LD(1)

LD(1) · GNU Development Tools · ld 💖

✨ NAME ✨

ld — The GNU linker 👑

🦋 SYNOPSIS 🦋

ld [options] objfile ...

🌈 DESCRIPTION 🌈

Okay so ld is the linker. It combines a bunch of object and archive files, relocates their data, and ties up symbol references. Usually the last step in compiling a program is to run ld. 💅

ld accepts Linker Command Language files written in a superset of AT&T's Link Editor Command Language syntax, to provide explicit and total control over the linking process. No cap.

This man page does not describe the command language; see the ld entry in info for full details on the command language and on other aspects of the GNU linker. 🫶

This version of ld uses the general purpose BFD libraries to operate on object files. This allows ld to read, combine, and write object files in many different formats---for example, COFF or a.out. Different formats may be linked together to produce any available kind of object file. Literally so flexible. 🦋

Aside from its flexibility, the GNU linker is more helpful than other linkers in providing diagnostic information. Many linkers abandon execution immediately upon encountering an error; whenever possible, ld continues executing, allowing you to identify other errors (or, in some cases, to get an output file in spite of the error). Helpful king behavior. 😭

The GNU linker ld is meant to cover a broad range of situations, and to be as compatible as possible with other linkers. As a result, you have many choices to control its behavior. 👑

💅 OPTIONS 💅

The linker supports a plethora of command-line options, but in actual practice few of them are used in any particular context. For instance, a frequent use of ld is to link standard Unix object files on a standard, supported Unix system. On such a system, to link a file hello.o:

        ld -o <output> /lib/crt0.o hello.o -lc

This tells ld to produce a file called output as the result of linking the file /lib/crt0.o with hello.o and the library libc.a, which will come from the standard search directories. (See the discussion of the -l option below.) Iconic.

Some of the command-line options to ld may be specified at any point in the command line. However, options which refer to files, such as -l or -T, cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. Repeating non-file options with a different argument will either have no further effect, or override prior occurrences (those further to the left on the command line) of that option. Options which may be meaningfully specified more than once are noted in the descriptions below. 🎀

Non-option arguments are object files or archives which are to be linked together. They may follow, precede, or be mixed in with command-line options, except that an object file argument may not be placed between an option and its argument. 💖

Usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. If no binary input files at all are specified, the linker does not produce any output, and issues the message No input files. Not the vibe, but okay. 💀

If the linker cannot recognize the format of an object file, it will assume that it is a linker script. A script specified in this way augments the main linker script used for the link (either the default linker script or the one specified by using -T). This feature permits the linker to link against a file which appears to be an object or an archive, but actually merely defines some symbol values, or uses INPUT or GROUP to load other objects. Specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script; use the -T option to replace the default linker script entirely, but note the effect of the INSERT command. 🧚

For options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them. 🌸

For options whose names are multiple letters, either one dash or two can precede the option name; for example, -trace-symbol and --trace-symbol are equivalent. Note---there is one exception to this rule. Multiple letter options that start with a lower case 'o' can only be preceded by two dashes. This is to reduce confusion with the -o option. So for example -omagic sets the output file name to magic whereas --omagic sets the NMAGIC flag on the output. 🙈

Arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. For example, --trace-symbol foo and --trace-symbol=foo are equivalent. Unique abbreviations of the names of multiple-letter options are accepted. ✨

Note---if the linker is being invoked indirectly, via a compiler driver (e.g. gcc) then all the linker command-line options should be prefixed by -Wl, (or whatever is appropriate for the particular compiler driver) like this:

        gcc -Wl,--start-group foo.o bar.o -Wl,--end-group

This is important, because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. Confusion may also arise when passing options that require values through a driver, as the use of a space between option and argument acts as a separator, and causes the driver to pass only the option to the linker and the argument to the compiler. In this case, it is simplest to use the joined forms of both single- and multiple-letter options, such as:

        gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.map

Here is a table of the generic command-line switches accepted by the GNU linker: 📋

• @file — Read command-line options from file. The options read are inserted in place of the original @file option. If file does not exist, or cannot be read, then the option will be treated literally, and not removed. 🫶 Options in file are separated by whitespace. A whitespace character may be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) may be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options will be processed recursively. ✨
• -a keyword — This option is supported for HP/UX compatibility. The keyword argument must be one of the strings archive, shared, or default. -aarchive is functionally equivalent to -Bstatic, and the other two keywords are functionally equivalent to -Bdynamic. This option may be used any number of times. 💅
• --audit AUDITLIB — Adds AUDITLIB to the DT_AUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. If specified multiple times, DT_AUDIT will contain a colon separated list of audit interfaces to use. If the linker finds an object with an audit entry while searching for shared libraries, it will add a corresponding DT_DEPAUDIT entry in the output file. This option is only meaningful on ELF platforms supporting the rtld-audit interface. 🔥
• -b input-format, --format=input-format — ld may be configured to support more than one kind of object file. If your ld is configured this way, you can use the -b option to specify the binary format for input object files that follow this option on the command line. Even when ld is configured to support alternative object formats, you don't usually need to specify this, as ld should be configured to expect as a default input format the most usual format on each machine. input-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i.) You may want to use this option if you are linking files with an unusual binary format. You can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format. The default format is taken from the environment variable GNUTARGET. You can also define the input format from a script, using the command TARGET; 🦋
• -c MRI-commandfile, --mri-script=MRI-commandfile — For compatibility with linkers produced by MRI, ld accepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. Introduce MRI script files with the option -c; use the -T option to run linker scripts written in the general-purpose ld scripting language. If MRI-cmdfile does not exist, ld looks for it in the directories specified by any -L options. 🎀
• -d, -dc, -dp — These three options are equivalent; multiple forms are supported for compatibility with other linkers. They assign space to common symbols even if a relocatable output file is specified (with -r). The script command FORCE_COMMON_ALLOCATION has the same effect. 💖
• --depaudit AUDITLIB, -P AUDITLIB — Adds AUDITLIB to the DT_DEPAUDIT entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. If specified multiple times, DT_DEPAUDIT will contain a colon separated list of audit interfaces to use. This option is only meaningful on ELF platforms supporting the rtld-audit interface. The -P option is provided for Solaris compatibility. 🌸
• --enable-linker-version — Enables the LINKER_VERSION linker script directive, described in Output Section Data. If this directive is used in a linker script and this option has been enabled then a string containing the linker version will be inserted at the current point. Note — this location of this option on the linker command line is significant. It will only affect linker scripts that come after it on the command line, or which are built into the linker. 👑
• --disable-linker-version — Disables the LINKER_VERSION linker script directive, so that it does not insert a version string. This is the default. 💀
• --enable-non-contiguous-regions — okay so bestie, normally if an input section doesn't fit into a matching output section, the linker just screams at you and dies. This option is the chill version: instead of erroring immediately, the linker tries to place the input section into subsequent matching output sections, and only throws a fit if no output section is big enough. It's iconic when you've got several non-contiguous memory regions lying around and the input section doesn't care which one it lands in. The order in which input sections are evaluated does not change, so it's predictable, bestie. Example time ✨:

MEMORY {
  MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
  MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
  MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
  mem1 : { *(.data.*); } > MEM1
  mem2 : { *(.data.*); } > MEM2
  mem3 : { *(.data.*); } > MEM3
}

with input sections:
.data.1: size 8
.data.2: size 0x10
.data.3: size 4

So with all that, .data.1 gets affected to mem1, and .data.2 plus .data.3 get affected to mem2 — even though .data.3 would fit in mem3. That's the whole bit, no cap.

Heads up though: this option is incompatible with INSERT statements, because it changes the way input sections are mapped to output sections. Not compatible, not happening, don't try it. 💀

• --enable-non-contiguous-regions-warnings — turns on warnings for when --enable-non-contiguous-regions allows possibly unexpected matches in sections mapping. Why do you care? Because those sneaky matches can potentially lead to silently discarding a section instead of failing because it doesn't fit any output region. So basically it's the "girl, are you sure?" alarm. 🔔
• -e entry, --entry=entry — use entry as the explicit symbol for beginning execution of your program instead of the default entry point. And if there's no symbol named entry? The linker will try to parse entry as a number and use that as the entry address. Number rules, stay with me: interpreted in base 10; you may use a leading 0x for base 16, or a leading 0 for base 8. For i386 PE, entry can also be the original function name — without the leading underscore and/or the trailing stdcall @number when applicable. Slay, bilingual linking. 🎀
• --exclude-libs lib,lib,... — specifies a list of archive libraries from which symbols should not be automatically exported. The library names may be delimited by commas or colons. Specify --exclude-libs ALL and it excludes symbols in all archive libraries from automatic export. Available only for the i386 PE targeted port of the linker and for ELF targeted ports. For i386 PE, symbols explicitly listed in a .def file are still exported, regardless of this option. For ELF targeted ports, symbols affected by this option will be treated as hidden. Lowkey a glow-down for those symbols and they know it. 🙈
• --exclude-modules-for-implib module,module,... — specifies a list of object files or archive members from which symbols should not be automatically exported, but which should be copied wholesale into the import library being generated during the link. The module names may be delimited by commas or colons, and must match exactly the filenames used by ld to open the files. For archive members, that's simply the member name; for object files, the name listed must include and match precisely any path used to specify the input file on the linker's command-line. Exact-exact. This option is available only for the i386 PE targeted port of the linker. Symbols explicitly listed in a .def file are still exported, regardless of this option. ✨
• -E, --export-dynamic, --no-export-dynamic — when creating a dynamically linked executable, using the -E option or the --export-dynamic option causes the linker to add all symbols to the dynamic symbol table. And what's the dynamic symbol table? It's the set of symbols which are visible from dynamic objects at run time. Main character symbols, honestly. 👑

If you don't use either of these options (or you use --no-export-dynamic to restore the default behavior), the dynamic symbol table will normally contain only those symbols which are referenced by some dynamic object mentioned in the link.

Now listen, this is the important bit: if you use dlopen to load a dynamic object which needs to refer back to the symbols defined by the program, rather than some other dynamic object, then you will probably need to use this option when linking the program itself. iykyk. 🫶

You can also use the dynamic list to control what symbols should be added to the dynamic symbol table if the output format supports it. See the description of --dynamic-list.

Note that this option is specific to ELF targeted ports. PE targets support a similar function to export all symbols from a DLL or EXE; see the description of --export-all-symbols below. ⭐

• --export-dynamic-symbol=glob — when creating a dynamically linked executable, symbols matching glob will be added to the dynamic symbol table. When creating a shared library, references to symbols matching glob will not be bound to the definitions within the shared library. This option is a no-op when creating a shared library and -Bsymbolic or --dynamic-list are not specified. Only meaningful on ELF platforms which support shared libraries. So specific, so picky, we love her. 💅
• --export-dynamic-symbol-list=file — specify a --export-dynamic-symbol for each pattern in the file. The format of the file is the same as the version node without scope and node name. See VERSION for more information. Bulk export era fr fr. 🦋
• -EB — link big-endian objects. This affects the default output format.
• -EL — link little-endian objects. This affects the default output format. Tiny endian battle, adorable. 🌸
• -f name, --auxiliary=name — when creating an ELF shared object, set the internal DT_AUXILIARY field to the specified name. This tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name. Fancy filter behavior, no cap. ✨

So if you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_AUXILIARY field. If the dynamic linker resolves any symbols from the filter object, it will first check whether there is a definition in the shared object name. If there is one, it will be used instead of the definition in the filter object. And here's the fun part: the shared object name need not exist. 😭 So the shared object name may be used to provide an alternative implementation of certain functions, perhaps for debugging or for machine-specific performance. Iconic behavior tbh.

This option may be specified more than once. The DT_AUXILIARY entries will be created in the order in which they appear on the command line. Order matters, always. 🎀

• -F name, --filter=name — when creating an ELF shared object, set the internal DT_FILTER field to the specified name. This tells the dynamic linker that the symbol table of the shared object which is being created should be used as a filter on the symbol table of the shared object name. 🦋

If you later link a program against this filter object, then, when you run the program, the dynamic linker will see the DT_FILTER field. The dynamic linker will resolve symbols according to the symbol table of the filter object as usual, but it will actually link to the definitions found in the shared object name. Thus the filter object can be used to select a subset of the symbols provided by the object name. Curated symbol menu, honestly. 💅

Some older linkers used the -F option throughout a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker uses other mechanisms for this purpose: the -b, --format, --oformat options, the TARGET command in linker scripts, and the GNUTARGET environment variable. The GNU linker will ignore the -F option when not creating an ELF shared object. So don't come at her with the old ways. 🙈

• -fini=name — when creating an ELF executable or shared object, call NAME when the executable or shared object is unloaded, by setting DT_FINI to the address of the function. By default, the linker uses _fini as the function to call. Goodbye function, but make it ✨specified✨.
• -g — ignored. Provided for compatibility with other tools. That's it, that's the whole vibe. She's just here so nothing breaks. 💀
• -G value, --gpsize=value — set the maximum size of objects to be optimized using the GP register to value. This is only meaningful for object file formats such as MIPS ELF that support putting large and small objects into different sections. It's ignored for other object file formats. Small object, big object, GP register decides. 🌈
• -h name, -soname=name — when creating an ELF shared object, set the internal DT_SONAME field to the specified name. When an executable is linked with a shared object which has a DT_SONAME field, then when the executable is run the dynamic linker will attempt to load the shared object specified by the DT_SONAME field rather than using the file name given to the linker. She goes by her name, not her filename. Periodt. 👑
• -i — perform an incremental link (same as option -r). Short and sweet. 🍓
• -init=name — when creating an ELF executable or shared object, call NAME when the executable or shared object is loaded, by setting DT_INIT to the address of the function. By default, the linker uses _init as the function to call. The hello function, basically. 🫶
• -l namespec, --library=namespec — add the archive or object file specified by namespec to the list of files to link. This option may be used any number of times. Okay so the rules: if namespec is of the form :filename, ld will search the library path for a file called filename; otherwise it will search the library path for a file called libnamespec.a. 🎀

On systems which support shared libraries, ld may also search for files other than libnamespec.a. Specifically, on ELF and SunOS systems, ld will search a directory for a library called libnamespec.so before searching for one called libnamespec.a. (By convention, a .so extension indicates a shared library.) Note that this behavior does not apply to :filename, which always specifies a file called filename. No substitutions, bestie. 💅

The linker will search an archive only once, at the location where it is specified on the command line. If the archive defines a symbol which was undefined in some object which appeared before the archive on the command line, the linker will include the appropriate file(s) from the archive. However, an undefined symbol in an object appearing later on the command line will not cause the linker to search the archive again. Order is literally everything, this is so real. 😭

See the -( option for a way to force the linker to search archives multiple times. (Yes, that's a real option, we'll get there, don't worry. 🙈)

You may list the same archive multiple times on the command line. Spam it, queen. 🔥

okay so real talk: this whole archive-searching thing? literally standard for Unix linkers, not a vibe unique to ld 💅. but bestie, heads up — if you're running ld on AIX, it does not behave like the AIX linker, so don't come for me when it does something different okay 🫶

• -L searchdir, --library-path=searchdir — adds the path searchdir to the list of paths ld will search for archive libraries and ld control scripts. use this as many times as your heart desires, fr. the directories get searched in the exact order you put them on the command line, and command-line directories get searched before the default directories. every single -L option applies to all -l options, no matter what order they appear in (the way that order-independence just works 😌). one caveat: -L options do not affect how ld searches for a linker script unless you specify the -T option.

if searchdir starts with = or $SYSROOT, then that prefix gets replaced by the sysroot prefix — which is controlled by the --sysroot option, or set when the linker was configured.

the default set of searched paths (the ones you didn't give with -L) depends on which emulation mode ld is using, and in some cases also on how it was configured. lowkey mysterious, ik.

you can also specify paths in a link script with the SEARCH_DIR command — directories specified that way get searched at the point where the linker script appears on the command line. iconic behaviour tbh.

