LD(1)
✨ LD(1) — The GNU linker ✨
okay bestie, welcome to the manual page for ld, the GNU linker, from the GNU Development Tools. this is literally the main character of linking, no cap. 💅
✨ NAME ✨
ld — The GNU linker. that's it, that's the name, iconic. 👑
🌸 SYNOPSIS 🌸
ld [options] objfile ...💅 DESCRIPTION 💅
okay so ld combines a number of object and archive files, relocates their data, and ties up symbol references. Usually the very last step in compiling a program is to run ld. periodt. 🫶
ld accepts Linker Command Language files written in a superset of AT&T's Link Editor Command Language syntax, to provide explicit and total control over the linking process. we love a flexible queen. ✨
This man page does not describe the command language; see the ld entry in info for full details on the command language and on other aspects of the GNU linker. iykyk. 📖
This version of ld uses the general purpose BFD libraries to operate on object files. This allows ld to read, combine, and write object files in many different formats---for example, COFF or a.out. Different formats may be linked together to produce any available kind of object file. versatility is the vibe. 🌈
Aside from its flexibility, the GNU linker is more helpful than other linkers in providing diagnostic information. Many linkers abandon execution immediately upon encountering an error; whenever possible, ld continues executing, allowing you to identify other errors (or, in some cases, to get an output file in spite of the error). not me being emotionally attached to a linker that doesn't ghost you on the first error 😭💖
The GNU linker ld is meant to cover a broad range of situations, and to be as compatible as possible with other linkers. As a result, you have many choices to control its behavior. options for days, fr fr. 🎀
🎀 OPTIONS 🎀
The linker supports a plethora of command-line options, but in actual practice few of them are used in any particular context. For instance, a frequent use of ld is to link standard Unix object files on a standard, supported Unix system. On such a system, to link a file hello.o:
ld -o <output> /lib/crt0.o hello.o -lcThis tells ld to produce a file called output as the result of linking the file /lib/crt0.o with hello.o and the library libc.a, which will come from the standard search directories. (See the discussion of the -l option below.) she's serving utility. 💅
Some of the command-line options to ld may be specified at any point in the command line. However, options which refer to files, such as -l or -T, cause the file to be read at the point at which the option appears in the command line, relative to the object files and other file options. Repeating non-file options with a different argument will either have no further effect, or override prior occurrences (those further to the left on the command line) of that option. Options which may be meaningfully specified more than once are noted in the descriptions below. order matters, bestie. 🧚
Non-option arguments are object files or archives which are to be linked together. They may follow, precede, or be mixed in with command-line options, except that an object file argument may not be placed between an option and its argument. so don't interrupt the option/argument moment, okay? 🙈
Usually the linker is invoked with at least one object file, but you can specify other forms of binary input files using -l, -R, and the script command language. If no binary input files at all are specified, the linker does not produce any output, and issues the message No input files. empty link? not the vibe. 💀
If the linker cannot recognize the format of an object file, it will assume that it is a linker script. A script specified in this way augments the main linker script used for the link (either the default linker script or the one specified by using -T). This feature permits the linker to link against a file which appears to be an object or an archive, but actually merely defines some symbol values, or uses INPUT or GROUP to load other objects. Specifying a script in this way merely augments the main linker script, with the extra commands placed after the main script; use the -T option to replace the default linker script entirely, but note the effect of the INSERT command. plot twist: it's a script. 📜
For options whose names are a single letter, option arguments must either follow the option letter without intervening whitespace, or be given as separate arguments immediately following the option that requires them. no spacing drama, please. ✋
For options whose names are multiple letters, either one dash or two can precede the option name; for example, -trace-symbol and --trace-symbol are equivalent. Note---there is one exception to this rule. Multiple letter options that start with a lower case 'o' can only be preceded by two dashes. This is to reduce confusion with the -o option. So for example -omagic sets the output file name to magic whereas --omagic sets the NMAGIC flag on the output. the lowercase-o exception is lowkey iconic. 👑
Arguments to multiple-letter options must either be separated from the option name by an equals sign, or be given as separate arguments immediately following the option that requires them. For example, --trace-symbol foo and --trace-symbol=foo are equivalent. Unique abbreviations of the names of multiple-letter options are accepted. abbreviations? slay. ✨
Note---if the linker is being invoked indirectly, via a compiler driver (e.g. gcc) then all the linker command-line options should be prefixed by -Wl, (or whatever is appropriate for the particular compiler driver) like this:
gcc -Wl,--start-group foo.o bar.o -Wl,--end-groupThis is important, because otherwise the compiler driver program may silently drop the linker options, resulting in a bad link. Confusion may also arise when passing options that require values through a driver, as the use of a space between option and argument acts as a separator, and causes the driver to pass only the option to the linker and the argument to the compiler. In this case, it is simplest to use the joined forms of both single- and multiple-letter options, such as:
gcc foo.o bar.o -Wl,-eENTRY -Wl,-Map=a.mapHere is a table of the generic command-line switches accepted by the GNU linker:
@file— Read command-line options from file. The options read are inserted in place of the original@fileoption. If file does not exist, or cannot be read, then the option will be treated literally, and not removed.
Options in file are separated by whitespace. A whitespace character may be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) may be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options will be processed recursively. nested options? recursive queen. 🌀
-akeyword — This option is supported for HP/UX compatibility. The keyword argument must be one of the stringsarchive,shared, ordefault.-aarchiveis functionally equivalent to-Bstatic, and the other two keywords are functionally equivalent to-Bdynamic. This option may be used any number of times. old-school compatibility, we respect it. 🫡--auditAUDITLIB — Adds AUDITLIB to theDT_AUDITentry of the dynamic section. AUDITLIB is not checked for existence, nor will it use theDT_SONAMEspecified in the library. If specified multiple timesDT_AUDITwill contain a colon separated list of audit interfaces to use. If the linker finds an object with an audit entry while searching for shared libraries, it will add a correspondingDT_DEPAUDITentry in the output file. This option is only meaningful on ELF platforms supporting the rtld-audit interface. ELF girlies, this one's for you. 💖-binput-format,--format=input-format —ldmay be configured to support more than one kind of object file. If yourldis configured this way, you can use the-boption to specify the binary format for input object files that follow this option on the command line. Even whenldis configured to support alternative object formats, you don't usually need to specify this, asldshould be configured to expect as a default input format the most usual format on each machine. input-format is a text string, the name of a particular format supported by the BFD libraries. (You can list the available binary formats withobjdump -i.)
You may want to use this option if you are linking files with an unusual binary format. You can also use -b to switch formats explicitly (when linking object files of different formats), by including -b input-format before each group of object files in a particular format.
The default format is taken from the environment variable GNUTARGET.
You can also define the input format from a script, using the command TARGET; format switching is a whole mood. 🦋
-cMRI-commandfile,--mri-script=MRI-commandfile — For compatibility with linkers produced by MRI,ldaccepts script files written in an alternate, restricted command language, described in the MRI Compatible Script Files section of GNU ld documentation. Introduce MRI script files with the option-c; use the-Toption to run linker scripts written in the general-purposeldscripting language. If MRI-cmdfile does not exist,ldlooks for it in the directories specified by any-Loptions. MRI script girlies, rise. 🌸-d,-dc,-dp— These three options are equivalent; multiple forms are supported for compatibility with other linkers. They assign space to common symbols even if a relocatable output file is specified (with-r). The script commandFORCE_COMMON_ALLOCATIONhas the same effect. three names, one slay. 💅--depauditAUDITLIB,-PAUDITLIB — Adds AUDITLIB to theDT_DEPAUDITentry of the dynamic section. AUDITLIB is not checked for existence, nor will it use theDT_SONAMEspecified in the library. If specified multiple timesDT_DEPAUDITwill contain a colon separated list of audit interfaces to use. This option is only meaningful on ELF platforms supporting the rtld-audit interface. The-Poption is provided for Solaris compatibility. Solaris said "same energy," and we love that. ☀️--enable-linker-version— Enables theLINKER_VERSIONlinker script directive, described in Output Section Data. If this directive is used in a linker script and this option has been enabled then a string containing the linker version will be inserted at the current point.
Note - this location of this option on the linker command line is significant. It will only affect linker scripts that come after it on the command line, or which are built into the linker. position matters, bestie. 📍
--disable-linker-version— Disables theLINKER_VERSIONlinker script directive, so that it does not insert a version string. This is the default. the default is chill, no version string, no stress. 😌--enable-non-contiguous-regions— okay so bestie, normally if an input section doesn't fit a matching output section, the linker throws hands and errors out. This flag says chill. Instead, the linker tries to allocate that input section to the subsequent matching output sections, and only actually errors if no output section is big enough. It's giving "I have several non-contiguous memory regions and honestly my input section isn't picky about which one." The order in which input sections get evaluated does not change, like fr fr:
MEMORY {
MEM1 (rwx) : ORIGIN = 0x1000, LENGTH = 0x14
MEM2 (rwx) : ORIGIN = 0x1000, LENGTH = 0x40
MEM3 (rwx) : ORIGIN = 0x2000, LENGTH = 0x40
}
SECTIONS {
mem1 : { *(.data.*); } > MEM1
mem2 : { *(.data.*); } > MEM2
mem3 : { *(.data.*); } > MEM3
}
with input sections:
.data.1: size 8
.data.2: size 0x10
.data.3: size 4
results in .data.1 affected to mem1, and .data.2 and .data.3
affected to mem2, even though .data.3 would fit in mem3.Heads up queen: this option is incompatible with INSERT statements because it changes the way input sections are mapped to output sections. No cap. 💅
--enable-non-contiguous-regions-warnings— turns on warnings for when--enable-non-contiguous-regionslets through possibly unexpected matches in section mapping. Why do we care? Because those sneaky matches could end up silently discarding a section instead of failing like it should when it doesn't fit any output region. 🫶-eentry,--entry=entry— use entry as the explicit symbol for where your program starts executing, instead of the default entry point. If there's no symbol actually named entry, the linker will try to parse entry as a number and use that as the entry address (interpreted in base 10; you may use a leading0xfor base 16, or a leading0for base 8). For i386 PE, entry can also be the original function name — without the leading underscore and/or the trailing stdcall@numberwhen applicable. ✨--exclude-libslib,lib,... — gives you a list of archive libraries whose symbols should not be automatically exported. Library names can be delimited by commas or colons. Saying--exclude-libs ALLexcludes symbols in all archive libraries from automatic export. This one's only available for the i386 PE targeted port of the linker and for ELF targeted ports. For i386 PE, symbols explicitly listed in a.deffile are still exported, regardless of this option. For ELF targeted ports, symbols affected by this option get treated as hidden. 🙈--exclude-modules-for-implibmodule,module,... — a list of object files or archive members whose symbols should not be automatically exported, but which should be copied wholesale into the import library being generated during the link. Module names can be delimited by commas or colons, and must match exactly the filenames used by ld to open the files. For archive members, that's just the member name; but for object files, the name listed must include and match precisely any path used to specify the input file on the linker's command-line. Only available for the i386 PE targeted port of the linker. Symbols explicitly listed in a.deffile are still exported, regardless of this option. 🎀-E,--export-dynamic,--no-export-dynamic— when you're creating a dynamically linked executable, using-Eor--export-dynamicmakes the linker add all symbols to the dynamic symbol table. The dynamic symbol table is the set of symbols visible from dynamic objects at run time.
If you don't use either of these options (or you use --no-export-dynamic to restore the default behavior), the dynamic symbol table will normally contain only those symbols which are referenced by some dynamic object mentioned in the link.
If you use dlopen to load a dynamic object that needs to refer back to the symbols defined by the program, rather than some other dynamic object, then you'll probably need this option when linking the program itself.
You can also use the dynamic list to control what symbols should be added to the dynamic symbol table if the output format supports it — see the description of --dynamic-list.
Note that this option is specific to ELF targeted ports. PE targets support a similar function to export all symbols from a DLL or EXE; see the description of --export-all-symbols below. 👑
--export-dynamic-symbol=glob— when creating a dynamically linked executable, symbols matching glob get added to the dynamic symbol table. When creating a shared library, references to symbols matching glob will not be bound to the definitions within the shared library. This option is a no-op when creating a shared library and-Bsymbolicor--dynamic-listare not specified. Only meaningful on ELF platforms which support shared libraries. 🌸--export-dynamic-symbol-list=file— specify a--export-dynamic-symbolfor each pattern in the file. The format of the file is the same as the version node without scope and node name. SeeVERSIONfor more information.-EB— link big-endian objects. This affects the default output format. 💜-EL— link little-endian objects. This affects the default output format. 🦋-fname,--auxiliary=name— when creating an ELF shared object, set the internalDT_AUXILIARYfield to the specified name. This tells the dynamic linker that the symbol table of the shared object should be used as an auxiliary filter on the symbol table of the shared object name.
If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_AUXILIARY field. If the dynamic linker resolves any symbols from the filter object, it'll first check whether there's a definition in the shared object name. If there is one, it'll be used instead of the definition in the filter object. The shared object name need not exist. So the shared object name may be used to provide an alternative implementation of certain functions — perhaps for debugging or for machine-specific performance.
This option may be specified more than once. The DT_AUXILIARY entries get created in the order in which they appear on the command line. ✨
-Fname,--filter=name— when creating an ELF shared object, set the internalDT_FILTERfield to the specified name. This tells the dynamic linker that the symbol table of the shared object which is being created should be used as a filter on the symbol table of the shared object name.
If you later link a program against this filter object, then when you run the program, the dynamic linker will see the DT_FILTER field. The dynamic linker will resolve symbols according to the symbol table of the filter object as usual, but it'll actually link to the definitions found in the shared object name. So the filter object can be used to select a subset of the symbols provided by the object name.
Some older linkers used the -F option throughout a compilation toolchain for specifying object-file format for both input and output object files. The GNU linker uses other mechanisms for this purpose: the -b, --format, --oformat options, the TARGET command in linker scripts, and the GNUTARGET environment variable. The GNU linker will ignore the -F option when not creating an ELF shared object. 💀
-fini=name— when creating an ELF executable or shared object, callNAMEwhen the executable or shared object is unloaded, by settingDT_FINIto the address of the function. By default, the linker uses_finias the function to call.-g— ignored. Provided for compatibility with other tools. That's it, that's the whole vibe. 🙈-Gvalue,--gpsize=value— set the maximum size of objects to be optimized using the GP register to value. This is only meaningful for object file formats such as MIPS ELF that support putting large and small objects into different sections. It's ignored for other object file formats.-hname,-soname=name— when creating an ELF shared object, set the internalDT_SONAMEfield to the specified name. When an executable is linked with a shared object which has aDT_SONAMEfield, then when the executable is run, the dynamic linker will attempt to load the shared object specified by theDT_SONAMEfield rather than using the file name given to the linker. 🌈-i— perform an incremental link (same as option-r).-init=name— when creating an ELF executable or shared object, callNAMEwhen the executable or shared object is loaded, by settingDT_INITto the address of the function. By default, the linker uses_initas the function to call.-lnamespec,--library=namespec— add the archive or object file specified by namespec to the list of files to link. This option may be used any number of times. If namespec is of the form:filename, ld will search the library path for a file called filename, otherwise it'll search the library path for a file calledlibnamespec.a.
On systems which support shared libraries, ld may also search for files other than libnamespec.a. Specifically, on ELF and SunOS systems, ld will search a directory for a library called libnamespec.so before searching for one called libnamespec.a. (By convention, a .so extension indicates a shared library.) Note that this behavior does not apply to :filename, which always specifies a file called filename.
The linker will search an archive only once, at the location where it's specified on the command line. If the archive defines a symbol which was undefined in some object that appeared before the archive on the command line, the linker will include the appropriate file(s) from the archive. However, an undefined symbol in an object appearing later on the command line will not cause the linker to search the archive again.
See the -( option for a way to force the linker to search archives multiple times.
You may list the same archive multiple times on the command line. 👑
okay so real talk bestie — this type of archive searching? standard for Unix linkers, no notes. BUT if you're using ld on AIX, heads up: it's different from how the AIX linker does it. iykyk 💅
-Lsearchdir,--library-path=searchdir — bestie this one adds searchdir to the list of paths whereldgoes looking for archive libraries andldcontrol scripts. You can drop this flag as many times as you want. The dirs get searched in the order you typed them on the command line, and command-line dirs come before the default dirs. Every-Lapplies to every-l, no matter what order they show up in — no cap. The one exception:-Loptions do not affect howldhunts for a linker script unless the-Toption is specified.
If searchdir starts with = or $SYSROOT, then that prefix gets swapped out for the sysroot prefix — controlled by the --sysroot option, or whatever was set when the linker was configured. <butterfly>🦋</butterfly>
The default set of paths it searches (like, when you don't pass -L) depends on which emulation mode ld is running and sometimes on how it was configured. <shrug energy>
Oh and you can also specify paths in a link script with the SEARCH_DIR command. Dirs specified that way get searched at the point in the linker script where it appears in the command line. <sparkles>✨</sparkles>
-memulation — emulate the emulation linker. You can list the available emulations with--verboseor-V. go look, it's free
If -m isn't used, the emulation gets taken from the LDEMULATION environment variable, if that's defined.
Otherwise? The default emulation depends on how the linker was configured. mystery box behavior, we love her
--remap-inputs=pattern=filename,--remap-inputs-file=file — these two are the glow-up options: they let you change input file names before the linker tries to open them. So--remap-inputs=foo.o=bar.omeans any attempt to load a file calledfoo.owill instead try to load a file calledbar.o. Wildcard patterns are allowed in the first filename, so--remap-inputs=foo*.o=bar.orenames any input file matchingfoo*.otobar.o. <iconic>
There's an alternative form, --remap-inputs-file=filename, which lets the remappings be read from a file. Each line in that file can hold a single remapping. Blank lines are ignored. Anything from a hash character (#) to the end of a line counts as a comment and is also ignored. The mapping pattern can be separated from the filename by whitespace or an equals (=) character.
You can specify these options multiple times and their contents accumulate. Remappings get processed in the order they occur on the command line, and if they come from a file, in the order they occur in the file. And once a match is made? No further checking for that filename, periodt.
If the replacement filename is /dev/null or just NUL, then the remapping will actually cause the input file to be ignored. Which is a genuinely convenient way to experiment with removing input files from a complicated build environment. <sparkles>🍓</sparkles>
watch out: this option is position dependent and only affects filenames that come after it on the command line. So:
ld foo.o --remap-inputs=foo.o=bar.oWill have no effect. Whereas:
ld --remap-inputs=foo.o=bar.o foo.oWill rename the input file foo.o to bar.o. <slay>
Note — these options also affect files referenced by INPUT statements in linker scripts. But since linker scripts are processed after the entire command line is read, the position of the remap options on the command line is not significant there.
If the verbose option is enabled then any mappings that match will be reported — although again, the verbose option needs to be enabled on the command line before the remapped filenames appear. <timing is everything>
If -Map or --print-map are enabled then the remapping list will be included in the map output. nice.
-M,--print-map— prints a link map to standard output. A link map gives you the tea about the link, including:- Where object files are mapped into memory. 🗺️
- How common symbols are allocated.
- All archive members included in the link, with a mention of the symbol which caused the archive member to be brought in.
- The values assigned to symbols.
Note — symbols whose values are computed by an expression which involves a reference to a previous value of the same symbol may not have correct result displayed in the link map. This is because the linker discards intermediate results and only retains the final value of an expression. Under such circumstances the linker will display the final value enclosed by square brackets. So for example a linker script containing:
foo = 1
foo = foo * 4
foo = foo + 8will produce the following output in the link map if the -M option is used:
0x00000001 foo = 0x1
[0x0000000c] foo = (foo * 0x4)
[0x0000000c] foo = (foo + 0x8)See Expressions for more info about expressions in linker scripts. <go read it bestie>
- How GNU properties are merged.
When the linker merges input .note.gnu.property sections into one output .note.gnu.property section, some properties are removed or updated. These actions are reported in the link map. For example:
Removed property 0xc0000002 to merge foo.o (0x1) and bar.o (not found)This indicates that property 0xc0000002 is removed from output when merging properties in foo.o, whose property 0xc0000002 value is 0x1, and bar.o, which doesn't have property 0xc0000002.
Updated property 0xc0010001 (0x1) to merge foo.o (0x1) and bar.o (0x1)This indicates that property 0xc0010001 value is updated to 0x1 in output when merging properties in foo.o, whose 0xc0010001 property value is 0x1, and bar.o, whose 0xc0010001 property value is 0x1.
- On some ELF targets, a list of fixups inserted by
--relax:
foo.o: Adjusting branch at 0x00000008 towards "far" in section .textThis indicates that the branch at 0x00000008 in foo.o, targeting the symbol "far" in section .text, has been replaced by a trampoline. <💀 wild>
--print-map-discarded,--no-print-map-discarded— print (or don't print) the list of discarded and garbage collected sections in the link map. Enabled by default. 🎀--print-map-locals,--no-print-map-locals— print (or don't print) local symbols in the link map. Local symbols get the text(local)printed before their name, and get listed after all the global symbols in a given section. Temporary local symbols (typically those that start with.L) will not be included in the output. Disabled by default.-n,--nmagic— turns off page alignment of sections, and disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as"NMAGIC". bold move honestly-N,--omagic— sets the text and data sections to be readable and writable. Also, it does not page-align the data segment, and disables linking against shared libraries. If the output format supports Unix style magic numbers, it marks the output as"OMAGIC".
Note: although a writable text section is allowed for PE-COFF targets, it does not conform to the format specification published by Microsoft. <😭>
--no-omagic— this option negates most of the effects of the-Noption. It sets the text section to be read-only, and forces the data segment to be page-aligned.
Note — this option does not enable linking against shared libraries. Use -Bdynamic for that. read the fine print bestie 💅
-ooutput,--output=output — use output as the name for the program produced byld. If this option isn't specified, the namea.outis used by default. The script commandOUTPUTcan also specify the output file name.
Note — the linker will delete the output file before it starts to write to it. It'll do this even if it turns out the link cannot be completed due to errors. <💀>
Note — the linker will check to make sure the output file name doesn't match the name of any of the input files, but that is all. In particular it will not complain if the output file might overwrite a source file or some other important file. Therefore in build systems it's recommended to use the -o option as the last option on the linker command line. For example consider:
ld -o $(EXE) $(OBJS)
ld $(OBJS) -o $(EXE)If the EXE variable is not defined for some reason, the first version of the linker command could end up deleting one of the object files (the first one in the OBJS list) whereas the second version of the linker command will generate an error message and not delete anything. <iconic safety tip, no cap>
--dependency-file=depfile — writes a dependency file to depfile. This file contains a rule suitable for"make"describing the output file and all the input files that were read to produce it. The output is similar to the compiler's output with-M -MP.
Note that there is no option like the compiler's-MM, to exclude"system files"(which is not a well-specified concept in the linker, unlike"system headers"in the compiler). So the output from--dependency-fileis always specific to the exact state of the installation where it was produced, and should not be copied into distributed makefiles without careful editing. fr fr, don't just paste it around
-Olevel — if level is a numeric value greater than zero,ldoptimizes the output. This might take significantly longer and therefore probably should only be enabled for the final binary. At the moment this option only affects ELF shared library generation. Future releases of the linker may make more use of this option. Also, currently there is no difference in the linker's behaviour for different non-zero values of this option. Again — this may change with future releases. <butterfly>🦋</butterfly>-plugin name— pulls a plugin into the linking party 🎉. The name param is the absolute filename of the plugin, fr fr, no shortcuts. Normally your compiler adds this one automatically when it's doing link time optimization, but bestie, if you wanna add your own plugins, you absolutely can 💅.
Heads up tho: the place where compiler-originated plugins live is not the same place where ar, nm and ranlib go looking for their plugins 🙈. So if you want those commands to actually use a compiler-based plugin, you gotta copy it into the ${libdir}/bfd-plugins directory first. Good news: all gcc-based linker plugins are backward compatible, so copying in just the newest one is enough ✨.
--push-state— saves the current state of all the flags that control input file handling, so you can restore every single one of them later with one matching--pop-state🫶.
The options that get covered are: -Bdynamic, -Bstatic, -dn, -dy, -call_shared, -non_shared, -static, -N, -n, --whole-archive, --no-whole-archive, -r, -Ur, --copy-dt-needed-entries, --no-copy-dt-needed-entries, --as-needed, --no-as-needed, and -a.
One big use case is pkg-config specs 📦. When you use it with --libs, it lists all possibly needed libraries and then those get linked in all the time. Way better to return something like this:
-Wl,--push-state,--as-needed -libone -libtwo -Wl,--pop-state--pop-state— undoes what--push-statedid, restoring the previous values of all those input-file-handling flags. The little rewind button of linker state 🔄.-q,--emit-relocs— leaves relocation sections and their contents in fully linked executables 👑. Post-link analysis and optimization tools might need this info to correctly modify executables. Downside: it makes your executables bigger 😭.
This option is currently only supported on ELF platforms.
--force-dynamic— forces the output file to have dynamic sections. This one is specific to VxWorks targets 🎯.-r,--relocatable— generates relocatable output, i.e. an output file that can go on to serve as input toldagain. People call this partial linking 💫. Side effect: in environments that support standard Unix magic numbers, this also sets the output file's magic number to"OMAGIC". If you don't specify this option, you get an absolute file. And when you're linking C++ programs, this option will not resolve references to constructors — for that, use-Ur.
When an input file doesn't have the same format as the output file, partial linking is only supported if that input file has no relocations at all. Different output formats can have even more restrictions — for example, some "a.out"-based formats don't support partial linking with input files in other formats periodt.
When the relocatable output contains both stuff that requires link-time optimization (LTO) and stuff that doesn't, a .gnu_object_only section gets created to hold a relocatable object file, as if -r was applied to all the relocatable inputs that don't require LTO. And when processing a relocatable input that has a .gnu_object_only section, the linker will extract that .gnu_object_only section as a separate input.
Note that since -r groups some sections from different input files together, there may be negative impacts on code size and locality in the final executable or shared library 😬.
This option does the same thing as -i.
-R filename,--just-symbols=filename— reads symbol names and their addresses from filename, but does not relocate it or include it in the output 🌸. This lets your output file refer symbolically to absolute locations of memory defined in other programs. You can use this option more than once, slay.
For compatibility with other ELF linkers: if the -R option is followed by a directory name instead of a file name, it's treated as the -rpath option 🌀.
--rosegment,--no-rosegment— tries to make sure that only a single read-only, non-code segment gets created ✨. Only useful when used together with the-z separate-codeoption. The resulting binaries should be smaller than if-z separate-codeis used on its own. Without this option, or if--no-rosegmentis specified,-z separate-codewill create two read-only segments — one before the code segment and one after it.
The names of these options are misleading ngl, but they were chosen so the linker stays compatible with the LLD and GOLD linkers 🤝.
These options are only supported by ELF targets. (Also the manpage literally spells it "Thse", typo and all, we don't gatekeep 💀.)
-s,--strip-all— omits all symbol information from the output file. Clean slate, nothing left 🙈.-S,--strip-debug— omits debugger symbol information (but not all symbols) from the output file. So like, the debug stuff goes, the rest stays 💅.--strip-discarded,--no-strip-discarded— omits (or doesn't omit) global symbols defined in discarded sections. Enabled by default ⭐.-plugin-save-temps— stores the plugin "temporary" intermediate files permanently 📁. No take-backs, they're staying.-t,--trace— prints the names of the input files asldprocesses them 🔍. If-tis given twice, then members within archives also get printed.-toutput is super useful for generating a list of all the object files and scripts involved in linking — for example when you're packaging files for a linker bug report 🐛.-T scriptfile,--script=scriptfile— uses scriptfile as the linker script 📜. This script replacesld's default linker script (rather than adding to it), unless the script contains"INSERT", so commandfile must specify everything necessary to describe the output file.
If scriptfile doesn't exist in the current directory, ld looks for it in the directories specified by any preceding -L options 🧭.
Command line options that appear before the -T option can affect the script, but command line options that appear after it do not ⏱️.
Multiple -T options will accumulate if they're augmenting the current script, otherwise the last, non-augmenting, -T option will be used.
There are other ways of specifying linker scripts. See
-dT scriptfile,--default-script=scriptfile— uses scriptfile as the default linker script 🌙.
This is similar to the --script option except that processing of the script is delayed until after the rest of the command line has been processed. This lets options placed after the --default-script option on the command line affect the behaviour of the linker script — which is important when the linker command line can't be directly controlled by the user (like when the command line is being built by another tool, such as gcc) 🛠️.
-u symbol,--undefined=symbol— forces symbol to be entered in the output file as an undefined symbol 👻. Doing this may, for example, trigger linking of additional modules from standard libraries.-ucan be repeated with different option arguments to enter additional undefined symbols. This option is equivalent to the"EXTERN"linker script command.
If you're using this option to force additional modules into the link, and it's an error for the symbol to remain undefined, then use --require-defined instead ⚠️.
--require-defined=symbol— requires that symbol is defined in the output file 🙏. This is the same as--undefinedexcept that if symbol is not defined in the output file, the linker will issue an error and exit 💀. You can get the same effect in a linker script by using"EXTERN","ASSERT"and"DEFINED"together. This option can be used multiple times to require additional symbols.-Ur— for programs that don't use constructors or destructors, or for ELF-based systems, this option is equivalent to-r: it generates relocatable output, i.e. an output file that can go on to serve as input told. For other binaries however, the-Uroption is similar to-rbut it also resolves references to constructors and destructors 🏗️.
For those systems where -r and -Ur behave differently, it does not work to use -Ur on files that were themselves linked with -Ur — once the constructor table has been built, it cannot be added to 😤. Use -Ur only for the last partial link, and -r for the others.
--orphan-handling=MODE— controls how orphan sections get handled. An orphan section is one that's not specifically mentioned in a linker script 🧸.
MODE can be any of these values:
"place"— orphan sections are placed into a suitable output section following the strategy described in Orphan Sections. The--uniqueoption also affects how sections are placed."discard"— all orphan sections are discarded, by placing them in the/DISCARD/section 🗑️."warn"— the linker places the orphan section as for"place"and also issues a warning ⚠️."error"— the linker exits with an error if any orphan section is found 💥.
The default if --orphan-handling isn't given is "place".
--unique[=SECTION]— creates a separate output section for every input section matching SECTION, or if the optional wildcard SECTION argument is missing, for every orphan input section 🦋. (An orphan section is one not specifically mentioned in a linker script.) You can use this option multiple times on the command line. It prevents the normal merging of input sections with the same name, overriding output section assignments in a linker script 👑.-v,--version,-V— displays the version number forld📢. The-Voption also lists the supported emulations. See also the description of the--enable-linker-versionin Options,,Command-line Options, which can be used to insert the linker version string into a binary 🏷️.-x,--discard-all— deletes all local symbols 🧹.-X,--discard-locals— deletes all temporary local symbols 🙈. (These symbols start with system-specific local label prefixes, typically.Lfor ELF systems orLfor traditionala.outsystems.)-y symbol,--trace-symbol=symbol— prints the name of each linked file in which symbol appears 🔎. This option may be given any number of times. On many systems it's necessary to prepend an underscore.
This one is so useful when you have an undefined symbol in your link but you have no idea where the reference is coming from — main character energy for debugging, fr fr 😭.
-Ypath — adds path to the default library search path. This one exists purely for Solaris compatibility. 🫶-zkeyword — the recognized keywords are a whole vibe check, so let's go one by one:call-nop=prefix-addr,call-nop=suffix-nop,call-nop=prefix-byte,call-nop=suffix-byte— these tell the linker which 1-byte "NOP" padding to use when it transforms an indirect call to a locally defined function,foo, via its GOT slot. Like, the details:call-nop=prefix-addrgenerates0x67 call foocall-nop=suffix-nopgeneratescall foo 0x90call-nop=prefix-bytegeneratesbyte call foocall-nop=suffix-bytegeneratescall foo byte
Supported for i386 and x86_64. 💅
cet-report=none,cet-report=warning,cet-report=error— controls how the linker reports missingGNU_PROPERTY_X86_FEATURE_1_IBTandGNU_PROPERTY_X86_FEATURE_1_SHSTKproperties in the input.note.gnu.propertysection.cet-report=none, which is the default, means the linker won't report missing properties in input files at all.cet-report=warningmakes it issue a warning for missing properties in input files.cet-report=errormakes it issue an error for missing properties in input files. Heads up bestie:ibtwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_IBTproperty report, andshstkwill turn off the missingGNU_PROPERTY_X86_FEATURE_1_SHSTKproperty report. Supported forLinux/i386andLinux/x86_64. ✨combreloc,nocombreloc— combines multiple dynamic relocation sections and sorts them to improve dynamic symbol lookup caching. And yeah, do not do this if it'snocombreloc. 🙈common,nocommon— generates common symbols withSTT_COMMONtype during a relocatable link. UseSTT_OBJECTtype if it'snocommon.common-page-size=value — sets the page size most commonly used to value. The memory image layout gets optimized to minimize memory pages if the system is using pages of this size.defs— reports unresolved symbol references from regular object files. This happens even if the linker is creating a non-symbolic shared library. This option is the inverse of-z undefs.dynamic-undefined-weak,nodynamic-undefined-weak— makes undefined weak symbols dynamic when building a dynamic object, if they're referenced from a regular object file and not forced local by symbol visibility or versioning. Don't make them dynamic if it'snodynamic-undefined-weak. If neither option is given, a target may default to either option being in force, or make some other selection of undefined weak symbols dynamic. Not all targets support these options, ngl. 😭execstack— marks the object as requiring executable stack. 💀global— this one is only meaningful when building a shared object. It makes the symbols defined by this shared object available for symbol resolution of subsequently loaded libraries.globalaudit— only meaningful when building a dynamic executable. It marks the executable as requiring global auditing by setting theDF_1_GLOBAUDITbit in theDT_FLAGS_1dynamic tag. Global auditing requires that any auditing library defined via the--depauditor-Pcommand-line options be run for all dynamic objects loaded by the application. 👑ibtplt— generates Intel Indirect Branch Tracking (IBT) enabled PLT entries. Supported forLinux/i386andLinux/x86_64.ibt— generatesGNU_PROPERTY_X86_FEATURE_1_IBTin.note.gnu.propertysection to indicate compatibility with IBT. This also impliesibtplt. Supported forLinux/i386andLinux/x86_64.indirect-extern-access,noindirect-extern-access— generatesGNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESSin.note.gnu.propertysection to indicate that the object file requires canonical function pointers and cannot be used with copy relocation. This option also impliesnoextern-protected-dataandnocopyreloc. Supported fori386andx86-64.
noindirect-extern-access removes GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS from .note.gnu.property section.
initfirst— only meaningful when building a shared object. It marks the object so that its runtime initialization will occur before the runtime initialization of any other objects brought into the process at the same time. Similarly, the runtime finalization of the object will occur after the runtime finalization of any other objects. main character energy fr. 🎀interpose— specifies that the dynamic loader should modify its symbol search order so that symbols in this shared library interpose all other shared libraries not so marked.unique,nounique— when generating a shared library or other dynamically loadable ELF object, marks it as one that should (by default) only ever be loaded once, and only in the main namespace (when usingdlmopen). This is primarily used to mark fundamental libraries such aslibc,libpthreadet al which don't usually function correctly unless they're the sole instances of themselves. This behaviour can be overridden by thedlmopencaller and does not apply to certain loading mechanisms (such as audit libraries).lam-u48— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U48in.note.gnu.propertysection to indicate compatibility with Intel LAM_U48. Supported forLinux/x86_64.lam-u57— generatesGNU_PROPERTY_X86_FEATURE_1_LAM_U57in.note.gnu.propertysection to indicate compatibility with Intel LAM_U57. Supported forLinux/x86_64.lam-u48-report=none,lam-u48-report=warning,lam-u48-report=error— controls how the linker reports the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48property in the input.note.gnu.propertysection.lam-u48-report=none, which is the default, means the linker won't report missing properties in input files.lam-u48-report=warningmakes it issue a warning for missing properties in input files.lam-u48-report=errormakes it issue an error for missing properties in input files. Supported forLinux/x86_64.lam-u57-report=none,lam-u57-report=warning,lam-u57-report=error— controls how the linker reports the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U57property in the input.note.gnu.propertysection.lam-u57-report=none, which is the default, means the linker won't report missing properties in input files.lam-u57-report=warningmakes it issue a warning for missing properties in input files.lam-u57-report=errormakes it issue an error for missing properties in input files. Supported forLinux/x86_64.lam-report=none,lam-report=warning,lam-report=error— controls how the linker reports the missingGNU_PROPERTY_X86_FEATURE_1_LAM_U48andGNU_PROPERTY_X86_FEATURE_1_LAM_U57properties in the input.note.gnu.propertysection.lam-report=none, which is the default, means the linker won't report missing properties in input files.lam-report=warningmakes it issue a warning for missing properties in input files.lam-report=errormakes it issue an error for missing properties in input files. Supported forLinux/x86_64.lazy— when generating an executable or shared library, marks it to tell the dynamic linker to defer function call resolution to the point when the function is called (lazy binding), rather than at load time. Lazy binding is the default, so this is lowkey the status quo. 💅loadfltr— specifies that the object's filters be processed immediately at runtime.max-page-size=value — sets the maximum memory page size supported to value.mark-plt,nomark-plt— marks PLT entries with dynamic tags,DT_X86_64_PLT,DT_X86_64_PLTSZandDT_X86_64_PLTENT. Since this option stores a non-zero value in ther_addendfield ofR_X86_64_JUMP_SLOTrelocations, the resulting executables and shared libraries are incompatible with dynamic linkers, such as those in older versions of glibc without the change to ignorer_addendinR_X86_64_GLOB_DATandR_X86_64_JUMP_SLOTrelocations, which don't ignore ther_addendfield ofR_X86_64_JUMP_SLOTrelocations. Supported forx86_64. 🚨muldefs— allows multiple definitions.nocopyreloc— disables linker generated.dynbssvariables used in place of variables defined in shared libraries. May result in dynamic text relocations. 😬nodefaultlib— specifies that the dynamic loader search for dependencies of this object should ignore any default library search paths.nodelete— specifies that the object shouldn't be unloaded at runtime.nodlopen— specifies that the object is not available todlopen.nodump— specifies that the object can not be dumped bydldump.noexecstack— marks the object as not requiring executable stack.noextern-protected-data— don't treat protected data symbols as external when building a shared library. This option overrides the linker backend default. It can be used to work around incorrect relocations against protected data symbols generated by the compiler. Updates on protected data symbols by another module aren't visible to the resulting shared library. Supported fori386andx86-64.noreloc-overflow— disables the relocation overflow check. This can be used to disable relocation overflow check if there will be no dynamic relocation overflow at run-time. Supported forx86_64.memory-seal,nomemory-seal— instructs the executable or shared library that allPT_LOADsegments should be sealed to avoid further manipulation (such as changing the protection flags, the segment size, or removing the mapping). This is a security hardening that requires system support. This generatesGNU_PROPERTY_MEMORY_SEALin.note.gnu.propertysection. 🔥
-z now— bestie, this is the "no procrastination" setting 🫶 When you're generating an executable or a shared library, it marks the thing to tell the dynamic linker to resolve all the symbols right when the program starts up (or right when the shared library gets loaded bydlopen), instead of being all "eh, I'll get to it" and deferring function call resolution until the first time that function actually gets called. It's giving instant gratification, but for symbol resolution 💅-z origin— specifies that the object requires$ORIGINhandling in paths. That's it, that's the whole vibe ✨-z pack-relative-relocs/-z nopack-relative-relocs— generates compact relative relocation in a position-independent executable and shared library 🌸 It addsDT_RELR,DT_RELRSZandDT_RELRENTentries to the dynamic section. Heads up though: it's ignored when you're building a position-dependent executable and relocatable output, so don't come for it expecting magic there 💀nopack-relative-relocsis the default, and it disables compact relative relocation. When you link against the GNU C Library, aGLIBC_ABI_DT_RELRsymbol version dependency on the shared C Library gets added to the output. Supported fori386andx86-64⭐-z relro/-z norelro— creates an ELFPT_GNU_RELROsegment header in the object 🎀 This specifies a memory segment that should be made read-only after relocation, if that's supported. Lowkey important warning: specifyingcommon-page-sizesmaller than the system page size will render this protection ineffective — like, completely pointless, don't do it 🙈 And it will not create an ELFPT_GNU_RELROsegment if you usenorelro.-z report-relative-reloc— reports dynamic relative relocations generated by the linker. Supported for Linux/i386 and Linux/x86_64 👑-z sectionheader/-z nosectionheader— generates a section header 📋 Don't generate a section header ifnosectionheaderis used.sectionheaderis the default, so that's the standard main-character setting ✨-z separate-code/-z noseparate-code— creates a separate codePT_LOADsegment header in the object 🔥 This specifies a memory segment that should contain only instructions and must be in wholly disjoint pages from any other data. Don't create a separate codePT_LOADsegment ifnoseparate-codeis used.-z shstk— generatesGNU_PROPERTY_X86_FEATURE_1_SHSTKin the.note.gnu.propertysection to indicate compatibility with Intel Shadow Stack 🛡️ Supported for Linux/i386 and Linux/x86_64.-z stack-size=value— specifies a stack size for an ELFPT_GNU_STACKsegment 📏 And specifying zero will override any default non-zero sizedPT_GNU_STACKsegment creation. So zero is not "eh, whatever," zero is a whole statement 💅-z start-stop-gc/-z nostart-stop-gc— okay so when--gc-sectionsis in effect, a reference from a retained section to__start_SECNAMEor__stop_SECNAMEcauses all input sections namedSECNAMEto also be retained, but only ifSECNAMEis representable as a C identifier and either__start_SECNAMEor__stop_SECNAMEis synthesized by the linker 🦋-z start-stop-gcdisables this effect, allowing sections to be garbage collected as if the special synthesized symbols were not defined. Important nuance, don't skip it:-z start-stop-gchas no effect on a definition of__start_SECNAMEor__stop_SECNAMEin an object file or linker script. Such a definition will prevent the linker providing a synthesized__start_SECNAMEor__stop_SECNAMErespectively, and therefore the special treatment by garbage collection for those references. iykyk 🌈-z start-stop-visibility=value— specifies the ELF symbol visibility for synthesized__start_SECNAMEand__stop_SECNAMEsymbols 👀valuemust be exactlydefault,internal,hidden, orprotected— no vibes-based guessing, bestie. If no-z start-stop-visibilityoption is given,protectedis used for compatibility with historical practice. However, it's highly recommended to use-z start-stop-visibility=hiddenin new programs and shared libraries so that these symbols are not exported between shared objects, which is not usually what's intended 💖-z text/-z notext/-z textoff— reports an error ifDT_TEXTRELis set, i.e., if the position-independent or shared object has dynamic relocations in read-only sections 🚨 Don't report an error ifnotextortextoff. Choose wisely ✨-z undefs— does not report unresolved symbol references from regular object files, either when creating an executable or when creating a shared library 🙈 This option is the inverse of-z defs.-z unique-symbol/-z nounique-symbol— avoids duplicated local symbol names in the symbol string table 🎀 Appends"."number""to duplicated local symbol names ifunique-symbolis used.nounique-symbolis the default.-z x86-64-baseline,-z x86-64-v2,-z x86-64-v3,-z x86-64-v4— specifies the x86-64 ISA level needed in the.note.gnu.propertysection 💜 Let's break it down:x86-64-baselinegeneratesGNU_PROPERTY_X86_ISA_1_BASELINEx86-64-v2generatesGNU_PROPERTY_X86_ISA_1_V2x86-64-v3generatesGNU_PROPERTY_X86_ISA_1_V3x86-64-v4generatesGNU_PROPERTY_X86_ISA_1_V4
Supported for Linux/i386 and Linux/x86_64 ⭐
-z isa-level-report=none,-z isa-level-report=all,-z isa-level-report=needed,-z isa-level-report=used— specifies how to report x86-64 ISA levels in input relocatable files 📊isa-level-report=none, which is the default, will make the linker not report x86-64 ISA levels in input filesisa-level-report=allwill make the linker report needed and used x86-64 ISA levels in input filesisa-level-report=neededwill make the linker report needed x86-64 ISA levels in input filesisa-level-report=usedwill make the linker report used x86-64 ISA levels in input files
Supported for Linux/i386 and Linux/x86_64 🌸
Other keywords are ignored for Solaris compatibility. Like, they're just there being decorative, bestie 💅
✨ more long options, let's GO ✨
--gnu-tls-tag/--no-gnu-tls-tag— adds aGLIBC_ABI_GNU_TLSversion tag dependency in output programs and shared libraries when linking against glibc, if input relocatable object files call___tls_get_addr🔥 Heads up, the output will fail to load and run at run-time against glibc which doesn't define theGLIBC_ABI_GNU_TLSversion tag 💀 Unless it's disabled by the--disable-gnu-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add theGLIBC_ABI_GNU_TLSversion tag dependency if inputs have a___tls_get_addrcall andlibc.sodefines theGLIBC_ABI_GNU_TLSversion tag. Supported for Linux/i386 👑--gnu2-tls-tag/--no-gnu2-tls-tag— same energy but forGLIBC_ABI_GNU2_TLS🌈 Adds aGLIBC_ABI_GNU2_TLSversion tag dependency in output programs and shared libraries when linking against glibc if input relocatable object files have anR_386_TLS_DESC_CALLorR_X86_64_TLSDESC_CALLrelocation. And yeah, the output will fail to load and run at run-time against glibc which doesn't define theGLIBC_ABI_GNU2_TLSversion tag 😭 Unless it's disabled by the--disable-gnu2-tls-tagconfigure option at the linker build time, when no options are specified, the linker will add theGLIBC_ABI_GNU2_TLSversion tag dependency if inputs have anR_386_TLS_DESC_CALLorR_X86_64_TLSDESC_CALLrelocation andlibc.sodefines theGLIBC_ABI_GNU2_TLSversion tag. Supported for Linux/i386 and Linux/x86_64 💖-(archives-)and--start-grouparchives--end-group— thearchivesshould be a list of archive files 📚 They may be either explicit file names, or-loptions. The specified archives are searched repeatedly until no new undefined references are created 🌀 Normally, an archive is searched only once, in the order that it's specified on the command line. If a symbol in that archive is needed to resolve an undefined symbol referred to by an object in an archive that appears later on the command line, the linker would not be able to resolve that reference 😔 By grouping the archives, they all get searched repeatedly until all possible references are resolved.
Real talk: using this option has a significant performance cost 🐌 It's best to use it only when there are unavoidable circular references between two or more archives. Don't just sprinkle it everywhere for funsies.
--accept-unknown-input-arch/--no-accept-unknown-input-arch— tells the linker to accept input files whose architecture cannot be recognised 🙈 The assumption is that the user knows what they're doing and deliberately wants to link in these unknown input files. This was the default behaviour of the linker, before release2.14⏳ The default behaviour from release2.14onwards is to reject such input files, and so the--accept-unknown-input-archoption has been added to restore the old behaviour. Throwback era 💅--as-needed/--no-as-needed— this option affects ELFDT_NEEDEDtags for dynamic libraries mentioned on the command line after the--as-neededoption 👀 Normally the linker will add aDT_NEEDEDtag for each dynamic library mentioned on the command line, regardless of whether the library is actually needed or not.--as-neededcauses aDT_NEEDEDtag to only be emitted for a library that at that point in the link satisfies a non-weak undefined symbol reference from a regular object file or, if the library is not found in theDT_NEEDEDlists of other needed libraries, a non-weak undefined symbol reference from another needed dynamic library. Object files or libraries appearing on the command line after the library in question do not affect whether the library is seen as needed 🚫 This is similar to the rules for extraction of object files from archives.--no-as-neededrestores the default behaviour.
Note: On Linux based systems the--as-neededoption also has an affect on the behaviour of the--rpathand--rpath-linkoptions. See the description of--rpath-linkfor more details 🫶
--add-needed/--no-add-needed— these two options have been deprecated 💀 because of the similarity of their names to the--as-neededand--no-as-neededoptions. They have been replaced by--copy-dt-needed-entriesand--no-copy-dt-needed-entries. Rip bozo, they had a good run 😭-assertkeyword— this option is ignored for SunOS compatibility. It's literally just vibing there ✨-Bdynamic,-dy,-call_shared— links against dynamic libraries 🎀 This is only meaningful on platforms for which shared libraries are supported. This option is normally the default on such platforms. The different variants of this option are for compatibility with various systems. And yes bestie, you may use this option multiple times on the command line: it affects library searching for-loptions which follow it 🌈-Bgroup— sets the"DF_1_GROUP"flag in the"DT_FLAGS_1"entry in the dynamic section. Bestie, what this does is make the runtime linker do lookups in this object and its dependencies only inside the group 🫶.--unresolved-symbols=report-allis implied. Only meaningful on ELF platforms that support shared libraries, so if that's not your vibe, this does nothing for you.-Bstatic,-dn,-non_shared,-static— do not link against shared libraries 🚫📚. Only meaningful on platforms where shared libraries are supported. All these different variants exist just for compatibility with various systems (yes, four names for one thing, it's giving "we couldn't agree in committee"). You may use this option multiple times on the command line — it affects library searching for-loptions which follow it. This option also implies--unresolved-symbols=report-all. And plot twist: it can be used with-shared🌈, which means a shared library is being created but that all of the library's external references must be resolved by pulling in entries from static libraries.-Bsymbolic— when creating a shared library, bind references to global symbols to the definition within the shared library, if any. Normally it's possible for a program linked against a shared library to override the definition within the shared library (that's the usual tea ☕). Only meaningful on ELF platforms which support shared libraries.-Bsymbolic-functions— same energy as above but specifically for references to global function symbols: bind them to the definition within the shared library, if any. Only meaningful on ELF platforms which support shared libraries.-Bno-symbolic— the cancel button 💅. This option can cancel previously specified-Bsymbolicand-Bsymbolic-functions.--dynamic-list=dynamic-list-file— specify the name of a dynamic list file to the linker. Typically used when creating shared libraries to specify a list of global symbols whose references shouldn't be bound to the definition within the shared library, or when creating dynamically linked executables to specify a list of symbols which should be added to the symbol table in the executable. Only meaningful on ELF platforms which support shared libraries.
The format of the dynamic list is the same as the version node without scope and node name. See VERSION for more information 👀.
--dynamic-list-data— include all global data symbols to the dynamic list 📊.--dynamic-list-cpp-new— provide the builtin dynamic list for C++operator newanddelete. Mainly useful for building sharedlibstdc++.--dynamic-list-cpp-typeinfo— provide the builtin dynamic list for C++ runtime type identification (RTTI, you know, thetypeidgirlies 🎀).--check-sections,--no-check-sections— asks the linker not to check section addresses after they've been assigned, to see if there are any overlaps. Normally the linker will perform this check, and if it finds any overlaps it will produce suitable error messages 🚨. The linker does know about, and does make allowances for, sections in overlays. The default behaviour can be restored by using the command-line switch--check-sections. Section overlap is not usually checked for relocatable links — you can force checking in that case by using the--check-sectionsoption.--copy-dt-needed-entries,--no-copy-dt-needed-entries— this option affects the treatment of dynamic libraries referred to byDT_NEEDEDtags inside ELF dynamic libraries mentioned on the command line. Normally the linker won't add aDT_NEEDEDtag to the output binary for each library mentioned in aDT_NEEDEDtag in an input dynamic library. With--copy-dt-needed-entriesspecified on the command line, however, any dynamic libraries that follow it will have theirDT_NEEDEDentries added. The default behaviour can be restored with--no-copy-dt-needed-entries.
This option also has an effect on the resolution of symbols in dynamic libraries. With --copy-dt-needed-entries, dynamic libraries mentioned on the command line will be recursively searched, following their DT_NEEDED tags to other libraries, in order to resolve symbols required by the output binary. With the default setting, however, the searching of dynamic libraries that follow it will stop with the dynamic library itself. No DT_NEEDED links will be traversed to resolve symbols 🔍.
--cref— output a cross reference table 📋. If a linker map file is being generated, the cross reference table is printed to the map file. Otherwise, it is printed on the standard output.
The format of the table is intentionally simple, so that it may be easily processed by a script if necessary. The symbols are printed out, sorted by name. For each symbol, a list of file names is given. If the symbol is defined, the first file listed is the location of the definition. If the symbol is defined as a common value, then any files where this happens appear next. Finally, any files that reference the symbol are listed.
--ctf-variables,--no-ctf-variables— the CTF debuginfo format supports a section which encodes the names and types of variables found in the program which do not appear in any symbol table. These variables clearly cannot be looked up by address by conventional debuggers, so the space used for their types and names is usually wasted: the types are usually small but the names are often not 🙈.--ctf-variablescauses the generation of such a section. The default behaviour can be restored with--no-ctf-variables.--ctf-share-types=method— adjust the method used to share types between translation units in CTF ✨.share-unconflicted— put all types that do not have ambiguous definitions into the shared dictionary, where debuggers can easily access them, even if they only occur in one translation unit. This is the default.share-duplicated— put only types that occur in multiple translation units into the shared dictionary: types with only one definition go into per-translation-unit dictionaries. Types with ambiguous definitions in multiple translation units always go into per-translation-unit dictionaries. This tends to make the CTF larger, but may reduce the amount of CTF in the shared dictionary. For very large projects this may speed up opening the CTF and save memory in the CTF consumer at runtime 🧠.
--no-define-common— this option inhibits the assignment of addresses to common symbols. The script command"INHIBIT_COMMON_ALLOCATION"has the same effect.
The --no-define-common option allows decoupling the decision to assign addresses to Common symbols from the choice of the output file type; otherwise a non-Relocatable output type forces assigning addresses to Common symbols. Using --no-define-common allows Common symbols that are referenced from a shared library to be assigned addresses only in the main program. This eliminates the unused duplicate space in the shared library, and also prevents any possible confusion over resolving to the wrong duplicate when there are many dynamic modules with specialized search paths for runtime symbol resolution 💫.
--force-group-allocation— this option causes the linker to place section group members like normal input sections, and to delete the section groups. This is the default behaviour for a final link, but this option can be used to change the behaviour of a relocatable link (-r). The script command"FORCE_GROUP_ALLOCATION"has the same effect.--defsym=symbol=expression— create a global symbol in the output file, containing the absolute address given by expression. You may use this option as many times as necessary to define multiple symbols in the command line. A limited form of arithmetic is supported for the expression in this context: you may give a hexadecimal constant or the name of an existing symbol, or use"+"and"-"to add or subtract hexadecimal constants or symbols. If you need more elaborate expressions, consider using the linker command language from a script. Note: there should be no white space between symbol, the equals sign ("="), and expression ⚠️.
The linker processes --defsym arguments and -T arguments in order — placing --defsym before -T will define the symbol before the linker script from -T is processed, while placing --defsym after -T will define the symbol after the linker script has been processed. This difference has consequences for expressions within the linker script that use the --defsym symbols, and which order is correct will depend on what you are trying to achieve 👑.
--demangle[=style],--no-demangle— these options control whether to demangle symbol names in error messages and other output. When the linker is told to demangle, it tries to present symbol names in a readable fashion: it strips leading underscores if they are used by the object file format, and converts C++ mangled symbol names into user readable names 🪄. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. The linker will demangle by default unless the environment variableCOLLECT_NO_DEMANGLEis set. These options may be used to override the default.-Ifile,--dynamic-linker=file— set the name of the dynamic linker. Only meaningful when generating dynamically linked ELF executables. The default dynamic linker is normally correct; don't use this unless you know what you are doing 😭 (fr fr, respect the default).--no-dynamic-linker— when producing an executable file, omit the request for a dynamic linker to be used at load-time. Only meaningful for ELF executables that contain dynamic relocations, and usually requires entry point code that is capable of processing these relocations 💀.--embedded-relocs— similar to the--emit-relocsoption, except that the relocs are stored in a target-specific section. Only supported by theBFIN,CR16andM68Ktargets.--disable-multiple-abs-defs— do not allow multiple definitions with symbols included in filename invoked by-Ror--just-symbols.--fatal-warnings,--no-fatal-warnings— treat all warnings as errors 🔥. The default behaviour can be restored with the option--no-fatal-warnings.
-w,--no-warnings— bestie this is the "shhh 🤫" flag. It says do not display any warning or error messages, at all, periodt. And it overrides--fatal-warningsif that was already switched on. When do you even use this? When you already know the output binary won't work but you still need to create it anyway. It's giving "I know she's broken, I'm building her regardless" energy. 💅--force-exe-suffix— makes sure your output file gets a.exesuffix. No cap. So here's the tea: if a successfully built, fully linked output file does not have a".exe"or".dll"suffix, this option forces the linker to copy the output file to one with the same name but carrying a".exe"suffix. This is a whole lifesaver when you're using unmodified Unix makefiles on a Microsoft Windows host, because some versions of Windows literally won't run an image unless it ends in a".exe"suffix. 🪟✨--gc-sections,--no-gc-sections— turns on garbage collection of unused input sections. It gets ignored on targets that don't support it, so don't come for it if it ghosts you. The default behaviour (aka not doing this garbage collection) can be brought back by passing--no-gc-sectionson the command line. Note bestie: garbage collection for COFF and PE format targets is supported, but the implementation is currently considered experimental. 🙈
So how does --gc-sections decide which input sections are used? It examines symbols and relocations. The section containing the entry symbol, plus all sections containing symbols undefined on the command-line, get kept — and so do sections containing symbols referenced by dynamic objects. Note that when building shared libraries, the linker must assume that any visible symbol is referenced. Once this initial set of sections has been figured out, the linker recursively marks as used any section referenced by their relocations. Peep --entry, --undefined, and --gc-keep-exported. 👀
This option can be set when doing a partial link (enabled with option -r). In that case, the root of symbols kept must be explicitly specified either by one of the options --entry, --undefined, or --gc-keep-exported, or by an "ENTRY" command in the linker script. Don't forget or she will simply not know what to keep.
As a GNU extension, ELF input sections marked with the "SHF_GNU_RETAIN" flag will not be garbage collected. 💖
--print-gc-sections,--no-print-gc-sections— lists every single section that got removed by garbage collection. The listing is printed on stderr. This option only does anything if garbage collection has been enabled via the--gc-sectionsoption. The default behaviour (of not listing the sections that are removed) can be restored by specifying--no-print-gc-sectionson the command line. Cute little receipt of what got yeeted. 🗑️--gc-keep-exported— when--gc-sectionsis enabled, this option stops garbage collection of unused input sections that contain global symbols having default or protected visibility. It's meant for executables where unreferenced sections would otherwise get garbage collected regardless of the external visibility of contained symbols. Note: this option has no effect when linking shared objects, since that's already the default behaviour there. And it's only supported for ELF format targets. 🧚--print-output-format— prints the name of the default output format (which might have been influenced by other command-line options). It's the exact string that would show up in an"OUTPUT_FORMAT"linker script command. So you get to peek at what the linker's thinking. 👑--print-memory-usage— prints the used size, total size and used size of memory regions created with theMEMORYcommand. This is lowkey perfect on embedded targets when you just want a quick view of how much free memory you have left. The output format has one headline and one line per region, and it's both human readable and easily parsable by tools. Here's an example of an output:
Memory region Used Size Region Size %age Used
ROM: 256 KB 1 MB 25.00%
RAM: 32 B 2 GB 0.00%Note: if you want to find out about the memory usage of the linker itself, then the --stats option will do this. Different question, bestie. 💀
--help— prints a summary of the command-line options on the standard output and exits. Your lil cheat sheet. 🌸--target-help— prints a summary of all target-specific options on the standard output and exits. The niche lore version. 🔥-Map=mapfile— prints a link map to the file mapfile. See the description of the-Moption, above. And if mapfile is just the character"-"then the map gets written to stdout instead.
Specifying a directory as mapfile makes the linker write the map as a file inside the directory. Normally the name of the file inside the directory is computed as the basename of the output file with ".map" appended. If however the special character "%" is used, then this gets replaced by the full path of the output file. Additionally, if there are any characters after the % symbol, then ".map" will no longer be appended. Behold, the receipts:
-o foo.exe -Map=bar [Creates ./bar]
-o ../dir/foo.exe -Map=bar [Creates ./bar]
-o foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir [Creates ../dir/foo.exe.map]
-o foo.exe -Map=% [Creates ./foo.exe.map]
-o ../dir/foo.exe -Map=% [Creates ../dir/foo.exe.map]
-o foo.exe -Map=%.bar [Creates ./foo.exe.bar]
-o ../dir/foo.exe -Map=%.bar [Creates ../dir/foo.exe.bar]
-o ../dir2/foo.exe -Map=../dir/% [Creates ../dir/../dir2/foo.exe.map]
-o ../dir2/foo.exe -Map=../dir/%.bar [Creates ../dir/../dir2/foo.exe.bar]It is an error to specify more than one "%" character. One and done, okay?
And if the map file already exists, then it will be overwritten by this operation. No mercy, no backup. 💅
--no-keep-memory—ldnormally optimizes for speed over memory usage by caching the symbol tables of input files in memory. This option tellsldto instead optimize for memory usage, by rereading the symbol tables as necessary. You might need this ifldruns out of memory space while linking a large executable. Tradeoff city. 😭--no-undefined,-z defs— reports unresolved symbol references from regular object files. This happens even if the linker is creating a non-symbolic shared library. The switch--[no-]allow-shlib-undefinedcontrols the behaviour for reporting unresolved references found in shared libraries being linked in. And plot twist: the effects of this option can be reverted by using"-z undefs". 🌀--allow-multiple-definition,-z muldefs— normally when a symbol is defined multiple times, the linker reports a fatal error. These options allow multiple definitions, and the first definition will be used. First come, first served, bestie. 🥇--allow-shlib-undefined,--no-allow-shlib-undefined— allows or disallows undefined symbols in shared libraries. This switch is similar to--no-undefinedexcept that it decides the behaviour when the undefined symbols are in a shared library rather than a regular object file. It does not affect how undefined symbols in regular object files are handled.
The default behaviour: report errors for any undefined symbols referenced in shared libraries if the linker is being used to create an executable, but allow them if the linker is being used to create a shared library.
Why would anyone allow undefined symbol references in shared libraries specified at link time? Valid reasons, actually:
- A shared library specified at link time may not be the same as the one that's available at load time, so the symbol might actually be resolvable at load time. 🕐
- There are some operating systems, eg BeOS and HPPA, where undefined symbols in shared libraries are normal.
The BeOS kernel for example patches shared libraries at load time to select whichever function is most appropriate for the current architecture. This is used, for example, to dynamically select an appropriate memset function. Wild but true. 🌈
--error-handling-script=scriptname— if this option is provided, then the linker will invoke scriptname whenever an error is encountered. Currently however only two kinds of error are supported: missing symbols and missing libraries. Two arguments will be passed to script: the keyword"undefined-symbol"or"missing-lib"and the name of the undefined symbol or missing library. The intention is that the script will give the user suggestions about where the symbol or library might be found. After the script has finished, the normal linker error message will be displayed. Helpful bestie behaviour. 🫶
Heads up though: the availability of this option is controlled by a configure time switch, so it may not be present in specific implementations. Don't be shocked if she's not there. 🙈
--no-undefined-version— normally when a symbol has an undefined version, the linker just ignores it. This option disallows symbols with undefined version, and a fatal error gets issued instead. No more ignoring, we're confronting things now. 😤--default-symver— creates and uses a default symbol version (the soname) for unversioned exported symbols. ✨--default-imported-symver— creates and uses a default symbol version (the soname) for unversioned imported symbols. The mirror twin. 🪞--no-warn-mismatch— normallyldgives an error if you try to link together input files that are mismatched for some reason, maybe because they were compiled for different processors or for different endiannesses. This option tellsldthat it should silently permit such possible errors.
Bestie, this option should only be used with care — in cases when you've taken some special action that ensures the linker errors are inappropriate. Don't just slap it on for fun. ⚠️
--no-warn-search-mismatch— normallyldgives a warning if it finds an incompatible library during a library search. This option silences that warning. 🤫--no-whole-archive— turns off the effect of the--whole-archiveoption for subsequent archive files. The switch-off switch. 🔌--noinhibit-exec— retains the executable output file whenever it's still usable. Normally the linker will not produce an output file if it encounters errors during the link process — it exits without writing an output file when it issues any error whatsoever. This flag is for when you want the wreckage anyway. 💀-nostdlib— only searches library directories explicitly specified on the command line. Library directories specified in linker scripts (including linker scripts specified on the command line) are ignored. Just the ones you asked for, nothing extra. 👑--oformat=output-format — okay so ld can be built to handle more than one kind of object file, and if yours is one of those ✨fancy✨ ones, this is how you tell it which binary format the output object file should be in. Ngl though, you usually don't need this —ldis set up out of the box to spit out the most normal format for your machine 🫶. output-format is a text string, literally the name of a format the BFD libraries support. (Wanna see the whole list of available binary formats?objdump -i, bestie, it's giving directory 📋.) Oh and the script commandOUTPUT_FORMATcan also set the output format — but this option overrides it. Periodt 💅.--out-implibfile — makes an import library in file that matches the executable the linker is generating (like a DLL or an ELF program, iykyk). This import library (which should be named"*.dll.a"or"*.a"for DLLs) can be used to link clients against the generated executable 🌸. The whole point? You get to skip a separate import library creation step (like"dlltool"for DLLs, no cap). Heads up though — this option is only available for the i386 PE and ELF targeted ports of the linker. Not everywhere. 🙈-pie,--pic-executable— makes a position independent executable 🎀. Currently only supported on ELF platforms. PIEs get relocated by the dynamic linker to whatever virtual address the OS picks for them, and that address can literally change between invocations 😭. They're markedET_DYNin the ELF file header, but they're not the same as shared libraries — they differ in a bunch of ways. In particular: defined symbols in a PIE can't be overridden by another object by default, the way they can be in a shared library. Different vibe entirely 💅.-no-pie— makes a position dependent executable. This is the default, bestie. 🧚-qmagic— this option is ignored, for Linux compatibility. That's it. That's the whole thing 💀.-Qy— this option is ignored, for SVR4 compatibility. Also iconic for doing absolutely nothing ✨.--relax,--no-relax— an option with machine dependent effects 🦋. Only supported on a few targets, so check before you get attached.
On some platforms, --relax performs target specific, global optimizations that only become possible once the linker resolves addressing in the program — stuff like relaxing address modes, synthesizing new instructions, selecting shorter versions of current instructions, and combining constant values. It's giving glow-up ✨.
But lowkey, on some platforms these link time global optimizations can make symbolic debugging of the resulting executable impossible. This is known to be the case for the Matsushita MN10200 and MN10300 family of processors. So. Yeah. Pick your fighter 😭.
On platforms where the feature is supported, --no-relax disables it.
On platforms where the feature is not supported, both --relax and --no-relax are accepted — but ignored. They're just there. Standing around. Being decorative 🌸.
--retain-symbols-file=filename — keeps only the symbols listed in the file filename, discarding every single other one 🗑️. filename is just a flat file, one symbol name per line, no fuss. This one is especially useful in environments (like VxWorks, hey bestie) where a big global symbol table gets accumulated gradually, because it conserves run-time memory 💖.
Okay but important: --retain-symbols-file does not discard undefined symbols, or symbols needed for relocations. Those stay. They have to 👑.
Also you may only specify --retain-symbols-file once on the command line. One time. That's the rule. And it overrides -s and -S.
-rpath=dir — adds a directory to the runtime library search path 🌈. This is used when linking an ELF executable with shared objects. All-rpatharguments get concatenated and passed to the runtime linker, which uses them to locate shared objects at runtime.
-rpath is also used when locating shared objects that are needed by shared objects explicitly included in the link — see the description of the -rpath-link option below. Searching -rpath this way is only supported by native linkers and cross linkers that have been configured with the --with-sysroot option.
If -rpath isn't used when linking an ELF executable, the contents of the environment variable LD_RUN_PATH will be used if it's defined. Slay 🫶.
-rpath can also be used on SunOS. By default on SunOS, the linker forms a runtime search path out of all the -L options it's given. But if a -rpath option is used, the runtime search path gets formed exclusively using the -rpath options — the -L options get ignored entirely 🙈. This is useful when using gcc, which adds a ton of -L options that may live on NFS mounted file systems. Rude of them.
And for compatibility with other ELF linkers: if the -R option is followed by a directory name rather than a file name, it's treated as the -rpath option. Sneaky but fine 💅.
-rpath-link=dir — when you're using ELF or SunOS, one shared library can require another. This happens when an"ld -shared"link includes a shared library as one of its input files.
When the linker hits such a dependency while doing a non-shared, non-relocatable link, it'll automatically try to locate the required shared library and include it in the link — if it wasn't included explicitly. In that case, several directories get searched, in the order described below. -rpath-link specifies the first set of directories to search 🔍. You can give a sequence of directory names either as a list separated by colons, or by just... using the option multiple times. Whatever feels right 🌸.
The tokens $ORIGIN and $LIB can appear in these search directories ✨. They get replaced by the full path to the directory containing the program or shared object in the case of $ORIGIN, and either lib — for 32-bit binaries — or lib64 — for 64-bit binaries — in the case of $LIB.
The alternative form of these tokens — ${ORIGIN} and ${LIB} — can also be used. The token $PLATFORM is not supported. Sorry bestie 😭.
The --rpath-link option should be used with caution, because it overrides the search path that may have been hard compiled into a shared library. In such a case it's possible to unintentionally use a different search path than the runtime linker would have used. Be careful out there 💀.
When additional shared libraries are required, the linker searches directories in the order listed below to find them. Note however that this only applies to additional libraries needed to satisfy already-included shared libraries. It does not apply to libraries included via the -l command line option. Searches for -l libraries are only conducted in directories specified by the -L option. Got it? Got it. 🎀
- Any directories specified by
-rpath-linkoptions. - Any directories specified by
-rpathoptions. The difference between-rpathand-rpath-linkis that directories specified by-rpathoptions are included in the executable and used at runtime, whereas the-rpath-linkoption is only effective at link time. Searching-rpathin this way is only supported by native linkers and cross linkers which have been configured with the--with-sysrootoption. - On an ELF system, for native linkers, if the
-rpathand-rpath-linkoptions were not used, search the contents of the environment variableLD_RUN_PATH. - On SunOS, if the
-rpathoption was not used, search any directories specified using-Loptions. - For a native linker, search the contents of the environment variable
LD_LIBRARY_PATH. - For a native ELF linker, the directories in
DT_RUNPATHorDT_RPATHof a shared library are searched for shared libraries needed by it. TheDT_RPATHentries are ignored ifDT_RUNPATHentries exist. - For a linker for a Linux system, if the file
/etc/ld.so.confexists, the list of directories found in that file. Note: the path to this file is prefixed with thesysrootvalue, if that is defined, and then anyprefixstring if the linker was configured with the--prefix=path option. - For a native linker on a FreeBSD system, any directories specified by the
_PATH_ELF_HINTSmacro defined in theelf-hints.hheader file. - Any directories specified by a
SEARCH_DIRcommand in a linker script given on the command line, including scripts specified by-T(but not-dT). - The default directories, normally
/liband/usr/lib. - Any directories specified by a plugin
LDPT_SET_EXTRA_LIBRARY_PATH. - Any directories specified by a
SEARCH_DIRcommand in a default linker script.
Note however on Linux based systems there's an additional caveat: if the --as-needed option is active and a shared library is located which would normally satisfy the search, and this library does not have a DT_NEEDED tag for libc.so, and there's a shared library later on in the set of search directories which also satisfies the search, and this second shared library does have a DT_NEEDED tag for libc.so — then the second library will be selected instead of the first. Plot twist 😳.
If the required shared library is not found, the linker will issue a warning and continue with the link. It's giving "we move" 💅.
--section-ordering-file=script — this option is used to augment the current linker script with additional mapping of input sections to output sections 🌈. This file must use the same syntax forSECTIONSas normal linker scripts do, but it should not do anything other than place input sections into output sections.@pxref{SECTIONS}
A second constraint on the section ordering script is that it can only reference output sections that are already defined by whichever linker script is currently in use. (Ie the default linker script or a script specified on the command line.) The benefit of the section ordering script though is that the input sections are mapped to the start of the output sections, so that they can ensure the ordering of sections in the output section ✨. For example, imagine the default linker script looks like this:
SECTIONS {
.text : { *(.text.hot) ; *(.text .text.*) }
.data : { *(.data.big) ; *(.data .data.*) }
}Then if a section ordering file like this is used:
.text : { *(.text.first) ; *(.text.z*) }
.data : { foo.o(.data.first) ; *(.data.small) }This would be equivalent to a linker script like this:
SECTIONS {
.text : { *(.text.first) ; *(.text.z*) ; *(.text.hot) ; *(.text .text.*) }
.data : { foo.o(.data.first) ; *(.data.small) ; *(.data.big) ; *(.data .data.*) }
}ok so the whole point of the section ordering file is that you can order just the sections that actually matter to you, and you don't have to stress about literally any other section, or memory regions, or anything else in the entire universe. it's giving ✨minimal effort, maximum control✨ and honestly? we love a low-maintenance icon. 💅
-shared,-Bshareable— makes a shared library. rn this is only supported onELF,XCOFFandSunOSplatforms. and heads up bestie: on SunOS, the linker will just automatically make a shared library if you didn't use-eand there are undefined symbols chillin' in the link. no cap, it does that on its own. 🦋--sort-common,--sort-common=ascending,--sort-common=descending— tellsldto sort the common symbols by alignment, either ascending or descending, when it drops them into the right output sections. the alignments it cares about are sixteen-byte or larger, then eight-byte, four-byte, two-byte, and one-byte. why tho? to stop gaps from forming between symbols because of alignment constraints. and if you don't specify an order at all? descending is what you get, periodt.--sort-section=name— slapsSORT_BY_NAMEonto every single wildcard section pattern in the linker script. all of them. 💖--sort-section=alignment— same energy, but it appliesSORT_BY_ALIGNMENTto all wildcard section patterns in the linker script instead. 🌸--spare-dynamic-tags=count— sets how many empty slots to leave in the.dynamicsection ofELFshared objects. post-processing tools like the prelinker might need those empty slots, okay?? the default is5.--split-by-file[=size]— basically--split-by-reloc's cousin: it spins up a new output section for each input file oncesizeis reached. if you don't hand over asize, it defaults to a size of1. simple as. 🎀--split-by-reloc[=count]— tries to create extra sections in the output file so that no single output section ends up holding more thancountrelocations. super useful when you're generating huge relocatable files to download into certain real time kernels using theCOFFobject file format — becauseCOFFliterally cannot represent more than65535relocations in a single section. 😭
big warning bestie: this will fail to work with object file formats that don't support arbitrary sections.
also, the linker will not split up individual input sections for redistribution — so if one single input section has more than count relocations, then one output section is just gonna have that many relocations in it. can't help you there. count defaults to 32768.
--stats[=filename]— computes and displays stats about the linker's whole operation — stuff like execution time and memory usage. the receipts, basically. 🧾
if you don't give the optional filename argument, only basic info gets reported, and it goes to the standard error output stream. if you do give filename, then extended info gets written to that named file. and if filename is just the - symbol? extended info goes to the standard output stream instead. and if filename starts with +, the file gets opened in append mode rather than overwrite mode. so many little rules, i know, but it's iconic. ✨
if -Map is enabled, the info also gets recorded in the map file too. and note: if both --stats and -Map got filename arguments and they match, the info only gets written out once, not twice. no dupe, we don't do that here. 💅
if the LD_STATS environment variable is defined, it behaves like the --stats option. if the variable's value is a string, that string gets used as the name of the file to record the info into. otherwise the info goes to the standard output stream. using the env var means you can record stats without having to mess with the linker's command line — very convenient, very slay. and note: if you use both the env var and --stats, then --stats takes precedence. the option wins, always. 👑
the extended info reported includes cpu time used, and if the getrusage() system library call is available, memory use gets recorded as well. all of this is reported for the individual parts of the linking process, which are called phases. plus there's a special phase called ALL that covers the entire linking process. and heads up: individual phases can contain or overlap each other, so don't assume the total resources used by the linker is just the sum of the individual phases. math is not mathing there, and that's intentional. 🦋
also, when extended info is being reported, the linker version, command line arguments and linker start time get included too. this makes it way easier when a build system is invoking multiple links and you need to figure out exactly which arguments produced the stats you're staring at. detective work, but make it cute. 🔍
the extended output looks something like this:
Stats: linker version: (GNU Binutils) 2.44.50.20250401
Stats: linker started: Wed Apr 2 09:36:41 2025
Stats: args: ld -z norelro -z nomemory-seal -z no-separate-code -o a.out [...]
Stats: phase cpu time memory user time system time
Stats: name (microsec) (KiB) (seconds) (seconds)
Stats: ALL 390082 217740 0 0
Stats: ctf processing 12 0 0 0
Stats: string merge 1324 0 0 0
Stats: parsing 349 288 0 0
Stats: plugins 1 0 0 0
Stats: processing files 259616 214524 0 0
Stats: write 116493 0 0 0--no-stats— turns off the reporting of usage statistics, in case it got enabled via the--statscommand line option or theLD_STATSenvironment variable. the off switch. 🛑--sysroot=directory— usedirectoryas the location of the sysroot, overriding the configure-time default. note: this option is only supported by linkers that were configured using--with-sysroot. so if yours wasn't, sorry bestie, this one's not for you. 🙈--task-link— used byCOFF/PEbased targets to create a task-linked object file where all of the global symbols have been converted to statics. very niche, very specific, very demure. 🎀--traditional-format— for some targets,ld's output is different in some ways from what some existing linker spits out. this switch asksldto use the traditional format instead. it's giving "be normal for once". 🌸
for example, on SunOS, ld combines duplicate entries in the symbol string table. this can shrink an output file with full debugging info by over 30 percent. unfortunately, the SunOS dbx program can't read the resulting program (gdb has no trouble, it's fine, it's fine). the --traditional-format switch tells ld to not combine duplicate entries. so it's a tradeoff and you get to pick your fighter. 💅
--section-start=sectionname=org— locates a section in the output file at the absolute address given byorg. you can use this option as many times as you need to locate multiple sections on the command line.orgmust be a single hexadecimal integer — and for compatibility with other linkers, you can omit the leading0xthat's usually associated with hex values. note: there should be no white space betweensectionname, the equals sign (=), andorg. none. zero. don't do it. 😭--image-base=org— when usingELF, this is the same as-Ttext-segment, with both options effectively setting the base address of theELFexecutable.
when using PE, use the value as the base address of your program or dll. this is the lowest memory location that gets used when your program or dll is loaded. to reduce the need to relocate and improve performance of your dlls, each one should have a unique base address and not overlap any other dlls. defaults: 0x400000 for executables, and 0x10000000 for dlls. 💖
-Tbss=org,-Tdata=org,-Ttext=org— same as--section-start, but with.bss,.dataor.textas thesectionname. shortcuts, we love them. ✨-Ttext-segment=org— when creating anELFexecutable, this sets the address of the first byte of the first segment. and note: when-pieis used together with-Ttext-segment=org, the output executable is markedET_EXECso that the address of the first byte of the text segment is guaranteed to beorgat run time. locked in. 🔒-Trodata-segment=org— when creating anELFexecutable or shared object for a target where the read-only data lives in its own segment separate from the executable text, this sets the address of the first byte of the read-only data segment. 🦋-Tldata-segment=org— when creating anELFexecutable or shared object for the x86-64 medium memory model, this sets the address of the first byte of theldatasegment. yes, that's a whole thing. 🎀--unresolved-symbols=method— decides how to handle unresolved symbols. there are four possible values formethod:ignore-all— don't report any unresolved symbols. pretend they're not there. 🙈report-all— report all unresolved symbols. this is the default.ignore-in-object-files— report unresolved symbols that live in shared libraries, but ignore them if they come from regular object files.ignore-in-shared-libs— report unresolved symbols that come from regular object files, but ignore them if they come from shared libraries. this can be useful when you're creating a dynamic binary and you already know that all the shared libraries it should be referencing are included on the linker's command line. iykyk. 💅
the behaviour for shared libraries on their own can also be controlled by the --[no-]allow-shlib-undefined option.
normally the linker generates an error message for each reported unresolved symbol, but the option --warn-unresolved-symbols can change that to a warning instead. softer delivery, same info. ✨
--dll-verbose,--verbose[=NUMBER]— displays the version number forldand lists the linker emulations supported. also displays which input files can and cannot be opened. and displays the linker script being used by the linker. if the optionalNUMBERargument is greater than1, plugin symbol status gets displayed as well. so much info, we're eating good. 🔥--version-script=version-scriptfile— bestie, this one lets you hand the linker a version script, and honestly? iconic behavior. You mostly reach for it when you're building shared libraries and need to spell out extra deets about the library's version hierarchy. Full support only on ELF platforms that do shared libraries — go read theVERSIONsection for the whole tea. On PE platforms it's only partially supported: there it can filter symbol visibility in auto-export mode, meaning any symbol markedlocalin the version script simply won't get exported. 🫶--warn-common— this one yells at you when a common symbol gets combined with another common symbol, or with an actual symbol definition. Unix linkers are like "sure babe, sloppy is fine," but linkers on some other operating systems are NOT having it. So this flag helps you sniff out potential problems from combining global symbols. The catch? Some C libraries pull this practice too, so you might get warnings about symbols inside the libraries, not just your own program. 😭
There are three kinds of global symbols, and here they are, illustrated with C examples:
int i = 1;That's a definition — it goes in the initialized data section of the output file. ✨
extern int i;That's an undefined reference, which does not allocate space. There has to be either a definition or a common symbol for the variable somewhere. 👀
int i;And that's a common symbol. If there are only (one or more) common symbols for a variable, it lands in the uninitialized data area of the output file. The linker merges multiple common symbols for the same variable into a single symbol, and if they're different sizes, it picks the largest one. Also — if there's a definition of the same variable, the linker turns that common symbol into a declaration. periodt.
So --warn-common can produce five kinds of warnings, and every warning is a little pair of lines: the first describes the symbol just encountered, the second describes the previous symbol encountered with the same name. One or both of the two symbols will be a common symbol. here we go 🎀
- Turning a common symbol into a reference, because there is already a definition for the symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by definition
<file>(<section>): warning: defined here- Turning a common symbol into a reference, because a later definition for the symbol is encountered. Same as the previous case, except the symbols show up in a different order.
<file>(<section>): warning: definition of `<symbol>'
overriding common
<file>(<section>): warning: common is here- Merging a common symbol with a previous same-sized common symbol.
<file>(<section>): warning: multiple common
of `<symbol>'
<file>(<section>): warning: previous common is here- Merging a common symbol with a previous larger common symbol.
<file>(<section>): warning: common of `<symbol>'
overridden by larger common
<file>(<section>): warning: larger common is here- Merging a common symbol with a previous smaller common symbol. Same as the previous case, except — you guessed it — the symbols are encountered in a different order.
<file>(<section>): warning: common of `<symbol>'
overriding smaller common
<file>(<section>): warning: smaller common is here--warn-constructors— warns you if any global constructors are used. ngl, this is only useful for a few object file formats. For formats likeCOFForELF, the linker literally can not detect the use of global constructors, so don't come for it. 💀--warn-execstack,--warn-execstack-objects,--no-warn-execstack— on ELF platforms the linker may generate warning messages if it's asked to create an output file that contains an executable stack. There are three possible states:- Do not generate any warnings.
- Always generate warnings, even if the executable stack is requested via the
-z execstackcommand line option. - Only generate a warning if an object file requests an executable stack, but not if the
-z execstackoption is used.
The default state depends on how the linker was configured when it was built. --no-warn-execstack always puts the linker into the no-warnings state. --warn-execstack puts it into the warn-always state. And --warn-execstack-objects puts it into the warn-for-object-files-only state. ✨
Note: ELF format input files can say they need an executable stack by having a.note.GNU-stacksection with the executable bit set in its section flags. They can say they don't need an executable stack by having the same section, but without the executable flag bit set. If an input file doesn't have a.note.GNU-stacksection, then the default behaviour is target specific — for some targets, the absence of such a section implies that an executable stack is required. This is often a problem for hand crafted assembler files. 🙈
--error-execstack,--no-error-execstack— if the linker is going to generate a warning message about an executable stack, then--error-execstackwill instead change that warning into a full-blown error. But note — this option does not change the linker's execstack warning generation state. Use--warn-execstackor--warn-execstack-objectsif you want to set a specific warning state.--no-error-execstackrestores the default behaviour of generating warning messages. 💅--warn-multiple-gp— warns if multiple global pointer values are required in the output file. This is only meaningful for certain processors, like the Alpha. Specifically: some processors put large-valued constants in a special section, and a special register (the global pointer) points into the middle of that section so constants can be loaded efficiently via a base-register relative addressing mode. Since the offset in base-register relative mode is fixed and relatively small (e.g.,16bits), that caps the max size of the constant pool. So in large programs it's often necessary to use multiple global pointer values to address all the possible constants — and this option makes a warning pop off whenever that case occurs. 🔥--warn-once— only warn once for each undefined symbol, instead of once per module that refers to it. your notifications are on do-not-disturb, bestie. 🔕--warn-rwx-segments,--no-warn-rwx-segments— warns if the linker creates a loadable, non-zero sized segment that has all three of the read, write and execute permission flags set. Such a segment represents a potential security vulnerability. On top of that, warnings get generated if a thread local storage segment is created with the execute permission flag set, regardless of whether or not it has the read and/or write flags set. 😭
These warnings are enabled by default. You can disable them with --no-warn-rwx-segments and re-enable them with --warn-rwx-segments. 🦋
--error-rwx-segments,--no-error-rwx-segments— if the linker is going to generate a warning message about an executable, writeable segment, or an executable TLS segment, then--error-rwx-segmentsturns that warning into an error instead.--no-error-rwx-segmentsrestores the default behaviour of just generating a warning message. 💅
Note —--error-rwx-segmentsdoes not by itself turn on warnings about these segments. These warnings are either enabled by default (if the linker was configured that way) or via the--warn-rwx-segmentscommand line option.
--warn-section-align— warns if the address of an output section is changed because of alignment. Typically the alignment is set by an input section, and the address only changes if it wasn't explicitly specified — that is, if theSECTIONScommand doesn't specify a start address for the section. 👑--warn-textrel— warns if the linker addsDT_TEXTRELto a position-independent executable or shared object. ✨--warn-alternate-em— warns if an object has alternate ELF machine code. lowkey niche, highkey useful. 🎀--warn-unresolved-symbols— if the linker is going to report an unresolved symbol (see the--unresolved-symbolsoption), it will normally generate an error. This option makes it generate a warning instead. 🫶--error-unresolved-symbols— this restores the linker's default behaviour of generating errors when it's reporting unresolved symbols. back to business, bestie. 💅--whole-archive— for each archive mentioned on the command line after the--whole-archiveoption, include every object file in the archive in the link, rather than searching the archive for the required object files. This is normally used to turn an archive file into a shared library, forcing every object to be included in the resulting shared library. This option may be used more than once. 🔥
Two notes when using this option from gcc: First, gcc doesn't know about this option, so you have to use -Wl,-whole-archive. Second, don't forget to use -Wl,-no-whole-archive after your list of archives, because gcc will add its own list of archives to your link and you may not want this flag to affect those as well. ⚠️
--wrap=symbol— use a wrapper function for symbol. Any undefined reference to symbol will be resolved to__wrap_symbol. Any undefined reference to__real_symbolwill be resolved to symbol. 🧚
This can be used to provide a wrapper for a system function. The wrapper function should be called __wrap_symbol. If it wishes to call the system function, it should call __real_symbol. slay.
Here is a trivial example:
void *
__wrap_malloc (size_t c)
{
printf ("malloc called with %zu\n", c);
return __real_malloc (c);
}If you link other code with this file using --wrap malloc, then all calls to malloc will call the function __wrap_malloc instead. The call to __real_malloc in __wrap_malloc will call the real malloc function. 💖
So you might also wanna hand over a __real_malloc function too, so that links without the --wrap option still succeed and don't just fall over. But bestie, listen closely: do not put the definition of __real_malloc in the same file as __wrap_malloc. If you do, the assembler may resolve the call before the linker has a chance to wrap it to malloc. 💀
Also!! Only undefined references get replaced by the linker. So translation-unit-internal references to a symbol are not resolved to __wrap_symbol. In this next example, the call to f inside g is not resolved to __wrap_f:
int
f (void)
{
return 123;
}
int
g (void)
{
return f();
}--eh-frame-hdr,--no-eh-frame-hdr— request (--eh-frame-hdr) or suppress (--no-eh-frame-hdr) the creation of the.eh_frame_hdrsection and the ELFPT_GNU_EH_FRAMEsegment header. ✨--no-ld-generated-unwind-info— requests creation of.eh_frameunwind info for linker generated code sections like PLT. This one is on by default if linker generated unwind info is supported. It also controls the generation of.sframestack trace info for linker generated code sections like PLT. 🦋--enable-new-dtags,--disable-new-dtags— this linker can create the new dynamic tags in ELF, but older ELF systems might not understand them. 🙈 If you say--enable-new-dtags, the new dynamic tags get created as needed and older dynamic tags get omitted. If you say--disable-new-dtags, no new dynamic tags get created at all. By default, the new dynamic tags are not created. Also heads up: these options are only available for ELF systems.--hash-size=number— sets the default size of the linker's hash tables to a prime number close to number. Bumping this value can shorten how long the linker takes to do its tasks, but at the cost of the linker's memory requirements going up. Same energy in reverse: lowering it cuts memory requirements at the expense of speed. The default value is4051under normal circumstances, and1021if the--reduce-memory-overheadscommand line option is used. 🔢--hash-style=style— sets the type of the linker's hash table(s). style can besysvfor the classic ELF.hashsection,gnufor the new style GNU.gnu.hashsection, orbothfor both the classic ELF.hashand the new style GNU.gnu.hashhash tables. The default depends on how the linker was configured, but for most Linux based systems it's gonna beboth. 👑--compress-debug-sections=none,--compress-debug-sections=zlib,--compress-debug-sections=zlib-gnu,--compress-debug-sections=zlib-gabi,--compress-debug-sections=zstd— on ELF platforms, these options control how DWARF debug sections get compressed using zlib.--compress-debug-sections=nonedoesn't compress DWARF debug sections. 🚫--compress-debug-sections=zlib-gnucompresses DWARF debug sections and renames them to begin with.zdebuginstead of.debug.--compress-debug-sections=zlib-gabialso compresses DWARF debug sections, but instead of renaming them it sets theSHF_COMPRESSEDflag in the sections' headers.- The
--compress-debug-sections=zliboption is an alias for--compress-debug-sections=zlib-gabi. --compress-debug-sections=zstdcompresses DWARF debug sections using zstd. 🔥
Note that this option overrides any compression in input debug sections. So if a binary is linked with --compress-debug-sections=none, for example, then any compressed debug sections in input files will be uncompressed before they're copied into the output binary. 😭
The default compression behaviour varies depending on the target involved and the configure options used to build the toolchain. You can figure out the default by examining the output from the linker's --help option.
--reduce-memory-overheads— this option reduces memory requirements atldruntime, at the expense of linking speed. It was introduced to select the old O(n^2) algorithm for link map file generation, rather than the new O(n) algorithm which uses about 40% more memory for symbol storage. Another effect of the switch is that it sets the default hash table size to1021, which again saves memory at the cost of lengthening the linker's run time. This is not done, however, if the--hash-sizeswitch has been used. The--reduce-memory-overheadsswitch may also be used to enable other tradeoffs in future versions of the linker. 🫶--max-cache-size=size—ldnormally caches the relocation information and symbol tables of input files in memory with unlimited size. This option sets the maximum cache size to size. Note — if the--no-keep-memorycommand line option has been used, then the linker acts as if the maximum cache size has been set to0, i.e. nothing is retained. 🗂️--build-id,--build-id=style— requests the creation of a.note.gnu.build-idELF note section or a.buildidCOFF section. The contents of the note are unique bits identifying this linked file. style can be:uuid— use 128 random bitssha1— use a 160-bit SHA1 hashmd5— use a 128-bit MD5 hashxx— use a 128-bit XXHASH on the normative parts of the output contents0xhexstring— use a chosen bit string specified as an even number of hexadecimal digits (the-and:characters between digit pairs are ignored)
If style is omitted, sha1 is used.
The md5, sha1, and xx styles produce an identifier that is always the same in an identical output file, but are almost certainly unique among all nonidentical output files. It is not intended to be compared as a checksum for the file's contents. A linked file may be changed later by other tools, but the build ID bit string identifying the original linked file does not change. 💅
Passing none for style disables the setting from any --build-id options earlier on the command line.
--package-metadata=JSON— requests the creation of a.note.packageELF note section. The contents of the note are in JSON format, as per the package metadata specification. For more information see:https://systemd.io/ELF_PACKAGE_METADATA/
The JSON argument supports percent-encoding and the following %[string] encoding (where string refers to the name in HTML's Named Character References): %[comma] for ,, %[lbrace] for {, %[quot] for ", %[rbrace] for }, and %[space] for the space character.
If the JSON argument is missing/empty then this will disable the creation of the metadata note, if one had been enabled by an earlier occurrence of the --package-metadata option. If the linker has been built with libjansson, then the JSON string will be validated. ✅
okay now we're entering i386 PE territory, buckle up bestie 🎀
The i386 PE linker supports the -shared option, which causes the output to be a dynamically linked library (DLL) instead of a normal executable. You should name the output *.dll when you use this option. On top of that, the linker fully supports the standard *.def files, which may be specified on the linker command line like an object file — in fact, it should precede archives it exports symbols from, to ensure that they get linked in, just like a normal object file. 📦
In addition to the options common to all targets, the i386 PE linker supports additional command-line options that are specific to the i386 PE target. Options that take values may be separated from their values by either a space or an equals sign. ✨
--add-stdcall-alias— if given, symbols with a stdcall suffix (@nn) will be exported as-is and also with the suffix stripped. [This option is specific to the i386 PE targeted port of the linker] 🌸--base-file file— use file as the name of a file in which to save the base addresses of all the relocations needed for generating DLLs withdlltool. [This is an i386 PE specific option] 📁--dll— create a DLL instead of a regular executable. You may also use-sharedor specify aLIBRARYin a given.deffile. [This option is specific to the i386 PE targeted port of the linker] 🧚--enable-long-section-names,--disable-long-section-names— the PE variants of the COFF object format add an extension that permits the use of section names longer than eight characters, the normal limit for COFF. By default, these names are only allowed in object files, as fully-linked executable images do not carry the COFF string table required to support the longer names. As a GNU extension, it's possible to allow their use in executable images as well, or to (probably pointlessly!) disallow it in object files, by using these two options. Executable images generated with these long section names are slightly non-standard, carrying as they do a string table, and may generate confusing output when examined with non-GNU PE-aware tools, such as file viewers and dumpers. However, GDB relies on the use of PE long section names to find Dwarf-2 debug information sections in an executable image at runtime, and so if neither option is specified on the command-line,ldwill enable long section names, overriding the default and technically correct behaviour, when it finds the presence of debug information while linking an executable image and not stripping symbols. [This option is valid for all PE targeted ports of the linker] 🫶--enable-stdcall-fixup,--disable-stdcall-fixup— if the link finds a symbol that it cannot resolve, it will attempt to do "fuzzy linking" by looking for another defined symbol that differs only in the format of the symbol name (cdecl vs stdcall) and will resolve that symbol by linking to the match. For example, the undefined symbol_foomight be linked to the function_foo@12, or the undefined symbol_bar@16might be linked to the function_bar. When the linker does this, it prints a warning, since it normally should have failed to link — but sometimes import libraries generated from third-party dlls may need this feature to be usable. If you specify--enable-stdcall-fixup, this feature is fully enabled and warnings are not printed. If you specify--disable-stdcall-fixup, this feature is disabled and such mismatches are considered to be errors. [This option is specific to the i386 PE targeted port of the linker] 💥--leading-underscore--no-leading-underscore— okay so for most targets the default symbol-prefix is an underscore and it's defined in the target's own description. These two let you turn that default underscore symbol-prefix off or back on. That's it, that's the whole job 💅--export-all-symbols— if you give this one, every global symbol in the objects used to build a DLL gets exported by the DLL. Ngl there's a lot of fine print here, so buckle up bestie:- heads up: this is the default if there otherwise wouldn't be any exported symbols at all.
- but when symbols are explicitly exported via DEF files, or implicitly exported via function attributes, the default flips — nothing else gets exported unless you pass this option.
- the symbols
DllMain@12,DllEntryPoint@0,DllMainCRTStartup@12, andimpure_ptrwill not be automatically exported. - also, symbols imported from other DLLs will not be re-exported, and neither will symbols that specify the DLL's internal layout — like the ones beginning with
_head_or ending with_iname. - in addition, no symbols from
libgcc,libstd++,libmingw32, orcrtX.owill be exported. - symbols whose names begin with
__rtti_or__builtin_will not be exported either, to help with C++ DLLs. - finally there's an extensive list of cygwin-private symbols that aren't exported (obviously this applies when building DLLs for cygwin targets). The cygwin-excludes are:
_cygwin_dll_entry@12,_cygwin_crt0_common@8,_cygwin_noncygwin_dll_entry@12,_fmode,_impure_ptr,cygwin_attach_dll,cygwin_premain0,cygwin_premain1,cygwin_premain2,cygwin_premain3, andenviron. - [This option is specific to the i386 PE targeted port of the linker]
--exclude-symbols symbol,symbol,...— lists out symbols that should not be automatically exported. The symbol names may be delimited by commas or colons, so,or:both work 🍓 [This option is specific to the i386 PE targeted port of the linker]--exclude-all-symbols— no symbols should be automatically exported. None. Zero. Nada. ✨ [This option is specific to the i386 PE targeted port of the linker]--file-alignment— specify the file alignment. Sections in the file will always begin at file offsets which are multiples of this number. This defaults to512. [This option is specific to the i386 PE targeted port of the linker]--heap reserve--heap reserve,commit— specify the number of bytes of memory to reserve (and optionally commit) to be used as heap for this program. The default is 1MB reserved, 4K committed. [This option is specific to the i386 PE targeted port of the linker]--kill-at— if given, the stdcall suffixes (@nn) will be stripped from symbols before they are exported. Bye bye suffixes 👋 [This option is specific to the i386 PE targeted port of the linker]--large-address-aware— if given, the appropriate bit in theCharacteristicsfield of the COFF header is set to indicate that this executable supports virtual addresses greater than 2 gigabytes. This should be used in conjunction with the/3GBor/USERVA=valuemegabytes switch in the[operating systems]section of the BOOT.INI. Otherwise, this bit has no effect. [This option is specific to PE targeted ports of the linker]--disable-large-address-aware— reverts the effect of a previous--large-address-awareoption. Super useful if--large-address-awareis always set by the compiler driver (e.g. Cygwin gcc) and the executable does not support virtual addresses greater than 2 gigabytes. [This option is specific to PE targeted ports of the linker]--major-image-version value— sets the major number of theimage version. Defaults to1. [This option is specific to the i386 PE targeted port of the linker]--major-os-version value— sets the major number of theos version. Defaults to4. [This option is specific to the i386 PE targeted port of the linker]--major-subsystem-version value— sets the major number of thesubsystem version. Defaults to4. [This option is specific to the i386 PE targeted port of the linker]--minor-image-version value— sets the minor number of theimage version. Defaults to0. [This option is specific to the i386 PE targeted port of the linker]--minor-os-version value— sets the minor number of theos version. Defaults to0. [This option is specific to the i386 PE targeted port of the linker]--minor-subsystem-version value— sets the minor number of thesubsystem version. Defaults to0. [This option is specific to the i386 PE targeted port of the linker]--output-def file— the linker will create the file file, which will contain a DEF file corresponding to the DLL the linker is generating. This DEF file (which should be called*.def) may be used to create an import library withdlltool, or may be used as a reference to automatically or implicitly exported symbols. [This option is specific to the i386 PE targeted port of the linker]--enable-auto-image-base--enable-auto-image-base=value— automatically choose the image base for DLLs, optionally starting with base value, unless one is specified using the--image-baseargument. By using a hash generated from the dllname to create unique image bases for each DLL, in-memory collisions and relocations which can delay program execution are avoided. Obsessed with the efficiency fr fr. [This option is specific to the i386 PE targeted port of the linker]--disable-auto-image-base— do not automatically generate a unique image base. If there is no user-specified image base (--image-base) then use the platform default. [This option is specific to the i386 PE targeted port of the linker]--dll-search-prefix string— when linking dynamically to a dll without an import library, search for<string><basename>.dllin preference tolib<basename>.dll. This behaviour allows easy distinction between DLLs built for the varioussubplatforms: native, cygwin, uwin, pw, etc. For instance, cygwin DLLs typically use--dll-search-prefix=cyg. [This option is specific to the i386 PE targeted port of the linker]--enable-auto-import— does sophisticated linking of_symbolto__imp__symbolfor DATA imports from DLLs, which makes it possible to bypass the dllimport mechanism on the user side and to reference unmangled symbol names. Iconic behaviour honestly. [This option is specific to the i386 PE targeted port of the linker]
The following remarks pertain to the original implementation of the feature and are obsolete nowadays for Cygwin and MinGW targets.
Note: Use of the 'auto-import' extension will cause the text section of the image file to be made writable. This does not conform to the PE-COFF format specification published by Microsoft.
Note — use of the 'auto-import' extension will also cause read only data which would normally be placed into the.rdatasection to be placed into the.datasection instead. This is in order to work around a problem with consts that is described here: http://www.cygwin.com/ml/cygwin/2004-09/msg01101.html
Using 'auto-import' generally will 'just work' — but sometimes you may see this message:
"variable '<var>' can't be auto-imported. Please read the
documentation for ld's "--enable-auto-import" for details."This message occurs when some (sub)expression accesses an address ultimately given by the sum of two constants (Win32 import tables only allow one). Instances where this may occur include accesses to member fields of struct variables imported from a DLL, as well as using a constant index into an array variable imported from a DLL. Any multiword variable (arrays, structs, long long, etc) may trigger this error condition. However, regardless of the exact data type of the offending exported variable, ld will always detect it, issue the warning, and exit.
There are several ways to address this difficulty, regardless of the data type of the exported variable:
One way is to use --enable-runtime-pseudo-reloc switch. This leaves the task of adjusting references in your client code for runtime environment, so this method works only when runtime environment supports this feature.
A second solution is to force one of the 'constants' to be a variable — that is, unknown and un-optimizable at compile time. For arrays, there are two possibilities: a) make the indexee (the array's address) a variable, or b) make the 'constant' index a variable. Thus:
extern type extern_array[];
extern_array[1] -->
{ volatile type *t=extern_array; t[1] }or
extern type extern_array[];
extern_array[1] -->
{ volatile int t=1; extern_array[t] }For structs (and most other multiword data types) the only option is to make the struct itself (or the long long, or the ...) variable:
extern struct s extern_struct;
extern_struct.field -->
{ volatile struct s *t=&extern_struct; t->field }or
extern long long extern_ll;
extern_ll -->
{ volatile long long * local_ll=&extern_ll; *local_ll }A third method of dealing with this difficulty is to abandon 'auto-import' for the offending symbol and mark it with __declspec(dllimport). However, in practice that requires using compile-time #defines to indicate whether you are building a DLL, building client code that will link to the DLL, or merely building/linking to a static library. In making the choice between the various methods of resolving the 'direct address with constant offset' problem, you should consider typical real-world usage:
Original:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}Solution 1:
--foo.h
extern int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
/* This workaround is for win32 and cygwin; do not "optimize" */
volatile int *parr = arr;
printf("%d\n",parr[1]);
}Solution 2:
--foo.h
/* Note: auto-export is assumed (no __declspec(dllexport)) */
#if (defined(_WIN32) || defined(__CYGWIN__)) && \
!(defined(FOO_BUILD_DLL) || defined(FOO_STATIC))
#define FOO_IMPORT __declspec(dllimport)
#else
#define FOO_IMPORT
#endif
extern FOO_IMPORT int arr[];
--foo.c
#include "foo.h"
void main(int argc, char **argv){
printf("%d\n",arr[1]);
}And bestie, if none of that sparkles for you, there's a fourth way out: just re-code your library so it uses a functional interface instead of a data interface for whatever variables are causing the drama — like set_foo() and get_foo() accessor functions. Clean. Iconic. Problem gone. ✨
--disable-auto-import— nope, don't do the fancy linking of"_symbol"to"__imp__symbol"for DATA imports coming from DLLs. [this one is specific to the i386 PE targeted port of the linker]--enable-runtime-pseudo-reloc— if your code has the expressions described over in the--enable-auto-importsection, aka DATA imports from a DLL with a non-zero offset, this switch builds you a whole vector of 'runtime pseudo relocations' that the runtime environment can use to adjust references to that data in your client code. 💅 [this option is specific to the i386 PE targeted port of the linker]--disable-runtime-pseudo-reloc— do not create pseudo relocations for non-zero offset DATA imports from DLLs. [this option is specific to the i386 PE targeted port of the linker]--enable-extra-pe-debug— show extra debug info related to auto-import symbol thunking. 👀 [this option is specific to the i386 PE targeted port of the linker]--section-alignment— sets the section alignment. Sections in memory will always start at addresses that are a multiple of this number. Defaults to0x1000. [this option is specific to the i386 PE targeted port of the linker]--stack reserve--stack reserve,commit— say how many bytes of memory to reserve (and optionally commit) for this program's stack. The default is 2MB reserved, 4K committed. [this option is specific to the i386 PE targeted port of the linker]--subsystem which--subsystem which:major--subsystem which:major.minor— tells the linker which subsystem your program is gonna execute under. The legal values for which are"native","windows","console","posix", and"xbox". You can optionally set the subsystem version too. Numeric values are also accepted for which. [this option is specific to the i386 PE targeted port of the linker]
The next batch of options set flags in the "DllCharacteristics" field of the PE file header: [these options are specific to PE targeted ports of the linker]
--high-entropy-va--disable-high-entropy-va— the image is compatible with 64-bit address space layout randomization (ASLR). This option is enabled by default for 64-bit PE images in MinGW targets.
This option also implies --dynamicbase and --enable-reloc-section.
--dynamicbase--disable-dynamicbase— the image base address may be relocated using address space layout randomization (ASLR). This feature was introduced with MS Windows Vista for i386 PE targets. This option is enabled by default for MinGW targets but can be disabled via the--disable-dynamicbaseoption. This option also implies--enable-reloc-section.--forceinteg--disable-forceinteg— code integrity checks are enforced. This option is disabled by default.--nxcompat--disable-nxcompat— the image is compatible with the Data Execution Prevention. This feature was introduced with MS Windows XP SP2 for i386 PE targets. The option is enabled by default for MinGW targets.--no-isolation--disable-no-isolation— even though the image understands isolation, do not isolate the image. This option is disabled by default.--no-seh--disable-no-seh— the image does not use SEH. No SE handler may be called from this image. This option is disabled by default.--no-bind--disable-no-bind— do not bind this image. This option is disabled by default.--wdmdriver--disable-wdmdriver— the driver uses the MS Windows Driver Model. This option is disabled by default.--tsaware--disable-tsaware— the image is Terminal Server aware. This option is disabled by default.--insert-timestamp--no-insert-timestamp— insert a real timestamp into the image. This is the default behaviour since it matches legacy code, and it means the image will work with other, proprietary tools. The problem with this default, bestie, is that it results in slightly different images being produced every single time you link the same sources. 😭 The--no-insert-timestampoption can be used to insert a zero value for the timestamp, which ensures that binaries produced from identical sources will compare identically.
If --insert-timestamp is active then the time inserted is either the time that the linking takes place or, if the "SOURCE_DATE_EPOCH" environment variable is defined, the number of seconds since Unix epoch as specified by that variable.
--enable-reloc-section--disable-reloc-section— create the base relocation table, which is necessary if the image is loaded at a different image base than the one specified in the PE header. This option is enabled by default.
The C6X uClinux target uses a binary format called DSBT to support shared libraries. Every shared library in the system needs its own unique index; all executables use an index of 0. 🦋
--dsbt-size size— sets the number of entries in the DSBT of the current executable or shared library to size. The default is to create a table with 64 entries.--dsbt-index index— sets the DSBT index of the current executable or shared library to index. The default is0, which is what you want for generating executables. If a shared library is generated with a DSBT index of0, the"R_C6000_DSBT_INDEX"relocs are copied into the output file.
The --no-merge-exidx-entries switch disables the merging of adjacent exidx entries in frame unwind info.
--branch-stub— enables linker branch relaxation by inserting branch stub sections whenever they're needed to extend the range of branches. This option is usually not required, since C-SKY supports branch and call instructions that can access the full memory range, and branch relaxation is normally handled by the compiler or assembler. 💅--stub-group-size=N— gives you finer control over linker branch stub creation. It sets the maximum size of a group of input sections that one stub section can handle. A negative value of N locates stub sections after their branches, while a positive value lets stub sections appear either before or after the branches. Values of1or-1mean the linker should just choose suitable defaults.
The 68HC11 and 68HC12 linkers support specific options to control the memory bank switching mapping and trampoline code generation. ✨
--no-trampoline— disables the generation of trampoline. By default a trampoline is generated for each far function that's called using a"jsr"instruction (this happens when a pointer to a far function is taken).--bank-window name— tells the linker the name of the memory region in the MEMORY specification that describes the memory bank window. The definition of that region is then used by the linker to compute paging and addresses within the memory window.
The following options are supported to control handling of GOT generation when linking for 68K targets. 🧚
--got=type— tells the linker which GOT generation scheme to use. type should be one ofsingle,negative,multigotortarget. For more info, go refer to the Info entry forld.
The following options are supported to control microMIPS instruction generation and branch relocation checks for ISA mode transitions when linking for MIPS targets. 💜
--insn32--no-insn32— these control the choice of microMIPS instructions used in code generated by the linker, like the stuff in the PLT or lazy binding stubs, or in relaxation. If--insn32is used, then the linker only uses 32-bit instruction encodings. By default, or if--no-insn32is used, all instruction encodings are used, including 16-bit ones where possible.--ignore-branch-isa--no-ignore-branch-isa— these control branch relocation checks for invalid ISA mode transitions. If--ignore-branch-isais used, then the linker accepts any branch relocations and any ISA mode transition required is lost in relocation calculation — except for some cases of"BAL"instructions which meet relaxation conditions and get converted to equivalent"JALX"instructions as the associated relocation is calculated. By default, or if--no-ignore-branch-isais used, a check is made and losing an ISA mode transition produces an error. 🚨--compact-branches--no-compact-branches— these control the generation of compact instructions by the linker in the PLT entries for MIPS R6.
For the pdp11-aout target, three variants of the output format can be produced, selected by the options below. The default variant for pdp11-aout is the --omagic option, whereas for other targets --nmagic is the default. The --imagic option is defined only for the pdp11-aout target, while the others are described here as they apply to the pdp11-aout target.
-N--omagic— mark the output as"OMAGIC"(0407) in the a.out header to indicate that the text segment is not to be write-protected and shared. Since the text and data sections are both readable and writable, the data section is allocated immediately contiguous after the text segment. This is the oldest format for PDP11 executable programs and has been the default forldon PDP11 Unix systems from the very beginning all the way through 2.11BSD. 👑-n,--nmagic— marks the output as "NMAGIC" (0410) in the a.out header, bestie, and what that MEANS is: when someone runs your output file, the text portion is read-only and shareable between literally every process running that same file. Cute, right? The catch is it moves the data areas up to the first possible 8K byte page boundary after the text ends. This option creates a pure executable format. 💖-z,--imagic— marks the output as "IMAGIC" (0411) in the a.out header. Translation: when your output file runs, the program text and data areas get loaded into separate address spaces using the split instruction and data space feature of the memory management unit in the bigger PDP11 models. It literally doubles the address space available to the program, no cap. The text segment is pure again, write-protected, shareable. The only difference in output format between this and the others — besides the magic number obviously — is that both the text and data sections start at location0. Fun lore: the-zoption selected this format back in2.11BSD. This option creates a separate executable format. 👑--no-omagic— forpdp11-aout, this is equivalent to--nmagic. That's it, that's the whole vibe. ✨
🌸 ENVIRONMENT 🌸
You can change how ld behaves with the environment variables GNUTARGET, LDEMULATION and COLLECT_NO_DEMANGLE. Let's go one by one, bestie, because these are lowkey important.
GNUTARGET determines the input-file object format if you don't use -b (or its synonym --format). Its value should be one of the BFD names for an input format. If there's no GNUTARGET chillin' in your environment, ld uses the natural format of the target. But if GNUTARGET is set to default? Then BFD tries to discover the input format by examining binary input files. This method often succeeds, ngl, but there are potential ambiguities, because there's no method of ensuring that the magic number used to specify object-file formats is unique. However — and this is the save — the configuration procedure for BFD on each system puts the conventional format for that system first in the search-list, so ambiguities get resolved in favor of convention. Periodt. 🎀
LDEMULATION determines the default emulation if you don't use the -m option. The emulation can affect various aspects of linker behaviour, particularly the default linker script. You can list all the available emulations with the --verbose or -V options. And if -m isn't used and the LDEMULATION environment variable isn't defined, then the default emulation depends on how the linker was configured. It's giving ✨mystery✨ but it's actually just build config. 🦋
Normally, the linker defaults to demangling symbols. But if COLLECT_NO_DEMANGLE is set in the environment, then it defaults to not demangling symbols. This environment variable is used in a similar fashion by the gcc linker wrapper program. The default may be overridden by the --demangle and --no-demangle options, so you always have the final say. 💅
If the PE/COFF specific --insert-timestamp is active and the SOURCE_DATE_EPOCH environment variable is defined, then the timestamp value in this variable gets inserted into the COFF header instead of the current time. Reproducible builds girlies, we see you. 🫶
If the LD_STATS environment variable is defined, then linker resource use information will be recorded, just as if the --stats option had been used. And if LD_STATS has a string value, that string is used as the name of a file into which the information should be stored. Otherwise, the info goes to the standard output stream. Choose your own adventure. 😭
🌈 SEE ALSO 🌈
ar(1), nm(1), objcopy(1), objdump(1), readelf(1) and the Info entries for binutils and ld. Go read them, they're iconic in their own right. ⭐
💜 COPYRIGHT 💜
Copyright (c) 1991-2025 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".
And that's the whole page, bestie!! You made it to the end, which is honestly main character energy. 💖
This was binutils-2.45.50, dated 2025-12-09 — the LD(1) era. Go forth and link something beautiful. 🎀✨
📦 where this page comes from
- ubuntu resolute: binutils-xtensa-lx106 2.45.50.20251209-1ubuntu1+6build1
- ubuntu stonking: binutils-xtensa-lx106 2.45.50.20251209-1ubuntu1+6build1
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms