LD(1)

๐Ÿ“ฆ version 2.40.50~ti1ubuntu1, in ubuntu noble

๐Ÿ’– LD(1) โ€” the GNU linker, and she is a WHOLE personality ๐Ÿ’–

okay bestie, sit down, hydrate, because this is the GNU linker โ€” manual page section 1, from the GNU Development Tools. she's a lot. she's also extremely useful. let's get into it ๐Ÿซถ


โœจ NAME โœจ

ld โ€” The GNU linker. that's her. that's the name. short, sweet, runs your entire build. iconic behavior ๐Ÿ’…

โœจ SYNOPSIS โœจ

ld [options] objfile ...

that's the whole vibe. options, then a pile of object files. periodt.

โœจ DESCRIPTION โœจ

okay so what does she actually DO. ld combines a number of object and archive files, relocates their data, and ties up symbol references. that's the job. usually the last step in compiling a program is running ld โ€” she's the finale, the closing number, the last one on stage ๐ŸŽ€

ld accepts Linker Command Language files written in a superset of AT&T's Link Editor Command Language syntax, and the reason is so you get explicit and total control over the linking process. total. control. no cap.

heads up bestie: this man page does not describe the command language. for full details on the command language and on other aspects of the GNU linker, go read the ld entry in info. this page is not the whole story, she's just the appetizer ๐Ÿ“

so, this version of ld uses the general purpose BFD libraries to operate on object files. what that buys you: ld can read, combine, and write object files in many different formats โ€” for example COFF or a.out. and yeah, different formats may be linked together to produce any available kind of object file. she's flexible like that.

aside from the flexibility, the GNU linker is genuinely more helpful than other linkers when it comes to handing you diagnostic information. here's the tea: many linkers just abandon execution immediately upon encountering an error. rude. ld, whenever possible, keeps going, so you can identify other errors โ€” or, in some cases, get an output file in spite of the error. she's not going to ghost you at the first sign of trouble ๐Ÿ˜ญ

and the whole point: the GNU linker ld is meant to cover a broad range of situations, and to be as compatible as possible with other linkers. as a result? you have many choices to control its behavior. many. a plethora. a buffet. ๐Ÿฝ๏ธ


โœจ OPTIONS โœจ

the linker supports a plethora of command-line options, but in actual practice few of them are used in any particular context. for instance, a frequent use of ld is to link standard Unix object files on a standard, supported Unix system. on such a system, to link a file hello.o:

ld -o <output> /lib/crt0.o hello.o -lc

so this tells ld to produce a file called output as the result of linking the file /lib/crt0.o with hello.o and the library libc.a, which will come from the standard search directories. (see the discussion of the -l option below, bestie, it's coming.)

some of the command-line options to ld may be specified at any point in the command line. HOWEVER โ€” and this is the plot twist โ€” options which refer to files, such as -l or -T, cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. order matters, she's sensitive about it ๐Ÿ’…

repeating non-file options with a different argument will either have no further effect, or override prior occurrences (those further to the left on the command line) of that option. options which may be meaningfully specified more than once are noted in the descriptions below. iykyk.

non-option arguments are object files or archives which are to be linked together. they may follow, precede, or be mixed in with command-line options โ€” except that an object file argument may not be placed between an option and its argument. do not do that. that's the one rule ๐Ÿšซ

usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. and if no binary input files at all are specified? the linker does not produce any output, and issues the message:

No input files.

she's blunt. she's honest. respect.

if the linker cannot recognize the format of an object file, it will assume that it is a linker script. a script specified in this way augments the main linker script used for the link โ€” either the default linker script, or the one specified by using -T. this feature permits the linker to link against a file which appears to be an object or an archive, but actually merely defines some symbol values, or uses INPUT or GROUP to load other objects. sneaky but legal โœจ

specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script. use the -T option to replace the default linker script entirely โ€” but note the effect of the INSERT command. don't say i didn't warn you.

for options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them. no space where space doesn't belong.

for options whose names are multiple letters, either one dash or two can precede the option name โ€” for example, -trace-symbol and --trace-symbol are equivalent. cute, right?

โš ๏ธ note โ€” there is ONE exception to this rule. Multiple letter options that start with a lower case o can only be preceded by two dashes. this is to reduce confusion with the -o option. so for example -omagic sets the output file name to magic, whereas --omagic sets the NMAGIC flag on the output. one dash vs two dash = completely different personality. do not mix them up ๐Ÿ’€

arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. for example, --trace-symbol foo and --trace-symbol=foo are equivalent. also, unique abbreviations of the names of multiple-letter options are accepted. yes, she'll meet you halfway. ๐Ÿซถ

โš ๏ธ note โ€” if the linker is being invoked indirectly, via a compiler driver (e.g. gcc), then all the linker command-line options should be prefixed by -Wl, (or whatever is appropriate for the particular compiler driver) like this:
gcc -Wl,--start-group foo.o bar.o -Wl,--end-group

this is important, because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. silently! the audacity! ๐Ÿ™ˆ

confusion may also arise when passing options that require values through a driver, as the use of a space between option and argument acts as a separator, and causes the driver to pass only the option to the linker and the argument to the compiler. in this case, it is simplest to use the joined forms of both single- and multiple-letter options, such as:

gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.map

here is a table of the generic command-line switches accepted by the GNU linker:


  • @file โ€” read command-line options from file. the options read are inserted in place of the original @file option. if file does not exist, or cannot be read, then the option will be treated literally, and not removed. (not me side-eyeing that behavior.) options in file are separated by whitespace. a whitespace character may be included in an option by surrounding the entire option in either single or double quotes. any character (including a backslash) may be included by prefixing the character to be included with a backslash. and yes, file may itself contain additional @file options โ€” any such options will be processed recursively. it's turtles all the way down ๐Ÿข
  • -a keyword โ€” this option is supported for HP/UX compatibility. the keyword argument must be one of the strings archive, shared, or default. -aarchive is functionally equivalent to -Bstatic, and the other two keywords are functionally equivalent to -Bdynamic. this option may be used any number of times. go off ๐Ÿ‘‘
  • --audit AUDITLIB โ€” adds AUDITLIB to the DT_AUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. if specified multiple times, DT_AUDIT will contain a colon separated list of audit interfaces to use. if the linker finds an object with an audit entry while searching for shared libraries, it will add a corresponding DT_DEPAUDIT entry in the output file. this option is only meaningful on ELF platforms supporting the rtld-audit interface.
  • -b input-format
  • --format=input-format โ€” ld may be configured to support more than one kind of object file. if your ld is configured this way, you can use the -b option to specify the binary format for input object files that follow this option on the command line. even when ld is configured to support alternative object formats, you don't usually need to specify this, as ld should be configured to expect as a default input format the most usual format on each machine. input-format is a text string, the name of a particular format supported by the BFD libraries. (you can list the available binary formats with objdump -i.) you may want to use this option if you are linking files with an unusual binary format. you can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format. the default format is taken from the environment variable GNUTARGET. you can also define the input format from a script, using the command TARGET; ๐Ÿ”ฅ
  • -c MRI-commandfile
  • --mri-script=MRI-commandfile โ€” for compatibility with linkers produced by MRI, ld accepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. introduce MRI script files with the option -c; use the -T option to run linker scripts written in the general-purpose ld scripting language. if MRI-cmdfile does not exist, ld looks for it in the directories specified by any -L options. she'll go looking for it, bestie, she's thorough ๐ŸŒธ
  • -d
  • -dc
  • -dp โ€” these three options are equivalent; multiple forms are supported for compatibility with other linkers. they assign space to common symbols even if a relocatable output file is specified (with -r). the script command FORCE_COMMON_ALLOCATION has the same effect. three names, one job, slay ๐Ÿ’…
  • --depaudit AUDITLIB
  • -P AUDITLIB โ€” adds AUDITLIB to the DT_DEPAUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. if specified multiple times, DT_DEPAUDIT will contain a colon separated list of audit interfaces to use. this option is only meaningful on ELF platforms supporting the rtld-audit interface. the -P option is provided for Solaris compatibility. ๐Ÿซถ
  • --enable-linker-version โ€” enables the LINKER_VERSION linker script directive, described in Output Section Data. if this directive is used in a linker script and this option has been enabled, then a string containing the linker version will be inserted at the current point.
โš ๏ธ note โ€” the location of this option on the linker command line is significant. it will only affect linker scripts that come after it on the command line, or which are built into the linker. position matters, she's picky like that ๐Ÿ™ˆ
  • --disable-linker-version โ€” disables the LINKER_VERSION linker script directive, so that it does not insert a version string. this is the default. she's chill about it out of the box โœจ
  • --enable-non-contiguous-regions โ€” bestie, this one stops the linker from having a whole meltdown when an input section doesn't fit into the output section it was matched with. Instead of just erroring out, the linker keeps trying to drop that input section into the next matching output sections, and only throws an error if literally no output section is big enough. Iconic, right? It's genuinely useful when you've got several non-contiguous memory regions kicking around and the input section doesn't care which one it lands in. ๐Ÿ’…

The order that input sections get evaluated stays exactly the same, no cap. Like, watch this vibe:

MEMORY {
  MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
  MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
  MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
  mem1 : { *(.data.*); } > MEM1
  mem2 : { *(.data.*); } > MEM2
  mem3 : { *(.data.*); } > MEM3
}

with these input sections:

.data.1: size 8
.data.2: size 0x10
.data.3: size 4

you get .data.1 affected to mem1, and .data.2 and .data.3 affected to mem2 โ€” even though .data.3 would have fit in mem3. โœจ

Heads up: this option is incompatible with INSERT statements, because it literally changes the way input sections get mapped to output sections.
  • --enable-non-contiguous-regions-warnings โ€” turns on warnings for when --enable-non-contiguous-regions allows possibly unexpected matches in section mapping. Why do you care? Because those sneaky matches could potentially lead to silently discarding a section instead of failing just because it didn't fit any output region. ๐Ÿ™ˆ
  • -e entry, --entry=entry โ€” use entry as the explicit symbol for where your program starts executing, instead of the default entry point. ๐ŸŽ€ If there's no symbol actually named entry, the linker will try to parse entry as a number and use that as the entry address. The number is interpreted in base 10, but you can use a leading 0x for base 16, or a leading 0 for base 8. periodt.
  • --exclude-libs lib,lib,... โ€” gives a list of archive libraries whose symbols should NOT be automatically exported. Library names can be delimited by commas or colons. If you say --exclude-libs ALL, then symbols in all archive libraries are excluded from automatic export. ๐Ÿซถ This option is only available for the i386 PE targeted port of the linker and for ELF targeted ports. For i386 PE, symbols explicitly listed in a .def file are still exported, regardless of this option. For ELF targeted ports, symbols affected by this option get treated as hidden.
  • --exclude-modules-for-implib module,module,... โ€” a list of object files or archive members whose symbols should not be automatically exported, but which should still be copied wholesale into the import library being generated during the link. Module names can be delimited by commas or colons, and they must match exactly the filenames used by ld to open the files. For archive members, that's simply the member name; but for object files, the name you list must include and match precisely any path used to specify the input file on the linker's command line. Only available for the i386 PE targeted port. Symbols explicitly listed in a .def file are still exported, regardless of this option.
  • -E, --export-dynamic, --no-export-dynamic โ€” when you're creating a dynamically linked executable, using -E or --export-dynamic makes the linker add all symbols to the dynamic symbol table. That table is the set of symbols visible from dynamic objects at run time. ๐ŸŒˆ

If you don't use either of these options โ€” or you use --no-export-dynamic to restore the default behavior โ€” then the dynamic symbol table will normally contain only those symbols that are referenced by some dynamic object mentioned in the link.

If you use dlopen to load a dynamic object that needs to refer back to symbols defined by the program (rather than by some other dynamic object), then you'll probably need this option when linking the program itself. ๐Ÿ’œ

You can also use the dynamic list to control which symbols get added to the dynamic symbol table, if the output format supports it. See the description of --dynamic-list.

Note: this option is specific to ELF targeted ports. PE targets support a similar function to export all symbols from a DLL or EXE โ€” see the description of --export-all-symbols below.
  • --export-dynamic-symbol=glob โ€” when creating a dynamically linked executable, symbols matching glob get added to the dynamic symbol table. When creating a shared library, references to symbols matching glob will not be bound to the definitions within the shared library. Lowkey important: this option is a no-op when creating a shared library and -Bsymbolic or --dynamic-list are not specified. It's only meaningful on ELF platforms which support shared libraries.
  • --export-dynamic-symbol-list=file โ€” specifies a --export-dynamic-symbol for each pattern in file. The format of the file is the same as the version node without scope and node name. See VERSION for more info. ๐ŸŽ€
  • -EB โ€” link big-endian objects. This affects the default output format.
  • -EL โ€” link little-endian objects. This affects the default output format.
  • -f name, --auxiliary=name โ€” when creating an ELF shared object, this sets the internal DT_AUXILIARY field to the specified name. It tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name. ๐Ÿฆ‹

If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_AUXILIARY field. If the dynamic linker resolves any symbols from the filter object, it first checks whether there's a definition in the shared object name. If there is one, it gets used instead of the definition in the filter object. The shared object name doesn't even need to exist. So name can be used to provide an alternative implementation of certain functions โ€” maybe for debugging, or for machine-specific performance. โœจ

This option may be specified more than once. The DT_AUXILIARY entries get created in the order they appear on the command line.