• -m emulation — emulates the emulation linker ✨. you can list all the available emulations with the --verbose or -V options (go look, it's giving menu).

if you don't use -m, the emulation comes from the LDEMULATION environment variable — if that's defined. otherwise the default emulation depends on how the linker was configured. no cap, that's the whole chain of command.

• --remap-inputs=pattern=filename, --remap-inputs-file=file — these let you change input file names before the linker even tries to open them 🎀. like, --remap-inputs=foo.o=bar.o makes any attempt to load a file called foo.o instead try to load bar.o. wildcard patterns are allowed in the first filename, so --remap-inputs=foo*.o=bar.o renames any input file matching foo*.o to bar.o. the range on that? unmatched.

there's also the alternate form --remap-inputs-file=filename, which reads the remappings out of a file. each line in the file can contain a single remapping. blank lines are ignored. anything from a hash character (#) to the end of a line counts as a comment and is also ignored 🫶. the mapping pattern can be separated from the filename by whitespace or an equals (=) character.

you can spec these options multiple times, and their contents accumulate. remappings get processed in the order they occur on the command line, and if they came from a file, in the order they occur in the file. once a match is made, no further checking happens for that filename — first match wins, periodt.

fun trick: if the replacement filename is /dev/null or just NUL, the remapping actually makes the input file get ignored. super convenient way to experiment with yeeting input files out of a complicated build environment 🧚

careful bestie — this option is position dependent and only affects filenames that come after it on the command line. so this:

ld foo.o --remap-inputs=foo.o=bar.o

does absolutely nothing 💀. whereas this:

ld --remap-inputs=foo.o=bar.o foo.o

will rename the input file foo.o to bar.o. order matters, always has.

one more note — these options also affect files referenced by INPUT statements in linker scripts. but since linker scripts get processed after the entire command line is read, the position of the remap options on the command line isn't significant in that case. plot twist but make it fair.

if the verbose option is enabled, any mappings that match get reported — although again, the verbose option needs to be enabled on the command line before the remapped filenames appear. timing is everything ✨

and if -Map or --print-map is enabled, the remapping list gets included in the map output. we love receipts.

• -M, --print-map — prints a link map to standard output 📜. a link map gives you the tea about the link, including:
  • where object files get mapped into memory
  • how common symbols are allocated
  • all archive members included in the link, with a mention of the symbol that caused the archive member to be brought in
  • the values assigned to symbols

note — symbols whose values are computed by an expression that involves a reference to a previous value of the same symbol may not have the correct result displayed in the link map. why? because the linker discards intermediate results and only keeps the final value of an expression 😭. in those cases the linker displays the final value enclosed in square brackets. so for example, a linker script containing:

foo = 1
foo = foo * 4
foo = foo + 8

will produce the following output in the link map if the -M option is used:

0x00000001                foo = 0x1
[0x0000000c]                foo = (foo * 0x4)
[0x0000000c]                foo = (foo + 0x8)

see Expressions for more info about expressions in linker scripts 👑

• how GNU properties are merged.

when the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties get removed or updated. these actions are reported in the link map 🌸. for example:

Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)

this indicates that property 0xc0000002 is removed from the output when merging properties in foo.o, whose property 0xc0000002 value is 0x1, and bar.o, which doesn't have property 0xc0000002 at all (rip).

Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)

this indicates that property 0xc0010001 value is updated to 0x1 in the output when merging properties in foo.o, whose 0xc0010001 property value is 0x1, and bar.o, whose 0xc0010001 property value is 0x1. glow-up on both sides 💅

• on some ELF targets, a list of fixups inserted by --relax:

foo.o: Adjusting branch at 0x00000008 towards "far" in section .text

this indicates that the branch at 0x00000008 in foo.o, targeting the symbol "far" in section .text, has been replaced by a trampoline 🦋 (yes, a trampoline. no, not that kind. well, kind of that kind.)

• --print-map-discarded, --no-print-map-discarded — print (or don't print, your call) the list of discarded and garbage collected sections in the link map. enabled by default, so it's already serving looks unless you tell it not to.
• --print-map-locals, --no-print-map-locals — print (or don't print) local symbols in the link map. local symbols get the text (local) printed before their name, and they'll be listed after all the global symbols in a given section 🎀. temporary local symbols (typically the ones starting with .L) will not be included in the output. disabled by default — you gotta opt in, bestie.
• -n, --nmagic — turns off page alignment of sections, and disables linking against shared libraries 🚫. if the output format supports Unix style magic numbers, it marks the output as "NMAGIC".
• -N, --omagic — sets the text and data sections to be readable and writable. also: don't page-align the data segment, and disable linking against shared libraries. if the output format supports Unix style magic numbers, it marks the output as "OMAGIC". 😳

note — although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. so like, it works, but it's not technically legal. yikes.

• --no-omagic — negates most of the effects of the -N option 💀. it sets the text section to be read-only, and forces the data segment to be page-aligned.

note — this option does not enable linking against shared libraries. use -Bdynamic for that. don't skip steps.

• -o output, --output=output — uses output as the name for the program produced by ld. if you don't specify this option, the name a.out is used by default (the classic ✨). the script command OUTPUT can also specify the output file name.

note — the linker will delete the output file before it starts to write to it. it'll do this even if it turns out the link can't be completed due to errors. yes, gone. 😭

note — the linker will check to make sure the output file name doesn't match the name of any of the input files, but that's all it checks. in particular it will not complain if the output file might overwrite a source file or some other important file. therefore in build systems it's recommended to use the -o option as the last option on the linker command line. for example consider:

ld -o $(EXE) $(OBJS)
ld $(OBJS) -o $(EXE)

if the EXE variable is not defined for some reason, the first version of the linker command could end up deleting one of the object files (the first one in the OBJS list) 🫠, whereas the second version of the linker command will generate an error message and not delete anything. main character energy from the second one, honestly.

• --dependency-file=depfile — writes a dependency file to depfile 📝. this file contains a rule suitable for make describing the output file and all the input files that were read to produce it. the output is similar to the compiler's output with -M -MP. note that there's no option like the compiler's -MM to exclude "system files" (which is not a well-specified concept in the linker, unlike "system headers" in the compiler 🤷‍♀️). so the output from --dependency-file is always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. it's giving ✨site-specific✨.
• -O level — if level is a numeric value greater than zero, ld optimizes the output ⚡. this might take significantly longer and therefore probably should only be enabled for the final binary. at the moment this option only affects ELF shared library generation. future releases of the linker may make more use of this option. also, currently there's no difference in the linker's behaviour for different non-zero values of this option — which, honestly? slay, less to think about. again, this may change with future releases 👀.
• -plugin name — pull a plugin into the linking process, bestie. The name is the absolute filename of the plugin. Usually the compiler adds this one for you automatically when it's doing link time optimization, but you can absolutely add your own plugins if that's your vibe. 💅

Heads up though — the location where compiler-originated plugins live is different from the place where ar, nm and ranlib go looking for theirs. So if you want those commands to use a compiler-based plugin, you gotta copy it into the ${libdir}/bfd-plugins directory first. Good news: all gcc based linker plugins are backward compatible, so just copying in the newest one is literally enough. ✨

• --push-state — this one saves the current state of all the flags that govern input file handling, so you can bring them all back later with a single matching --pop-state. It's giving "save point before the boss fight" 🎀

The options covered are: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a.

One iconic use case for this is pkg-config specifications. When you use it with the --libs option, it lists all possibly needed libraries and then they possibly get linked in all the time. Way better to return something like this instead:

        -Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state

• --pop-state — undoes what --push-state did and restores the previous values of those input-file-handling flags. The rewind button fr fr 🦋
• -q, --emit-relocs — leaves relocation sections and their contents inside fully linked executables. Post-link analysis and optimization tools might need this info to correctly modify executables. The tradeoff? Bigger executables. 😭

Currently this option is only supported on ELF platforms.

• --force-dynamic — forces the output file to have dynamic sections. This one is specific to VxWorks targets. 🎯
• -r, --relocatable — generates relocatable output, meaning an output file that can itself serve as input to ld later. People call this partial linking. As a little side effect, in environments that support standard Unix magic numbers, this option also sets the output file's magic number to "OMAGIC". If you don't specify this option, you get an absolute file instead. Also important: when linking C++ programs, this option will not resolve references to constructors — to do that, use -Ur. 🌸

When an input file doesn't have the same format as the output file, partial linking is only supported if that input file contains no relocations. Different output formats can have further restrictions too — for example, some "a.out"-based formats don't support partial linking with input files in other formats at all.

When the relocatable output contains both contents that require link-time optimization (LTO) and contents that don't, a .gnu_object_only section will be created to hold a relocatable object file, as if -r were applied to all relocatable inputs which don't require LTO. And when processing a relocatable input with a .gnu_object_only section, the linker extracts the .gnu_object_only section as a separate input. 🧚

Ngl, since -r groups some sections from different input files together, there may be negative impacts on code size and locality in the final executable or shared library. Just so you know. 💀

This option does the same thing as -i.

• -R filename, --just-symbols=filename — reads symbol names and their addresses from filename, but doesn't relocate it or include it in the output. This lets your output file refer symbolically to absolute locations of memory defined in other programs. You may use this option more than once. 🔥

For compatibility with other ELF linkers, if the -R option is followed by a directory name rather than a file name, it's treated as the -rpath option instead.

• --rosegment, --no-rosegment — tries to make sure only a single read-only, non-code segment gets created. Only useful alongside the -z separate-code option. The resulting binaries should be smaller than if -z separate-code was used on its own. Without this option — or if --no-rosegment is specified — the -z separate-code option creates two read-only segments: one before the code segment, one after it. 🌈

Yeah, the names are misleading, but they were chosen so the linker stays compatible with the LLD and GOLD linkers. Not my fault, bestie. 🙈

These options are only supported by ELF targets.

• -s, --strip-all — omits all symbol information from the output file. Gone. Poof. ✨
• -S, --strip-debug — omits debugger symbol information from the output file, but not all symbols. Big difference, don't mix them up. 🎀
• --strip-discarded, --no-strip-discarded — omit (or don't omit) global symbols defined in discarded sections. Enabled by default. 👑
• -plugin-save-temps — stores the plugin "temporary" intermediate files permanently. Those quotes are doing a lot of work here, but okay. 💅
• -t, --trace — prints the names of the input files as ld processes them. If you give -t twice, members within archives get printed too. This output is genuinely useful for generating a list of all the object files and scripts involved in linking — for example when you're packaging files for a linker bug report. 🐛
• -T scriptfile, --script=scriptfile — uses scriptfile as the linker script. This script replaces ld's default linker script (it doesn't add to it), unless the script contains "INSERT" — in which case commandfile must specify everything necessary to describe the output file. (Yep, the manpage says commandfile there. Not me, fr fr.)

If scriptfile doesn't exist in the current directory, ld looks for it in the directories specified by any preceding -L options.

Command line options that appear before the -T option can affect the script, but command line options that appear after it do not. Order matters, bestie. ⭐

Multiple -T options will accumulate if they're augmenting the current script; otherwise the last, non-augmenting -T option wins.

There are other ways of specifying linker scripts. See

• -dT scriptfile, --default-script=scriptfile — uses scriptfile as the default linker script. 🦋

This is similar to the --script option, except that processing of the script is delayed until after the rest of the command line has been processed. That means options placed after --default-script on the command line can still affect how the linker script behaves — which is a big deal when the linker command line can't be directly controlled by the user (eg because the command line is being constructed by another tool, such as gcc).

• -u symbol, --undefined=symbol — forces symbol to be entered in the output file as an undefined symbol. This might, for example, trigger linking of additional modules from standard libraries. -u may be repeated with different option arguments to enter additional undefined symbols. This option is equivalent to the "EXTERN" linker script command. 🫶

If you're using this option to force extra modules to be pulled into the link, and it's an error for the symbol to remain undefined, then you should use --require-defined instead.

• --require-defined=symbol — requires that symbol is defined in the output file. Same as --undefined except that if symbol isn't defined in the output file, the linker issues an error and exits. The same effect can be achieved in a linker script by using "EXTERN", "ASSERT" and "DEFINED" together. This option can be used multiple times to require additional symbols. 👑
• -Ur — for programs that don't use constructors or destructors, or for ELF based systems, this option is equivalent to -r: it generates relocatable output, i.e. an output file that can in turn serve as input to ld. For other binaries though, -Ur is similar to -r but it also resolves references to constructors and destructors. 🎀

For those systems where -r and -Ur behave differently, it does not work to use -Ur on files that were themselves linked with -Ur — once the constructor table has been built, it cannot be added to. So use -Ur only for the last partial link, and -r for all the others. ⭐

• --orphan-handling=MODE — controls how orphan sections are handled. An orphan section is one that's not specifically mentioned in a linker script. 🧚

MODE can be any of these values:

• "place" — orphan sections are placed into a suitable output section following the strategy described in Orphan Sections. The option --unique also affects how sections are placed.
• "discard" — all orphan sections are discarded, by placing them in the /DISCARD/ section.
• "warn" — the linker places the orphan section as for "place" and issues a warning.
• "error" — the linker exits with an error if any orphan section is found.

If --orphan-handling isn't given, the default is "place". 💅

• --unique[=SECTION] — creates a separate output section for every input section matching SECTION, or — if the optional wildcard SECTION argument is missing — for every orphan input section. (An orphan section is one not specifically mentioned in a linker script.) You may use this option multiple times on the command line; it prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script. ✨
• -v, --version, -V — displays the version number for ld. The -V option also lists the supported emulations. See also the description of the --enable-linker-version in Options,,Command-line Options, which can be used to insert the linker version string into a binary. 👑
• -x, --discard-all — deletes all local symbols. Bye bestie 💀
• -X, --discard-locals — deletes all temporary local symbols. (These symbols start with system-specific local label prefixes — typically .L for ELF systems, or L for traditional a.out systems.) 🌸
• -y symbol, --trace-symbol=symbol — prints the name of each linked file in which symbol appears. This option may be given any number of times. On many systems it's necessary to prepend an underscore. 🦋

Super useful when you've got an undefined symbol in your link but you have no idea where the reference is coming from. Detective mode activated 🔍

• -Y path — adds path to the default library search path 💫. It's literally only here for Solaris compatibility, so it's giving "legacy icon" energy. iykyk.
• -z keyword — the keyword slot, where the linker keeps all its little secrets 👀. The recognized keywords are:
  • call-nop=prefix-addr, call-nop=suffix-nop, call-nop=prefix-byte, call-nop=suffix-byte — these set the 1-byte NOP padding when the linker transforms an indirect call to a locally defined function, foo, via its GOT slot 🎀. Specifically:
    • call-nop=prefix-addr generates 0x67 call foo
    • call-nop=suffix-nop generates call foo 0x90
    • call-nop=prefix-byte generates byte call foo
    • call-nop=suffix-byte generates call foo byte

Supported for i386 and x86_64 ✅.

• cet-report=none, cet-report=warning, cet-report=error — tells the linker how to report the missing GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK properties in the input .note.gnu.property section 🧐. cet-report=none is the default and makes the linker not report missing properties in input files. cet-report=warning makes it issue a warning for missing properties in input files. cet-report=error makes it issue an error for missing properties in input files 😤. Heads up: ibt turns off the missing GNU_PROPERTY_X86_FEATURE_1_IBT property report, and shstk turns off the missing GNU_PROPERTY_X86_FEATURE_1_SHSTK property report. Supported for Linux/i386 and Linux/x86_64 💜.
• combreloc, nocombreloc — combreloc combines multiple dynamic relocation sections and sorts them to improve dynamic symbol lookup caching ✨. nocombreloc is the "do not do this" girlie — if you say nocombreloc, it doesn't happen 🙅‍♀️.
• common, nocommon — common generates common symbols with STT_COMMON type during a relocatable link. Use STT_OBJECT type if you pick nocommon 🫶.
• common-page-size=value — sets the page size most commonly used to value 📏. Memory image layout gets optimized to minimize memory pages if the system is using pages of this size. lowkey efficient.
• defs — reports unresolved symbol references from regular object files 🚨. It does this even if the linker is creating a non-symbolic shared library. This option is the inverse of -z undefs. periodt.
• dynamic-undefined-weak, nodynamic-undefined-weak — makes undefined weak symbols dynamic when building a dynamic object, if they're referenced from a regular object file and not forced local by symbol visibility or versioning 🦋. nodynamic-undefined-weak is the "don't do that" version. If neither option is given, a target may default to either option being in force, or make some other selection of undefined weak symbols dynamic. Not all targets support these options — so vibe check your target first 💅.
• execstack — marks the object as requiring an executable stack 🔥.
• global — only meaningful when building a shared object 👑. It makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries.
• globalaudit — only meaningful when building a dynamic executable 👑. It marks the executable as requiring global auditing by setting the DF_1_GLOBAUDIT bit in the DT_FLAGS_1 dynamic tag. Global auditing requires that any auditing library defined via the --depaudit or -P command-line options be run for all dynamic objects loaded by the application. fancy.
• ibtplt — generates Intel Indirect Branch Tracking (IBT) enabled PLT entries 🛡️. Supported for Linux/i386 and Linux/x86_64.
• ibt — generates GNU_PROPERTY_X86_FEATURE_1_IBT in the .note.gnu.property section to indicate compatibility with IBT ✨. This also implies ibtplt. Supported for Linux/i386 and Linux/x86_64.
• indirect-extern-access, noindirect-extern-access — generates GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS in the .note.gnu.property section to indicate that the object file requires canonical function pointers and cannot be used with copy relocation 🫶. This option also implies noextern-protected-data and nocopyreloc. Supported for i386 and x86-64. And noindirect-extern-access removes GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS from the .note.gnu.property section — like, un-generates it 💀.
• initfirst — only meaningful when building a shared object 💖. It marks the object so that its runtime initialization will occur before the runtime initialization of any other objects brought into the process at the same time. Similarly, the runtime finalization of the object will occur after the runtime finalization of any other objects. main character energy, honestly.
• interpose — specifies that the dynamic loader should modify its symbol search order so that symbols in this shared library interpose all other shared libraries not so marked 🌈.
• unique, nounique — when generating a shared library or other dynamically loadable ELF object, marks it as one that should (by default) only ever be loaded once, and only in the main namespace (when using dlmopen) 🌸. This is primarily used to mark fundamental libraries such as libc, libpthread et al which do not usually function correctly unless they are the sole instances of themselves. The dlmopen caller can override this behaviour, and it doesn't apply to certain loading mechanisms (such as audit libraries).
• lam-u48 — generates GNU_PROPERTY_X86_FEATURE_1_LAM_U48 in the .note.gnu.property section to indicate compatibility with Intel LAM_U48 ⭐. Supported for Linux/x86_64.
• lam-u57 — generates GNU_PROPERTY_X86_FEATURE_1_LAM_U57 in the .note.gnu.property section to indicate compatibility with Intel LAM_U57 ⭐. Supported for Linux/x86_64.
• lam-u48-report=none, lam-u48-report=warning, lam-u48-report=error — tells the linker how to report the missing GNU_PROPERTY_X86_FEATURE_1_LAM_U48 property in the input .note.gnu.property section 🧐. lam-u48-report=none is the default and makes the linker not report missing properties in input files. lam-u48-report=warning makes it issue a warning for missing properties in input files. lam-u48-report=error makes it issue an error for missing properties in input files 😤. Supported for Linux/x86_64.
• lam-u57-report=none, lam-u57-report=warning, lam-u57-report=error — same deal, but for the missing GNU_PROPERTY_X86_FEATURE_1_LAM_U57 property in the input .note.gnu.property section 🧐. Default is none, so no report for missing properties in input files; warning issues a warning; error issues an error. Supported for Linux/x86_64 💜.
• lam-report=none, lam-report=warning, lam-report=error — the combo version 💅: reports on the missing both GNU_PROPERTY_X86_FEATURE_1_LAM_U48 and GNU_PROPERTY_X86_FEATURE_1_LAM_U57 properties in the input .note.gnu.property section. lam-report=none is the default and makes the linker not report missing properties in input files; lam-report=warning issues a warning; lam-report=error issues an error. Supported for Linux/x86_64.
• lazy — when generating an executable or shared library, marks it to tell the dynamic linker to defer function call resolution until the function is actually called (lazy binding) rather than at load time 😴. Lazy binding is the default — the linker is a procrastinator, same.
• loadfltr — specifies that the object's filters be processed immediately at runtime ⚡.
• max-page-size=value — sets the maximum memory page size supported to value 📐.
• mark-plt, nomark-plt — marks PLT entries with dynamic tags DT_X86_64_PLT, DT_X86_64_PLTSZ and DT_X86_64_PLTENT 🏷️. > ⚠️ Careful bestie: since this option stores a non-zero value in the r_addend field of R_X86_64_JUMP_SLOT relocations, the resulting executables and shared libraries are incompatible with dynamic linkers such as those in older versions of glibc without the change to ignore r_addend in R_X86_64_GLOB_DAT and R_X86_64_JUMP_SLOT relocations — the ones that don't ignore the r_addend field of R_X86_64_JUMP_SLOT relocations. Supported for x86_64.
• muldefs — allows multiple definitions 👯‍♀️. chaos permitted.
• nocopyreloc — disables linker-generated .dynbss variables that get used in place of variables defined in shared libraries. May result in dynamic text relocations 😬.
• nodefaultlib — specifies that the dynamic loader's search for dependencies of this object should ignore any default library search paths 🙈.
• nodelete — specifies that the object shouldn't be unloaded at runtime. it stays. it lives here now 💅.
• nodlopen — specifies that the object is not available to dlopen 🚫.
• nodump — specifies that the object can not be dumped by dldump 🚫.
• noexecstack — marks the object as not requiring an executable stack 🛡️.
• noextern-protected-data — don't treat protected data symbols as external when building a shared library 🫶. This option overrides the linker backend default, and it can be used to work around incorrect relocations against protected data symbols generated by the compiler. Heads up: updates on protected data symbols by another module aren't visible to the resulting shared library. Supported for i386 and x86-64.
• noreloc-overflow — disables the relocation overflow check 🙈. You can use this to disable the relocation overflow check if there will be no dynamic relocation overflow at run-time. Supported for x86_64.
• memory-seal, nomemory-seal — instructs the executable or shared library that all PT_LOAD segments should be sealed to avoid further manipulation (such as changing the protection flags, the segment size, or removing the mapping) 🔒✨. This is a security hardening that requires system support. It generates GNU_PROPERTY_MEMORY_SEAL in the .note.gnu.property section. very demure, very mindful.

• -z now — 👑 bestie this one is the GOAT for security. When you're generating an executable or a shared library, -z now marks it so the dynamic linker resolves all symbols right when the program starts, or right when the shared library gets loaded by dlopen — instead of being lazy and deferring function call resolution until the function is literally first called. no procrastination allowed 💅
• -z origin — tells the linker this object requires $ORIGIN handling in paths. that's it, that's the whole vibe.
• -z pack-relative-relocs, -z nopack-relative-relocs — generates compact relative relocation in position-independent executable and shared library ✨ it adds DT_RELR, DT_RELRSZ and DT_RELRENT entries to the dynamic section. heads up though: it's ignored when building position-dependent executable and relocatable output. nopack-relative-relocs is the default, and it disables compact relative relocation. when linked against the GNU C Library, a GLIBC_ABI_DT_RELR symbol version dependency on the shared C Library gets added to the output. supported for i386 and x86-64 🫶
• -z relro, -z norelro — creates an ELF PT_GNU_RELRO segment header in the object. this specifies a memory segment that should be made read-only after relocation, if supported 🔥 but listen — specifying common-page-size smaller than the system page size will render this protection ineffective 😭 so don't do that. and it won't create an ELF PT_GNU_RELRO segment if you say norelro.
• -z report-relative-reloc — reports dynamic relative relocations generated by the linker. supported for Linux/i386 and Linux/x86_64 👀
• -z sectionheader, -z nosectionheader — generate section header, or don't generate it if nosectionheader is used. sectionheader is the default, periodt.
• -z separate-code, -z noseparate-code — creates a separate code PT_LOAD segment header in the object. this specifies a memory segment that should contain only instructions and must be in wholly disjoint pages from any other data 🛡️ don't create that separate code PT_LOAD segment if noseparate-code is used.
• -z shstk — generates GNU_PROPERTY_X86_FEATURE_1_SHSTK in the .note.gnu.property section to indicate compatibility with Intel Shadow Stack 💜 supported for Linux/i386 and Linux/x86_64.
• -z stack-size= value — specify a stack size for an ELF PT_GNU_STACK segment. and bestie, specifying zero will override any default non-zero sized PT_GNU_STACK segment creation 🙈
• -z start-stop-gc, -z nostart-stop-gc — okay this one's a whole paragraph, buckle up 🎀 when --gc-sections is in effect, a reference from a retained section to __start_SECNAME or __stop_SECNAME causes all input sections named SECNAME to also be retained — but only if SECNAME is representable as a C identifier and either __start_SECNAME or __stop_SECNAME is synthesized by the linker. -z start-stop-gc disables this effect, allowing sections to be garbage collected as if those special synthesized symbols were not defined. and -z start-stop-gc has no effect on a definition of __start_SECNAME or __stop_SECNAME in an object file or linker script. such a definition will prevent the linker providing a synthesized __start_SECNAME or __stop_SECNAME respectively, and therefore the special treatment by garbage collection for those references. iykyk 😌
• -z start-stop-visibility= value — specify the ELF symbol visibility for synthesized __start_SECNAME and __stop_SECNAME symbols. value must be exactly default, internal, hidden, or protected. if no -z start-stop-visibility option is given, protected is used for compatibility with historical practice. however — it's highly recommended to use -z start-stop-visibility=hidden in new programs and shared libraries so that these symbols are not exported between shared objects, which is not usually what's intended ⚠️
• -z text, -z notext, -z textoff — report an error if DT_TEXTREL is set, i.e. if the position-independent or shared object has dynamic relocations in read-only sections. don't report an error if notext or textoff 💀
• -z undefs — do not report unresolved symbol references from regular object files, either when creating an executable or when creating a shared library. this option is the inverse of -z defs 🦋
• -z unique-symbol, -z nounique-symbol — avoid duplicated local symbol names in the symbol string table. append "."number" to duplicated local symbol names if unique-symbol is used. nounique-symbol is the default 🌸
• -z x86-64-baseline, -z x86-64-v2, -z x86-64-v3, -z x86-64-v4 — specify the x86-64 ISA level needed in the .note.gnu.property section. x86-64-baseline generates GNU_PROPERTY_X86_ISA_1_BASELINE. x86-64-v2 generates GNU_PROPERTY_X86_ISA_1_V2. x86-64-v3 generates GNU_PROPERTY_X86_ISA_1_V3. x86-64-v4 generates GNU_PROPERTY_X86_ISA_1_V4 ⭐ supported for Linux/i386 and Linux/x86_64.
• -z isa-level-report=none, -z isa-level-report=all, -z isa-level-report=needed, -z isa-level-report=used — specify how to report x86-64 ISA levels in input relocatable files 👑 isa-level-report=none, which is the default, will make the linker not report x86-64 ISA levels in input files. isa-level-report=all will make the linker report needed and used x86-64 ISA levels in input files. isa-level-report=needed will make the linker report needed x86-64 ISA levels in input files. isa-level-report=used will make the linker report used x86-64 ISA levels in input files. supported for Linux/i386 and Linux/x86_64 💖

other keywords are ignored for Solaris compatibility. not our problem bestie 🙈

---

🧚 the other long-form options

• --gnu-tls-tag, --no-gnu-tls-tag — adds a GLIBC_ABI_GNU_TLS version tag dependency in output programs and shared libraries when linking against glibc, if input relocatable object files call ___tls_get_addr. heads up: the output will fail to load and run at run-time against glibc which doesn't define the GLIBC_ABI_GNU_TLS version tag 😭 unless disabled by the --disable-gnu-tls-tag configure option at the linker build time, when no options are specified, the linker will add the GLIBC_ABI_GNU_TLS version tag dependency if inputs have a ___tls_get_addr call and libc.so defines the GLIBC_ABI_GNU_TLS version tag. supported for Linux/i386 💅
• --gnu2-tls-tag, --no-gnu2-tls-tag — adds a GLIBC_ABI_GNU2_TLS version tag dependency in output programs and shared libraries when linking against glibc, if input relocatable object files have R_386_TLS_DESC_CALL or R_X86_64_TLSDESC_CALL relocation. same warning as above — the output will fail to load and run at run-time against glibc which doesn't define the GLIBC_ABI_GNU2_TLS version tag 💀 unless disabled by the --disable-gnu2-tls-tag configure option at the linker build time, when no options are specified, the linker will add the GLIBC_ABI_GNU2_TLS version tag dependency if inputs have R_386_TLS_DESC_CALL or R_X86_64_TLSDESC_CALL relocation and libc.so defines the GLIBC_ABI_GNU2_TLS version tag. supported for Linux/i386 and Linux/x86_64 🫶

-( archives -)
--start-group archives --end-group

• -( archives -), --start-group archives --end-group — archives should be a list of archive files. they may be either explicit file names, or -l options 🎀

so here's the tea: the specified archives are searched repeatedly until no new undefined references are created. normally an archive is searched only once, in the order that it's specified on the command line. if a symbol in that archive is needed to resolve an undefined symbol referred to by an object in an archive that appears later on the command line, the linker would not be able to resolve that reference 😭 but by grouping the archives, they all get searched repeatedly until all possible references are resolved. iconic behaviour honestly.

real talk though — using this option has a significant performance cost. it's best to use it only when there are unavoidable circular references between two or more archives ⚠️

• --accept-unknown-input-arch, --no-accept-unknown-input-arch — tells the linker to accept input files whose architecture cannot be recognised. the assumption is that the user knows what they're doing and deliberately wants to link in these unknown input files 🙈 this was the default behaviour of the linker before release 2.14. the default behaviour from release 2.14 onwards is to reject such input files, and so the --accept-unknown-input-arch option has been added to restore the old behaviour 🌈
• --as-needed, --no-as-needed — this option affects ELF DT_NEEDED tags for dynamic libraries mentioned on the command line after the --as-needed option. normally the linker will add a DT_NEEDED tag for each dynamic library mentioned on the command line, regardless of whether the library is actually needed or not. --as-needed causes a DT_NEEDED tag to only be emitted for a library that at that point in the link satisfies a non-weak undefined symbol reference from a regular object file or, if the library is not found in the DT_NEEDED lists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. object files or libraries appearing on the command line after the library in question do not affect whether the library is seen as needed. this is similar to the rules for extraction of object files from archives 👑

--no-as-needed restores the default behaviour.

note: on Linux based systems the --as-needed option also has an affect on the behaviour of the --rpath and --rpath-link options. see the description of --rpath-link for more details 🔍

• --add-needed, --no-add-needed — these two options have been deprecated 💀 because of the similarity of their names to the --as-needed and --no-as-needed options. they have been replaced by --copy-dt-needed-entries and --no-copy-dt-needed-entries.
• -assert keyword — this option is ignored for SunOS compatibility 🦋
• -Bdynamic, -dy, -call_shared — link against dynamic libraries. this is only meaningful on platforms for which shared libraries are supported. this option is normally the default on such platforms. the different variants of this option are for compatibility with various systems. you may use this option multiple times on the command line: it affects library searching for -l options which follow it ✨

okay so we're back in the options buffet, bestie — no skipping, no summarizing, every single linker flag is getting its moment 💅✨

• -Bgroup — this slaps the "DF_1_GROUP" flag into the "DT_FLAGS_1" entry in the dynamic section. It makes the runtime linker handle lookups in this object and its dependencies only inside the group. --unresolved-symbols=report-all is implied. Only meaningful on ELF platforms which support shared libraries.
• -Bstatic, -dn, -non_shared, -static — do not link against shared libraries. Only meaningful on platforms for which shared libraries are supported. The different variants are for compatibility with various systems. You may use this option multiple times on the command line: it affects library searching for -l options which follow it. This option also implies --unresolved-symbols=report-all. It can be used with -shared — doing so means a shared library is being created, but all of the library's external references must be resolved by pulling in entries from static libraries. 🫶
• -Bsymbolic — when creating a shared library, bind references to global symbols to the definition within the shared library, if any. Normally, a program linked against a shared library can override the definition within the shared library. Only meaningful on ELF platforms which support shared libraries.
• -Bsymbolic-functions — same energy, but for global function symbols: when creating a shared library, bind references to global function symbols to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries.
• -Bno-symbolic — this one can cancel previously specified -Bsymbolic and -Bsymbolic-functions. bye bye binding 💀
• --dynamic-list=dynamic-list-file — specifies the name of a dynamic list file to the linker. Typically used when creating shared libraries to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library, or when creating dynamically linked executables to specify a list of symbols which should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries.

The format of the dynamic list is the same as the version node without scope and node name. See VERSION for more information.

• --dynamic-list-data — includes all global data symbols in the dynamic list. 🍓
• --dynamic-list-cpp-new — provides the builtin dynamic list for C++ operator new and delete. It is mainly useful for building shared libstdc++.
• --dynamic-list-cpp-typeinfo — provides the builtin dynamic list for C++ runtime type identification.
• --check-sections, --no-check-sections — --no-check-sections asks the linker not to check section addresses after they have been assigned to see if there are any overlaps. Normally the linker performs this check, and if it finds any overlaps it produces suitable error messages. The linker does know about, and does make allowances for, sections in overlays. Restore the default behaviour with --check-sections. Section overlap is not usually checked for relocatable links; you can force checking in that case by using --check-sections.
• --copy-dt-needed-entries, --no-copy-dt-needed-entries — this affects the treatment of dynamic libraries referred to by DT_NEEDED tags inside ELF dynamic libraries mentioned on the command line. Normally the linker won't add a DT_NEEDED tag to the output binary for each library mentioned in a DT_NEEDED tag in an input dynamic library. With --copy-dt-needed-entries specified on the command line, however, any dynamic libraries that follow it will have their DT_NEEDED entries added. Restore the default behaviour with --no-copy-dt-needed-entries.

This option also affects symbol resolution in dynamic libraries. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line will be recursively searched, following their DT_NEEDED tags to other libraries, in order to resolve symbols required by the output binary. With the default setting, however, searching of dynamic libraries that follow it will stop with the dynamic library itself. No DT_NEEDED links will be traversed to resolve symbols.

• --cref — outputs a cross reference table. If a linker map file is being generated, the cross reference table is printed to the map file. Otherwise, it is printed on standard output. 📋

The format of the table is intentionally simple, so it may be easily processed by a script if necessary. The symbols are printed out, sorted by name. For each symbol, a list of file names is given. If the symbol is defined, the first file listed is the location of the definition. If the symbol is defined as a common value, then any files where this happens appear next. Finally, any files that reference the symbol are listed.

• --ctf-variables, --no-ctf-variables — the CTF debuginfo format supports a section which encodes the names and types of variables found in the program which do not appear in any symbol table. These variables clearly cannot be looked up by address by conventional debuggers, so the space used for their types and names is usually wasted: the types are usually small but the names are often not. --ctf-variables causes the generation of such a section. Restore the default behaviour with --no-ctf-variables.
• --ctf-share-types=method — adjusts the method used to share types between translation units in CTF.
  • share-unconflicted — put all types that do not have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default.
  • share-duplicated — put only types that occur in multiple translation units into the shared dictionary: types with only one definition go into per-translation-unit dictionaries. Types with ambiguous definitions in multiple translation units always go into per-translation-unit dictionaries. This tends to make the CTF larger, but may reduce the amount of CTF in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime.
• --no-define-common — this inhibits the assignment of addresses to common symbols. The script command "INHIBIT_COMMON_ALLOCATION" has the same effect.

--no-define-common allows decoupling the decision to assign addresses to Common symbols from the choice of the output file type; otherwise a non-Relocatable output type forces assigning addresses to Common symbols. Using --no-define-common allows Common symbols that are referenced from a shared library to be assigned addresses only in the main program. This eliminates the unused duplicate space in the shared library, and also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution. 🧚

• --force-group-allocation — makes the linker place section group members like normal input sections, and delete the section groups. This is the default behaviour for a final link, but this option can be used to change the behaviour of a relocatable link (-r). The script command "FORCE_GROUP_ALLOCATION" has the same effect.
• --defsym=symbol=expression — creates a global symbol in the output file, containing the absolute address given by expression. You may use this option as many times as necessary to define multiple symbols in the command line. A limited form of arithmetic is supported for expression in this context: you may give a hexadecimal constant or the name of an existing symbol, or use "+" and "-" to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider using the linker command language from a script. Note: there should be no white space between symbol, the equals sign ("="), and expression. 😤

The linker processes --defsym arguments and -T arguments in order. Placing --defsym before -T defines the symbol before the linker script from -T is processed, while placing --defsym after -T defines the symbol after the linker script has been processed. This difference has consequences for expressions within the linker script that use the --defsym symbols, and which order is correct will depend on what you are trying to achieve.

• --demangle[=style], --no-demangle — these control whether to demangle symbol names in error messages and other output. When the linker is told to demangle, it tries to present symbol names in a readable fashion: it strips leading underscores if they are used by the object file format, and converts C++ mangled symbol names into user readable names. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. The linker demangles by default unless the environment variable COLLECT_NO_DEMANGLE is set. These options may be used to override the default. 💖
• -Ifile, --dynamic-linker=file — sets the name of the dynamic linker. Only meaningful when generating dynamically linked ELF executables. The default dynamic linker is normally correct; don't use this unless you know what you are doing 🔥
• --no-dynamic-linker — when producing an executable file, omit the request for a dynamic linker to be used at load-time. Only meaningful for ELF executables that contain dynamic relocations, and usually requires entry point code that is capable of processing these relocations.
• --embedded-relocs — similar to the --emit-relocs option, except the relocs are stored in a target-specific section. Only supported by the BFIN, CR16 and M68K targets.
• --disable-multiple-abs-defs — do not allow multiple definitions with symbols included in filename invoked by -R or --just-symbols.
• --fatal-warnings, --no-fatal-warnings — treat all warnings as errors. Restore the default behaviour with --no-fatal-warnings. periodt 🌈👑
• -w, --no-warnings — bestie, this one just mutes everything. No warning messages, no error messages, nada. It literally overrides --fatal-warnings if you already turned that on 💀. Use it when you know the output binary is not gonna work but you still gotta produce it anyway. Unbothered. Iconic. Slightly unhinged.
• --force-exe-suffix — makes sure your output file has a .exe suffix, periodt. If a successfully built, fully linked output file doesn't have a .exe or .dll suffix, this forces the linker to copy the output file to a same-named file with a .exe suffix. Super useful when you're running unmodified Unix makefiles on a Microsoft Windows host, because some Windows versions straight up refuse to run an image unless it ends in .exe. ✨
• --gc-sections, --no-gc-sections — this enables garbage collection of unused input sections 🗑️✨. It gets ignored on targets that don't support it. Want the default behaviour back (aka no garbage collection)? Just pass --no-gc-sections on the command line. Heads up: garbage collection for COFF and PE format targets is supported, but the implementation is currently considered experimental 👀.

So --gc-sections decides which input sections are used by examining symbols and relocations. The section containing the entry symbol and all sections containing symbols undefined on the command-line get kept, and so do sections containing symbols referenced by dynamic objects. Lowkey important: when building shared libraries, the linker must assume that any visible symbol is referenced. Once that initial set of sections is determined, the linker recursively marks as used any section referenced by their relocations. See --entry, --undefined, and --gc-keep-exported 🫶.

This option can be set when doing a partial link (enabled with option -r). In that case the root of symbols kept must be explicitly specified, either by one of the options --entry, --undefined, or --gc-keep-exported, or by a "ENTRY" command in the linker script.

As a GNU extension, ELF input sections marked with the "SHF_GNU_RETAIN" flag will not be garbage collected. Protecting them fr fr 💅.

• --print-gc-sections, --no-print-gc-sections — lists all the sections that garbage collection yeeted. The listing goes to stderr. Only actually does anything if garbage collection has been enabled via the --gc-sections option. Default behaviour (not listing removed sections) comes back with --no-print-gc-sections on the command line 🌸.
• --gc-keep-exported — when --gc-sections is enabled, this stops garbage collection of unused input sections that contain global symbols having default or protected visibility 🛡️. It's meant for executables where unreferenced sections would otherwise be collected regardless of the external visibility of contained symbols. Note that it has no effect when linking shared objects, since that's already the default behaviour. Only supported for ELF format targets. iykyk.
• --print-output-format — prints the name of the default output format (which might be influenced by other command-line options). That's the exact string that would show up in an "OUTPUT_FORMAT" linker script command 🔍.
• --print-memory-usage — prints used size, total size, and used size of memory regions created with the MEMORY command. So handy on embedded targets when you want a quick look at how much free memory you've got. The output has one headline and one line per region, and it's both human readable and easily parsable by tools 👑

Here's an example of what it gives you:

        Memory region         Used Size  Region Size  %age Used
                     ROM:        256 KB         1 MB     25.00%
                     RAM:          32 B         2 GB      0.00%

Note: if you wanna know the memory usage of the linker itself, that's the --stats option's whole job 🫡.

• --help — prints a summary of the command-line options on standard output and exits. Your classic "wait what were the flags again" moment 💖.
• --target-help — prints a summary of all the target-specific options on standard output and exits. Very niche, very demure 🎀.
• -Map=mapfile — prints a link map to the file mapfile. See the description of the -M option up above ✨. If mapfile is just the character -, the map gets written to stdout.

Okay this next bit is the good part, so pay attention bestie 📝. Specifying a directory as mapfile makes the linker map written as a file inside that directory. Normally the name of that file is computed as the basename of the output file with .map appended. But if the special character % is used, it gets replaced by the full path of the output file. And if there are any characters after the % symbol, then .map is no longer appended. Watch:

                    -o foo.exe -Map=bar                  [Creates ./bar]
                    -o ../dir/foo.exe -Map=bar           [Creates ./bar]
                    -o foo.exe -Map=../dir               [Creates ../dir/foo.exe.map]
                    -o ../dir2/foo.exe -Map=../dir       [Creates ../dir/foo.exe.map]
                    -o foo.exe -Map=%                    [Creates ./foo.exe.map]
                    -o ../dir/foo.exe -Map=%             [Creates ../dir/foo.exe.map]
                    -o foo.exe -Map=%.bar                [Creates ./foo.exe.bar]
                    -o ../dir/foo.exe -Map=%.bar         [Creates ../dir/foo.exe.bar]
                    -o ../dir2/foo.exe -Map=../dir/%     [Creates ../dir/../dir2/foo.exe.map]
                    -o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]

It is an error to specify more than one % character 🚨. And if the map file already exists, it gets overwritten by this operation. No takebacks.

• --no-keep-memory — ld normally optimizes for speed over memory usage by caching the symbol tables of input files in memory. This tells ld to flip that: optimize for memory usage instead, rereading the symbol tables as needed 🔄. Might be required if ld runs out of memory space while linking a large executable. Painful but necessary 😭.
• --no-undefined, -z defs — reports unresolved symbol references from regular object files. It does this even if the linker is creating a non-symbolic shared library. Wanna control the behaviour for unresolved references found in shared libraries being linked in? That's the --[no-]allow-shlib-undefined switch's department 🫶. And the effects of this option can be reverted by using -z undefs.
• --allow-multiple-definition, -z muldefs — normally when a symbol is defined multiple times, the linker reports a fatal error. These options allow multiple definitions instead, and the first definition wins 🥇. Honestly slay, sometimes you just need the chaos.
• --allow-shlib-undefined, --no-allow-shlib-undefined — allows or disallows undefined symbols in shared libraries. Similar to --no-undefined, except this one's about the undefined symbols being in a shared library rather than a regular object file. It does not affect how undefined symbols in regular object files are handled ⚠️.

Default behaviour: report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable, but allow them if the linker is creating a shared library.

Why would undefined symbol references in shared libraries specified at link time be allowed? Two reasons, bestie:

• A shared library specified at link time may not be the same as the one available at load time, so the symbol might actually be resolvable at load time 🤔.
• There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are normal.

The BeOS kernel for example patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for example, to dynamically select an appropriate memset function. Genuinely clever ngl 💜.

• --error-handling-script=scriptname — if this is provided, the linker invokes scriptname whenever an error is encountered. Currently though, only two kinds of error are supported: missing symbols and missing libraries. Two arguments get passed to the script: the keyword undefined-symbol or missing-lib, and the name of the undefined symbol or missing library. The whole intention is that the script gives the user suggestions about where the symbol or library might be found 🔎✨. After the script finishes, the normal linker error message is displayed.

Heads up: availability of this option is controlled by a configure time switch, so it may not be present in specific implementations 🙈.

• --no-undefined-version — normally when a symbol has an undefined version, the linker just ignores it 🙃. This option disallows symbols with undefined version, and a fatal error gets issued instead.
• --default-symver — creates and uses a default symbol version (the soname) for unversioned exported symbols 🎀.
• --default-imported-symver — creates and uses a default symbol version (the soname) for unversioned imported symbols 🦋.
• --no-warn-mismatch — normally ld gives an error if you try to link together input files that are mismatched for some reason — maybe they were compiled for different processors, or for different endiannesses. This option tells ld to silently permit such possible errors 💀. Only use it with care, in cases where you've taken some special action that ensures the linker errors are inappropriate fr fr.
• --no-warn-search-mismatch — normally ld gives a warning if it finds an incompatible library during a library search. This silences that warning 🤫.
• --no-whole-archive — turns off the effect of the --whole-archive option for subsequent archive files. The off switch to the on switch, basically 🔁.
• --noinhibit-exec — retains the executable output file whenever it's still usable. Normally the linker won't produce an output file if it hits errors during the link process — it exits without writing an output file when it issues any error whatsoever 😤. This is the "no bestie, keep it, we can fix it later" flag 💅.
• -nostdlib — only searches library directories explicitly specified on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line) are ignored 🚫📚.

---

• --oformat=output-format — okay so ld can be configured to support more than one kind of object file. If your ld is set up that way, this option lets you pick the binary format for the output object file. ✨

Even when ld supports alternative object formats, you usually don't need to specify this, because ld should be configured to produce the most usual format on each machine as its default output format. output-format is a text string — the name of a particular format supported by the BFD libraries. (You can list the available binary formats with objdump -i.) The script command OUTPUT_FORMAT can also specify the output format, but this option overrides it.

• --out-implib file — create an import library in file that corresponds to the executable the linker is generating (like a DLL or an ELF program). 💅

This import library (which should be called *.dll.a or *.a for DLLs) may be used to link clients against the generated executable. That means you can skip a separate import library creation step — like dlltool for DLLs. This option is only available for the i386 PE and ELF targetted ports of the linker.

• -pie, --pic-executable — create a position independent executable. 🎀 This is currently only supported on ELF platforms.

Position independent executables are relocated by the dynamic linker to the virtual address the OS chooses for them, which can vary between invocations. They are marked ET_DYN in the ELF file header, but they differ from shared libraries in a number of ways. In particular, defined symbols in a PIE by default can not be overridden by another object the way they can be in a shared library.

• -no-pie — create a position dependent executable. This is the default, bestie. 🫶
• -qmagic — this option is ignored for Linux compatibility. Literally ignored. 💀
• -Qy — this option is ignored for SVR4 compatibility. Also literally ignored. 🙈
• --relax, --no-relax — an option with machine dependent effects. This one is only supported on a few targets. 🧚

On some platforms, the --relax option performs target specific, global optimizations that become possible when the linker resolves addressing in the program — things like relaxing address modes, synthesizing new instructions, selecting shorter versions of current instructions, and combining constant values.

On some platforms these link time global optimizations may make symbolic debugging of the resulting executable impossible. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors. 😭

On platforms where the feature is supported, the option --no-relax will disable it.

On platforms where the feature is not supported, both --relax and --no-relax are accepted, but ignored.

• --retain-symbols-file=filename — retain only the symbols listed in the file filename, discarding all others. 🌸 filename is simply a flat file, with one symbol name per line.

This option is especially useful in environments (such as VxWorks) where a large global symbol table is accumulated gradually, to conserve run-time memory.

--retain-symbols-file does not discard undefined symbols, or symbols needed for relocations.

You may only specify --retain-symbols-file once in the command line. It overrides -s and -S.

• -rpath=dir — add a directory to the runtime library search path. 🦋 This is used when linking an ELF executable with shared objects. All -rpath arguments are concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime.

The -rpath option is also used when locating shared objects which are needed by shared objects explicitly included in the link; see the description of the -rpath-link option. Searching -rpath in this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option.

If -rpath is not used when linking an ELF executable, the contents of the environment variable LD_RUN_PATH will be used if it is defined.

The -rpath option may also be used on SunOS. By default, on SunOS, the linker will form a runtime search path out of all the -L options it is given. If a -rpath option is used, the runtime search path will be formed exclusively using the -rpath options, ignoring the -L options. This can be useful when using gcc, which adds many -L options which may be on NFS mounted file systems.

For compatibility with other ELF linkers, if the -R option is followed by a directory name, rather than a file name, it is treated as the -rpath option.

• -rpath-link=dir — when using ELF or SunOS, one shared library may require another. 🌈 This happens when an ld -shared link includes a shared library as one of the input files.

When the linker encounters such a dependency when doing a non-shared, non-relocatable link, it will automatically try to locate the required shared library and include it in the link, if it is not included explicitly. In such a case, several directories are searched as described below. The -rpath-link option specifies the first set of directories to search. This option may specify a sequence of directory names either by providing a list of names separated by colons, or by appearing multiple times.

The tokens $ORIGIN and $LIB can appear in these search directories. They will be replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN, and either lib — for 32-bit binaries — or lib64 — for 64-bit binaries — in the case of $LIB.

The alternative form of these tokens — ${ORIGIN} and ${LIB} — can also be used. The token $PLATFORM is not supported.

The --rpath-link option should be used with caution as it overrides the search path that may have been hard compiled into a shared library. In such a case it is possible to unintentionally use a different search path than the runtime linker would have used. 😬

When additional shared libraries are required, the linker will search directories in the order listed below in order to find them. Note however that this only applies to additional libraries needed to satisfy already included shared libraries. It does not apply to libraries that are included via the -l command line option. Searches for -l libraries are only conducted in directories specified by the -L option.

1. Any directories specified by -rpath-link options.
2. Any directories specified by -rpath options. The difference between -rpath and -rpath-link is that directories specified by -rpath options are included in the executable and used at runtime, whereas the -rpath-link option is only effective at link time. Searching -rpath in this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option.
3. On an ELF system, for native linkers, if the -rpath and -rpath-link options were not used, search the contents of the environment variable LD_RUN_PATH.
4. On SunOS, if the -rpath option was not used, search any directories specified using -L options.
5. For a native linker, search the contents of the environment variable LD_LIBRARY_PATH.
6. For a native ELF linker, the directories in DT_RUNPATH or DT_RPATH of a shared library are searched for shared libraries needed by it. The DT_RPATH entries are ignored if DT_RUNPATH entries exist.
7. For a linker for a Linux system, if the file /etc/ld.so.conf exists, the list of directories found in that file. Note: the path to this file is prefixed with the sysroot value, if that is defined, and then any prefix string if the linker was configured with the --prefix=<path> option.
8. For a native linker on a FreeBSD system, any directories specified by the _PATH_ELF_HINTS macro defined in the elf-hints.h header file.
9. Any directories specified by a SEARCH_DIR command in a linker script given on the command line, including scripts specified by -T (but not -dT).
10. The default directories, normally /lib and /usr/lib.
11. Any directories specified by a plugin LDPT_SET_EXTRA_LIBRARY_PATH.
12. Any directories specified by a SEARCH_DIR command in a default linker script.

Note however on Linux based systems there is an additional caveat: if the --as-needed option is active and a shared library is located which would normally satisfy the search and this library does not have a DT_NEEDED tag for libc.so and there is a shared library later on in the set of search directories which also satisfies the search and this second shared library does have a DT_NEEDED tag for libc.so then the second library will be selected instead of the first. 👑

If the required shared library is not found, the linker will issue a warning and continue with the link.

