LD.LLD(1)

🎀 NAME 🎀

okay bestie, meet ld.lld — the ELF linker from the LLVM project. This is ld.lld(1), and she's here to link your stuff. 💖

---

✨ SYNOPSIS ✨

ld.lld [options] objfile ...

---

💖 DESCRIPTION 💖

So a linker? It's giving matchmaker but for object files. It takes one or more object, archive, and library files and smooshes them into one output file — could be an executable, a shared library, or another object file. Along the way it relocates code and data from the input files and resolves symbol references between them. Slay. 🫶

ld.lld is a drop-in replacement for the GNU BFD and gold linkers. She accepts most of the same command line arguments and linker scripts as GNU linkers. No cap.

Right now ld.lld supports these targets: i386, x86-64, ARM, AArch64, PowerPC32, PowerPC64, MIPS32, MIPS64, RISC-V, AMDGPU, Hexagon and SPARC V9. If you invoke her as lld-link, she acts as a Microsoft link.exe-compatible linker, and if you invoke her as ld.ld64, she acts as macOS's ld. And here's the iconic part: all these targets are always supported however ld.lld was built, so you can always use ld.lld as a native linker as well as a cross linker. Periodt. 👑

---

💅 OPTIONS 💅

okay so many options have both a single-letter and long form. When using the long form options — other than those beginning with the letter o — you can specify them using either one or two dashes preceding the option name. Long options beginning with o require two dashes to avoid confusion with the -o path option. Iykyk. ✨

• --allow-multiple-definition — do not error if a symbol is defined multiple times. The first definition will be used. 💅
• --allow-shlib-undefined — allow unresolved references in shared libraries. This option is enabled by default when linking a shared library. 🦋
• --apply-dynamic-relocs — apply link-time values for dynamic relocations.
• --as-needed — only set DT_NEEDED for shared libraries if used.
• --auxiliary=value — set the DT_AUXILIARY field to the specified name.
• --Bdynamic, --dy — link against shared libraries. 🌈
• --Bstatic, --static, --dn — do not link against shared libraries.
• --Bsymbolic — bind defined symbols locally.
• --Bsymbolic-functions — bind defined function symbols locally.
• --build-id=value — generate a build ID note. value may be one of fast, md5, sha1, tree, uuid, 0xhex-string, and none. tree is an alias for sha1. Build-IDs of type fast, md5, sha1, and tree are calculated from the object contents. fast is not intended to be cryptographically secure. ⚠️
• --build-id — synonym for --build-id=fast.
• --color-diagnostics=value — use colors in diagnostics. value may be one of always, auto, and never. auto enables color if and only if output is to a terminal. 🎨
• --color-diagnostics — alias for --color-diagnostics=auto.
• --compress-debug-sections=value — compress DWARF debug sections. value may be none or zlib. The default compression level is 1 (fastest) as the debug info usually compresses well at that level, but if you want to compress it more, you can specify -O2 to set the compression level to 6. 🗜️
• --cref — output cross reference table.
• --define-common, -d — assign space to common symbols.
• --defsym=symbol=expression — define a symbol alias. expression may be another symbol or a linker script expression. For example, --defsym=foo=bar or --defsym=foo=bar+0x100.
• --demangle — demangle symbol names.
• --disable-new-dtags — disable new dynamic tags.
• --discard-all, -x — delete all local symbols.
• --discard-locals, -X — delete temporary local symbols.
• --discard-none — keep all symbols in the symbol table.
• --dynamic-linker=value — specify the dynamic linker to be used for a dynamically linked executable. This is recorded in an ELF segment of type PT_INTERP.
• --dynamic-list=file — read a list of dynamic symbols from file. (executable) put matched non-local defined symbols to the dynamic symbol table. (shared object) references to matched non-local STV_DEFAULT symbols shouldn't be bound to definitions within the shared object. Implies -Bsymbolic but does not set DF_SYMBOLIC.
• --eh-frame-hdr — request creation of .eh_frame_hdr section and PT_GNU_EH_FRAME segment header.
• --emit-relocs, -q — generate relocations in the output.
• --enable-new-dtags — enable new dynamic tags.
• --end-lib — end a grouping of objects that should be treated as if they were together in an archive.
• --entry=entry — name of entry point symbol.
• --error-limit=value — maximum number of errors to emit before stopping. A value of zero indicates that there is no limit.
• --error-unresolved-symbols — report unresolved symbols as errors.
• --error-handing-script=script_path — call script script_path upon some error, with tag as first argument, and an extra parameter as second argument. The script is expected to return 0 on success. Any other value is considered a generic error. tag may be missing-lib followed by the name of the missing library. undefined-symbol followed by the name of the undefined symbol.
• --execute-only — mark executable sections unreadable. This option is currently only supported on AArch64. 👑
• --exclude-libs=value — exclude static libraries from automatic export.
• --export-dynamic, -E — put symbols in the dynamic symbol table.
• --export-dynamic-symbol=glob — (executable) put matched non-local defined symbols to the dynamic symbol table. (shared object) references to matched non-local STV_DEFAULT symbols shouldn't be bound to definitions within the shared object even if they would otherwise be due to -Bsymbolic, -Bsymbolic-functions or --dynamic-list.
• --fatal-warnings — treat warnings as errors. 💀
• --filter=value, -F value — set the DT_FILTER field to the specified value.
• --fini=symbol — specify a finalizer function.
• --format=input-format, -b input-format — specify the format of the inputs following this option. input-format may be one of binary, elf, and default. default is a synonym for elf.
• --gc-sections — enable garbage collection of unused sections. 🗑️
• --gdb-index — generate .gdb_index section.
• --hash-style=value — specify hash style. value may be sysv, gnu, or both. both is the default.
• --help — print a help message. 🆘
• --icf=all — enable identical code folding.
• --icf=safe — enable safe identical code folding.
• --icf=none — disable identical code folding.
• --ignore-data-address-equality — ignore address equality of data. C/C++ requires each data to have a unique address. This option allows lld to do unsafe optimization that breaks the requirement: create copies of read-only data or merge two or more read-only data that happen to have the same value. ⚠️
• --ignore-function-address-equality — ignore address equality of functions. This option allows non-PIC calls to a function with non-default visibility in a shared object. The function may have different addresses within the executable and within the shared object.
• --image-base=value — set the base address to value.
• --init=symbol — specify an initializer function.
• --keep-unique=symbol — do not fold symbol during ICF.
• -l libName, --library=libName — root name of library to use.
• -L dir, --library-path=dir — add a directory to the library search path.
• --lto-aa-pipeline=value — AA pipeline to run during LTO. Used in conjunction with --lto-newpm-passes.
• --lto-newpm-passes=value — passes to run during LTO.
• --lto-Oopt-level — optimization level for LTO.
• --lto-partitions=value — number of LTO codegen partitions.
• -m value — set target emulation.
• --Map=file, -M file — print a link map to file.
• --nmagic, -n — do not page align sections, link against static libraries.
• --no-allow-shlib-undefined — do not allow unresolved references in shared libraries. This option is enabled by default when linking an executable.
• --no-as-needed — always set DT_NEEDED for shared libraries.
• --no-color-diagnostics — do not use colors in diagnostics.
• --no-define-common — do not assign space to common symbols.
• --no-demangle — do not demangle symbol names.
• --no-dynamic-linker — inhibit output of an .interp section.
• --no-fortran-common — do not search archive members for definitions to override COMMON symbols.
• --no-gc-sections — disable garbage collection of unused sections.
• --no-gnu-unique — disable STB_GNU_UNIQUE symbol binding.
• --no-merge-exidx-entries — disable merging .ARM.exidx entries.
• --no-nmagic — page align sections.
• --no-omagic — do not set the text data sections to be writable, page align sections.
• --no-relax — disable target-specific relaxations. This is currently a no-op.
• --no-rosegment — do not put read-only non-executable sections in their own segment.
• --no-undefined-version — report version scripts that refer undefined symbols.
• --no-undefined — report unresolved symbols even if the linker is creating a shared library.
• --no-warn-symbol-ordering — do not warn about problems with the symbol ordering file or call graph profile.
• --no-whole-archive — restores the default behavior of loading archive members.
• --no-pie, --no-pic-executable — do not create a position independent executable.
• --noinhibit-exec — retain the executable output file whenever it is still usable.
• --nostdlib — only search directories specified on the command line.
• -o path — write the output executable, library, or object to path. If not specified, a.out is used as a default.
• -Ovalue — optimize output file size. value may be:
  • 0 — disable string merging.
  • 1 — enable string merging.
  • 2 — enable string tail merging. If --compress-debug-sections is given, compress debug sections at compression level 6 instead of 1.

-O1 is the default.

• --oformat=format — tells the linker what format the output object file should be. literally only one option on the menu: binary, which spits out output with no ELF header at all. that's it bestie, that's the whole list 💅
• --omagic, -N — makes the text and data sections readable AND writable 🫶, skips page-aligning the sections, and links against static libraries. chaotic but iconic.
• --opt-remarks-filename file — writes optimization remarks out in YAML format into file ✨
• --opt-remarks-passes pass-regex — filters those optimization remarks so only the passes matching pass-regex get through. gatekeeping, but make it productive 🌸
• --opt-remarks-with-hotness — adds hotness info into the optimization remarks file 🔥 (yes, actual hotness, it's giving profile data)
• --orphan-handling=mode — controls what happens to orphan sections. an orphan section is one that nobody bothered to mention in the linker script 😭 abandoned fr. mode can be:
  • place — places orphan sections into suitable output sections. this is the default.
  • warn — does what place does, and also throws a warning.
  • error — does what place does, and also throws an error.
• --pack-dyn-relocs=format — packs dynamic relocations in the given format. format can be:
  • none — don't pack. dynamic relocations get encoded in SHT_REL(A).
  • android — packs dynamic relocations into SHT_ANDROID_REL(A).
  • relr — packs relative relocations into SHT_RELR, and the rest of the dynamic relocations into SHT_REL(A).
  • android+relr — packs relative relocations into SHT_RELR, and the rest of the dynamic relocations into SHT_ANDROID_REL(A).

none is the default. and heads up: if --use-android-relr-tags is specified, it uses SHT_ANDROID_RELR instead of SHT_RELR 👑

• --pic-veneer — always generates position independent thunks. no cap.
• --pie, --pic-executable — creates a position independent executable 🦋
• --print-gc-sections — lists out the unused sections that got removed. exposing them, honestly
• --print-icf-sections — lists the identical folded sections ✨
• --print-map — prints a link map straight to standard output 📜
• --print-archive-stats=file — writes archive usage statistics to the specified file. it prints the numbers of members and fetched members for each archive 📊
• --push-state — saves the current state of --as-needed, --static, and --whole-archive. a little save point, we love to see it 🎀
• --pop-state — undoes whatever --push-state did. rewind time bestie
• --relocatable, -r — creates a relocatable object file 💜
• --reproduce=path — writes a tar file to path that contains all the input files you'd need to reproduce the link, plus a text file called response.txt with the command line options, plus a text file called version.txt containing the output of ld.lld --version. once you unpack that archive you can re-run the linker with the exact same options and input files. time capsule energy fr 🕰️
• --retain-symbols-file=file — retains ONLY the symbols listed in file. everyone else, goodbye 💅
• --rpath=value, -R value — adds a DT_RUNPATH to the output 🌈
• --rsp-quoting=value — sets the quoting style for response files. the supported values are windows and posix.
• --script=file, -T file — reads the linker script from file. if you hand it multiple linker scripts, they get processed as if they were concatenated in the order they appeared on the command line 📚
• --section-start=section=address — sets the address of a section.
• --shared, --Bsharable — builds a shared object 🫶
• --shuffle-sections=seed — shuffles input sections using the given seed. if it's 0, it uses a random seed 🎲 gambling but for linkers
• --soname=value, -h value — sets DT_SONAME to value.
• --sort-common — this option is ignored for GNU compatibility. it's just there for the vibes, doing absolutely nothing 🙈
• --sort-section=value — specifies the sections sorting rule when a linkerscript is used.
• --start-lib — starts a grouping of objects that should be treated as if they were all together in an archive 📦
• --strip-all, -s — strips all symbols. bye bye everything 😭
• --strip-debug, -S — strips debugging information. keeps the rest, just not the debug tea 🍵
• --symbol-ordering-file=file — lays out sections in the order specified by file 📝
• --sysroot=value — sets the system root.
• --target1-abs — interprets R_ARM_TARGET1 as R_ARM_ABS32.
• --target1-rel — interprets R_ARM_TARGET1 as R_ARM_REL32.
• --target2=type — interprets R_ARM_TARGET2 as type, where type is one of rel, abs, or got-rel.
• --Tbss=value — same as --section-start but with .bss as the sectionname.
• --Tdata=value — same as --section-start but with .data as the sectionname.
• --Ttext=value — same as --section-start but with .text as the sectionname.
• --thinlto-cache-dir=value — path to the ThinLTO cached object file directory 🗂️
• --thinlto-cache-policy=value — pruning policy for the ThinLTO cache ✂️
• --thinlto-jobs=value — number of ThinLTO jobs.
• --threads=N — number of threads. all is the default and means all the concurrent threads supported. 1 disables multi-threading entirely 🧵 multitasking queen vs. one girl doing everything
• --time-trace — records a time trace ⏱️
• --time-trace-file=file — writes the time trace output to file.
• --time-trace-granularity=value — minimum time granularity (in microseconds) traced by the time profiler 🕰️
• --trace — prints the names of the input files.
• --trace-symbol=symbol, -y symbol — traces references to symbol 🔍
• --undefined=symbol, -u symbol — if symbol isn't defined after symbol resolution, and there's a static library containing an object file that defines the symbol, it loads that member so the object file gets included in the output file. dragging it out of the archive by name 💖
• --undefined-glob=pattern — a synonym for --undefined, except it takes a glob pattern. in a glob pattern, * matches zero or more characters, ? matches any single character, and [...] matches the characters within the brackets. every symbol matching a given pattern gets handled as if it were passed as an argument to --undefined 🌟
• --unique — creates a separate output section for every orphan input section. no sharing, everyone gets their own room 🚪
• --unresolved-symbols=value — determines how unresolved symbols get handled 🤷
• --use-android-relr-tags — uses SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*.
• -v — displays the version number and then proceeds with linking if object files are specified. shows up AND does the work 💅
• -V, --version — displays the version number and exits. no linking, just the flex 👑
• --verbose — verbose mode 🗣️
• --version-script=file — reads the version script from file.
• --warn-backrefs — warns about reverse or cyclic dependencies to or between static archives. you'd use this to make sure the linker invocation stays compatible with traditional Unix-like linkers 🔄
• --warn-backrefs-exclude=glob — a glob describing an archive (or an object file within --start-lib) that should be ignored for --warn-backrefs. a lil do-not-warn list
• --warn-common — warns about duplicate common symbols 👯
• --warn-ifunc-textrel — warns about using ifunc symbols together with text relocations. older versions of the glibc library (2.28 and earlier) have a bug that marks the segment containing ifunc symbols as not executable when they get relocated. so even though the program compiles and links just fine, it gives a segmentation fault when the instruction pointer reaches an ifunc symbol 💀. use -warn-ifunc-textrel to let lld give you a warning if the code may include ifunc symbols, may do text relocations, and gets linked with an older glibc version. otherwise there's no need to use it, since the default value doesn't warn. this flag was introduced in late 2018, has no counterpart in the ld and gold linkers, and may be removed in the future ⚠️
• --warn-unresolved-symbols — reports unresolved symbols as warnings instead of errors.
• --whole-archive — forces loading of all members in a static library 📚 nobody gets left out
• --wrap=symbol — redirects references to __wrap_symbol and __real_symbol references to symbol 🎁
• -z option — linker option extensions ✨ these are the little extras:
  • dead-reloc-in-nonalloc=section_glob=value — resolves a relocation in a matched non-SHF_ALLOC section that references a discarded symbol to value. accepts globs. if a section matches more than one option, the last option wins. the recommended move is ordering them from least specific to most specific match 📋
  • execstack — makes the main stack executable. stack permissions get recorded in the PT_GNU_STACK segment ⚠️
  • force-bti — force-enables the AArch64 BTI instruction in the PLT, and warns if an input ELF file doesn't have the GNU_PROPERTY_AARCH64_FEATURE_1_BTI property.
  • force-ibt — force-enables Intel Indirect Branch Tracking in the PLT, and warns if an input ELF file doesn't have the GNU_PROPERTY_X86_FEATURE_1_IBT property.
  • global — sets the DF_1_GLOBAL flag in the DYNAMIC section. different loaders can decide how to handle this flag on their own 🤷
  • ifunc-noplt — does not emit PLT entries for ifunc symbols. instead, it emits text relocations referencing the resolver. this is an experimental optimization and only suitable for standalone environments where text relocations don't have the usual drawbacks. it must be combined with the -z notext option ⚠️
  • initfirst — sets the DF_1_INITFIRST flag to indicate the module should be initialized first 🥇
  • interpose — sets the DF_1_INTERPOSE flag to tell the runtime linker that the object is an interposer. during symbol resolution, interposers are searched after the application but before other dependencies.
  • muldefs — doesn't error if a symbol is defined multiple times. the first definition gets used. this is a synonym for --allow-multiple-definition.
  • nocombreloc — disables combining and sorting multiple relocation sections 🚫
• nocopyreloc — turns off the creation of copy relocations. bye bestie, no copy relocs for you 💅
• nodefaultlib — sets the DF_1_NODEFLIB flag, which basically says "ignore the default library search paths, we're not doing that today." 🚫
• nodelete — sets the DF_1_NODELETE flag, so the object can't be unloaded from a process. it's staying, it lives here now 🏠
• nodlopen — sets the DF_1_NOOPEN flag, meaning the object may not be opened by dlopen(3). sorry, doors closed 🚪
• nognustack — don't emit the PT_GNU_STACK segment. it's just not giving segment today ✨
• norelro — do not indicate that portions of the object should be mapped read-only after the initial relocation processing. the object will omit the PT_GNU_RELRO segment. lowkey a choice but ok 🫣
• notext — allow relocations against read-only segments. sets the DT_TEXTREL flag in the DYNAMIC section. 📝
• now — sets the DF_BIND_NOW flag, telling the run-time loader to do all the relocation processing as part of object initialization. by default, relocations may be performed on demand instead (very "we'll get to it when we get to it" energy, no shade).
• origin — sets the DF_ORIGIN flag, so the object requires $ORIGIN processing. 🌱
• pac-plt — AArch64 only bestie, use pointer authentication in PLT. 🔐
• rel — use REL format for dynamic relocations.
• rela — use RELA format for dynamic relocations.
• retpolineplt — emit retpoline format PLT entries as a mitigation for CVE-2017-5715. protection era, we love to see it 🛡️
• rodynamic — makes the .dynamic section read-only. heads up: the DT_DEBUG tag will not be emitted. 🧊
• separate-loadable-segments, separate-code, noseparate-code — these three decide whether two adjacent PT_LOAD segments are allowed to overlap in pages. like, are we sharing the page or not?? 😭
  • noseparate-code (the default) — allows overlap.
  • separate-code — allows overlap between two executable segments, or between two non-executable segments.
  • separate-loadable-segments — disallows overlap. hard boundary, no touching 🚧
• shstk — x86 only, use shadow stack. ✨
• stack-size=size — set the main thread's stack size to size. it gets recorded as the size of the PT_GNU_STACK program segment. 📏
• text — do not allow relocations against read-only segments. this is the default, so if you did nothing, congrats, you already have it 💅
• wxneeded — create a PT_OPENBSD_WXNEEDED segment. 🌊

---

🌈 IMPLEMENTATION NOTES 🌈

okay so this part is important and honestly kind of iconic, because ld.lld's handling of archive files (the ones with a .a file extension) is different from the traditional linkers used on Unix-like systems. not wrong, just different. main character behavior.

Traditional linkers maintain a set of undefined symbols during linking. the linker processes each file in the order in which it appears on the command line, until that set of undefined symbols becomes empty. an object file gets linked into the output object when it's encountered, and its undefined symbols get added to the set. then, upon encountering an archive file, a traditional linker searches the objects contained therein, and processes those that satisfy symbols in the unresolved set. 🧠

Handling mutually dependent archives can be lowkey awkward with a traditional linker, ngl. archive files may have to be specified multiple times, or you can use the special command line options --start-group and --end-group to have the linker loop over the files in the group until no new symbols are added to the set. 🔁

ld.lld does it differently: it records all symbols found in objects and archives as it iterates over command line arguments. and when ld.lld encounters an undefined symbol that can be resolved by an object file contained in a previously processed archive file, it immediately extracts and links it into the output object. no waiting, no second pass, just slay ✨

⚠️ With certain archive inputs, ld.lld may produce different results compared to traditional linkers. that's a real thing, bestie, don't @ me.

In practice, large bodies of third party software have been linked with ld.lld without material issues. so like, it's fine. it's fine!! 😌

The --warn-backrefs option may be used to identify a linker invocation that may be incompatible with traditional Unix-like linker behavior. use it, it's your little detective 🔍

---

and that's the whole page, bestie!! 🎀 this one came from the Debian folks, dated May 12, 2019 — so if you're reading this in the future, yes, it's vintage, and vintage is always in 💖 thanks for reading all three parts, you ate that fr fr 👑💅🦋