xc0000002). 💀

Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)

this means property 0xc0010001's value is updated to 0x1 in the output while merging properties in foo.o (whose 0xc0010001 value is 0x1) and bar.o (whose 0xc0010001 value is 0x1). slay. 💅

• on some ELF targets, a list of fixups inserted by --relax:

foo.o: Adjusting branch at 0x00000008 towards "far" in section .text

this means the branch at 0x00000008 in foo.o, targeting the symbol "far" in section .text, has been replaced by a trampoline. 🧚

• --print-map-discarded, --no-print-map-discarded — print (or don't print) the list of discarded and garbage collected sections in the link map. enabled by default. 🗑️
• --print-map-locals, --no-print-map-locals — print (or don't print) local symbols in the link map. local symbols get the text (local) printed right before their name, and they show up after all the global symbols in a given section. temporary local symbols (typically the ones starting with .L) will not be included in the output. disabled by default. 🙅
• -n, --nmagic — turns off page alignment of sections, and disables linking against shared libraries. if the output format supports Unix style magic numbers, it marks the output as "NMAGIC". 🎀
• -N, --omagic — sets the text and data sections to be readable and writable. also: don't page-align the data segment, and disable linking against shared libraries. if the output format supports Unix style magic numbers, it marks the output as "OMAGIC".

note — although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. so, like, it'll work but Microsoft said no. 😭

• --no-omagic — this one negates most of the effects of the -N option. it sets the text section to read-only, and forces the data segment to be page-aligned. but listen — this option does not enable linking against shared libraries. for that you want -Bdynamic. periodt. 👑
• -o output, --output=output — use output as the name for the program ld produces. if you don't specify this option, the name a.out is used by default. the script command OUTPUT can also specify the output file name. 🌈

note — the linker will delete the output file before it starts writing to it. it does this even if the link turns out to be impossible to complete because of errors. yes, really. 🙈

note — the linker checks that the output file name doesn't match the name of any of the input files, but that is all it checks. in particular it will not complain if the output file might overwrite a source file or some other important file. so in build systems it's recommended to use -o as the last option on the linker command line. for example, consider:

ld -o $(EXE) $(OBJS)
ld $(OBJS) -o $(EXE)

if the EXE variable isn't defined for some reason, the first version of the command could end up deleting one of the object files (the first one in the OBJS list), whereas the second version will generate an error message and not delete anything. that's a real bug-shaped footgun, bestie. 💀

• --dependency-file=depfile — write a dependency file to depfile. this file contains a rule suitable for make describing the output file and all the input files that were read to produce it. the output is similar to what the compiler gives you with -M -MP.

note — there's no option like the compiler's -MM to exclude "system files" (which honestly isn't a well-specified concept in the linker, unlike "system headers" in the compiler). so the output from --dependency-file is always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. 📝

• -O level — if level is a numeric value greater than zero, ld optimizes the output. this might take significantly longer, so it probably should only be enabled for the final binary. at the moment this option only affects ELF shared library generation. future releases of the linker may make more use of this option. also, currently there's no difference in the linker's behaviour for different non-zero values of this option. again, this may change with future releases. ⚡

If level is zero or the string fast, then ld is like "bestie we're speedrunning this 💨" and just skips the operations that are optional. Faster link, yes — but the binaries come out slower and chunkier. Warning: this is giving tradeoff energy. RN the only operation getting skipped is the combining of mergeable sections, but that could change later, so don't go building your whole personality on it.

If level is the string default, or literally just the - character, then you get the linker's default behaviour: no optimizing, no skipping, just vibes. The classic. 💅

• -plugin name — pull a plugin into the linking process. The name param is the absolute filename of the plugin. Usually your compiler auto-adds this when you're doing link time optimization, but bestie you can absolutely add your own plugins if you feel like it. ✨

Heads up tho: compiler-originated plugins live somewhere different from where ar, nm and ranlib go hunting for their plugins. So for those commands to actually use a compiler-based plugin, you gotta copy it into the ${libdir}/bfd-plugins directory first. The good news? All gcc-based linker plugins are backward compatible, so copying in just the newest one is enough. One and done 🫶

• --push-state — this one saves the current state of all the flags that control input file handling, so you can restore every single one of them later with the corresponding --pop-state option. Snapshot, bestie 📸

The options it covers: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, --link-mapless, --no-link-mapless, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a. Yes, all of them. Iconic list ngl 👑

One target for this option is pkg-config specifications. When it's used with the --libs option, all the possibly-needed libraries get listed and then possibly linked with all the time, which is kinda wasteful. It's better to return something like this instead:

-Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state

• --pop-state — undoes whatever --push-state did, restoring the previous values of the flags that govern input file handling. The rewind button ⏪
• -q, --emit-relocs — leaves the relocation sections and their contents in fully linked executables. Why would you want that? Because post-link analysis and optimization tools might need that info to correctly modify executables. The cost: bigger executables. The catch: currently this option is only supported on ELF platforms. Sorry, other platforms 😭
• --force-dynamic — forces the output file to have dynamic sections. This one is specific to VxWorks targets. That's it, that's the whole thing 🎯
• -r, --relocatable — generates relocatable output, meaning an output file that can then serve as input to ld all over again. This is what everyone calls partial linking. Fun side effect: in environments that support standard Unix magic numbers, this option also sets the output file's magic number to "OMAGIC". If you don't specify this option, you get an absolute file instead. And when you're linking C++ programs, this option will not resolve references to constructors — for that you need -Ur.

When an input file doesn't have the same format as the output file, partial linking is only supported if that input file contains no relocations. Different output formats can have even more restrictions; like, some "a.out"-based formats straight up don't support partial linking with input files in other formats. Periodt.

When the relocatable output has both contents that require link-time optimization (LTO) and contents that don't, a .gnu_object_only section gets created to hold a relocatable object file, as if -r was applied to all the relocatable inputs that don't require LTO. And when processing a relocatable input with a .gnu_object_only section, the linker extracts the .gnu_object_only section as a separate input.

Real talk tho: since -r groups some sections from different input files together, there may be negative impacts on code size and locality in the final executable or shared library. Just so you know 💀

This option does the same thing as -i.

• -R filename, --just-symbols=filename — reads symbol names and their addresses from filename, but does not relocate it or include it in the output. This lets your output file refer symbolically to absolute locations of memory defined in other programs. You can use this option more than once. 🔥

For compatibility with other ELF linkers: if -R is followed by a directory name rather than a file name, it gets treated as the -rpath option. Sneaky little shapeshifter 🙈

• --rosegment, --no-rosegment — attempts to ensure that only a single read-only, non-code segment gets created. Only useful when paired with the -z separate-code option. The resulting binaries should be smaller than if you used -z separate-code on its own. Without this option, or if --no-rosegment is specified, -z separate-code will create two read-only segments — one before the code segment and one after it.

Yeah the names of these options are misleading, but they were chosen so the linker stays compatible with the LLD and GOLD linkers. Blame compatibility, not us 🫠

These options are only supported by ELF targets.

• -s, --strip-all — omits all symbol information from the output file. Everything. Gone. ✂️
• -S, --strip-debug — omits debugger symbol information (but not all the symbols) from the output file. So it's a lighter strip, a lil trim if you will.
• --strip-discarded, --no-strip-discarded — omit (or do not omit) global symbols that are defined in discarded sections. Enabled by default. ⭐
• -plugin-save-temps — stores the plugin "temporary" intermediate files permanently. They stay. Forever. No takebacks 💾
• -t, --trace — prints the names of the input files as ld processes them. Give -t twice and the members within archives get printed too. The -t output is genuinely useful for generating a list of all the object files and scripts involved in linking — like, say, when you're packaging files for a linker bug report. Cheat code for debugging fr fr 📝
• -T scriptfile, --script=scriptfile — use scriptfile as the linker script. This script replaces ld's default linker script (rather than adding to it), unless the script contains "INSERT" — in which case commandfile must specify everything necessary to describe the output file. So like, all the responsibility is on you bestie 😅

If scriptfile doesn't exist in the current directory, ld goes looking for it in the directories specified by any preceding -L options.

Command line options that appear before the -T option can affect the script, but command line options that appear after it do not.

Multiple -T options will accumulate if they're augmenting the current script, otherwise the last, non-augmenting, -T option wins.

There are other ways of specifying linker scripts too. See

• -dT scriptfile, --default-script=scriptfile — use scriptfile as the default linker script.

This is similar to the --script option except that processing of the script is delayed until after the rest of the command line has been processed. That's the whole point, actually — it lets options placed after the --default-script option on the command line still affect the behaviour of the linker script. Super important when the linker command line can't be directly controlled by the user (eg because the command line is being constructed by another tool, such as gcc). Big brain energy 🧠✨

• -u symbol, --undefined=symbol — forces symbol to be entered in the output file as an undefined symbol. Doing this may, for example, trigger the linking of additional modules from standard libraries. -u can be repeated with different option arguments to enter more undefined symbols. This option is equivalent to the "EXTERN" linker script command.

If you're using this option to force extra modules into the link, and it's an error for the symbol to remain undefined, then you should use --require-defined instead. Don't use the wrong one, okay? 😤

• --require-defined=symbol — requires that symbol is defined in the output file. This is the same as --undefined except that if symbol isn't defined in the output file, the linker will issue an error and exit. The same effect can be achieved in a linker script by using "EXTERN", "ASSERT" and "DEFINED" together. You can use this option multiple times to require additional symbols. Chain them, queen ⛓️👑
• -Ur — for programs that don't use constructors or destructors, or for ELF-based systems, this option is equivalent to -r: it generates relocatable output, i.e. an output file that can in turn serve as input to ld. For other binaries tho, -Ur is similar to -r but it also resolves references to constructors and destructors.

For those systems where -r and -Ur behave differently: it does not work to use -Ur on files that were themselves linked with -Ur. Once the constructor table has been built, it cannot be added to. So use -Ur only for the last partial link, and -r for all the others. Learn from this, bestie 🙏

• --orphan-handling=MODE — controls how orphan sections are handled. An orphan section is one that isn't specifically mentioned in a linker script. Aww, little orphan 🥺

MODE can have any of these values:

• "place" — orphan sections get placed into a suitable output section following the strategy described in Orphan Sections. The option --unique also affects how sections are placed.
• "discard" — all orphan sections are thrown out, by placing them in the /DISCARD/ section. Bye bye 👋
• "warn" — the linker places the orphan section as it would for "place" and issues a warning.
• "error" — the linker exits with an error if any orphan section is found.

The default if --orphan-handling isn't given is "place".

• --unique[=SECTION] — creates a separate output section for every input section matching SECTION, or if the optional wildcard SECTION argument is missing, for every orphan input section (and yes, an orphan section is one not specifically mentioned in a linker script, same as above). You can use this option multiple times on the command line. It prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script. Breaking up the cliques, one section at a time 💅
• -v, --version, -V — displays the version number for ld. The -V option also lists the supported emulations. See also the description of --enable-linker-version in Options,,Command-line Options, which can be used to insert the linker version string into a binary. Version check, babe 🌈
• -x, --discard-all — deletes all local symbols. All of them. Iconic level of ruthless 🗑️💖

---

• -X, --discard-locals — bestie, this one just deletes ALL the temporary local symbols. Like, gone gone. (These are the ones that start with whatever system-specific local label prefix your platform uses — usually .L on ELF systems, or just L on traditional a.out systems.) 💅
• -y symbol, --trace-symbol=symbol — okay so this prints out the name of every single linked file where symbol shows up. 👀 You can drop this option as many times as you want. Heads up tho: on many systems you gotta prepend an underscore. This one is lowkey a lifesaver when you've got an undefined symbol in your link and zero clue where the reference is even coming from. 🕵️‍♀️
• -Y path — adds path to the default library search path. This exists purely for Solaris compatibility, so don't come for it. ✨
• -z keyword — okay queen, this is the big one, here are all the recognized keywords:
  • call-nop=prefix-addr, call-nop=suffix-nop, call-nop=prefix-byte, call-nop=suffix-byte — these specify the 1-byte "NOP" padding used when transforming an indirect call to a locally defined function, foo, via its GOT slot. Specifically: call-nop=prefix-addr generates "0x67 call foo". call-nop=suffix-nop generates "call foo 0x90". call-nop=prefix-byte generates "byte call foo". And call-nop=suffix-byte generates "call foo byte". Supported for i386 and x86_64. 🧚
  • cet-report=none, cet-report=warning, cet-report=error — these decide how the linker reports missing GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK properties in the input .note.gnu.property section. cet-report=none, which is the default, makes the linker just... not report missing properties in input files (iconic, honestly). cet-report=warning makes it issue a warning for missing properties in input files. cet-report=error makes it issue an error for missing properties in input files. Just so you know: ibt will turn off the missing GNU_PROPERTY_X86_FEATURE_1_IBT property report, and shstk will turn off the missing GNU_PROPERTY_X86_FEATURE_1_SHSTK property report. Supported for Linux/i386 and Linux/x86_64. 🛡️
  • combreloc, nocombreloc — combine multiple dynamic relocation sections and sort them to improve dynamic symbol lookup caching. If it's nocombreloc... don't do this. Simple as that. 💅
  • common, nocommon — generate common symbols with STT_COMMON type during a relocatable link. Use STT_OBJECT type if nocommon. 🌸
  • common-page-size=value — set the page size you most commonly use to value. The memory image layout will get optimized to minimize memory pages if the system is using pages of this size. ✨
  • defs — report unresolved symbol references from regular object files. This happens even if the linker is creating a non-symbolic shared library. This option is the inverse of -z undefs. 🔄
  • dynamic-undefined-weak, nodynamic-undefined-weak — make undefined weak symbols dynamic when building a dynamic object, but only if they're referenced from a regular object file and not forced local by symbol visibility or versioning. nodynamic-undefined-weak means don't make them dynamic. If you give neither option, a target may default to either one being in force, or it may make some other selection of undefined weak symbols dynamic. Heads up: not all targets support these options. 🙈
  • execstack — marks the object as requiring an executable stack. 🫡
  • global — this one only means anything when you're building a shared object. It makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries. 👑
  • globalaudit — only meaningful when building a dynamic executable. It marks the executable as requiring global auditing by setting the "DF_1_GLOBAUDIT" bit in the "DT_FLAGS_1" dynamic tag. And global auditing requires that any auditing library defined via the --depaudit or -P command-line options be run for all dynamic objects loaded by the application. periodt. 🔍
  • ibtplt — generate Intel Indirect Branch Tracking (IBT) enabled PLT entries. Supported for Linux/i386 and Linux/x86_64. ⭐
  • ibt — generate GNU_PROPERTY_X86_FEATURE_1_IBT in the .note.gnu.property section to signal compatibility with IBT. This one also implies ibtplt. Supported for Linux/i386 and Linux/x86_64. 🔥
  • indirect-extern-access, noindirect-extern-access — generate GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS in the .note.gnu.property section to indicate that the object file requires canonical function pointers and can't be used with copy relocation. This option also implies noextern-protected-data and nocopyreloc. Supported for i386 and x86-64. Meanwhile noindirect-extern-access removes GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS from the .note.gnu.property section. 🦋
  • initfirst — only meaningful when building a shared object. It marks the object so its runtime initialization happens before the runtime initialization of any other objects brought into the process at the same time. And symmetrically, its runtime finalization happens after the runtime finalization of any other objects. main character energy fr. 👑
  • interpose — tells the dynamic loader to modify its symbol search order so that symbols in this shared library interpose all other shared libraries not marked this way. 💅
  • unique, nounique — when generating a shared library or other dynamically loadable ELF object, this marks it as one that should (by default) only ever be loaded once, and only in the main namespace (when using "dlmopen"). It's mostly used to mark fundamental libraries like libc, libpthread et al, which don't usually work correctly unless they're the sole instance of themselves. This behavior can be overridden by the "dlmopen" caller, and it doesn't apply to certain loading mechanisms (like audit libraries). 🔒
  • lam-u48 — generate GNU_PROPERTY_X86_FEATURE_1_LAM_U48 in the .note.gnu.property section to signal compatibility with Intel LAM_U48. Supported for Linux/x86_64. ✨
  • lam-u57 — generate GNU_PROPERTY_X86_FEATURE_1_LAM_U57 in the .note.gnu.property section to signal compatibility with Intel LAM_U57. Supported for Linux/x86_64. ✨
  • lam-u48-report=none, lam-u48-report=warning, lam-u48-report=error — how to report the missing GNU_PROPERTY_X86_FEATURE_1_LAM_U48 property in the input .note.gnu.property section. lam-u48-report=none, which is the default, makes the linker not report missing properties in input files. lam-u48-report=warning makes it issue a warning for missing properties in input files. lam-u48-report=error makes it issue an error for missing properties in input files. Supported for Linux/x86_64. 📋
  • lam-u57-report=none, lam-u57-report=warning, lam-u57-report=error — same deal but for the missing GNU_PROPERTY_X86_FEATURE_1_LAM_U57 property in the input .note.gnu.property section. lam-u57-report=none is the default and makes the linker not report missing properties in input files. lam-u57-report=warning issues a warning for missing properties in input files. lam-u57-report=error issues an error for missing properties in input files. Supported for Linux/x86_64. 📋
  • lam-report=none, lam-report=warning, lam-report=error — this one covers both missing properties at once: GNU_PROPERTY_X86_FEATURE_1_LAM_U48 and GNU_PROPERTY_X86_FEATURE_1_LAM_U57 in the input .note.gnu.property section. lam-report=none, the default, makes the linker not report missing properties in input files. lam-report=warning makes it issue a warning for missing properties in input files. lam-report=error makes it issue an error for missing properties in input files. Supported for Linux/x86_64. 📋
  • lazy — when generating an executable or shared library, this marks it to tell the dynamic linker to defer function call resolution until the point when the function is actually called (that's lazy binding), instead of doing it at load time. Fun fact: lazy binding is the default anyway. 😴
  • loadfltr — specify that the object's filters be processed immediately at runtime. ⚡
  • max-page-size=value — set the maximum supported memory page size to value. 📐
  • mark-plt, nomark-plt — mark PLT entries with the dynamic tags DT_X86_64_PLT, DT_X86_64_PLTSZ and DT_X86_64_PLTENT. BUT — and this is a big but — since this option stores a non-zero value in the r_addend field of R_X86_64_JUMP_SLOT relocations, the resulting executables and shared libraries are incompatible with dynamic linkers, like those in older versions of glibc that don't have the change to ignore r_addend in R_X86_64_GLOB_DAT and R_X86_64_JUMP_SLOT relocations, which don't ignore the r_addend field of R_X86_64_JUMP_SLOT relocations. Supported for x86_64. 💀
  • muldefs — allow multiple definitions. That's it, that's the whole thing. 🤝
  • nocopyreloc — disable linker-generated .dynbss variables used in place of variables defined in shared libraries. Heads up: this may result in dynamic text relocations. 🙈
  • nodefaultlib — specify that the dynamic loader's search for dependencies of this object should ignore any default library search paths. 🚫
  • nodelete — specify that the object shouldn't be unloaded at runtime. 🔒
  • nodlopen — specify that the object is not available to "dlopen". 🙅‍♀️
  • nodump — specify that the object can not be dumped by "dldump". 🙅‍♀️
  • noexecstack — marks the object as not requiring an executable stack. 🎀
  • noextern-protected-data — don't treat protected data symbols as external when building a shared library. This option overrides the linker backend default, and you can use it to work around incorrect relocations against protected data symbols that the compiler generated. Just so you know: updates on protected data symbols by another module aren't visible to the resulting shared library. Supported for i386 and x86-64. 🛠️

okay bestie we're still deep in the -z keyword zone and honestly? it's giving ✨buffet✨ 🌸 same rules as before: one bullet per keyword, all the receipts kept, nothing skipped, periodt 💅

• noreloc-overflow — kills the relocation overflow check. you'd only reach for this if you're 100% sure there'll be no dynamic relocation overflow at run-time. setup: x86_64 only 🫶
• memory-seal, nomemory-seal — tells the executable or shared library that all PT_LOAD segments should be sealed to avoid any further manipulation (aka changing the protection flags, the segment size, or removing the mapping). it's a security hardening thing and it requires system support. this generates GNU_PROPERTY_MEMORY_SEAL in the .note.gnu.property section ✨
• now — when you're generating an executable or shared library, this marks it to tell the dynamic linker to resolve all symbols when the program is started, or when the shared library is loaded by dlopen, instead of deferring function call resolution to the moment the function is first called. no procrastination allowed in this house 💅
• origin — says the object requires $ORIGIN handling in paths. that's the whole thing. iconic, brief 🎀
• pack-relative-relocs, nopack-relative-relocs — generates compact relative relocation in position-independent executable and shared library. it adds DT_RELR, DT_RELRSZ and DT_RELRENT entries to the dynamic section. it gets ignored when you're building position-dependent executable and relocatable output, so don't even. nopack-relative-relocs is the default, and it disables compact relative relocation. when you link against the GNU C Library, a GLIBC_ABI_DT_RELR symbol version dependency on the shared C Library gets added to the output, fr fr. supported for i386 and x86-64
• relro, norelro — creates an ELF PT_GNU_RELRO segment header in the object. that declares a memory segment that should be made read-only after relocation, if supported 🦋 ⚠️ watch out: specifying common-page-size smaller than the system page size will render this protection ineffective (rip). norelro means don't create that ELF PT_GNU_RELRO segment.
• report-relative-reloc — reports the dynamic relative relocations generated by the linker. supported for Linux/i386 and Linux/x86_64
• sectionheader, nosectionheader — generates the section header. nosectionheader = no section header, obviously 💀. sectionheader is the default.
• separate-code, noseparate-code — creates a separate code PT_LOAD segment header in the object. that memory segment should contain only instructions and it must be in wholly disjoint pages from any other data, no overlap bestie. noseparate-code = don't create that separate code PT_LOAD segment.
• shstk — generates GNU_PROPERTY_X86_FEATURE_1_SHSTK in the .note.gnu.property section to indicate compatibility with Intel Shadow Stack. she's secure, she's iconic 👑 supported for Linux/i386 and Linux/x86_64
• stack-size=value — specifies a stack size for an ELF PT_GNU_STACK segment. specifying zero will override any default non-zero sized PT_GNU_STACK segment creation.
• start-stop-gc, nostart-stop-gc — okay deep breath bestie 🫁 this one's a mouthful. When --gc-sections is in effect, a reference from a retained section to __start_SECNAME or __stop_SECNAME causes all input sections named SECNAME to also be retained, if SECNAME is representable as a C identifier and either __start_SECNAME or __stop_SECNAME is synthesized by the linker. -z start-stop-gc disables this effect, which lets sections be garbage collected as if the special synthesized symbols were not defined. -z start-stop-gc has no effect on a definition of __start_SECNAME or __stop_SECNAME in an object file or linker script. such a definition will prevent the linker from providing a synthesized __start_SECNAME or __stop_SECNAME respectively, and therefore there's no special treatment by garbage collection for those references. (yes it's a lot, iykyk 😭)
• start-stop-visibility=value — specifies the ELF symbol visibility for the synthesized __start_SECNAME and __stop_SECNAME symbols. value must be exactly default, internal, hidden, or protected. if no -z start-stop-visibility option is given, protected is used for compatibility with historical practice. however it's highly recommended to use -z start-stop-visibility=hidden in new programs and shared libraries so these symbols aren't exported between shared objects, which is not usually what's intended 💀
• text, notext, textoff — reports an error if DT_TEXTREL is set, i.e. if the position-independent or shared object has dynamic relocations in read-only sections. notext or textoff = don't report that error.
• undefs — do not report unresolved symbol references from regular object files, either when creating an executable or when creating a shared library. this option is the inverse of -z defs.
• unique-symbol, nounique-symbol — avoids duplicated local symbol names in the symbol string table. if unique-symbol is used, it appends "."number"" to duplicated local symbol names. nounique-symbol is the default.
• x86-64-baseline, x86-64-v2, x86-64-v3, x86-64-v4 — specifies the x86-64 ISA level needed in the .note.gnu.property section:
  • x86-64-baseline generates GNU_PROPERTY_X86_ISA_1_BASELINE
  • x86-64-v2 generates GNU_PROPERTY_X86_ISA_1_V2
  • x86-64-v3 generates GNU_PROPERTY_X86_ISA_1_V3
  • x86-64-v4 generates GNU_PROPERTY_X86_ISA_1_V4

supported for Linux/i386 and Linux/x86_64 🔥

• isa-level-report=none, isa-level-report=all, isa-level-report=needed, isa-level-report=used — specifies how to report x86-64 ISA levels in input relocatable files, bestie:
  • isa-level-report=none — the default — makes the linker not report x86-64 ISA levels in input files at all. silence 🤫
  • isa-level-report=all — makes the linker report needed and used x86-64 ISA levels in input files
  • isa-level-report=needed — makes the linker report needed x86-64 ISA levels in input files
  • isa-level-report=used — makes the linker report used x86-64 ISA levels in input files

supported for Linux/i386 and Linux/x86_64

other keywords are ignored for Solaris compatibility. yes, really, that's the whole sentence 🎀

