LD(1)
💖 ld — The GNU linker (LD(1), GNU Development Tools) 💖
okay bestie, sit down, hydrate, because we're about to talk about the GNU linker and honestly? she's iconic. this is ld from the GNU Development Tools family. let's get into it ✨
🌸 NAME 🌸
ld — The GNU linker. yes bestie, that's her. that's the whole name. short, sweet, links your whole life together 🫶
✨ SYNOPSIS ✨
ld [options] objfile ...that's it. that's the vibe. options, then object files, in whatever order your heart desires (with one tiny caveat we'll get to, promise) 💅
🦋 DESCRIPTION 🦋
so like, what does ld even do? okay so basically ld takes a bunch of object files and archive files, relocates their data, and ties up symbol references. that's the whole job. usually the very last step in compiling a program is running ld, so she's literally the finale of the whole build process. main character energy, no cap 👑
ld also accepts Linker Command Language files, written in a superset of AT&T's Link Editor Command Language syntax. why do you care? because that gives you explicit and total control over the linking process. total. control. periodt.
ok real talk though — this man page does not describe the command language. if you want the full tea on the command language and other aspects of the GNU linker, go read theldentry ininfo. this page is just the CLI girlies' guide 🎀
this version of ld uses the general purpose BFD libraries to operate on object files. why is that slay? because it means ld can read, combine, and write object files in many different formats — for example, COFF or "a.out". and yes, different formats may be linked together to produce any available kind of object file. versatility queen 💜
aside from all that flexibility, the GNU linker is genuinely more helpful than other linkers when it comes to diagnostic info. lots of linkers just ✨abandon execution immediately✨ the second they hit an error. rude. ld, whenever possible, keeps going, so you can identify other errors — or, in some cases, actually get an output file in spite of the error. she's forgiving like that. we love a supportive queen 😭
the GNU linker ld is meant to cover a broad range of situations and to be as compatible as possible with other linkers. as a result, you have many choices to control its behavior. so. many. choices. buckle up 🌈
💅 OPTIONS 💅
the linker supports a plethora of command-line options, but in actual practice few of them get used in any particular context. like, for instance, a super frequent use of ld is just linking standard Unix object files on a standard, supported Unix system. on such a system, to link a file "hello.o":
ld -o <output> /lib/crt0.o hello.o -lcwhat's happening here? this tells ld to produce a file called output as the result of linking the file "/lib/crt0.o" with "hello.o" and the library "libc.a", which comes from the standard search directories. (see the discussion of the -l option below, bestie, we'll get there 💖)
okay now the important structural stuff:
some of the command-line options to ld may be specified at any point in the command line. cute. but options which refer to files — like -l or -T — cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. so order matters there, lowkey 🫠
repeating non-file options with a different argument will either have no further effect, or override prior occurrences (those further to the left on the command line) of that option. options that can meaningfully be specified more than once are noted in the descriptions below. iykyk.
non-option arguments are object files or archives which are to be linked together. they may follow, precede, or be mixed in with command-line options — except that an object file argument may not be placed between an option and its argument. do not do that. that's the one rule 🚫
usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. if no binary input files at all are specified, the linker does not produce any output, and issues the message:
No input files.😭 she's not mad, she's just disappointed.
if the linker cannot recognize the format of an object file, it will assume that it is a linker script. a script specified in this way augments the main linker script used for the link — either the default linker script or the one specified by using -T. this feature lets the linker link against a file which looks like an object or an archive, but actually just defines some symbol values, or uses "INPUT" or "GROUP" to load other objects. sneaky? a little. useful? absolutely.
heads up: specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script. if you want to replace the default linker script entirely, use the-Toption — but note the effect of the"INSERT"command when you do. 🎀
on single-letter options: for options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them.
on multiple-letter options: either one dash or two can precede the option name. for example, -trace-symbol and --trace-symbol are equivalent. so chill. but — and there's always a but — there is one exception to this rule. multiple-letter options that start with a lower case 'o' can only be preceded by two dashes. why? to reduce confusion with the -o option. so for example:
-omagicsets the output file name tomagic--omagicsets the NMAGIC flag on the output
see how different those are?? be careful bestie 💀
arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. for example, --trace-symbol foo and --trace-symbol=foo are equivalent. also: unique abbreviations of the names of multiple-letter options are accepted. fancy ✨
big warning energy: if the linker is being invoked indirectly, via a compiler driver (e.g.gcc), then all the linker command-line options should be prefixed by-Wl,— or whatever is appropriate for the particular compiler driver — like this:gcc -Wl,--start-group foo.o bar.o -Wl,--end-groupthis is important because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. 😭 confusion may also arise when passing options that require values through a driver, since the use of a space between option and argument acts as a separator — which causes the driver to pass only the option to the linker and the argument to the compiler. in that case, simplest fix: use the joined forms of both single- and multiple-letter options, like this:gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.map
here is a table of the generic command-line switches accepted by the GNU linker. (it's a list here, not a table, because we're cute like that 💅)
@file— reads command-line options from file. the options read are inserted in place of the original@fileoption. if file does not exist, or cannot be read, then the option will be treated literally, and not removed.
options in file are separated by whitespace. a whitespace character may be included in an option by surrounding the entire option in either single or double quotes. any character (including a backslash) may be included by prefixing the character to be included with a backslash. the file may itself contain additional @file options; any such options will be processed recursively. 🌀
-akeyword — this option is supported for HP/UX compatibility. the keyword argument must be one of the stringsarchive,shared, ordefault.-aarchiveis functionally equivalent to-Bstatic, and the other two keywords are functionally equivalent to-Bdynamic. this option may be used any number of times 🫶--auditAUDITLIB — adds AUDITLIB to the"DT_AUDIT"entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. if specified multiple times,"DT_AUDIT"will contain a colon separated list of audit interfaces to use. if the linker finds an object with an audit entry while searching for shared libraries, it will add a corresponding"DT_DEPAUDIT"entry in the output file. this option is only meaningful on ELF platforms supporting the rtld-audit interface.-binput-format--format=input-format —ldmay be configured to support more than one kind of object file. if yourldis configured this way, you can use the-boption to specify the binary format for input object files that follow this option on the command line. even whenldis configured to support alternative object formats, you don't usually need to specify this, becauseldshould be configured to expect as a default input format the most usual format on each machine. input-format is a text string — the name of a particular format supported by the BFD libraries. (you can list the available binary formats withobjdump -i.) 🌸
you may want to use this option if you are linking files with an unusual binary format. you can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format.
the default format is taken from the environment variable "GNUTARGET".
you can also define the input format from a script, using the command "TARGET".
-cMRI-commandfile--mri-script=MRI-commandfile — for compatibility with linkers produced by MRI,ldaccepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. introduce MRI script files with the option-c; use the-Toption to run linker scripts written in the general-purposeldscripting language. if MRI-cmdfile does not exist,ldlooks for it in the directories specified by any-Loptions. 🔍-d-dc-dp— these three options are equivalent; multiple forms are supported for compatibility with other linkers. they assign space to common symbols even if a relocatable output file is specified (with-r). the script command"FORCE_COMMON_ALLOCATION"has the same effect ✨--depauditAUDITLIB-PAUDITLIB — adds AUDITLIB to the"DT_DEPAUDIT"entry of the dynamic section. AUDITLIB is not checked for existence, nor will it use the DT_SONAME specified in the library. if specified multiple times,"DT_DEPAUDIT"will contain a colon separated list of audit interfaces to use. this option is only meaningful on ELF platforms supporting the rtld-audit interface. the-Poption is provided for Solaris compatibility 💜--enable-linker-version— enables the"LINKER_VERSION"linker script directive, described in Output Section Data. if this directive is used in a linker script and this option has been enabled, then a string containing the linker version will be inserted at the current point. 🎀
note — the location of this option on the linker command line is significant. it will only affect linker scripts that come after it on the command line, or which are built into the linker. order matters bestie!!
--disable-linker-version— disables the"LINKER_VERSION"linker script directive, so that it does not insert a version string. this is the default. 🙈--enable-non-contiguous-regions— okay so bestie, normally if an input section doesn't fit into the output section it matched up with, the linker just throws an error and ruins your whole day 😭. This flag is like "no babe, keep looking." The linker will try to shove that input section into the next matching output sections instead, and it only actually errors out if no output section is big enough. Lowkey iconic when you've got several non-contiguous memory regions sitting around and your input section doesn't care which one it lands in. The order input sections get evaluated in does NOT change, fr fr:
MEMORY {
MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
mem1 : { *(.data.*); } > MEM1
mem2 : { *(.data.*); } > MEM2
mem3 : { *(.data.*); } > MEM3
}
with input sections:
.data.1: size 8
.data.2: size 0x10
.data.3: size 4
results in .data.1 affected to mem1, and .data.2 and .data.3
affected to mem2, even though .data.3 would fit in mem3.Heads up bestie: this one is incompatible with INSERT statements, because it literally changes the way input sections get mapped to output sections. So pick a lane 💅.
--enable-non-contiguous-regions-warnings— turns on warnings whenever--enable-non-contiguous-regionslets a section match up in a way that's possibly unexpected, which could 🫣 silently discard a section instead of failing like it normally would when it doesn't fit any output region. Basically the "are you SURE, girl?" alarm.-eentry — and--entry=entry — use entry as the explicit symbol for where your program starts executing, instead of the default entry point. If there's no symbol named entry, the linker tries to parse entry as a number and uses that as the entry address. That number gets read in base 10, but you can slap a leading0xon it for base 16, or a leading0for base 8. And for i386 PE specifically, entry can also be the original function name (without the leading underscore and/or the trailing stdcall@numberwhen applicable). Periodt.--exclude-libslib,lib,... — gives a list of archive libraries whose symbols should not be automatically exported. The library names can be delimited by commas or colons, your choice 🎀. Say--exclude-libs ALLand every symbol in every archive library gets excluded from automatic export. This is only available for ELF and PE targeted ports of the linker. For PE targets, symbols you explicitly listed in a.deffile still get exported no matter what this option says. For ELF ports, symbols hit by this option get treated ashidden.--exclude-modules-for-implibmodule,module,... — a list of object files or archive members whose symbols should not be auto-exported, but which should be copied wholesale into the import library being generated during the link. Delimiters can be commas or colons. The module names have to match EXACTLY the filenamesldused to open the files — for archive members that's just the member name, but for object files the name you list must include and match precisely any path used to specify the input file on the linker's command-line. Symbols explicitly listed in a.deffile are still exported regardless of this option. [This option is specific to PE targeted ports of the linker]-E—--export-dynamic—--no-export-dynamic— when you're making a dynamically linked executable,-Eor--export-dynamicmakes the linker add all symbols to the dynamic symbol table 📋. That table is the set of symbols visible from dynamic objects at run time. If you don't use either of these (or you use--no-export-dynamicto restore the default behavior), the dynamic symbol table will normally only contain the symbols that are referenced by some dynamic object mentioned in the link. So if you usedlopento load a dynamic object that needs to refer back to symbols defined by the program itself (not some other dynamic object), you'll probably need this option when linking the program. You can also use the dynamic list to control what symbols get added to the dynamic symbol table, if the output format supports it — see the description of--dynamic-list. And note: this option is specific to ELF targeted ports. PE targets have a similar thing for exporting all symbols from a DLL or EXE — go read--export-all-symbolsbelow ✨.--export-dynamic-symbol=glob — when making a dynamically linked executable, symbols matching glob get added to the dynamic symbol table. When making a shared library, references to symbols matching glob will not be bound to the definitions within the shared library. This option is a no-op when creating a shared library and-Bsymbolicor--dynamic-listare not specified. Only meaningful on ELF platforms which support shared libraries, bestie.--export-dynamic-symbol-list=file — say--export-dynamic-symbolfor each pattern in file. The format of the file is the same as the version node without scope and node name. See VERSION for more info 🌸.-EB— link big-endian objects. This affects the default output format.-EL— link little-endian objects. This affects the default output format.-fname —--auxiliary=name — when creating an ELF shared object, set the internalDT_AUXILIARYfield to name. This tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name 🦋. So if you later link a program against this filter object, then when you run the program the dynamic linker will see thatDT_AUXILIARYfield. If it resolves any symbols from the filter object, it first checks whether there's a definition in the shared object name. If there is one, that gets used instead of the definition in the filter object. And plot twist: the shared object name doesn't even need to exist 😳. Which means name can be used to provide an alternative implementation of certain functions — maybe for debugging, maybe for machine-specific performance. This option can be specified more than once, and theDT_AUXILIARYentries get created in the order they appear on the command line.-Fname —--filter=name — when creating an ELF shared object, set the internalDT_FILTERfield to name. This tells the dynamic linker that the symbol table of the shared object being created should be used as a filter on the symbol table of the shared object name. So if you link a program against this filter object later, then when you run it the dynamic linker sees theDT_FILTERfield. It resolves symbols according to the filter object's symbol table as usual, but it actually links to the definitions found in the shared object name. So the filter object is basically picking a subset of the symbols the object name provides 💅. Some older linkers used-Fall over a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker does that differently: via the-b,--format,--oformatoptions, theTARGETcommand in linker scripts, and theGNUTARGETenvironment variable. GNUldwill ignore-Fwhen it's not creating an ELF shared object. k thanks bye 👋-fini=name — when creating an ELF executable or shared object, callNAMEwhen the executable or shared object is unloaded, by settingDT_FINIto the address of the function. By default the linker uses_finias the function to call. 🎬-g— ignored. Just there for compatibility with other tools. She's doing nothing but she's showing up 💀.-Gvalue —--gpsize=value — set the maximum size of objects to be optimized using the GP register to value. Only meaningful for object file formats like MIPS ELF that support putting large and small objects into different sections. Ignored for every other object file format.-hname —-soname=name — when creating an ELF shared object, set the internalDT_SONAMEfield to name. When an executable gets linked with a shared object that has aDT_SONAMEfield, then when the executable runs, the dynamic linker will try to load the shared object specified by thatDT_SONAMEfield rather than using the file name given to the linker. 👑-i— perform an incremental link (same as option-r).-init=name — when creating an ELF executable or shared object, callNAMEwhen the executable or shared object is loaded, by settingDT_INITto the address of the function. By default the linker uses_initas the function to call. ✨-lnamespec —--library=namespec — add the archive or object file specified by namespec to the list of files to link. You can use this option any number of times, no limit bestie. If namespec is of the form:filename,ldsearches the library path for a file called filename; otherwise it searches the library path for a file calledlibnamespec.a. On systems that support shared libraries,ldmay also look for files other thanlibnamespec.a— specifically, on ELF and SunOS systems,ldsearches a directory for a library calledlibnamespec.sobefore searching for one calledlibnamespec.a. (By convention, a.soextension means shared library.) And note that this behavior does NOT apply to:filename, which always means a file literally called filename. Now here's the important bit:
The linker searches an archive only once, at the location where it's specified on the command line 🫶. If the archive defines a symbol that was undefined in some object appearing before the archive on the command line, the linker will include the appropriate file(s) from the archive. But an undefined symbol in an object appearing later on the command line will not make the linker go back and search that archive again. See the -( option if you want to force the linker to search archives multiple times. And yes, you may list the same archive multiple times on the command line, go off 🎀.
