LD.LLD(1)

💖 ld.lld(1) — the ELF linker from the LLVM project, bestie edition 💖

okay so. you opened the General Commands Manual page for ld.lld and you want the tea. say less. 🫖✨

---

✨ NAME ✨

ld.lld — the ELF linker from the LLVM project. that's it, that's the whole name, she's simple and she serves. 💅

---

🌸 SYNOPSIS 🌸

ld.lld [options] objfile ...

yeah. you give her options, you give her object files, she does her thing. no cap.

---

🦋 DESCRIPTION 🦋

so like, what even is a linker? a linker takes one or more object files, archive files, and library files, and glues them all together into one output file — that could be an executable, a shared library, or just another object file. while she's at it she relocates the code and data from the input files and resolves the symbol references between them. she's basically the group project organizer who actually does the work. 😭👑

ld.lld is a drop-in replacement for the GNU BFD and gold linkers. meaning: she accepts most of the same command line arguments and linker scripts as the GNU linkers do. so if you're migrating, she's not gonna make you rewrite everything. iconic behavior fr fr.

as for targets, she currently supports i386, x86-64, ARM, AArch64, PowerPC32, PowerPC64, MIPS32, MIPS64, RISC-V, AMDGPU, Hexagon and SPARC V9. that's a whole roster. 💖

and here's the cute part: ld.lld acts as a Microsoft link.exe-compatible linker if you invoke her as lld-link, and as macOS's ld if you invoke her as ld.ld64. she's a shapeshifter. main character energy. 🧚

oh and also — all these targets are always supported no matter how ld.lld was built. so you can always use ld.lld as a native linker as well as a cross linker. no build-flag gatekeeping here. periodt.

---

💅 OPTIONS 💅

first, the vibes-level lore about the options themselves: many options have both a single-letter and a long form. when you're using the long form options — other than the ones that start with the letter o — you can specify them with either one or two dashes in front. 💖

but the long options that begin with o? those need two dashes, specifically so nobody gets them confused with the -o path option. iykyk.

---

• --allow-multiple-definition — do not error if a symbol is defined multiple times. the first definition will be used. (yes, the first one. she doesn't do indecision.)
• --allow-shlib-undefined — allow unresolved references in shared libraries. this option is enabled by default when linking a shared library.
• --apply-dynamic-relocs — apply link-time values for dynamic relocations.
• --as-needed — only set DT_NEEDED for shared libraries if used.
• --auxiliary=value — set the DT_AUXILIARY field to the specified name.
• --Bdynamic, --dy — link against shared libraries.
• --Bstatic, --static, --dn — do not link against shared libraries.
• --Bsymbolic — bind defined symbols locally.
• --Bsymbolic-functions — bind defined function symbols locally.
• --build-id=value — generate a build ID note. value may be one of fast, md5, sha1, tree, uuid, 0xhex-string, and none. tree is an alias for sha1. build-IDs of type fast, md5, sha1, and tree are calculated from the object contents. and heads up bestie — fast is not intended to be cryptographically secure. it's fast, not safe. 🙈
• --build-id — synonym for --build-id=fast.
• --color-diagnostics=value — use colors in diagnostics. value may be one of always, auto, and never. auto enables color if and only if output is to a terminal.
• --color-diagnostics — alias for --color-diagnostics=auto.
• --compress-debug-sections=value — compress DWARF debug sections. value may be none or zlib. the default compression level is 1 (fastest) because the debug info usually compresses well at that level — but if you want it squeezed harder, you can specify -O2 to set the compression level to 6. 🗜️✨
• --cref — output cross reference table.
• --define-common, -d — assign space to common symbols.
• --defsym=symbol=expression — define a symbol alias. expression may be another symbol or a linker script expression. for example, --defsym=foo=bar or --defsym=foo=bar+0x100. 🎀
• --demangle — demangle symbol names.
• --disable-new-dtags — disable new dynamic tags.
• --discard-all, -x — delete all local symbols.
• --discard-locals, -X — delete temporary local symbols.
• --discard-none — keep all symbols in the symbol table.
• --dynamic-linker=value — specify the dynamic linker to be used for a dynamically linked executable. this gets recorded in an ELF segment of type PT_INTERP.
• --dynamic-list=file — read a list of dynamic symbols from file. (executable) put matched non-local defined symbols to the dynamic symbol table. (shared object) references to matched non-local STV_DEFAULT symbols shouldn't be bound to definitions within the shared object. implies -Bsymbolic but does not set DF_SYMBOLIC. 😤
• --eh-frame-hdr — request creation of .eh_frame_hdr section and PT_GNU_EH_FRAME segment header.
• --emit-relocs, -q — generate relocations in the output.
• --enable-new-dtags — enable new dynamic tags.
• --end-lib — end a grouping of objects that should be treated as if they were together in an archive.
• --entry=entry — name of entry point symbol.
• --error-limit=value — maximum number of errors to emit before stopping. a value of zero indicates that there is no limit. (chaos mode, respect. 💀)
• --error-unresolved-symbols — report unresolved symbols as errors.
• --execute-only — mark executable sections unreadable. this option is currently only supported on AArch64.
• --exclude-libs=value — exclude static libraries from automatic export.
• --export-dynamic, -E — put symbols in the dynamic symbol table.
• --export-dynamic-symbol=glob — (executable) put matched non-local defined symbols to the dynamic symbol table. (shared object) references to matched non-local STV_DEFAULT symbols shouldn't be bound to definitions within the shared object even if they would otherwise be due to -Bsymbolic, -Bsymbolic-functions or --dynamic-list.
• --fatal-warnings — treat warnings as errors. no more "it's just a warning" coping. 😌
• --filter=value, -F value — set the DT_FILTER field to the specified value.
• --fini=symbol — specify a finalizer function.
• --format=input-format, -b input-format — specify the format of the inputs following this option. input-format may be one of binary, elf, and default. default is a synonym for elf.
• --gc-sections — enable garbage collection of unused sections. take out the trash. 🗑️✨
• --gdb-index — generate .gdb_index section.
• --hash-style=value — specify hash style. value may be sysv, gnu, or both. both is the default.
• --help — print a help message.
• --icf=all — enable identical code folding.
• --icf=safe — enable safe identical code folding.
• --icf=none — disable identical code folding.
• --ignore-data-address-equality — ignore address equality of data. C/C++ requires each data to have a unique address. this option allows lld to do unsafe optimization that breaks the requirement: create copies of read-only data or merge two or more read-only data that happen to have the same value. ⚠️ she said unsafe and she meant it.
• --ignore-function-address-equality — ignore address equality of functions. this option allows non-PIC calls to a function with non-default visibility in a shared object. the function may have different addresses within the executable and within the shared object. ⚠️
• --image-base=value — set the base address to value.
• --init=symbol — specify an initializer function.
• --keep-unique=symbol — do not fold symbol during ICF.
• -l libName, --library=libName — root name of library to use.
• -L dir, --library-path=dir — add a directory to the library search path.
• --lto-aa-pipeline=value — AA pipeline to run during LTO. used in conjunction with --lto-newpm-passes.
• --lto-newpm-passes=value — passes to run during LTO.
• --lto-Oopt-level — optimization level for LTO.
• --lto-partitions=value — number of LTO codegen partitions.
• -m value — set target emulation.
• --Map=file, -M file — print a link map to file.
• --nmagic, -n — do not page align sections, link against static libraries.
• --no-allow-shlib-undefined — do not allow unresolved references in shared libraries. this option is enabled by default when linking an executable.
• --no-as-needed — always set DT_NEEDED for shared libraries.
• --no-color-diagnostics — do not use colors in diagnostics.
• --no-define-common — do not assign space to common symbols.
• --no-demangle — do not demangle symbol names.
• --no-dynamic-linker — inhibit output of an .interp section.
• --no-gc-sections — disable garbage collection of unused sections.
• --no-gnu-unique — disable STB_GNU_UNIQUE symbol binding.
• --no-merge-exidx-entries — disable merging .ARM.exidx entries.
• --no-nmagic — page align sections.
• --no-omagic — do not set the text data sections to be writable, page align sections.
• --no-relax — disable target-specific relaxations. this is currently a no-op. (she's just standing there. not doing anything. 💀)
• --no-rosegment — do not put read-only non-executable sections in their own segment.
• --no-undefined-version — report version scripts that refer undefined symbols.
• --no-undefined — report unresolved symbols even if the linker is creating a shared library.
• --no-warn-symbol-ordering — do not warn about problems with the symbol ordering file or call graph profile.
• --no-whole-archive — restores the default behavior of loading archive members.
• --no-pie, --no-pic-executable — do not create a position independent executable.
• --noinhibit-exec — retain the executable output file whenever it is still usable.
• --nostdlib — only search directories specified on the command line.
• -o path — write the output executable, library, or object to path. if not specified, a.out is used as a default.
• -Ovalue — optimize output file size. value may be:
  • 0 — disable string merging.
  • 1 — enable string merging.
  • 2 — enable string tail merging. if --compress-debug-sections is given, compress debug sections at compression level 6 instead of 1.

-O1 is the default.

• --oformat=format — specify the format for the output object file. the only supported format is binary, which produces output with no ELF header.
• --omagic, -N — set the text and data sections to be readable and writable, do not page align sections, link against static libraries.
• --opt-remarks-filename file — write optimization remarks in YAML format to file.
• --opt-remarks-passes pass-regex — filter optimization remarks by only allowing the passes matching pass-regex.
• --opt-remarks-with-hotness — Include hotness information in the optimization remarks file. 💅
• --orphan-handling=mode — Control how orphan sections are handled. An orphan section is one not specifically mentioned in a linker script. mode may be:
  • place — Place orphan sections in suitable output sections.
  • warn — Place orphan sections as for place and also report a warning.
  • error — Place orphan sections as for place and also report an error.

place is the default. 🫶

• --pack-dyn-relocs=format — Pack dynamic relocations in the given format. format may be:
  • none — Do not pack. Dynamic relocations are encoded in SHT_REL(A).
  • android — Pack dynamic relocations in SHT_ANDROID_REL(A).
  • relr — Pack relative relocations in SHT_RELR, and the rest of dynamic relocations in SHT_REL(A).
  • android+relr — Pack relative relocations in SHT_RELR, and the rest of dynamic relocations in SHT_ANDROID_REL(A).

none is the default. If --use-android-relr-tags is specified, use SHT_ANDROID_RELR instead of SHT_RELR. ✨

• --pic-veneer — Always generate position independent thunks. 💖
• --pie, --pic-executable — Create a position independent executable. 🦋
• --print-gc-sections — List removed unused sections. 👑
• --print-icf-sections — List identical folded sections. 🔥
• --print-map — Print a link map to the standard output. 📜
• --print-archive-stats=file — Write archive usage statistics to the specified file. Print the numbers of members and fetched members for each archive. 🍓
• --push-state — Save the current state of --as-needed, --static, and --whole-archive. 💾
• --pop-state — Undo the effect of --push-state. ↩️
• --relocatable, -r — Create relocatable object file. 🧚
• --reproduce=path — Write a tar file to path, containing all the input files needed to reproduce the link, a text file called response.txt containing the command line options and a text file called version.txt containing the output of ld.lld --version. The archive when unpacked can be used to re-run the linker with the same options and input files. 🎀
• --retain-symbols-file=file — Retain only the symbols listed in the file. 💅
• --rpath=value, -R value — Add a DT_RUNPATH to the output. 🌈
• --rsp-quoting=value — Quoting style for response files. The supported values are windows and posix. 🪟
• --script=file, -T file — Read linker script from file. If multiple linker scripts are given, they are processed as if they were concatenated in the order they appeared on the command line. 📜
• --section-start=section=address — Set address of section. 🎯
• --shared, --Bsharable — Build a shared object. 🫶
• --shuffle-sections=seed — Shuffle input sections using the given seed. If 0, use a random seed. 🎲
• --soname=value, -h value — Set DT_SONAME to value. 💖
• --sort-common — This option is ignored for GNU compatibility. 💀
• --sort-section=value — Specifies sections sorting rule when linkerscript is used. 🧚
• --start-lib — Start a grouping of objects that should be treated as if they were together in an archive. 📦
• --strip-all, -s — Strip all symbols. ✂️
• --strip-debug, -S — Strip debugging information. 🐛
• --symbol-ordering-file=file — Lay out sections in the order specified by file. 📋
• --sysroot=value — Set the system root. 🌳
• --target1-abs — Interpret R_ARM_TARGET1 as R_ARM_ABS32. 🎯
• --target1-rel — Interpret R_ARM_TARGET1 as R_ARM_REL32. 🎯
• --target2=type — Interpret R_ARM_TARGET2 as type, where type is one of rel, abs, or got-rel. 🎯
• --Tbss=value — Same as --section-start with .bss as the sectionname. 🫧
• --Tdata=value — Same as --section-start with .data as the sectionname. 📊
• --Ttext=value — Same as --section-start with .text as the sectionname. 📝
• --thinlto-cache-dir=value — Path to ThinLTO cached object file directory. 🗂️
• --thinlto-cache-policy=value — Pruning policy for the ThinLTO cache. 🧹
• --thinlto-jobs=value — Number of ThinLTO jobs. ⚙️
• --threads=N — Number of threads. all (default) means all of concurrent threads supported. 1 disables multi-threading. 🧵
• --time-trace — Record time trace. ⏱️
• --time-trace-file=file — Write time trace output to file. 📁
• --time-trace-granularity=value — Minimum time granularity (in microseconds) traced by time profiler. 🔬
• --trace — Print the names of the input files. 👀
• --trace-symbol=symbol, -y symbol — Trace references to symbol. 🔍
• --undefined=symbol, -u symbol — If symbol is not defined after symbol resolution, and there's a static library that contains an object file defining the symbol, load the member to include the object file in the output file. 🫶
• --undefined-glob=pattern — Synonym for --undefined, except that it takes a glob pattern. In a glob pattern, * matches zero or more characters, ? matches any single character, and [...] matches the characters within brackets. All symbols that match a given pattern are handled as if they were given as arguments of --undefined. 🌐
• --unique — Creates a separate output section for every orphan input section. 🦄
• --unresolved-symbols=value — Determine how to handle unresolved symbols. ⚠️
• --use-android-relr-tags — Use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*. 🤖
• -v — Display the version number and proceed with linking if object files are specified. 💬
• -V, --version — Display the version number and exit. 🚪
• --verbose — Verbose mode. 🗣️
• --version-script=file — Read version script from file. 📜
• --warn-backrefs — Warn about reverse or cyclic dependencies to or between static archives. This can be used to ensure linker invocation remains compatible with traditional Unix-like linkers. 🔄
• --warn-backrefs-exclude=glob — Glob describing an archive (or an object file within --start-lib) which should be ignored for --warn-backrefs. 🚫
• --warn-common — Warn about duplicate common symbols. 👯
• --warn-ifunc-textrel — Warn about using ifunc symbols in conjunction with text relocations. Older versions of glibc library (2.28 and earlier) has a bug that causes the segment that includes ifunc symbols to be marked as not executable when they are relocated. As a result, although the program compiles and links successfully, it gives segmentation fault when the instruction pointer reaches an ifunc symbol. Use -warn-ifunc-textrel to let lld give a warning, if the code may include ifunc symbols, may do text relocations and be linked with an older glibc version. Otherwise, there is no need to use it, as the default value does not give a warning. This flag has been introduced in late 2018, has no counter part in ld and gold linkers, and may be removed in the future. 💀
• --warn-unresolved-symbols — Report unresolved symbols as warnings. ⚠️
• --whole-archive — Force load of all members in a static library. 📚
• --wrap=symbol — Use wrapper functions for symbol. 🎁
• -z option — Linker option extensions. ✨
  • dead-reloc-in-nonalloc=section_glob=value — Resolve a relocation in a matched non-SHF_ALLOC section referencing a discarded symbol to value. Accepts globs, in the event of a section matching more than one option, the last option takes precedence. An order of least specific to most specific match is recommended. 🧩
  • execstack — Make the main stack executable. Stack permissions are recorded in the PT_GNU_STACK segment. 🥞
  • force-bti — Force enable AArch64 BTI instruction in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property. 🛡️
  • force-ibt — Force enable Intel Indirect Branch Tracking in PLT, warn if an input ELF file does not have GNU_PROPERTY_X86_FEATURE_1_IBT property. 🛡️
  • global — Sets the DF_1_GLOBAL flag in the DYNAMIC section. Different loaders can decide how to handle this flag on their own. 🌍
  • ifunc-noplt — Do not emit PLT entries for ifunc symbols. Instead, emit text relocations referencing the resolver. This is an experimental optimization and only suitable for standalone environments where text relocations do not have the usual drawbacks. This option must be combined with the -z notext option. 🧪
  • initfirst — Sets the DF_1_INITFIRST flag to indicate the module should be initialized first. 🥇
  • interpose — Set the DF_1_INTERPOSE flag to indicate to the runtime linker that the object is an interposer. During symbol resolution interposers are searched after the application but before other dependencies. 🕵️
  • muldefs — Do not error if a symbol is defined multiple times. The first definition will be used. This is a synonym for --allow-multiple-definition. 🔁
  • nocombreloc — Disable combining and sorting multiple relocation sections. 🚫
  • nocopyreloc — Disable the creation of copy relocations. 🚫
  • nodefaultlib — Set the DF_1_NODEFLIB flag to indicate that default library search paths should be ignored. 📚
  • nodelete — Set the DF_1_NODELETE flag to indicate that the object cannot be unloaded from a process. 🔒
  • nodlopen — Set the DF_1_NOOPEN flag to indicate that the object may not be opened by dlopen(3). 🚪
  • nognustack — Do not emit the PT_GNU_STACK segment. 🚫
• norelro — bestie, this one says do not mark portions of the object as read-only after the initial relocation processing. So the object just… omits the PT_GNU_RELRO segment entirely. It's giving "I don't need that protection, tyvm" 💅
• notext — allows relocations against read-only segments. Sets the DT_TEXTREL flag in the DYNAMIC section. Yeah it's a whole thing, but it's allowed, ok? 🙈
• now — sets the DF_BIND_NOW flag, which tells the run-time loader to do all the relocation processing as part of object initialization. By default? Relocations can be done on demand. So this is the "do it all right now, no waiting" option, very main character energy ✨
• origin — sets the DF_ORIGIN flag to say that the object requires $ORIGIN processing. 💫
• pac-plt — AArch64 only, uses pointer authentication in PLT. That's it, that's the whole vibe 🎀
• rel — use REL format for dynamic relocations.
• rela — use RELA format for dynamic relocations. (yes they're siblings, no we don't pick favourites)
• retpolineplt — emits retpoline format PLT entries as a mitigation for CVE-2017-5715. Security girlies stay winning 🛡️
• rodynamic — makes the .dynamic section read-only. Heads up though: the DT_DEBUG tag will not be emitted. 😭
• separate-loadable-segments, separate-code, noseparate-code — these three decide whether two adjacent PT_LOAD segments are allowed to overlap in pages. Let's break it down fr fr:
  • noseparate-code is the default, and it allows overlap.
  • separate-code allows overlap between two executable segments, or between two non-executable segments.
  • separate-loadable-segments disallows overlap. Periodt.
• shstk — x86 only, uses shadow stack. 🌈
• stack-size=size — sets the main thread's stack size to size. That size gets recorded as the size of the PT_GNU_STACK program segment. 📏
• text — do not allow relocations against read-only segments. This is the default, so if you do nothing, congrats, you already have it 💖
• wxneeded — creates a PT_OPENBSD_WXNEEDED segment. Very niche, very iconic. 👑

---

🫶 IMPLEMENTATION NOTES 🫶

Okay so this is the part where ld.lld is lowkey different from the traditional linkers you'd find on Unix-like systems, and it's specifically about how it handles archive files — you know, the ones with a .a file extension. 🗂️

Traditional linkers keep a set of undefined symbols while they're linking. They process each file in the order it shows up on the command line, and they keep going until that set of undefined symbols is empty. When the linker hits an object file, that file gets linked into the output object and its undefined symbols get added to the set. Then, when it encounters an archive file, a traditional linker searches the objects inside it and processes the ones that satisfy symbols in the unresolved set. 🔍

The messy part? Mutually dependent archives get awkward with a traditional linker. You might have to specify archive files multiple times, or use the special command line options --start-group and --end-group so the linker just loops over the files in the group until no new symbols get added to the set. Exhausting, honestly 😮‍💨

ld.lld does it differently. It records all the symbols found in objects and archives as it iterates over the command line arguments. And the moment ld.lld encounters an undefined symbol that can be resolved by an object file contained in a previously processed archive file, it immediately extracts it and links it into the output object. No looping, no waiting, just instant extraction. slay 💅

Heads up bestie: with certain archive inputs, ld.lld may produce different results compared to traditional linkers. That said, in practice, large bodies of third party software have been linked with ld.lld without material issues. So like… it's fine, but be aware. 👀

If you wanna catch a linker invocation that might be incompatible with traditional Unix-like linker behavior, the --warn-backrefs option is your girl. She'll flag it for you. 🚩

---

and that's a wrap on the whole page, bestie!! 💖 this one came from the Debian crew, dated May 12, 2019, and it lives at LD.LLD(1). go forth and link responsibly 🫶✨