LD.LLD(1)

💖 LD.LLD(1) — General Commands Manual 💖

okay bestie, welcome to ld.lld, the ELF linker from the LLVM project, and no I will NOT be normal about it ✨

---

🌸 NAME 🌸

ld.lld — ELF linker from the LLVM project

---

✨ SYNOPSIS ✨

ld.lld [options] objfile ...

---

🦋 DESCRIPTION 🦋

So like, what even is a linker, you ask? Bestie. A linker takes one or more object, archive, and library files, and smooshes them all together into one output file — which could be an executable, a shared library, or honestly just another object file. Along the way it relocates code and data from the input files and resolves all the symbol references between them. It's giving matchmaker but for symbols. 💅

ld.lld is a drop-in replacement for the GNU BFD and gold linkers, which means it accepts most of the same command line arguments and linker scripts as those GNU linkers. Slay, compatibility. 👑

Right now ld.lld supports i386, x86-64, ARM, AArch64, PowerPC32, PowerPC64, MIPS32, MIPS64, RISC-V, AMDGPU, Hexagon and SPARC V9 targets. And here's the iconic part: if you invoke it as lld-link, it acts like a Microsoft link.exe-compatible linker, and if you invoke it as ld.ld64, it acts like macOS's ld. 🌈

The way that ALL of these targets are always supported no matter how ld.lld was built?? So you can always use ld.lld as a native linker and as a cross linker. Obsessed. 🫶

---

🎀 OPTIONS 🎀

Okay so real talk: many options have both a single-letter and a long form. When you're using the long form options — other than the ones that begin with the letter o — you can specify them with either one or two dashes before the option name. But long options that begin with o? Those need two dashes, specifically so they don't get confused with the -o path option. iykyk. 💖

• --allow-multiple-definition — Do not error out if a symbol is defined multiple times. The first definition will be used. 😌
• --allow-shlib-undefined — Allow unresolved references in shared libraries. This option is enabled by default when linking a shared library.
• --apply-dynamic-relocs — Apply link-time values for dynamic relocations. ✨
• --as-needed — Only set DT_NEEDED for shared libraries if used.
• --auxiliary=value — Set the DT_AUXILIARY field to the specified name.
• --Bdynamic, --dy — Link against shared libraries.
• --Bstatic, --static, --dn — Do not link against shared libraries.
• -Bno-symbolic — Don't bind default visibility defined symbols locally for -shared (default).
• -Bsymbolic — Bind default visibility defined symbols locally for -shared. Also sets the DF_SYMBOLIC flag. 🔥
• -Bsymbolic-functions — Bind default visibility defined function symbols locally for -shared.
• -Bsymbolic-non-weak-functions — Bind default visibility defined STB_GLOBAL function symbols locally for -shared.
• --build-id=value — Generate a build ID note. value may be one of fast, md5, sha1, tree, uuid, 0xhex-string, and none. tree is an alias for sha1. Build-IDs of type fast, md5, sha1, and tree are calculated from the object contents.

fast is not intended to be cryptographically secure. bestie, it's giving "vibes-based security" — do not use it for that. 💀

• --build-id — Synonym for --build-id=fast.
• --color-diagnostics=value — Use colors in diagnostics. value may be one of always, auto, and never. auto enables color if and only if output is to a terminal. 🌈
• --color-diagnostics — Alias for --color-diagnostics=auto.
• --compress-debug-sections=value — Compress DWARF debug sections. value may be none or zlib. The default compression level is 1 (fastest) as the debug info usually compresses well at that level, but if you want to compress it more, you can specify -O2 to set the compression level to 6. 🗜️
• --cref — Output cross reference table. If -Map is specified, print to the map file.
• --define-common, -d — Assign space to common symbols.
• --defsym=symbol=expression — Define a symbol alias. expression may be another symbol or a linker script expression. For example, ‘--defsym=foo=bar’ or ‘--defsym=foo=bar+0x100’.
• --demangle — Demangle symbol names.
• --disable-new-dtags — Disable new dynamic tags.
• --discard-all, -x — Delete all local symbols.
• --discard-locals, -X — Delete temporary local symbols.
• --discard-none — Keep all symbols in the symbol table.
• --dynamic-linker=value — Specify the dynamic linker to be used for a dynamically linked executable. This is recorded in an ELF segment of type PT_INTERP.
• --dynamic-list=file — Similar to --export-dynamic-symbol-list. When creating a shared object, implies -Bsymbolic but does not set DF_SYMBOLIC. 😤
• --EB — Select the big-endian format in the OUTPUT_FORMAT command.
• --EL — Select the little-endian format in the OUTPUT_FORMAT command.
• --eh-frame-hdr — Request creation of .eh_frame_hdr section and PT_GNU_EH_FRAME segment header.
• --emit-relocs, -q — Generate relocations in the output.
• --enable-new-dtags — Enable new dynamic tags.
• --end-lib — End a grouping of objects that should be treated as if they were together in an archive.
• --entry=entry — Name of entry point symbol.
• --error-limit=value — Maximum number of errors to emit before stopping. A value of zero indicates that there is no limit. 🙈
• --error-unresolved-symbols — Report unresolved symbols as errors.
• --error-handing-script=script_path — Call script script_path upon some error, with tag as first argument, and an extra parameter as second argument. The script is expected to return 0 on success. Any other value is considered a generic error. tag may be missing-lib followed by the name of the missing library. undefined-symbol followed by the name of the undefined symbol.
• --execute-only — Mark executable sections unreadable. This option is currently only supported on AArch64.
• --exclude-libs=value — Exclude static libraries from automatic export.
• --export-dynamic, -E — Put symbols in the dynamic symbol table.
• --export-dynamic-symbol=glob — (executable) Put matched non-local defined symbols to the dynamic symbol table. (shared object) References to matched non-local STV_DEFAULT symbols shouldn't be bound to definitions within the shared object even if they would otherwise be due to -Bsymbolic , -Bsymbolic-functions or --dynamic-list.
• --export-dynamic-symbol-list=file — Read a list of dynamic symbol patterns from file. Apply --export-dynamic-symbol on each pattern.
• --fatal-warnings — Treat warnings as errors. 😱
• --filter=value, -F value — Set the DT_FILTER field to the specified value.
• --fini=symbol — Specify a finalizer function.
• --format=input-format, -b input-format — Specify the format of the inputs following this option. input-format may be one of binary, elf, and default. default is a synonym for elf.
• --gc-sections — Enable garbage collection of unused sections. 🗑️✨
• --gdb-index — Generate .gdb_index section.
• --hash-style=value — Specify hash style. value may be sysv, gnu, or both. both is the default.
• --help — Print a help message. 🫶
• --icf=all — Enable identical code folding.
• --icf=safe — Enable safe identical code folding.
• --icf=none — Disable identical code folding.
• --ignore-data-address-equality — Ignore address equality of data. C/C++ requires each data to have a unique address.

This option allows lld to do unsafe optimization that breaks the requirement: create copies of read-only data or merge two or more read-only data that happen to have the same value. bestie this is the part where you read twice. 💀

• --ignore-function-address-equality — Ignore address equality of functions. This option allows non-PIC calls to a function with non-default visibility in a shared object. The function may have different addresses within the executable and within the shared object. 😭
• --image-base=value — Set the base address to value.
• --init=symbol — Specify an initializer function.
• --keep-unique=symbol — Do not fold symbol during ICF.
• -l libName, --library=libName — Root name of library to use.
• -L dir, --library-path=dir — Add a directory to the library search path.
• --lto-aa-pipeline=value — AA pipeline to run during LTO. Used in conjunction with --lto-newpm-passes.
• --lto-newpm-passes=value — Passes to run during LTO.
• --lto-Oopt-level — Optimization level for LTO.
• --lto-partitions=value — Number of LTO codegen partitions.
• -m value — Set target emulation.
• --Map=file, -M file — Print a link map to file.
• --nmagic, -n — Do not page align sections, link against static libraries.
• --no-allow-shlib-undefined — Do not allow unresolved references in shared libraries. This option is enabled by default when linking an executable.
• --no-as-needed — Always set DT_NEEDED for shared libraries.
• --no-color-diagnostics — Do not use colors in diagnostics.
• --no-define-common — Do not assign space to common symbols.
• --no-demangle — Do not demangle symbol names.
• --no-dynamic-linker — Inhibit output of an .interp section.
• --no-fortran-common — Do not search archive members for definitions to override COMMON symbols.
• --no-gc-sections — Disable garbage collection of unused sections.
• --no-gnu-unique — Disable STB_GNU_UNIQUE symbol binding.
• --no-merge-exidx-entries — Disable merging .ARM.exidx entries.
• --no-nmagic — Page align sections.
• --no-omagic — Do not set the text data sections to be writable, page align sections.
• --no-relax — Disable target-specific relaxations. For x86-64 this disables R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX GOT optimization.
• --no-rosegment — Do not put read-only non-executable sections in their own segment.
• --no-undefined-version — Report version scripts that refer undefined symbols.
• --no-undefined — Report unresolved symbols even if the linker is creating a shared library.
• --no-warn-symbol-ordering — Do not warn about problems with the symbol ordering file or call graph profile.
• --no-whole-archive — Restores the default behavior of loading archive members.
• --no-pie, --no-pic-executable — Do not create a position independent executable.
• --noinhibit-exec — bestie, if the output executable is still usable, keep it. No cap. ✨
• --nostdlib — only search the directories you literally put on the command line. That's it. No standard library dirs. 🎀
• -o path — write the output executable, library, or object to path. If you don't specify, a.out is the default. iconic. 💅
• -Ovalue — optimize output file size. value can be:
  • 0 — disable string merging.
  • 1 — enable string merging.
  • 2 — enable string tail merging. If --compress-debug-sections is given, compress debug sections at compression level 6 instead of 1. -O1 is the default.
• --oformat=format — specify the format for the output object file. The only supported format is binary, which produces output with no ELF header. periodt.
• --omagic, -N — set the text and data sections to be readable and writable, do not page align sections, link against static libraries. ✨
• --opt-remarks-filename file — write optimization remarks in YAML format to file.
• --opt-remarks-passes pass-regex — filter optimization remarks by only allowing the passes matching pass-regex.
• --opt-remarks-with-hotness — include hotness information in the optimization remarks file. 🔥
• --orphan-handling=mode — control how orphan sections are handled. An orphan section is one not specifically mentioned in a linker script. mode may be:
  • place — place orphan sections in suitable output sections.
  • warn — place orphan sections as for place and also report a warning.
  • error — place orphan sections as for place and also report an error. place is the default.
• --pack-dyn-relocs=format — pack dynamic relocations in the given format. format may be:
  • none — do not pack. Dynamic relocations are encoded in SHT_REL(A).
  • android — pack dynamic relocations in SHT_ANDROID_REL(A).
  • relr — pack relative relocations in SHT_RELR, and the rest of dynamic relocations in SHT_REL(A).
  • android+relr — pack relative relocations in SHT_RELR, and the rest of dynamic relocations in SHT_ANDROID_REL(A). none is the default. If --use-android-relr-tags is specified, use SHT_ANDROID_RELR instead of SHT_RELR.
• --pic-veneer — always generate position independent thunks. 💅
• --pie, --pic-executable — create a position independent executable.
• --power10-stubs=mode — whether to use Power10 instructions in call stubs for R_PPC64_REL24_NOTOC and TOC/NOTOC interworking. mode may be:
  • yes — (default) use.
  • auto — currently the same as yes.
  • no — don't use.
• --print-gc-sections — list removed unused sections.
• --print-icf-sections — list identical folded sections.
• --print-map — print a link map to the standard output.
• --print-archive-stats=file — write archive usage statistics to the specified file. Print the numbers of members and fetched members for each archive.
• --push-state — save the current state of --as-needed, --static, and --whole-archive.
• --pop-state — restore the states saved by --push-state.
• --relocatable, -r — create relocatable object file.
• --reproduce=path — write a tar file to path, containing all the input files needed to reproduce the link, a text file called response.txt containing the command line options and a text file called version.txt containing the output of ld.lld --version. The archive when unpacked can be used to re-run the linker with the same options and input files. 🫶
• --retain-symbols-file=file — retain only the symbols listed in the file.
• --rpath=value, -R value — add a DT_RUNPATH to the output.
• --rsp-quoting=value — quoting style for response files. The supported values are windows and posix.
• --script=file, -T file — read linker script from file. If multiple linker scripts are given, they are processed as if they were concatenated in the order they appeared on the command line.
• --section-start=section=address — set address of section.
• --shared, --Bsharable — build a shared object. 👑
• --shuffle-sections=seed — shuffle matched sections using the given seed before mapping them to the output sections. If -1, reverse the section order. If 0, use a random seed. 🎲
• --soname=value, -h value — set DT_SONAME to value.
• --sort-common — this option is ignored for GNU compatibility. 💀
• --sort-section=value — specifies sections sorting rule when linkerscript is used.
• --start-lib — start a grouping of objects that should be treated as if they were together in an archive.
• --strip-all, -s — strip all symbols. Implies --strip-debug.
• --strip-debug, -S — strip debugging information.
• --symbol-ordering-file=file — lay out sections in the order specified by file.
• --sysroot=value — set the system root.
• --target1-abs — interpret R_ARM_TARGET1 as R_ARM_ABS32.
• --target1-rel — interpret R_ARM_TARGET1 as R_ARM_REL32.
• --target2=type — interpret R_ARM_TARGET2 as type, where type is one of rel, abs, or got-rel.
• --Tbss=value — same as --section-start with .bss as the sectionname.
• --Tdata=value — same as --section-start with .data as the sectionname.
• --Ttext=value — same as --section-start with .text as the sectionname.
• --thinlto-cache-dir=value — path to ThinLTO cached object file directory.
• --thinlto-cache-policy=value — pruning policy for the ThinLTO cache.
• --thinlto-jobs=value — number of ThinLTO jobs.
• --threads=N — number of threads. all (default) means all of concurrent threads supported. 1 disables multi-threading.
• --time-trace — record time trace.
• --time-trace-file=file — write time trace output to file.
• --time-trace-granularity=value — minimum time granularity (in microseconds) traced by time profiler.
• --trace — print the names of the input files.
• --trace-symbol=symbol, -y symbol — trace references to symbol.
• --undefined=symbol, -u symbol — if symbol is not defined after symbol resolution, and there's a static library that contains an object file defining the symbol, load the member to include the object file in the output file.
• --undefined-glob=pattern — synonym for --undefined, except that it takes a glob pattern. In a glob pattern, * matches zero or more characters, ? matches any single character, and [...] matches the characters within brackets. All symbols that match a given pattern are handled as if they were given as arguments of --undefined.
• --unique — creates a separate output section for every orphan input section.
• --unresolved-symbols=value — determine how to handle unresolved symbols.
• --use-android-relr-tags — use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*.
• -v — display the version number and proceed with linking if object files are specified.
• -V, --version — display the version number and exit.
• --verbose — verbose mode.
• --version-script=file — read version script from file.
• --warn-backrefs — warn about reverse or cyclic dependencies to or between static archives. This can be used to ensure linker invocation remains compatible with traditional Unix-like linkers.
• --warn-backrefs-exclude=glob — glob describing an archive (or an object file within --start-lib) which should be ignored for --warn-backrefs
• --warn-common — warn about duplicate common symbols.
• --warn-ifunc-textrel — warn about using ifunc symbols in conjunction with text relocations. Older versions of glibc library (2.28 and earlier) has a bug that causes the segment that includes ifunc symbols to be marked as not executable when they are relocated. As a result, although the program compiles and links successfully, it gives segmentation fault when the instruction pointer reaches an ifunc symbol. Use -warn-ifunc-textrel to let lld give a warning, if the code may include ifunc symbols, may do text relocations and be linked with an older glibc version. Otherwise, there is no need to use it, as the default value does not give a warning. This flag has been introduced in late 2018, has no counter part in ld and gold linkers, and may be removed in the future. 😭
• --warn-unresolved-symbols — report unresolved symbols as warnings.
• --whole-archive — force load of all members in a static library.
• --why-extract=file — print to a file about why archive members are extracted.
• --wrap=symbol — redirect symbol references to __wrap_symbol and __real_symbol references to symbol.
• -z option — linker option extensions.
  • dead-reloc-in-nonalloc=section_glob=value — resolve a relocation in a matched non-SHF_ALLOC section referencing a discarded symbol to value Accepts globs, in the event of a section matching more than one option, the last option takes precedence. An order of least specific to most specific match is recommended.
  • execstack — make the main stack executable. Stack permissions are recorded in the PT_GNU_STACK segment.
  • bti-report=[none|warning|error] — specify how to report the missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI property. none is the default, linker will not report the missing property otherwise will be reported as a warning or an error.

…and the -z keywords just keep going, bestie, we're almost at the finish line 🏁

• -z cet-report=[none|warning|error] — tells the linker how to snitch on missing GNU_PROPERTY_X86_FEATURE_1_IBT or GNU_PROPERTY_X86_FEATURE_1_SHSTK properties. none is the default, meaning the linker literally will not report the missing property at all — otherwise it gets reported as a warning or as an error. pick your vibe 💅
• -z force-bti — forces AArch64 BTI instruction to be enabled in the PLT, and warns if an Input ELF file does not have the GNU_PROPERTY_AARCH64_FEATURE_1_BTI property.
• -z force-ibt — forces Intel Indirect Branch Tracking on in the PLT, and warns if an input ELF file does not have the GNU_PROPERTY_X86_FEATURE_1_IBT property.
• -z global — sets the DF_1_GLOBAL flag in the DYNAMIC section. Different loaders can decide how to handle this flag on their own, so it's giving "figure it out yourselves" energy ✨
• -z ifunc-noplt — do not emit PLT entries for ifunc symbols. Instead, emit text relocations referencing the resolver. This is an experimental optimization and only suitable for standalone environments where text relocations do not have the usual drawbacks. This option must be combined with the -z notext option.

🚨 bestie listen — ifunc-noplt is experimental AND it has a mandatory buddy (-z notext). do not go rogue.

• -z initfirst — sets the DF_1_INITFIRST flag to indicate the module should be initialized first. main character gets to go first, obviously 👑
• -z interpose — sets the DF_1_INTERPOSE flag to tell the runtime linker that the object is an interposer. During symbol resolution interposers are searched after the application but before other dependencies.
• -z muldefs — do not error if a symbol is defined multiple times. The first definition will be used. This is a synonym for --allow-multiple-definition.
• -z nocombreloc — disables combining and sorting multiple relocation sections.
• -z nocopyreloc — disables the creation of copy relocations.
• -z nodefaultlib — sets the DF_1_NODEFLIB flag to indicate that default library search paths should be ignored.
• -z nodelete — sets the DF_1_NODELETE flag to indicate that the object cannot be unloaded from a process.
• -z nodlopen — sets the DF_1_NOOPEN flag to indicate that the object may not be opened by dlopen(3).
• -z nognustack — do not emit the PT_GNU_STACK segment.
• -z norelro — do not indicate that portions of the object should be mapped read-only after initial relocation processing. The object will omit the PT_GNU_RELRO segment.
• -z notext — allows relocations against read-only segments. Sets the DT_TEXTREL flag in the DYNAMIC section.
• -z now — sets the DF_BIND_NOW flag to indicate that the run-time loader should perform all relocation processing as part of object initialization. By default relocations may be performed on demand.
• -z origin — sets the DF_ORIGIN flag to indicate that the object requires $ORIGIN processing.
• -z pac-plt — AArch64 only, use pointer authentication in PLT.
• -z rel — use REL format for dynamic relocations.
• -z rela — use RELA format for dynamic relocations.
• -z retpolineplt — emit retpoline format PLT entries as a mitigation for CVE-2017-5715.
• -z rodynamic — makes the .dynamic section read-only. Heads up: the DT_DEBUG tag will not be emitted.
• -z separate-loadable-segments, -z separate-code, -z noseparate-code — these three decide whether two adjacent PT_LOAD segments are allowed to overlap in pages. noseparate-code (the default) allows overlap. separate-code allows overlap between two executable segments, or two non-executable segments. separate-loadable-segments disallows overlap.
• -z shstk — x86 only, use shadow stack.
• -z stack-size=size — set the main thread's stack size to size. The stack size is recorded as the size of the size. PT_GNU_STACK program segment.
• -z start-stop-gc — don't let __start_/__stop_ references retain the associated C identifier name sections (this is the default).
• -z nostart-stop-gc — let __start_/__stop_ references retain the associated C identifier name sections.
• -z text — do not allow relocations against read-only segments. This is the default.
• -z wxneeded — create a PT_OPENBSD_WXNEEDED segment.

---

📚 IMPLEMENTATION NOTES 📚

okay so this is the part where ld.lld admits it does things its own way and honestly? iconic of it.

ld.lld's handing of archive files (those with a .a file extension) is different from traditional linkers used on Unix-like systems.

Traditional linkers maintain a set of undefined symbols during linking. The linker processes each file in the order in which it appears on the command line, until the set of undefined symbols becomes empty. An object file is linked into the output object when it is encountered, with its undefined symbols added to the set. Upon encountering an archive file a traditional linker searches the objects contained therein, and processes those that satisfy symbols in the unresolved set.

Handling mutually dependent archives may be awkward when using a traditional linker. Archive files may have to be specified multiple times, or the special command line options --start-group and --end-group may be used to have the linker loop over the files in the group until no new symbols are added to the set.

ld.lld records all symbols found in objects and archives as it iterates over command line arguments. When ld.lld encounters an undefined symbol that can be resolved by an object file contained in a previously processed archive file, it immediately extracts and links it into the output object.

With certain archive inputs ld.lld may produce different results compared to traditional linkers. In practice, large bodies of third party software have been linked with ld.lld without material issues.

The --warn-backrefs option may be used to identify a linker invocation that may be incompatible with traditional Unix-like linker behavior.

🌸 so like — same energy, different algorithm. if your archives are being extra about it, --warn-backrefs is your bestie for catching the drama before it ships.

---

and that's the whole page, bestie!! we did it!! 🎀✨

this beauty lives in the Debian release, dated May 12, 2019, and she goes by the name LD.LLD(1) — put some respect on it 💅👑