okay so this flavour of archive searching? it's literally the standard move for Unix linkers. but real talk bestie — if you're running ld on AIX, note that it is different from the behaviour of the AIX linker. different universe, different rules 😭
-L searchdir,--library-path=searchdir— adds the path searchdir to the list of paths thatldwill go hunting through for archive libraries andldcontrol scripts. you can use this option any number of times 💅. the directories get searched in the order you specified them on the command line. directories you named on the command line are searched before the default directories. and here's the iconic bit: all-Loptions apply to all-loptions, regardless of the order in which the options appear.-Loptions do not affect howldsearches for a linker script unless the-Toption is specified.
if searchdir begins with = or $SYSROOT, then this prefix will be replaced by the sysroot prefix — controlled by the --sysroot option, or specified when the linker was configured. ✨
the default set of paths searched (without you specifying them with -L) depends on which emulation mode ld is using, and in some cases also on how it was configured. no cap.
the paths can also be specified in a link script with the "SEARCH_DIR" command. directories specified this way are searched at the point in which the linker script appears in the command line. 🫶
-m emulation— emulate the emulation linker. you can list the available emulations with the--verboseor-Voptions. 👑
if the -m option is not used, the emulation is taken from the "LDEMULATION" environment variable, if that is defined. (yes, an env var, she's mysterious like that 🌸)
otherwise, the default emulation depends upon how the linker was configured. it's giving "it depends" fr fr.
--remap-inputs=pattern=filename,--remap-inputs-file=file— these options let the names of input files be changed before the linker even attempts to open them. so--remap-inputs=foo.o=bar.owill cause any attempt to load a file calledfoo.oto instead try to load a file calledbar.o. wildcard patterns are permitted in the first filename, so--remap-inputs=foo*.o=bar.owill rename any input file that matchesfoo*.otobar.o. shapeshifting, but for files 🦋
there's an alternative form, --remap-inputs-file=filename, that lets the remappings be read from a file. each line in the file can contain a single remapping. blank lines are ignored. anything from a hash character (#) to the end of a line is considered to be a comment and is also ignored. the mapping pattern can be separated from the filename by whitespace or an equals (=) character.
the options can be specified multiple times. their contents accumulate. the remappings will be processed in the order in which they occur on the command line, and if they come from a file, in the order in which they occur in the file. if a match is made, no further checking for that filename will be performed — first match wins, periodt.
if the replacement filename is /dev/null or just NUL then the remapping will actually cause the input file to be ignored. this can be a convenient way to experiment with removing input files from a complicated build environment. 🧚
note that this option is position dependent and only affects filenames that come after it on the command line. so:
ld foo.o --remap-inputs=foo.o=bar.owill have no effect, whereas:
ld --remap-inputs=foo.o=bar.o foo.owill rename the input file foo.o to bar.o. order matters, bestie 😭
note — these options also affect files referenced by INPUT statements in linker scripts. but since linker scripts are processed after the entire command line is read, the position of the remap options on the command line is not significant.
if the verbose option is enabled then any mappings that match will be reported, although again the verbose option needs to be enabled on the command line before the remaped filenames appear.
if the -Map or --print-map options are enabled then the remapping list will be included in the map output. 📝
-M,--print-map— prints a link map to the standard output. a link map gives you the tea about the link, including the following:- where object files are mapped into memory.
- how common symbols are allocated.
- all archive members included in the link, with a mention of the symbol which caused the archive member to be brought in. 👑
- the values assigned to symbols.
note — symbols whose values are computed by an expression which involves a reference to a previous value of the same symbol may not have correct result displayed in the link map. this is because the linker discards intermediate results and only retains the final value of an expression. under such circumstances the linker will display the final value enclosed by square brackets. so for example a linker script containing:
foo = 1
foo = foo * 4
foo = foo + 8will produce the following output in the link map if the -M option is used:
0x00000001 foo = 0x1
[0x0000000c] foo = (foo * 0x4)
[0x0000000c] foo = (foo + 0x8)see Expressions for more information about expressions in linker scripts. 🌈
- how GNU properties are merged.
when the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties are removed or updated. these actions are reported in the link map. for example:
Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)this indicates that property 0xc0000002 is removed from output when merging properties in foo.o, whose property 0xc0000002 value is 0x1, and bar.o, which doesn't have property 0xc0000002. 💀
Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)this indicates that property 0xc0010001 value is updated to 0x1 in output when merging properties in foo.o, whose 0xc0010001 property value is 0x1, and bar.o, whose 0xc0010001 property value is 0x1.
- on some ELF targets, a list of fixups inserted by
--relax:
foo.o: Adjusting branch at 0x00000008 towards "far" in section .textthis indicates that the branch at 0x00000008 in foo.o, targeting the symbol "far" in section .text, has been replaced by a trampoline. acrobatics ✨
--print-map-discarded,--no-print-map-discarded— print (or do not print) the list of discarded and garbage collected sections in the link map. enabled by default.--print-map-locals,--no-print-map-locals— print (or do not print) local symbols in the link map. local symbols will have the text(local)printed before their name, and will be listed after all of the global symbols in a given section. temporary local symbols (typically those that start with.L) will not be included in the output. disabled by default.-n,--nmagic— turns off page alignment of sections, and disables linking against shared libraries. if the output format supports Unix style magic numbers, it marks the output as"NMAGIC". 🎀-N,--omagic— sets the text and data sections to be readable and writable. also, does not page-align the data segment, and disables linking against shared libraries. if the output format supports Unix style magic numbers, it marks the output as"OMAGIC".
note: although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. 🙈
--no-omagic— this option negates most of the effects of the-Noption. it sets the text section to be read-only, and forces the data segment to be page-aligned.
note — this option does not enable linking against shared libraries. use -Bdynamic for this. don't skip that part bestie 💅
-o output,--output=output— use output as the name for the program produced byld; if this option is not specified, the namea.outis used by default. the script command"OUTPUT"can also specify the output file name.
note — the linker will delete the output file before it starts to write to it. it will do this even if it turns out that the link cannot be completed due to errors. yes. it's that girl. 😭
note — the linker will check to make sure that the output file name does not match the name of any of the input files, but that is all. in particular it will not complain if the output file might overwrite a source file or some other important file. therefore in build systems it is recommended to use the -o option as the last option on the linker command line. for example consider:
ld -o $(EXE) $(OBJS)
ld $(OBJS) -o $(EXE)if the EXE variable is not defined for some reason, the first version of the linker command could end up deleting one of the object files (the first one in the OBJS list) whereas the second version of the linker command will generate an error message and not delete anything. protect your files bestie, put -o last 🙏
--dependency-file=depfile— write a dependency file to depfile. this file contains a rule suitable for"make"describing the output file and all the input files that were read to produce it. the output is similar to the compiler's output with-M -MP.
note that there is no option like the compiler's-MM, to exclude "system files" (which is not a well-specified concept in the linker, unlike "system headers" in the compiler). so the output from--dependency-fileis always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. ⚠️
-O level— if level is a numeric values greater than zeroldoptimizes the output. this might take significantly longer and therefore probably should only be enabled for the final binary. at the moment this option only affects ELF shared library generation. future releases of the linker may make more use of this option. also currently there is no difference in the linker's behaviour for different non-zero values of this option. again this may change with future releases. so like… for now it's-Oon or off, glow up TBD ✨
If level is zero or the string fast, then ld does the opposite vibe — it skips the operations that are technically optional. You get a faster link, but the binaries it spits out are slower and chonkier. ✨ Right now the only thing being skipped is the combining of mergeable sections, but genuinely that could change in the future, so don't hardcode your whole personality around it.
If level is the string default or literally just the - character, then you get the linker's default behaviour: no optimizing, no skipping. Just vibes. Balanced. 💅
-pluginname — pulls a plugin into the linking process, bestie. The name parameter is the absolute filename of the plugin. Usually your compiler adds this one automatically when you're doing link time optimization, but nothing's stopping you from adding your own plugins if that's your thing. 🦋
Heads up though: compiler-originated plugins live somewhere different from where ar, nm and ranlib go looking for theirs. So if you want those commands to actually use a compiler-based plugin, you have to copy it into the ${libdir}/bfd-plugins directory first. Good news: all gcc based linker plugins are backward compatible, so just copying in the newest one is enough. ✨
--push-state— saves the current state of all the flags that govern input file handling, so you can bring them all back later with one matching--pop-state. It's giving "save point in a video game", lowkey iconic. 🎀
The options covered by this are: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, --link-mapless, --no-link-mapless, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a.
One target for this option is pkg-config specifications. When it's used with the --libs option, all possibly needed libraries get listed and then possibly linked in all the time. It's way better to return something like this:
-Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state--pop-state— undoes whatever--push-statedid and restores the previous values of those input-file-handling flags. The rewind button. 💫-q,--emit-relocs— keeps relocation sections and their contents in fully linked executables. Post-link analysis and optimization tools might need this info to correctly modify executables. Downside? Bigger executables. 😭
Currently this one's only supported on ELF platforms, no cap.
--force-dynamic— forces the output file to have dynamic sections. This one is specific to VxWorks targets. 🧚-r,--relocatable— generates relocatable output, which means the output file can itself be fed back intoldas input later. People call this partial linking. As a side effect, in environments that support standard Unix magic numbers, this option also sets the output file's magic number to"OMAGIC". If you don't specify this option, you get an absolute file instead. ⭐
Important: when you're linking C++ programs, this option will not resolve references to constructors. To do that, use -Ur instead.
When an input file doesn't match the format of the output file, partial linking is only supported if that input file has no relocations in it. Different output formats can have even more restrictions — for example, some "a.out"-based formats don't support partial linking with input files in other formats at all. 💀
When the relocatable output contains both stuff that requires link-time optimization (LTO) and stuff that doesn't, a .gnu_object_only section gets created to hold a relocatable object file, as if -r was applied to all relocatable inputs that don't need LTO. And when the linker processes a relocatable input that has a .gnu_object_only section, it extracts that .gnu_object_only section as a separate input.
Also worth knowing: since -r groups some sections from different input files together, there may be negative impacts on code size and locality in the final executable or shared library. 🫶
This option does the exact same thing as -i.
-Rfilename /--just-symbols=filename — reads symbol names and their addresses from filename, but does not relocate it and does not include it in the output. This lets your output file refer symbolically to absolute memory locations defined in other programs. You can use this option more than once. 🌸
For compatibility with other ELF linkers: if -R is followed by a directory name instead of a file name, it's treated as the -rpath option instead. Sneaky but iconic.
--rosegment,--no-rosegment— tries to make sure only a single read-only, non-code segment gets created. Only useful when paired with the-z separate-codeoption. The resulting binaries should be smaller than if you used-z separate-codeon its own. Without this option — or if--no-rosegmentis given — the-z separate-codeoption creates two read-only segments, one before the code segment and one after it.
The names of these options are genuinely misleading, but they were picked so the linker stays compatible with the LLD and GOLD linkers. Weird flex but okay.
These options are only supported by ELF targets.
-s,--strip-all— omits all symbol information from the output file. Nothing left. Gone. 💅-S,--strip-debug— omits debugger symbol information from the output file, but not all the symbols. A more surgical strip. ✨--strip-discarded,--no-strip-discarded— omits (or doesn't omit) global symbols defined in discarded sections. Enabled by default, so it's already doing its thing unless you say otherwise.-plugin-save-temps— stores the plugin's "temporary" intermediate files permanently. The quotes around temporary are doing a lot of heavy lifting there ngl. 🎀-t,--trace— prints the names of the input files asldprocesses them. If you pass-ttwice, then members within archives get printed too. The-toutput is super useful for generating a list of all the object files and scripts involved in linking — for example, when you're packaging files for a linker bug report. Chef's kiss for debugging. 🔥-Tscriptfile /--script=scriptfile — uses scriptfile as the linker script. This script replacesld's default linker script rather than adding to it — unless the script contains"INSERT", in which case commandfile must specify everything necessary to describe the output file.
If scriptfile doesn't exist in the current directory, ld goes looking for it in the directories given by any preceding -L options. 👑
Command line options that appear before the -T option can affect the script, but command line options that appear after it don't. Order matters, bestie.
Multiple -T options will accumulate if they're augmenting the current script; otherwise the last, non-augmenting -T option wins.
There are other ways of specifying linker scripts. See
-dTscriptfile /--default-script=scriptfile — uses scriptfile as the default linker script.
This is like the --script option, except the processing of the script is delayed until after the rest of the command line has been processed. That means options placed after the --default-script option on the command line can affect the behaviour of the linker script. Which is actually important when the linker command line can't be directly controlled by you — e.g. because the command line is being constructed by another tool, like gcc. 🦋
-usymbol /--undefined=symbol — forces symbol to be entered in the output file as an undefined symbol. Doing this may, for example, trigger linking of additional modules from standard libraries.-ucan be repeated with different option arguments to enter more undefined symbols. This option is equivalent to the"EXTERN"linker script command. ⭐
If you're using this to force additional modules into the link, and it's actually an error for the symbol to remain undefined, then use --require-defined instead. Right tool, right job.
--require-defined=symbol — requires that symbol is defined in the output file. This is the same as--undefinedexcept that if symbol isn't defined in the output file, the linker throws an error and exits. You can get the same effect in a linker script by using"EXTERN","ASSERT"and"DEFINED"together. Can be used multiple times to require additional symbols. 💖-Ur— for programs that don't use constructors or destructors, or for ELF based systems, this is equivalent to-r: it generates relocatable output, meaning an output file that can in turn serve as input told. For other binaries though,-Uris similar to-rbut it also resolves references to constructors and destructors. 🌈
For systems where -r and -Ur behave differently, it does not work to use -Ur on files that were themselves linked with -Ur. Once the constructor table has been built, you can't add to it. Periodt. So use -Ur only for the last partial link, and -r for all the others.
--orphan-handling=MODE — controls how orphan sections are handled. An orphan section is one that isn't specifically mentioned in a linker script. 🧚
MODE can be any of these values:
"place"— orphan sections get placed into a suitable output section following the strategy described in Orphan Sections. The--uniqueoption also affects how sections are placed."discard"— all orphan sections are discarded, by placing them in the/DISCARD/section. 💀"warn"— the linker places the orphan section as for"place"and also issues a warning."error"— the linker exits with an error if any orphan section is found.
If you never pass --orphan-handling, the default is "place".
--unique[=SECTION]** — creates a separate output section for every input section matching SECTION. Or, if the optional wildcard SECTION argument is missing, for every orphan input section. (An orphan section is one not specifically mentioned in a linker script.) You can use this option multiple times on the command line. It prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script. 🎀-v,--version,-V— displays the version number forld. The-Voption also lists the supported emulations. See also the description of the--enable-linker-versionin Options,,Command-line Options, which can be used to insert the linker version string into a binary. ✨-x,--discard-all— deletes all local symbols. Bye bestie. 👋
okay bestie we're back and yes we are STILL inside the -z keyword list, the saga continues, hydrate before you scroll 💖
-X,--discard-locals— yeets every temporary local symbol into the void. these symbols start with system-specific local label prefixes — usually.Lon ELF systems, orLon old-school traditional a.out systems. gone, deleted, not invited back 🗑️-y symbol,--trace-symbol=symbol— prints the name of every linked file where symbol shows up. and bestie you can throw this flag down as many times as you want, no cap. heads up tho: on many systems you gotta prepend an underscore. this one is a lifesaver when you've got an undefined symbol in your link and absolutely zero clue where the reference is coming from 🔍 (we've all been there, crying in the terminal)-Y path— adds path to the default library search path. this option is out here purely for Solaris compatibility. that's it, that's the tea ☕-z keyword— okay now the big one. these are the recognized keyword values, buckle up:call-nop=prefix-addr/call-nop=suffix-nop/call-nop=prefix-byte/call-nop=suffix-byte— sets the 1-byte"NOP"padding used when transforming an indirect call to a locally defined function,foo, via its GOT slot.call-nop=prefix-addrspits out"0x67 call foo".call-nop=suffix-nopspits out"call foo 0x90".call-nop=prefix-bytespits out"byte call foo".call-nop=suffix-bytespits out"call foo byte".- supported for i386 and x86_64 ✨
cet-report=none/cet-report=warning/cet-report=error— tells the linker how to report missingGNU_PROPERTY_X86_FEATURE_1_IBTandGNU_PROPERTY_X86_FEATURE_1_SHSTKproperties in the input.note.gnu.propertysection.cet-report=noneis the default and means the linker won't report missing properties in input files.cet-report=warningmakes it throw a warning, andcet-report=errormakes it throw an actual error. lowkey important:ibtwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_IBTproperty report, andshstkwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_SHSTKproperty report. supported for Linux/i386 and Linux/x86_64 💅combreloc/nocombreloc—combreloccombines multiple dynamic relocation sections and sorts them to make dynamic symbol lookup caching faster. literally do not do this if it'snocombreloc🙈common/nocommon—commongenerates common symbols withSTT_COMMONtype during a relocatable link. useSTT_OBJECTtype if it'snocommon.common-page-size=value— sets the most commonly used page size to value. memory image layout gets optimized to minimize memory pages if the system is using pages of this size ✨defs— reports unresolved symbol references from regular object files. this happens even if the linker is creating a non-symbolic shared library. this option is the inverse of-z undefs. (they're enemies, your honor)dynamic-undefined-weak/nodynamic-undefined-weak— makes undefined weak symbols dynamic when building a dynamic object, as long as they're referenced from a regular object file and not forced local by symbol visibility or versioning.nodynamic-undefined-weaksays do NOT make them dynamic. if neither option is given, a target may default to either one being in force, or make some other selection of undefined weak symbols dynamic. not all targets support these options, so vibe check your target first 🦋execstack— marks the object as requiring an executable stack.global— only meaningful when building a shared object. it makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries.globalaudit— only meaningful when building a dynamic executable. it marks the executable as requiring global auditing by setting the"DF_1_GLOBAUDIT"bit in the"DT_FLAGS_1"dynamic tag. global auditing requires that any auditing library defined via the--depauditor-Pcommand-line options be run for all dynamic objects loaded by the application 👑ibtplt— generates Intel Indirect Branch Tracking (IBT) enabled PLT entries. supported for Linux/i386 and Linux/x86_64.ibt— generatesGNU_PROPERTY_X86_FEATURE_1_IBTin the.note.gnu.propertysection to indicate compatibility with IBT. this also impliesibtplt. supported for Linux/i386 and Linux/x86_64 🔥indirect-extern-access/noindirect-extern-access— generatesGNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESSin the.note.gnu.propertysection to indicate that the object file requires canonical function pointers and cannot be used with copy relocation. this option also impliesnoextern-protected-dataandnocopyreloc. supported for i386 and x86-64.noindirect-extern-accessremovesGNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESSfrom the.note.gnu.propertysection.
initfirst— only meaningful when building a shared object. it marks the object so its runtime initialization happens before the runtime initialization of any other objects brought into the process at the same time. similarly, the object's runtime finalization happens after the runtime finalization of any other objects. main character energy, it goes first and leaves last 💅interpose— tells the dynamic loader to modify its symbol search order so that symbols in this shared library interpose all other shared libraries not so marked.unique/nounique— when generating a shared library or other dynamically loadable ELF object, marks it as one that should (by default) only ever be loaded once, and only in the main namespace (when using"dlmopen"). this is primarily used to mark fundamental libraries like libc, libpthread et al, which don't usually function correctly unless they're the sole instances of themselves. this behaviour can be overridden by the"dlmopen"caller and does not apply to certain loading mechanisms (such as audit libraries). periodt 💖lam-u48— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U48in the.note.gnu.propertysection to indicate compatibility with Intel LAM_U48. supported for Linux/x86_64.lam-u57— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U57in the.note.gnu.propertysection to indicate compatibility with Intel LAM_U57. supported for Linux/x86_64.lam-u48-report=none/lam-u48-report=warning/lam-u48-report=error— sets how to report the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48property in the input.note.gnu.propertysection.lam-u48-report=noneis the default and makes the linker not report missing properties in input files.lam-u48-report=warningissues a warning,lam-u48-report=errorissues an error. supported for Linux/x86_64 ✨lam-u57-report=none/lam-u57-report=warning/lam-u57-report=error— same deal, but for the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U57property in the input.note.gnu.propertysection.lam-u57-report=noneis the default (no reporting),lam-u57-report=warningwarns,lam-u57-report=errorerrors out. supported for Linux/x86_64 ✨lam-report=none/lam-report=warning/lam-report=error— sets how to report the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48andGNU_PROPERTY_X86_FEATURE_1_LAM_U57properties in the input.note.gnu.propertysection.lam-report=noneis the default (no reporting),lam-report=warningwarns,lam-report=errorerrors out. supported for Linux/x86_64 ✨lazy— when generating an executable or shared library, marks it to tell the dynamic linker to defer function call resolution until the point when the function is actually called (lazy binding), rather than at load time. lazy binding is the default, so yeah, procrastination is literally the standard 🛋️loadfltr— specifies that the object's filters be processed immediately at runtime.max-page-size=value— sets the maximum memory page size supported to value.mark-plt/nomark-plt— marks PLT entries with dynamic tagsDT_X86_64_PLT,DT_X86_64_PLTSZandDT_X86_64_PLTENT. since this option stores a non-zero value in ther_addendfield ofR_X86_64_JUMP_SLOTrelocations, the resulting executables and shared libraries are incompatible with dynamic linkers, such as those in older versions of glibc without the change to ignorer_addendinR_X86_64_GLOB_DATandR_X86_64_JUMP_SLOTrelocations, which don't ignore ther_addendfield ofR_X86_64_JUMP_SLOTrelocations. supported for x86_64 ⚠️ (yes that sentence is a mouthful, read it twice bestie)muldefs— allows multiple definitions. chaotic, and we support it 💀nocopyreloc— disables linker generated.dynbssvariables used in place of variables defined in shared libraries. may result in dynamic text relocations. (may cause drama, proceed with awareness)nodefaultlib— specifies that the dynamic loader's search for dependencies of this object should ignore any default library search paths.nodelete— specifies that the object shouldn't be unloaded at runtime. it stays. forever. iconic energy 🎀nodlopen— specifies that the object is not available to"dlopen".nodump— specifies that the object cannot be dumped by"dldump".noexecstack— marks the object as not requiring executable stack. (opposite twin ofexecstack)noextern-protected-data— don't treat protected data symbols as external when building a shared library. this option overrides the linker backend default. it can be used to work around incorrect relocations against protected data symbols generated by the compiler. updates on protected data symbols by another module aren't visible to the resulting shared library. supported for i386 and x86-64 🌸-z noreloc-overflow— turns OFF the relocation overflow check. You'd only do this if you know there's not gonna be any dynamic relocation overflow at run time, bestie. Supported forx86_64. 💅-z memory-seal,-z nomemory-seal— tells the executable or shared library that all thePT_LOADsegments should be sealed so nobody can mess with them afterwards (like changing the protection flags, the segment size, or straight-up removing the mapping). It's a security hardening thing and it needs system support, so no cap: it only works if your system says yes. This generatesGNU_PROPERTY_MEMORY_SEALin the.note.gnu.propertysection. 🔒-z now— when you're generating an executable or a shared library, this marks it to tell the dynamic linker to resolve all symbols right when the program starts, or when the shared library gets loaded bydlopen, instead of deferring function call resolution until the function is actually called for the first time. No lazy vibes here, everything gets resolved upfront. ✨-z origin— says the object requires$ORIGINhandling in paths. 🏠-z pack-relative-relocs,-z nopack-relative-relocs— generates compact relative relocation in position-independent executables and shared libraries. It adds"DT_RELR","DT_RELRSZ"and"DT_RELRENT"entries to the dynamic section. It gets ignored when you're building position-dependent executable and relocatable output, so don't stress about it there.nopack-relative-relocsis the default, and it disables compact relative relocation. When linked against the GNU C Library, aGLIBC_ABI_DT_RELRsymbol version dependency on the shared C Library gets added to the output. Supported fori386andx86-64. 🎀-z relro,-z norelro— creates an ELF"PT_GNU_RELRO"segment header in the object. This specifies a memory segment that should be made read-only after relocation, if supported. Heads up bestie: specifyingcommon-page-sizesmaller than the system page size will render this protection ineffective — it's giving expired. It does not create an ELF"PT_GNU_RELRO"segment ifnorelro. 😭-z report-relative-reloc— reports dynamic relative relocations generated by the linker. Supported forLinux/i386andLinux/x86_64. 📋-z sectionheader,-z nosectionheader— generates section header. It does not generate section header ifnosectionheaderis used.sectionheaderis the default. 👑-z separate-code,-z noseparate-code— creates a separate code"PT_LOAD"segment header in the object. This specifies a memory segment that should contain only instructions and must be in wholly disjoint pages from any other data, so keep them separated, fr fr. It does not create separate code"PT_LOAD"segment ifnoseparate-codeis used. 🦋-z shstk— generatesGNU_PROPERTY_X86_FEATURE_1_SHSTKin the.note.gnu.propertysection to indicate compatibility with Intel Shadow Stack. Supported forLinux/i386andLinux/x86_64. 🛡️-z stack-size=value— specifies a stack size for an ELF"PT_GNU_STACK"segment. Specifying zero will override any default non-zero sized"PT_GNU_STACK"segment creation. 📏-z start-stop-gc,-z nostart-stop-gc— okay so when--gc-sectionsis in effect, a reference from a retained section to"__start_SECNAME"or"__stop_SECNAME"causes all input sections named"SECNAME"to also be retained, if"SECNAME"is representable as a C identifier and either"__start_SECNAME"or"__stop_SECNAME"is synthesized by the linker.-z start-stop-gcdisables this effect, allowing sections to be garbage collected as if the special synthesized symbols were not defined.-z start-stop-gchas no effect on a definition of"__start_SECNAME"or"__stop_SECNAME"in an object file or linker script. Such a definition will prevent the linker providing a synthesized"__start_SECNAME"or"__stop_SECNAME"respectively, and therefore the special treatment by garbage collection for those references. 🗑️-z start-stop-visibility=value— specifies the ELF symbol visibility for synthesized"__start_SECNAME"and"__stop_SECNAME"symbols.valuemust be exactlydefault,internal,hidden, orprotected. If no-z start-stop-visibilityoption is given,protectedis used for compatibility with historical practice. But bestie, it's highly recommended to use-z start-stop-visibility=hiddenin new programs and shared libraries so that these symbols are not exported between shared objects, which is not usually what's intended. 🙈-z text,-z notext,-z textoff— reports an error ifDT_TEXTRELis set, i.e., if the position-independent or shared object has dynamic relocations in read-only sections. It does not report an error ifnotextortextoff. ⚠️-z undefs— do not report unresolved symbol references from regular object files, either when creating an executable, or when creating a shared library. This option is the inverse of-z defs. 🔄-z unique-symbol,-z nounique-symbol— avoids duplicated local symbol names in the symbol string table. Appends"."number""to duplicated local symbol names ifunique-symbolis used.nounique-symbolis the default. ⭐-z x86-64-baseline,-z x86-64-v2,-z x86-64-v3,-z x86-64-v4— specifies the x86-64 ISA level needed in the.note.gnu.propertysection.x86-64-baselinegenerates"GNU_PROPERTY_X86_ISA_1_BASELINE".x86-64-v2generates"GNU_PROPERTY_X86_ISA_1_V2".x86-64-v3generates"GNU_PROPERTY_X86_ISA_1_V3".x86-64-v4generates"GNU_PROPERTY_X86_ISA_1_V4". Supported forLinux/i386andLinux/x86_64. 🔥-z isa-level-report=none,-z isa-level-report=all,-z isa-level-report=needed,-z isa-level-report=used— specifies how to report x86-64 ISA levels in input relocatable files.isa-level-report=none, which is the default, will make the linker not report x86-64 ISA levels in input files.isa-level-report=allwill make the linker report needed and used x86-64 ISA levels in input files.isa-level-report=neededwill make the linker report needed x86-64 ISA levels in input files.isa-level-report=usedwill make the linker report used x86-64 ISA levels in input files. Supported forLinux/i386andLinux/x86_64. 📊
Other keywords are ignored for Solaris compatibility. (iykyk, we just pretend they're not there 💀)
--gnu-tls-tag,--no-gnu-tls-tag— adds a"GLIBC_ABI_GNU_TLS"version tag dependency in output programs and shared libraries when linking against glibc if input relocatable object files call"___tls_get_addr". The output will fail to load and run at run-time against glibc which doesn't define the"GLIBC_ABI_GNU_TLS"version tag 😭. Unless it's disabled by the--disable-gnu-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add the"GLIBC_ABI_GNU_TLS"version tag dependency if inputs have"___tls_get_addr"call andlibc.sodefines the"GLIBC_ABI_GNU_TLS"version tag. Supported forLinux/i386. 🌸--gnu2-tls-tag,--no-gnu2-tls-tag— adds a"GLIBC_ABI_GNU2_TLS"version tag dependency in output programs and shared libraries when linking against glibc if input relocatable object files have"R_386_TLS_DESC_CALL"or"R_X86_64_TLSDESC_CALL"relocation. The output will fail to load and run at run-time against glibc which doesn't define the"GLIBC_ABI_GNU2_TLS"version tag 💀. Unless it's disabled by the--disable-gnu2-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add the"GLIBC_ABI_GNU2_TLS"version tag dependency if inputs have"R_386_TLS_DESC_CALL"or"R_X86_64_TLSDESC_CALL"relocation andlibc.sodefines the"GLIBC_ABI_GNU2_TLS"version tag. Supported forLinux/i386andLinux/x86_64. 🌈-( archives -),--start-group archives --end-group— the archives should be a list of archive files. They may be either explicit file names, or-loptions. 👑
The specified archives are searched repeatedly until no new undefined references are created. Normally, an archive is searched only once in the order that it's specified on the command line. If a symbol in that archive is needed to resolve an undefined symbol referred to by an object in an archive that appears later on the command line, the linker would not be able to resolve that reference. By grouping the archives, they will all be searched repeatedly until all possible references are resolved. 🌀
This option is not allowed within a --start-lib/--end-lib option pair. 🚫
Using this option has a significant performance cost. It is best to use it only when there are unavoidable circular references between two or more archives. Like, only pull this out when you genuinely have no other choice, bestie.
--start-lib objects --end-lib— the objects should be a list of object files. 📦
The specified objects are treated as if they were members of an archive the name of which has been placed at the location of --start-lib on the command line. All the usual linker archive handling properties and command line options apply to such an artificial archive. ✨
This option may be used multiple times, in which case each set of the objects specified will be treated as an individual archive. Nesting this option is not allowed though. 🙅
Options that affect archive processing are not allowed between --start-lib and --end-lib as it would make no sense to apply them midway through handling an archive. These options include: -(/--start-group, -)/--end-group, --whole-archive, and --no-whole-archive, as well as --pop-state where it would change the state of --whole-archive setting. 🎯
--accept-unknown-input-arch,--no-accept-unknown-input-arch— tells the linker to accept input files whose architecture cannot be recognised. The assumption is that the user knows what they're doing and deliberately wants to link in these unknown input files. This was the default behaviour of the linker, before release2.14. The default behaviour from release2.14onwards is to reject such input files, and so the--accept-unknown-input-archoption has been added to restore the old behaviour. 🧚--as-needed,--no-as-needed— okay bestie, this one is about ELFDT_NEEDEDtags for dynamic libraries that show up on the command line after the--as-neededoption. Normally the linker just slaps aDT_NEEDEDtag on every dynamic library mentioned on the command line, whether it's actually needed or not (iconic behaviour honestly, no thoughts, just tags 💅).--as-neededis the glow-up: aDT_NEEDEDtag only gets emitted for a library that, at that point in the link, satisfies a non-weak undefined symbol reference from a regular object file — or, if that library isn't found in theDT_NEEDEDlists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. And the timing is everything: object files or libraries appearing on the command line after the library in question do not affect whether the library is seen as needed. It's giving the same energy as the rules for extraction of object files from archives, fr fr. And--no-as-needed? That just restores the default behaviour, we love a reset button 🎀
Note: on Linux based systems,--as-neededalso has an affect on the behaviour of the--rpathand--rpath-linkoptions. Go read the description of--rpath-linkfor more details, iykyk 👑
--add-needed,--no-add-needed— these two are deprecated 😭 and the reason is so valid it hurts: their names were just too similar to--as-neededand--no-as-needed. They've been replaced by--copy-dt-needed-entriesand--no-copy-dt-needed-entries. We do not use the old ones, periodt.-assertkeyword — this option is ignored for SunOS compatibility. That's it, that's the whole vibe 🙈-Bdynamic,-dy,-call_shared— link against dynamic libraries, babes ✨ This is only meaningful on platforms for which shared libraries are supported (so, not everywhere, we're not delulu). On such platforms this option is normally the default anyway. The different variants exist purely for compatibility with various systems — they're the same girl in different outfits 💖 You can use this option multiple times on the command line: it affects library searching for-loptions which follow it, so order matters, no cap.-Bgroup— set the"DF_1_GROUP"flag in the"DT_FLAGS_1"entry in the dynamic section. The consequence? The runtime linker handles lookups in this object and its dependencies only inside the group.--unresolved-symbols=report-allis implied — no takebacks. This option is only meaningful on ELF platforms which support shared libraries 🦋-Bstatic,-dn,-non_shared,-static— do not link against shared libraries. Same deal as above: only meaningful on platforms for which shared libraries are supported, and the different variants are for compatibility with various systems (same energy, different name tags 🎀). You may use this option multiple times on the command line: it affects library searching for-loptions which follow it. This option also implies--unresolved-symbols=report-all. And plot twist: you can use this with-shared— doing so means a shared library is being created, but all of the library's external references must be resolved by pulling in entries from static libraries. Okay that's lowkey iconic 🤯-Bsymbolic— when creating a shared library, bind references to global symbols to the definition within the shared library, if any. Normally it's possible for a program linked against a shared library to override the definition within the shared library — so this shuts that door, respectfully 💅 Only meaningful on ELF platforms which support shared libraries.-Bsymbolic-functions— same thing but make it functions only: when creating a shared library, bind references to global function symbols to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries ✨-Bno-symbolic— the cancel button 🫶 This option can cancel previously specified-Bsymbolicand-Bsymbolic-functions. Never let them know your next move.--dynamic-list=dynamic-list-file — hand the linker the name of a dynamic list file. This is typically used when creating shared libraries, to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library — or when creating dynamically linked executables, to specify a list of symbols which should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries, bestie.
The format of the dynamic list is the same as the version node without scope and node name. Go see VERSION for more info 📚
--dynamic-list-data— include all global data symbols to the dynamic list. All of them. Every single one. We're not being selective today 💖--dynamic-list-cpp-new— provide the builtin dynamic list for C++operator newanddelete. It's mainly useful for building sharedlibstdc++🔥--dynamic-list-cpp-typeinfo— provide the builtin dynamic list for C++ runtime type identification. Cute, specific, does one job 🧚--check-sections,--no-check-sections— this asks the linker not to check section addresses after they've been assigned, to see if there are any overlaps. Normally the linker does perform this check, and if it finds any overlaps it produces suitable error messages (as it should, honestly 👑). The linker does know about, and does make allowances for, sections in overlays. The default behaviour can be restored by using the command-line switch--check-sections. Also important: section overlap is not usually checked for relocatable links — you can force checking in that case by using the--check-sectionsoption 🌸--copy-dt-needed-entries,--no-copy-dt-needed-entries— this one affects the treatment of dynamic libraries referred to byDT_NEEDEDtags inside ELF dynamic libraries mentioned on the command line. Normally the linker won't add aDT_NEEDEDtag to the output binary for each library mentioned in aDT_NEEDEDtag in an input dynamic library. But with--copy-dt-needed-entriesspecified on the command line? Any dynamic libraries that follow it will have theirDT_NEEDEDentries added 💅 The default behaviour can be restored with--no-copy-dt-needed-entries.
This option also has an effect on the resolution of symbols in dynamic libraries. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line will be recursively searched, following their DT_NEEDED tags to other libraries, in order to resolve symbols required by the output binary. With the default setting, though, the searching of dynamic libraries that follow it stops with the dynamic library itself — no DT_NEEDED links will be traversed to resolve symbols. Boundaries, bestie 🦋
--cref— output a cross reference table ✨ If a linker map file is being generated, the cross reference table is printed to the map file. Otherwise, it's printed on the standard output.
The format of the table is intentionally simple, so that it may be easily processed by a script if necessary. The symbols are printed out, sorted by name. For each symbol, a list of file names is given. If the symbol is defined, the first file listed is the location of the definition. If the symbol is defined as a common value, then any files where this happens appear next. Finally, any files that reference the symbol are listed. Organized, legible, slay 🎀
--ctf-variables,--no-ctf-variables— okay so the CTF debuginfo format supports a section which encodes the names and types of variables found in the program which do not appear in any symbol table. These variables clearly cannot be looked up by address by conventional debuggers, so the space used for their types and names is usually wasted: the types are usually small but the names are often not 😭--ctf-variablescauses the generation of such a section. The default behaviour can be restored with--no-ctf-variables.--ctf-share-types=method — adjust the method used to share types between translation units in CTF 🧚share-unconflicted— put all types that do not have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default.share-duplicated— put only types that occur in multiple translation units into the shared dictionary: types with only one definition go into per-translation-unit dictionaries. Types with ambiguous definitions in multiple translation units always go into per-translation-unit dictionaries. This tends to make the CTF larger, but may reduce the amount of CTF in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime. Tradeoffs, we love to see them 💜
--no-define-common— this option inhibits the assignment of addresses to common symbols. The script commandINHIBIT_COMMON_ALLOCATIONhas the same effect 👑
The --no-define-common option allows decoupling the decision to assign addresses to Common symbols from the choice of the output file type; otherwise a non-Relocatable output type forces assigning addresses to Common symbols. Using --no-define-common allows Common symbols that are referenced from a shared library to be assigned addresses only in the main program. This eliminates the unused duplicate space in the shared library, and also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution. Clean, no duplicates, no drama 🌈
--force-group-allocation— this option causes the linker to place section group members like normal input sections, and to delete the section groups. This is the default behaviour for a final link, but this option can be used to change the behaviour of a relocatable link (-r). The script commandFORCE_GROUP_ALLOCATIONhas the same effect ✨--defsym=symbol=expression — create a global symbol in the output file, containing the absolute address given by expression. You may use this option as many times as necessary to define multiple symbols in the command line 💅 A limited form of arithmetic is supported for the expression in this context: you may give a hexadecimal constant or the name of an existing symbol, or use+and-to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider using the linker command language from a script. And listen — huge note: there should be no white space between symbol, the equals sign ("="), and expression. Not one space. Not even a lil one. The linker will notice 🙈
okay so bestie, real talk: the linker processes --defsym arguments and -T arguments in order. Put --defsym before -T and the symbol gets defined before the linker script from -T is processed. Put --defsym after -T and the symbol gets defined after the linker script has been processed. This difference has consequences for expressions within the linker script that use the --defsym symbols, and which order is correct will depend on what you are trying to achieve. 💅
--demangle[=style],--no-demangle— these control whether to demangle symbol names in error messages and other output. When the linker is told to demangle, it tries to present symbol names in a readable fashion: it strips leading underscores if they are used by the object file format, and converts C++ mangled symbol names into user readable names. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. The linker will demangle by default unless the environment variableCOLLECT_NO_DEMANGLEis set. These options may be used to override the default. ✨-Ifile,--dynamic-linker=file— set the name of the dynamic linker. This is only meaningful when generating dynamically linked ELF executables. The default dynamic linker is normally correct; don't use this unless you know what you are doing. 🫶--no-dynamic-linker— when producing an executable file, omit the request for a dynamic linker to be used at load-time. This is only meaningful for ELF executables that contain dynamic relocations, and usually requires entry point code that is capable of processing these relocations.--embedded-relocs— similar to the--emit-relocsoption except that the relocs are stored in a target-specific section. This option is only supported by the BFIN, CR16 and M68K targets. 💀--disable-multiple-abs-defs— do not allow multiple definitions with symbols included in filename invoked by-Ror--just-symbols.--fatal-warnings,--no-fatal-warnings— treat all warnings as errors. The default behaviour can be restored with the option--no-fatal-warnings.-w,--no-warnings— do not display any warning or error messages. This overrides--fatal-warningsif it has been enabled. This option can be used when it is known that the output binary will not work, but there is still a need to create it. 😭--force-exe-suffix— make sure that an output file has a.exesuffix.
If a successfully built fully linked output file does not have a ".exe" or ".dll" suffix, this option forces the linker to copy the output file to one of the same name with a ".exe" suffix. This option is useful when using unmodified Unix makefiles on a Microsoft Windows host, since some versions of Windows won't run an image unless it ends in a ".exe" suffix. 👑
--gc-sections,--no-gc-sections— enable garbage collection of unused input sections. It is ignored on targets that do not support this option. The default behaviour (of not performing this garbage collection) can be restored by specifying--no-gc-sectionson the command line. Note that garbage collection for COFF and PE format targets is supported, but the implementation is currently considered to be experimental. 🧚
--gc-sections decides which input sections are used by examining symbols and relocations. The section containing the entry symbol and all sections containing symbols undefined on the command-line will be kept, as will sections containing symbols referenced by dynamic objects. Note that when building shared libraries, the linker must assume that any visible symbol is referenced. Once this initial set of sections has been determined, the linker recursively marks as used any section referenced by their relocations. See --entry, --undefined, and --gc-keep-exported.
This option can be set when doing a partial link (enabled with option -r). In this case the root of symbols kept must be explicitly specified either by one of the options --entry, --undefined, or --gc-keep-exported or by a "ENTRY" command in the linker script.
As a GNU extension, ELF input sections marked with the "SHF_GNU_RETAIN" flag will not be garbage collected.
--print-gc-sections,--no-print-gc-sections— list all sections removed by garbage collection. The listing is printed on stderr. This option is only effective if garbage collection has been enabled via the--gc-sections)option. The default behaviour (of not listing the sections that are removed) can be restored by specifying--no-print-gc-sectionson the command line. 🍓--gc-keep-exported— when--gc-sectionsis enabled, this option prevents garbage collection of unused input sections that contain global symbols having default or protected visibility. This option is intended to be used for executables where unreferenced sections would otherwise be garbage collected regardless of the external visibility of contained symbols. Note that this option has no effect when linking shared objects since it is already the default behaviour. This option is only supported for ELF format targets.--print-output-format— print the name of the default output format (perhaps influenced by other command-line options). This is the string that would appear in an"OUTPUT_FORMAT"linker script command. 🌈--print-memory-usage— print used size, total size and used size of memory regions created with theMEMORYcommand. This is useful on embedded targets to have a quick view of amount of free memory. The format of the output has one headline and one line per region. It is both human readable and easily parsable by tools. Here is an example of an output:
Memory region Used Size Region Size %age Used
ROM: 256 KB 1 MB 25.00%
RAM: 32 B 2 GB 0.00%Note: if you want to find out about the memory usage of the linker itself, then the --stats option will do this. 👑
--help— print a summary of the command-line options on the standard output and exit.--target-help— print a summary of all target-specific options on the standard output and exit.-Map=mapfile— print a link map to the file mapfile. See the description of the-Moption, above. If mapfile is just the character"-"then the map will be written to stdout.
Specifying a directory as mapfile causes the linker map to be written as a file inside the directory. Normally name of the file inside the directory is computed as the basename of the output file with ".map" appended. If however the special character "%" is used then this will be replaced by the full path of the output file. Additionally if there are any characters after the % symbol then ".map" will no longer be appended.
-o foo.exe -Map=bar [Creates ./bar]
-o ../dir/foo.exe -Map=bar [Creates ./bar]
-o foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o foo.exe -Map=% [Creates ./foo.exe.map]
-o ../dir/foo.exe -Map=% [Creates ../dir/foo.exe.map]
-o foo.exe -Map=%.bar [Creates ./foo.exe.bar]
-o ../dir/foo.exe -Map=%.bar [Creates ../dir/foo.exe.bar]
-o ../dir2/foo.exe -Map=../dir/% [Creates ../dir/../dir2/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]It is an error to specify more than one "%" character.
If the map file already exists then it will be overwritten by this operation. 💅
--no-keep-memory—ldnormally optimizes for speed over memory usage by caching the symbol tables of input files in memory. This option tellsldto instead optimize for memory usage, by rereading the symbol tables as necessary. This may be required ifldruns out of memory space while linking a large executable. 🫶--no-undefined,-z defs— report unresolved symbol references from regular object files. This is done even if the linker is creating a non-symbolic shared library. The switch--[no-]allow-shlib-undefinedcontrols the behaviour for reporting unresolved references found in shared libraries being linked in.
The effects of this option can be reverted by using -z undefs.
--allow-multiple-definition,-z muldefs— normally when a symbol is defined multiple times, the linker will report a fatal error. These options allow multiple definitions and the first definition will be used. 💀--allow-shlib-undefined,--no-allow-shlib-undefined— allows or disallows undefined symbols in shared libraries. This switch is similar to--no-undefinedexcept that it determines the behaviour when the undefined symbols are in a shared library rather than a regular object file. It does not affect how undefined symbols in regular object files are handled.
The default behaviour is to report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable, but to allow them if the linker is being used to create a shared library.
The reasons for allowing undefined symbol references in shared libraries specified at link time are that:
- A shared library specified at link time may not be the same as the one that is available at load time, so the symbol might actually be resolvable at load time.
- There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are normal.
The BeOS kernel for example patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for example, to dynamically select an appropriate memset function. 🌸
--error-handling-script=scriptname— bestie, hand the linker a little helper script and it'll callscriptnameevery single time it hits an error ✨. But rn only two kinds of error are supported: missing symbols and missing libraries. Your script gets exactly two arguments: the keyword"undefined-symbol"or`missing-lib"and then the name of the undefined symbol or the missing library. The whole idea is that the script goes "hey girl, here's where that thing might be 👀" with suggestions. And after the script finishes, the normal linker error message still gets displayed. The availability of this option is controlled by a configure time switch, so it may not be present in specific implementations 💅.--no-undefined-version— so normally, when a symbol has an undefined version, the linker just… ignores it 🙈. This option says "no ma'am" and disallows symbols with undefined version, and a fatal error will be issued instead. Dramatic? Maybe. Correct? Yes 🔥.--default-symver— creates and uses a default symbol version (the soname) for unversioned exported symbols 👑--default-imported-symver— same energy, different direction: creates and uses a default symbol version (the soname) for unversioned imported symbols 💖--no-warn-mismatch— okay so normallyldwill throw an error if you try to link together input files that are mismatched for some reason — maybe they were compiled for different processors, or for different endiannesses 😭. This option tellsldit should silently permit such possible errors. > Use this one with care only, in cases when you have taken some special action that ensures that the linker errors are inappropriate. It's giving "I know what I'm doing" and you better actually know 💀--no-warn-search-mismatch— normallyldgives you a warning if it finds an incompatible library during a library search. This option silences the warning 🤫--no-whole-archive— turns off the effect of the--whole-archiveoption for subsequent archive files. Not allowed within a--start-lib/--end-liboption pair 🚫--no-link-mapless— rejects archives that lack an index aka symbol map for all the subsequent archives referred on the command line. If such a file is encountered, a link error occurs. This is the traditional behavior 🎀--noinhibit-exec— retains the executable output file whenever it is still usable 🫶. Normally, the linker will not produce an output file if it encounters errors during the link process; it exits without writing an output file when it issues any error whatsoever.-nostdlib— only search library directories explicitly specified on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line) are ignored 😤--oformat=output-format—ldmay be configured to support more than one kind of object file. If yourldis configured this way, you can use the--oformatoption to specify the binary format for the output object file ✨. Even whenldis configured to support alternative object formats, you don't usually need to specify this, asldshould be configured to produce as a default output format the most usual format on each machine. output-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats withobjdump -i.) The script commandOUTPUT_FORMATcan also specify the output format, but this option overrides it 💅--out-implib file— create an import library in file corresponding to the executable the linker is generating (eg. a DLL or ELF program). This import library (which should be called"*.dll.a"or"*.a"for DLLs) may be used to link clients against the generated executable; this behaviour makes it possible to skip a separate import library creation step (eg."dlltool"for DLLs). This option is only available for the PE and ELF targetted ports of the linker 👑-pie,--pic-executable— create a position independent executable 🌈. This is currently only supported on ELF platforms. Position independent executables are relocated by the dynamic linker to the virtual address the OS chooses for them, which can vary between invocations. They are markedET_DYNin the ELF file header, but differ from shared libraries in a number of ways. In particular, defined symbols in a PIE by default can not be overridden by another object as they can be in a shared library 😮-no-pie— create a position dependent executable. This is the default 🎀-qmagic— this option is ignored for Linux compatibility 🙈-Qy— this option is ignored for SVR4 compatibility 🙈--relax,--no-relax— an option with machine dependent effects. This option is only supported on a few targets 👀
On some platforms the --relax option performs target specific, global optimizations that become possible when the linker resolves addressing in the program, such as relaxing address modes, synthesizing new instructions, selecting shorter version of current instructions, and combining constant values 🔥
On some platforms these link time global optimizations may make symbolic debugging of the resulting executable impossible 😭. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors.
On platforms where the feature is supported, the option --no-relax will disable it.
On platforms where the feature is not supported, both --relax and --no-relax are accepted, but ignored 🤷
--retain-symbols-file=filename— retain only the symbols listed in the file filename, discarding all others 💖. filename is simply a flat file, with one symbol name per line. This option is especially useful in environments (such as VxWorks) where a large global symbol table is accumulated gradually, to conserve run-time memory.
--retain-symbols-file does not discard undefined symbols, or symbols needed for relocations 🫶
You may only specify --retain-symbols-file once in the command line. It overrides -s and -S.
-rpath=dir— add a directory to the runtime library search path. This is used when linking an ELF executable with shared objects. All-rpatharguments are concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime 🌸
The -rpath option is also used when locating shared objects which are needed by shared objects explicitly included in the link; see the description of the -rpath-link option. Searching -rpath in this way is only supported by native linkers and cross linkers which have been configured with the --with-sysroot option 👑
If -rpath is not used when linking an ELF executable, the contents of the environment variable "LD_RUN_PATH" will be used if it is defined.
The -rpath option may also be used on SunOS. By default, on SunOS, the linker will form a runtime search path out of all the -L options it is given. If a -rpath option is used, the runtime search path will be formed exclusively using the -rpath options, ignoring the -L options. This can be useful when using gcc, which adds many -L options which may be on NFS mounted file systems ✨
For compatibility with other ELF linkers, if the -R option is followed by a directory name, rather than a file name, it is treated as the -rpath option 💅
-rpath-link=dir— when using ELF or SunOS, one shared library may require another. This happens when an"ld -shared"link includes a shared library as one of the input files 👀
When the linker encounters such a dependency when doing a non-shared, non-relocatable link, it will automatically try to locate the required shared library and include it in the link, if it is not included explicitly. In such a case, several directories are searched as described below. The -rpath-link option specifies the first set of directories to search. This option may specify a sequence of directory names either by providing a list of names separated by colons, or by appearing multiple times 🦋
The tokens $ORIGIN and $LIB can appear in these search directories. They will be replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN and either lib — for 32-bit binaries — or lib64 — for 64-bit binaries — in the case of $LIB.
The alternative form of these tokens — ${ORIGIN} and ${LIB} — can also be used. The token $PLATFORM is not supported 🚫
The --rpath-link option should be used with caution as it overrides the search path that may have been hard compiled into a shared library. In such a case it is possible to unintentionally use a different search path than the runtime linker would have used 😭
When additional shared libraries are required, the linker will search directories in the order listed below in order to find them. Note however that this only applies to additional libraries needed to satisfy already included shared libraries. It does not apply to libraries that are included via the -l command line option. Searches for -l libraries are only conducted in directories specified by the -L option 👑
- Any directories specified by
-rpath-linkoptions. - Any directories specified by
-rpathoptions. The difference between-rpathand-rpath-linkis that directories specified by-rpathoptions are included in the executable and used at runtime, whereas the-rpath-linkoption is only effective at link time. Searching-rpathin this way is only supported by native linkers and cross linkers which have been configured with the--with-sysrootoption. - On an ELF system, for native linkers, if the
-rpathand-rpath-linkoptions were not used, search the contents of the environment variable"LD_RUN_PATH". - On SunOS, if the
-rpathoption was not used, search any directories specified using-Loptions. - For a native linker, search the contents of the environment variable
"LD_LIBRARY_PATH". - For a native ELF linker, the directories in
"DT_RUNPATH"or"DT_RPATH"of a shared library are searched for shared libraries needed by it. The"DT_RPATH"entries are ignored if"DT_RUNPATH"entries exist.
- On a Linux linker, if
/etc/ld.so.confexists, whatever directories are listed inside it. 💅 heads up though: that file's path gets the "sysroot" value stuck on the front if one's defined, and then any "prefix" string too, if the linker was configured with the--prefix=<path>option. - If you're on a native linker on a FreeBSD system, any directories named by the
_PATH_ELF_HINTSmacro (that one lives in theelf-hints.hheader file). - Any directories named by a "SEARCH_DIR" command inside a linker script you passed on the command line — scripts given via
-Tcount, but-dTones do not, just so we're clear. - The default directories, which are normally
/liband/usr/lib. 🫶 the classics - Any directories named by a plugin's
LDPT_SET_EXTRA_LIBRARY_PATH. plugins staying nosy, iconic of them ✨ - Any directories named by a "SEARCH_DIR" command in a default linker script.
okay but bestie, on Linux-based systems there's one more lil caveat and it's giving sneaky 👀 If--as-neededis active, and a shared library gets found that would normally satisfy the search, and that library does not have aDT_NEEDEDtag forlibc.so, and then later in the set of search directories there's another shared library that also satisfies the search and that one does have aDT_NEEDEDtag forlibc.so— then the linker picks the second library instead of the first. no cap.
And if the required shared library just... isn't found at all? The linker issues a warning and keeps on going with the link. 😭 it literally just vibes forward.
