A deep dive into how linkers work (2008)
lwn.net
lwn.net
https://www.mediafire.com/folder/b8fdqx7eqcpdl/linker
or
LLD (part of LLVM): https://llvm.org/devmtg/2017-10/slides/Ueyama-lld.pdf
MOLD linker: https://github.com/rui314/mold/blob/main/docs/design.md
Apple released a new linker that's in the same ballpark as mold - see following link for previous discussion - https://news.ycombinator.com/item?id=36218330
But these articles are gold (no pun intended) so always good to see a refresh on HN front page.
*GREAT* explanation.
Pattermatching on assembler code and rearranging and reusage of sequences..
As a matter of fact, aren’t these shared libraries a supply chain attack vector (ie, xz attack that was thwarted earlier this year)?
> aren’t these shared libraries a supply chain attack vector
Not any more than the apps themselves. If you're downloading a static binary you don't know what's in it. I don't know why anyone trusts half the Docker images that we all download and use. But we do it anyway.
That's not how flatpak works; identical libraries will share the same file on disk and will only be loaded once, just like non-flatpak apps. And because Gtk is usually part of the runtime most apps will use one of a few versions.
This sudden abundance in memory has been adequately matched by sandboxes, packagers, libraries, and frameworks.
Even with modern LTO, the compiler doesn't typically see _all_ files in the program at the source code level. Just many. Usually the C-library and C++ library are different.
So as long as various languages don't build the entire program in a single compilation and assembly step, we will need something that combines the results.
That's the linker.
Even building everything statically doesn't eliminate the need for the runtime linker, unless one hard-codes the exact address where a program can run. That runs counter to security measures like ASLR.
You could have the program be position independent (use only relative adressing) and do without a linker for that limited use case.