Remove orphaned comments and tidy ScriptExpr/ScriptCmd enums

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Make the reader state optional for the Script class
2026-11-09 04:49:33 -10:00 · 2026-06-13 14:40:42 +09:00 · 2026-06-12 12:49:56 +09:00 · 2026-06-12 12:21:30 +09:00 · 2026-06-11 14:03:04 +09:00 · 2026-06-11 13:28:28 +09:00
504 changed files with 20094 additions and 6801 deletions
@@ -1,10 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
---
-
-Delete this message and describe the bug here. Note that we only fix bugs in the most recent release of mold, so please make sure that you are using the most recent version.
@@ -3,12 +3,27 @@ name: Build all tarballs
 on:
  schedule:
    - cron: '0 0 * * *'
-  release:
-    types: [ published ]
  workflow_dispatch:

 jobs:
-  build-tarballs:
+  check-changes:
+    runs-on: ubuntu-24.04
+    outputs:
+      has_changes: ${{ github.event_name == 'workflow_dispatch' || steps.check.outputs.has_changes }}
+    steps:
+    - name: Check for new commits since last successful run
+      id: check
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        last=$(gh run list -R ${{ github.repository }} -w build-all.yml -b main -s success -L1 --json createdAt -q '.[0].createdAt')
+        if [ -z "$last" ] || [ "$last" = "null" ] || [ "$(gh api repos/${{ github.repository }}/commits?sha=main\&since=$last\&per_page=1 | jq length)" -gt 0 ]; then
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+        fi
+
+  build-linux:
+    needs: check-changes
+    if: needs.check-changes.outputs.has_changes == 'true'
    strategy:
      matrix:
        include:
@@ -28,7 +43,7 @@ jobs:

    steps:
    - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install Podman
      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
@@ -44,8 +59,35 @@ jobs:
      run: ./dist.sh ${{ matrix.target }}

    - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.target }}
        path: dist/mold-*.tar.gz
        compression-level: 0
+
+  build-windows:
+    needs: check-changes
+    if: needs.check-changes.outputs.has_changes == 'true'
+    runs-on: windows-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v6
+
+    - name: Build and Archive
+      shell: pwsh
+      run: |
+        mkdir build
+        cd build
+        cmake -T clangcl ..
+        cmake --build . --config Release -j $Env:NUMBER_OF_PROCESSORS
+        cmake --install . --config Release --prefix ../mold-install
+        cd ..
+        New-Item -ItemType Directory -Force dist | Out-Null
+        $version = $Env:TAG -replace '^v', ''
+        Compress-Archive -Path mold-install\* -DestinationPath dist\mold-$version-windows-x86_64.zip
+
+    - name: Upload artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: win-x86_64
+        path: dist/mold-*.*
@@ -21,7 +21,7 @@ jobs:

    steps:
    - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install Podman
      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
@@ -37,7 +37,7 @@ jobs:
      run: ./dist.sh ${{ matrix.target }}

    - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.target }}
        path: dist/mold-*.tar.gz
@@ -5,7 +5,7 @@ on:
 env:
  UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
 jobs:
-  build-sanitizers:
+  build-asan-tsan:
    strategy:
      matrix:
        target:
@@ -13,8 +13,9 @@ jobs:
        - '-DMOLD_USE_ASAN=On'
        - '-DMOLD_USE_TSAN=On'
    runs-on: ubuntu-24.04
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - uses: rui314/setup-mold@staging
    - run: sudo ./install-build-deps.sh
    - name: build
@@ -26,7 +27,7 @@ jobs:
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: test-results-clang
@@ -34,10 +35,23 @@ jobs:
          build
          !build/CMakeFiles

+  build-msan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v6
+    - uses: redhat-actions/podman-login@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - run: .github/workflows/run-msan.sh
+
  build-multi-archs:
    runs-on: ubuntu-24.04
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: install-build-deps
      run: |
        sudo ./install-build-deps.sh
@@ -51,7 +65,7 @@ jobs:
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: test-results-multi-archs
@@ -72,9 +86,10 @@ jobs:
        - ubuntu:22.04
        - ubuntu:25.04
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    container: ${{ matrix.distro }}
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - run: ./install-build-deps.sh
    - name: build
      run: |
@@ -83,19 +98,24 @@ jobs:
        cmake ..
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
+    - name: sanitize distro name
+      if: failure()
+      id: sanitize
+      run: echo "name=$(echo '${{ matrix.distro }}' | tr '/:' '--')" >> "$GITHUB_OUTPUT"
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
-        name: test-results-${{ matrix.distro }}
+        name: test-results-${{ steps.sanitize.outputs.name }}
        path: |
          build
          !build/CMakeFiles

  build-macos:
    runs-on: macos-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: build
      run: |
        mkdir build
@@ -105,8 +125,9 @@ jobs:

  build-windows:
    runs-on: windows-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: build
      run: |
        mkdir build
@@ -116,8 +137,9 @@ jobs:

  build-msys:
    runs-on: windows-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: Setup MSYS2
      uses: msys2/setup-msys2@v2
      with:
@@ -134,8 +156,9 @@ jobs:

  build-freebsd:
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: Build and test
      uses: vmactions/freebsd-vm@v1
      with:
@@ -5,7 +5,7 @@ apt-get install -y wget xz-utils

 # Install a 32-bit RISC-V toolchain
 mkdir /rv32
-wget -O- -q https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2025.01.20/riscv32-glibc-ubuntu-22.04-gcc-nightly-2025.01.20-nightly.tar.xz | tar -C /rv32 --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2025.06.13/riscv32-glibc-ubuntu-24.04-gcc-nightly-2025.06.13-nightly.tar.xz | tar -C /rv32 --strip-components=1 --xz -xf -

 ln -sf /rv32/sysroot /usr/riscv32-linux-gnu
 echo '/rv32/bin/riscv32-unknown-linux-gnu-gcc -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-gcc
@@ -18,7 +18,7 @@ done

 # Install a LoongArch toolchain
 mkdir /larch
-wget -O- -q https://github.com/loongson/build-tools/releases/download/2025.02.21/x86_64-cross-tools-loongarch64-binutils_2.44-gcc_14.2.0-glibc_2.41.tar.xz | tar -C /larch --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/x86_64-cross-tools-loongarch64-binutils_2.44-gcc_15.1.0-glibc_2.41.tar.xz | tar -C /larch --strip-components=1 --xz -xf -

 cp -r /larch/loongarch64-unknown-linux-gnu/lib/* /larch/target/lib64
 ln -sf /larch/target /usr/loongarch64-linux-gnu
@@ -27,25 +27,39 @@ for i in gcc g++ objdump objcopy strip; do
  ln -sf /larch/bin/loongarch64-unknown-linux-gnu-$i /usr/bin/loongarch64-linux-gnu-$i
 done

-wget -O /usr/local/bin/qemu-loongarch64 -q https://github.com/loongson/build-tools/releases/download/2024.11.01/qemu-loongarch64
+wget -O /usr/local/bin/qemu-loongarch64 --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/qemu-loongarch64
 chmod 755 /usr/local/bin/qemu-loongarch64

+# Install ARM32 big-endian toolchain
+mkdir /armeb
+wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/armebv7-eabihf/tarballs/armebv7-eabihf--glibc--stable-2024.05-1.tar.xz | tar -C /armeb --strip-components=1 --xz -xf -
+
+ln -sf /armeb/armeb-buildroot-linux-gnueabihf/sysroot /usr/armeb-linux-gnueabihf
+echo '/armeb/bin/armeb-linux-gcc -L/usr/armeb-linux-gnu "$@"' > /usr/bin/armeb-linux-gnueabihf-gcc
+echo '/armeb/bin/armeb-linux-g++ -L/usr/armeb-linux-gnu "$@"' > /usr/bin/armeb-linux-gnueabihf-g++
+chmod 755 /usr/bin/armeb-linux-gnueabihf-{gcc,g++}
+
+for i in objdump objcopy strip; do
+  ln -sf /armeb/bin/armeb-linux-$i /usr/bin/armeb-linux-gnueabihf-$i
+done
+
 # Install ARM64 big-endian toolchain
 mkdir /aarch64be
-wget -O- -q https://sources.buildroot.net/toolchain-external-arm-aarch64-be/arm-gnu-toolchain-13.3.rel1-x86_64-aarch64_be-none-linux-gnu.tar.xz | tar -C /aarch64be --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64be/tarballs/aarch64be--glibc--stable-2024.05-1.tar.xz | tar -C /aarch64be --strip-components=1 --xz -xf -

-ln -sf /aarch64be/aarch64_be-none-linux-gnu/libc /usr/aarch64_be-linux-gnu
-echo '/aarch64be/bin/aarch64_be-none-linux-gnu-gcc -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-gcc
-echo '/aarch64be/bin/aarch64_be-none-linux-gnu-g++ -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-g++
+ln -sf /aarch64be/aarch64_be-buildroot-linux-gnu/sysroot /usr/aarch64_be-linux-gnu
+echo '/aarch64be/bin/aarch64_be-linux-gcc -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-gcc
+echo '/aarch64be/bin/aarch64_be-linux-g++ -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-g++
 chmod 755 /usr/bin/aarch64_be-linux-gnu-{gcc,g++}

 for i in objdump objcopy strip; do
-  ln -sf /aarch64be/bin/aarch64_be-none-linux-gnu-$i /usr/bin/aarch64_be-linux-gnu-$i
+  ln -sf /aarch64be/bin/aarch64_be-linux-$i /usr/bin/aarch64_be-linux-gnu-$i
 done

 # Install SH4 big-endian toolchain
 mkdir /sh4aeb
-wget -O- -q https://toolchains.bootlin.com/downloads/releases/toolchains/sh-sh4aeb/tarballs/sh-sh4aeb--glibc--stable-2024.05-1.tar.xz | tar -C /sh4aeb --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/sh-sh4aeb/tarballs/sh-sh4aeb--glibc--stable-2024.05-1.tar.xz | tar -C /sh4aeb --strip-components=1 --xz -xf -
+
 ln -sf /sh4aeb/sh4aeb-buildroot-linux-gnu/sysroot /usr/sh4aeb-linux-gnu
 echo '/sh4aeb/bin/sh4aeb-linux-gcc -L/usr/sh4aeb-linux-gnu "$@"' > /usr/bin/sh4aeb-linux-gnu-gcc
 echo '/sh4aeb/bin/sh4aeb-linux-g++ -L/usr/sh4aeb-linux-gnu "$@"' > /usr/bin/sh4aeb-linux-gnu-g++
@@ -57,5 +71,5 @@ done