🎀 more OPTIONS (we're still going, stay with me) 🎀
--section-ordering-file=script— this one augments the current linker script with extra mapping of input sections to output sections. The file has to use the same syntax for "SECTIONS" that normal linker scripts use, but it shouldn't do anything beyond dropping input sections into output sections.@pxref{SECTIONS}
There's a second constraint too: the section ordering script can only reference output sections that are already defined by whichever linker script is in play right now (so the default linker script, or one you handed over on the command line). The glow-up though? The input sections get mapped to the start of the output sections, so you can lock in the ordering of sections inside the output section. Say the default linker script looks like this:
SECTIONS {
.text : { *(.text.hot) ; *(.text .text.*) }
.data : { *(.data.big) ; *(.data .data.*) }
}Then if a section ordering file like this is used:
.text : { *(.text.first) ; *(.text.z*) }
.data : { foo.o(.data.first) ; *(.data.small) }That would be equivalent to a linker script like this:
SECTIONS {
.text : { *(.text.first) ; *(.text.z*) ; *(.text.hot) ; *(.text .text.*) }
.data : { foo.o(.data.first) ; *(.data.small) ; *(.data.big) ; *(.data .data.*) }
}The whole point of the section ordering file? You can order the sections you care about without stressing over any other sections, or memory regions, or literally anything else. main character energy, honestly 💅
-shared,-Bshareable— makes a shared library. Right now this is only supported on ELF, XCOFF and SunOS platforms. And on SunOS the linker will just auto-create a shared library if-ewasn't used and there are undefined symbols in the link. it does it itself, slay ✨--sort-common,--sort-common=ascending,--sort-common=descending— tellsldto sort the common symbols by alignment, ascending or descending, when it drops them into the right output sections. The alignments it cares about are sixteen-byte or larger, eight-byte, four-byte, two-byte, and one-byte. Why? To stop gaps appearing between symbols because of alignment constraints. And if you don't specify an order at all, descending is what you get. 🍓--sort-section=name— applies "SORT_BY_NAME" to every wildcard section pattern in the linker script.--sort-section=alignment— applies "SORT_BY_ALIGNMENT" to every wildcard section pattern in the linker script.--spare-dynamic-tags=count— sets how many empty slots to leave in the.dynamicsection of ELF shared objects. Post-processing tools like the prelinker might need those empty slots. Default is5.--split-by-file[=size]— like--split-by-relocbut it makes a brand new output section for each input file oncesizeis reached. If you don't give asize, it defaults to a size of1. 🦋--split-by-reloc[=count]— tries to create extra sections in the output file so that no single output section has more thancountrelocations in it. Super useful when you're generating massive relocatable files to download into certain real time kernels with the COFF object file format, because COFF cannot represent more than65535relocations in a single section. ⚠️ warning bestie: this will fail to work with object file formats that don't support arbitrary sections. Also the linker will not split up individual input sections for redistribution, so if one single input section holds more thancountrelocations, one output section is gonna end up containing that many relocations.countdefaults to32768.--stats[=filename]— computes and shows you statistics about how the linker did, things like execution time and memory usage. 💀 obsessed
If you don't pass the optional filename argument, only basic info gets reported and it goes to the standard error output stream. If you do pass filename, extended info gets written to that named file. If filename is set to just the - symbol, the extended info goes to the standard output stream instead. And if filename starts with +, the file opens in append mode rather than overwrite mode. 🎀
If the -Map option is enabled, the info gets recorded in the map file too. And note: if both --stats and -Map were given filename arguments and they match, the info only gets written out once, not twice. efficiency, we love her ✨
If the LD_STATS environment variable is defined, this behaves like the --stats option. If the variable's value is a string, that string gets used as the name of a file to record the info into. Otherwise the info goes to the standard output stream. Using the env var means you can record stats without touching the linker's command line. Note: if you use both the environment variable and the --stats option, then --stats wins. 💅
The extended info includes the cpu time used and, if the getrusage() system library call is available, the maximum set size plus the user and system run times as well. And if the mallinfo or mallinfo2 system library calls are available, total memory usage gets reported too.
The info shows up per individual part of the linking process, and those parts are called phases. Heads up: individual phases can contain or overlap with each other, so please do not assume the overall resources used by the linker is just the sum of the resources used by the individual phases. math is not mathing there 🙈
On top of that, the info also gets reported for a special phase called ALL, which covers the entire linking process.
When extended info is being reported, you also get the linker version, the command line arguments, and the linker start time. Why? Because it makes life so much easier when a build system is firing off multiple links and you need to indentify exactly which arguments were responsible for producing the statistics you're staring at. yes, the manpage says "indentify". we don't correct the elders. 😌
The extended output looks something like this:
Stats: linker version: (GNU Binutils) 2.44.50.20250401
Stats: linker started: Wed Apr 2 09:36:41 2025
Stats: args: ld -z norelro -z nomemory-seal -z no-separate-code -o a.out [...]
Stats: phase cpu time rss user time system time memory
Stats: name (microsec) (KiB) (seconds) (seconds) (KiB)
Stats: ALL 390082 217740 0 0 25219440
Stats: ctf processing 12 0 0 0 0
Stats: string merge 1324 0 0 0 406544
Stats: parsing 349 288 0 0 119792
Stats: plugins 1 0 0 0 0
Stats: processing files 259616 214524 0 0 31569120
Stats: write 116493 0 0 0 48096--no-stats— turns the reporting of usage statistics back off, in case it got enabled via the--statscommand line option or theLD_STATSenvironment variable. bye bestie 👋--sysroot=directory— use directory as the location of the sysroot, overriding the configure-time default. Just so you know: this option is only supported by linkers that were configured using--with-sysroot. 🌸--task-link— used by COFF/PE based targets to create a task-linked object file where all of the global symbols have been converted to statics. 🧚--traditional-format— for some targets,ld's output is different in some ways from the output of some existing linker. This switch asksldto use the traditional format instead.
Example time: on SunOS, ld combines duplicate entries in the symbol string table. That can shrink an output file with full debugging information by over 30 percent. unfortunately the SunOS "dbx" program cannot read the resulting program (though "gdb" has zero trouble with it). The --traditional-format switch tells ld not to combine duplicate entries. 💖
--section-start=sectionname=org— bestie, this one drops a section in the output file at the absolute address<italic>org</italic>gives you. ✨ You can use it as many times as you need to place multiple sections on the command line. Lowkey important:<italic>org</italic>has to be a single hexadecimal integer — and for compatibility with other linkers, you can skip the leading0xthat hex values usually rock. Also: no white space between<italic>sectionname</italic>, the equals sign (=), and<italic>org</italic>. Fr fr, none. 💅--image-base=org— when you're on ELF, this is the same as-Ttext-segment, and both options effectively set the base address of the ELF executable. When you're on PE, the value is the base address of your program or dll — the lowest memory location that gets used when your program or dll is loaded. To reduce the need to relocate and improve performance of your dlls, each one should have a unique base address and not overlap any other dlls. Defaults? 0x400000 for executables, and 0x10000000 for dlls. 👑-Tbss=org— same as--section-start, with".bss"as the<italic>sectionname</italic>. 🎀-Tdata=org— same as--section-start, with".data"as the<italic>sectionname</italic>. 🎀-Ttext=org— same as--section-start, with".text"as the<italic>sectionname</italic>. 🎀-Ttext-segment=org— when creating an ELF executable, this sets the address of the first byte of the first segment. Note: when-pieis used with-Ttext-segment=org, the output executable is markedET_EXECso that the address of the first byte of the text segment is guaranteed to be<italic>org</italic>at run time. Not me learning that detail. 😭-Trodata-segment=org— when creating an ELF executable or shared object for a target where the read-only data is in its own segment separate from the executable text, this sets the address of the first byte of the read-only data segment. 🦋-Tldata-segment=org— when creating an ELF executable or shared object for x86-64 medium memory model, this sets the address of the first byte of the ldata segment. 🌸--unresolved-symbols=method— tells the linker how to handle unresolved symbols. There are four possible values for<italic>method</italic>:ignore-all— do not report any unresolved symbols. 🙈report-all— report all unresolved symbols. This is the default. 👑ignore-in-object-files— report unresolved symbols that are contained in shared libraries, but ignore them if they come from regular object files. 🫶ignore-in-shared-libs— report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. This can be useful when creating a dynamic binary and it is known that all the shared libraries that it should be referencing are included on the linker's command line. 💅
The behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option. Normally the linker generates an error message for each reported unresolved symbol, but the option --warn-unresolved-symbols can change this to a warning. ✨
--dll-verbose,--verbose[=NUMBER]— display the version number forldand list the linker emulations supported. Display which input files can and cannot be opened. Display the linker script being used by the linker. If the optional<italic>NUMBER</italic>argument is> 1, plugin symbol status will also be displayed. 🔥--version-script=version-scriptfile— specify the name of a version script to the linker. This is typically used when creating shared libraries to specify additional information about the version hierarchy for the library being created. This option is only fully supported on ELF platforms which support shared libraries; see VERSION. It is partially supported on PE platforms, which can use version scripts to filter symbol visibility in auto-export mode: any symbols marked local in the version script will not be exported. 💜--warn-common— warn when a common symbol is combined with another common symbol or with a symbol definition. Unix linkers allow this somewhat sloppy practice, but linkers on some other operating systems do not. This option lets you find potential problems from combining global symbols. Unfortunately, some C libraries use this practice, so you may get some warnings about symbols in the libraries as well as in your programs. 😭
There are three kinds of global symbols, illustrated here by C examples:
int i = 1;A definition, which goes in the initialized data section of the output file. 💖
extern int i;An undefined reference, which does not allocate space. There must be either a definition or a common symbol for the variable somewhere. 🌈
int i;A common symbol. If there are only (one or more) common symbols for a variable, it goes in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol. If they are of different sizes, it picks the largest size. The linker turns a common symbol into a declaration, if there is a definition of the same variable. ⭐
The --warn-common option can produce five kinds of warnings. Each warning consists of a pair of lines: the first describes the symbol just encountered, and the second describes the previous symbol encountered with the same name. One or both of the two symbols will be a common symbol. 🎀
- Turning a common symbol into a reference, because there is already a definition for the symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by definition
<file>(<section>): warning: defined here- Turning a common symbol into a reference, because a later definition for the symbol is encountered. This is the same as the previous case, except that the symbols are encountered in a different order.
<file>(<section>): warning: definition of `<symbol>'
overriding common
<file>(<section>): warning: common is here- Merging a common symbol with a previous same-sized common symbol.
<file>(<section>): warning: multiple common
of `<symbol>'
<file>(<section>): warning: previous common is here- Merging a common symbol with a previous larger common symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by larger common
<file>(<section>): warning: larger common is here- Merging a common symbol with a previous smaller common symbol. This is the same as the previous case, except that the symbols are encountered in a different order.
<file>(<section>): warning: common of `<symbol>'
overriding smaller common
<file>(<section>): warning: smaller common is here--warn-constructors— warn if any global constructors are used. This is only useful for a few object file formats. For formats like COFF or ELF, the linker can not detect the use of global constructors. 💀--warn-execstack,--warn-execstack-objects,--no-warn-execstack— on ELF platforms the linker may generate warning messages if it is asked to create an output file that contains an executable stack. There are three possible states:- Do not generate any warnings.
- Always generate warnings, even if the executable stack is requested via the
-z execstackcommand line option. - Only generate a warning if an object file requests an executable stack, but not if the
-z execstackoption is used.
The default state depends upon how the linker was configured when it was built. The --no-warn-execstack option always puts the linker into the no-warnings state. The --warn-execstack option puts the linker into the warn-always state. The --warn-execstack-objects option puts the linker into the warn-for-object-files-only state. 🔥
Note: ELF format input files can specify that they need an executable stack by having a .note.GNU-stack section with the executable bit set in its section flags. They can specify that they do not need an executable stack by having the same section, but without the executable flag bit set. If an input file does not have a .note.GNU-stack section then the default behaviour is target specific. For some targets, the absence of such a section implies that an executable stack is required. This is often a problem for hand crafted assembler files. 😭
--error-execstack,--no-error-execstack— if the linker is going to generate a warning message about an executable stack, then the--error-execstackoption will instead change that warning into an error. Note — this option does not change the linker's execstack warning generation state. Use--warn-execstackor--warn-execstack-objectsto set a specific warning state. The--no-error-execstackoption will restore the default behaviour of generating warning messages. 💅--warn-multiple-gp— warn if multiple global pointer values are required in the output file. This is only meaningful for certain processors, such as the Alpha. Specifically, some processors put large-valued constants in a special section. A special register (the global pointer) points into the middle of this section, so that constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g., 16 bits), this limits the maximum size of the constant pool. Thus, in large programs, it is often necessary to use multiple global pointer values in order to be able to address all possible constants. This option causes a warning to be issued whenever this case occurs. 🌸--warn-once— only warn once for each undefined symbol, rather than once per module which refers to it. 🫶--warn-rwx-segments,--no-warn-rwx-segments— warn if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set. Such a segment represents a potential security vulnerability. In addition warnings will be generated if a thread local storage segment is created with the execute permission flag set, regardless of whether or not it has the read and/or write flags set. 🔥
These warnings are enabled by default 💅 They can be disabled via the --no-warn-rwx-segments option and re-enabled via the --warn-rwx-segments option.
--error-rwx-segments— bestie, if the linker is about to warn you about an executable, writeable segment, or an executable TLS segment, this turns that warning into an error instead 😭--no-error-rwx-segments— restores the default behaviour of just generating a warning message 🫶
Note: the--error-rwx-segmentsoption does not by itself turn on warnings about these segments. Those warnings are either enabled by default (if the linker was configured that way) or via the--warn-rwx-segmentscommand line option. 👑
--warn-section-align— warns if the address of an output section gets changed because of alignment. Usually the alignment is set by an input section, and the address only changes if it isn't explicitly specified — like, if theSECTIONScommand doesn't give a start address for the section. ✨--warn-textrel— warns if the linker addsDT_TEXTRELto a position-independent executable or shared object. 💀--warn-alternate-em— warns if an object has alternate ELF machine code. 👀--warn-unresolved-symbols— if the linker is about to report an unresolved symbol (see the option--unresolved-symbols), it normally generates an error. This option makes it generate a warning instead. 🫠--error-unresolved-symbols— restores the linker's default behaviour of generating errors when it's reporting unresolved symbols. 🔥--whole-archive— for each archive mentioned on the command line after--whole-archive, include every object file in the archive in the link, instead of searching the archive for the required object files. This is normally used to turn an archive file into a shared library, forcing every object to be included in the resulting shared library. This option may be used more than once. 💖
This option is not allowed within a --start-lib/--end-lib option pair. 🚫
Two notes when using this option from gcc: First, gcc doesn't know about this option, so you have to use -Wl,-whole-archive. Second, don't forget to use -Wl,-no-whole-archive after your list of archives, because gcc will add its own list of archives to your link and you may not want this flag to affect those as well. 😌
--link-mapless— accept archives that lack an index aka symbol map for all the subsequent archives referred on the command line. If missing, such an index is made internally on the fly at performance cost. This is the default. 🦋--wrap=symbol — use a wrapper function for symbol. Any undefined reference to symbol will be resolved to__wrap_symbol. Any undefined reference to__real_symbolwill be resolved to symbol. 🎀
This can be used to provide a wrapper for a system function. The wrapper function should be called __wrap_symbol. If it wishes to call the system function, it should call __real_symbol. 🌸
Here is a trivial example:
void *
__wrap_malloc (size_t c)
{
printf ("malloc called with %zu\n", c);
return __real_malloc (c);
}If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead. The call to __real_malloc in __wrap_malloc will call the real malloc function. 👑
You may wish to provide a __real_malloc function as well, so that links without the --wrap option will succeed. If you do this, you should not put the definition of __real_malloc in the same file as __wrap_malloc; if you do, the assembler may resolve the call before the linker has a chance to wrap it to malloc. 😭
Only undefined references are replaced by the linker. So, translation unit internal references to symbol are not resolved to __wrap_symbol. In the next example, the call to f in g is not resolved to __wrap_f. 🙈
int
f (void)
{
return 123;
}
int
g (void)
{
return f();
}--eh-frame-hdr— request the creation of.eh_frame_hdrsection and ELFPT_GNU_EH_FRAMEsegment header. ✨--no-eh-frame-hdr— suppress the creation of.eh_frame_hdrsection and ELFPT_GNU_EH_FRAMEsegment header. 🚫--no-ld-generated-unwind-info— request creation of.eh_frameunwind info for linker generated code sections like PLT. This option is on by default if linker generated unwind info is supported. 🧚--discard-sframe— discard.sframestack trace info from the output. This option also prohibits the creation of SFrame stack trace data for linker generated code sections like PLT. This option is off by default. 💀--enable-new-dtags— this linker can create the new dynamic tags in ELF, but older ELF systems may not understand them. If you specify--enable-new-dtags, the new dynamic tags will be created as needed and older dynamic tags will be omitted. Note that these options are only available for ELF systems. 🌈--disable-new-dtags— if you specify this, no new dynamic tags will be created. By default, the new dynamic tags are not created. Again, only available for ELF systems. 🫶--hash-size=number — set the default size of the linker's hash tables to a prime number close to number. Increasing this value can reduce the length of time it takes the linker to perform its tasks, at the expense of increasing the linker's memory requirements. Similarly reducing this value can reduce the memory requirements at the expense of speed. The default value is4051under normal circumstances and1021if the--reduce-memory-overheadscommand line option is used. 👑--hash-style=style — set the type of linker's hash table(s). style can be eithersysvfor classic ELF.hashsection,gnufor new style GNU.gnu.hashsection orbothfor both the classic ELF.hashand new style GNU.gnu.hashhash tables. The default depends upon how the linker was configured, but for most Linux based systems it will beboth. 💅--compress-debug-sections=none— on ELF platforms, controls how DWARF debug sections are compressed using zlib. This one doesn't compress DWARF debug sections. 🚫--compress-debug-sections=zlib— alias for--compress-debug-sections=zlib-gabi. ✨--compress-debug-sections=zlib-gnu— compresses DWARF debug sections and renames them to begin with.zdebuginstead of.debug. 🎀--compress-debug-sections=zlib-gabi— also compresses DWARF debug sections, but rather than renaming them it sets theSHF_COMPRESSEDflag in the sections' headers. 🌸--compress-debug-sections=zstd— compresses DWARF debug sections using zstd. 🔥
Note that this option overrides any compression in input debug sections, so if a binary is linked with --compress-debug-sections=none for example, then any compressed debug sections in input files will be uncompressed before they are copied into the output binary. 😭
The default compression behaviour varies depending upon the target involved and the configure options used to build the toolchain. The default can be determined by examining the output from the linker's --help option. 👀
--reduce-memory-overheads— this option reduces memory requirements atldruntime, at the expense of linking speed. This was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage. 💀
Another effect of the switch is to set the default hash table size to 1021, which again saves memory at the cost of lengthening the linker's run time. This is not done however if the --hash-size switch has been used. 🫠
The --reduce-memory-overheads switch may be also be used to enable other tradeoffs in future versions of the linker. 🦋
--max-cache-size=size —ldnormally caches the relocation information and symbol tables of input files in memory with the unlimited size. This option sets the maximum cache size to size. Note: if the--no-keep-memorycommand line option has been used then the linker acts as if the maximum cache size has been set to0— ie nothing is retained. 🎀--build-id,--build-id=style — request the creation of a.note.gnu.build-idELF note section or a.buildidCOFF section. The contents of the note are unique bits identifying this linked file. style can beuuidto use 128 random bits;sha1to use a 160-bit SHA1 hash,md5to use a 128-bit MD5 hash, orxxto use a 128-bit XXHASH on the normative parts of the output contents; or0xhexstringto use a chosen bit string specified as an even number of hexadecimal digits (-and:characters between digit pairs are ignored). If style is omitted,sha1is used. 👑
The md5, sha1, and xx styles produces an identifier that is always the same in an identical output file, but are almost certainly unique among all nonidentical output files. It is not intended to be compared as a checksum for the file's contents. A linked file may be changed later by other tools, but the build ID bit string identifying the original linked file does not change. 💖
Passing none for style disables the setting from any --build-id options earlier on the command line. 🚫
--package-metadata=JSON— okay so bestie, this one asks for a.note.packageELF note section to be created ✨ the note's contents are in JSON format, per the package metadata spec. Wanna know more?https://systemd.io/ELF_PACKAGE_METADATA/— go peek. The JSON argument supports percent-encoding and these%[string]forms (where string = the name in HTML's Named Character References):%[comma]→,,%[lbrace]→{,%[quot]→",%[rbrace]→}, and%[space]→ a space character 🫶 If the JSON argument is missing/empty, that disables creation of the metadata note — but only if one had been turned on by an earlier--package-metadata. And if the linker was built with libjansson, then your JSON string gets validated fr fr.
The PE linker is out here supporting the -shared option too, which makes the output a dynamically linked library (DLL) instead of a normal executable 👑 you should name that output "*.dll" when you use it, no cap. Also? The linker fully supports the standard "*.def" files, and those can be given on the linker command line just like an object file — lowkey also it should come before the archives it exports symbols from, so that they actually get linked in, same as a normal object file 💅
On top of the options that every target shares, the PE linker has its own special command-line options that are PE-only. Options that take values can be separated from those values by either a space or an equals sign. iconic.
--add-stdcall-alias— if given, symbols with a stdcall suffix (@nn) get exported as-is and also with the suffix stripped 💖 [this option is specific to PE targeted ports of the linker]--base-file file— use file as the name of a file to save the base addresses of all the relocations needed for generating DLLs withdlltool. [this option is specific to PE targeted ports of the linker]--dll— make a DLL instead of a regular executable 🦋 you can also use-sharedor slap a"LIBRARY"into a".def"file. [this option is specific to PE targeted ports of the linker]--enable-long-section-names--disable-long-section-names— the PE variants of the COFF object format add an extension that lets you use section names longer than eight characters (eight = the normal COFF limit, sad). By default these names are only allowed in object files, because fully-linked executable images don't carry the COFF string table needed to support the longer names 🙈 As a GNU extension, you can allow them in executable images too, or — probably pointlessly! — disallow them in object files, using these two options. Executable images made with these long section names are slightly non-standard, carrying a string table like they do, and may spit out confusing output when examined with non-GNU PE-aware tools, like file viewers and dumpers. However, GDB relies on PE long section names to find Dwarf-2 debug information sections in an executable image at runtime, so if neither option is given on the command line,ldwill enable long section names — overriding the default and technically correct behaviour — when it finds debug information present while linking an executable image and not stripping symbols. [this option is specific to PE targeted ports of the linker]--enable-stdcall-fixup--disable-stdcall-fixup— if the link finds a symbol it can't resolve, it'll attempt "fuzzy linking" 😭 searching for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall) and resolves to that match. E.g. the undefined symbol_foomight get linked to the function_foo@12, or the undefined_bar@16might get linked to_bar. When the linker does this it prints a warning, since normally it should've failed to link — but sometimes import libraries generated from third-party dlls need this feature to even be usable. Give--enable-stdcall-fixupand the feature is fully enabled, warnings are NOT printed. Give--disable-stdcall-fixupand the feature is off, and those mismatches count as errors 💀 [this option is specific to PE targeted ports of the linker]--leading-underscore--no-leading-underscore— for most targets the default symbol-prefix is an underscore, defined in the target's description. This option lets you disable/enable that default underscore symbol-prefix 🌸 [this option is specific to PE targeted ports of the linker]--export-all-symbols— if given, ALL global symbols in the objects used to build a DLL get exported by the DLL ✨ heads up, this is the default if there otherwise wouldn't be any exported symbols at all. When symbols are explicitly exported via DEF files or implicitly exported via function attributes, the default is to not export anything else unless this option is given. And listen: the symbols"DllMain@12","DllEntryPoint@0","DllMainCRTStartup@12", and"impure_ptr"will not be automatically exported 🙅♀️ Also, symbols imported from other DLLs won't be re-exported, and neither will symbols specifying the DLL's internal layout — like ones starting with"_head_"or ending with"_iname". Plus, no symbols from"libgcc","libstd++","libmingw32", or"crtX.o"get exported. Symbols whose names start with"__rtti_"or"__builtin_"won't be exported either, to help with C++ DLLs. And finally, there's an extensive list of cygwin-private symbols that aren't exported (obviously this only applies when building DLLs for cygwin targets). Those cygwin-excludes are:"_cygwin_dll_entry@12","_cygwin_crt0_common@8","_cygwin_noncygwin_dll_entry@12","_fmode","_impure_ptr","cygwin_attach_dll","cygwin_premain0","cygwin_premain1","cygwin_premain2","cygwin_premain3", and"environ". [this option is specific to PE targeted ports of the linker]--exclude-symbols symbol,symbol,...— gives a list of symbols that should NOT be automatically exported. The symbol names may be delimited by commas or colons 🎀 [this option is specific to PE targeted ports of the linker]--exclude-all-symbols— says no symbols should be automatically exported, periodt. [this option is specific to PE targeted ports of the linker]--file-alignment— specify the file alignment. Sections in the file will always begin at file offsets that are multiples of this number. Defaults to 512 🧚 [this option is specific to PE targeted ports of the linker]--heap reserve--heap reserve,commit— specify the number of bytes of memory to reserve (and optionally commit) to be used as heap for this program. Default is 1MB reserved, 4K committed 💜 [this option is specific to PE targeted ports of the linker]--kill-at— if given, the stdcall suffixes (@nn) get stripped from symbols before they're exported 🔥 [this option is specific to PE targeted ports of the linker]--large-address-aware— if given, the appropriate bit in the"Characteristics"field of the COFF header gets set, indicating this executable supports virtual addresses greater than 2 gigabytes 👑 this should be used together with the/3GBor/USERVA=value megabytesswitch in the"[operating systems]"section of theBOOT.INI. Otherwise, this bit has no effect, ngl. [this option is specific to the i386 PE targeted port of the linker]--disable-large-address-aware— undoes the effect of a previous--large-address-awareoption. Super useful if--large-address-awareis always set by the compiler driver (e.g. Cygwin gcc) and the executable does not support virtual addresses greater than 2 gigabytes. [this option is specific to the i386 PE targeted port of the linker]--major-image-version value— sets the major number of the"image version". Defaults to 1. [this option is specific to PE targeted ports of the linker]--major-os-version value— sets the major number of the"os version". Defaults to 4. [this option is specific to PE targeted ports of the linker]--major-subsystem-version value— sets the major number of the"subsystem version". Defaults to 4. [this option is specific to PE targeted ports of the linker]--minor-image-version value— sets the minor number of the"image version". Defaults to 0. [this option is specific to PE targeted ports of the linker]--minor-os-version value— sets the minor number of the"os version". Defaults to 0. [this option is specific to PE targeted ports of the linker]--minor-subsystem-version value— sets the minor number of the"subsystem version". Defaults to 0. [this option is specific to PE targeted ports of the linker]--output-def file— the linker will create the file file, which'll contain a DEF file corresponding to the DLL the linker is generating 🌈 this DEF file (which should be called"*.def") may be used to create an import library with"dlltool", or used as a reference to automatically or implicitly exported symbols. [this option is specific to PE targeted ports of the linker]--enable-auto-image-base--enable-auto-image-base=value— automatically choose the image base for DLLs, optionally starting with base value, unless one is specified via the"--image-base"argument. By using a hash generated from the dllname to make unique image bases for each DLL, those in-memory collisions and relocations that can delay program execution are avoided 💅 [this option is specific to PE targeted ports of the linker]--disable-auto-image-base— do NOT automatically generate a unique image base. If there's no user-specified image base ("--image-base") then it uses the platform default. [this option is specific to PE targeted ports of the linker]--dll-search-prefix string— when linking dynamically to a dll without an import library, search for"<string><basename>.dll"in preference to"lib<basename>.dll"🦋 this behaviour lets you easily tell apart DLLs built for the various "subplatforms": native, cygwin, uwin, pw, etc. For instance, cygwin DLLs typically use"--dll-search-prefix=cyg". [this option is specific to PE targeted ports of the linker]--enable-auto-import— okay bestie, this one is iconic but also a little chaotic. It does sophisticated linking of"_symbol"to"__imp__symbol"for DATA imports from DLLs, thus making it possible to bypass the dllimport mechanism on the user side and to reference unmangled symbol names. [This option is specific to PE targeted ports of the linker]
The following remarks pertain to the original implementation of the feature and are obsolete nowadays for Cygwin and MinGW targets.
Note: Use of the 'auto-import' extension will cause the text section of the image file to be made writable. This does not conform to the PE-COFF format specification published by Microsoft.
Note - use of the'auto-import'extension will also cause read only data which would normally be placed into the.rdatasection to be placed into the.datasection instead. This is in order to work around a problem with consts that is described here:http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html
Using 'auto-import' generally will 'just work' -- but sometimes you may see this message:
"variable '<var>' can't be auto-imported. Please read the documentation for ld's "--enable-auto-import" for details."This message occurs when some (sub)expression accesses an address ultimately given by the sum of two constants (Win32 import tables only allow one). Instances where this may occur include accesses to member fields of struct variables imported from a DLL, as well as using a constant index into an array variable imported from a DLL. Any multiword variable (arrays, structs, long long, etc) may trigger this error condition. However, regardless of the exact data type of the offending exported variable, ld will always detect it, issue the warning, and exit.
There are several ways to address this difficulty, regardless of the data type of the exported variable:
One way is to use --enable-runtime-pseudo-reloc switch. This leaves the task of adjusting references in your client code for runtime environment, so this method works only when runtime environment supports this feature.
A second solution is to force one of the 'constants' to be a variable -- that is, unknown and un-optimizable at compile time. For arrays, there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. Thus:
extern type extern_array[];
extern_array[1] -->
{ volatile type *t=extern_array; t[1] }or
extern type extern_array[];
extern_array[1] -->
{ volatile int t=1; extern_array[t] }For structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the ...) variable:
extern struct s extern_struct;
extern_struct.field -->
{ volatile struct s *t=&extern_struct; t->field }or
extern long long extern_ll;
extern_ll -->
{ volatile long long * local_ll=&extern_ll; *local_ll }A third method of dealing with this difficulty is to abandon 'auto-import' for the offending symbol and mark it with "__declspec(dllimport)". However, in practice that requires using compile-time #defines to indicate whether you are building a DLL, building client code that will link to the DLL, or merely building/linking to a static library. In making the choice between the various methods of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:
Original:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}Solution 1:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
/* This workaround is for win32 and cygwin; do not "optimize" */
volatile int *parr = arr;
printf("%d\n",parr[1]);
}Solution 2:
--foo.h
/* Note: auto-export is assumed (no __declspec(dllexport)) */
#if (defined(_WIN32) || defined(__CYGWIN__)) && \
!(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
#define FOO_IMPORT __declspec(dllimport)
#else
#define FOO_IMPORT
#endif
extern FOO_IMPORT int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}A fourth way to avoid this problem is to re-code your library to use a functional interface rather than a data interface for the offending variables (e.g. set_foo() and get_foo() accessor functions).
--disable-auto-import— Do not attempt to do sophisticated linking of"_symbol"to"__imp__symbol"for DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]--enable-runtime-pseudo-reloc— If your code contains expressions described in--enable-auto-importsection, that is, DATA imports from DLL with non-zero offset, this switch will create a vector of'runtime pseudo relocations'which can be used by runtime environment to adjust references to such data in your client code. [This option is specific to PE targeted ports of the linker]--disable-runtime-pseudo-reloc— Do not create pseudo relocations for non-zero offset DATA imports from DLLs. [This option is specific to PE targeted ports of the linker]--enable-extra-pe-debug— Show additional debug info related to auto-import symbol thunking. [This option is specific to PE targeted ports of the linker]--section-alignment— Sets the section alignment. Sections in memory will always begin at addresses which are a multiple of this number. Defaults to0x1000. [This option is specific to PE targeted ports of the linker]--stack reserve,--stack reserve,commit— Specify the number of bytes of memory to reserve (and optionally commit) to be used as stack for this program. The default is 2MB reserved, 4K committed. [This option is specific to PE targeted ports of the linker]--subsystem which,--subsystem which:major,--subsystem which:major.minor— Specifies the subsystem under which your program will execute. The legal values for which are"native","windows","console","posix", and"xbox". You may optionally set the subsystem version also. Numeric values are also accepted for which. [This option is specific to PE targeted ports of the linker]
The following options set flags in the "DllCharacteristics" field of the PE file header: [These options are specific to PE targeted ports of the linker]
--high-entropy-va,--disable-high-entropy-va— Image is compatible with 64-bit address space layout randomization (ASLR). This option is enabled by default for 64-bit PE images in MinGW targets.
This option also implies --dynamicbase and --enable-reloc-section. [This options is specific to 64-bit PE targeted ports of the linker]
--dynamicbase,--disable-dynamicbase— The image base address may be relocated using address space layout randomization (ASLR). This feature was introduced with MS Windows Vista. This option is enabled by default for MinGW targets but can be disabled via the--disable-dynamicbaseoption. This option also implies--enable-reloc-section.--forceinteg,--disable-forceinteg— Code integrity checks are enforced. This option is disabled by default.--nxcompat,--disable-nxcompat— The image is compatible with the Data Execution Prevention. This feature was introduced with MS Windows XP SP2. The option is enabled by default for MinGW targets.--no-isolation,--disable-no-isolation— Although the image understands isolation, do not isolate the image. This option is disabled by default.--no-seh,--disable-no-seh— The image does not use SEH. No SE handler may be called from this image. This option is disabled by default.--no-bind,--disable-no-bind— Do not bind this image. This option is disabled by default.--wdmdriver,--disable-wdmdriver— The driver uses the MS Windows Driver Model. This option is disabled by default.--tsaware,--disable-tsaware— The image is Terminal Server aware. This option is disabled by default.--insert-timestamp,--no-insert-timestamp— Insert a real timestamp into the image. This is the default behaviour as it matches legacy code and it means that the image will work with other, proprietary tools. The problem with this default is that it will result in slightly different images being produced each time the same sources are linked. The option--no-insert-timestampcan be used to insert a zero value for the timestamp, this ensuring that binaries produced from identical sources will compare identically.
If --insert-timestamp is active then the time inserted is either the time that the linking takes place or, if the "SOURCE_DATE_EPOCH" environment variable is defined, the number of seconds since Unix epoch as specified by that variable.
--enable-reloc-section,--disable-reloc-section— Create the base relocation table, which is necessary if the image is loaded at a different image base than specified in the PE header. This option is enabled by default.
The C6X uClinux target uses a binary format called DSBT to support shared libraries. Each shared library in the system needs to have a unique index; all executables use an index of 0.
--dsbt-size size— This option sets the number of entries in the DSBT of the current executable or shared library to size. The default is to create a table with 64 entries.--dsbt-index index— This option sets the DSBT index of the current executable or shared library to index. The default is 0, which is appropriate for generating executables. If a shared library is generated with a DSBT index of 0, the"R_C6000_DSBT_INDEX"relocs are copied into the output file.
The --no-merge-exidx-entries switch — bestie, this one disables the merging of adjacent exidx entries in frame unwind info. That's it. That's the whole vibe. 💅
--branch-stub— this option enables linker branch relaxation by inserting branch stub sections when needed to extend the range of branches. And before you go "wait do I need this", no babe, this option is usually not required, because C-SKY supports branch and call instructions that can access the full memory range, and branch relaxation is normally handled by the compiler or assembler anyway. ✨--stub-group-size=N— okay so this one gives you finer control of linker branch stub creation 🎀 It sets the maximum size of a group of input sections that can be handled by one stub section. A negative value of N locates stub sections after their branches, while a positive value lets stub sections appear either before or after the branches. And values of1or-1mean "linker bestie, you choose suitable defaults, I trust you". 🫶
✨ 68HC11 and 68HC12 things ✨
The 68HC11 and 68HC12 linkers support specific options to control the memory bank switching mapping and trampoline code generation. Very demure, very specific. 💖
--no-trampoline— this disables the generation of trampoline. By default a trampoline is generated for each far function which is called using a"jsr"instruction (which happens when a pointer to a far function is taken). So yeah, default = trampolines happening. 🦋--bank-windowname — this tells the linker the name of the memory region in theMEMORYspecification that describes the memory bank window. That region's definition is then used by the linker to compute paging and addresses within the memory window. Math but make it banks. 💀
🌈 68K GOT generation 🌈
The following options are supported to control handling of GOT generation when linking for 68K targets.
--got=type — tells the linker which GOT generation scheme to use. type should be one ofsingle,negative,multigotortarget. For more information refer to the Info entry forld. iykyk 📖
💅 MIPS microMIPS instruction generation + branch relocation checks 💅
The following options are supported to control microMIPS instruction generation and branch relocation checks for ISA mode transitions when linking for MIPS targets. Buckle up, there's a pair for everything. 🌸
--insn32--no-insn32
These control the choice of microMIPS instructions used in code generated by the linker — like the stuff in the PLT or lazy binding stubs, or in relaxation. If --insn32 is used, then the linker only uses 32-bit instruction encodings. By default, or if --no-insn32 is used, all instruction encodings are used, including 16-bit ones where possible. So tiny instructions, when tiny instructions are possible. 🧚
--ignore-branch-isa--no-ignore-branch-isa
These control branch relocation checks for invalid ISA mode transitions. If --ignore-branch-isa is used, then the linker accepts any branch relocations and any ISA mode transition required is lost in relocation calculation — except for some cases of "BAL" instructions which meet relaxation conditions and get converted to equivalent "JALX" instructions as the associated relocation is calculated. By default, or if --no-ignore-branch-isa is used, a check is made, causing the loss of an ISA mode transition to produce an error. So: ignoring = quiet vibes, default = it will absolutely yell at you. 😭
--compact-branches--no-compact-branches
These control the generation of compact instructions by the linker in the PLT entries for MIPS R6. Short and slay. ✨
🍓 pdp11-aout output formats 🍓
For the pdp11-aout target, three variants of the output format can be produced as selected by the following options. The default variant for pdp11-aout is the --omagic option, whereas for other targets --nmagic is the default. The --imagic option is defined only for the pdp11-aout target, while the others are described here as they apply to the pdp11-aout target. History lesson + linker flags, we love a crossover episode. 👑
-N,--omagic— marks the output as"OMAGIC"(0407) in the a.out header to indicate that the text segment is not to be write-protected and shared. Since the text and data sections are both readable and writable, the data section is allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs, and it's the default forldon PDP11 Unix systems from the beginning through2.11BSD. Ancient. Iconic. 💜-n,--nmagic— marks the output as"NMAGIC"(0410) in the a.out header to indicate that when the output file is executed, the text portion will be read-only and shareable among all processes executing the same file. This involves moving the data areas up to the first possible 8K byte page boundary following the end of the text. This option creates a pure executable format. Sharing is caring, fr fr. 🫶-z,--imagic— marks the output as"IMAGIC"(0411) in the a.out header to indicate that when the output file is executed, the program text and data areas will be loaded into separate address spaces using the split instruction and data space feature of the memory management unit in larger models of the PDP11. This doubles the address space available to the program. The text segment is again pure, write-protected, and shareable. The only difference in the output format between this option and the others, besides the magic number, is that both the text and data sections start at location0. The-zoption selected this format in2.11BSD. This option creates a separate executable format. Double the address space, double the drama. 💀--no-omagic— equivalent to--nmagicforpdp11-aout.
🌟 ENVIRONMENT 🌟
You can change the behaviour of ld with the environment variables "GNUTARGET", "LDEMULATION" and "COLLECT_NO_DEMANGLE". Three little levers, big linker energy. 🎀
"GNUTARGET" determines the input-file object format if you don't use -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there is no "GNUTARGET" in the environment, ld uses the natural format of the target. If "GNUTARGET" is set to "default" then BFD attempts to discover the input format by examining binary input files. This method often succeeds, but there are potential ambiguities, since there is no method of ensuring that the magic number used to specify object-file formats is unique. However, the configuration procedure for BFD on each system places the conventional format for that system first in the search-list, so ambiguities are resolved in favor of convention. So it's fine. Mostly. 🦋
"LDEMULATION" determines the default emulation if you don't use the -m option. The emulation can affect various aspects of linker behaviour, particularly the default linker script. You can list the available emulations with the --verbose or -V options. If the -m option is not used, and the "LDEMULATION" environment variable is not defined, the default emulation depends upon how the linker was configured. It's giving ✨circumstantial✨.
Normally, the linker will default to demangling symbols. However, if "COLLECT_NO_DEMANGLE" is set in the environment, then it will default to not demangling symbols. This environment variable is used in a similar fashion by the "gcc" linker wrapper program. The default may be overridden by the --demangle and --no-demangle options. So many layers of "well actually, it depends". 😭
If the PE/COFF specific --insert-timestamp is active and the SOURCE_DATE_EPOCH environment variable is defined, then the timestamp value in this variable will be inserted into the COFF header instead of the current time. Time travel but make it reproducible. ⭐
If the "LD_STATS" environment variable is defined then linker resource use information will be recorded, just as if the --stats option had been used. If the "LD_STATS" variable has a string value then this will be used as the name of a file into which the information should be stored. Otherwise the information will be sent to the standard output stream. Receipts: enabled. 🔥
👀 SEE ALSO 👀
ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld.
Go read those too, bestie, or at least let objdump(1) buy you a coffee first. ☕
💜 COPYRIGHT 💜
Copyright (c) 1991-2026 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".
No cap: that license text is legally load-bearing, so it stays exactly as written. Copy it, share it, remix it — just keep it this shape and keep that section title intact. 📜✨
and that's the whole LD(1) page, bestie!! 🎉✨💖 This absolute icon comes from binutils-2.47, dated 2026-09-19 — so go forth, link slayfully, and may your relocations always resolve on the first try. 🫶👑🌈
📦 where this page comes from
- ubuntu stonking: binutils-sh-elf 2.47+3build2 · GPL-3.0-or-later
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms