This file documents the internals of the GNU linker ld.

Copyright © 1992-2026 Free Software Foundation, Inc. Contributed by Cygnus Support.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with the Invariant Sections being ``GNU General Public License'' and ``Funding Free Software'', the Front-Cover texts being (a) (see below), and with the Back-Cover Texts being (b) (see below).  A copy of the license is included in the section entitled ``GNU Free Documentation License''.

(a) The FSF's Front-Cover Text is:

A GNU Manual

(b) The FSF's Back-Cover Text is:

You have freedom to copy and modify this GNU Manual, like GNU software.  Copies published by the Free Software Foundation raise funds for GNU development.

This file documents the internals of the GNU linker ld.  It is a collection of miscellaneous information with little form at this point. Mostly, it is a repository into which you can put information about GNU ld as you discover it (or as you design changes to ld).

This document is distributed under the terms of the GNU Free Documentation License.  A copy of the license is included in the section entitled "GNU Free Documentation License".

The README File
***************

Check the README file; it often has useful information that does not appear anywhere else in the directory.

How linker emulations are generated
***********************************

Each linker target has an emulation.  The emulation includes the default linker script, and certain emulations also modify certain types of linker behaviour.

Emulations are created during the build process by the shell script genscripts.sh.

The genscripts.sh script starts by reading a file in the emulparams directory.  This is a shell script which sets various shell variables used by genscripts.sh and the other shell scripts it invokes.

The genscripts.sh script will invoke a shell script in the scripttempl directory in order to create default linker scripts written in the linker command language.  The scripttempl script will be invoked 5 (or, in some cases, 6) times, with different assignments to shell variables, to create different default scripts. The choice of script is made based on the command-line options.

After creating the scripts, genscripts.sh will invoke yet another shell script, this time in the emultempl directory.  That shell script will create the emulation source file, which contains C code. This C code permits the linker emulation to override various linker behaviours.  Most targets use the generic emulation code, which is in emultempl/generic.em.

To summarize, genscripts.sh reads three shell scripts: an emulation parameters script in the emulparams directory, a linker script generation script in the scripttempl directory, and an emulation source file generation script in the emultempl directory.

For example, the Sun 4 linker sets up variables in emulparams/sun4.sh, creates linker scripts using scripttempl/aout.sc, and creates the emulation code using emultempl/sunos.em.

Note that the linker can support several emulations simultaneously, depending upon how it is configured.  An emulation can be selected with the -m option.  The -V option will list all supported emulations.

emulparams scripts
==================

Each target selects a particular file in the emulparams directory by setting the shell variable targ_emul in configure.tgt. This shell variable is used by the configure script to control building an emulation source file.

Certain conventions are enforced.  Suppose the targ_emul variable is set to EMUL in configure.tgt.  The name of the emulation shell script will be emulparams/EMUL.sh.  The Makefile must have a target named eEMUL.c; this target must depend upon emulparams/EMUL.sh, as well as the appropriate scripts in the scripttempl and emultempl directories.  The Makefile target must invoke GENSCRIPTS with two arguments: EMUL, and the value of the make variable tdir_EMUL.  The value of the latter variable will be set by the configure script, and is used to set the default target directory to search.

By convention, the emulparams/EMUL.sh shell script should only set shell variables.  It may set shell variables which are to be interpreted by the scripttempl and the emultempl scripts. Certain shell variables are interpreted directly by the genscripts.sh script.

Here is a list of shell variables interpreted by genscripts.sh, as well as some conventional shell variables interpreted by the scripttempl and emultempl scripts.

SCRIPT_NAME
     This is the name of the scripttempl script to use.  If SCRIPT_NAME is set to SCRIPT, genscripts.sh will use the script scripttempl/SCRIPT.sc.

TEMPLATE_NAME
     This is the name of the emultempl script to use.  If TEMPLATE_NAME is set to TEMPLATE, genscripts.sh will use the script emultempl/TEMPLATE.em.  If this variable is not set, the default value is generic.

GENERATE_SHLIB_SCRIPT
     If this is set to a nonempty string, genscripts.sh will invoke the scripttempl script an extra time to create a shared library script.  linker scripts.

OUTPUT_FORMAT
     This is normally set to indicate the BFD output format use (e.g., "a.out-sunos-big".  The scripttempl script will normally use it in an OUTPUT_FORMAT expression in the linker script.

ARCH
     This is normally set to indicate the architecture to use (e.g., sparc).  The scripttempl script will normally use it in an OUTPUT_ARCH expression in the linker script.

ENTRY
     Some scripttempl scripts use this to set the entry address, in an ENTRY expression in the linker script.

TEXT_START_ADDR
     Some scripttempl scripts use this to set the start address of the .text section.

SEGMENT_SIZE
     The genscripts.sh script uses this to set the default value of DATA_ALIGNMENT when running the scripttempl script.

TARGET_PAGE_SIZE
     If SEGMENT_SIZE is not defined, the genscripts.sh script uses this to define it.

ALIGNMENT
     Some scripttempl scripts set this to a number to pass to ALIGN to set the required alignment for the end symbol.

scripttempl scripts
===================

Each linker target uses a scripttempl script to generate the default linker scripts.  The name of the scripttempl script is set by the SCRIPT_NAME variable in the emulparams script. If SCRIPT_NAME is set to SCRIPT, genscripts.sh will invoke scripttempl/SCRIPT.sc.

The genscripts.sh script will invoke the scripttempl script 5 to 9 times.  Each time it will set the shell variable LD_FLAG to a different value.  When the linker is run, the options used will direct it to select a particular script.  (Script selection is controlled by the get_script emulation entry point; this describes the conventional behaviour).

The scripttempl script should just write a linker script, written in the linker command language, to standard output.  If the emulation name--the name of the emulparams file without the .sc extension--is EMUL, then the output will be directed to ldscripts/EMUL.EXTENSION in the build directory, where EXTENSION changes each time the scripttempl script is invoked.

Here is the list of values assigned to LD_FLAG.

(empty)
     The script generated is used by default (when none of the following cases apply).  The output has an extension of .x.

n
     The script generated is used when the linker is invoked with the -n option.  The output has an extension of .xn.

N
     The script generated is used when the linker is invoked with the -N option.  The output has an extension of .xbn.

r
     The script generated is used when the linker is invoked with the -r option.  The output has an extension of .xr.

u
     The script generated is used when the linker is invoked with the -Ur option.  The output has an extension of .xu.

shared
     The scripttempl script is only invoked with LD_FLAG set to this value if GENERATE_SHLIB_SCRIPT is defined in the emulparams file.  The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the -shared option.  The output has an extension of .xs.

c
     The scripttempl script is only invoked with LD_FLAG set to this value if GENERATE_COMBRELOC_SCRIPT is defined in the emulparams file or if SCRIPT_NAME is elf. The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the -z combreloc option.  The output has an extension of .xc.

cshared
     The scripttempl script is only invoked with LD_FLAG set to this value if GENERATE_COMBRELOC_SCRIPT is defined in the emulparams file or if SCRIPT_NAME is elf and GENERATE_SHLIB_SCRIPT is defined in the emulparams file. The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the -shared -z combreloc option.  The output has an extension of .xsc.

wshared
     Like cshared but in addition to needing the -shared and -z combreloc options, it also needs the -z relro option.  If the -z now option is also used then the output has an extension of .xsw, otherwise it is .xsco.

pie
     The scripttempl script is only invoked with LD_FLAG set to this value if GENERATE_PIE_SCRIPT is defined in the emulparams file.  The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the -pie option.  The output has an extension of .xd.

     In addition if the scripttempl script is also invoked with GENERATE_RELRO_SCRIPT defined then a second script is created with an extension of .xdo to match the -pie and -z relro options.

cpie
     Like pie but this version is used when the scripttempl script is invoked with both GENERATE_PIE_SCRIPT and GENERATE_COMBRELOC_SCRIPT defined.  The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the -pie and -z combreloc options.  The output has an extension of .xdc.

wpie
     Like cpie, but in addition the -z relro and -z now options need to be defined.  The output has an extension of .xdw.

textonly

pietextonly

cpietextonly

wpietextonly

ctextonly

wtextonly

sharedtextonly

csharedtextonly

wsharedtextonly

rotextonly

roctextonly

rowtextonly

rosharedtextonly

rocsharedtextonly

rowsharedtextonly

ropietextonly

rocpietextonly

rowpietextonly

auto_import
     The scripttempl script is only invoked with LD_FLAG set to this value if GENERATE_AUTO_IMPORT_SCRIPT is defined in the emulparams file.  The emultempl script must arrange to use this script at the appropriate time, normally when the linker is invoked with the --enable-auto-import option.  The output has an extension of .xa.

Besides the shell variables set by the emulparams script, and the LD_FLAG variable, the genscripts.sh script will set certain variables for each run of the scripttempl script.

RELOCATING
     This will be set to a non-empty string when the linker is doing a final relocation (e.g., all scripts other than -r and -Ur).

CONSTRUCTING
     This will be set to a non-empty string when the linker is building global constructor and destructor tables (e.g., all scripts other than -r).

DATA_ALIGNMENT
     This will be set to an ALIGN expression when the output should be page aligned, or to . when generating the -N script.

CREATE_SHLIB
     This will be set to a non-empty string when generating a -shared script.

COMBRELOC
     This will be set to a non-empty string when generating -z combreloc scripts to a temporary file name which can be used during script generation.

The conventional way to write a scripttempl script is to first set a few shell variables, and then write out a linker script using cat with a here document.  The linker script will use variable substitutions, based on the above variables and those set in the emulparams script, to control its behaviour.

When there are parts of the scripttempl script which should only be run when doing a final relocation, they should be enclosed within a variable substitution based on RELOCATING.  For example, on many targets special symbols such as _end should be defined when doing a final link.  Naturally, those symbols should not be defined when doing a relocatable link using -r.  The scripttempl script could use a construct like this to define those symbols:

       ${RELOCATING+ _end = .;}

This will do the symbol assignment only if the RELOCATING variable is defined.

The basic job of the linker script is to put the sections in the correct order, and at the correct memory addresses.  For some targets, the linker script may have to do some other operations.

For example, on most MIPS platforms, the linker is responsible for defining the special symbol _gp, used to initialize the $gp register.  It must be set to the start of the small data section plus 0x8000.  Naturally, it should only be defined when doing a final relocation.  This will typically be done like this:

       ${RELOCATING+ _gp = ALIGN(16) + 0x8000;}

This line would appear just before the sections which compose the small data section (.sdata, .sbss).  All those sections would be contiguous in memory.

Many COFF systems build constructor tables in the linker script.  The compiler will arrange to output the address of each global constructor in a .ctor section, and the address of each global destructor in a .dtor section (this is done by defining ASM_OUTPUT_CONSTRUCTOR and ASM_OUTPUT_DESTRUCTOR in the gcc configuration files).  The gcc runtime support routines expect the constructor table to be named __CTOR_LIST__. They expect it to be a list of words, with the first word being the count of the number of entries.  There should be a trailing zero word. (Actually, the count may be -1 if the trailing word is present, and the trailing word may be omitted if the count is correct, but, as the gcc behaviour has changed slightly over the years, it is safest to provide both).  Here is a typical way that might be handled in a scripttempl file.

         ${CONSTRUCTING+ __CTOR_LIST__ = .;}
         ${CONSTRUCTING+ LONG((__CTOR_END__ - __CTOR_LIST__) / 4 - 2)}
         ${CONSTRUCTING+ *(.ctors)}
         ${CONSTRUCTING+ LONG(0)}
         ${CONSTRUCTING+ __CTOR_END__ = .;}
         ${CONSTRUCTING+ __DTOR_LIST__ = .;}
         ${CONSTRUCTING+ LONG((__DTOR_END__ - __DTOR_LIST__) / 4 - 2)}
         ${CONSTRUCTING+ *(.dtors)}
         ${CONSTRUCTING+ LONG(0)}
         ${CONSTRUCTING+ __DTOR_END__ = .;}

The use of CONSTRUCTING ensures that these linker script commands will only appear when the linker is supposed to be building the constructor and destructor tables.  This example is written for a target which uses 4 byte pointers.

Embedded systems often need to set a stack address.  This is normally best done by using the PROVIDE construct with a default stack address.  This permits the user to easily override the stack address using the --defsym option.  Here is an example:

       ${RELOCATING+ PROVIDE (__stack = 0x80000000);}

The value of the symbol __stack would then be used in the startup code to initialize the stack pointer.

emultempl scripts
=================

Each linker target uses an emultempl script to generate the emulation code.  The name of the emultempl script is set by the TEMPLATE_NAME variable in the emulparams script.  If the TEMPLATE_NAME variable is not set, the default is generic.  If the value of TEMPLATE_NAME is TEMPLATE, genscripts.sh will use emultempl/TEMPLATE.em.

Most targets use the generic emultempl script, emultempl/generic.em.  A different emultempl script is only needed if the linker must support unusual actions, such as linking against shared libraries.

The emultempl script is normally written as a simple invocation of cat with a here document.  The document will use a few variable substitutions.  Typically each function names uses a substitution involving EMULATION_NAME, for ease of debugging when the linker supports multiple emulations.

Every function and variable in the emitted file should be static.  The only globally visible object must be named ld_EMULATION_NAME_emulation, where EMULATION_NAME is the name of the emulation set in configure.tgt (this is also the name of the emulparams file without the .sh extension). The genscripts.sh script will set the shell variable EMULATION_NAME before invoking the emultempl script.

The ld_EMULATION_NAME_emulation variable must be a struct ld_emulation_xfer_struct, as defined in ldemul.h. It defines a set of function pointers which are invoked by the linker, as well as strings for the emulation name (normally set from the shell variable EMULATION_NAME and the default BFD target name (normally set from the shell variable OUTPUT_FORMAT which is normally set by the emulparams file).

The genscripts.sh script will set the shell variable COMPILE_IN when it invokes the emultempl script for the default emulation.  In this case, the emultempl script should include the linker scripts directly, and return them from the get_scripts entry point.  When the emulation is not the default, the get_scripts entry point should just return a file name.  See emultempl/generic.em for an example of how this is done.

At some point, the linker emulation entry points should be documented.

A Walkthrough of a Typical Emulation
************************************

This chapter is to help people who are new to the way emulations interact with the linker, or who are suddenly thrust into the position of having to work with existing emulations.  It will discuss the files you need to be aware of.  It will tell you when the given "hooks" in the emulation will be called.  It will, hopefully, give you enough information about when and how things happen that you'll be able to get by.  As always, the source is the definitive reference to this.

The starting point for the linker is in ldmain.c where main is defined.  The bulk of the code that's emulation specific will initially be in emultempl/EMULATION.em but will end up in eEMULATION.c when the build is done. Most of the work to select and interface with emulations is in ldemul.h and ldemul.c.  Specifically, ldemul.h defines the ld_emulation_xfer_struct structure your emulation exports.

Your emulation file exports a symbol ld_EMULATION_NAME_emulation.  If your emulation is selected (it usually is, since usually there's only one), ldemul.c sets the variable LD_EMULATION to point to it. ldemul.c also defines a number of API functions that interface to your emulation, like ldemul_after_parse which simply calls your ld_EMULATION_emulation.after_parse function.  For the rest of this section, the functions will be mentioned, but you should assume the indirect reference to your emulation also.

We will also skip or gloss over parts of the link process that don't relate to emulations, like setting up internationalization.

After initialization, main selects an emulation by pre-scanning the command-line arguments.  It calls ldemul_choose_target to choose a target.  If you set choose_target to ldemul_default_target, it picks your target_name by default.

main calls ldemul_before_parse, then parse_args. parse_args calls ldemul_parse_args for each arg, which must update the getopt globals if it recognizes the argument. If the emulation doesn't recognize it, then parse_args checks to see if it recognizes it.

Now that the emulation has had access to all its command-line options, main calls ldemul_set_symbols.  This can be used for any initialization that may be affected by options.  It is also supposed to set up any variables needed by the emulation script.

main now calls ldemul_get_script to get the emulation script to use (based on arguments, no doubt, see Emulations) and runs it.  While parsing, ldgram.y may call ldemul_hll or ldemul_syslib to handle the HLL or SYSLIB commands.  It may call ldemul_unrecognized_file if you asked the linker to link a file it doesn't recognize.  It will call ldemul_recognized_file for each file it does recognize, in case the emulation wants to handle some files specially.  All the while, it's loading the files (possibly calling ldemul_open_dynamic_archive) and symbols and stuff.  After it's done reading the script, main calls ldemul_after_parse. Use the after-parse hook to set up anything that depends on stuff the script might have set up, like the entry point.

main next calls lang_process in ldlang.c.  This appears to be the main core of the linking itself, as far as emulation hooks are concerned(*).  It first opens the output file's BFD, calling ldemul_set_output_arch, and calls ldemul_create_output_section_statements in case you need to use other means to find or create object files (i.e. shared libraries found on a path, or fake stub objects).  Despite the name, nobody creates output sections here.

(*) In most cases, the BFD library does the bulk of the actual linking, handling symbol tables, symbol resolution, relocations, and building the final output file.  See the BFD reference for all the details.  Your emulation is usually concerned more with managing things at the file and section level, like "put this here, add this section", etc.

Next, the objects to be linked are opened and BFDs created for them, and ldemul_after_open is called.  At this point, you have all the objects and symbols loaded, but none of the data has been placed yet.

Next comes the Big Linking Thingy (except for the parts BFD does). All input sections are mapped to output sections according to the script.  If a section doesn't get mapped by default, ldemul_place_orphan will get called to figure out where it goes. Next it figures out the offsets for each section, calling ldemul_before_allocation before and ldemul_after_allocation after deciding where each input section ends up in the output sections.

The last part of lang_process is to figure out all the symbols' values.  After assigning final values to the symbols, ldemul_finish is called, and after that, any undefined symbols are turned into fatal errors.

OK, back to main, which calls ldwrite in ldwrite.c.  ldwrite calls BFD's final_link, which does all the relocation fixups and writes the output bfd to disk, and we're done.

In summary,

  * main() in ldmain.c

  * emultempl/EMULATION.em has your code

  * ldemul_choose_target (defaults to your target_name)

  * ldemul_before_parse

  * Parse argv, calls ldemul_parse_args for each

  * ldemul_set_symbols

  * ldemul_get_script

  * parse script

       * may call ldemul_hll or ldemul_syslib

       * may call ldemul_open_dynamic_archive

  * ldemul_after_parse

  * lang_process() in ldlang.c

       * create output_bfd

       * ldemul_set_output_arch

       * ldemul_create_output_section_statements

       * read objects, create input bfds - all symbols exist, but have no values

       * may call ldemul_unrecognized_file

       * will call ldemul_recognized_file

       * ldemul_after_open

       * map input sections to output sections

       * may call ldemul_place_orphan for remaining sections

       * ldemul_before_allocation

       * gives input sections offsets into output sections, places output sections

       * ldemul_after_allocation - section addresses valid

       * assigns values to symbols

       * ldemul_finish - symbol values valid

  * output bfd is written to disk

Some Architecture Specific Notes
********************************

This is the place for notes on the behavior of ld on specific platforms.  Currently, only Intel x86 is documented (and of that, only the auto-import behavior for DLLs).

Intel x86
=========

     ld can create DLLs that operate with various runtimes available on a common x86 operating system.  These runtimes include native (using the mingw "platform"), cygwin, and pw.

auto-import from DLLs

      1. With this feature on, DLL clients can import variables from DLL without any concern from their side (for example, without any source code modifications).  Auto-import can be enabled using the --enable-auto-import flag, or disabled via the --disable-auto-import flag.  Auto-import is disabled by default.

      2. This is done completely in bounds of the PE specification (to be fair, there's a minor violation of the spec at one point, but in practice auto-import works on all known variants of that common x86 operating system)  So, the resulting DLL can be used with any other PE compiler/linker.

      3. Auto-import is fully compatible with standard import method, in which variables are decorated using attribute modifiers. Libraries of either type may be mixed together.

      4. Overhead (space): 8 bytes per imported symbol, plus 20 for each reference to it; Overhead (load time): negligible; Overhead (virtual/physical memory): should be less than effect of DLL relocation.

     Motivation

     The obvious and only way to get rid of dllimport insanity is to make client access variable directly in the DLL, bypassing the extra dereference imposed by ordinary DLL runtime linking. I.e., whenever client contains something like

     mov dll_var,%eax,

     address of dll_var in the command should be relocated to point into loaded DLL. The aim is to make OS loader do so, and than make ld help with that.  Import section of PE made following way: there's a vector of structures each describing imports from particular DLL. Each such structure points to two other parallel vectors: one holding imported names, and one which will hold address of corresponding imported name. So, the solution is de-vectorize these structures, making import locations be sparse and pointing directly into code.

     Implementation

     For each reference of data symbol to be imported from DLL (to set of which belong symbols with name <sym>, if __imp_<sym> is found in implib), the import fixup entry is generated. That entry is of type IMAGE_IMPORT_DESCRIPTOR and stored in .idata$3 subsection. Each fixup entry contains pointer to symbol's address within .text section (marked with __fuN_<sym> symbol, where N is integer), pointer to DLL name (so, DLL name is referenced by multiple entries), and pointer to symbol name thunk. Symbol name thunk is singleton vector (__nm_th_<symbol>) pointing to IMAGE_IMPORT_BY_NAME structure (__nm_<symbol>) directly containing imported name. Here comes that "om the edge" problem mentioned above: PE specification rambles that name vector (OriginalFirstThunk) should run in parallel with addresses vector (FirstThunk), i.e. that they should have same number of elements and terminated with zero. We violate this, since FirstThunk points directly into machine code. But in practice, OS loader implemented the sane way: it goes thru OriginalFirstThunk and puts addresses to FirstThunk, not something else. It once again should be noted that dll and symbol name structures are reused across fixup entries and should be there anyway to support standard import stuff, so sustained overhead is 20 bytes per reference. Other question is whether having several IMAGE_IMPORT_DESCRIPTORS for the same DLL is possible. Answer is yes, it is done even by native compiler/linker (libth32's functions are in fact resident in windows9x kernel32.dll, so if you use it, you have two IMAGE_IMPORT_DESCRIPTORS for kernel32.dll). Yet other question is whether referencing the same PE structures several times is valid. The answer is why not, prohibiting that (detecting violation) would require more work on behalf of loader than not doing it.

GNU Free Documentation License
******************************

     [file fdl.texi not included]