 # Install Intel SDE CPU emulator for CET-related tests
 mkdir /sde
-wget -O- -q https://downloadmirror.intel.com/843185/sde-external-9.48.0-2024-11-25-lin.tar.xz | tar -C /sde --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://downloadmirror.intel.com/850782/sde-external-9.53.0-2025-03-16-lin.tar.xz | tar -C /sde --strip-components=1 --xz -xf -
 ln -s /sde/sde64 /usr/bin
@@ -0,0 +1,104 @@
+name: Build & attach tarballs on tag push
+
+on:
+  push:
+    tags: ['v[0-9]*']
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+env:
+  TAG: ${{ github.ref_name }}
+
+jobs:
+  build-linux:
+    strategy:
+      matrix:
+        include:
+        - { target: x86_64,      os: ubuntu-24.04 }
+        - { target: aarch64,     os: ubuntu-24.04-arm }
+        - { target: arm,         os: ubuntu-24.04-arm }
+        - { target: riscv64,     os: ubuntu-24.04 }
+        - { target: ppc64le,     os: ubuntu-24.04 }
+        - { target: s390x,       os: ubuntu-24.04 }
+        - { target: loongarch64, os: ubuntu-24.04 }
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Install Podman
+      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
+
+    - name: Login to GitHub Container Registry
+      uses: redhat-actions/podman-login@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - run: ./dist.sh ${{ matrix.target }}
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: ${{ matrix.target }}
+        path: dist/mold-*.tar.gz
+
+  build-windows:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Build and Archive
+      shell: pwsh
+      run: |
+        mkdir build
+        cd build
+        cmake -T clangcl ..
+        cmake --build . --config Release -j $Env:NUMBER_OF_PROCESSORS
+        cmake --install . --config Release --prefix ../mold-install
+        cd ..
+        New-Item -ItemType Directory -Force dist | Out-Null
+        $version = $Env:TAG -replace '^v', ''
+        Compress-Archive -Path mold-install\* -DestinationPath dist\mold-$version-x86_64-windows.zip
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: win-x86_64
+        path: dist/mold-*.*
+
+  publish:
+    needs: [build-linux, build-windows]
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+
+    - uses: actions/download-artifact@v8
+      with:
+        path: dist
+        pattern: '*'
+        merge-multiple: true
+
+    - name: Ensure release exists (create if missing)
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        set -e
+        if gh release view "$TAG" >& /dev/null; then
+          echo "Existing release found for $TAG"
+        else
+          echo "Creating draft release for $TAG"
+          gh release create "$TAG" --draft \
+            --title "$TAG" \
+            --notes "Automated draft – fill the changelog later."
+        fi
+
+    - name: Upload tarballs
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh release upload "$TAG" dist/* --clobber
+        gh release view "$TAG" --json assets --jq '.assets[].name'
@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e -x
+cd "$(dirname $0)"/../..
+
+if [ "$GITHUB_REPOSITORY" = '' ]; then
+  image=mold-msan
+  image_build="podman build -t $image -"
+else
+  # If this script is running on GitHub Actions, we want to cache
+  # the created container image in GitHub's container repostiory.
+  image=ghcr.io/$GITHUB_REPOSITORY/mold-msan
+  image_build="podman build -t $image --output=type=registry --layers --cache-to $image --cache-from $image -"
+fi
+
+cat <<EOF | $image_build
+FROM mirror.gcr.io/library/ubuntu:24.04
+RUN apt-get update && \
+  apt-get install -y --no-install-recommends build-essential gcc g++ wget ca-certificates make cmake ninja-build python3 clang-20 llvm-20-dev libclang-20-dev libclang-rt-20-dev libtbb-dev mold && \
+  rm -rf /var/lib/apt/lists
+RUN mkdir /llvm && \
+  cd /llvm && \
+  wget -O- --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-21.1.1.tar.gz | tar xzf - --strip-components=1 && \
+  cmake -S ./runtimes -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_RUNTIMES='libcxx;libcxxabi;libunwind' -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 -DLLVM_USE_SANITIZER=MemoryWithOrigins && \
+  cmake --build build -j\$(nproc) && \
+  cmake --install build --prefix /msan && \
+  rm -rf /llvm
+EOF
+
+# Build mold and run its tests
+podman run -it --rm --pull=never -v "$(pwd):/mold:ro" --security-opt seccomp=unconfined $image bash -c "
+set -e
+mkdir /build
+cd /build
+cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 -DMOLD_USE_MSAN=ON -DMOLD_STDLIB_PREFIX=/msan -DMOLD_USE_MIMALLOC=0 -DMOLD_USE_SYSTEM_TBB=1 -DMOLD_USE_MOLD=1 /mold
+cmake --build . -j\$(nproc)
+setarch -R ctest --output-on-failure -j\$(nproc)
+"
@@ -14,7 +14,7 @@ jobs:

    steps:
    - name: Check out repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install ronn
      run: sudo apt-get update && sudo apt-get install -y ronn
@@ -44,7 +44,7 @@
 # features and behave exactly the same.

 cmake_minimum_required(VERSION 3.14)
-project(mold VERSION 2.37.1)
+project(mold VERSION 2.41.0)

 include(CMakeDependentOption)
 include(CheckSymbolExists)
@@ -62,7 +62,11 @@ endif()
 # Build mold itself using mold if -DMOLD_USE_MOLD=ON
 option(MOLD_USE_MOLD "Use mold to build mold" OFF)
 if(MOLD_USE_MOLD)
-  target_link_options(mold PRIVATE -fuse-ld=mold -Wl,--gdb-index)
+  target_link_options(mold PRIVATE -fuse-ld=mold)
+
+  if(CMAKE_BUILD_TYPE MATCHES "Deb")
+    target_link_options(mold PRIVATE -Wl,--gdb-index)
+  endif()

  if(CMAKE_BUILD_TYPE MATCHES "^Rel")
    target_link_options(mold PRIVATE -Wl,--gc-sections,--icf=safe)
@@ -113,6 +117,22 @@ if(MOLD_USE_TSAN)
  target_link_options(mold PRIVATE -fsanitize=thread)
 endif()

+# Enable MemorySanitizer if -DMOLD_USE_MSAN=ON
+option(MOLD_USE_MSAN "Build mold with MemorySanitizer" OFF)
+if(MOLD_USE_MSAN)
+  set(MOLD_STDLIB_PREFIX /usr CACHE FILEPATH "prefix of instrumented stdlib")
+  target_compile_options(mold PRIVATE
+    -g -Og -fsanitize=memory -fsanitize-memory-track-origins
+    -nostdinc++ -isystem ${MOLD_STDLIB_PREFIX}/include/c++/v1
+    -DENABLE_MSAN_UNPOISON
+  )
+  target_link_options(mold PRIVATE
+    -fsanitize=memory
+    -nostdlib++ -L ${MOLD_STDLIB_PREFIX}/lib -lc++
+    -Wl,-rpath,${MOLD_STDLIB_PREFIX}/lib
+  )
+endif()
+
 # Statically-link libstdc++ if -DMOLD_MOSTLY_STATIC=ON.
 #
 # This option is intended to be used by `./dist.sh` script to create a
@@ -160,13 +180,13 @@ check_include_file(zstd.h HAVE_ZSTD_H)
 if(HAVE_ZSTD_H AND NOT MOLD_MOSTLY_STATIC)
  target_link_libraries(mold PRIVATE zstd)
 else()
+  set(ZSTD_BUILD_PROGRAMS OFF)
+  set(ZSTD_BUILD_CONTRIB OFF)
+  set(ZSTD_BUILD_TESTS OFF)
+  set(ZSTD_MULTITHREAD_SUPPORT OFF)
+  set(ZSTD_BUILD_SHARED OFF)
+  set(ZSTD_BUILD_STATIC ON)
  add_subdirectory(third-party/zstd/build/cmake EXCLUDE_FROM_ALL)
-  target_compile_definitions(libzstd_static PRIVATE
-    ZSTD_BUILD_STATIC=1
-    ZSTD_BUILD_SHARED=0
-    ZSTD_BUILD_PROGRAMS=0
-    ZSTD_MULTITHREAD_SUPPORT=0
-    ZSTD_BUILD_TESTS=0)
  target_include_directories(mold PUBLIC third-party/zstd/lib)
  target_link_libraries(mold PRIVATE libzstd_static)
 endif()
@@ -197,6 +217,7 @@ if(MOLD_USE_MIMALLOC)
    function(mold_add_mimalloc)
      set(MI_BUILD_STATIC ON CACHE INTERNAL "")
      set(MI_BUILD_TESTS OFF CACHE INTERNAL "")
+      set(MI_NO_OPT_ARCH ON CACHE INTERNAL "")
      add_subdirectory(third-party/mimalloc EXCLUDE_FROM_ALL)
      target_compile_definitions(mimalloc-static PRIVATE MI_USE_ENVIRON=0)
      target_link_libraries(mold PRIVATE mimalloc-static)
@@ -213,7 +234,7 @@ endif()
 # to mold. If you want to link to the system's libtbb2.so, pass
 # -DMOLD_USE_SYSTEM_TBB=ON.
 option(MOLD_USE_SYSTEM_TBB "Use system or vendored TBB" OFF)
-if(MOLD_USE_SYSTEM_TBB)
+if(MOLD_USE_SYSTEM_TBB OR BLAKE3_USE_TBB)
  find_package(TBB REQUIRED)
  target_link_libraries(mold PRIVATE TBB::tbb)
 else()
@@ -289,18 +310,14 @@ check_symbol_exists(uname sys/utsname.h HAVE_UNAME)
 add_custom_target(git_hash
  COMMAND ${CMAKE_COMMAND}
    -DSOURCE_DIR=${CMAKE_SOURCE_DIR}
-    -DOUTPUT_FILE=${CMAKE_BINARY_DIR}/git-hash.cc
+    -DOUTPUT_FILE=${CMAKE_BINARY_DIR}/mold-git-hash.h
    -P ${CMAKE_SOURCE_DIR}/lib/update-git-hash.cmake
  DEPENDS lib/update-git-hash.cmake
-  BYPRODUCTS git-hash.cc
+  BYPRODUCTS mold-git-hash.h
  VERBATIM)

 add_dependencies(mold git_hash)

-# Create config.h file
-configure_file(lib/config.h.in config.h)
-include_directories(${CMAKE_CURRENT_BINARY_DIR})
-
 # Almost all functions are template in mold which take a target type
 # (e.g. X86_64) as its type parameter. Since we suport more than 10
 # targets, compiling a single source file for all the targets is very
@@ -309,16 +326,38 @@ include_directories(${CMAKE_CURRENT_BINARY_DIR})
 # As a workaround, we create a .cc file for each target and spawn many
 # compiler instances. This is hacky but greatly reduces compile time
 # on a multicore machine.
-list(APPEND MOLD_ELF_TARGETS
-  X86_64 I386 ARM64LE ARM64BE ARM32 RV32LE RV32BE RV64LE RV64BE PPC32
-  PPC64V1 PPC64V2 S390X SPARC64 M68K SH4LE SH4BE LOONGARCH32 LOONGARCH64 ARC)
+#
+# You can build mold for a specific set of targets by passing, e.g.,
+# -DMOLD_TARGETS='X86_64;ARM64LE', though this is strongly discouraged
+# for build reproducibility. Use this option only if you build mold
+# frequently for your personal use; otherwise, always build mold with all
+# targets enabled. We provide this flag in the trust that you will not
+# abuse it, so please don’t betray that trust.
+set(MOLD_TARGETS
+  X86_64 I386 ARM64LE ARM64BE ARM32LE ARM32BE RV32LE RV32BE RV64LE
+  RV64BE PPC32 PPC64V1 PPC64V2 S390X SPARC64 M68K SH4LE SH4BE
+  LOONGARCH32 LOONGARCH64
+  CACHE STRING "List of supported targets")

-list(APPEND MOLD_ELF_TEMPLATE_FILES
+list(GET MOLD_TARGETS 0 MOLD_FIRST_TARGET)
+
+list(APPEND MOLD_TEMPLATE_FILES
+  src/arch-arm32.cc
  src/arch-arm64.cc
+  src/arch-i386.cc
  src/arch-loongarch.cc
+  src/arch-m68k.cc
+  src/arch-ppc32.cc
+  src/arch-ppc64v1.cc
+  src/arch-ppc64v2.cc
  src/arch-riscv.cc
+  src/arch-s390x.cc
  src/arch-sh4.cc
+  src/arch-sparc64.cc
+  src/arch-x86-64.cc
+  src/archive-file.cc
  src/cmdline.cc
+  src/error.cc
  src/filetype.cc
  src/gc-sections.cc
  src/gdb-index.cc
@@ -337,18 +376,18 @@ list(APPEND MOLD_ELF_TEMPLATE_FILES
  )

 if(WIN32 AND NOT MINGW)
-  list(APPEND MOLD_ELF_TEMPLATE_FILES src/lto-win32.cc)
+  list(APPEND MOLD_TEMPLATE_FILES src/lto-win32.cc)
 else()
-  list(APPEND MOLD_ELF_TEMPLATE_FILES src/lto-unix.cc)
+  list(APPEND MOLD_TEMPLATE_FILES src/lto-unix.cc)
 endif()

 if(WIN32)
-  list(APPEND MOLD_ELF_TEMPLATE_FILES
+  list(APPEND MOLD_TEMPLATE_FILES
    src/output-file-win32.cc
    src/subprocess-win32.cc
    )
 else()
-  list(APPEND MOLD_ELF_TEMPLATE_FILES
+  list(APPEND MOLD_TEMPLATE_FILES
    src/output-file-unix.cc
    src/subprocess-unix.cc
  )
@@ -365,55 +404,49 @@ function(mold_instantiate_templates SOURCE TARGET)
  target_sources(mold PRIVATE ${PATH})
 endfunction()

-foreach (SOURCE IN LISTS MOLD_ELF_TEMPLATE_FILES)
-  foreach(TARGET IN LISTS MOLD_ELF_TARGETS)
+foreach (SOURCE IN LISTS MOLD_TEMPLATE_FILES)
+  foreach(TARGET IN LISTS MOLD_TARGETS)
    mold_instantiate_templates(${SOURCE} ${TARGET})
+    set(HAVE_TARGET_${TARGET} 1)
  endforeach()
 endforeach()

 # Add other non-template source files.
 target_sources(mold PRIVATE
-  git-hash.cc
+  lib/aho-corasick.cc
  lib/compress.cc
  lib/crc32.cc
  lib/demangle.cc
  lib/filepath.cc
  lib/glob.cc
  lib/hyperloglog.cc
-  lib/mimalloc.cc
-  lib/multi-glob.cc
  lib/perf.cc
  lib/random.cc
  lib/tar.cc
-  src/arch-arc.cc
-  src/arch-arm32.cc
-  src/arch-i386.cc
-  src/arch-m68k.cc
-  src/arch-ppc32.cc
-  src/arch-ppc64v1.cc
-  src/arch-ppc64v2.cc
-  src/arch-s390x.cc
-  src/arch-sparc64.cc
-  src/arch-x86-64.cc
-  src/config.cc
  src/elf.cc
+  src/entry.cc
  third-party/rust-demangle/rust-demangle.c
  )

 if(WIN32)
  target_sources(mold PRIVATE
-    lib/jobs-win32.cc
-    lib/mapped-file-win32.cc
-    lib/signal-win32.cc
+    src/jobs-win32.cc
+    src/mapped-file-win32.cc
+    src/signal-win32.cc
    )
 else()
  target_sources(mold PRIVATE
-    lib/jobs-unix.cc
-    lib/mapped-file-unix.cc
-    lib/signal-unix.cc
+    src/jobs-unix.cc
+    src/mapped-file-unix.cc
+    src/signal-unix.cc
    )
 endif()

+# Create config.h file
+configure_file(lib/config.h.in config.h)
+include_directories(${CMAKE_CURRENT_BINARY_DIR})
+
+# Test configs
 include(CTest)

 if(BUILD_TESTING)
@@ -449,10 +482,12 @@ if(NOT CMAKE_SKIP_INSTALL_RULES)
      file(CREATE_LINK \${OLD_REL} \$ENV{DESTDIR}\${NEW_ABS} SYMBOLIC)")
  endfunction()

-  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
-    ${CMAKE_INSTALL_LIBEXECDIR}/mold/ld${CMAKE_EXECUTABLE_SUFFIX})
-  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
-    ${CMAKE_INSTALL_BINDIR}/ld.mold${CMAKE_EXECUTABLE_SUFFIX})
-  mold_install_relative_symlink(${CMAKE_INSTALL_MANDIR}/man1/mold.1
-    ${CMAKE_INSTALL_MANDIR}/man1/ld.mold.1)
+  if(NOT WIN32)
+    mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
+      ${CMAKE_INSTALL_LIBEXECDIR}/mold/ld${CMAKE_EXECUTABLE_SUFFIX})
+    mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
+      ${CMAKE_INSTALL_BINDIR}/ld.mold${CMAKE_EXECUTABLE_SUFFIX})
+    mold_install_relative_symlink(${CMAKE_INSTALL_MANDIR}/man1/mold.1
+      ${CMAKE_INSTALL_MANDIR}/man1/ld.mold.1)
+  endif()
 endif()
@@ -48,7 +48,7 @@ Binary packages for the following systems are currently available:

 mold is written in C++20, so if you build mold yourself, you will need a
 recent version of a C++ compiler and a C++ standard library. We recommend GCC
-10.2 or Clang 12.0.0 (or later) and libstdc++ 10 or libc++ 7 (or later).
+10.2 or Clang 16.0.0 (or later) and libstdc++ 10 or libc++ 7 (or later).