• --section-ordering-file=script — this option is used to augment the current linker script with additional mapping of input sections to output sections. ⭐ This file must use the same syntax for SECTIONS as is used in normal linker scripts, but it should not do anything other than place input sections into output sections. @pxref{SECTIONS}

A second constraint on the section ordering script is that it can only reference output sections that are already defined by whichever linker script is currently in use. (Ie the default linker script or a script specified on the command line.) The benefit of the section ordering script however is that the input sections are mapped to the start of the output sections, so that they can ensure the ordering of sections in the output section. For example, imagine that the default linker script looks like this:

SECTIONS {
  .text : { *(.text.hot) ; *(.text .text.*) }
  .data : { *(.data.big) ; *(.data .data.*) }
  }

Then if a section ordering file like this is used:

  .text : { *(.text.first) ; *(.text.z*) }
  .data : { foo.o(.data.first) ; *(.data.small) }

This would be equivalent to a linker script like this:

                   SECTIONS {
                     .text : { *(.text.first) ; *(.text.z*) ; *(.text.hot) ; *(.text .text.*) }
                     .data : { foo.o(.data.first) ; *(.data.small) ; *(.data.big) ; *(.data .data.*) }
                     }

The whole point of the section ordering file is that you get to boss around the sections you actually care about without having to think about every other section, or memory regions, or literally anything else. It's giving curated playlist energy. 🎀

• -shared, -Bshareable — bestie, this makes a shared library. Right now it's only a thing on ELF, XCOFF and SunOS platforms. On SunOS specifically, the linker will auto-make a shared library if you didn't use -e and there are undefined symbols hanging out in the link. ✨
• --sort-common, --sort-common=ascending, --sort-common=descending — tells ld to sort the common symbols by alignment, ascending or descending, when it drops them into the right output sections. The alignments it looks at are sixteen-byte or larger, eight-byte, four-byte, two-byte, and one-byte — the whole reason is so you don't get ugly gaps between symbols from alignment constraints. No sorting order given? Then descending is assumed, periodt. 💅
• --sort-section=name — applies "SORT_BY_NAME" to all wildcard section patterns in the linker script. All of them. Every last one. 🦋
• --sort-section=alignment — same deal but it applies "SORT_BY_ALIGNMENT" to all wildcard section patterns in the linker script. Iconic. ⭐
• --spare-dynamic-tags=count — sets how many empty slots to leave in the .dynamic section of ELF shared objects. Why would you want empty slots? Post-processing tools like the prelinker need them, that's why. Default is 5. 🎀
• --split-by-file[=size] — similar to --split-by-reloc but it makes a new output section for each input file once size is reached. If you don't give a size, it defaults to 1. Yeah, one. 🙈
• --split-by-reloc[=count] — tries to make extra sections in the output file so no single output section holds more than count relocations. Super useful when you're generating huge relocatable files for downloading into certain real time kernels with the COFF object file format — because COFF literally cannot represent more than 65535 relocations in a single section. Important caveats though: it will fail to work with object file formats that don't support arbitrary sections, and the linker will not split up individual input sections to redistribute them — so if one input section has more than count relocations, one output section is gonna contain that many. count defaults to 32768. 😭
• --stats[=filename] — computes and displays statistics about how the linker is doing, like execution time and memory usage. The deets:
  • No filename argument? Then only basic info gets reported, and it goes to the standard error output stream.
  • filename given? Then extended info is written to the named file.
  • Set filename to just the - symbol and the extended info goes to the standard output stream instead.
  • If filename starts with +, the file is opened in append mode rather than overwrite mode. 🫶
  • If the -Map option is enabled, the info also gets recorded in the map file too. Note: if both --stats and -Map got filename arguments and those names match, the info is only written out once, not twice. We love no duplicates.
  • If the "LD_STATS" environment variable is defined, this behaves like --stats. If the variable's value is a string, that string is used as the name of the file to record into; otherwise the info goes to the standard output stream. Using the env var means you can record stats without touching the linker's command line — so convenient. Note: if both the environment variable and --stats are used, --stats takes precedence. 👑
  • Extended info includes cpu time used and — if the getrusage() system library call is available — memory use too. It's reported per individual part of the linking process, called phases. There's also a special phase called ALL covering the whole linking process. Careful though: individual phases can contain or overlap each other, so do not assume the total resources used by the linker is the sum of the individual phases. Math doesn't math here, bestie.
  • Also, when extended info is being reported, the linker version, command line arguments and linker start time are included too. This makes it way easier when a build system is invoking multiple links and you need to identify exactly which arguments produced the stats you're staring at. 🔍
  • The extended output looks something like this:

                   Stats: linker version: (GNU Binutils) 2.44.50.20250401
                   Stats: linker started: Wed Apr  2 09:36:41 2025
                   Stats: args: ld -z norelro -z nomemory-seal -z no-separate-code -o a.out [...]

                   Stats: phase               cpu time    memory      user time    system time
                   Stats: name                (microsec)   (KiB)      (seconds)      (seconds)
                   Stats: ALL                   390082    217740              0              0
                   Stats: ctf processing            12         0              0              0
                   Stats: string merge            1324         0              0              0
                   Stats: parsing                  349       288              0              0
                   Stats: plugins                    1         0              0              0
                   Stats: processing files      259616    214524              0              0
                   Stats: write                 116493         0              0              0

• --no-stats — turns off the reporting of usage statistics, in case it got switched on via --stats or the LD_STATS environment variable. The off switch. 💀
• --sysroot=directory — uses directory as the location of the sysroot, overriding the configure-time default. Heads up: this option is only supported by linkers that were configured using --with-sysroot. No configure flag, no sysroot slay. 🌸
• --task-link — used by COFF/PE based targets to create a task-linked object file where all the global symbols have been converted to statics. 🦋
• --traditional-format — for some targets the output of ld differs in some ways from the output of some existing linker, and this switch asks ld to use the traditional format instead. Example: on SunOS, ld combines duplicate entries in the symbol string table, which can shrink an output file with full debugging info by over 30 percent. Unfortunately the SunOS "dbx" program can't read the resulting program ("gdb" has no trouble). --traditional-format tells ld to not combine duplicate entries. Trade-offs, bestie. 😭
• --section-start=sectionname=org — locates a section in the output file at the absolute address given by org. You can use this option as many times as you need to locate multiple sections on the command line. org must be a single hexadecimal integer; for compatibility with other linkers you may omit the leading 0x that's usually associated with hexadecimal values. Note: there should be no white space between sectionname, the equals sign ("="), and org. Not even one space. 🙈
• --image-base=org — on ELF, same as -Ttext-segment, with both options effectively setting the base address of the ELF executable. On PE, use the value as the base address of your program or dll — the lowest memory location used when your program or dll is loaded. To reduce the need to relocate and improve performance of your dlls, each should have a unique base address and not overlap any other dlls. Default is 0x400000 for executables, and 0x10000000 for dlls. ✨
• -Tbss=org, -Tdata=org, -Ttext=org — same as --section-start, with ".bss", ".data" or ".text" as the sectionname. Short and sweet. 💅
• -Ttext-segment=org — when creating an ELF executable, sets the address of the first byte of the first segment. Note: when -pie is used with -Ttext-segment=org, the output executable is marked ET_EXEC so that the address of the first byte of the text segment is guaranteed to be org at run time. Guaranteed, fr fr. 🔥
• -Trodata-segment=org — when creating an ELF executable or shared object for a target where the read-only data lives in its own segment, separate from the executable text, this sets the address of the first byte of the read-only data segment. 🎀
• -Tldata-segment=org — when creating an ELF executable or shared object for x86-64 medium memory model, sets the address of the first byte of the ldata segment. Very niche, very iconic. ⭐
• --unresolved-symbols=method — decides how to handle unresolved symbols. There are four possible values for method:
  • ignore-all — do not report any unresolved symbols. Blissful ignorance, honestly.
  • report-all — report all unresolved symbols. This is the default. 👑
  • ignore-in-object-files — report unresolved symbols contained in shared libraries, but ignore them if they come from regular object files.
  • ignore-in-shared-libs — report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. Super handy when you're creating a dynamic binary and you know all the shared libraries it should be referencing are included on the linker's command line. 🫶

The behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option. Normally the linker generates an error message for each reported unresolved symbol, but --warn-unresolved-symbols can change that into a warning instead. 😌

• --dll-verbose, --verbose[=NUMBER] — displays the version number for ld and lists the linker emulations supported. Also displays which input files can and cannot be opened, and shows the linker script being used by the linker. And if the optional NUMBER argument is > 1, plugin symbol status gets displayed too. Maximum transparency. 🌈

---

• --version-script=version-scriptfile — bestie, this one tells the linker exactly which version script to use 🎀. It's the move when you're building shared libraries and you wanna hand over extra deets about the version hierarchy of the library you're making.

Real talk though: it's only fully supported on ELF platforms that support shared libraries — peep the VERSION section for that whole situation 👀. On PE platforms it's partially supported, where version scripts can filter symbol visibility in auto-export mode — meaning any symbols marked local in the version script simply won't get exported. Periodt.

• --warn-common — warns you whenever a common symbol gets combined with another common symbol or with a symbol definition. Kinda a vibe check for sloppy linking 💅.

So here's the lore: Unix linkers are chill about this somewhat sloppy practice, but linkers on some other operating systems are absolutely not. This option lets you sniff out potential problems from combining global symbols. The catch? Some C libraries literally do this, so you might catch warnings about symbols in the libraries too, not just in your own programs 😭. Not their fault, not yours.

There are three kinds of global symbols, illustrated with C examples:

int i = 1;

That's a definition — it goes in the initialized data section of the output file ✨.

extern int i;

That's an undefined reference — it does not allocate space. There's gotta be either a definition or a common symbol for the variable somewhere, or you're in trouble 🫠.

int i;

That's a common symbol. If there are only (one or more) common symbols for a variable, it goes in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol — and if they're different sizes, it picks the largest size, queen behavior 👑. Also, the linker turns a common symbol into a declaration if there's a definition of the same variable.

The --warn-common option can produce five kinds of warnings, and each one is a pair of lines: first line describes the symbol just encountered, second describes the previous symbol with the same name. One or both of the two symbols will be a common symbol. Let's go through them 🧚:

1. Turning a common symbol into a reference, because there's already a definition for the symbol.

<file>(<section>): warning: common of `<symbol>'
   overridden by definition
<file>(<section>): warning: defined here

2. Turning a common symbol into a reference, because a later definition for the symbol is encountered. Same as the previous case, except the symbols show up in a different order 🔄.

<file>(<section>): warning: definition of `<symbol>'
   overriding common
<file>(<section>): warning: common is here

3. Merging a common symbol with a previous same-sized common symbol.

<file>(<section>): warning: multiple common
   of `<symbol>'
<file>(<section>): warning: previous common is here

4. Merging a common symbol with a previous larger common symbol.

<file>(<section>): warning: common of `<symbol>'
   overridden by larger common
<file>(<section>): warning: larger common is here

5. Merging a common symbol with a previous smaller common symbol. Again, same as the previous case, just with the symbols encountered in a different order.

<file>(<section>): warning: common of `<symbol>'
   overriding smaller common
<file>(<section>): warning: smaller common is here

• --warn-constructors — warns if any global constructors are used 🏗️. Lowkey only useful for a few object file formats, ngl. For formats like COFF or ELF, the linker literally can't detect the use of global constructors, so don't come for it 💀.
• --warn-execstack, --warn-execstack-objects, --no-warn-execstack — on ELF platforms the linker might throw warning messages at you if it's asked to create an output file that contains an executable stack 😳. There are three possible states:
  1. Do not generate any warnings.
  2. Always generate warnings — even if the executable stack is requested via the -z execstack command line option.
  3. Only generate a warning if an object file requests an executable stack, but not if the -z execstack option is used.

The default state depends on how the linker was configured when it was built (so it's giving "depends on your build" energy 🌈). --no-warn-execstack always puts the linker into the no-warnings state. --warn-execstack puts it into the warn-always state. --warn-execstack-objects puts it into the warn-for-object-files-only state. Slay, very clear.

Note: ELF format input files can specify that they need an executable stack by having a .note.GNU-stack section with the executable bit set in its section flags. They can specify that they do not need an executable stack by having that same section, but without the executable flag bit set. And if an input file doesn't have a .note.GNU-stack section at all? Then the default behaviour is target specific 😬. For some targets, that absence implies an executable stack is required. This is often a whole problem for hand crafted assembler files — you've been warned, bestie.

• --error-execstack, --no-error-execstack — if the linker is about to generate a warning message about an executable stack, then --error-execstack will instead change that warning into an error 🔥. But heads up: this option does not change the linker's execstack warning generation state. If you wanna set a specific warning state, use --warn-execstack or --warn-execstack-objects.

And --no-error-execstack restores the default behaviour of generating warning messages 🫶.

• --warn-multiple-gp — warns if multiple global pointer values are required in the output file 🎯. Only meaningful for certain processors, such as the Alpha.

The lore: some processors put large-valued constants in a special section, and a special register (the global pointer) points into the middle of that section so constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g., 16 bits), that limits the maximum size of the constant pool 📏. So in large programs it's often necessary to use multiple global pointer values just to address all the possible constants. This option makes a warning pop off whenever that case occurs 💅.

• --warn-once — only warn once for each undefined symbol, instead of once per module that refers to it 🙈. Your terminal will thank you.
• --warn-rwx-segments, --no-warn-rwx-segments — warns if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set 😱. Such a segment represents a potential security vulnerability — not cute, not iconic, fix it.

On top of that, warnings get generated if a thread local storage segment is created with the execute permission flag set, regardless of whether or not it has the read and/or write flags set 👀.

These warnings are enabled by default. You can turn them off with --no-warn-rwx-segments and turn them back on with --warn-rwx-segments ✨.

• --error-rwx-segments, --no-error-rwx-segments — if the linker is going to generate a warning message about an executable, writeable segment, or an executable TLS segment, then --error-rwx-segments turns that warning into an error instead 💀. And --no-error-rwx-segments restores the default behaviour of just generating a warning message.

Note: --error-rwx-segments does not by itself turn on warnings about these segments. Those warnings are either enabled by default (if the linker was configured that way) or via the --warn-rwx-segments command line option. So don't be surprised if nothing screams at you 🙈.

• --warn-section-align — warns if the address of an output section gets changed because of alignment 📐. Typically the alignment will be set by an input section. The address only changes if it's not explicitly specified — that is, if the SECTIONS command doesn't specify a start address for the section. iykyk.
• --warn-textrel — warns if the linker adds DT_TEXTREL to a position-independent executable or shared object 🎀. Little flag, big deal.
• --warn-alternate-em — warns if an object has alternate ELF machine code 👀. That's it, that's the whole vibe.
• --warn-unresolved-symbols — if the linker is going to report an unresolved symbol (see the option --unresolved-symbols), it'll normally generate an error. This option makes it generate a warning instead 🫶. Softer delivery, same message.
• --error-unresolved-symbols — this restores the linker's default behaviour of generating errors when it's reporting unresolved symbols 🔥. Back to business.
• --whole-archive — for each archive mentioned on the command line after the --whole-archive option, include every object file in the archive in the link, rather than searching the archive for the required object files 🌸. Normally this is used to turn an archive file into a shared library, forcing every object to be included in the resulting shared library. And yes, this option may be used more than once 💅.

Two notes when using this option from gcc: First, gcc doesn't know about this option, so you have to use -Wl,-whole-archive. Second, don't forget to use -Wl,-no-whole-archive after your list of archives, because gcc will add its own list of archives to your link and you may not want this flag to affect those as well 😭. Learn from my mistakes, bestie.

• --wrap=symbol — uses a wrapper function for symbol 🎁. Any undefined reference to symbol will be resolved to __wrap_symbol. Any undefined reference to __real_symbol will be resolved to symbol.

You can use this to provide a wrapper for a system function. The wrapper function should be called __wrap_symbol. If it wishes to call the system function, it should call __real_symbol ✨.

Here's a trivial example, and it's literally so clean:

void *
__wrap_malloc (size_t c)
{
  printf ("malloc called with %zu\n", c);
  return __real_malloc (c);
}

If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead 🔥. And the call to __real_malloc inside __wrap_malloc will call the real malloc function. Chef's kiss, no notes 👑.

You may also want to hand the linker a __real_malloc function too, so that links without the --wrap option still go through fine. But bestie, listen — do not put the definition of __real_malloc in the same file as __wrap_malloc. If you do, the assembler might resolve that call before the linker even gets a chance to wrap it to malloc, and then the whole bit falls apart. 🙈

Also important: only undefined references get replaced by the linker. So translation-unit-internal references to a symbol are not resolved to __wrap_symbol. In this next example, the call to f inside g is not resolved to __wrap_f. 😭

int
f (void)
{
  return 123;
}

int
g (void)
{
  return f();
}

---

• --eh-frame-hdr, --no-eh-frame-hdr — request (--eh-frame-hdr) or suppress (--no-eh-frame-hdr) the creation of the .eh_frame_hdr section and the ELF PT_GNU_EH_FRAME segment header. ✨
• --no-ld-generated-unwind-info — request creation of .eh_frame unwind info for linker-generated code sections like PLT. This option is on by default if linker-generated unwind info is supported. It also controls the generation of .sframe stack trace info for linker-generated code sections like PLT. 🧚
• --enable-new-dtags, --disable-new-dtags — this linker can create the new dynamic tags in ELF, but older ELF systems may not understand them 😬. If you specify --enable-new-dtags, the new dynamic tags get created as needed and older dynamic tags are omitted. If you specify --disable-new-dtags, no new dynamic tags are created. By default, the new dynamic tags are not created. Note that these options are only available for ELF systems. 🫶
• --hash-size=number — sets the default size of the linker's hash tables to a prime number close to number. Bumping this value can shorten the time the linker takes to do its thing, at the expense of more memory. Similarly, lowering it can cut memory requirements at the expense of speed. Tradeoffs, bestie 💅
• --hash-style=style — sets the type of the linker's hash table(s). style can be sysv for the classic ELF .hash section, gnu for the new-style GNU .gnu.hash section, or both for both the classic ELF .hash and the new-style GNU .gnu.hash hash tables. The default depends on how the linker was configured, but for most Linux-based systems it'll be both. 👑
• --compress-debug-sections=none, --compress-debug-sections=zlib, --compress-debug-sections=zlib-gnu, --compress-debug-sections=zlib-gabi, --compress-debug-sections=zstd — on ELF platforms, these control how DWARF debug sections get compressed using zlib.

--compress-debug-sections=none doesn't compress DWARF debug sections at all. --compress-debug-sections=zlib-gnu compresses them and renames them to begin with .zdebug instead of .debug. --compress-debug-sections=zlib-gabi also compresses them, but instead of renaming, it sets the SHF_COMPRESSED flag in the sections' headers.

The --compress-debug-sections=zlib option is an alias for --compress-debug-sections=zlib-gabi.

--compress-debug-sections=zstd compresses DWARF debug sections using zstd. 🦋

Heads up: this option overrides any compression in input debug sections. So if a binary is linked with --compress-debug-sections=none, for example, then any compressed debug sections in input files will be uncompressed before they're copied into the output binary. 😭

The default compression behaviour varies depending on the target involved and the configure options used to build the toolchain. You can figure out the default by peeking at the output from the linker's --help option. ⭐

• --reduce-memory-overheads — cuts memory requirements at ld runtime, at the expense of linking speed. This was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage.

Another effect of the switch is to set the default hash table size to 1021, which again saves memory at the cost of lengthening the linker's run time. This is not done, however, if the --hash-size switch has been used. 🫶

The --reduce-memory-overheads switch may also be used to enable other tradeoffs in future versions of the linker. 🔮

• --max-cache-size=size — ld normally caches the relocation information and symbol tables of input files in memory with unlimited size. This option sets the maximum cache size to size. 💾
• --build-id, --build-id=style — request the creation of a .note.gnu.build-id ELF note section or a .buildid COFF section. The contents of the note are unique bits identifying this linked file. 👑

style can be:

• uuid — use 128 random bits
• sha1 — use a 160-bit SHA1 hash
• md5 — use a 128-bit MD5 hash
• xx — use a 128-bit XXHASH on the normative parts of the output contents
• 0xhexstring — use a chosen bit string specified as an even number of hexadecimal digits (- and : characters between digit pairs are ignored)

If style is omitted, sha1 is used.

The md5, sha1, and xx styles produce an identifier that's always the same in an identical output file, but is almost certainly unique among all nonidentical output files. It is not intended to be compared as a checksum for the file's contents. A linked file may be changed later by other tools, but the build ID bit string identifying the original linked file does not change. ✨

Passing none for style disables the setting from any --build-id options earlier on the command line. 🚫

• --package-metadata=JSON — request the creation of a .note.package ELF note section. The contents of the note are in JSON format, as per the package metadata specification. For more info see: https://systemd.io/ELF_PACKAGE_METADATA/

The JSON argument supports percent-encoding and the following %[string] encoding (where string refers to the name in HTML's Named Character References): %[comma] for ,, %[lbrace] for {, %[quot] for ", %[rbrace] for }, and %[space] for the space character. 🌸

If the JSON argument is missing/empty, then this disables the creation of the metadata note — if one had been enabled by an earlier occurrence of the --package-metadata option. If the linker has been built with libjansson, then the JSON string will be validated. 🎀

---

🎀 Options Specific to i386 PE Targets 🎀

The i386 PE linker supports the -shared option, which makes the output a dynamically linked library (DLL) instead of a normal executable. You should name the output *.dll when you use this one, bestie 💅. On top of that, the linker fully supports the standard *.def files, which you can specify on the linker command line just like an object file — in fact, it should come before the archives it exports symbols from, to make sure they get linked in, just like a normal object file. 🫶

In addition to the options common to all targets, the i386 PE linker supports extra command-line options that are specific to the i386 PE target. Options that take values may be separated from their values by either a space or an equals sign. ✨

• --add-stdcall-alias — if given, symbols with a stdcall suffix (@nn) will be exported as-is and also with the suffix stripped. [This option is specific to the i386 PE targeted port of the linker]
• --base-file file — use file as the name of a file in which to save the base addresses of all the relocations needed for generating DLLs with dlltool. [This is an i386 PE specific option] 🦋
• --dll — create a DLL instead of a regular executable. You may also use -shared or specify a LIBRARY in a given .def file. [This option is specific to the i386 PE targeted port of the linker]
• --enable-long-section-names, --disable-long-section-names — the PE variants of the COFF object format add an extension that permits section names longer than eight characters, which is the normal limit for COFF. By default, these names are only allowed in object files, since fully-linked executable images don't carry the COFF string table required to support the longer names.

As a GNU extension, it's possible to allow their use in executable images too, or to (probably pointlessly!) disallow it in object files, using these two options. 🫠 Executable images generated with these long section names are slightly non-standard, carrying a string table as they do, and may generate confusing output when examined with non-GNU PE-aware tools, like file viewers and dumpers. However, GDB relies on PE long section names to find Dwarf-2 debug information sections in an executable image at runtime — so if neither option is specified on the command line, ld will enable long section names, overriding the default and technically correct behaviour, when it finds debug information present while linking an executable image and not stripping symbols. [This option is valid for all PE targeted ports of the linker] 😭

• --enable-stdcall-fixup, --disable-stdcall-fixup — if the link finds a symbol it can't resolve, it attempts to do "fuzzy linking" 😵‍💫 by looking for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall) and resolves that symbol by linking to the match. For example, the undefined symbol _foo might be linked to the function _foo@12, or the undefined symbol _bar@16 might be linked to the function _bar.

When the linker does this, it prints a warning, since it normally should have failed to link — but sometimes import libraries generated from third-party dlls may need this feature to be usable. If you specify --enable-stdcall-fixup, this feature is fully enabled and warnings are not printed. If you specify --disable-stdcall-fixup, this feature is disabled and such mismatches are considered to be errors. 💀 [This option is specific to the i386 PE targeted port of the linker]

• --leading-underscore, --no-leading-underscore — for most targets the default symbol-prefix is an underscore, and it's defined in the target's description. With this option it's possible to disable/enable the default underscore symbol-prefix. 🌟
• --export-all-symbols — okay so if you pass this, every global symbol in the objects used to build a DLL gets exported by the DLL. 💅 Heads up: it's already the default if there otherwise wouldn't be any exported symbols at all. But when symbols are explicitly exported via DEF files, or implicitly exported via function attributes, the default flips to not exporting anything else — unless you hand it this option. So like, it's giving "break glass in case of emergency" energy.

Not everything gets auto-exported though, and the list is long, so buckle up bestie:

• These four never get the auto-export treatment: DllMain@12, DllEntryPoint@0, DllMainCRTStartup@12, and impure_ptr.
• Symbols imported from other DLLs won't be re-exported. 🙈
• Neither will symbols that specify the DLL's internal layout — like ones beginning with _head_ or ending with _iname.
• No symbols from libgcc, libstd++, libmingw32, or crtX.o get exported.
• Symbols whose names begin with __rtti_ or __builtin_ are also skipped — that's to help with C++ DLLs.
• And finally there's a whole extensive list of cygwin-private symbols that aren't exported (obviously this applies only when building DLLs for cygwin targets). The cygwin-excludes are: _cygwin_dll_entry@12, _cygwin_crt0_common@8, _cygwin_noncygwin_dll_entry@12, _fmode, _impure_ptr, cygwin_attach_dll, cygwin_premain0, cygwin_premain1, cygwin_premain2, cygwin_premain3, and environ.

[This option is specific to the i386 PE targeted port of the linker]

• --exclude-symbols symbol,symbol,... — drops a list of symbols that should not be automatically exported. Delimit the names with commas or colons, whichever vibe you prefer. ✨ [This option is specific to the i386 PE targeted port of the linker]
• --exclude-all-symbols — the nuclear option: no symbols get automatically exported. Periodt. 🚫 [This option is specific to the i386 PE targeted port of the linker]
• --file-alignment — sets the file alignment. Sections in the file will always begin at file offsets that are multiples of this number. Defaults to 512. 🎀 [This option is specific to the i386 PE targeted port of the linker]
• --heap reserve, --heap reserve,commit — tells it how many bytes of memory to reserve (and optionally commit) to be used as heap for this program. Default is 1MB reserved, 4K committed. [This option is specific to the i386 PE targeted port of the linker]
• --kill-at — if given, the stdcall suffixes (@nn) get stripped from symbols before they're exported. Slay, honestly. 💅 [This option is specific to the i386 PE targeted port of the linker]
• --large-address-aware — if given, the appropriate bit in the Characteristics field of the COFF header is set, indicating that this executable supports virtual addresses greater than 2 gigabytes. 🔥 This should be used in conjunction with the /3GB or /USERVA=value megabytes switch in the [operating systems] section of BOOT.INI. Otherwise, this bit has no effect. [This option is specific to PE targeted ports of the linker]
• --disable-large-address-aware — reverts the effect of a previous --large-address-aware option. Super useful when --large-address-aware is always set by the compiler driver (e.g. Cygwin gcc) and the executable doesn't support virtual addresses greater than 2 gigabytes. 🫶 [This option is specific to PE targeted ports of the linker]
• --major-image-version value — sets the major number of the image version. Defaults to 1. [This option is specific to the i386 PE targeted port of the linker]
• --major-os-version value — sets the major number of the os version. Defaults to 4. [This option is specific to the i386 PE targeted port of the linker]
• --major-subsystem-version value — sets the major number of the subsystem version. Defaults to 4. [This option is specific to the i386 PE targeted port of the linker]
• --minor-image-version value — sets the minor number of the image version. Defaults to 0. [This option is specific to the i386 PE targeted port of the linker]
• --minor-os-version value — sets the minor number of the os version. Defaults to 0. [This option is specific to the i386 PE targeted port of the linker]
• --minor-subsystem-version value — sets the minor number of the subsystem version. Defaults to 0. [This option is specific to the i386 PE targeted port of the linker]
• --output-def file — the linker creates the file file, which will contain a DEF file corresponding to the DLL the linker is generating. 👑 This DEF file (which should be called *.def) may be used to create an import library with dlltool, or may be used as a reference to automatically or implicitly exported symbols. [This option is specific to the i386 PE targeted port of the linker]
• --enable-auto-image-base, --enable-auto-image-base=value — automatically chooses the image base for DLLs, optionally starting with base value, unless one is specified using the --image-base argument. By using a hash generated from the dllname to create unique image bases for each DLL, in-memory collisions and relocations (which can delay program execution, ugh 😭) are avoided. [This option is specific to the i386 PE targeted port of the linker]
• --disable-auto-image-base — do not automatically generate a unique image base. If there's no user-specified image base (--image-base), then it uses the platform default. [This option is specific to the i386 PE targeted port of the linker]
• --dll-search-prefix string — when linking dynamically to a dll without an import library, this searches for <string><basename>.dll in preference to lib<basename>.dll. This behaviour allows easy distinction between DLLs built for the various subplatforms: native, cygwin, uwin, pw, etc. For instance, cygwin DLLs typically use --dll-search-prefix=cyg. 🦋 [This option is specific to the i386 PE targeted port of the linker]
• --enable-auto-import — does sophisticated linking of _symbol to __imp__symbol for DATA imports from DLLs, which makes it possible to bypass the dllimport mechanism on the user side and to reference unmangled symbol names. iconic behaviour honestly ✨ [This option is specific to the i386 PE targeted port of the linker]

Okay so the following remarks pertain to the original implementation of the feature, and they're obsolete nowadays for Cygwin and MinGW targets. So like, historical lore, but we're keeping it because facts are facts. 💜

Note: use of the 'auto-import' extension will cause the text section of the image file to be made writable. This does not conform to the PE-COFF format specification published by Microsoft. ⚠️

Note — use of the 'auto-import' extension will also cause read only data which would normally be placed into the .rdata section to be placed into the .data section instead. That's in order to work around a problem with consts, which is described here: http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html

Using 'auto-import' generally will 'just work' — but sometimes you may see this message:

"variable '<var>' can't be auto-imported. Please read the documentation for ld's "--enable-auto-import" for details."

This message occurs when some (sub)expression accesses an address ultimately given by the sum of two constants (Win32 import tables only allow one). 😭 Instances where this may occur include accesses to member fields of struct variables imported from a DLL, as well as using a constant index into an array variable imported from a DLL. Any multiword variable (arrays, structs, long long, etc) may trigger this error condition. However, regardless of the exact data type of the offending exported variable, ld will always detect it, issue the warning, and exit. No cap.

There are several ways to address this difficulty, regardless of the data type of the exported variable:

One way is to use --enable-runtime-pseudo-reloc switch. This leaves the task of adjusting references in your client code for the runtime environment, so this method works only when the runtime environment supports this feature.

A second solution is to force one of the 'constants' to be a variable — that is, unknown and un-optimizable at compile time. For arrays, there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. Thus:

extern type extern_array[];
extern_array[1] -->
   { volatile type *t=extern_array; t[1] }

or

extern type extern_array[];
extern_array[1] -->
   { volatile int t=1; extern_array[t] }

For structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the ...) variable:

extern struct s extern_struct;
extern_struct.field -->
   { volatile struct s *t=&extern_struct; t->field }

or

extern long long extern_ll;
extern_ll -->
  { volatile long long * local_ll=&extern_ll; *local_ll }

A third method of dealing with this difficulty is to abandon 'auto-import' for the offending symbol and mark it with __declspec(dllimport). However, in practice that requires using compile-time #defines to indicate whether you are building a DLL, building client code that will link to the DLL, or merely building/linking to a static library. In making the choice between the various methods of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:

Original:

--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
  printf("%d\n",arr[1]);
}

Solution 1:

--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
  /* This workaround is for win32 and cygwin; do not "optimize" */
  volatile int *parr = arr;
  printf("%d\n",parr[1]);
}

Solution 2:

…and that's exactly where we're picking this back up next, bestie 🍓 — don't go anywhere, the code examples are not done with us yet 💀

                   --foo.h
                   /* Note: auto-export is assumed (no __declspec(dllexport)) */
                   #if (defined(_WIN32) || defined(__CYGWIN__)) && \
                     !(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
                   #define FOO_IMPORT __declspec(dllimport)
                   #else
                   #define FOO_IMPORT
                   #endif
                   extern FOO_IMPORT int arr[];
                   --foo.c
                   #include "foo.h"
                   void main(int argc, char **argv){
                     printf("%d\n",arr[1]);
                   }

And a fourth way to dodge this whole mess? Re-code your library to use a functional interface instead of a data interface for the offending variables — like, literally just set_foo() and get_foo() accessor functions. Cute, clean, no thunking drama. 💅

• --disable-auto-import — nope out of the fancy linking of "_symbol" to "__imp__symbol" for DATA imports from DLLs. [This option is specific to the i386 PE targeted port of the linker]
• --enable-runtime-pseudo-reloc — if your code has the expressions from the --enable-auto-import section (aka DATA imports from a DLL with non-zero offset), this switch builds a vector of 'runtime pseudo relocations' that the runtime environment can use to adjust references to that data in your client code. [This option is specific to the i386 PE targeted port of the linker]
• --disable-runtime-pseudo-reloc — don't create pseudo relocations for non-zero offset DATA imports from DLLs. [This option is specific to the i386 PE targeted port of the linker]
• --enable-extra-pe-debug — spill extra debug info about auto-import symbol thunking. [This option is specific to the i386 PE targeted port of the linker]
• --section-alignment — sets the section alignment. Sections in memory will always begin at addresses that are a multiple of this number. Defaults to 0x1000. [This option is specific to the i386 PE targeted port of the linker]
• --stack reserve, --stack reserve,commit — say how many bytes of memory to reserve (and optionally commit) as this program's stack. The default is 2MB reserved, 4K committed. [This option is specific to the i386 PE targeted port of the linker]
• --subsystem which, --subsystem which:major, --subsystem which:major.minor — picks the subsystem your program runs under. Legal values for which are "native", "windows", "console", "posix", and "xbox". You can optionally set the subsystem version too. Numeric values are also accepted for which. [This option is specific to the i386 PE targeted port of the linker]

---

The next batch sets flags in the "DllCharacteristics" field of the PE file header: [These options are specific to PE targeted ports of the linker]

• --high-entropy-va, --disable-high-entropy-va — the image is compatible with 64-bit address space layout randomization (ASLR). Enabled by default for 64-bit PE images in MinGW targets. This option also implies --dynamicbase and --enable-reloc-section.
• --dynamicbase, --disable-dynamicbase — the image base address may be relocated using address space layout randomization (ASLR). This feature showed up with MS Windows Vista for i386 PE targets. Enabled by default for MinGW targets, but you can turn it off with --disable-dynamicbase. This option also implies --enable-reloc-section.
• --forceinteg, --disable-forceinteg — code integrity checks are enforced. Disabled by default.
• --nxcompat, --disable-nxcompat — the image is compatible with the Data Execution Prevention. This feature landed with MS Windows XP SP2 for i386 PE targets. Enabled by default for MinGW targets.
• --no-isolation, --disable-no-isolation — the image understands isolation but we do not isolate it. Disabled by default.
• --no-seh, --disable-no-seh — the image doesn't use SEH. No SE handler may be called from this image. Disabled by default.
• --no-bind, --disable-no-bind — do not bind this image. Disabled by default.
• --wdmdriver, --disable-wdmdriver — the driver uses the MS Windows Driver Model. Disabled by default.
• --tsaware, --disable-tsaware — the image is Terminal Server aware. Disabled by default.
• --insert-timestamp, --no-insert-timestamp — insert a real timestamp into the image. That's the default behaviour, because it matches legacy code and means the image works with other, proprietary tools. The catch? It makes slightly different images every time you link the same sources 😭. Use --no-insert-timestamp to insert a zero value for the timestamp instead, which ensures binaries produced from identical sources will compare identically. If --insert-timestamp is active, the time inserted is either the time the linking takes place or, if the "SOURCE_DATE_EPOCH" environment variable is defined, the number of seconds since Unix epoch as specified by that variable.
• --enable-reloc-section, --disable-reloc-section — create the base relocation table, which is necessary if the image is loaded at a different image base than the one specified in the PE header. Enabled by default.

---

The C6X uClinux target uses a binary format called DSBT to support shared libraries. Each shared library in the system needs its own unique index, and all executables use an index of 0. 🦋

• --dsbt-size size — sets the number of entries in the DSBT of the current executable or shared library to size. The default is a table with 64 entries.
• --dsbt-index index — sets the DSBT index of the current executable or shared library to index. The default is 0, which is the right call when generating executables. If a shared library is generated with a DSBT index of 0, the "R_C6000_DSBT_INDEX" relocs are copied into the output file.

Heads up bestie: the --no-merge-exidx-entries switch disables the merging of adjacent exidx entries in frame unwind info. ✨

---

• --branch-stub — this one enables linker branch relaxation by inserting branch stub sections whenever they're needed to extend the range of branches. Usually you don't need it, since C-SKY supports branch and call instructions that can access the full memory range, and branch relaxation is normally handled by the compiler or assembler. So like, lowkey optional.
• --stub-group-size=N — gives you finer control of linker branch stub creation. It sets the maximum size of a group of input sections that can be handled by one stub section. A negative value of N locates stub sections after their branches, while a positive value lets stub sections appear either before or after the branches. Values of 1 or -1 mean the linker should just choose suitable defaults. 🎀

---

The 68HC11 and 68HC12 linkers support specific options to control the memory bank switching mapping and trampoline code generation. 🧚

• --no-trampoline — disables the generation of trampoline. By default a trampoline is generated for each far function which is called using a "jsr" instruction (this happens when a pointer to a far function is taken).
• --bank-window name — tells the linker the name of the memory region in the MEMORY specification that describes the memory bank window. The definition of such a region is then used by the linker to compute paging and addresses within the memory window.

---

The following options control handling of GOT generation when linking for 68K targets. 💜

• --got=type — tells the linker which GOT generation scheme to use. type should be one of single, negative, multigot or target. For more information refer to the Info entry for ld.

---

And these next ones control microMIPS instruction generation and branch relocation checks for ISA mode transitions when linking for MIPS targets. 🌈

• --insn32, --no-insn32 — these control the choice of microMIPS instructions used in code generated by the linker, such as in the PLT, in lazy binding stubs, or in relaxation. If --insn32 is used, the linker only uses 32-bit instruction encodings. By default, or if --no-insn32 is used, all instruction encodings are used, including 16-bit ones where possible.
• --ignore-branch-isa, --no-ignore-branch-isa — these control branch relocation checks for invalid ISA mode transitions. If --ignore-branch-isa is used, the linker accepts any branch relocations, and any ISA mode transition required is lost in relocation calculation — except for some cases of "BAL" instructions which meet relaxation conditions and get converted to equivalent "JALX" instructions as the associated relocation is calculated. By default, or if --no-ignore-branch-isa is used, a check is made, so losing an ISA mode transition produces an error. ⚠️
• --compact-branches, --no-compact-branches — these control the generation of compact instructions by the linker in the PLT entries for MIPS R6.

---

For the pdp11-aout target, three variants of the output format can be produced, selected by the following options. The default variant for pdp11-aout is the --omagic option, whereas for other targets --nmagic is the default. The --imagic option is defined only for the pdp11-aout target, while the others are described here as they apply to the pdp11-aout target. 🍓

• -N, --omagic — marks the output as "OMAGIC" (0407) in the a.out header to indicate that the text segment is not to be write-protected and shared. Since the text and data sections are both readable and writable, the data section is allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs and is the default for ld on PDP11 Unix systems from the beginning through 2.11BSD. vintage icon behaviour fr fr 👑
• -n, --nmagic — stamps the output as "NMAGIC" (0410) in the a.out header, which is the linker's way of saying "bestie, this text portion is read-only and shareable across every process running the same file." To make that happen it shifts the data areas up to the first possible 8K byte page boundary after the end of the text. Bottom line: this option creates a pure executable format. ✨
• -z, --imagic — marks the output as "IMAGIC" (0411) in the a.out header, meaning that when the file runs, the program text and data areas get loaded into separate address spaces using the split instruction and data space feature of the memory management unit in the larger models of the PDP11. It literally doubles the address space available to the program. 🔥 The text segment is again pure, write-protected, and shareable. The only difference in the output format between this option and the others — besides the magic number — is that both the text and data sections start at location 0. Fun lore drop: the -z option selected this format in 2.11BSD. This option creates a separate executable format. 🫶
• --no-omagic — equivalent to --nmagic for pdp11-aout. That's it, that's the whole vibe. 💅

---

🌈 ENVIRONMENT 🌈

Okay so you can absolutely change how ld behaves with the environment variables GNUTARGET, LDEMULATION and COLLECT_NO_DEMANGLE. Let's go through them one by one, no skips. 🎀

GNUTARGET picks the input-file object format when you're not using -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there's no GNUTARGET in the environment, ld just uses the natural format of the target. If GNUTARGET is set to default, then BFD attempts to discover the input format by examining binary input files — and ngl, this method often succeeds, but there are potential ambiguities, since there's no way to ensure the magic number used to specify object-file formats is unique. 😭 The good news? The configuration procedure for BFD on each system places the conventional format for that system first in the search-list, so ambiguities get resolved in favor of convention. Slay.

LDEMULATION sets the default emulation when you're not using the -m option. The emulation can affect various aspects of linker behaviour, particularly the default linker script. You can list the available emulations with the --verbose or -V options. 👑 If -m isn't used and the LDEMULATION environment variable isn't defined, the default emulation depends on how the linker was configured.

Normally the linker defaults to demangling symbols. But if COLLECT_NO_DEMANGLE is set in the environment, then it defaults to not demangling symbols. This environment variable is used in a similar fashion by the gcc linker wrapper program. Either way, the default may be overridden by the --demangle and --no-demangle options. 🦋

If the PE/COFF specific --insert-timestamp is active and the SOURCE_DATE_EPOCH environment variable is defined, then the timestamp value in this variable gets inserted into the COFF header instead of the current time. Reproducibility icon behaviour, honestly. ⭐

If the LD_STATS environment variable is defined, then linker resource use information will be recorded, just as if the --stats option had been used. And here's the cute part: if LD_STATS has a string value, that string is used as the name of a file into which the information should be stored. Otherwise the information gets sent to the standard output stream. 🍓

---

💜 SEE ALSO 💜

ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld. Go read them, they're all part of the same friend group. 🧚

---

🌸 COPYRIGHT 🌸

Copyright (c) 1991-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

---

bestie you made it to the very end, I'm literally so proud of you 😭💖 that's the whole ld man page, every flag, every env var, nothing skipped. go link something iconic.

This one's from binutils-2.45.1, dated 2025-11-10 — that's the page footer, and yes I saved it for last like a little bow on the gift. 🎀 periodt.