---

• --gnu-tls-tag, --no-gnu-tls-tag — adds a GLIBC_ABI_GNU_TLS version tag dependency in output programs and shared libraries when linking against glibc, if input relocatable object files call ___tls_get_addr. heads up bestie: the output will fail to load and run at run-time against a glibc which doesn't define the GLIBC_ABI_GNU_TLS version tag. unless it's disabled by the --disable-gnu-tls-tag configure option at linker build time, when no options are specified the linker will add the GLIBC_ABI_GNU_TLS version tag dependency if the inputs have a ___tls_get_addr call and libc.so defines the GLIBC_ABI_GNU_TLS version tag. supported for Linux/i386
• --gnu2-tls-tag, --no-gnu2-tls-tag — same energy, different tag ✨ adds a GLIBC_ABI_GNU2_TLS version tag dependency in output programs and shared libraries when linking against glibc if input relocatable object files have an R_386_TLS_DESC_CALL or R_X86_64_TLSDESC_CALL relocation. the output will fail to load and run at run-time against a glibc which doesn't define the GLIBC_ABI_GNU2_TLS version tag. unless it's disabled by the --disable-gnu2-tls-tag configure option at linker build time, when no options are specified the linker will add the GLIBC_ABI_GNU2_TLS version tag dependency if the inputs have an R_386_TLS_DESC_CALL or R_X86_64_TLSDESC_CALL relocation and libc.so defines the GLIBC_ABI_GNU2_TLS version tag. supported for Linux/i386 and Linux/x86_64
• -( archives -), --start-group archives --end-group — the archives here should be a list of archive files. they can be either explicit file names, or -l options.

the specified archives get searched repeatedly until no new undefined references are created, slay 🔁. normally an archive is searched only once, in the order it's specified on the command line. so if a symbol in that archive is needed to resolve an undefined symbol referred to by an object in an archive that appears later on the command line, the linker would not be able to resolve that reference (so rude of it). by grouping the archives, they all get searched repeatedly until all possible references are resolved 🫶

this option is not allowed within a --start-lib/--end-lib option pair.

using this option has a significant performance cost. bestie, it's best to use it only when there are unavoidable circular references between two or more archives.

• --start-lib objects --end-lib — the objects here should be a list of object files.

the specified objects get treated as if they were members of an archive, the name of which has been placed at the location of --start-lib on the command line. all the usual linker archive handling properties and command line options apply to this little artificial archive 💅

this option may be used multiple times, in which case each set of the objects specified gets treated as an individual archive. nesting this option is not allowed though.

options that affect archive processing are not allowed between --start-lib and --end-lib, because it would make no sense to apply them midway through handling an archive. those options include: -(/--start-group, -)/--end-group, --whole-archive, and --no-whole-archive, as well as --pop-state where it would change the state of the --whole-archive setting.

• --accept-unknown-input-arch, --no-accept-unknown-input-arch — tells the linker to accept input files whose architecture it cannot even recognise 💀 the assumption is that the user knows what they're doing and deliberately wants to link in these unknown input files (chaotic, but okay, we respect the vision 👑). this was the default behaviour of the linker before release 2.14. the default behaviour from release 2.14 onwards is to reject such input files, and so the --accept-unknown-input-arch option has been added to restore the old behaviour.
• --as-needed, --no-as-needed — okay bestie, this one is about ELF DT_NEEDED tags for dynamic libraries that show up on the command line after the --as-needed option. Normally the linker is out here being generous and adding a DT_NEEDED tag for every single dynamic library on the command line, whether you actually needed it or not 🙈. --as-needed says: nope, we're only emitting a DT_NEEDED tag for a library that, at that exact point in the link, satisfies a non-weak undefined symbol reference from a regular object file — or, if that library isn't found in the DT_NEEDED lists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. Object files or libraries that appear on the command line after the library in question? They don't get a vote on whether it's seen as needed. It's giving the same energy as the rules for extracting object files from archives, fr fr. --no-as-needed puts the default behaviour back. ✨

Note lowkey important: on Linux based systems, --as-needed also affects how --rpath and --rpath-link behave. Go read the --rpath-link description for the deets 👑

• --add-needed, --no-add-needed — these two got deprecated 💀 because their names were too similar to --as-needed and --no-as-needed (chaos, honestly). They've been replaced by --copy-dt-needed-entries and --no-copy-dt-needed-entries. Periodt.
• -assert keyword — this one is just ignored, for SunOS compatibility. It's giving "we're keeping it around to be polite" 🎀
• -Bdynamic, -dy, -call_shared — link against dynamic libraries. This only means anything on platforms where shared libraries are supported, and on those platforms it's normally the default. The different variants exist for compatibility with various systems. You can absolutely use this option multiple times on the command line — it affects library searching for -l options that come after it. 👑
• -Bgroup — sets the "DF_1_GROUP" flag in the "DT_FLAGS_1" entry in the dynamic section. This makes the runtime linker perform lookups in this object and its dependencies only inside the group. --unresolved-symbols=report-all is implied. Only meaningful on ELF platforms that support shared libraries. 🦋
• -Bstatic, -dn, -non_shared, -static — do NOT link against shared libraries. Only meaningful on platforms where shared libraries are supported. The different variants are for compatibility with various systems. You may use this option multiple times on the command line — it affects library searching for -l options that follow it. This option also implies --unresolved-symbols=report-all. Oh and plot twist: this option can be used with -shared — doing so means a shared library is being created but all of the library's external references must be resolved by pulling in entries from static libraries. 💅
• -Bsymbolic — when you're creating a shared library, this binds references to global symbols to the definition within the shared library, if there is one. Normally a program linked against a shared library is allowed to override the definition inside that shared library (sneaky, iconic). Only meaningful on ELF platforms which support shared libraries. ✨
• -Bsymbolic-functions — same vibe as above, but only for references to global function symbols: they get bound to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries. 🎀
• -Bno-symbolic — this one can cancel previously specified -Bsymbolic and -Bsymbolic-functions. The undo button 🫶
• *--dynamic-list=dynamic-list-file* — hand the linker the name of a dynamic list file. Typically used when creating shared libraries to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library, or when creating dynamically linked executables to specify a list of symbols that should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries. 👑

The format of the dynamic list is the same as the version node without scope and node name. See VERSION for more info, bestie.

• --dynamic-list-data — include all global data symbols in the dynamic list. All of them. Every last one 💖
• --dynamic-list-cpp-new — provides the builtin dynamic list for C++ operator new and delete. Mainly useful for building shared libstdc++. Niche but slay ✨
• --dynamic-list-cpp-typeinfo — provides the builtin dynamic list for C++ runtime type identification. 🦋
• --check-sections, --no-check-sections — asks the linker to not check section addresses after they've been assigned, to see if there are any overlaps. Normally the linker does perform this check, and if it finds overlaps it'll produce suitable error messages. And get this — the linker does know about, and does make allowances for, sections in overlays. You can restore the default behaviour with --check-sections. Also ngl, section overlap isn't usually checked for relocatable links — but you can force the checking in that case by using the --check-sections option. 🔥
• --copy-dt-needed-entries, --no-copy-dt-needed-entries — this one is all about how dynamic libraries referred to by DT_NEEDED tags (inside ELF dynamic libraries mentioned on the command line) get treated. Normally the linker won't add a DT_NEEDED tag to the output binary for each library mentioned in a DT_NEEDED tag in an input dynamic library. But with --copy-dt-needed-entries on the command line, any dynamic libraries that follow it will have their DT_NEEDED entries added. Default behaviour comes back with --no-copy-dt-needed-entries. 💅

This option also does something to symbol resolution in dynamic libraries. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line get recursively searched, following their DT_NEEDED tags to other libraries, to resolve symbols required by the output binary. With the default setting, though, the searching of dynamic libraries that follow it stops with the dynamic library itself — no DT_NEEDED links get traversed to resolve symbols. 🫶

• --cref — outputs a cross reference table ✨. If a linker map file is being generated, the cross reference table gets printed to the map file. Otherwise it's printed on standard output. 👑

The format of the table is intentionally simple, so a script can easily process it if needed. The symbols are printed out, sorted by name. For each symbol, you get a list of file names. If the symbol is defined, the first file listed is where the definition lives. If the symbol is defined as a common value, then any files where that happens appear next. And finally, any files that reference the symbol are listed. 💖

• --ctf-variables, --no-ctf-variables — so the CTF debuginfo format supports a section that encodes the names and types of variables in the program that don't appear in any symbol table. Those variables obviously can't be looked up by address by conventional debuggers, so the space used for their types and names is usually wasted — the types are usually small, but the names are often not 😭. --ctf-variables causes the generation of such a section. Default behaviour restored with --no-ctf-variables. 🎀
• *--ctf-share-types=method* — adjusts the method used to share types between translation units in CTF. Two options, bestie:
  • share-unconflicted — put all types that don't have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default. ✨
  • share-duplicated — put only types that occur in multiple translation units into the shared dictionary: types with only one definition go into per-translation-unit dictionaries. Types with ambiguous definitions in multiple translation units always go into per-translation-unit dictionaries. This tends to make the CTF larger, but may reduce the amount of CTF in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime. 👑
• --no-define-common — inhibits the assignment of addresses to common symbols. The script command "INHIBIT_COMMON_ALLOCATION" has the same effect. 🦋

--no-define-common lets you decouple the decision to assign addresses to Common symbols from the choice of output file type; otherwise a non-Relocatable output type forces assigning addresses to Common symbols. Using --no-define-common allows Common symbols that are referenced from a shared library to be assigned addresses only in the main program. This eliminates the unused duplicate space in the shared library, and also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution. Very "no redundant space, no confusion" of it 💅

• --force-group-allocation — causes the linker to place section group members like normal input sections, and to delete the section groups. This is the default behaviour for a final link, but this option can be used to change the behaviour of a relocatable link (-r). The script command "FORCE_GROUP_ALLOCATION" has the same effect. 🔥
• *--defsym=symbol*=expression — creates a global symbol in the output file, containing the absolute address given by expression. You may use this option as many times as necessary to define multiple symbols on the command line. A limited form of arithmetic is supported for the expression here: you can give a hexadecimal constant or the name of an existing symbol, or use + and - to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider the linker command language from a script instead. 🎀

Note, bestie: there should be no white space between the symbol, the equals sign ("="), and the expression. None. Zero. Nada 😭

The way the linker handles --defsym and -T is literally about order, bestie — it processes them in the sequence you give them. Put --defsym before -T and the symbol gets defined before the linker script from -T is processed. Put --defsym after -T and the symbol gets defined after the linker script has already been processed. And that difference actually matters for any expressions inside the linker script that reference your --defsym symbols. Which order is the right one? Depends entirely on what you're trying to achieve, no cap. 🎀

---

• --demangle[=style], --no-demangle — these control whether symbol names get demangled in error messages and other output. When the linker is told to demangle, it tries to make symbol names readable: it strips leading underscores if the object file format uses them, and converts C++ mangled names into names that are actually human-readable. Different compilers mangle differently, so the optional style argument lets you pick the right demangling style for your compiler. By default, the linker demangles — unless the environment variable COLLECT_NO_DEMANGLE is set. These options override that default. ✨
• -Ifile, --dynamic-linker=file — sets the name of the dynamic linker. Only meaningful when you're generating dynamically linked ELF executables. The default dynamic linker is normally correct, so don't touch this unless you know what you're doing. 💀
• --no-dynamic-linker — when producing an executable, skip the request for a dynamic linker to be used at load time. Only meaningful for ELF executables that contain dynamic relocations, and it usually needs entry point code that can handle those relocations. 🌸
• --embedded-relocs — similar to --emit-relocs, except the relocs get stored in a target-specific section. Only supported by the BFIN, CR16 and M68K targets. 🦋
• --disable-multiple-abs-defs — do not allow multiple definitions for symbols included in filename invoked by -R or --just-symbols. 🚫
• --fatal-warnings, --no-fatal-warnings — treat all warnings as errors. Want the chill default back? --no-fatal-warnings restores it. 👑
• -w, --no-warnings — do not display any warning or error messages. This one overrides --fatal-warnings if that's been enabled. Use it when you know the output binary won't work but you still need to create it. Yes, that's a real use case, and yes, it's unhinged. 😭
• --force-exe-suffix — makes sure an output file has a .exe suffix.

If a successfully built, fully linked output file doesn't have a .exe or .dll suffix, this option forces the linker to copy the output file to one of the same name with a .exe suffix. It's useful when you're using unmodified Unix makefiles on a Microsoft Windows host, because some versions of Windows refuse to run an image unless it ends in .exe. 💅

• --gc-sections, --no-gc-sections — enables garbage collection of unused input sections. It's ignored on targets that don't support it. Want the default back (i.e. no garbage collection)? Pass --no-gc-sections on the command line. Heads up: garbage collection for COFF and PE format targets is supported, but the implementation is currently considered experimental. ⚠️

--gc-sections figures out which input sections are used by examining symbols and relocations. The section containing the entry symbol is kept, as are all sections containing symbols undefined on the command line, and sections containing symbols referenced by dynamic objects. And note: when building shared libraries, the linker must assume that any visible symbol is referenced. Once that initial set of sections is nailed down, the linker recursively marks as used any section referenced by their relocations. Peep --entry, --undefined, and --gc-keep-exported. 🔍

You can also set this option while doing a partial link (that's the one enabled with -r). In that case the root of the symbols kept must be explicitly specified — either by one of --entry, --undefined, or --gc-keep-exported, or by an ENTRY command in the linker script. ✨

And as a GNU extension: ELF input sections marked with the SHF_GNU_RETAIN flag will not be garbage collected. 🌈

• --print-gc-sections, --no-print-gc-sections — lists every section removed by garbage collection. The listing goes to stderr. Only effective if garbage collection has been enabled via the --gc-sections option. Want the default back (not listing the removed sections)? --no-print-gc-sections restores it. 📋
• --gc-keep-exported — when --gc-sections is enabled, this prevents garbage collection of unused input sections that contain global symbols with default or protected visibility. It's meant for executables where unreferenced sections would otherwise get garbage collected regardless of the external visibility of the symbols inside them. Note: this option has no effect when linking shared objects, because that's already the default behaviour there. Only supported for ELF format targets. 💜
• --print-output-format — prints the name of the default output format (possibly influenced by other command-line options). This is the string that would show up in an OUTPUT_FORMAT linker script command. 🖨️
• --print-memory-usage — prints used size, total size, and used size of memory regions created with the MEMORY command. Super handy on embedded targets for a quick peek at how much free memory you've got. The output format is one headline and one line per region — both human readable and easy for tools to parse. Here's an example:

        Memory region         Used Size  Region Size  %age Used
                     ROM:        256 KB         1 MB     25.00%
                     RAM:          32 B         2 GB      0.00%

Note: if you want to find out about the memory usage of the linker itself, then the --stats option will do that. 🍓

• --help — prints a summary of the command-line options on standard output and exits. 🫶
• --target-help — prints a summary of all target-specific options on standard output and exits. 🎀
• -Map=mapfile — prints a link map to the file mapfile. See the description of the -M option, above. If mapfile is just the character - then the map gets written to stdout. 📝

Specifying a directory as mapfile makes the linker write the map as a file inside that directory. Normally the name of the file inside the directory is computed as the basename of the output file with .map appended. If, however, the special character % is used, it gets replaced by the full path of the output file. And if there are any characters after the %, then .map is no longer appended. Behold:

 -o foo.exe -Map=bar                  [Creates ./bar]
 -o ../dir/foo.exe -Map=bar           [Creates ./bar]
 -o foo.exe -Map=../dir               [Creates ../dir/foo.exe.map]
 -o ../dir2/foo.exe -Map=../dir       [Creates ../dir/foo.exe.map]
 -o foo.exe -Map=%                    [Creates ./foo.exe.map]
 -o ../dir/foo.exe -Map=%             [Creates ../dir/foo.exe.map]
 -o foo.exe -Map=%.bar                [Creates ./foo.exe.bar]
 -o ../dir/foo.exe -Map=%.bar         [Creates ../dir/foo.exe.bar]
 -o ../dir2/foo.exe -Map=../dir/%     [Creates ../dir/../dir2/foo.exe.map]
 -o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]

Specifying more than one % character is an error. 🚨

And if the map file already exists, it gets overwritten by this operation. 💀

• --no-keep-memory — ld normally optimizes for speed over memory usage by caching the symbol tables of input files in memory. This option flips that: now it optimizes for memory usage instead, rereading the symbol tables as needed. You might need this if ld runs out of memory space while linking a large executable. 😮‍💨
• --no-undefined, -z defs — report unresolved symbol references from regular object files. It does this even if the linker is creating a non-symbolic shared library. The switch --[no-]allow-shlib-undefined controls the behaviour for reporting unresolved references found in shared libraries being linked in. 🌟

You can revert the effects of this option by using -z undefs. ↩️

• --allow-multiple-definition, -z muldefs — normally, when a symbol is defined multiple times, the linker reports a fatal error. These options allow multiple definitions, and the first definition is the one that gets used. 👀
• --allow-shlib-undefined, --no-allow-shlib-undefined — allows or disallows undefined symbols in shared libraries. Similar to --no-undefined, except this one decides the behaviour when the undefined symbols live in a shared library rather than a regular object file. It does not affect how undefined symbols in regular object files are handled. 🦋

Default behaviour: report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable, but allow them if the linker is being used to create a shared library. 📌

The reasons for allowing undefined symbol references in shared libraries specified at link time are:

• A shared library specified at link time may not be the same as the one available at load time, so the symbol might actually be resolvable at load time. ✨
• There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are normal.

The BeOS kernel, for example, patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for example, to dynamically select an appropriate memset function. 🧚

• --error-handling-script=scriptname — okay so if you hand the linker this option, it will run scriptname every single time it hits an error. Rn tho, only two flavors of error are supported: missing symbols and missing libraries. Two arguments get passed to the script: the keyword "undefined-symbol" or missing-lib" , plus the actual name of the undefined symbol or the missing library. The whole idea? Your script pops off with suggestions for where that symbol or library might be hiding. Once the script is done doing its thing, the normal linker error message still gets displayed. 💅

Heads up bestie — whether this option even exists is controlled by a configure-time switch, so it might be straight up missing in some implementations. 🙈

• --no-undefined-version — normally, when a symbol has an undefined version, the linker just ignores it (iconic chill behavior). This option says no ma'am — symbols with an undefined version get disallowed and a fatal error gets issued instead.
• --default-symver — creates and uses a default symbol version (the soname) for unversioned exported symbols.
• --default-imported-symver — creates and uses a default symbol version (the soname) for unversioned imported symbols.
• --no-warn-mismatch — so normally ld will throw an error at you if you try to link input files that are mismatched for literally any reason — maybe they got compiled for different processors, or different endiannesses. 🌈 This option tells ld to silently permit those possible errors. ⚠️ Only use this with care, in cases where you've already taken some special action that makes sure the linker errors are inappropriate.
• --no-warn-search-mismatch — normally ld will warn you if it finds an incompatible library while doing a library search. This option silences that warning. 🤫
• --no-whole-archive — turns off the effect of the --whole-archive option for the archive files that come after it. Not allowed inside a --start-lib/--end-lib option pair.
• --no-link-mapless — rejects archives that lack an index, aka a symbol map, for all the subsequent archives referred to on the command line. If such a file shows up, you get a link error. This is the traditional behavior.
• --noinhibit-exec — retains the executable output file whenever it's still usable. Normally the linker won't produce an output file at all if it hits errors during the link process — it just exits without writing an output file the moment it issues any error whatsoever.
• -nostdlib — only search the library directories you explicitly named on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line) get ignored. 👑
• --oformat=output-format — ld may be configured to support more than one kind of object file. If your ld is built that way, you can use --oformat to specify the binary format for the output object file. Even when ld supports alternative object formats, you usually don't need to say anything — ld should be configured to spit out the most usual format on each machine as the default. output-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i.) The script command "OUTPUT_FORMAT" can also specify the output format, but this option overrides it. ✨
• --out-implib file — creates an import library in file corresponding to the executable the linker is generating (eg. a DLL or ELF program). This import library (which should be called "*.dll.a" or "*.a" for DLLs) may be used to link clients against the generated executable — this behavior makes it possible to skip a separate import library creation step (eg. "dlltool" for DLLs). This option is only available for the PE and ELF targeted ports of the linker.
• -pie, --pic-executable — creates a position independent executable. Currently this is only supported on ELF platforms. Position independent executables get relocated by the dynamic linker to whatever virtual address the OS chooses for them, which can vary between invocations. They're marked ET_DYN in the ELF file header, but they differ from shared libraries in a bunch of ways. In particular, defined symbols in a PIE by default can not be overridden by another object the way they can be in a shared library. 🦋
• -no-pie — creates a position dependent executable. This is the default.
• -qmagic — this option is ignored for Linux compatibility. 💀
• -Qy — this option is ignored for SVR4 compatibility.
• --relax, --no-relax — an option with machine dependent effects. Only supported on a few targets, bestie.

On some platforms the --relax option performs target specific, global optimizations that become possible once the linker resolves addressing in the program — stuff like relaxing address modes, synthesizing new instructions, selecting shorter versions of current instructions, and combining constant values. 🎀

On some platforms these link time global optimizations may make symbolic debugging of the resulting executable impossible. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors. 😭

On platforms where the feature is supported, the option --no-relax will disable it.

On platforms where the feature is not supported, both --relax and --no-relax are accepted, but ignored.

• --retain-symbols-file=filename — retain only the symbols listed in the file filename, discarding literally all the others. filename is simply a flat file, with one symbol name per line. This option is especially useful in environments (such as VxWorks) where a large global symbol table is accumulated gradually, to conserve run-time memory. 🧠

--retain-symbols-file does not discard undefined symbols, or symbols needed for relocations.

You may only specify --retain-symbols-file once in the command line. It overrides -s and -S.

• -rpath=dir — adds a directory to the runtime library search path. This is used when linking an ELF executable with shared objects. All -rpath arguments get concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime. 🔍

The -rpath option is also used when locating shared objects which are needed by shared objects explicitly included in the link; see the description of the -rpath-link option. Searching -rpath this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option.

If -rpath is not used when linking an ELF executable, the contents of the environment variable "LD_RUN_PATH" will be used if it is defined.

The -rpath option may also be used on SunOS. By default on SunOS, the linker forms a runtime search path out of all the -L options it's given. If a -rpath option is used, the runtime search path gets formed exclusively using the -rpath options, ignoring the -L options. This can be useful when using gcc, which adds many -L options which may be on NFS mounted file systems. 🌸

For compatibility with other ELF linkers, if the -R option is followed by a directory name, rather than a file name, it's treated as the -rpath option.

• -rpath-link=dir — when using ELF or SunOS, one shared library may require another. This happens when an "ld -shared" link includes a shared library as one of the input files. 🫶

When the linker encounters such a dependency while doing a non-shared, non-relocatable link, it will automatically try to locate the required shared library and include it in the link, if it isn't included explicitly. In such a case, several directories get searched as described below. The -rpath-link option specifies the first set of directories to search. This option may specify a sequence of directory names either by providing a list of names separated by colons, or by appearing multiple times.

The tokens $ORIGIN and $LIB can appear in these search directories. They'll be replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN, and either lib — for 32-bit binaries — or lib64 — for 64-bit binaries — in the case of $LIB.

The alternative form of these tokens — ${ORIGIN} and ${LIB} — can also be used. The token $PLATFORM is not supported.

⚠️ The --rpath-link option should be used with caution as it overrides the search path that may have been hard compiled into a shared library. In such a case it's possible to unintentionally use a different search path than the runtime linker would have used. Not the vibe you want, fr fr.

When additional shared libraries are required, the linker will search directories in the order listed below in order to find them. Note however that this only applies to additional libraries needed to satisfy already included shared libraries. It does not apply to libraries that are included via the -l command line option. Searches for -l libraries are only conducted in directories specified by the -L option.

1. Any directories specified by -rpath-link options.
2. Any directories specified by -rpath options. The difference between -rpath and -rpath-link is that directories specified by -rpath options are included in the executable and used at runtime, whereas the -rpath-link option is only effective at link time. Searching -rpath this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option.
3. On an ELF system, for native linkers, if the -rpath and -rpath-link options were not used, search the contents of the environment variable "LD_RUN_PATH".
4. On SunOS, if the -rpath option was not used, search any directories specified using -L options.
5. For a native linker, search the contents of the environment variable "LD_LIBRARY_PATH".
6. For a native ELF linker, the directories in "DT_RUNPATH" or "DT_RPATH" of a shared library are searched for shared libraries needed by it. The "DT_RPATH" entries are ignored if "DT_RUNPATH" entries exist. 💜

7. For a Linux linker, if the file /etc/ld.so.conf exists, it's the list of directories found in that file. Note: the path to this file is prefixed with the "sysroot" value, if that is defined, and then any "prefix" string if the linker was configured with the --prefix=<path> option. 🐧
8. For a native linker on a FreeBSD system, any directories specified by the "_PATH_ELF_HINTS" macro defined in the elf-hints.h header file. 🦋
9. Any directories specified by a "SEARCH_DIR" command in a linker script given on the command line, including scripts specified by -T (but not -dT). 🌸
10. The default directories, normally /lib and /usr/lib. 👑
11. Any directories specified by a plugin LDPT_SET_EXTRA_LIBRARY_PATH. ✨
12. Any directories specified by a "SEARCH_DIR" command in a default linker script. 💫

Note however on Linux based systems there is an additional caveat: If the --as-needed option is active and a shared library is located which would normally satisfy the search and this library does not have DT_NEEDED tag for libc.so and there is a shared library later on in the set of search directories which also satisfies the search and this second shared library does have DT_NEEDED tag for libc.so then the second library will be selected instead of the first. 😱

If the required shared library is not found, the linker will issue a warning and continue with the link. 🫶

• --section-ordering-file=script — This option is used to augment the current linker script with additional mapping of input sections to output sections. This file must use the same syntax for "SECTIONS" as is used in normal linker scripts, but it should not do anything other than place input sections into output sections. @pxref{SECTIONS}

A second constraint on the section ordering script is that it can only reference output sections that are already defined by whichever linker script is currently in use. (Ie the default linker script or a script specified on the command line). The benefit of the section ordering script however is that the input sections are mapped to the start of the output sections, so that they can ensure the ordering of sections in the output section. For example, imagine that the default linker script looks like this:

SECTIONS {
  .text : { *(.text.hot) ; *(.text .text.*) }
  .data : { *(.data.big) ; *(.data .data.*) }
  }

Then if a section ordering file like this is used:

.text : { *(.text.first) ; *(.text.z*) }
.data : { foo.o(.data.first) ; *(.data.small) }

This would be equivalent to a linker script like this:

SECTIONS {
  .text : { *(.text.first) ; *(.text.z*) ; *(.text.hot) ; *(.text .text.*) }
  .data : { foo.o(.data.first) ; *(.data.small) ; *(.data.big) ; *(.data .data.*) }
  }

The advantage of the section ordering file is that it can be used to order those sections that matter to the user without having to worry about any other sections, or memory regions, or anything else. 💅

• -shared, -Bshareable — Create a shared library. This is currently only supported on ELF, XCOFF and SunOS platforms. On SunOS, the linker will automatically create a shared library if the -e option is not used and there are undefined symbols in the link. 🎀
• --sort-common, --sort-common=ascending, --sort-common=descending — This option tells ld to sort the common symbols by alignment in ascending or descending order when it places them in the appropriate output sections. The symbol alignments considered are sixteen-byte or larger, eight-byte, four-byte, two-byte, and one-byte. This is to prevent gaps between symbols due to alignment constraints. If no sorting order is specified, then descending order is assumed. ✨
• --sort-section=name — This option will apply "SORT_BY_NAME" to all wildcard section patterns in the linker script. 🌸
• --sort-section=alignment — This option will apply "SORT_BY_ALIGNMENT" to all wildcard section patterns in the linker script. 🦋
• --spare-dynamic-tags=count — This option specifies the number of empty slots to leave in the .dynamic section of ELF shared objects. Empty slots may be needed by post processing tools, such as the prelinker. The default is 5. 👑
• --split-by-file[=size] — Similar to --split-by-reloc but creates a new output section for each input file when size is reached. size defaults to a size of 1 if not given. 💅
• --split-by-reloc[=count] — Tries to create extra sections in the output file so that no single output section in the file contains more than count relocations. This is useful when generating huge relocatable files for downloading into certain real time kernels with the COFF object file format; since COFF cannot represent more than 65535 relocations in a single section. Note that this will fail to work with object file formats which do not support arbitrary sections. The linker will not split up individual input sections for redistribution, so if a single input section contains more than count relocations one output section will contain that many relocations. count defaults to a value of 32768. 😭
• --stats[=filename] — Compute and display statistics about the operation of the linker, such as execution time and memory usage.

If the optional filename argument is not supplied then only basic information is reported, and it is sent to the standard error output stream. If the filename argument is supplied then extended information is written to the named file. If filename is set to just the - symbol, then the extended information is sent to the standard output stream. If the filename starts with + then the file is opened in append mode rather than overwrite mode.

If the -Map option has been enabled then the information is also recorded in the map file as well. Note: if both the --stats option and the -Map options have been given filename arguments and they match, then the information will only be written out once not twice.

If the "LD_STATS" environment variable is defined then this behaves like the --stats option. If the variable's value is a string then this will used as the name of a file into which the information should be recorded. Otherwise the information will be sent to the standard output stream. Using the environment variable allows stats to be recorded without having to alter the linker's command line. Note: if both the environment variable and the --stats option are used then the --stats option takes precedence.

The extended information reported includes the cpu time used and, if the getrusage() system library call is available then maximum set size and the user and system run times as well. In addition if the mallinfo or mallinfo2 system library calls are available then the total memory usage is reported,

The information is displayed for individual parts of the linking process which are referred to as phases. Note that individual phases can contain or overlap with each other so it should not be assumed that the overall resources used by the linker is the sum of the resources used by the individual phases.

In addition the information is also reported for a special phase called ALL which covers the entire linking process.

When extended information is being reported the linker version, command line arguments and linker start time are also included. This makes it easier to handle the situation where multiple links are being invoked by a build system and to identify exactly which arguments were responsible for producing the statistics that are reported.

The extended output looks something like this:

Stats: linker version: (GNU Binutils) 2.44.50.20250401
Stats: linker started: Wed Apr  2 09:36:41 2025
Stats: args: ld -z norelro -z nomemory-seal -z no-separate-code -o a.out [...]

Stats: phase               cpu time       rss      user time    system time     memory
Stats: name                (microsec)   (KiB)      (seconds)      (seconds)      (KiB)
Stats: ALL                   390082    217740              0              0   25219440
Stats: ctf processing            12         0              0              0          0
Stats: string merge            1324         0              0              0     406544
Stats: parsing                  349       288              0              0     119792
Stats: plugins                    1         0              0              0          0
Stats: processing files      259616    214524              0              0   31569120
Stats: write                 116493         0              0              0      48096

• --no-stats — Disables the reporting of usage statistics, should it have been enabled via the --stats command line option or the LD_STATS environment variable. 🚫
• --sysroot=directory — Use directory as the location of the sysroot, overriding the configure-time default. This option is only supported by linkers that were configured using --with-sysroot. 🌈
• --task-link — This is used by COFF/PE based targets to create a task-linked object file where all of the global symbols have been converted to statics. 🛠️
• --traditional-format — For some targets, the output of ld is different in some ways from the output of some existing linker. This switch requests ld to use the traditional format instead.

For example, on SunOS, ld combines duplicate entries in the symbol string table. This can reduce the size of an output file with full debugging information by over 30 percent. Unfortunately, the SunOS "dbx" program can not read the resulting program ("gdb" has no trouble). The --traditional-format switch tells ld to not combine duplicate entries. 😭

• --section-start=sectionname=org — bestie, this drops a section into the output file at the absolute address org. You can stack this option as many times as you need to place multiple sections from the command line — it's giving ✨ unlimited power ✨. org has to be a single hexadecimal integer, and for compatibility with other linkers you're allowed to skip the leading 0x that hex values usually rock with.

🚨 Warning, queen: there should be no white space between sectionname, the equals sign (=), and org. None. Zero. Not even a little one. Don't do it. 💅

• --image-base=org — two moods depending on your format, okay?
  • When you're using ELF: this is the same as -Ttext-segment, and both of those options are effectively setting the base address of the ELF executable.
  • When you're using PE: the value becomes the base address of your program or dll. This is the lowest memory location that'll be used when your program or dll gets loaded. To cut down on the need to relocate and to boost your dlls' performance, each one should have its own unique base address and not overlap any other dlls. The default is 0x400000 for executables, and 0x10000000 for dlls.
• -Tbss=org
• -Tdata=org
• -Ttext=org — these three are literally just --section-start, but with ".bss", ".data" or ".text" as the sectionname. That's it, that's the whole vibe. 🦋
• -Ttext-segment=org — when you're creating an ELF executable, this sets the address of the first byte of the first segment. Now listen: when -pie is used together with -Ttext-segment=org, the output executable gets marked ET_EXEC, so the address of the first byte of the text segment is guaranteed to be org at run time. Slay, honestly. 💖
• -Trodata-segment=org — when you're making an ELF executable or shared object for a target where the read-only data lives in its own segment, separate from the executable text, this sets the address of the first byte of the read-only data segment. 🎀
• -Tldata-segment=org — when you're creating an ELF executable or shared object for the x86-64 medium memory model, this sets the address of the first byte of the ldata segment. Very niche, very iconic. ⭐
• --unresolved-symbols=method — this one decides how unresolved symbols get handled, and there are four possible values for method:
  • ignore-all — don't report any unresolved symbols. Blissful ignorance, honestly.
  • report-all — report all unresolved symbols. This is the default, so this is the energy you're already living in. 👑
  • ignore-in-object-files — report unresolved symbols that are contained in shared libraries, but ignore them if they come from regular object files.
  • ignore-in-shared-libs — report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. This one is useful when you're creating a dynamic binary and you already know that all the shared libraries it should be referencing are included on the linker's command line. iykyk. 💅

The behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option.

Normally the linker generates an error message for each reported unresolved symbol, but the --warn-unresolved-symbols option can switch that over to a warning instead.

• --dll-verbose
• --verbose[=NUMBER] — this duo displays the version number for ld and lists the linker emulations supported. It also shows you which input files can and cannot be opened, and displays the linker script being used by the linker. And if the optional NUMBER argument is greater than 1, plugin symbol status gets displayed too. So much information, so little time. 😭
• --version-script=version-scriptfile — hands the linker the name of a version script. This is typically used when you're creating shared libraries, to specify extra info about the version hierarchy for the library being created. It's only fully supported on ELF platforms that support shared libraries — check the VERSION section. It's partially supported on PE platforms, which can use version scripts to filter symbol visibility in auto-export mode: any symbols marked local in the version script won't be exported. 🫶
• --warn-common — this warns you when a common symbol gets combined with another common symbol, or with a symbol definition. Unix linkers allow this kinda sloppy practice, but linkers on some other operating systems are like "absolutely not." This option helps you find potential problems from combining global symbols. Sadly, some C libraries use this practice, so you might catch warnings about symbols in the libraries too, not just in your own programs. Not their fault, but it's still on your screen. 🙈

There are three kinds of global symbols, illustrated here with C examples:

int i = 1;

A definition, which goes in the initialized data section of the output file.

extern int i;

An undefined reference, which does not allocate space. There must be either a definition or a common symbol for the variable somewhere.

int i;

A common symbol. If there are only (one or more) common symbols for a variable, it goes in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol. If they're different sizes, it picks the largest size. And the linker turns a common symbol into a declaration if there's a definition of the same variable. ✨

The --warn-common option can produce five kinds of warnings. Each warning is a pair of lines: the first describes the symbol just encountered, and the second describes the previous symbol encountered with the same name. One or both of the two symbols will be a common symbol.

1. Turning a common symbol into a reference, because there's already a definition for the symbol.

<file>(<section>): warning: common of `<symbol>'
   overridden by definition
<file>(<section>): warning: defined here

2. Turning a common symbol into a reference, because a later definition for the symbol is encountered. This is the same as the previous case, except the symbols are encountered in a different order.

<file>(<section>): warning: definition of `<symbol>'
   overriding common
<file>(<section>): warning: common is here

3. Merging a common symbol with a previous same-sized common symbol.

<file>(<section>): warning: multiple common
   of `<symbol>'
<file>(<section>): warning: previous common is here

4. Merging a common symbol with a previous larger common symbol.

<file>(<section>): warning: common of `<symbol>'
   overridden by larger common
<file>(<section>): warning: larger common is here

5. Merging a common symbol with a previous smaller common symbol. This is the same as the previous case, except the symbols are encountered in a different order.

<file>(<section>): warning: common of `<symbol>'
   overriding smaller common
<file>(<section>): warning: smaller common is here

• --warn-constructors — warns you if any global constructors are used. Ngl this is only useful for a few object file formats. For formats like COFF or ELF, the linker literally cannot detect the use of global constructors. So it's giving "best effort." 💀
• --warn-execstack
• --warn-execstack-objects
• --no-warn-execstack — on ELF platforms, the linker might throw warning messages at you if it's asked to create an output file containing an executable stack. There are three possible states:
  1. Do not generate any warnings.
  2. Always generate warnings, even if the executable stack was requested via the -z execstack command line option.
  3. Only generate a warning if an object file requests an executable stack, but not if the -z execstack option is used.

The default state depends on how the linker was configured when it was built. The --no-warn-execstack option always puts the linker into the no-warnings state. The --warn-execstack option puts it into the warn-always state. And the --warn-execstack-objects option puts it into the warn-for-object-files-only state. Pick your fighter. 🥊

📝 Note: ELF format input files can specify that they need an executable stack by having a .note.GNU-stack section with the executable bit set in its section flags. They can specify that they don't need an executable stack by having the same section, but without the executable flag bit set. If an input file doesn't have a .note.GNU-stack section, then the default behaviour is target specific. For some targets, the absence of such a section implies that an executable stack is required. This is often a problem for hand crafted assembler files. 😬

• --error-execstack
• --no-error-execstack — if the linker is about to generate a warning message about an executable stack, then the --error-execstack option will change that warning into an error instead. Heads up though: this option does not change the linker's execstack warning generation state. Use --warn-execstack or --warn-execstack-objects if you want to set a specific warning state. And the --no-error-execstack option restores the default behaviour of generating warning messages. Balance restored. 🧚
• --warn-multiple-gp — warns you if multiple global pointer values are required in the output file. This is only meaningful for certain processors, such as the Alpha. Let me explain the lore, bestie: some processors put large-valued constants in a special section, and a special register (the global pointer) points into the middle of this section, so constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g., 16 bits), this limits the maximum size of the constant pool. So in large programs, it's often necessary to use multiple global pointer values to be able to address all possible constants. This option causes a warning to be issued whenever this case occurs. 👑
• --warn-once — only warn once for each undefined symbol, instead of once per module that refers to it. Your terminal will thank you. 🙏
• --warn-rwx-segments
• --no-warn-rwx-segments — warns you if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set. Such a segment represents a potential security vulnerability, so like... pay attention. 🚩 In addition, warnings get generated if a thread local storage segment is created with the execute permission flag set, regardless of whether or not it has the read and/or write flags set. Not me being the security bestie you didn't ask for. 💅

These warnings? Yeah, they're on by default, bestie. You can turn them off with --no-warn-rwx-segments and turn them right back on with --warn-rwx-segments. No drama, just vibes. ✨

• --error-rwx-segments, --no-error-rwx-segments — okay so if the linker was gonna hit you with a warning about an executable/writeable segment, or an executable TLS segment, --error-rwx-segments upgrades that lil warning to a full-on ERROR 😤. And --no-error-rwx-segments just puts it back to the default behaviour where it only warns you.

Heads up queen 🫶 — --error-rwx-segments does NOT turn on the warnings by itself. Those warnings come either from the default (if the linker was configured that way) or from the --warn-rwx-segments command line option. Don't be out here thinking one flag does both jobs.

• --warn-section-align — warns you when the address of an output section gets changed because of alignment. Usually it's an input section that sets the alignment. And bestie, the address only changes if it wasn't explicitly specified — meaning if the SECTIONS command didn't give the section a start address. It's giving polite little heads up energy. 💅
• --warn-textrel — warns if the linker adds DT_TEXTREL to a position-independent executable or shared object. Consider yourself notified. 🎀
• --warn-alternate-em — warns if an object has alternate ELF machine code. Lowkey niche, highkey useful. 🌸
• --warn-unresolved-symbols — so if the linker is about to report an unresolved symbol (peep --unresolved-symbols for the deets), normally it freaks out and generates an error. This option makes it chill and generate a warning instead. 🦋
• --error-unresolved-symbols — restores the linker's default behaviour of straight-up generating errors when it's reporting unresolved symbols. Back to business fr fr.
• --whole-archive — for every archive listed on the command line after the --whole-archive option, include every single object file in the archive in the link, instead of searching the archive for just the object files it needs. Classic use case? Turning an archive file into a shared library by forcing every object into the resulting shared library. You can use this option more than once, no cap. 🔥

Not allowed inside a --start-lib/--end-lib option pair, so don't even try it.

Two notes for when you're using this from gcc: First — gcc doesn't know about this option, so you have to write it as -Wl,-whole-archive. Second — don't forget -Wl,-no-whole-archive after your list of archives, because gcc adds its own list of archives to your link and you probably don't want this flag affecting those too. 🙈

• --link-mapless — accepts archives that lack an index aka symbol map, for all the subsequent archives mentioned on the command line. If it's missing, an index gets made internally on the fly, which costs you performance. And yeah — this is the default. ✨
• --wrap=symbol — use a wrapper function for symbol. Any undefined reference to symbol gets resolved to __wrap_symbol. And any undefined reference to __real_symbol gets resolved to symbol. Iconic little switcheroo. 💫

Use it to provide a wrapper for a system function. Your wrapper function should be called __wrap_symbol, and if it wants to call the actual system function, it should call __real_symbol.

Here's a trivial example:

        void *
        __wrap_malloc (size_t c)
        {
          printf ("malloc called with %zu\n", c);
          return __real_malloc (c);
        }

If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead. And the call to __real_malloc inside __wrap_malloc will call the real malloc function. Slay. 👑

You might also want to provide a __real_malloc function, so that links without the --wrap option still succeed. But if you do, do not put the definition of __real_malloc in the same file as __wrap_malloc — because if you do, the assembler may resolve the call before the linker even gets a chance to wrap it to malloc. Rude of the assembler honestly. 😭

Also important: only undefined references are replaced by the linker. So translation-unit-internal references to symbol do not get resolved to __wrap_symbol. In this next example, the call to f inside g is not resolved to __wrap_f:

        int
        f (void)
        {
          return 123;
        }

        int
        g (void)
        {
          return f();
        }

• --eh-frame-hdr, --no-eh-frame-hdr — request (--eh-frame-hdr) or suppress (--no-eh-frame-hdr) the creation of the .eh_frame_hdr section and the ELF PT_GNU_EH_FRAME segment header. Pick your fighter. 💅
• --no-ld-generated-unwind-info — requests creation of .eh_frame unwind info for linker-generated code sections like PLT. This one is on by default if linker-generated unwind info is supported. 🧚
• --discard-sframe — discards .sframe stack trace info from the output. It also prohibits the creation of SFrame stack trace data for linker-generated code sections like PLT. Off by default, so it's not doing anything until you say so. 🌈
• --enable-new-dtags, --disable-new-dtags — this linker can create the new dynamic tags in ELF, but the older ELF systems may not understand them. 😬 If you specify --enable-new-dtags, the new dynamic tags get created as needed and the older dynamic tags get omitted. If you specify --disable-new-dtags, no new dynamic tags get created. By default, the new dynamic tags are not created. Note note note: these options are only available for ELF systems. Periodt.
• --hash-size=number — sets the default size of the linker's hash tables to a prime number close to number. Bumping this value up can cut down how long the linker takes to do its tasks, but it costs you more memory. Dropping it down saves memory at the expense of speed. Default is 4051 under normal circumstances, and 1021 if the --reduce-memory-overheads command line option is being used. Balance, bestie. ⚖️
• --hash-style=style — sets the type of the linker's hash table(s). style can be sysv for the classic ELF .hash section, gnu for the new style GNU .gnu.hash section, or both for both the classic ELF .hash and the new style GNU .gnu.hash hash tables. The default depends on how the linker was configured, but for most Linux based systems it'll be both. 💖
• --compress-debug-sections=none, --compress-debug-sections=zlib, --compress-debug-sections=zlib-gnu, --compress-debug-sections=zlib-gabi, --compress-debug-sections=zstd — on ELF platforms, these control how DWARF debug sections get compressed using zlib. Let's break it down:
  • --compress-debug-sections=none doesn't compress DWARF debug sections at all.
  • --compress-debug-sections=zlib-gnu compresses DWARF debug sections and renames them to begin with .zdebug instead of .debug.
  • --compress-debug-sections=zlib-gabi also compresses DWARF debug sections, but instead of renaming them it sets the SHF_COMPRESSED flag in the sections' headers.
  • --compress-debug-sections=zlib is an alias for --compress-debug-sections=zlib-gabi.
  • --compress-debug-sections=zstd compresses DWARF debug sections using zstd.

Note that this option overrides any compression in input debug sections. So if a binary is linked with --compress-debug-sections=none, for example, then any compressed debug sections in input files will get uncompressed before they're copied into the output binary. Uncompressed era. 😌

The default compression behaviour varies depending on the target involved and the configure options used to build the toolchain. You can figure out the default by peeping the output from the linker's --help option. Detective work, but make it cute 🔍✨

• --reduce-memory-overheads — reduces memory requirements at ld runtime, at the expense of linking speed. It was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage. Trade-offs, we love to see it. 🎀

Another effect of the switch is setting the default hash table size to 1021, which again saves memory at the cost of lengthening the linker's run time. However — this does not happen if the --hash-size switch has been used. Respect the override, okay?

The --reduce-memory-overheads switch may also be used to enable other tradeoffs in future versions of the linker. Foreshadowing. 👀

• --max-cache-size=size — ld normally caches the relocation information and symbol tables of input files in memory with unlimited size. This option sets the maximum cache size to size.

Note — if the --no-keep-memory command line option has been used, then the linker acts as if the maximum cache size has been set to 0, i.e. nothing is retained. Cold. ❄️

• --build-id, --build-id=style — requests the creation of a .note.gnu.build-id ELF note section, or a .buildid COFF section. The contents of the note are unique bits identifying this linked file. 🦋

style can be:

• uuid — use 128 random bits
• sha1 — use a 160-bit SHA1 hash
• md5 — use a 128-bit MD5 hash
• xx — use a 128-bit XXHASH on the normative parts of the output contents
• 0xhexstring — use a chosen bit string specified as an even number of hexadecimal digits (the - and : characters between digit pairs are ignored)

If style is omitted, sha1 is used.

The md5, sha1, and xx styles produce an identifier that is always the same in an identical output file, but are almost certainly unique among all nonidentical output files. It is not intended to be compared as a checksum for the file's contents. A linked file may get changed later by other tools, but the build ID bit string identifying the original linked file does not change. Immutable queen. 👑

Passing none for style disables the setting from any --build-id options earlier on the command line. Undo, but make it permanent. 💅

• --package-metadata=JSON — bestie, this one asks for a .note.package ELF note section to get created 💌. The note's contents are in JSON format, per the package metadata specification, and you can read the whole thing here: https://systemd.io/ELF_PACKAGE_METADATA/. The JSON argument lowkey supports percent-encoding plus this %[string] escape set (where string refers to the name in HTML's Named Character References): %[comma] for ,, %[lbrace] for {, %[quot] for ", %[rbrace] for }, and %[space] for a space character. If the JSON argument is missing or empty, that disables the creation of the metadata note — but only if one had been enabled by an earlier occurrence of --package-metadata. And if your linker was built with libjansson, then the JSON string gets validated for you. No cap. ✨

The PE linker is out here supporting the -shared option, which makes the output a dynamically linked library (DLL) instead of a normal executable. When you use this one, you should name your output *.dll, mwah 💅. On top of that, the linker fully supports the standard *.def files, and you can hand one to the linker on the command line just like an object file — in fact it should come before the archives it exports symbols from, so those symbols actually get linked in, exactly like a normal object file would. 🎀

In addition to the options common to all targets, the PE linker supports extra command-line options that are specific to the PE target. And for options that take values? You can separate the value from the option with either a space or an equals sign. Obsessed with the flexibility tbh.

• --add-stdcall-alias — if you give this one, symbols with a stdcall suffix (@nn) get exported as-is and with the suffix stripped. Two for one 🌸. [This option is specific to PE targeted ports of the linker]
• --base-file file — use file as the name of a file in which to save the base addresses of all the relocations needed for generating DLLs with dlltool. [This option is specific to PE targeted ports of the linker]
• --dll — create a DLL instead of a regular executable. You may also use -shared or specify a "LIBRARY" in a given ".def" file. So many paths to the same slay ✨ [This option is specific to PE targeted ports of the linker]
• --enable-long-section-names, --disable-long-section-names — the PE variants of the COFF object format add an extension that permits section names longer than eight characters, which is the normal limit for COFF. By default, these names are only allowed in object files, since fully-linked executable images don't carry the COFF string table you'd need to support the longer names 🫶. As a GNU extension, you can allow their use in executable images too, or (probably pointlessly!) disallow it in object files, using these two options. Executable images generated with these long section names are slightly non-standard, carrying a string table as they do, and may generate confusing output when you examine them with non-GNU PE-aware tools, like file viewers and dumpers. However — GDB relies on the use of PE long section names to find Dwarf-2 debug information sections in an executable image at runtime, so if neither option is specified on the command line, ld will enable long section names, overriding the default and technically correct behaviour, whenever it finds debug information present while linking an executable image and not stripping symbols. It's giving "we do a little rule-breaking for the debugger's sake" 💀 [This option is specific to PE targeted ports of the linker]
• --enable-stdcall-fixup, --disable-stdcall-fixup — if the link finds a symbol it can't resolve, it will attempt "fuzzy linking" by looking for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall), and it'll resolve that symbol by linking to the match. For example, the undefined symbol "_foo" might be linked to the function "_foo@12", or the undefined symbol "_bar@16" might be linked to the function "_bar". When the linker does this, it prints a warning, since it normally should have failed to link — but sometimes import libraries generated from third-party DLLs need this feature to be usable, so 🙈. If you specify --enable-stdcall-fixup, this feature is fully enabled and warnings are not printed. If you specify --disable-stdcall-fixup, the feature is disabled and such mismatches are considered to be errors. [This option is specific to PE targeted ports of the linker]
• --leading-underscore, --no-leading-underscore — for most targets the default symbol-prefix is an underscore, and it's defined in the target's description. With this option it's possible to disable/enable that default underscore symbol-prefix ✨ [This option is specific to PE targeted ports of the linker]
• --export-all-symbols — if given, all global symbols in the objects used to build a DLL will be exported by the DLL. Note that this is the default if there otherwise wouldn't be any exported symbols. When symbols are explicitly exported via DEF files or implicitly exported via function attributes, the default is to not export anything else unless this option is given. Heads up, here's who gets excluded from the auto-export party 🎀: the symbols "DllMain@12", "DllEntryPoint@0", "DllMainCRTStartup@12", and "impure_ptr" will not be automatically exported. Also, symbols imported from other DLLs will not be re-exported, and neither will symbols specifying the DLL's internal layout, such as those beginning with "_head_" or ending with "_iname". In addition, no symbols from "libgcc", "libstd++", "libmingw32", or "crtX.o" will be exported. Symbols whose names begin with "__rtti_" or "__builtin_" will not be exported, to help with C++ DLLs. And finally, there's an extensive list of cygwin-private symbols that are not exported (obviously, this applies only when building DLLs for cygwin targets). These cygwin-excludes are: "_cygwin_dll_entry@12", "_cygwin_crt0_common@8", "_cygwin_noncygwin_dll_entry@12", "_fmode", "_impure_ptr", "cygwin_attach_dll", "cygwin_premain0", "cygwin_premain1", "cygwin_premain2", "cygwin_premain3", and "environ". That's a whole list, we love receipts 💅 [This option is specific to PE targeted ports of the linker]
• --exclude-symbols symbol,symbol,... — specifies a list of symbols which should not be automatically exported. The symbol names may be delimited by commas or colons. [This option is specific to PE targeted ports of the linker]
• --exclude-all-symbols — specifies that no symbols should be automatically exported. [This option is specific to PE targeted ports of the linker]
• --file-alignment — specify the file alignment. Sections in the file will always begin at file offsets which are multiples of this number. This defaults to 512. [This option is specific to PE targeted ports of the linker]
• --heap reserve, --heap reserve,commit — specify the number of bytes of memory to reserve (and optionally commit) to be used as heap for this program. The default is 1MB reserved, 4K committed. [This option is specific to PE targeted ports of the linker]
• --kill-at — if given, the stdcall suffixes (@nn) will be stripped from symbols before they are exported. Bye suffix ✂️ [This option is specific to PE targeted ports of the linker]
• --large-address-aware — if given, the appropriate bit in the "Characteristics" field of the COFF header is set to indicate that this executable supports virtual addresses greater than 2 gigabytes. This should be used in conjunction with the /3GB or /USERVA=value megabytes switch in the "[operating systems]" section of the BOOT.INI. Otherwise, this bit has no effect. [This option is specific to the i386 PE targeted port of the linker]
• --disable-large-address-aware — reverts the effect of a previous --large-address-aware option. This is useful if --large-address-aware is always set by the compiler driver (e.g. Cygwin gcc) and the executable does not support virtual addresses greater than 2 gigabytes. [This option is specific to the i386 PE targeted port of the linker]
• --major-image-version value — sets the major number of the "image version". Defaults to 1. [This option is specific to PE targeted ports of the linker]
• --major-os-version value — sets the major number of the "os version". Defaults to 4. [This option is specific to PE targeted ports of the linker]
• --major-subsystem-version value — sets the major number of the "subsystem version". Defaults to 4. [This option is specific to PE targeted ports of the linker]
• --minor-image-version value — sets the minor number of the "image version". Defaults to 0. [This option is specific to PE targeted ports of the linker]
• --minor-os-version value — sets the minor number of the "os version". Defaults to 0. [This option is specific to PE targeted ports of the linker]
• --minor-subsystem-version value — sets the minor number of the "subsystem version". Defaults to 0. [This option is specific to PE targeted ports of the linker]
• --output-def file — the linker will create the file file, which will contain a DEF file corresponding to the DLL the linker is generating 🌸. This DEF file (which should be called "*.def") may be used to create an import library with "dlltool", or may be used as a reference to automatically or implicitly exported symbols. [This option is specific to PE targeted ports of the linker]
• --enable-auto-image-base, --enable-auto-image-base=value — automatically choose the image base for DLLs, optionally starting with base value, unless one is specified using the --image-base argument ✨. By using a hash generated from the dllname to create unique image bases for each DLL, in-memory collisions and relocations which can delay program execution are avoided. [This option is specific to PE targeted ports of the linker]
• --disable-auto-image-base — do not automatically generate a unique image base. If there is no user-specified image base (--image-base) then use the platform default. [This option is specific to PE targeted ports of the linker]
• --dll-search-prefix string — when linking dynamically to a dll without an import library, search for "<string><basename>.dll" in preference to "lib<basename>.dll". This behaviour allows easy distinction between DLLs built for the various "subplatforms": native, cygwin, uwin, pw, etc. For instance, cygwin DLLs typically use --dll-search-prefix=cyg. [This option is specific to PE targeted ports of the linker]
• --enable-auto-import — okay so this one does the ✨sophisticated✨ thing of linking "_symbol" to "__imp__symbol" for DATA imports coming in from DLLs, which means you can straight up bypass the dllimport mechanism on your end and just reference unmangled symbol names. 💅 [This option is specific to PE targeted ports of the linker]

Now real talk: the notes below are about the original implementation of this feature and are obsolete nowadays for Cygwin and MinGW targets. Bestie, they're historical, iykyk.

Note: using the 'auto-import' extension will make the text section of the image file writable. That does not conform to the PE-COFF format spec Microsoft published. 🙈

Note: the 'auto-import' extension will also make read only data — stuff that would normally live in the .rdata section — get placed into the .data section instead. Why? To work around a problem with consts, described right here: http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html

So using 'auto-import' will generally 'just work' — but every now and then you get this message, and it's giving jump scare:

"variable '<var>' can't be auto-imported. Please read the
documentation for ld's "--enable-auto-import" for details."

This message pops up when some (sub)expression accesses an address that's ultimately the sum of two constants (Win32 import tables only allow one, tragic 💀). Places this can happen: accesses to member fields of struct variables imported from a DLL, and using a constant index into an array variable imported from a DLL. Literally any multiword variable (arrays, structs, long long, etc) can trigger this error condition. And no matter what the exact data type of the offending exported variable is, ld will always detect it, issue the warning, and exit. Periodt.

There are several ways to deal with this difficulty, regardless of the data type of the exported variable:

One way is to use the --enable-runtime-pseudo-reloc switch. This hands the job of adjusting references in your client code over to the runtime environment — so this method only works when the runtime environment supports this feature.

A second solution is to force one of the 'constants' to be a variable — meaning unknown and un-optimizable at compile time. For arrays there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. So like:

        extern type extern_array[];
        extern_array[1] -->
           { volatile type *t=extern_array; t[1] }

or

        extern type extern_array[];
        extern_array[1] -->
           { volatile int t=1; extern_array[t] }

For structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the …) variable:

        extern struct s extern_struct;
        extern_struct.field -->
           { volatile struct s *t=&extern_struct; t->field }

or

        extern long long extern_ll;
        extern_ll -->
          { volatile long long * local_ll=&extern_ll; *local_ll }

A third method for dealing with this difficulty is to abandon 'auto-import' for the offending symbol and mark it with "__declspec(dllimport)". But fr in practice that means using compile-time #defines to indicate whether you're building a DLL, building client code that'll link to the DLL, or merely building/linking to a static library. And when you're choosing between the various methods of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:

Original:

        --foo.h
        extern int arr[];
        --foo.c
        #include "foo.h"
        void main(int argc, char **argv){
          printf("%d\n",arr[1]);
        }

Solution 1:

        --foo.h
        extern int arr[];
        --foo.c
        #include "foo.h"
        void main(int argc, char **argv){
          /* This workaround is for win32 and cygwin; do not "optimize" */
          volatile int *parr = arr;
          printf("%d\n",parr[1]);
        }

Solution 2:

        --foo.h
        /* Note: auto-export is assumed (no __declspec(dllexport)) */
        #if (defined(_WIN32) || defined(__CYGWIN__)) && \
          !(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
        #define FOO_IMPORT __declspec(dllimport)
        #else
        #define FOO_IMPORT
        #endif
        extern FOO_IMPORT int arr[];
        --foo.c
        #include "foo.h"
        void main(int argc, char **argv){
          printf("%d\n",arr[1]);
        }

A fourth way to dodge this problem is to re-code your library to use a functional interface instead of a data interface for the offending variables (like set_foo() and get_foo() accessor functions). 🫶

• --disable-auto-import — do not attempt the sophisticated linking of "_symbol" to "__imp__symbol" for DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]
• --enable-runtime-pseudo-reloc — if your code has expressions like the ones described in the --enable-auto-import section, meaning DATA imports from a DLL with non-zero offset, this switch creates a vector of 'runtime pseudo relocations' that the runtime environment can use to adjust references to such data in your client code. [This option is specific to PE targeted ports of the linker]
• --disable-runtime-pseudo-reloc — do not create pseudo relocations for non-zero offset DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]
• --enable-extra-pe-debug — shows extra debug info related to auto-import symbol thunking. [This option is specific to PE targeted ports of the linker]
• --section-alignment — sets the section alignment. Sections in memory will always start at addresses that are a multiple of this number. Defaults to 0x1000. [This option is specific to PE targeted ports of the linker]
• --stack reserve
• --stack reserve,commit — specify how many bytes of memory to reserve (and optionally commit) to use as the stack for this program. Default is 2MB reserved, 4K committed. [This option is specific to PE targeted ports of the linker]
• --subsystem which
• --subsystem which:major
• --subsystem which:major.minor — specifies the subsystem your program will execute under. The legal values for which are "native", "windows", "console", "posix", and "xbox". You may optionally set the subsystem version too. Numeric values are also accepted for which. [This option is specific to PE targeted ports of the linker]

The following options set flags in the "DllCharacteristics" field of the PE file header: [These options are specific to PE targeted ports of the linker]

• --high-entropy-va
• --disable-high-entropy-va — the image is compatible with 64-bit address space layout randomization (ASLR). This option is enabled by default for 64-bit PE images in MinGW targets.

This option also implies --dynamicbase and --enable-reloc-section. [This options is specific to 64-bit PE targeted ports of the linker]

• --dynamicbase
• --disable-dynamicbase — the image base address may be relocated using address space layout randomization (ASLR). This feature showed up with MS Windows Vista. It's enabled by default for MinGW targets but can be disabled via the --disable-dynamicbase option. This option also implies --enable-reloc-section.
• --forceinteg
• --disable-forceinteg — code integrity checks are enforced. This option is disabled by default.
• --nxcompat
• --disable-nxcompat — the image is compatible with the Data Execution Prevention. This feature came in with MS Windows XP SP2. The option is enabled by default for MinGW targets.
• --no-isolation
• --disable-no-isolation — although the image understands isolation, do not isolate the image. This option is disabled by default.
• --no-seh
• --disable-no-seh — the image does not use SEH. No SE handler may be called from this image. This option is disabled by default.
• --no-bind
• --disable-no-bind — do not bind this image. This option is disabled by default.
• --wdmdriver
• --disable-wdmdriver — the driver uses the MS Windows Driver Model. This option is disabled by default.
• --tsaware
• --disable-tsaware — the image is Terminal Server aware. This option is disabled by default.
• --insert-timestamp
• --no-insert-timestamp — insert a real timestamp into the image. This is the default behaviour, 'cause it matches legacy code and it means the image will work with other, proprietary tools. The problem with this default? It results in slightly different images being produced every single time the same sources get linked, which is lowkey cursed. The --no-insert-timestamp option can be used to insert a zero value for the timestamp, which ensures that binaries produced from identical sources will compare identically. ✨

If --insert-timestamp is active then the time inserted is either the time the linking takes place, or — if the "SOURCE_DATE_EPOCH" environment variable is defined — the number of seconds since Unix epoch as specified by that variable.

• --enable-reloc-section
• --disable-reloc-section — create the base relocation table, which is necessary if the image gets loaded at a different image base than the one specified in the PE header. This option is enabled by default.

---

The C6X uClinux target uses a binary format called DSBT to support shared libraries. Each shared library in the system needs its own unique index; all executables use an index of 0. 👑

• --dsbt-size size — this option sets the number of entries in the DSBT of the current executable or shared library to size. The default is to create a table with 64 entries.
• --dsbt-index index — this option sets the DSBT index of the current executable or shared library to index. The default is 0, which is the right vibe for generating executables. If a shared library is generated with a DSBT index of 0, the "R_C6000_DSBT_INDEX" relocs get copied into the output file. 💖

The --no-merge-exidx-entries switch is the little "please don't" button for merging adjacent exidx entries in frame unwind info. 💅

• --branch-stub — this one turns on linker branch relaxation by inserting branch stub sections whenever they're needed to extend the range of branches. Ngl tho, you usually don't need it at all, because C-SKY already supports branch and call instructions that can reach the full memory range, and branch relaxation is normally the compiler's or assembler's whole job. ✨
• --stub-group-size=N — want finer control over linker branch stub creation? Say less, this is it. It sets the maximum size of a group of input sections that one stub section can handle. A negative N puts stub sections after their branches; a positive value lets stub sections show up either before or after the branches. And if you hand it 1 or -1? That just means "linker bestie, you pick suitable defaults." 🫶

---

The 68HC11 and 68HC12 linkers also have their own specific options for controlling memory bank switching mapping and trampoline code generation. 💖

• --no-trampoline — disables generation of the trampoline. By default a trampoline is generated for each far function that gets called with a "jsr" instruction (this happens when a pointer to a far function is taken). 🎀
• --bank-window name — tells the linker the name of the memory region in the MEMORY specification that describes the memory bank window. The linker then uses that region's definition to compute paging and addresses within the memory window. 🌸

---

And for 68K targets, here's the option squad that controls GOT generation when linking: ✨

• --got=type — tells the linker which GOT generation scheme to use. type should be one of single, negative, multigot or target. For more info, go read the Info entry for ld. (iykyk 💅)

---

Now for MIPS targets, these options control microMIPS instruction generation and branch relocation checks for ISA mode transitions: 🦋

• --insn32 / --no-insn32 — these control which microMIPS instructions get used in code the linker generates, like the stuff in the PLT or lazy binding stubs, or in relaxation. If you use --insn32, then the linker only uses 32-bit instruction encodings. By default, or if --no-insn32 is used, all instruction encodings get used, including 16-bit ones where possible. ⭐
• --ignore-branch-isa / --no-ignore-branch-isa — these control branch relocation checks for invalid ISA mode transitions. If --ignore-branch-isa is used, the linker accepts any branch relocations, and any ISA mode transition that was required just gets lost in the relocation calculation — except for a few cases of "BAL" instructions that meet relaxation conditions and get converted to equivalent "JALX" instructions as the associated relocation is calculated. By default, or if --no-ignore-branch-isa is used, a check runs that makes losing an ISA mode transition produce an error. 😭
• --compact-branches / --no-compact-branches — these control the generation of compact instructions by the linker in the PLT entries for MIPS R6. 👑

---

Ok pdp11-aout besties, this one's for you: three variants of the output format can be produced, selected by the options below. The default variant for pdp11-aout is --omagic, whereas for other targets --nmagic is the default. The --imagic option is defined only for the pdp11-aout target, while the others are described here as they apply to the pdp11-aout target. 🌈

• -N, --omagic — marks the output as "OMAGIC" (0407) in the a.out header, which says the text segment is not to be write-protected and shared. Since the text and data sections are both readable and writable, the data section gets allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs and has been the default for ld on PDP11 Unix systems from the very beginning through 2.11BSD. 💜
• -n, --nmagic — marks the output as "NMAGIC" (0410) in the a.out header, which says that when the output file is executed, the text portion will be read-only and shareable among all processes executing that same file. This means moving the data areas up to the first possible 8K byte page boundary following the end of the text. This option creates a pure executable format. ✨
• -z, --imagic — marks the output as "IMAGIC" (0411) in the a.out header, which says that when the output file is executed, the program text and data areas will be loaded into separate address spaces using the split instruction and data space feature of the memory management unit in larger models of the PDP11. This doubles the address space available to the program. The text segment is again pure, write-protected and shareable. The only difference in the output format between this option and the others — besides the magic number — is that both the text and data sections start at location 0. The -z option selected this format in 2.11BSD. This option creates a separate executable format. 🎀
• --no-omagic — equivalent to --nmagic for pdp11-aout. that's it, that's the whole thing. 💅

---

🌟 ENVIRONMENT 🌟

You can absolutely change how ld behaves using the environment variables "GNUTARGET", "LDEMULATION" and "COLLECT_NO_DEMANGLE". 🫶

"GNUTARGET" decides the input-file object format when you're not using -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there's no "GNUTARGET" in the environment, ld uses the natural format of the target. And if "GNUTARGET" is set to "default", then BFD tries to discover the input format by examining binary input files — this method often works, but there are potential ambiguities, since there's no way to guarantee that the magic number used to specify object-file formats is unique. However! The configuration procedure for BFD on each system puts the conventional format for that system first in the search-list, so ambiguities get resolved in favor of convention. 🦋

"LDEMULATION" determines the default emulation when you're not using the -m option. The emulation can affect all sorts of linker behaviour, especially the default linker script. You can list the available emulations with the --verbose or -V options. If -m isn't used and the "LDEMULATION" environment variable isn't defined, the default emulation depends on how the linker was configured. ✨

Normally, the linker defaults to demangling symbols. But if "COLLECT_NO_DEMANGLE" is set in the environment, then it defaults to not demangling symbols. The "gcc" linker wrapper program uses this environment variable in a similar fashion. The default can be overridden by the --demangle and --no-demangle options. 💖

If the PE/COFF specific --insert-timestamp is active and the SOURCE_DATE_EPOCH environment variable is defined, then the timestamp value in that variable gets inserted into the COFF header instead of the current time. ⭐

And if the "LD_STATS" environment variable is defined, then linker resource use information gets recorded, just as if the --stats option had been used. If "LD_STATS" has a string value, that string is used as the name of a file where the info should be stored. Otherwise, the info goes to the standard output stream. 👑

---

🌸 SEE ALSO 🌸

ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld. go read them, they're iconic too. 💜

---

🎀 COPYRIGHT 🎀

Copyright (c) 1991-2026 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

---

aaaand that's a wrap on the whole LD(1) page, bestie!! 🥳✨ you made it to the end, which is honestly main character energy. this gorgeous thing lives in binutils-2.47 and got its final glow-up on 2026-09-10 — slay, date-stamped, and fully iconic. periodt. 💅👑🌈