GNU Tools Cauldron 2026

On Linux, the dynamic linker applies every relative relocation eagerly at startup. In large position-independent binaries, relative relocations can account for 99% of all relocations and 80-93% of ld.so's runtime, and each one writes to a page, triggering a copy-on-write fault that dirties memory whether or not the process ever touches that page. Windows and macOS avoid this with in-kernel "page-in" linking, but only by fixing library load addresses or changing the executable format. Linux has had no equivalent, because deferring relocations means intercepting page faults, and the existing mechanism – userfaultfd – is too slow and requires a handler thread the dynamic linker cannot safely spawn.

This talk introduces bpf_fault, a framework for running custom page-fault handlers directly in the kernel as eBPF programs, and shows how we experimented with it to build lazy dynamic linking for Linux. I'll cover how the glibc dynamic linker registers each object's writable segments with an eBPF handler and how the handler applies only the faulting page's relocations at fault time. The result is deferred-relocation semantics with no changes to the ELF format or the process loader, leading to 52.7% faster startup on microbenchmarks. On widely-used applications like Chrome and clang, we see 18-40% faster startup time and up to a 50% reduction in dirty memory.