  • -F name, --filter=name โ€” when creating an ELF shared object, this sets the internal DT_FILTER field to name. It tells the dynamic linker that the symbol table of the shared object being created should be used as a filter on the symbol table of the shared object name. ๐Ÿ’–

If you later link a program against this filter object, then when you run it, the dynamic linker will see the DT_FILTER field. It resolves symbols according to the symbol table of the filter object as usual, but it will actually link to the definitions found in the shared object name. So the filter object can select a subset of the symbols provided by name. ๐Ÿ‘‘

Some older linkers used -F all throughout a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker uses other mechanisms for this: the -b, --format, --oformat options, the TARGET command in linker scripts, and the GNUTARGET environment variable. The GNU linker will just ignore the -F option when not creating an ELF shared object. ๐Ÿ’…

  • -fini=name โ€” when creating an ELF executable or shared object, call NAME when the executable or shared object is unloaded, by setting DT_FINI to the address of the function. By default, the linker uses _fini as the function to call. ๐ŸŽ€
  • -g โ€” ignored. Provided for compatibility with other tools. That's it, that's the whole thing. ๐Ÿ˜ญ
  • -G value, --gpsize=value โ€” set the maximum size of objects to be optimized using the GP register to size. This is only meaningful for object file formats like MIPS ELF that support putting large and small objects into different sections. It's ignored for other object file formats. ๐ŸŒธ
  • -h name, -soname=name โ€” when creating an ELF shared object, this sets the internal DT_SONAME field to name. When an executable is linked with a shared object that has a DT_SONAME field, then when the executable runs, the dynamic linker will try to load the shared object specified by the DT_SONAME field rather than using the file name given to the linker. ๐Ÿซถ
  • -i โ€” perform an incremental link (same as option -r).
  • -init=name โ€” when creating an ELF executable or shared object, call NAME when the executable or shared object is loaded, by setting DT_INIT to the address of the function. By default, the linker uses _init as the function to call. โœจ
  • -l namespec, --library=namespec โ€” add the archive or object file specified by namespec to the list of files to link. This option may be used any number of times. If namespec is of the form :filename, ld will search the library path for a file called filename; otherwise it searches the library path for a file called libnamespec.a. ๐Ÿ’–

On systems that support shared libraries, ld may also search for files other than libnamespec.a. Specifically, on ELF and SunOS systems, ld will search a directory for a library called libnamespec.so before searching for one called libnamespec.a. (By convention, a .so extension means shared library.) Note that this behavior does not apply to :filename, which always specifies a file called filename. ๐Ÿ‘‘

The linker searches an archive only once, at the location where it's specified on the command line. If the archive defines a symbol that was undefined in some object appearing before the archive on the command line, the linker includes the appropriate file(s) from the archive. But โ€” plot twist โ€” an undefined symbol in an object appearing later on the command line will NOT cause the linker to search the archive again. ๐Ÿ˜ญ

See the -( option for a way to force the linker to search archives multiple times.

You may list the same archive multiple times on the command line.

This type of archive searching is standard for Unix linkers. However, if you're using ld on AIX, note that it's different from the behaviour of the AIX linker. ๐ŸŒˆ

  • -L searchdir, --library-path=searchdir โ€” bestie, this one adds searchdir to the list of paths ld will go rummaging through looking for archive libraries and ld control scripts. Use it as many times as your heart desires ๐Ÿ’– The directories get searched in the order you typed them on the command line, and anything you put on the command line gets searched before the default directories. Lowkey important: all -L options apply to all -l options, no matter what order they appear in. And heads up โ€” -L options do not affect how ld hunts for a linker script unless you also specify the -T option. ๐Ÿซถ

If searchdir starts with = or $SYSROOT, that prefix gets swapped out for the sysroot prefix โ€” the one controlled by the --sysroot option, or set when the linker was configured. ๐ŸŒธ

The default set of paths searched (the ones you didn't specify with -L) depends on which emulation mode ld is using, and sometimes on how it was configured. The paths can also be specified in a link script with the "SEARCH_DIR" command โ€” and directories specified that way get searched at the exact point where the linker script shows up in the command line. โœจ

  • -m emulation โ€” emulate the emulation linker, periodt. You can list all the available emulations with the --verbose or -V options. If -m isn't used, the emulation gets taken from the "LDEMULATION" environment variable (if that's defined, bestie). Otherwise, the default emulation depends on how the linker was configured. ๐Ÿ™ˆ
  • --remap-inputs=pattern=filename, --remap-inputs-file=file โ€” okay so these two let you change the names of input files before the linker even tries to open them. Like, --remap-inputs=foo.o=bar.o makes any attempt to load a file called foo.o instead try to load a file called bar.o. Wildcard patterns are permitted in the first filename, so --remap-inputs=foo*.o=bar.o renames any input file that matches foo*.o to bar.o. ๐Ÿฆ‹

Alternative form: --remap-inputs-file=filename lets you read the remappings from a file. Each line in the file can hold a single remapping. Blank lines are ignored. Anything from a hash character (#) to the end of a line counts as a comment and is also ignored. The mapping pattern can be separated from the filename by whitespace or an equals (=) character. ๐Ÿ’…

You can specify these options multiple times โ€” their contents accumulate. The remappings get processed in the order they occur on the command line, and if they come from a file, in the order they occur in the file. If a match is made, no further checking for that filename will be performed. ๐ŸŽ€

If the replacement filename is /dev/null or just NUL, then the remapping will actually cause the input file to be ignored โ€” which is a convenient way to experiment with removing input files from a complicated build environment. ๐ŸŒˆ

Note that this option is position dependent and only affects filenames that come after it on the command line. So this:
ld foo.o --remap-inputs=foo.o=bar.o

Will have no effect, whereas:

ld --remap-inputs=foo.o=bar.o foo.o

Will rename the input file foo.o to bar.o. ๐Ÿ˜Œ

Note โ€” these options also affect files referenced by INPUT statements in linker scripts. But since linker scripts are processed after the entire command line is read, the position of the remap options on the command line is not significant. If the verbose option is enabled then any mappings that match will be reported, although again the verbose option needs to be enabled on the command line before the remapped filenames appear. And if the -Map or --print-map options are enabled, then the remapping list will be included in the map output. ๐Ÿ”ฅ

  • -M, --print-map โ€” prints a link map to the standard output. A link map is basically the receipts for the link, and it tells you:
    • Where object files are mapped into memory. ๐Ÿ“
    • How common symbols are allocated.
    • All archive members included in the link, plus a mention of the symbol which caused that archive member to be brought in.
    • The values assigned to symbols.
Note โ€” symbols whose values are computed by an expression that involves a reference to a previous value of the same symbol may not have the correct result displayed in the link map. That's because the linker discards intermediate results and only retains the final value of an expression. Under such circumstances the linker will display the final value enclosed by square brackets. ๐Ÿ’€

So for example, a linker script containing:

foo = 1
foo = foo * 4
foo = foo + 8

will produce the following output in the link map if the -M option is used:

0x00000001                foo = 0x1
[0x0000000c]                foo = (foo * 0x4)
[0x0000000c]                foo = (foo + 0x8)

See Expressions for more info about expressions in linker scripts. ๐Ÿงš

  • How GNU properties are merged.

When the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties get removed or updated. These actions are reported in the link map. For example:

Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)

This indicates that property 0xc0000002 is removed from output when merging properties in foo.o, whose property 0xc0000002 value is 0x1, and bar.o, which doesn't have property 0xc0000002. โœจ

Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)

This indicates that property 0xc0010001 value is updated to 0x1 in output when merging properties in foo.o, whose 0xc0010001 property value is 0x1, and bar.o, whose 0xc0010001 property value is 0x1. ๐Ÿ’œ

  • --print-map-discarded, --no-print-map-discarded โ€” print (or don't print) the list of discarded and garbage collected sections in the link map. Enabled by default. ๐Ÿ—‘๏ธ
  • --print-map-locals, --no-print-map-locals โ€” print (or don't print) local symbols in the link map. Local symbols will have the text (local) printed before their name, and will be listed after all of the global symbols in a given section. Temporary local symbols (typically those that start with .L) will not be included in the output. Disabled by default. ๐Ÿ™ˆ
  • -n, --nmagic โ€” turns off page alignment of sections, and disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as "NMAGIC". โœจ
  • -N, --omagic โ€” sets the text and data sections to be readable and writable. Also, it does not page-align the data segment, and disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as "OMAGIC".
Note: although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. ๐Ÿ˜ญ
  • --no-omagic โ€” negates most of the effects of the -N option. It sets the text section to be read-only, and forces the data segment to be page-aligned.
Note โ€” this option does not enable linking against shared libraries. Use -Bdynamic for that. ๐Ÿ’…
  • -o output, --output=output โ€” use output as the name for the program produced by ld. If you don't specify this option, the name a.out is used by default. The script command "OUTPUT" can also specify the output file name. ๐Ÿ‘‘
  • --dependency-file=depfile โ€” writes a dependency file to depfile. This file contains a rule suitable for "make" describing the output file and all the input files that were read to produce it. The output is similar to the compiler's output with -M -MP.
Note that there is no option like the compiler's -MM, to exclude "system files" (which is not a well-specified concept in the linker, unlike "system headers" in the compiler). So the output from --dependency-file is always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. ๐Ÿ“
  • -O level โ€” if level is a numeric value greater than zero, ld optimizes the output. This might take significantly longer and therefore probably should only be enabled for the final binary. At the moment this option only affects ELF shared library generation. Future releases of the linker may make more use of this option. Also currently there's no difference in the linker's behaviour for different non-zero values of this option โ€” again, this may change with future releases. โญ
  • -plugin name โ€” involves a plugin in the linking process. The name parameter is the absolute filename of the plugin. Usually this parameter is automatically added by the compiler when using link time optimization, but users can also add their own plugins if they so wish. ๐Ÿงš
Note that the location of the compiler originated plugins is different from the place where the ar, nm and ranlib programs search for their plugins. In order for those commands to make use of a compiler based plugin, it must first be copied into the ${libdir}/bfd-plugins directory. All gcc based linker plugins are backward compatible, so it is sufficient to just copy in the newest one. ๐Ÿ’–
  • --push-state โ€” lets you preserve the current state of the flags that govern input file handling, so that they can all be restored with one corresponding --pop-state option. ๐ŸŒธ

The options that are covered are: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a. ๐Ÿ“‹

One target for this option is specifications for pkg-config. When used with the --libs option, all possibly needed libraries are listed and then possibly linked with all the time. It's better to return something like this instead:

-Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state
  • --pop-state โ€” undoes the effect of --push-state, restoring the previous values of the flags governing input file handling. ๐Ÿซถ
  • -q, --emit-relocs โ€” bestie, this one leaves the relocation sections and all their contents sitting in fully linked executables ๐Ÿ’–. Like, post-link analysis and optimization tools might lowkey NEED that info to modify executables correctly. Downside? Your executables get bigger. And heads up: this is currently only supported on ELF platforms. โœจ
  • --force-dynamic โ€” forces the output file to have dynamic sections. This one is super specific: it's only for VxWorks targets, no cap. ๐ŸŽ€
  • -r, --relocatable โ€” generate relocatable output, aka make an output file that can itself go be an input to ld again. People call this partial linking and it's giving very meta, very recursive, we love her ๐Ÿฆ‹. Side effect: in environments that support standard Unix magic numbers, this option also sets the output file's magic number to "OMAGIC". If you don't pass this option, you get an absolute file instead. And psst โ€” when you're linking C++ programs, this option will not resolve references to constructors; for that you gotta use -Ur.

Also, important: when an input file doesn't have the same format as the output file, partial linking is only supported if that input file has no relocations at all. Different output formats can have further restrictions โ€” for example, some "a.out"-based formats straight up don't support partial linking with input files in other formats, like, at all. ๐Ÿ˜ญ

This option does the exact same thing as -i.

  • -R filename, --just-symbols=filename โ€” reads symbol names and their addresses from filename, but doesn't relocate it or include it in the output. This lets your output file refer symbolically to absolute locations of memory defined in other programs. You can use this option more than once, bestie ๐Ÿ’….

For compatibility with other ELF linkers: if -R is followed by a directory name instead of a file name, it's treated as the -rpath option. Sneaky. ๐Ÿ‘‘

  • -s, --strip-all โ€” omits all symbol information from the output file. Gone. Bye. ๐Ÿ’€
  • -S, --strip-debug โ€” omits debugger symbol information (but not all symbols, she's selective) from the output file. ๐ŸŒธ
  • --strip-discarded, --no-strip-discarded โ€” omit (or don't omit) global symbols defined in discarded sections. Enabled by default, periodt.
  • -t, --trace โ€” prints the names of the input files as ld processes them. Give -t twice and members within archives get printed too ๐Ÿซถ. The -t output is genuinely useful for generating a list of all the object files and scripts involved in linking โ€” like when you're packaging files for a linker bug report. Iconic for debugging.
  • -T scriptfile, --script=scriptfile โ€” use scriptfile as the linker script. This script replaces ld's default linker script (rather than adding to it), unless the script contains "INSERT" โ€” in that case commandfile must specify everything necessary to describe the output file. If scriptfile doesn't exist in the current directory, ld goes looking for it in the directories specified by any preceding -L options. Multiple -T options accumulate. โญ
  • -dT scriptfile, --default-script=scriptfile โ€” use scriptfile as the default linker script.

This is similar to the --script option except that processing of the script is delayed until after the rest of the command line has been processed โณ. This means options placed after --default-script on the command line can affect the behaviour of the linker script, which matters a lot when the linker command line can't be directly controlled by the user. (eg because the command line is being constructed by another tool, such as gcc.) ๐Ÿงš

  • -u symbol, --undefined=symbol โ€” force symbol to be entered in the output file as an undefined symbol. Doing this may, for example, trigger linking of additional modules from standard libraries ๐Ÿ‘€. -u may be repeated with different option arguments to enter additional undefined symbols. This option is equivalent to the "EXTERN" linker script command.

If you're using this to force additional modules into the link, and it's an error for the symbol to remain undefined, then you should use --require-defined instead. Read the room, use the right tool ๐Ÿ’….

  • --require-defined=symbol โ€” require that symbol is defined in the output file. This is the same as --undefined except that if symbol is not defined in the output file, the linker issues an error and exits. ๐Ÿ˜ค The same effect can be achieved in a linker script by using "EXTERN", "ASSERT" and "DEFINED" together. This option can be used multiple times to require additional symbols.
  • -Ur โ€” for programs that don't use constructors or destructors, or for ELF based systems, this option is equivalent to -r: it generates relocatable output, i.e. an output file that can in turn serve as input to ld. For other binaries though, -Ur is similar to -r but it also resolves references to constructors and destructors. ๐ŸŒˆ

For those systems where -r and -Ur behave differently: it does not work to use -Ur on files that were themselves linked with -Ur. Once the constructor table has been built, it cannot be added to. So use -Ur only for the last partial link, and -r for all the others. Fr fr, don't fight the rules.

  • --orphan-handling=MODE โ€” controls how orphan sections are handled. An orphan section is one not specifically mentioned in a linker script. ๐Ÿง

MODE can have any of the following values:

  • "place" โ€” orphan sections are placed into a suitable output section following the strategy described in Orphan Sections. The option --unique also affects how sections are placed.
  • "discard" โ€” all orphan sections are discarded, by placing them in the /DISCARD/ section. ๐Ÿ—‘๏ธ
  • "warn" โ€” the linker places the orphan section as for "place" and also issues a warning.
  • "error" โ€” the linker exits with an error if any orphan section is found. ๐Ÿ˜ค

The default if --orphan-handling is not given is "place".

  • --unique[=SECTION] โ€” creates a separate output section for every input section matching SECTION, or if the optional wildcard SECTION argument is missing, for every orphan input section. An orphan section is one not specifically mentioned in a linker script. You can use this option multiple times on the command line โœจ. It prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script. She said no merging today ๐Ÿ’….
  • -v, --version, -V โ€” display the version number for ld. The -V option also lists the supported emulations ๐Ÿ‘‘. See also the description of the --enable-linker-version in Options,,Command-line Options, which can be used to insert the linker version string into a binary.
  • -x, --discard-all โ€” delete all local symbols. All of them. Poof. ๐Ÿ’€
  • -X, --discard-locals โ€” delete all temporary local symbols. (These symbols start with system-specific local label prefixes, typically .L for ELF systems or L for traditional a.out systems.) ๐ŸŽ€
  • -y symbol, --trace-symbol=symbol โ€” print the name of each linked file in which symbol appears. This option may be given any number of times ๐Ÿ”ฅ. On many systems it's necessary to prepend an underscore.

This option is useful when you have an undefined symbol in your link but don't know where the reference is coming from โ€” like a little detective for your linker ๐Ÿ•ต๏ธโ€โ™€๏ธ.

  • -Y path โ€” add path to the default library search path. This option exists for Solaris compatibility, iykyk.
  • -z keyword โ€” the recognized keywords are:
    • call-nop=prefix-addr, call-nop=suffix-nop, call-nop=prefix-byte, call-nop=suffix-byte โ€” specify the 1-byte "NOP" padding when transforming an indirect call to a locally defined function, foo, via its GOT slot. call-nop=prefix-addr generates "0x67 call foo". call-nop=suffix-nop generates "call foo 0x90". call-nop=prefix-byte generates "byte call foo". call-nop=suffix-byte generates "call foo byte". Supported for i386 and x86_64. โญ
    • cet-report=none, cet-report=warning, cet-report=error โ€” specify how to report the missing GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK properties in input .note.gnu.property section. cet-report=none, which is the default, makes the linker not report missing properties in input files. cet-report=warning makes the linker issue a warning for missing properties in input files. cet-report=error makes the linker issue an error for missing properties in input files. Note that ibt turns off the missing GNU_PROPERTY_X86_FEATURE_1_IBT property report and shstk turns off the missing GNU_PROPERTY_X86_FEATURE_1_SHSTK property report. Supported for Linux/i386 and Linux/x86_64. ๐Ÿฆ‹
    • combreloc, nocombreloc โ€” combine multiple dynamic relocation sections and sort to improve dynamic symbol lookup caching. Do not do this if nocombreloc. ๐Ÿ™ˆ
    • common, nocommon โ€” generate common symbols with STT_COMMON type during a relocatable link. Use STT_OBJECT type if nocommon.
    • common-page-size=value โ€” set the page size most commonly used to value. Memory image layout will be optimized to minimize memory pages if the system is using pages of this size. ๐Ÿ“
    • defs โ€” report unresolved symbol references from regular object files. This is done even if the linker is creating a non-symbolic shared library. This option is the inverse of -z undefs.
    • dynamic-undefined-weak, nodynamic-undefined-weak โ€” make undefined weak symbols dynamic when building a dynamic object, if they're referenced from a regular object file and not forced local by symbol visibility or versioning. Do not make them dynamic if nodynamic-undefined-weak. If neither option is given, a target may default to either option being in force, or make some other selection of undefined weak symbols dynamic. Not all targets support these options, ngl. ๐Ÿซถ
    • execstack โ€” marks the object as requiring executable stack. โš ๏ธ
    • global โ€” this option is only meaningful when building a shared object. It makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries. ๐Ÿ‘‘
  • -z globalaudit โ€” only makes sense when you're building a dynamic executable, bestie. It slaps the "DF_1_GLOBAUDIT" bit into the "DT_FLAGS_1" dynamic tag, marking the executable as needing global auditing. What that means: any auditing library you defined with the --depaudit or -P command-line options has to run for every single dynamic object the app loads. Periodt.
  • -z ibtplt โ€” generates Intel Indirect Branch Tracking (IBT) enabled PLT entries. Supported for Linux/i386 and Linux/x86_64. ๐Ÿ’…
  • -z ibt โ€” generates GNU_PROPERTY_X86_FEATURE_1_IBT in the .note.gnu.property section, which is the lil signal that says "hey, I'm compatible with IBT." It also implies ibtplt. Supported for Linux/i386 and Linux/x86_64.
  • -z indirect-extern-access, -z noindirect-extern-access โ€” the first one generates GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS in the .note.gnu.property section, declaring that the object file needs canonical function pointers and literally cannot be used with copy relocation. It also implies noextern-protected-data and nocopyreloc. Supported for i386 and x86-64. And noindirect-extern-access? That one just removes GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS from the .note.gnu.property section. Undoing the vibe, iconic.
  • -z initfirst โ€” only meaningful when building a shared object. It marks the object so its runtime initialization happens before the runtime initialization of any other object pulled into the process at the same time. And on the flip side, its runtime finalization happens after everybody else's. Main character energy, honestly.
  • -z interpose โ€” tells the dynamic loader to switch up its symbol search order so symbols in this shared library interpose all the other shared libraries that didn't get this mark. Sorry to everyone else. ๐Ÿ’…
  • -z unique, -z nounique โ€” when you're generating a shared library or any other dynamically loadable ELF object, this marks it as one that should (by default) only ever be loaded once, and only in the main namespace (that's when you're using "dlmopen"). It's mainly for fundamental libraries like libc, libpthread et al, which lowkey don't function correctly unless they're the sole instance of themselves. The "dlmopen" caller can override this behaviour, and it doesn't apply to certain loading mechanisms (like audit libraries, iykyk).
  • -z lam-u48 โ€” generates GNU_PROPERTY_X86_FEATURE_1_LAM_U48 in the .note.gnu.property section to show compatibility with Intel LAM_U48. Supported for Linux/x86_64. โœจ
  • -z lam-u57 โ€” generates GNU_PROPERTY_X86_FEATURE_1_LAM_U57 in the .note.gnu.property section to show compatibility with Intel LAM_U57. Supported for Linux/x86_64. โœจ
  • -z lam-u48-report=none, -z lam-u48-report=warning, -z lam-u48-report=error โ€” picks how you report a missing GNU_PROPERTY_X86_FEATURE_1_LAM_U48 property in the input .note.gnu.property section. lam-u48-report=none is the default, and it makes the linker just not report missing properties in input files at all (living in denial, honestly). lam-u48-report=warning makes the linker throw a warning for missing properties in input files. lam-u48-report=error makes the linker throw a whole error for missing properties in input files. Supported for Linux/x86_64.
  • -z lam-u57-report=none, -z lam-u57-report=warning, -z lam-u57-report=error โ€” same situation but for a missing GNU_PROPERTY_X86_FEATURE_1_LAM_U57 property in the input .note.gnu.property section. lam-u57-report=none is the default and the linker won't report missing properties in input files. lam-u57-report=warning gets you a warning for missing properties in input files. lam-u57-report=error gets you an error for missing properties in input files. Supported for Linux/x86_64.
  • -z lam-report=none, -z lam-report=warning, -z lam-report=error โ€” the combo meal ๐Ÿ“: how to report missing GNU_PROPERTY_X86_FEATURE_1_LAM_U48 and GNU_PROPERTY_X86_FEATURE_1_LAM_U57 properties in the input .note.gnu.property section. lam-report=none is the default and skips reporting missing properties in input files entirely. lam-report=warning warns you about missing properties in input files. lam-report=error goes full error on missing properties in input files. Supported for Linux/x86_64.
  • -z lazy โ€” when generating an executable or shared library, this marks it to tell the dynamic linker to defer function call resolution until the exact moment the function is called (that's lazy binding), instead of doing it at load time. And bestie, lazy binding is the default. It's giving procrastination as a lifestyle. ๐Ÿ˜ญ
  • -z loadfltr โ€” says the object's filters get processed immediately at runtime. No waiting around. ๐Ÿ’…
  • -z max-page-size=value โ€” sets the maximum memory page size supported to value.
  • -z muldefs โ€” allow multiple definitions. Let them cook.
  • -z nocopyreloc โ€” disables linker generated .dynbss variables that get used in place of variables defined in shared libraries. Heads up though: this may result in dynamic text relocations. ๐Ÿ™ˆ
  • -z nodefaultlib โ€” says the dynamic loader, when searching for dependencies of this object, should ignore any default library search paths. It's going off the grid.
  • -z nodelete โ€” says the object shouldn't be unloaded at runtime. It's staying. Forever. ๐Ÿซถ
  • -z nodlopen โ€” says the object is not available to "dlopen". Gatekeeping, honestly.
  • -z nodump โ€” says the object cannot be dumped by "dldump".
  • -z noexecstack โ€” marks the object as not requiring an executable stack. Safety queen. ๐Ÿ‘‘
  • -z noextern-protected-data โ€” don't treat protected data symbols as external when building a shared library. This option overrides the linker backend default, and it can be used to work around incorrect relocations against protected data symbols that the compiler generated. Warning though: updates on protected data symbols made by another module aren't visible to the resulting shared library. Supported for i386 and x86-64.
  • -z noreloc-overflow โ€” disables the relocation overflow check. You'd use this to turn off the relocation overflow check when there's no dynamic relocation overflow at run-time. Supported for x86_64.
  • -z now โ€” when generating an executable or shared library, this marks it to tell the dynamic linker to resolve all symbols when the program starts, or when the shared library is loaded by dlopen, instead of deferring function call resolution to the moment the function is first called. The opposite of lazy, basically the overachiever of the linker world. โญ
  • -z origin โ€” says the object requires $ORIGIN handling in paths.
  • -z pack-relative-relocs, -z nopack-relative-relocs โ€” generates compact relative relocation in position-independent executable and shared library. It adds "DT_RELR", "DT_RELRSZ" and "DT_RELRENT" entries to the dynamic section. It's ignored when you're building a position-dependent executable and relocatable output. nopack-relative-relocs is the default, which disables compact relative relocation. When linked against the GNU C Library, a GLIBC_ABI_DT_RELR symbol version dependency on the shared C Library gets added to the output. Supported for i386 and x86-64.
  • -z relro, -z norelro โ€” creates an ELF "PT_GNU_RELRO" segment header in the object. This specifies a memory segment that should be made read-only after relocation, if supported. Big warning: specifying common-page-size smaller than the system page size will render this protection ineffective. And norelro? Don't create the ELF "PT_GNU_RELRO" segment. No protection, no vibes.
  • -z report-relative-reloc โ€” reports dynamic relative relocations generated by the linker. Supported for Linux/i386 and Linux/x86_64.
  • -z sectionheader, -z nosectionheader โ€” generate a section header. Don't generate one if nosectionheader is used. And sectionheader is the default.
  • -z separate-code, -z noseparate-code โ€” creates a separate code "PT_LOAD" segment header in the object. This specifies a memory segment that should contain only instructions and must sit in wholly disjoint pages from any other data. If you use noseparate-code, no separate code "PT_LOAD" segment gets created. It's giving "my code is in its own lane." ๐Ÿ’…
  • -z shstk โ€” generates GNU_PROPERTY_X86_FEATURE_1_SHSTK in the .note.gnu.property section to indicate compatibility with Intel Shadow Stack. Supported for Linux/i386 and Linux/x86_64. โœจ
  • -z stack-size=value โ€” specifies a stack size for an ELF "PT_GNU_STACK" segment. Heads up: specifying zero will override any default non-zero sized "PT_GNU_STACK" segment creation. ๐Ÿ˜ญ
  • -z start-stop-gc, -z nostart-stop-gc โ€” okay so when --gc-sections is in effect, a reference from a retained section to "__start_SECNAME" or "__stop_SECNAME" causes all input sections named "SECNAME" to also get retained, as long as "SECNAME" is representable as a C identifier and either "__start_SECNAME" or "__stop_SECNAME" is synthesized by the linker. -z start-stop-gc disables that effect, letting sections get garbage collected as if those special synthesized symbols were never defined. Now here's the tea: -z start-stop-gc has no effect on a definition of "__start_SECNAME" or "__stop_SECNAME" in an object file or linker script. Such a definition will stop the linker from providing a synthesized "__start_SECNAME" or "__stop_SECNAME" respectively, and therefore it also kills the special treatment by garbage collection for those references.
  • -z start-stop-visibility=value โ€” specifies the ELF symbol visibility for synthesized "__start_SECNAME" and "__stop_SECNAME" symbols. value must be exactly default, internal, hidden, or protected. If no -z start-stop-visibility option is given, protected is used for compatibility with historical practice. But fr fr, it's highly recommended to use -z start-stop-visibility=hidden in new programs and shared libraries so these symbols don't get exported between shared objects, which is usually not what you intended. Do yourself a favour. ๐ŸŽ€
  • -z text, -z notext, -z textoff โ€” throw an error if DT_TEXTREL is set, like, if the position-independent or shared object has dynamic relocations chillin' in read-only sections. With notext or textoff, no error, no drama.
  • -z undefs โ€” do not rat out unresolved symbol references from regular object files, not when you're making an executable and not when you're making a shared library. It's literally the inverse of -z defs. โœจ
  • -z unique-symbol, -z nounique-symbol โ€” avoid duplicated local symbol names in the symbol string table. If you go unique-symbol, duplicated local symbol names get ."number" tacked on the end. nounique-symbol is the default, bestie. ๐Ÿ’…
  • -z x86-64-baseline, -z x86-64-v2, -z x86-64-v3, -z x86-64-v4 โ€” pick the x86-64 ISA level you need in the .note.gnu.property section:
    • x86-64-baseline generates GNU_PROPERTY_X86_ISA_1_BASELINE
    • x86-64-v2 generates GNU_PROPERTY_X86_ISA_1_V2
    • x86-64-v3 generates GNU_PROPERTY_X86_ISA_1_V3
    • x86-64-v4 generates GNU_PROPERTY_X86_ISA_1_V4

Supported for Linux/i386 and Linux/x86_64. ๐Ÿง

Other keywords are just ignored, for Solaris compatibility. Not us being rude, it's just the vibe. ๐Ÿ™ˆ


  • -( archives -), --start-group archives --end-group โ€” okay so archives here is a list of archive files. Could be straight-up explicit file names, or -l options, your call.

The archives you list get searched over and over until no new undefined references pop up. Normally an archive gets searched exactly once, in the order it shows up on the command line. So if some symbol in that archive is needed to resolve an undefined symbol that's referred to by an object in an archive appearing later on the command line โ€” yeah, the linker just cannot resolve that reference, rip. But when you group the archives, they all get searched repeatedly until every possible reference is resolved. ๐Ÿซถ

Heads up: this option has a significant performance cost. Bestie, use it only when there are unavoidable circular references between two or more archives. It is not a casual snack. ๐Ÿ˜ญ
  • --accept-unknown-input-arch, --no-accept-unknown-input-arch โ€” tells the linker to accept input files whose architecture can't be recognised. The whole assumption is that you know what you're doing and you deliberately want to link in these unknown input files, main character behaviour. This was the default before release 2.14. From release 2.14 onwards the default flipped to rejecting such input files, so --accept-unknown-input-arch got added to bring the old behaviour back. ๐ŸŒˆ
  • --as-needed, --no-as-needed โ€” this one messes with ELF DT_NEEDED tags for dynamic libraries mentioned on the command line after the --as-needed option. Normally the linker slaps a DT_NEEDED tag on for every dynamic library mentioned, whether it's actually needed or not, no vibe check at all. --as-needed means a DT_NEEDED tag only gets emitted for a library that, at that exact point in the link, satisfies a non-weak undefined symbol reference from a regular object file โ€” or, if the library isn't found in the DT_NEEDED lists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. Object files or libraries showing up on the command line after the library in question don't affect whether the library counts as needed. It's similar to the rules for extracting object files from archives. --no-as-needed restores the default behaviour. โญ
Note: on Linux based systems, --as-needed also has an effect on how --rpath and --rpath-link behave. Go read the --rpath-link description for the details, iykyk.
  • --add-needed, --no-add-needed โ€” these two are deprecated, fr. They got retired because their names were too similar to --as-needed and --no-as-needed. They've been replaced by --copy-dt-needed-entries and --no-copy-dt-needed-entries. Don't use them, periodt.
  • -assert keyword โ€” this option is ignored, for SunOS compatibility. That's it, that's the whole tea. ๐Ÿ“
  • -Bdynamic, -dy, -call_shared โ€” link against dynamic libraries. Only meaningful on platforms where shared libraries are supported, and on those platforms this option is normally the default anyway. The different variants exist for compatibility with various systems. You can use this option multiple times on the command line: it affects library searching for -l options which follow it. ๐Ÿ‘‘
  • -Bgroup โ€” sets the DF_1_GROUP flag in the DT_FLAGS_1 entry in the dynamic section. This makes the runtime linker handle lookups in this object and its dependencies only inside the group. --unresolved-symbols=report-all is implied. Only meaningful on ELF platforms which support shared libraries.
  • -Bstatic, -dn, -non_shared, -static โ€” do not link against shared libraries. Only meaningful on platforms where shared libraries are supported. The different variants are for compatibility with various systems. You can use this option multiple times on the command line: it affects library searching for -l options which follow it. This option also implies --unresolved-symbols=report-all. And plot twist โ€” it can be used with -shared. Doing that means a shared library is being created, but all of the library's external references must be resolved by pulling in entries from static libraries. ๐Ÿ”ฅ
  • -Bsymbolic โ€” when creating a shared library, bind references to global symbols to the definition within the shared library, if there is one. Normally a program linked against a shared library can override the definition inside the shared library. Only meaningful on ELF platforms which support shared libraries.
  • -Bsymbolic-functions โ€” same energy as -Bsymbolic but only for references to global function symbols: bind them to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries. ๐Ÿ’œ
  • -Bno-symbolic โ€” this one can cancel previously specified -Bsymbolic and -Bsymbolic-functions. Undo button, iconic.
  • --dynamic-list=dynamic-list-file โ€” hand the linker the name of a dynamic list file. Typically used when creating shared libraries to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library โ€” or when creating dynamically linked executables to specify a list of symbols which should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries.

The format of the dynamic list is the same as the version node without scope and node name. See VERSION for more info, bestie. โœจ

  • --dynamic-list-data โ€” include all global data symbols in the dynamic list. All of them. No crumbs left.
  • --dynamic-list-cpp-new โ€” provides the builtin dynamic list for C++ operator new and delete. Mainly useful for building shared libstdc++. ๐ŸŽ€
  • --dynamic-list-cpp-typeinfo โ€” provides the builtin dynamic list for C++ runtime type identification.
  • --check-sections, --no-check-sections โ€” asks the linker not to check section addresses after they've been assigned, to see if there are any overlaps. Normally the linker does perform this check, and if it finds overlaps it produces suitable error messages. The linker does know about sections in overlays and does make allowances for them. Default behaviour can be restored with --check-sections. Section overlap is not usually checked for relocatable links โ€” but you can force checking in that case by using the --check-sections option. ๐Ÿฆ‹
  • --copy-dt-needed-entries, --no-copy-dt-needed-entries โ€” this option affects the treatment of dynamic libraries referred to by DT_NEEDED tags inside ELF dynamic libraries mentioned on the command line. Normally the linker won't add a DT_NEEDED tag to the output binary for each library mentioned in a DT_NEEDED tag inside an input dynamic library. But with --copy-dt-needed-entries on the command line, any dynamic libraries that follow it will have their DT_NEEDED entries added. Default behaviour can be restored with --no-copy-dt-needed-entries. ๐ŸŒธ

This option also affects how symbols in dynamic libraries get resolved. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line get recursively searched, following their DT_NEEDED tags to other libraries, to resolve symbols the output binary needs. With the default setting, searching of dynamic libraries that follow it stops with the dynamic library itself โ€” no DT_NEEDED links get traversed to resolve symbols. ๐Ÿ˜ค

  • --cref โ€” output a cross reference table. If a linker map file is being generated, the cross reference table goes into the map file. Otherwise it's printed on standard output. ๐Ÿ’–

The format of the table is intentionally simple, so it can be easily processed by a script if necessary. Symbols are printed out, sorted by name. For each symbol you get a list of file names. If the symbol is defined, the first file listed is where the definition lives. If the symbol is defined as a common value, then any files where that happens appear next. Finally, any files that reference the symbol are listed. No cap, that's the whole layout.

  • --ctf-variables, --no-ctf-variables โ€” the CTF debuginfo format supports a section that encodes the names and types of variables found in the program which don't appear in any symbol table. Those variables clearly can't be looked up by address by conventional debuggers, so the space used for their types and names is usually just wasted: the types are usually small but the names are often not. --ctf-variables causes generation of such a section. Default behaviour can be restored with --no-ctf-variables. ๐Ÿงš
  • --ctf-share-types=method โ€” adjusts the method used to share types between translation units in CTF. The methods are:
    • share-unconflicted โ€” put all types that do not have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default. ๐Ÿ‘‘
  • share-duplicated โ€” okay so this one only puts types that show up in multiple translation units into the shared dictionary. Types with just one definition? They go into per-translation-unit dictionaries. And types with ambiguous definitions across multiple translation units always go into per-translation-unit dictionaries, no debate. This tends to make the CTF bigger, but it may reduce how much CTF ends up in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime. โœจ
  • --no-define-common โ€” this one blocks the assignment of addresses to common symbols. The script command INHIBIT_COMMON_ALLOCATION does the exact same thing, iykyk.

Why would you want that? Because --no-define-common lets you decouple the decision to assign addresses to Common symbols from the choice of output file type โ€” otherwise a non-Relocatable output type forces assigning addresses to Common symbols, no take-backs. Using --no-define-common lets Common symbols that are referenced from a shared library be assigned addresses only in the main program. That eliminates the unused duplicate space in the shared library, and it also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution. no cap, that's a real mess you're avoiding ๐Ÿซถ

  • --force-group-allocation โ€” this makes the linker place section group members like normal input sections, and delete the section groups. This is already the default behaviour for a final link, but you can use this option to change the behaviour of a relocatable link (-r). The script command FORCE_GROUP_ALLOCATION has the same effect.
  • --defsym=symbol=expression โ€” makes a global symbol in the output file holding the absolute address given by expression. You can use this option as many times as you need to define multiple symbols on the command line, go off ๐Ÿ’…

Only a limited form of arithmetic is supported for expression here: you may give a hexadecimal constant, or the name of an existing symbol, or use + and - to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider using the linker command language from a script instead.

Note: there should be no white space between symbol, the equals sign (=), and expression. Literally none. Don't do it.

The linker processes --defsym arguments and -T arguments in order. Put --defsym before -T and the symbol gets defined before the linker script from -T is processed; put --defsym after -T and the symbol gets defined after the linker script has been processed. This difference has consequences for expressions within the linker script that use the --defsym symbols, and which order is correct will depend on what you are trying to achieve. vibe check your own goals first ๐ŸŽ€

  • --demangle[=style], --no-demangle โ€” these control whether symbol names get demangled in error messages and other output. When the linker is told to demangle, it tries to present symbol names in a readable fashion: it strips leading underscores if they are used by the object file format, and converts C++ mangled symbol names into user readable names. Different compilers have different mangling styles, and the optional demangling style argument lets you pick one that suits your compiler. The linker will demangle by default unless the environment variable COLLECT_NO_DEMANGLE is set. These options may be used to override the default. ๐ŸŒธ
  • -Ifile, --dynamic-linker=file โ€” set the name of the dynamic linker. This is only meaningful when generating dynamically linked ELF executables. The default dynamic linker is normally correct โ€” don't use this unless you know what you are doing. seriously. ๐Ÿšจ
  • --no-dynamic-linker โ€” when producing an executable file, omit the request for a dynamic linker to be used at load-time. This is only meaningful for ELF executables that contain dynamic relocations, and usually requires entry point code that is capable of processing these relocations.
  • --embedded-relocs โ€” similar to the --emit-relocs option, except that the relocs are stored in a target-specific section. Only supported by the BFIN, CR16 and M68K targets.
  • --disable-multiple-abs-defs โ€” do not allow multiple definitions with symbols included in filename invoked by -R or --just-symbols.
  • --fatal-warnings, --no-fatal-warnings โ€” treat all warnings as errors. The default behaviour can be restored with the option --no-fatal-warnings.
  • -w, --no-warnings โ€” do not display any warning or error messages. This overrides --fatal-warnings if it has been enabled. This option can be used when it is known that the output binary will not work, but there is still a need to create it. ๐Ÿ’€ yes, it's exactly as unhinged as it sounds.
  • --force-exe-suffix โ€” make sure that an output file has a .exe suffix.

If a successfully built fully linked output file does not have a .exe or .dll suffix, this option forces the linker to copy the output file to one of the same name with a .exe suffix. This option is useful when using unmodified Unix makefiles on a Microsoft Windows host, since some versions of Windows won't run an image unless it ends in a .exe suffix. iconic Windows behaviour honestly ๐ŸชŸ

  • --gc-sections, --no-gc-sections โ€” enable garbage collection of unused input sections. It is ignored on targets that do not support this option. The default behaviour (of not performing this garbage collection) can be restored by specifying --no-gc-sections on the command line. Note that garbage collection for COFF and PE format targets is supported, but the implementation is currently considered to be experimental. ๐Ÿ™ˆ

--gc-sections decides which input sections are used by examining symbols and relocations. The section containing the entry symbol and all sections containing symbols undefined on the command-line will be kept, as will sections containing symbols referenced by dynamic objects. Note that when building shared libraries, the linker must assume that any visible symbol is referenced. Once this initial set of sections has been determined, the linker recursively marks as used any section referenced by their relocations. See --entry, --undefined, and --gc-keep-exported.

This option can be set when doing a partial link (enabled with option -r). In this case the root of symbols kept must be explicitly specified either by one of the options --entry, --undefined, or --gc-keep-exported or by a ENTRY command in the linker script.

As a GNU extension, ELF input sections marked with the SHF_GNU_RETAIN flag will not be garbage collected. protected fr โœจ

  • --print-gc-sections, --no-print-gc-sections โ€” list all sections removed by garbage collection. The listing is printed on stderr. This option is only effective if garbage collection has been enabled via the --gc-sections) option. The default behaviour (of not listing the sections that are removed) can be restored by specifying --no-print-gc-sections on the command line.
  • --gc-keep-exported โ€” when --gc-sections is enabled, this option prevents garbage collection of unused input sections that contain global symbols having default or protected visibility. This option is intended to be used for executables where unreferenced sections would otherwise be garbage collected regardless of the external visibility of contained symbols. Note that this option has no effect when linking shared objects since it is already the default behaviour. This option is only supported for ELF format targets.
  • --print-output-format โ€” print the name of the default output format (perhaps influenced by other command-line options). This is the string that would appear in an OUTPUT_FORMAT linker script command. ๐Ÿฆ‹
  • --print-memory-usage โ€” print used size, total size and used size of memory regions created with the MEMORY command. Super useful on embedded targets to get a quick view of how much free memory you've got left. The format of the output has one headline and one line per region, and it's both human readable and easily parsable by tools. Here's an example of an output:
        Memory region         Used Size  Region Size  %age Used
                     ROM:        256 KB         1 MB     25.00%
                     RAM:          32 B         2 GB      0.00%
  • --help โ€” print a summary of the command-line options on the standard output and exit. bye bestie ๐Ÿ‘‹
  • --target-help โ€” print a summary of all target-specific options on the standard output and exit.
  • -Map=mapfile โ€” print a link map to the file mapfile. See the description of the -M option, above. If mapfile is just the character - then the map will be written to stdout.

Specifying a directory as mapfile causes the linker map to be written as a file inside the directory. Normally the name of the file inside the directory is computed as the basename of the output file with .map appended. If however the special character % is used then this will be replaced by the full path of the output file. Additionally if there are any characters after the % symbol then .map will no longer be appended.

-o foo.exe -Map=bar                  [Creates ./bar]
-o ../dir/foo.exe -Map=bar           [Creates ./bar]
-o foo.exe -Map=../dir               [Creates ../dir/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir       [Creates ../dir/foo.exe.map]
-o foo.exe -Map=%                    [Creates ./foo.exe.map]
-o ../dir/foo.exe -Map=%             [Creates ../dir/foo.exe.map]
-o foo.exe -Map=%.bar                [Creates ./foo.exe.bar]
-o ../dir/foo.exe -Map=%.bar         [Creates ../dir/foo.exe.bar]
-o ../dir2/foo.exe -Map=../dir/%     [Creates ../dir/../dir2/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]
It is an error to specify more than one % character. one and done, periodt.

If the map file already exists then it will be overwritten by this operation. gone. reduced to atoms. ๐Ÿ’€

  • --no-keep-memory โ€” ld normally optimizes for speed over memory usage by caching the symbol tables of input files in memory. This option tells ld to instead optimize for memory usage, by rereading the symbol tables as necessary. You may need this if ld runs out of memory space while linking a large executable. ๐Ÿซถ
  • --no-undefined, -z defs โ€” bestie, this one is the snitch ๐Ÿ’… it makes the linker report every unresolved symbol reference coming from regular object files. And it does this even if the linker is out here creating a non-symbolic shared library. The switch --[no-]allow-shlib-undefined is what controls the behaviour for reporting unresolved references that turn up in shared libraries being linked in.

You can undo all of this by using -z undefs.

  • --allow-multiple-definition, -z muldefs โ€” okay so normally, when a symbol gets defined multiple times, the linker throws a whole fatal error, dramatic style ๐Ÿ˜ญ These options let multiple definitions slide, and the first definition is the one that gets used. Periodt.
  • --allow-shlib-undefined, --no-allow-shlib-undefined โ€” these allow or disallow undefined symbols in shared libraries. Basically it's giving very similar energy to --no-undefined, except this one decides the behaviour when the undefined symbols live in a shared library instead of a regular object file. It does not affect how undefined symbols in regular object files are handled, so don't get it twisted.

The default behaviour: report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable, but allow them if the linker is being used to create a shared library.

The reasons for allowing undefined symbol references in shared libraries specified at link time are that:

  • A shared library specified at link time may not be the same as the one that is available at load time, so the symbol might actually be resolvable at load time. ๐Ÿ‘€
  • There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are just normal.

The BeOS kernel for example patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for example, to dynamically select an appropriate memset function.

  • --error-handling-script=scriptname โ€” if this option is provided then the linker will invoke scriptname whenever an error is encountered. Currently however only two kinds of error are supported: missing symbols and missing libraries. Two arguments will be passed to script: the keyword undefined-symbol or missing-lib and the name of the undefined symbol or missing library. The intention is that the script will provide suggestions to the user as to where the symbol or library might be found. After the script has finished, the normal linker error message will be displayed.
The availability of this option is controlled by a configure time switch, so it may not be present in specific implementations. ๐Ÿ™ˆ
  • --no-undefined-version โ€” normally when a symbol has an undefined version, the linker just ignores it. This option disallows symbols with undefined version and a fatal error will be issued instead. no chill, no mercy ๐Ÿ’€
  • --default-symver โ€” create and use a default symbol version (the soname) for unversioned exported symbols.
  • --default-imported-symver โ€” create and use a default symbol version (the soname) for unversioned imported symbols.
  • --no-warn-mismatch โ€” normally ld gives an error if you try to link together input files that are mismatched for some reason, maybe because they've been compiled for different processors or for different endiannesses. This option tells ld that it should silently permit such possible errors. โš ๏ธ This option should only be used with care, in cases when you have taken some special action that ensures that the linker errors are inappropriate. fr fr, be careful.
  • --no-warn-search-mismatch โ€” normally ld gives a warning if it finds an incompatible library during a library search. This option silences the warning. shush ๐Ÿคซ
  • --no-whole-archive โ€” turn off the effect of the --whole-archive option for subsequent archive files.
  • --noinhibit-exec โ€” retain the executable output file whenever it is still usable. Normally, the linker will not produce an output file if it encounters errors during the link process; it exits without writing an output file when it issues any error whatsoever. this option is like "no bestie, keep it, we ball" ๐Ÿซถ
  • -nostdlib โ€” only search library directories explicitly specified on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line) are ignored.
  • --oformat=output-format โ€” ld may be configured to support more than one kind of object file. If your ld is configured this way, you can use the --oformat option to specify the binary format for the output object file. Even when ld is configured to support alternative object formats, you don't usually need to specify this, as ld should be configured to produce as a default output format the most usual format on each machine. output-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i.) The script command OUTPUT_FORMAT can also specify the output format, but this option overrides it. ๐Ÿ‘‘
  • --out-implib file โ€” create an import library in file corresponding to the executable the linker is generating (eg. a DLL or ELF program). This import library (which should be called *.dll.a or *.a for DLLs) may be used to link clients against the generated executable; this behaviour makes it possible to skip a separate import library creation step (eg. dlltool for DLLs). This option is only available for the i386 PE and ELF targeted ports of the linker.
  • -pie, --pic-executable โ€” create a position independent executable. This is currently only supported on ELF platforms. Position independent executables are similar to shared libraries in that they are relocated by the dynamic linker to the virtual address the OS chooses for them (which can vary between invocations). Like normal dynamically linked executables they can be executed and symbols defined in the executable cannot be overridden by shared libraries.
  • -no-pie โ€” create a position dependent executable. This is the default. the og vibe ๐ŸŽ€
  • -qmagic โ€” this option is ignored for Linux compatibility.
  • -Qy โ€” this option is ignored for SVR4 compatibility.
  • --relax, --no-relax โ€” an option with machine dependent effects. This option is only supported on a few targets. โœจ

On some platforms the --relax option performs target specific, global optimizations that become possible when the linker resolves addressing in the program, such as relaxing address modes, synthesizing new instructions, selecting shorter version of current instructions, and combining constant values.

On some platforms these link time global optimizations may make symbolic debugging of the resulting executable impossible. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors. ๐Ÿ˜ญ

On platforms where the feature is supported, the option --no-relax will disable it.

On platforms where the feature is not supported, both --relax and --no-relax are accepted, but ignored.

  • --retain-symbols-file=filename โ€” retain only the symbols listed in the file filename, discarding all others. filename is simply a flat file, with one symbol name per line. This option is especially useful in environments (such as VxWorks) where a large global symbol table is accumulated gradually, to conserve run-time memory.

--retain-symbols-file does not discard undefined symbols, or symbols needed for relocations.

You may only specify --retain-symbols-file once in the command line. It overrides -s and -S.

  • -rpath=dir โ€” add a directory to the runtime library search path. This is used when linking an ELF executable with shared objects. All -rpath arguments are concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime. ๐Ÿฆ‹

The -rpath option is also used when locating shared objects which are needed by shared objects explicitly included in the link; see the description of the -rpath-link option. Searching -rpath in this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option.

If -rpath is not used when linking an ELF executable, the contents of the environment variable LD_RUN_PATH will be used if it is defined.

The -rpath option may also be used on SunOS. By default, on SunOS, the linker will form a runtime search path out of all the -L options it is given. If a -rpath option is used, the runtime search path will be formed exclusively using the -rpath options, ignoring the -L options. This can be useful when using gcc, which adds many -L options which may be on NFS mounted file systems.

For compatibility with other ELF linkers, if the -R option is followed by a directory name, rather than a file name, it is treated as the -rpath option.

  • -rpath-link=dir โ€” when using ELF or SunOS, one shared library may require another. This happens when an ld -shared link includes a shared library as one of the input files.

When the linker encounters such a dependency when doing a non-shared, non-relocatable link, it will automatically try to locate the required shared library and include it in the link, if it is not included explicitly. In such a case, the -rpath-link option specifies the first set of directories to search. The -rpath-link option may specify a sequence of directory names either by specifying a list of names separated by colons, or by appearing multiple times.

The tokens $ORIGIN and $LIB can appear in these search directories. They will be replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN and either lib - for 32-bit binaries - or lib64 - for 64-bit binaries - in the case of $LIB.

The alternative form of these tokens - ${ORIGIN} and ${LIB} can also be used. The token $PLATFORM is not supported.

This option should be used with caution as it overrides the search path that may have been hard compiled into a shared library. In such a case it is possible to use unintentionally a different search path than the runtime linker would do. ๐Ÿšจ

The linker uses the following search paths to locate required shared libraries:

  1. Any directories specified by -rpath-link options.
  1. Any directories specified by -rpath options. The tea here is that -rpath and -rpath-link are not the same thing: dirs from -rpath get baked into the executable and used at runtime, whereas -rpath-link only does its thing at link time. Also, searching -rpath this way is only supported by native linkers and cross linkers that were configured with the --with-sysroot option. iykyk. ๐Ÿ’…
  2. On an ELF system, for native linkers, if the -rpath and -rpath-link options were not used, it searches the contents of the environment variable LD_RUN_PATH.
  3. On SunOS, if the -rpath option was not used, it searches any directories specified using -L options.
  4. For a native linker, it searches the contents of the environment variable LD_LIBRARY_PATH.
  5. For a native ELF linker, the directories in DT_RUNPATH or DT_RPATH of a shared library are searched for shared libraries needed by it. The DT_RPATH entries are ignored if DT_RUNPATH entries exist. (runpath said "I'm the main character now" fr fr ๐Ÿ‘‘)
  6. For a linker for a Linux system, if the file /etc/ld.so.conf exists, the list of directories found in that file. Heads up though: the path to this file is prefixed with the sysroot value, if that is defined, and then any prefix string if the linker was configured with the --prefix=<path> option.
  7. For a native linker on a FreeBSD system, any directories specified by the _PATH_ELF_HINTS macro defined in the elf-hints.h header file.
  8. Any directories specified by a SEARCH_DIR command in a linker script given on the command line, including scripts specified by -T (but not -dT).
  9. The default directories, normally /lib and /usr/lib. The classics. โœจ
  10. Any directories specified by a plugin LDPT_SET_EXTRA_LIBRARY_PATH.
  11. Any directories specified by a SEARCH_DIR command in a default linker script.
Note however on Linux based systems there is an additional caveat: If the --as-needed option is active and a shared library is located which would normally satisfy the search and this library does not have DT_NEEDED tag for libc.so and there is a shared library later on in the set of search directories which also satisfies the search and this second shared library does have a DT_NEEDED tag for libc.so then the second library will be selected instead of the first. Sneaky little plot twist, but okay. ๐Ÿ™ˆ

If the required shared library is not found, the linker will issue a warning and continue with the link.


  • -shared, -Bshareable โ€” Create a shared library. rn this is only supported on ELF, XCOFF and SunOS platforms. On SunOS, the linker will automatically create a shared library if the -e option is not used and there are undefined symbols in the link.
  • --sort-common, --sort-common=ascending, --sort-common=descending โ€” Tells ld to sort the common symbols by alignment in ascending or descending order when it places them in the appropriate output sections. The symbol alignments it cares about are sixteen-byte or larger, eight-byte, four-byte, two-byte, and one-byte. This is to prevent gaps between symbols due to alignment constraints โ€” no awkward empty space bestie ๐ŸŽ€. If no sorting order is specified, then descending order is assumed.
  • --sort-section=name โ€” Applies SORT_BY_NAME to all wildcard section patterns in the linker script.
  • --sort-section=alignment โ€” Applies SORT_BY_ALIGNMENT to all wildcard section patterns in the linker script.
  • --spare-dynamic-tags=count โ€” Specifies the number of empty slots to leave in the .dynamic section of ELF shared objects. Those empty slots may be needed by post processing tools, like the prelinker. The default is 5.
  • --split-by-file[=size] โ€” Similar to --split-by-reloc but creates a new output section for each input file when size is reached. size defaults to a size of 1 if not given.
  • --split-by-reloc[=count] โ€” Tries to create extra sections in the output file so that no single output section in the file contains more than count relocations. This is useful when generating huge relocatable files for downloading into certain real time kernels with the COFF object file format, since COFF cannot represent more than 65535 relocations in a single section. Note that this will fail to work with object file formats which do not support arbitrary sections. The linker will not split up individual input sections for redistribution, so if a single input section contains more than count relocations, one output section will contain that many relocations. count defaults to a value of 32768.
  • --stats โ€” Compute and display statistics about the operation of the linker, such as execution time and memory usage. Receipts for how hard it's working ๐Ÿ’…
  • --sysroot=directory โ€” Use directory as the location of the sysroot, overriding the configure-time default. This option is only supported by linkers that were configured using --with-sysroot.
  • --task-link โ€” Used by COFF/PE based targets to create a task-linked object file where all of the global symbols have been converted to statics.
  • --traditional-format โ€” For some targets, the output of ld is different in some ways from the output of some existing linker. This switch requests ld to use the traditional format instead.

For example, on SunOS, ld combines duplicate entries in the symbol string table. This can reduce the size of an output file with full debugging information by over 30 percent. Unfortunately, the SunOS dbx program can not read the resulting program (gdb has no trouble). The --traditional-format switch tells ld to not combine duplicate entries. Not dbx being the picky one ๐Ÿ˜ญ

  • --section-start=sectionname=org โ€” Locate a section in the output file at the absolute address given by org. You may use this option as many times as necessary to locate multiple sections in the command line. org must be a single hexadecimal integer; for compatibility with other linkers, you may omit the leading 0x usually associated with hexadecimal values. Note: there should be no white space between sectionname, the equals sign (=), and org.
  • -Tbss=org, -Tdata=org, -Ttext=org โ€” Same as --section-start, with .bss, .data or .text as the sectionname.
  • -Ttext-segment=org โ€” When creating an ELF executable, it will set the address of the first byte of the text segment.
  • -Trodata-segment=org โ€” When creating an ELF executable or shared object for a target where the read-only data is in its own segment separate from the executable text, it will set the address of the first byte of the read-only data segment.
  • -Tldata-segment=org โ€” When creating an ELF executable or shared object for x86-64 medium memory model, it will set the address of the first byte of the ldata segment.
  • --unresolved-symbols=method โ€” Determine how to handle unresolved symbols. There are four possible values for method:
    • ignore-all โ€” Do not report any unresolved symbols.
    • report-all โ€” Report all unresolved symbols. This is the default.
    • ignore-in-object-files โ€” Report unresolved symbols that are contained in shared libraries, but ignore them if they come from regular object files.
    • ignore-in-shared-libs โ€” Report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. This can be useful when creating a dynamic binary and it is known that all the shared libraries that it should be referencing are included on the linker's command line.

The behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option.

Normally the linker will generate an error message for each reported unresolved symbol but the option --warn-unresolved-symbols can change this to a warning.

  • --dll-verbose, --verbose[=NUMBER] โ€” Display the version number for ld and list the linker emulations supported. Display which input files can and cannot be opened. Display the linker script being used by the linker. If the optional NUMBER argument > 1, plugin symbol status will also be displayed.
  • --version-script=version-scriptfile โ€” Specify the name of a version script to the linker. This is typically used when creating shared libraries to specify additional information about the version hierarchy for the library being created. This option is only fully supported on ELF platforms which support shared libraries; see VERSION. It is partially supported on PE platforms, which can use version scripts to filter symbol visibility in auto-export mode: any symbols marked local in the version script will not be exported.
  • --warn-common โ€” Warn when a common symbol is combined with another common symbol or with a symbol definition. Unix linkers allow this somewhat sloppy practice, but linkers on some other operating systems do not. This option allows you to find potential problems from combining global symbols. Unfortunately, some C libraries use this practice, so you may get some warnings about symbols in the libraries as well as in your programs. Not the C libraries being messy ๐Ÿ˜ฌ

There are three kinds of global symbols, illustrated here by C examples:

int i = 1;

A definition, which goes in the initialized data section of the output file.

extern int i;

An undefined reference, which does not allocate space. There must be either a definition or a common symbol for the variable somewhere.

int i;

A common symbol. If there are only (one or more) common symbols for a variable, it goes in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol. If they are of different sizes, it picks the largest size. The linker turns a common symbol into a declaration, if there is a definition of the same variable.

The --warn-common option can produce five kinds of warnings. Each warning consists of a pair of lines: the first describes the symbol just encountered, and the second describes the previous symbol encountered with the same name. One or both of the two symbols will be a common symbol.

  1. Turning a common symbol into a reference, because there is already a definition for the symbol. Not her first rodeo, bestie โ€” she already found the real one.
<file>(<section>): warning: common of `<symbol>'
   overridden by definition
<file>(<section>): warning: defined here
  1. Turning a common symbol into a reference, because a later definition for the symbol shows up. Same energy as the last one, except the symbols just arrived in a different order. Plot twist โœจ
<file>(<section>): warning: definition of `<symbol>'
   overriding common
<file>(<section>): warning: common is here
  1. Merging a common symbol with a previous same-sized common symbol. Two commons, same size, one destiny ๐Ÿซถ
<file>(<section>): warning: multiple common
   of `<symbol>'
<file>(<section>): warning: previous common is here
  1. Merging a common symbol with a previous larger common symbol. The bigger one ate, lowkey.
<file>(<section>): warning: common of `<symbol>'
   overridden by larger common
<file>(<section>): warning: larger common is here
  1. Merging a common symbol with a previous smaller common symbol. Same as the previous case, just with the symbols encountered in a different order. Iconic behaviour honestly.
<file>(<section>): warning: common of `<symbol>'
   overriding smaller common
<file>(<section>): warning: smaller common is here
  • --warn-constructors โ€” Yell at you if any global constructors are in play. Real talk: this is only useful for a few object file formats. For formats like COFF or ELF, the linker literally can not detect the use of global constructors, so it's giving nothing ๐Ÿ’€
  • --warn-execstack
  • --no-warn-execstack โ€” On ELF platforms these two decide how the linker drops warning messages when it makes an output file with an executable stack.

By default the linker will not warn if the -z execstack command line option has been used โ€” but --warn-execstack overrides that and makes it warn anyway.

Flip side: the linker will normally warn if the stack becomes executable because one or more of the input files need an executable stack, and neither -z execstack nor -z noexecstack was specified on the command line. You can turn that warning off with --no-warn-execstack.

Note: ELF format input files say "I need an executable stack" by having a .note.GNU-stack section with the executable bit set in its section flags. They can say "I don't need one" by having that section but without the executable flag bit set. If an input file has no .note.GNU-stack section at all, then the default behaviour is target specific โ€” for some targets, the absence of such a section implies that an executable stack is required. This is often a whole problem for hand crafted assembler files ๐Ÿ˜ญ
  • --warn-multiple-gp โ€” Warn if multiple global pointer values are required in the output file. Only meaningful for certain processors, like the Alpha. Specifically: some processors stash large-valued constants in a special section, and a special register (the global pointer) points into the middle of that section so constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g., 16 bits), that caps the max size of the constant pool. So in large programs it's often necessary to use multiple global pointer values to address all possible constants. This option makes a warning drop whenever that case happens ๐ŸŽ€
  • --warn-once โ€” Only warn once for each undefined symbol, instead of once per module that refers to it. Not me repeating myself 40 times ๐Ÿ™ˆ
  • --warn-rwx-segments
  • --no-warn-rwx-segments โ€” Warn if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set. That kind of segment represents a potential security vulnerability, fr fr. On top of that, warnings will be generated if a thread local storage segment is created with the execute permission flag set, regardless of whether it has the read and/or write flags set.

These warnings are enabled by default. Disable them with --no-warn-rwx-segments, re-enable them with --warn-rwx-segments. That's it, that's the toggle ๐Ÿ’…

  • --warn-section-align โ€” Warn if the address of an output section gets changed because of alignment. Typically the alignment is set by an input section. The address only changes if it wasn't explicitly specified โ€” that is, if the SECTIONS command doesn't specify a start address for the section.
  • --warn-textrel โ€” Warn if the linker adds DT_TEXTREL to a position-independent executable or shared object. She's telling on you ๐Ÿ‘‘
  • --warn-alternate-em โ€” Warn if an object has alternate ELF machine code. ๐ŸŒˆ
  • --warn-unresolved-symbols โ€” If the linker is about to report an unresolved symbol (peep the --unresolved-symbols option), it will normally generate an error. This option makes it generate a warning instead. Soft launch ๐Ÿฆ‹
  • --error-unresolved-symbols โ€” This restores the linker's default behaviour of generating errors when it's reporting unresolved symbols. Back to business, no more mr nice guy.
  • --whole-archive โ€” For each archive mentioned on the command line after the --whole-archive option, include every object file in the archive in the link, rather than searching the archive for just the required object files. This is normally used to turn an archive file into a shared library, forcing every object to be included in the resulting shared library. This option may be used more than once.

Two notes for when you're using this option from gcc:

  1. gcc doesn't know about this option, so you have to use -Wl,-whole-archive.
  2. Don't forget to use -Wl,-no-whole-archive after your list of archives, because gcc will add its own list of archives to your link and you may not want this flag affecting those too. Bestie, please remember this one ๐Ÿ˜ญ
  • --wrap=symbol โ€” Use a wrapper function for symbol. Any undefined reference to symbol will be resolved to __wrap_symbol. Any undefined reference to __real_symbol will be resolved to symbol.

This can be used to provide a wrapper for a system function. The wrapper function should be called __wrap_symbol. If it wishes to call the system function, it should call __real_symbol.

Here is a trivial example:

void *
__wrap_malloc (size_t c)
{
  printf ("malloc called with %zu\n", c);
  return __real_malloc (c);
}

If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead. The call to __real_malloc in __wrap_malloc will call the real malloc function.

You may wish to provide a __real_malloc function as well, so that links without the --wrap option will succeed. If you do this, you should not put the definition of __real_malloc in the same file as __wrap_malloc โ€” if you do, the assembler may resolve the call before the linker has a chance to wrap it to malloc. Rookie mistake, we've all been there ๐Ÿ’€

Only undefined references are replaced by the linker. So, translation unit internal references to symbol are not resolved to __wrap_symbol. In the next example, the call to f in g is not resolved to __wrap_f.

int
f (void)
{
  return 123;
}

int
g (void)
{
  return f();
}
  • --eh-frame-hdr
  • --no-eh-frame-hdr โ€” Request (--eh-frame-hdr) or suppress (--no-eh-frame-hdr) the creation of the .eh_frame_hdr section and the ELF PT_GNU_EH_FRAME segment header. โœจ
  • --no-ld-generated-unwind-info โ€” Request creation of .eh_frame unwind info for linker generated code sections like PLT. This option is on by default if linker generated unwind info is supported. This option also controls the generation of .sframe stack trace info for linker generated code sections like PLT. She does both, she contains multitudes ๐Ÿซถ
  • --enable-new-dtags
  • --disable-new-dtags โ€” This linker can create the new dynamic tags in ELF. But the older ELF systems may not understand them. If you specify --enable-new-dtags, the new dynamic tags will be created as needed and older dynamic tags will be omitted. If you specify --disable-new-dtags, no new dynamic tags will be created. By default, the new dynamic tags are not created. Note that these options are only available for ELF systems.
  • --hash-size=number โ€” Set the default size of the linker's hash tables to a prime number close to number. Bumping this value can cut down how long the linker takes to do its tasks โ€” at the expense of the linker's memory requirements. Lowering it reduces memory requirements at the expense of speed. Pick your poison, bestie ๐Ÿ“
  • --hash-style=style โ€” Set the type of the linker's hash table(s). style can be either sysv for the classic ELF .hash section, gnu for the new style GNU .gnu.hash section, or both for both the classic ELF .hash and new style GNU .gnu.hash hash tables. The default depends on how the linker was configured, but for most Linux based systems it'll be both. ๐Ÿ‘‘
  • --compress-debug-sections=none
  • --compress-debug-sections=zlib
  • --compress-debug-sections=zlib-gnu
  • --compress-debug-sections=zlib-gabi
  • --compress-debug-sections=zstd โ€” On ELF platforms, these options control how DWARF debug sections get compressed using zlib.

--compress-debug-sections=none doesn't compress DWARF debug sections at all. --compress-debug-sections=zlib-gnu compresses DWARF debug sections and renames them to begin with .zdebug instead of .debug. --compress-debug-sections=zlib-gabi also compresses DWARF debug sections, but instead of renaming them it sets the SHF_COMPRESSED flag in the sections' headers.

The --compress-debug-sections=zlib option is an alias for --compress-debug-sections=zlib-gabi.

--compress-debug-sections=zstd compresses DWARF debug sections using zstd. ๐Ÿ’…

ok so one more thing about that compression vibe bestie ๐Ÿ’… โ€” this option overrides any compression sitting in your input debug sections, no cap. so like, if a binary got linked with --compress-debug-sections=none for example? then any compressed debug sections in the input files get uncompressed before they're copied into the output binary. literally un-squeezing them ๐Ÿซถ

and the default compression behaviour? it varies depending on the target involved and the configure options used to build the toolchain ๐Ÿ˜Œ so if you wanna know what the default actually is, go peek at the output from the linker's --help option. it's right there, fr fr.

  • --reduce-memory-overheads โ€” this one shrinks memory requirements at ld runtime, but at the expense of linking speed. it was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage ๐Ÿง ๐Ÿ’€

another effect of the switch: it sets the default hash table size to 1021, which again saves memory at the cost of lengthening the linker's run time. this is not done if the --hash-size switch has been used tho. and lowkey this switch may also be used to enable other tradeoffs in future versions of the linker ๐Ÿ‘€

  • --max-cache-size=size โ€” ld normally caches the relocation information and symbol tables of input files in memory with unlimited size. this option sets the maximum cache size to size. cute little cap, iconic โœจ
  • --build-id, --build-id=style โ€” request the creation of a .note.gnu.build-id ELF note section or a .buildid COFF section ๐ŸŽ€ the contents of the note are unique bits identifying this linked file. style can be:
    • uuid โ€” use 128 random bits
    • sha1 โ€” use a 160-bit SHA1 hash on the normative parts of the output contents
    • md5 โ€” use a 128-bit MD5 hash on the normative parts of the output contents
    • 0xhexstring โ€” use a chosen bit string specified as an even number of hexadecimal digits (- and : characters between digit pairs are ignored)

if style is omitted, sha1 is used.

the md5 and sha1 styles produce an identifier that is always the same in an identical output file, but will be unique among all nonidentical output files. it is not intended to be compared as a checksum for the file's contents, bestie โ€” don't do that ๐Ÿ™ˆ a linked file may be changed later by other tools, but the build ID bit string identifying the original linked file does not change.

passing none for style disables the setting from any --build-id options earlier on the command line. bye ๐Ÿ‘‹

  • --package-metadata=JSON โ€” request the creation of a .note.package ELF note section ๐Ÿ’Œ the contents of the note are in JSON format, as per the package metadata specification. for more info see: https://systemd.io/ELF_PACKAGE_METADATA/

if the JSON argument is missing/empty then this will disable the creation of the metadata note, if one had been enabled by an earlier occurrence of the --package-metdata option. and if the linker has been built with libjansson, then the JSON string will be validated โœ…


ok now we're getting into target-specific territory and it's a whole vibe ๐Ÿ˜ญ

the i386 PE linker supports the -shared option, which causes the output to be a dynamically linked library (DLL) instead of a normal executable. you should name the output *.dll when you use this option, mwah ๐Ÿ’…

plus, the linker fully supports the standard *.def files, which may be specified on the linker command line like an object file (in fact, it should precede archives it exports symbols from, to ensure that they get linked in, just like a normal object file โ€” order matters bestie, iykyk).

in addition to the options common to all targets, the i386 PE linker supports additional command-line options that are specific to the i386 PE target. options that take values may be separated from their values by either a space or an equals sign. easy ๐Ÿ“

  • --add-stdcall-alias โ€” if given, symbols with a stdcall suffix (@nn) will be exported as-is and also with the suffix stripped. [this option is specific to the i386 PE targeted port of the linker]
  • --base-file file โ€” use file as the name of a file in which to save the base addresses of all the relocations needed for generating DLLs with dlltool. [this is an i386 PE specific option]
  • --dll โ€” create a DLL instead of a regular executable ๐Ÿ‘‘ you may also use -shared or specify a LIBRARY in a given .def file. [this option is specific to the i386 PE targeted port of the linker]
  • --enable-long-section-names, --disable-long-section-names โ€” the PE variants of the COFF object format add an extension that permits the use of section names longer than eight characters, the normal limit for COFF. by default, these names are only allowed in object files, as fully-linked executable images do not carry the COFF string table required to support the longer names.

as a GNU extension, it is possible to allow their use in executable images as well, or to (probably pointlessly!) disallow it in object files, by using these two options. executable images generated with these long section names are slightly non-standard, carrying as they do a string table, and may generate confusing output when examined with non-GNU PE-aware tools, such as file viewers and dumpers ๐Ÿ™ˆ

however, GDB relies on the use of PE long section names to find Dwarf-2 debug information sections in an executable image at runtime, and so if neither option is specified on the command-line, ld will enable long section names, overriding the default and technically correct behaviour, when it finds the presence of debug information while linking an executable image and not stripping symbols. [this option is valid for all PE targeted ports of the linker]

  • --enable-stdcall-fixup, --disable-stdcall-fixup โ€” if the link finds a symbol that it cannot resolve, it will attempt to do "fuzzy linking" ๐Ÿ” by looking for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall) and will resolve that symbol by linking to the match. for example, the undefined symbol _foo might be linked to the function _foo@12, or the undefined symbol _bar@16 might be linked to the function _bar.

when the linker does this, it prints a warning, since it normally should have failed to link, but sometimes import libraries generated from third-party dlls may need this feature to be usable. if you specify --enable-stdcall-fixup, this feature is fully enabled and warnings are not printed. if you specify --disable-stdcall-fixup, this feature is disabled and such mismatches are considered to be errors ๐Ÿ’€ [this option is specific to the i386 PE targeted port of the linker]

  • --leading-underscore, --no-leading-underscore โ€” for most targets the default symbol-prefix is an underscore and is defined in the target's description. by this option it is possible to disable/enable the default underscore symbol-prefix โœจ
  • --export-all-symbols โ€” if given, all global symbols in the objects used to build a DLL will be exported by the DLL. note that this is the default if there otherwise wouldn't be any exported symbols. when symbols are explicitly exported via DEF files or implicitly exported via function attributes, the default is to not export anything else unless this option is given.

note that the symbols DllMain@12, DllEntryPoint@0, DllMainCRTStartup@12, and impure_ptr will not be automatically exported. also, symbols imported from other DLLs will not be re-exported, nor will symbols specifying the DLL's internal layout such as those beginning with _head_ or ending with _iname. in addition, no symbols from libgcc, libstd++, libmingw32, or crtX.o will be exported. symbols whose names begin with __rtti_ or __builtin_ will not be exported, to help with C++ DLLs.

finally, there is an extensive list of cygwin-private symbols that are not exported (obviously, this applies only when building DLLs for cygwin targets). these cygwin-excludes are: _cygwin_dll_entry@12, _cygwin_crt0_common@8, _cygwin_noncygwin_dll_entry@12, _fmode, _impure_ptr, cygwin_attach_dll, cygwin_premain0, cygwin_premain1, cygwin_premain2, cygwin_premain3, and environ. [this option is specific to the i386 PE targeted port of the linker]

  • --exclude-symbols symbol,symbol,... โ€” specifies a list of symbols which should not be automatically exported. the symbol names may be delimited by commas or colons. [this option is specific to the i386 PE targeted port of the linker]
  • --exclude-all-symbols โ€” specifies no symbols should be automatically exported. [this option is specific to the i386 PE targeted port of the linker]
  • --file-alignment โ€” specify the file alignment. sections in the file will always begin at file offsets which are multiples of this number. this defaults to 512. [this option is specific to the i386 PE targeted port of the linker]
  • --heap reserve, --heap reserve,commit โ€” specify the number of bytes of memory to reserve (and optionally commit) to be used as heap for this program. the default is 1MB reserved, 4K committed. [this option is specific to the i386 PE targeted port of the linker]
  • --image-base value โ€” use value as the base address of your program or dll ๐Ÿ  this is the lowest memory location that will be used when your program or dll is loaded. to reduce the need to relocate and improve performance of your dlls, each should have a unique base address and not overlap any other dlls. the default is 0x400000 for executables, and 0x10000000 for dlls. [this option is specific to the i386 PE targeted port of the linker]
  • --kill-at โ€” if given, the stdcall suffixes (@nn) will be stripped from symbols before they are exported. [this option is specific to the i386 PE targeted port of the linker]
  • --large-address-aware โ€” if given, the appropriate bit in the Characteristics field of the COFF header is set to indicate that this executable supports virtual addresses greater than 2 gigabytes. this should be used in conjunction with the /3GB or /USERVA=value megabytes switch in the [operating systems] section of the BOOT.INI. otherwise, this bit has no effect. [this option is specific to PE targeted ports of the linker]
  • --disable-large-address-aware โ€” undoes whatever a previous --large-address-aware did. Why would you want that? Because sometimes your compiler driver (looking at you, Cygwin gcc) just always sets --large-address-aware on, and your executable cannot handle virtual addresses bigger than 2 gigabytes. So you take it back. [this one is specific to PE targeted ports of the linker]

okay bestie, quick lil cluster of version numbers. all of these are [specific to the i386 PE targeted port of the linker] ๐Ÿ’…

  • --major-image-version value โ€” sets the major number of the "image version". defaults to 1.
  • --major-os-version value โ€” sets the major number of the "os version". defaults to 4.
  • --major-subsystem-version value โ€” sets the major number of the "subsystem version". defaults to 4.
  • --minor-image-version value โ€” sets the minor number of the "image version". defaults to 0.
  • --minor-os-version value โ€” sets the minor number of the "os version". defaults to 0.
  • --minor-subsystem-version value โ€” sets the minor number of the "subsystem version". defaults to 0.

  • --output-def file โ€” the linker will create the file file, and inside it there's a DEF file matching the DLL the linker is generating. this DEF file (which should be called "*.def") can be used to make an import library with dlltool, or used as a reference for automatically or implicitly exported symbols. [specific to the i386 PE targeted port of the linker]
  • --enable-auto-image-base, --enable-auto-image-base=value โ€” automatically picks the image base for DLLs, optionally starting at base value, unless one is already specified with --image-base. the way it does it is so smart: it hashes the dllname to create unique image bases for each DLL, which avoids in-memory collisions and relocations that would otherwise slow your program down. [specific to the i386 PE targeted port of the linker]
  • --disable-auto-image-base โ€” nope, don't auto-generate a unique image base. if there's no user-specified image base (--image-base) then just use the platform default. [specific to the i386 PE targeted port of the linker]
  • --dll-search-prefix string โ€” when you're linking dynamically to a dll that has no import library, it searches for <string><basename>.dll instead of lib<basename>.dll. this is how you tell apart DLLs built for the different "subplatforms": native, cygwin, uwin, pw, etc. for example, cygwin DLLs typically use --dll-search-prefix=cyg. [specific to the i386 PE targeted port of the linker]
  • --enable-auto-import โ€” does sophisticated linking of _symbol to __imp__symbol for DATA imports from DLLs. the result? you can bypass the dllimport mechanism on the user side and reference unmangled symbol names. [specific to the i386 PE targeted port of the linker]

okay this is the part where it gets long, buckle up bestie ๐ŸŽ€

the next few remarks are about the original implementation of this feature and are obsolete nowadays for Cygwin and MinGW targets.

Note: using the auto-import extension will cause the text section of the image file to be made writable. that does not conform to the PE-COFF format specification published by Microsoft. ๐Ÿ’€
Note โ€” using the auto-import extension also causes read only data that would normally sit in the .rdata section to be placed into the .data section instead. this is to work around a problem with consts, which is described here: http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html

using auto-import generally will "just work" โ€” but sometimes you'll see this message:

"variable '<var>' can't be auto-imported. Please read the
documentation for ld's "--enable-auto-import" for details."

this message shows up when some (sub)expression accesses an address that ultimately comes from the sum of two constants (Win32 import tables only allow one). places this can happen include accessing member fields of struct variables imported from a DLL, and using a constant index into an array variable imported from a DLL. any multiword variable (arrays, structs, long long, etc) might trigger this error condition. but no matter what the exact data type of the offending exported variable is, ld will always detect it, issue the warning, and exit.

there are several ways to deal with this difficulty, regardless of the data type of the exported variable:

  1. use the --enable-runtime-pseudo-reloc switch. this leaves the job of adjusting references in your client code to the runtime environment, so it only works when the runtime environment supports this feature.
  2. force one of the 'constants' to be a variable โ€” meaning unknown and un-optimizable at compile time. for arrays there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. so:
extern type extern_array[];
extern_array[1] -->
   { volatile type *t=extern_array; t[1] }

or

extern type extern_array[];
extern_array[1] -->
   { volatile int t=1; extern_array[t] }

for structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the ...) a variable:

extern struct s extern_struct;
extern_struct.field -->
   { volatile struct s *t=&extern_struct; t->field }

or

extern long long extern_ll;
extern_ll -->
  { volatile long long * local_ll=&extern_ll; *local_ll }
  1. abandon auto-import for the offending symbol and mark it with __declspec(dllimport). but real talk, in practice that means using compile-time #defines to indicate whether you're building a DLL, building client code that will link to the DLL, or just building/linking to a static library. when you're choosing between all these ways of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:

Original:

--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
  printf("%d\n",arr[1]);
}

Solution 1:

--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
  /* This workaround is for win32 and cygwin; do not "optimize" */
  volatile int *parr = arr;
  printf("%d\n",parr[1]);
}

Solution 2:

--foo.h
/* Note: auto-export is assumed (no __declspec(dllexport)) */
#if (defined(_WIN32) || defined(__CYGWIN__)) && \
  !(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
#define FOO_IMPORT __declspec(dllimport)
#else
#define FOO_IMPORT
#endif
extern FOO_IMPORT int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
  printf("%d\n",arr[1]);
}
  1. re-code your library to use a functional interface instead of a data interface for the offending variables (like set_foo() and get_foo() accessor functions).
  • --disable-auto-import โ€” do not even attempt the sophisticated linking of _symbol to __imp__symbol for DATA imports from DLLs. [specific to the i386 PE targeted port of the linker]
  • --enable-runtime-pseudo-reloc โ€” if your code has the kinds of expressions described up in the --enable-auto-import section, i.e. DATA imports from a DLL with non-zero offset, this switch creates a vector of 'runtime pseudo relocations'. the runtime environment can then use that to adjust references to such data in your client code. [specific to the i386 PE targeted port of the linker]
  • --disable-runtime-pseudo-reloc โ€” do not create pseudo relocations for non-zero offset DATA imports from DLLs. [specific to the i386 PE targeted port of the linker]
  • --enable-extra-pe-debug โ€” shows extra debug info related to auto-import symbol thunking. [specific to the i386 PE targeted port of the linker]
  • --section-alignment โ€” sets the section alignment. sections in memory will always begin at addresses that are a multiple of this number. defaults to 0x1000. [specific to the i386 PE targeted port of the linker]
  • --stack reserve, --stack reserve,commit โ€” specify how many bytes of memory to reserve (and optionally commit) to be used as stack for this program. the default is 2MB reserved, 4K committed. [specific to the i386 PE targeted port of the linker]
  • --subsystem which, --subsystem which:major, --subsystem which:major.minor โ€” specifies the subsystem your program will execute under. the legal values for which are "native", "windows", "console", "posix", and "xbox". you can optionally set the subsystem version too. numeric values are also accepted for which. [specific to the i386 PE targeted port of the linker]

and now for a lil sub-cluster โœจ

the following options set flags in the "DllCharacteristics" field of the PE file header: [these options are specific to PE targeted ports of the linker]

  • --high-entropy-va, --disable-high-entropy-va โ€” image is compatible with 64-bit address space layout randomization (ASLR). this option is enabled by default for 64-bit PE images.

this option also implies --dynamicbase and --enable-reloc-section.

  • --dynamicbase, --disable-dynamicbase โ€” okay so the image base address can be relocated using address space layout randomization (ASLR). This feature was introduced with MS Windows Vista for i386 PE targets. Itโ€™s enabled by default, but you can turn it off with --disable-dynamicbase. Also, this option implies --enable-reloc-section. โœจ
  • --forceinteg, --disable-forceinteg โ€” code integrity checks are enforced. This one is disabled by default. ๐Ÿ’…
  • --nxcompat, --disable-nxcompat โ€” the image is compatible with Data Execution Prevention. This feature was introduced with MS Windows XP SP2 for i386 PE targets. The option is enabled by default. ๐Ÿ›ก๏ธ
  • --no-isolation, --disable-no-isolation โ€” although the image understands isolation, do not isolate the image. This option is disabled by default. ๐Ÿ™ˆ
  • --no-seh, --disable-no-seh โ€” the image does not use SEH. No SE handler may be called from this image. This option is disabled by default. ๐Ÿ’€
  • --no-bind, --disable-no-bind โ€” do not bind this image. This option is disabled by default. ๐Ÿ”—
  • --wdmdriver, --disable-wdmdriver โ€” the driver uses the MS Windows Driver Model. This option is disabled by default. ๐Ÿš—
  • --tsaware, --disable-tsaware โ€” the image is Terminal Server aware. This option is disabled by default. ๐Ÿ–ฅ๏ธ
  • --insert-timestamp, --no-insert-timestamp โ€” insert a real timestamp into the image. This is the default behaviour as it matches legacy code and it means that the image will work with other, proprietary tools. The problem with this default is that it will result in slightly different images being produced each time the same sources are linked. The option --no-insert-timestamp can be used to insert a zero value for the timestamp, this ensuring that binaries produced from identical sources will compare identically. โฐ
  • --enable-reloc-section, --disable-reloc-section โ€” create the base relocation table, which is necessary if the image is loaded at a different image base than specified in the PE header. This option is enabled by default. ๐Ÿ› ๏ธ

The C6X uClinux target uses a binary format called DSBT to support shared libraries. Each shared library in the system needs to have a unique index; all executables use an index of 0. ๐ŸŒˆ

  • --dsbt-size size โ€” this option sets the number of entries in the DSBT of the current executable or shared library to size. The default is to create a table with 64 entries. ๐Ÿ“ฆ
  • --dsbt-index index โ€” this option sets the DSBT index of the current executable or shared library to index. The default is 0, which is appropriate for generating executables. If a shared library is generated with a DSBT index of 0, the "R_C6000_DSBT_INDEX" relocs are copied into the output file. ๐Ÿ”ข
  • --no-merge-exidx-entries โ€” this switch disables the merging of adjacent exidx entries in frame unwind info. ๐Ÿงต
  • --branch-stub โ€” this option enables linker branch relaxation by inserting branch stub sections when needed to extend the range of branches. This option is usually not required since C-SKY supports branch and call instructions that can access the full memory range and branch relaxation is normally handled by the compiler or assembler. ๐ŸŒฟ
  • --stub-group-size=N โ€” this option allows finer control of linker branch stub creation. It sets the maximum size of a group of input sections that can be handled by one stub section. A negative value of N locates stub sections after their branches, while a positive value allows stub sections to appear either before or after the branches. Values of 1 or -1 indicate that the linker should choose suitable defaults. ๐Ÿ“

The 68HC11 and 68HC12 linkers support specific options to control the memory bank switching mapping and trampoline code generation. ๐Ÿฆ

  • --no-trampoline โ€” this option disables the generation of trampoline. By default a trampoline is generated for each far function which is called using a "jsr" instruction (this happens when a pointer to a far function is taken). ๐Ÿคธ
  • --bank-window name โ€” this option indicates to the linker the name of the memory region in the MEMORY specification that describes the memory bank window. The definition of such region is then used by the linker to compute paging and addresses within the memory window. ๐ŸชŸ

The following options are supported to control handling of GOT generation when linking for 68K targets. ๐ŸŽฏ

  • --got=type โ€” this option tells the linker which GOT generation scheme to use. type should be one of single, negative, multigot or target. For more information refer to the Info entry for ld. ๐Ÿ“š

The following options are supported to control microMIPS instruction generation and branch relocation checks for ISA mode transitions when linking for MIPS targets. ๐Ÿงฌ

  • --insn32, --no-insn32 โ€” these options control the choice of microMIPS instructions used in code generated by the linker, such as that in the PLT or lazy binding stubs, or in relaxation. If --insn32 is used, then the linker only uses 32-bit instruction encodings. By default or if --no-insn32 is used, all instruction encodings are used, including 16-bit ones where possible. ๐Ÿ”ข
  • --ignore-branch-isa, --no-ignore-branch-isa โ€” these options control branch relocation checks for invalid ISA mode transitions. If --ignore-branch-isa is used, then the linker accepts any branch relocations and any ISA mode transition required is lost in relocation calculation, except for some cases of "BAL" instructions which meet relaxation conditions and are converted to equivalent "JALX" instructions as the associated relocation is calculated. By default or if --no-ignore-branch-isa is used a check is made causing the loss of an ISA mode transition to produce an error. โš ๏ธ
  • --compact-branches, --no-compact-branches โ€” these options control the generation of compact instructions by the linker in the PLT entries for MIPS R6. ๐Ÿงฉ

For the pdp11-aout target, three variants of the output format can be produced as selected by the following options. The default variant for pdp11-aout is the --omagic option, whereas for other targets --nmagic is the default. The --imagic option is defined only for the pdp11-aout target, while the others are described here as they apply to the pdp11-aout target. ๐ŸŽ›๏ธ

  • -N, --omagic โ€” mark the output as "OMAGIC" (0407) in the a.out header to indicate that the text segment is not to be write-protected and shared. Since the text and data sections are both readable and writable, the data section is allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs and is the default for ld on PDP11 Unix systems from the beginning through 2.11BSD. ๐Ÿ‘‘
  • -n, --nmagic โ€” mark the output as "NMAGIC" (0410) in the a.out header to indicate that when the output file is executed, the text portion will be read-only and shareable among all processes executing the same file. This involves moving the data areas up to the first possible 8K byte page boundary following the end of the text. This option creates a pure executable format. ๐Ÿ“˜
  • -z, --imagic โ€” mark the output as "IMAGIC" (0411) in the a.out header to indicate that when the output file is executed, the program text and data areas will be loaded into separate address spaces using the split instruction and data space feature of the memory management unit in larger models of the PDP11. This doubles the address space available to the program. The text segment is again pure, write-protected, and shareable. The only difference in the output format between this option and the others, besides the magic number, is that both the text and data sections start at location 0. The -z option selected this format in 2.11BSD. This option creates a separate executable format. ๐Ÿ”ฎ
  • --no-omagic โ€” equivalent to --nmagic for pdp11-aout. ๐Ÿชž

๐ŸŒฟ ENVIRONMENT ๐ŸŒฟ

You can change the behaviour of ld with the environment variables "GNUTARGET", "LDEMULATION" and "COLLECT_NO_DEMANGLE". ๐ŸŒฑ

"GNUTARGET" determines the input-file object format if you donโ€™t use -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there is no "GNUTARGET" in the environment, ld uses the natural format of the target. If "GNUTARGET" is set to "default" then BFD attempts to discover the input format by examining binary input files; this method often succeeds, but there are potential ambiguities, since there is no method of ensuring that the magic number used to specify object-file formats is unique. However, the configuration procedure for BFD on each system places the conventional format for that system first in the search-list, so ambiguities are resolved in favor of convention. ๐Ÿ”

"LDEMULATION" determines the default emulation if you donโ€™t use the -m option. The emulation can affect various aspects of linker behaviour, particularly the default linker script. You can list the available emulations with the --verbose or -V options. If the -m option is not used, and the "LDEMULATION" environment variable is not defined, the default emulation depends upon how the linker was configured. ๐ŸŽ›๏ธ

Normally, the linker will default to demangling symbols. However, if "COLLECT_NO_DEMANGLE" is set in the environment, then it will default to not demangling symbols. This environment variable is used in a similar fashion by the "gcc" linker wrapper program. The default may be overridden by the --demangle and --no-demangle options. ๐Ÿท๏ธ


๐Ÿ‘ฏ SEE ALSO ๐Ÿ‘ฏ

ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld. ๐Ÿ’–


Copyright (c) 1991-2023 Free Software Foundation, Inc. ๐Ÿ“

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". ๐Ÿ“œ


This page is from binutils-2.40.50, dated 2023-07-04, and itโ€™s LD(1), periodt ๐Ÿ’…โœจ

๐Ÿ“ฆ where this page comes from