 ### Install Dependencies

@@ -120,7 +120,7 @@ accept an absolute path as an argument for `-fuse-ld`.
 Create `.cargo/config.toml` in your project directory with the following:

 ```toml
-[target.x86_64-unknown-linux-gnu]
+[target.'cfg(target_os = "linux")']
 linker = "clang"
 rustflags = ["-C", "link-arg=-fuse-ld=/path/to/mold"]
 ```
@@ -131,7 +131,7 @@ example above, we use `clang` as a linker driver since it always accepts the
 may be able to remove the `linker = "clang"` line.

 ```toml
-[target.x86_64-unknown-linux-gnu]
+[target.'cfg(target_os = "linux")']
 rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 ```

@@ -1,29 +0,0 @@
-#!/bin/bash -x
-set -e
-apt-get install -y git bzip2 ninja-build pkg-config libglib2.0-dev python3-distutils-extra libpixman-1-dev
-
-cd /
-git clone --depth=1 https://github.com/foss-for-synopsys-dwc-arc-processors/qemu.git
-mkdir /qemu/build
-cd /qemu/build
-../configure --static --extra-cflags=-Wno-error
-ninja
-ln -s /qemu/build/qemu-arc /qemu/build/qemu-arc64 /usr/local/bin
-
-
-apt-get install -y libgmp-dev libmpfr-dev texinfo bison yacc flex
-cd /
-git clone --depth=1 https://github.com/foss-for-synopsys-dwc-arc-processors/binutils-gdb.git
-cd /binutils-gdb
-mkdir build
-cd build
-../configure --target=arc-linux
-make -j$(nproc)
-
-
-apt-get install -y mold
-mkdir /build
-cd /build
-cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DMOLD_USE_MOLD=1 /mold
-ninja
-TRIPLE=arc-linux-gnu bash -x /mold/test/hello-dynamic.sh
@@ -1,40 +1,45 @@
 #!/bin/bash
 #
-# This script creates a mold binary distribution. The output is written in
-# `dist` directory as `mold-$version-$arch-linux.tar.gz` (e.g.,
-# `mold-1.0.3-x86_64-linux.tar.gz`).
+# This script creates a mold binary distribution. The output is written to
+# the `dist` directory as `mold-$version-$arch-linux.tar.gz` (e.g.
+# `mold-2.40.0-x86_64-linux.tar.gz`).
 #
-# The mold executable created by this script is statically linked to
-# libstdc++ but dynamically linked to libc, libm, libz, and librt, as
-# these libraries almost always exist on any Linux system. We can't
-# statically link libc because doing so would disable dlopen(), which is
-# necessary to open the LTO linker plugin.
-#
-# This script aims to produce reproducible outputs. That means if you run
-# the script twice on the same git commit, it should produce bit-by-bit
-# identical binary files. This property is crucial as a countermeasure
-# against supply chain attacks. With this, you can verify that the binary
-# files distributed on the GitHub release pages are created from the
-# commit with release tags by rebuilding the binaries yourself.
+# This script aims to produce reproducible outputs. That means each time
+# it's run on the same git commit, it generates a bit-for-bit identical
+# binary file regardless of when or where it's executed. This property
+# serves as a strong safeguard against supply chain attacks. With a
+# reproducible build, anyone can independently verify that the binary
+# files published on our GitHub release page were built from the git
+# commit tagged for release by rebuilding the binaries themselves.
 #
 # Debian provides snapshot.debian.org to host all historical binary
-# packages. We use it to construct Podman images pinned to a
-# particular timestamp.
+# packages. We use it to construct a container image pinned to a
+# particular timestamp. snapshot.debian.org is known to be very slow,
+# but that shouldn't be a big problem for us because we only need that
+# site the first time.
 #
-# We aim to use a reasonably old Debian version because we'll dynamically
-# link glibc to mold, and a binary linked against a newer version of glibc
-# won't work on a system with an older version of glibc.
+# The mold executable created by this script is statically linked to
+# libstdc++, but dynamically linked to glibc, libm and a few other
+# libraries, as these libraries are almost always available on any Linux
+# system. We can't statically link glibc because doing so would disable
+# dlopen(), which is required to load the LTO linker plugin.
 #
-# We want to build mold with Clang rather than GCC because mold's
+# We use a reasonably old Debian version for the build environment because
+# a binary dynamically linked against a newer version of glibc won't work
+# on a system with an older version of glibc.
+#
+# We prefer to build mold with Clang rather than GCC because mold's
 # Identical Code Folding works best with the LLVM address significance
-# table (.llvm_addrsig). Building a release binary with GCC yields a
-# slightly larger binary than Clang's.
+# table (.llvm_addrsig). Building a release binary with GCC produces a
+# slightly larger binary than with Clang.
 #
 # We need a recent version of Clang to build mold. If it's not available
 # via apt-get, we'll build it ourselves.
 #
-# You may need to install qemu-user-static package to build non-native
-# binaries.
+# This script can be used to create non-native binaries (e.g., building
+# aarch64 binary on x86-64) because Podman automatically runs everything
+# under QEMU if the container image is not native. To use this script for
+# non-native builds, you may need to install the qemu-user-static package.

 set -e -x
 cd "$(dirname $0)"
@@ -74,21 +79,29 @@ fi
 case $arch in
 x86_64)
  # Debian 9 (Stretch) released in June 2017.
-  # We use a Google-provided mirror (gcr.io) of the official Docker hub
-  # (docker.io) because docker.io has a strict rate limit policy.
+  #
+  # We use a Google-provided mirror (gcr.io) instead of the official Docker
+  # Hub (docker.io) because docker.io has a strict rate limit policy.
+  #
+  # The toolchain in Debian 9 is too old to build mold, so we rebuild it
+  # from source. We download source archives from official sites and build
+  # them locally, rather than downloading pre-built binaries from somewhere
+  # else, to avoid relying on unverifiable third-party binary blobs. Podman
+  # caches the result of each RUN command, so rebuilding is done only once
+  # per host.
  cat <<EOF | $image_build
 FROM mirror.gcr.io/library/debian:stretch@sha256:c5c5200ff1e9c73ffbf188b4a67eb1c91531b644856b4aefe86a58d2f0cb05be
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN sed -i -e '/^deb/d' -e 's/^# deb /deb [trusted=yes] /g' /etc/apt/sources.list && \
+RUN sed -i -e '/^deb/d' -e 's/^# deb /deb /g' /etc/apt/sources.list && \
  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
  apt-get update && \
-  apt-get install -y --no-install-recommends wget file make gcc g++ zlib1g-dev libssl-dev && \
+  apt-get install -y --no-install-recommends wget file make gcc g++ zlib1g-dev libssl-dev ca-certificates && \
  rm -rf /var/lib/apt/lists

 # Build CMake 3.27
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://cmake.org/files/v3.27/cmake-3.27.7.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://cmake.org/files/v3.27/cmake-3.27.7.tar.gz | tar xzf - --strip-components=1 && \
  ./bootstrap --parallel=\$(nproc) && \
  make -j\$(nproc) && \
  make install && \
@@ -97,11 +110,11 @@ RUN mkdir /build && \
 # Build GCC 14
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/gcc/gcc-14.2.0/gcc-14.2.0.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/gcc/gcc-14.2.0/gcc-14.2.0.tar.gz | tar xzf - --strip-components=1 && \
  mkdir gmp mpc mpfr && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.gz | tar xzf - --strip-components=1 -C gmp && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz | tar xzf - --strip-components=1 -C mpc && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.gz | tar xzf - --strip-components=1 -C mpfr && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.gz | tar xzf - --strip-components=1 -C gmp && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz | tar xzf - --strip-components=1 -C mpc && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.gz | tar xzf - --strip-components=1 -C mpfr && \
  ./configure --prefix=/usr --enable-languages=c,c++ --disable-bootstrap --disable-multilib && \
  make -j\$(nproc) && \
  make install && \
@@ -111,7 +124,7 @@ RUN mkdir /build && \
 # Build GNU binutils 2.43
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/binutils/binutils-2.43.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/binutils/binutils-2.43.tar.gz | tar xzf - --strip-components=1 && \
  ./configure --prefix=/usr && \
  make -j\$(nproc) && \
  make install && \
@@ -120,16 +133,16 @@ RUN mkdir /build && \
 # Build Python 3.12.7
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://www.python.org/ftp/python/3.12.7/Python-3.12.7.tgz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://www.python.org/ftp/python/3.12.7/Python-3.12.7.tgz | tar xzf - --strip-components=1 && \
  ./configure && \
  make -j\$(nproc) && \
  make install && \
  rm -rf /build

-# Build LLVM 19
+# Build LLVM 20
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-19.1.7.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.3.tar.gz | tar xzf - --strip-components=1 && \
  mkdir b && \
  cd b && \
  cmake -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_PROJECTS=clang ../llvm && \
@@ -141,13 +154,13 @@ EOF
 aarch64 | arm | ppc64le | s390x)
  # Debian 11 (Bullseye) released in August 2021
  #
-  # We don't want to build Clang for these targets with Qemu becuase
-  # that'd take extremely long time. Also I believe old build machines
-  # are usually x86-64.
+  # We don't want to build Clang for these targets on QEMU becuase it
+  # would take an extremely long time. Also, I believe old Linux boxes
+  # are typically x86-64.
  cat <<EOF | $image_build
 FROM mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN sed -i -e '/^deb/d' -e 's/^# deb /deb [trusted=yes] /g' /etc/apt/sources.list && \
+RUN sed -i -e '/^deb/d' -e 's/^# deb /deb /g' /etc/apt/sources.list && \
  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
  apt-get update && \
  apt-get install -y --no-install-recommends build-essential gcc-10 g++-10 clang-16 cmake && \
@@ -170,11 +183,12 @@ RUN sed -i -e '/^URIs/d' -e 's/^# http/URIs: http/' /etc/apt/sources.list.d/debi
 EOF
  ;;
 loongarch64)
-  # LoongArch build is not reproducible yet
  cat <<EOF | $image_build
-FROM mirror.gcr.io/loongarch64/debian:sid
+FROM mirror.gcr.io/loongarch64/debian:sid@sha256:0356df4e494bbb86bb469377a00789a5b42bbf67d5ff649a3f9721b745cbef77
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN apt-get update && \
+RUN sed -i -e 's!http[^ ]*!http://snapshot.debian.org/archive/debian-ports/20250620T014755Z!g' /etc/apt/sources.list && \
+  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
+  apt-get update && \
  apt-get install -y --no-install-recommends build-essential gcc-14 g++-14 clang-19 cmake && \
  ln -sf /usr/bin/clang-19 /usr/bin/clang && \
  ln -sf /usr/bin/clang++-19 /usr/bin/clang++ && \
@@ -189,20 +203,34 @@ esac
 version=$(sed -n 's/^project(mold VERSION \(.*\))/\1/p' CMakeLists.txt)
 dest=mold-$version-$arch-linux

-# Source tarballs available on GitHub don't contain .git history.
+# Source tarballs available on GitHub don't contain .git directory.
 # Clone the repo if missing.
 [ -d .git ] || git clone --branch v$version --depth 1 --bare https://github.com/rui314/mold .git

 # We use the timestamp of the last Git commit as the file timestamp
 # for build artifacts.
-timestamp="$(git log -1 --format=%ci)"
+timestamp=$(git log -1 --format=%ct)
+
+# `uname -m` in an ARM32 container running on an ARM64 host reports it
+# not as ARM32 but as ARM64. That confuses BLAKE3's cmake script and
+# erroneously enables NEON SIMD instructions. `setarch` can be used to
+# change the output of `uname -m`.
+setarch=
+[ $arch = arm ] && setarch='setarch linux32'

-# Build mold in a container.
 mkdir -p dist

+# Build mold in a container.
+#
+# SOURCE_DATE_EPOCH is a standardized environment variable that allows
+# build artifacts to appear as if they were built at a specific time.
+# We use it to control how the compiler expands the C/C++ __DATE__ and
+# __TIME__ macros.
 podman run --arch $arch -it --rm --userns=host --pids-limit=-1 --network=none \
-  -v "$(pwd):/mold:ro" -v "$(pwd)/dist:/dist" $image bash -c "
+  --pull=never -v "$(pwd):/mold:ro" -v "$(pwd)/dist:/dist" $image \
+   $setarch bash -c "
 set -e
+export SOURCE_DATE_EPOCH=$timestamp
 mkdir /build
 cd /build
 cmake -DCMAKE_BUILD_TYPE=Release -DMOLD_MOSTLY_STATIC=1 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ /mold
@@ -212,7 +240,7 @@ cmake -DMOLD_USE_MOLD=1 .
 cmake --build . -j\$(nproc)
 ctest --output-on-failure -j\$(nproc)
 cmake --install . --prefix $dest --strip
-find $dest -print | xargs touch --no-dereference --date='$timestamp'
+find $dest -print | xargs touch --no-dereference --date=@$timestamp
 find $dest -print | sort | tar -cf - --no-recursion --files-from=- | gzip -9nc > /dist/$dest.tar.gz
 cp mold /dist
 sha256sum /dist/$dest.tar.gz
@@ -0,0 +1,179 @@
+# Instrumenting mold with MemorySanitizer
+
+## Introduction
+
+Per <https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo>:
+
+> If you want MemorySanitizer to work properly and not produce any false
+> positives, you must ensure that all the code in your program and in
+> libraries it uses is instrumented (i.e. built with `-fsanitize=memory`).
+> In particular, you would need to link against an MSan-instrumented C++
+> standard library. We recommend to use [libc++](https://libcxx.llvm.org/)
+> for that purpose.
+
+## Building instrumented libc++
+
+Build an MSan-instrumented libc++ from source:
+
+```sh
+cd ~
+git clone https://github.com/llvm/llvm-project
+cd llvm-project
+cmake -S ./runtimes -B build-libcxx -G Ninja  \
+    -DCMAKE_BUILD_TYPE=Release                \
+    -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
+    -DCMAKE_C_COMPILER=clang                  \
+    -DCMAKE_CXX_COMPILER=clang++              \
+    -DLLVM_USE_SANITIZER=MemoryWithOrigins
+cmake --build build-libcxx -- cxx cxxabi
+export LIBCXX="$HOME/llvm-project/build-libcxx" # for subsequent build steps
+```
+
+Upon success, `./build-libcxx/{include,lib}` will contain the resulting
+headers and shared libraries.
+
+## Linking mold against instrumented libc++
+
+Use the `MOLD_USE_MSAN` and `MOLD_STDLIB_PREFIX` cmake variables to link
+mold against the instrumented build of libc++:
+
+```sh
+cd ~
+git clone https://github.com/rui314/mold.git
+cd mold
+cmake -B build -G Ninja            \
+    -DCMAKE_BUILD_TYPE=Debug       \
+    -DCMAKE_C_COMPILER=clang       \
+    -DCMAKE_CXX_COMPILER=clang++   \
+    -DMOLD_USE_MSAN=ON             \
+    -DMOLD_STDLIB_PREFIX="$LIBCXX" \
+    -DMOLD_USE_MIMALLOC=OFF        \
+    -DMOLD_USE_SYSTEM_TBB=ON
+cmake --build build
+```
+
+Most of mold's tests (except those for `-flto`) should work at this
+point. Run them like normal:
+
+```sh
+ctest --test-dir build
+```
+
+Any resulting MemorySanitizer errors should be visible in
+`./build/Temporary/Testing/LastTest.log`.
+
+## Building instrumented LTO plugin (experimental)
+
+Exercising `-flto` with MemorySanitizer (and without false positives)
+requires instrumenting the transitive dependencies of `lto-unix.cc`:
+
+- `libiberty.a`
+- `liblto_plugin.so`
+- `LLVMgold.so`
+
+> [!NOTE]
+> This is more involved and time-consuming than building only libc++ from
+> source. The cost-benefit ratio of this additional instrumentation and
+> test coverage may be unfavorable in many cases.
+
+> [!IMPORTANT]
+> The following steps are experimental and unlikely to work exactly as-is
+> under CI runners and individual developer environments. Consider the
+> following a starting point rather than a complete HOWTO.
+
+Build an MSan-instrumented GNU libiberty:
+
+```sh
+cd ~
+git clone [email protected]:gcc-mirror/gcc.git
+cd gcc/libiberty
+export CC=clang
+export CFLAGS="-g -Og -fsanitize=memory -fsanitize-memory-track-origins"
+export LDFLAGS="-fsanitize=memory"
+./configure
+make -j$(nproc)
+unset CC CFLAGS LDFLAGS
+```
+
+Install the resulting `./libiberty.a` into the build toolchain being
+tested with mold. If the system image is ephemeral or disposable (e.g. a
+short-lived VM or container), a quick-and-dirty install could look like:
+
+```sh
+sudo cp /usr/lib/libiberty.a{,.bak}
+sudo cp ./libiberty.a /usr/lib/
+```
+
+Build an MSan-instrumented GCC LTO plugin library:
+
+```sh
+cd ~/gcc/lto-plugin # use already-cloned repo from earlier step
+export CC=clang
+export CFLAGS="-g -Og -fsanitize=memory -fsanitize-memory-track-origins"
+export LDFLAGS="-fsanitize=memory"
+./configure --with-libiberty=/usr/lib
+make -j$(nproc)
+unset CC CFLAGS LDFLAGS
+```
+
+Install the resulting `liblto_plugin.so`. With the same caveats discussed
+above, a simple install into an ephemeral environment could look like:
+
+```sh
+export GCC_VERSION="$(gcc -dumpversion)"
+sudo cp /usr/lib/gcc/x86_64-pc-linux-gnu/$GCC_VERSION/liblto_plugin.so{,.bak}
+sudo cp .libs/liblto_plugin.so /usr/lib/gcc/x86_64-pc-linux-gnu/$GCC_VERSION/
+```
+
+Build an MSan-instrumented LLVM LTO plugin library:
+
+```sh
+cd ~/llvm-project # use already-cloned repo from earlier step
+
+CF="-nostdinc++ -isystem $LIBCXX/include/c++/v1"
+INCDIR="$(find /usr -name plugin-api.h -type f | head -1 | xargs dirname)"
+
+function configure
+{
+    cmake -S ./llvm -B build-plugin -G Ninja   \
+        -DLLVM_ENABLE_PROJECTS=clang           \
+        -DLLVM_TARGETS_TO_BUILD=X86            \
+        -DCMAKE_BUILD_TYPE=Release             \
+        -DCMAKE_C_COMPILER=clang               \
+        -DCMAKE_CXX_COMPILER=clang++           \
+        -DCMAKE_C_FLAGS="$CF"                  \
+        -DCMAKE_CXX_FLAGS="$CF"                \
+        -DCMAKE_EXE_LINKER_FLAGS="$1"          \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON   \
+        -DLLVM_BINUTILS_INCDIR="$INCDIR"       \
+        -DLLVM_USE_SANITIZER=MemoryWithOrigins
+}
+
+# workaround for linker issues: configure twice with different LDFLAGS
+configure "-nostdlib++ -L $LIBCXX/lib -Wl,--rpath=$LIBCXX/lib"
+configure "-nostdlib++ -L $LIBCXX/lib -lc++ -Wl,--rpath=$LIBCXX/lib"
+
+cmake --build build-plugin -- LLVMgold.so
+```
+
+Install the resulting `LLVMgold.so`. With the same caveats discussed
+above, a simple install into an ephemeral environment could look like:
+
+```sh
+sudo cp /usr/lib/LLVMgold.so{,.bak}
+sudo cp ./build-plugin/lib/LLVMgold.so /usr/lib/
+```
+
+mold's tests for `-flto` should now (mostly) work, though there do seem
+to be issues around `gcc` inferring `-flto` when not explicitly specified.
+One workaround is to use `clang` as `TEST_CC`:
+
+```sh
+cd ~/mold # use already-cloned and built repo from earlier step
+TEST_CC=clang TEST_CXX=clang++ ctest --test-dir build
+```
+
+## References
+
+- <https://github.com/google/sanitizers/wiki/MemorySanitizerBootstrappingClang>
+- <https://llvm.org/docs/GoldPlugin.html#lto-how-to-build>
@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.9.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.9.1
-.TH "MOLD" "1" "February 2025" ""
+.TH "MOLD" "1" "May 2026" ""
 .SH "NAME"
 \fBmold\fR \- a modern linker
 .SH "SYNOPSIS"
@@ -70,6 +70,8 @@ Permit or do not permit mold to create a debug info file in the background\.
 .TP
 \fB\-\-fork\fR, \fB\-\-no\-fork\fR
 Spawn a child process and let it do the actual linking\. When linking a large program, the OS kernel can take a few hundred milliseconds to terminate a \fBmold\fR process\. \fB\-\-fork\fR hides that latency\. By default, it does fork\.
+.IP
+Note that \fB\-\-fork\fR also hides the resource usage statistics reported by time(2), since it doesn't call waitpid(2) on the child process\. If you need those statistics, pass \fB\-\-no\-fork\fR\.
 .TP
 \fB\-\-perf\fR
 Print performance statistics\.
@@ -130,6 +132,17 @@ Use multiple threads\. By default, \fBmold\fR uses as many threads as the number
 \fB\-\-quick\-exit\fR, \fB\-\-no\-quick\-exit\fR
 Use or do not use \fBquick_exit\fR to exit\.
 .TP
+\fB\-\-zero\-to\-bss\fR
+Convert all\-zero data sections into BSS\.
+.IP
+When this option is enabled, \fBmold\fR scans input data sections that are not of type \fBSHT_NOBITS\fR and checks whether their contents consist solely of zero bytes\. Such sections are then converted into BSS (\fBSHT_NOBITS\fR) sections\. This reduces the size of the output file, since BSS sections occupy no space in the file image\.
+.IP
+This behavior is especially useful for user\-defined sections created with \fB__attribute__((section("\.sectname")))\fR that contain uninitialized global variables\. GCC and Clang do not automatically mark such sections as BSS even if their contents are entirely zero, and instead emit them as regular data sections\.
+.IP
+For example, consider \fB__attribute__((section("\.sectname"))) int vec[256];\fR\.
+.IP
+By default, this results in a \fB\.sectname\fR section of type \fBSHT_PROGBITS\fR filled with zeros\. With \fB\-\-zero\-to\-bss\fR, the linker will recognize it as empty data and convert it to a \fBSHT_NOBITS\fR section, reducing the output file size without changing runtime semantics\.
+.TP
 \fB\-z rewrite\-endbr\fR, \fB\-z norewrite\-endbr\fR
 As a security measure, some CPU instruction sets have recently gained a feature to protect control flow integrity by disallowing indirect branches by default\. If the feature is enabled, the instruction that is executed immediately after an indirect branch must be an branch target marker instruction, or a CPU\-level fault will raise\. The marker instruction is also known as "landing pad" instruction, to which indirect branches can land\. This feature makes ROP attacks harder to conduct\.
 .IP
@@ -269,8 +282,8 @@ Synonym for \fB\-\-build\-id=sha256\fR\.
 \fB\-\-no\-build\-id\fR
 Synonym for \fB\-\-build\-id=none\fR\.
 .TP
-\fB\-\-compress\-debug\-sections\fR=[ \fBzlib\fR | \fBzlib\-gabi\fR | \fBzstd\fR | \fBnone\fR ]
-Compress DWARF debug info (\fB\.debug_*\fR sections) using the zlib or zstd compression algorithm\. \fBzlib\-gabi\fR is an alias for \fBzlib\fR\.
+\fB\-\-compress\-debug\-sections\fR=[ \fBzlib\fR | \fBzlib\-gabi\fR | \fBzlib:\fR\fIN\fR | \fBzstd\fR | \fBzstd:\fR\fIN\fR | \fBnone\fR ]
+Compress DWARF debug info (\fB\.debug_*\fR sections) using the zlib or zstd compression algorithm\. \fBzlib\-gabi\fR is an alias for \fBzlib\fR\. \fBzlib:\fR\fIN\fR selects the zlib compression level, where \fIN\fR is between 0 and 9 (0 means no compression), and \fBzstd:\fR\fIN\fR selects the zstd compression level, where \fIN\fR is between 1 and 22\. Higher levels achieve better compression ratios but are slower\. \fBzlib\fR is equivalent to \fBzlib:1\fR and \fBzstd\fR is equivalent to \fBzstd:3\fR\.
 .TP
 \fB\-\-defsym\fR=\fIsymbol\fR=\fIvalue\fR
 Define \fIsymbol\fR as an alias for \fIvalue\fR\.
@@ -358,10 +371,16 @@ Embed a specified string into the \fB\.note\.package\fR section\. This option is
 .IP
 An argument to this option is treated as percent\-encoded and decoded before being inserted into the section, allowing you to avoid the use of the comma (\fB,\fR) character in the argument\. This is useful because the compiler replaces all occurrences of commas in \fB\-Wl,\fR with spaces before forwarding them to the linker\. Note that \fBmold\fR always interprets the argument as percent\-encoded, so you also need to escape all occurrences of \fB%\fR as \fB%25\fR\.
 .TP
-\fB\-\-pack\-dyn\-relocs\fR=[ \fBrelr\fR | \fBnone\fR ]
+\fB\-\-pack\-dyn\-relocs\fR=[ \fBrelr\fR | \fBandroid\fR | \fBandroid+relr\fR | \fBnone\fR ]
+Compress dynamic relocations in the output file\.
+.IP
 If \fBrelr\fR is specified, all \fBR_*_RELATIVE\fR relocations are put into \fB\.relr\.dyn\fR section instead of \fB\.rel\.dyn\fR or \fB\.rela\.dyn\fR section\. Since \fB\.relr\.dyn\fR section uses a space\-efficient encoding scheme, specifying this flag can reduce the size of the output\. This is typically most effective for position\-independent executable\.
 .IP
-Note that a runtime loader has to support \fB\.relr\.dyn\fR to run executables or shared libraries linked with \fB\-\-pack\-dyn\-relocs=relr\fR\. As of 2022, only ChromeOS, Android and Fuchsia support it\.
+If \fBandroid\fR is specified, all dynamic relocations are encoded in Android's packed relocation format (APS2) and stored in the \fB\.rel\.dyn\fR or \fB\.rela\.dyn\fR section, whose section type is changed to \fBSHT_ANDROID_REL\fR or \fBSHT_ANDROID_RELA\fR\. The dynamic table is updated to use \fBDT_ANDROID_REL\fR / \fBDT_ANDROID_RELA\fR and their \fBSZ\fR variants in place of the standard tags\.
+.IP
+\fBandroid+relr\fR combines both: \fBR_*_RELATIVE\fR relocations go to \fB\.relr\.dyn\fR and the rest are APS2\-encoded\. This is the configuration used by most Android system binaries\.
+.IP
+Note that a runtime loader has to support \fB\.relr\.dyn\fR to run executables or shared libraries linked with \fB\-\-pack\-dyn\-relocs=relr\fR\. As of 2026, glibc (since 2\.36), musl (since 1\.2\.4), Android, ChromeOS, and Fuchsia all support it\. The APS2 format, on the other hand, is only handled by Android's bionic loader; the encoder itself is target\-agnostic, but the produced binary can only be loaded on platforms where bionic (or a compatible loader) handles \fBDT_ANDROID_REL(A)\fR\.
 .TP
 \fB\-\-pie\fR, \fB\-\-pic\-executable\fR, \fB\-\-no\-pie\fR, \fB\-\-no\-pic\-executable\fR
 Create a position\-independent executable\.
@@ -427,6 +446,9 @@ How to handle undefined symbols\.
 \fB\-\-version\-script\fR=\fIfile\fR
 Read version script from \fIfile\fR\. If \fIfile\fR does not exist in the current directory, it is searched from library search paths for the sake of compatibility with GNU ld\.
 .TP
+\fB\-w\fR, \fB\-\-no\-warnings\fR
+Suppress warnings and cancel \fB\-\-fatal\-warnings\fR\.
+.TP
 \fB\-\-warn\-common\fR, \fB\-\-no\-warn\-common\fR
 Warn about common symbols\.
 .TP
@@ -483,9 +505,9 @@ By default, \fBmold\fR generates a relro segment\. \fB\-z norelro\fR disables th
 \fB\-z separate\-loadable\-segments\fR, \fB\-z separate\-code\fR, \fB\-z noseparate\-code\fR
 If one memory page contains multiple segments, the page protection bits are set in such a way that the needed attributes (writable or executable) are satisfied for all segments\. This usually happens at a boundary of two segments with two different attributes\.
 .IP
-\fBseparate\-loadable\-segments\fR adds paddings between segments with different attributes so that they do not share the same page\. This is the default\.
+\fBseparate\-loadable\-segments\fR adds paddings between segments with different attributes so that they do not share the same page\.
 .IP
-\fBseparate\-code\fR adds paddings only between executable and non\-executable segments\.
+\fBseparate\-code\fR adds paddings only between executable and non\-executable segments\. This is the default\.
 .IP
 \fBnoseparate\-code\fR does not add any paddings between segments\.
 .TP
@@ -159,6 +159,10 @@ but as `-o magic`.
  program, the OS kernel can take a few hundred milliseconds to terminate a
  `mold` process. `--fork` hides that latency. By default, it does fork.

+  Note that `--fork` also hides the resource usage statistics reported by
+  time(2), since it doesn't call waitpid(2) on the child process. If you
+  need those statistics, pass `--no-fork`.
+
 * `--perf`:
  Print performance statistics.

@@ -267,6 +271,28 @@ but as `-o magic`.
 * `--quick-exit`, `--no-quick-exit`:
  Use or do not use `quick_exit` to exit.

+* `--zero-to-bss`:
+  Convert all-zero data sections into BSS.
+
+  When this option is enabled, `mold` scans input data sections that are not
+  of type `SHT_NOBITS` and checks whether their contents consist solely of
+  zero bytes. Such sections are then converted into BSS (`SHT_NOBITS`)
+  sections. This reduces the size of the output file, since BSS sections
+  occupy no space in the file image.
+
+  This behavior is especially useful for user-defined sections created with
+  `__attribute__((section(".sectname")))` that contain uninitialized global
+  variables. GCC and Clang do not automatically mark such sections as BSS
+  even if their contents are entirely zero, and instead emit them as regular
+  data sections.
+
+  For example, consider `__attribute__((section(".sectname"))) int vec[256];`.
+
+  By default, this results in a `.sectname` section of type `SHT_PROGBITS`
+  filled with zeros. With `--zero-to-bss`, the linker will recognize it as
+  empty data and convert it to a `SHT_NOBITS` section, reducing the output
+  file size without changing runtime semantics.
+
 * `-z rewrite-endbr`, `-z norewrite-endbr`:
  As a security measure, some CPU instruction sets have recently gained a
  feature to protect control flow integrity by disallowing indirect branches
@@ -480,9 +506,14 @@ but as `-o magic`.
 * `--no-build-id`:
  Synonym for `--build-id=none`.

-* `--compress-debug-sections`=[ `zlib` | `zlib-gabi` | `zstd` | `none` ]:
+* `--compress-debug-sections`=[ `zlib` | `zlib-gabi` | `zlib:`_N_ | `zstd` | `zstd:`_N_ | `none` ]:
  Compress DWARF debug info (`.debug_*` sections) using the zlib or zstd
-  compression algorithm. `zlib-gabi` is an alias for `zlib`.
+  compression algorithm. `zlib-gabi` is an alias for `zlib`. `zlib:`_N_
+  selects the zlib compression level, where _N_ is between 0 and 9 (0
+  means no compression), and `zstd:`_N_ selects the zstd compression
+  level, where _N_ is between 1 and 22. Higher levels achieve better
+  compression ratios but are slower. `zlib` is equivalent to `zlib:1`
+  and `zstd` is equivalent to `zstd:3`.

 * `--defsym`=_symbol_=_value_:
  Define _symbol_ as an alias for _value_.
@@ -632,16 +663,32 @@ but as `-o magic`.
  argument as percent-encoded, so you also need to escape all occurrences
  of `%` as `%25`.

-* `--pack-dyn-relocs`=[ `relr` | `none` ]:
+* `--pack-dyn-relocs`=[ `relr` | `android` | `android+relr` | `none` ]:
+  Compress dynamic relocations in the output file.
+
  If `relr` is specified, all `R_*_RELATIVE` relocations are put into
  `.relr.dyn` section instead of `.rel.dyn` or `.rela.dyn` section. Since
  `.relr.dyn` section uses a space-efficient encoding scheme, specifying this
  flag can reduce the size of the output. This is typically most effective for
  position-independent executable.

+  If `android` is specified, all dynamic relocations are encoded in Android's
+  packed relocation format (APS2) and stored in the `.rel.dyn` or `.rela.dyn`
+  section, whose section type is changed to `SHT_ANDROID_REL` or
+  `SHT_ANDROID_RELA`. The dynamic table is updated to use `DT_ANDROID_REL`
+  / `DT_ANDROID_RELA` and their `SZ` variants in place of the standard tags.
+
+  `android+relr` combines both: `R_*_RELATIVE` relocations go to `.relr.dyn`
+  and the rest are APS2-encoded. This is the configuration used by most
+  Android system binaries.
+
  Note that a runtime loader has to support `.relr.dyn` to run executables or
-  shared libraries linked with `--pack-dyn-relocs=relr`. As of 2022, only
-  ChromeOS, Android and Fuchsia support it.
+  shared libraries linked with `--pack-dyn-relocs=relr`. As of 2026, glibc
+  (since 2.36), musl (since 1.2.4), Android, ChromeOS, and Fuchsia all
+  support it. The APS2 format, on the other hand, is only handled by
+  Android's bionic loader; the encoder itself is target-agnostic, but the
+  produced binary can only be loaded on platforms where bionic (or a
+  compatible loader) handles `DT_ANDROID_REL(A)`.

 * `--pie`, `--pic-executable`, `--no-pie`, `--no-pic-executable`:
  Create a position-independent executable.
@@ -731,6 +778,9 @@ but as `-o magic`.
  directory, it is searched from library search paths for the sake of
  compatibility with GNU ld.

+* `-w`, `--no-warnings`:
+  Suppress warnings and cancel `--fatal-warnings`.
+
 * `--warn-common`, `--no-warn-common`:
  Warn about common symbols.

@@ -828,10 +878,10 @@ but as `-o magic`.
  segments with two different attributes.

  `separate-loadable-segments` adds paddings between segments with different
-  attributes so that they do not share the same page. This is the default.
+  attributes so that they do not share the same page.

  `separate-code` adds paddings only between executable and non-executable
-  segments.
+  segments. This is the default.

  `noseparate-code` does not add any paddings between segments.

@@ -8,24 +8,24 @@ set -e
 set -x

 case "$ID" in
-ubuntu | pop | linuxmint | debian | raspbian | neon)
+ubuntu | pop | linuxmint | debian | raspbian | neon | zorin)
  apt-get update
  apt-get install -y cmake gcc g++ clang gdb
  ;;
-fedora | amzn | rhel | centos)
-  dnf install -y gcc-g++ cmake glibc-static libstdc++-static diffutils util-linux tar
+fedora | fedora-* | amzn | rhel | centos)
+  dnf install -y gcc-c++ cmake glibc-static libstdc++-static diffutils util-linux tar
  ;;
-rocky)
-  dnf install -y gcc-g++ cmake diffutils util-linux
+rocky | ol)
+  dnf install -y gcc-c++ cmake diffutils util-linux
  ;;
 opensuse-*)
-  zypper install -y make cmake gcc-c++ glibc-devel-static tar diffutils util-linux
+  zypper install -y make cmake gcc-c++ glibc-devel-static tar diffutils util-linux gawk
  ;;
 gentoo)
  emerge-webrsync
  FEATURES='getbinpkg binpkg-request-signature' emerge dev-build/cmake
  ;;
-arch | archarm | artix | endeavouros)
+arch | archarm | artix | endeavouros | manjaro | cachyos)
  pacman -Sy --needed --noconfirm base-devel cmake util-linux
  ;;
 void)
@@ -42,6 +42,10 @@ clear-linux-os)
 almalinux)
  dnf install -y gcc-toolset-13-gcc-c++ gcc-toolset-13-libstdc++-devel cmake diffutils
  ;;
+altlinux)
+  apt-get update
+  apt-get install -y gcc-c++ make cmake ctest diffutils util-linux
+  ;;
 freebsd)
  pkg update
  pkg install -y cmake bash binutils gcc
@@ -11,7 +11,7 @@ set -x

 case "$ID" in
 ubuntu | pop | linuxmint | debian | raspbian)
-  apt-get install -y qemu-user {gcc,g++}-{i686,aarch64,riscv64,powerpc,powerpc64,powerpc64le,s390x,sparc64,m68k,sh4,arc}-linux-gnu {gcc,g++}-arm-linux-gnueabihf
+  apt-get install -y qemu-user {gcc,g++}-{i686,aarch64,riscv64,powerpc,powerpc64,powerpc64le,s390x,sparc64,m68k,sh4}-linux-gnu {gcc,g++}-arm-linux-gnueabihf
  ;;
 *)
  echo "Error: don't know anything about build dependencies on $ID-$VERSION_ID"
@@ -0,0 +1,132 @@
+// This file implements the Aho-Corasick algorithm to search multiple
+// strings within an input string simultaneously. It is essentially a
+// trie with additional links. For details, see
+// https://en.wikipedia.org/wiki/Aho-Corasick_algorithm.
+//
+// We use it for simple glob patterns in version scripts or dynamic
+// list files. Here are some examples of glob patterns:
+//
+//    qt_private_api_tag*
+//    *16QAccessibleCache*
+//    *32QAbstractFileIconProviderPrivate*
+//    *17QPixmapIconEngine*
+//
+// Aho-Corasick can do only substring search, so it cannot handle
+// complex glob patterns such as `*foo*bar*`. We handle such patterns
+// with the Glob class.
+
+#include "lib.h"
+
+#include <queue>
+
+namespace mold {
+
+bool AhoCorasick::can_handle(std::string_view pat) {
+  if (pat.starts_with('*'))
+    pat.remove_prefix(1);
+  if (pat.ends_with('*'))
+    pat.remove_suffix(1);
+  return pat.find_first_of("*?[") == pat.npos;
+}
+
+i64 AhoCorasick::find(std::string_view str) {
+  if (nodes.empty())
+    return -1;
+
+  i64 idx = 0;
+  i64 val = -1;
+
+  auto walk = [&](u8 c) {
+    for (i64 j = idx; j != -1; j = nodes[j].suffix_link) {
+      i64 child = nodes[j].children[c];
+      if (child != -1) {
+        idx = child;
+        val = std::max(val, nodes[child].value);
+        return;
+      }
+    }
+    idx = 0;
+  };
+
+  walk('\0');
+  for (u8 c : str)
+    walk(c);
+  walk('\0');
+  return val;
+}
+
+bool AhoCorasick::add(std::string_view pat, i64 val) {
+  assert(can_handle(pat));
+  if (nodes.empty())
+    nodes.resize(1);
+  i64 idx = 0;
+
+  auto walk = [&](u8 c) {
+    if (nodes[idx].children[c] == -1) {
+      nodes[idx].children[c] = nodes.size();
+      nodes.resize(nodes.size() + 1);
+    }
+    idx = nodes[idx].children[c];
+  };
+
+  // We handle "foo" as if "\0foo\0", "*foo" as if "foo\0", "foo*" as
+  // if "\0foo", and "*foo*" as if "foo". Aho-Corasick can do only
+  // substring matching, so we use \0 as a beginning/end-of-string
+  // markers.
+  if (!pat.starts_with('*'))
+    walk('\0');
+  for (u8 c : pat)
+    if (c != '*')
+      walk(c);
+  if (!pat.ends_with('*'))
+    walk('\0');
+
+  nodes[idx].value = std::max(nodes[idx].value, val);
+  return true;
+}
+
+void AhoCorasick::compile() {
+  if (nodes.empty())
+    return;
+  fix_suffix_links(0);
+  fix_values();
+}
+
+void AhoCorasick::fix_suffix_links(i64 idx) {
+  for (i64 i = 0; i < 256; i++) {
+    i64 child = nodes[idx].children[i];
+    if (child == -1)
+      continue;
+
+    i64 j = nodes[idx].suffix_link;
+    for (; j != -1; j = nodes[j].suffix_link) {
+      if (nodes[j].children[i] != -1) {
+        nodes[child].suffix_link = j;
+        break;
+      }
+    }
+    if (j == -1)
+      nodes[child].suffix_link = 0;
+    fix_suffix_links(child);
+  }
+}
+
+void AhoCorasick::fix_values() {
+  std::queue<i64> queue;
+  queue.push(0);
+
+  do {
+    i64 idx = queue.front();
+    queue.pop();
+
+    for (i64 child : nodes[idx].children) {
+      if (child != -1) {
+        i64 suffix = nodes[child].suffix_link;
+        nodes[child].value = std::max(nodes[child].value, nodes[suffix].value);
+        queue.push(child);
+      }
+    }
+  } while (!queue.empty());
+}
+
+} // namespace mold
@@ -0,0 +1,50 @@
+// This is the same as std::atomic except that the default memory
+// order is relaxed instead of sequential consistency.
+
+#pragma once
+
+#include <atomic>
+
+namespace mold {
+
+template <typename T>
+struct Atomic : std::atomic<T> {
+  static constexpr std::memory_order relaxed = std::memory_order_relaxed;
+
+  using std::atomic<T>::atomic;
+
+  Atomic(const Atomic<T> &other) : std::atomic<T>(other.load()) {}
+
+  Atomic<T> &operator=(const Atomic<T> &other) {
+    store(other.load());
+    return *this;
+  }
+
+  void operator=(T val) { store(val); }
+  operator T() const { return load(); }
+
+  void store(T val, std::memory_order order = relaxed) {
+    std::atomic<T>::store(val, order);
+  }
+
+  T load(std::memory_order order = relaxed) const {
+    return std::atomic<T>::load(order);
+  }
+
+  T exchange(T val) { return std::atomic<T>::exchange(val, relaxed); }
+  T operator|=(T val) { return std::atomic<T>::fetch_or(val, relaxed); }
+  T operator++() { return std::atomic<T>::fetch_add(1, relaxed) + 1; }
+  T operator--() { return std::atomic<T>::fetch_sub(1, relaxed) - 1; }
+  T operator++(int) { return std::atomic<T>::fetch_add(1, relaxed); }
+  T operator--(int) { return std::atomic<T>::fetch_sub(1, relaxed); }
+
+  bool test_and_set() {
+    // A relaxed load + branch (assuming miss) takes only around 20 cycles,
+    // while an atomic RMW can easily take hundreds on x86. We note that it's
+    // common that another thread beat us in marking, so doing an optimistic
+    // early test tends to improve performance in the ~20% ballpark.
+    return load() || exchange(true);
+  }
+};
+
+} // namespace mold
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "integers.h"
+
+#include <cassert>
+#include <vector>
+
+namespace mold {
+
+class BitvectorProxy {
+public:
+  BitvectorProxy(u64 &word, size_t pos)
+    : word(word), mask(1ULL << pos) {}
+
+  BitvectorProxy &operator=(bool val) {
+    if (val)
+      word |= mask;
+    else
+      word &= ~mask;
+    return *this;
+  }
+
+  BitvectorProxy &operator=(const BitvectorProxy &other) {
+    return *this = (bool)other;
+  }
+
+  operator bool() const {
+    return word & mask;
+  }
+
+private:
+  u64 &word;
+  u64 mask;
+};
+
+class Bitvector {
+public:
+  Bitvector() = default;
+  Bitvector(i64 n) : size(n), words((n + 63) / 64) {}
+
+  void resize(i64 n) {
+    words.clear();
+    words.resize((n + 63) / 64);
+    size = n;
+  }
+
+  Bitvector &operator|=(const Bitvector &x) {
+    assert(size == x.size);
+    for (i64 i = 0; i < words.size(); i++)
+      words[i] |= x.words[i];
+    return *this;
+  }
+
+  Bitvector &operator&=(const Bitvector &x) {
+    assert(size == x.size);
+    for (i64 i = 0; i < words.size(); i++)
+      words[i] &= x.words[i];
+    return *this;
+  }
+
+  Bitvector &operator<<=(size_t n) {
+    assert(n == 1);
+    for (i64 i = words.size() - 1; i > 0; i--)
+      words[i] = (words[i] << 1) | (words[i - 1] >> 63);
+    words[0] <<= 1;
+    return *this;
+  }
+
+  BitvectorProxy operator[](size_t pos) {
+    assert(pos < size);
+    return {words[pos / 64], pos % 64};
+  }
+
+  i64 size = 0;
+  std::vector<u64> words;
+};
+
+} // namespace mold
@@ -14,7 +14,7 @@
 // a little bit. However, if a shard size is large enough, that loss
 // is negligible in practice.

-#include "common.h"
+#include "lib.h"

 #include <tbb/parallel_for_each.h>
 #include <zlib.h>
@@ -30,42 +30,41 @@ namespace mold {

 static constexpr i64 SHARD_SIZE = 1024 * 1024;

-static std::vector<std::string_view> split(std::string_view input) {
-  std::vector<std::string_view> shards;
-
-  while (input.size() >= SHARD_SIZE) {
-    shards.push_back(input.substr(0, SHARD_SIZE));
-    input = input.substr(SHARD_SIZE);
-  }
-  if (!input.empty())
-    shards.push_back(input);
-  return shards;
+Compressor::~Compressor() {
+  for (std::span<u8> shard : shards)
+    delete[] shard.data();
 }

-static std::vector<u8> zlib_compress(std::string_view input) {
-  // Initialize zlib stream. Since debug info is generally compressed
-  // pretty well with lower compression levels, we chose compression
-  // level 1.
-  z_stream strm;
-  strm.zalloc = Z_NULL;
-  strm.zfree = Z_NULL;
-  strm.opaque = Z_NULL;
+static std::vector<std::span<u8>> split(std::span<u8> input) {
+  std::vector<std::span<u8>> vec;
+  while (!input.empty()) {
+    i64 sz = std::min<i64>(SHARD_SIZE, input.size());
+    vec.push_back(input.subspan(0, sz));
+    input = input.subspan(sz);
+  }
+  return vec;
+}

-  CHECK(deflateInit2(&strm, 1, Z_DEFLATED, -15, 8, Z_DEFAULT_STRATEGY));
+static std::span<u8> zlib_compress(std::span<u8> input, int level) {
+  // Initialize zlib stream. Since debug info is generally compressed
+  // pretty well with lower compression levels, the default level is 1.
+  z_stream strm = {};
+  CHECK(deflateInit2(&strm, level, Z_DEFLATED, -15, 8, Z_DEFAULT_STRATEGY));

  // Set an input buffer
  strm.avail_in = input.size();
-  strm.next_in = (u8 *)input.data();
+  strm.next_in = input.data();

  // Set an output buffer. deflateBound() returns an upper bound
  // on the compression size. +16 for Z_SYNC_FLUSH.
-  std::vector<u8> buf(deflateBound(&strm, strm.avail_in) + 16);
+  i64 bufsize = deflateBound(&strm, strm.avail_in) + 16;
+  u8 *buf = new u8[bufsize];

  // Compress data. It writes all compressed bytes except the last
  // partial byte, so up to 7 bits can be held to be written to the
  // buffer.
-  strm.avail_out = buf.size();
-  strm.next_out = buf.data();
+  strm.avail_out = bufsize;
+  strm.next_out = buf;
  CHECK(deflate(&strm, Z_BLOCK));

  // This is a workaround for libbacktrace before 2022-04-06.
@@ -84,29 +83,26 @@ static std::vector<u8> zlib_compress(std::string_view input) {
  // that the bit position is 7 in the next byte.
  //
  // https://github.com/ianlancetaylor/libbacktrace/pull/87
-  int nbits;
+  int nbits = 0;
  deflatePending(&strm, Z_NULL, &nbits);
  if (nbits == 5)
    CHECK(deflatePrime(&strm, 10, 2));
  CHECK(deflate(&strm, Z_SYNC_FLUSH));

-  assert(strm.avail_out > 0);
-  buf.resize(buf.size() - strm.avail_out);
-  buf.shrink_to_fit();
  deflateEnd(&strm);
-  return buf;
+  return {buf, (size_t)(bufsize - strm.avail_out)};
 }

-ZlibCompressor::ZlibCompressor(u8 *buf, i64 size) {
-  std::string_view input{(char *)buf, (size_t)size};
-  std::vector<std::string_view> inputs = split(input);
-  std::vector<u64> adlers(inputs.size());
+ZlibCompressor::ZlibCompressor(u8 *buf, i64 size, i64 level) {
+  std::vector<std::span<u8>> inputs = split(std::span(buf, size));
+  std::vector<u32> adlers(inputs.size());
  shards.resize(inputs.size());

  // Compress each shard
  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
-    adlers[i] = adler32(1, (u8 *)inputs[i].data(), inputs[i].size());
-    shards[i] = zlib_compress(inputs[i]);
+    std::span<u8> in = inputs[i];
+    adlers[i] = adler32(1, in.data(), in.size());
+    shards[i] = zlib_compress(in, level);
  });

  // Combine checksums
@@ -116,7 +112,7 @@ ZlibCompressor::ZlibCompressor(u8 *buf, i64 size) {

  // Comput the total size
  compressed_size = 8; // the header and the trailer
-  for (std::vector<u8> &shard : shards)
+  for (std::span<u8> &shard : shards)
    compressed_size += shard.size();
 }

@@ -127,7 +123,7 @@ void ZlibCompressor::write_to(u8 *buf) {

  // Copy compressed data
  std::vector<i64> offsets(shards.size());
-  offsets[0] = 2; // +2 for header
+  offsets[0] = 2; // +2 for the header
  for (i64 i = 1; i < shards.size(); i++)
    offsets[i] = offsets[i - 1] + shards[i - 1].size();

@@ -139,35 +135,28 @@ void ZlibCompressor::write_to(u8 *buf) {
  u8 *end = buf + compressed_size;
  end[-6] = 3;
  end[-5] = 0;
-
-  // Write a checksum
  *(ub32 *)(end - 4) = checksum;
 }

-static std::vector<u8> zstd_compress(std::string_view input) {
-  std::vector<u8> buf(ZSTD_COMPRESSBOUND(input.size()));
-  constexpr int LEVEL = 3; // compression level; must be between 1 to 22
-
-  size_t sz = ZSTD_compress(buf.data(), buf.size(), input.data(), input.size(),
-                            LEVEL);
+static std::span<u8> zstd_compress(std::span<u8> input, int level) {
+  i64 bufsize = ZSTD_COMPRESSBOUND(input.size());
+  u8 *buf = new u8[bufsize];
+  size_t sz = ZSTD_compress(buf, bufsize, input.data(), input.size(), level);
  assert(!ZSTD_isError(sz));
-  buf.resize(sz);
-  buf.shrink_to_fit();
-  return buf;
+  return {buf, sz};
 }

-ZstdCompressor::ZstdCompressor(u8 *buf, i64 size) {
-  std::string_view input{(char *)buf, (size_t)size};
-  std::vector<std::string_view> inputs = split(input);
+ZstdCompressor::ZstdCompressor(u8 *buf, i64 size, i64 level) {
+  std::vector<std::span<u8>> inputs = split(std::span(buf, size));
  shards.resize(inputs.size());

  // Compress each shard
  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
-    shards[i] = zstd_compress(inputs[i]);
+    shards[i] = zstd_compress(inputs[i], level);
  });

  compressed_size = 0;
-  for (std::vector<u8> &shard : shards)
+  for (std::span<u8> &shard : shards)
    compressed_size += shard.size();
 }

@@ -1,7 +1,29 @@
 #define MOLD_VERSION "@mold_VERSION@"
 #define MOLD_LIBDIR "@CMAKE_INSTALL_FULL_LIBDIR@"
+#define MOLD_FIRST_TARGET @MOLD_FIRST_TARGET@

-#cmakedefine HAVE_MADVISE 1
-#cmakedefine HAVE_UNAME 1
-#cmakedefine MOLD_USE_MIMALLOC 1
-#cmakedefine MOLD_USE_SYSTEM_MIMALLOC 1
+#cmakedefine01 HAVE_MADVISE
+#cmakedefine01 HAVE_UNAME
+#cmakedefine01 MOLD_USE_MIMALLOC
+#cmakedefine01 MOLD_USE_SYSTEM_MIMALLOC
+
+#cmakedefine01 HAVE_TARGET_X86_64
+#cmakedefine01 HAVE_TARGET_I386
+#cmakedefine01 HAVE_TARGET_ARM64LE
+#cmakedefine01 HAVE_TARGET_ARM64BE
+#cmakedefine01 HAVE_TARGET_ARM32LE
+#cmakedefine01 HAVE_TARGET_ARM32BE
+#cmakedefine01 HAVE_TARGET_RV32LE
+#cmakedefine01 HAVE_TARGET_RV32BE
+#cmakedefine01 HAVE_TARGET_RV64LE
+#cmakedefine01 HAVE_TARGET_RV64BE
+#cmakedefine01 HAVE_TARGET_PPC32
+#cmakedefine01 HAVE_TARGET_PPC64V1
+#cmakedefine01 HAVE_TARGET_PPC64V2
+#cmakedefine01 HAVE_TARGET_S390X
+#cmakedefine01 HAVE_TARGET_SPARC64
+#cmakedefine01 HAVE_TARGET_M68K
+#cmakedefine01 HAVE_TARGET_SH4LE
+#cmakedefine01 HAVE_TARGET_SH4BE
+#cmakedefine01 HAVE_TARGET_LOONGARCH64
+#cmakedefine01 HAVE_TARGET_LOONGARCH32
@@ -1,4 +1,4 @@
-#include "common.h"
+#include "lib.h"

 #include <tbb/parallel_for_each.h>
 #include <zlib.h>
@@ -1,4 +1,4 @@
-#include "common.h"
+#include "lib.h"

 #include <cstdlib>

@@ -1,4 +1,4 @@
-#include "common.h"
+#include "lib.h"

 #include <filesystem>
 #include <sys/stat.h>
@@ -54,14 +54,14 @@ dir=gentoo/$git_hash

 mkdir -p "$dir"/success "$dir"/failure

-$podman nice -n 19 bash -c "$cmd1 && $cmd2 && $cmd3" >& "$dir"/"$filename".mold
+$podman chrt --idle 0 nice -n 19 bash -c "$cmd1 && $cmd2 && $cmd3" >& "$dir"/"$filename".mold
 if [ $? = 0 ]; then
  mv "$dir"/"$filename".mold "$dir"/success
 else
  mv "$dir"/"$filename".mold "$dir"/failure
 fi

-$podman nice -n 19 bash -c "$cmd2 && $cmd3" >& "$dir"/"$filename".ld
+$podman chrt --idle 0 nice -n 19 bash -c "$cmd2 && $cmd3" >& "$dir"/"$filename".ld
 if [ $? = 0 ]; then
  mv "$dir"/"$filename".ld "$dir"/success
 else
@@ -1,35 +1,113 @@
-#include "common.h"
+// This file implements a glob matcher that can run multiple glob patterns
+// against an input string. mold uses the glob matcher for symbol name
+// patterns in a version script or a dynamic list file. Since we may need to
+// match hundreds of glob patterns against millions of symbol names, the
+// speed of the matcher is very important.
+//
+// The pattern match implemented in this file is NFA-based, although the
+// cost of the function is O(n*m), where n is the number of NFA states and m
+// is the length of the input string. We do not use recursion or
+// backtracking, unlike a generic NFA-based regular expression matcher. This
+// is doable because glob patterns are very limited subsets of regexes.
+//
+// Here is the explanation of the algorithm. Observe that the only "tricky"
+// meta-character in a glob pattern is "*", which matches zero or more
+// characters. Other characters and meta-characters always match a single
+// input character. So the key of the algorithm is to handle "*" efficiently.
+//
+// We can represent a glob pattern "a*b*" with three NFA states: q_start, q1
+// and q_accept, with the following transition functions:
+//
+//   δ(q_start, "a") = q1
+//   δ(q1, <any character>) = q1
+//   δ(q1, "b") = q_accept
+//   δ(q_accept, <any character>) = q_accept
+//
+// We can construct such an NFA in a straightforward manner. We maintain NFA
+// states as a list, with the initial contents being the start state. Each
+// character except for "*" creates a new NFA state, adds a transition from
+// the last state in the list to the new one, and appends the new state at
+// the end of the list. "*" sets the "is_star" flag on the last NFA state.
+// The flag indicates that the state machine can remain in the state for any
+// input character.
+//
+// An NFA constructed this way doesn't have any complicated loops,
+// ε-transitions, or anything like that. Each state has only one incoming
+// edge. The only loops in the state transition are the self-loops on states
+// followed by a "*". Aside from that, the state machine progresses linearly
+// from the start state to the accept state.
+//
+// Each state of an NFA can be represented by a single bit. If a bit is 1,
+// the non-deterministic state machine is in that state. Otherwise, it's
+// not. Observe that a state with the "is_star" flag will continued to be 1
+// once it becomes 1, since the state machine can loop over the state on any
+// input character.
+//
+// With that observation, we can represent an NFA with a bit vector of N
+// bits, where N is the number of NFA states. For each input character, bit
+// M becomes 1 if
+//
+//   - bit M-1 is 1 and there's a transition from state_{M-1} to state_M
+//     with the given character, or
+//   - bit M is 1 and state_M's "is_star" flag is 1.
+//
+// Initially, the 0th bit is 1 for the start state. At each step, the bits
+// propagate from least significant to most significant positions, at most
+// one bit at a time. If the most significant bit is 1 after the entire
+// input has been processed, the string matches.
+//
+// This propagation can be implemented with bitwise OR, bitwise AND, and a
+// one-bit bit shift on the bit vector. All these operations are very cheap.
+//
+// We can combine multiple glob matchers into a single matcher by simply
+// concatenating the bit vectors of their state machines.
+
+#include "lib.h"

 #include <cstring>

 namespace mold {

-std::optional<Glob> Glob::compile(std::string_view pat) {
-  std::vector<Element> vec;
+static std::vector<MultiGlob::State> parse_glob(std::string_view pat) {
+  std::vector<MultiGlob::State> vec(1);

  while (!pat.empty()) {
    u8 c = pat[0];
    pat = pat.substr(1);
+    std::bitset<256> chars;

    switch (c) {
+    case '*':
+      vec.back().is_star = true;
+      continue;
+    case '?':
+      chars.set();
+      break;
+    case '\\':
+      if (pat.empty())
+        return {};
+      chars[pat[0]] = true;
+      pat = pat.substr(1);
+      break;
    case '[': {
      // Here are a few bracket pattern examples:
      //
      // [abc]: a, b or c
      // [$\]!]: $, ] or !
      // [a-czg-i]: a, b, c, z, g, h, or i
-      // [^a-z]: Any character except lowercase letters
-      vec.emplace_back(BRACKET);
-      std::bitset<256> &bitset = vec.back().bitset;
-
+      // [!a-z]: Any character except lowercase letters
+      //
+      // Both `!` and `^` are accepted as negation markers. `!` is the
+      // POSIX/shell convention used by other linkers. `^` was mold's
+      // original syntax and is kept for backward compatibility.
      bool negate = false;
-      if (!pat.empty() && pat[0] == '^') {
+      bool closed = false;
+
+      if (!pat.empty() && (pat[0] == '!' || pat[0] == '^')) {
        negate = true;
        pat = pat.substr(1);
      }

-      bool closed = false;
-
      while (!pat.empty()) {
        if (pat[0] == ']') {
          pat = pat.substr(1);
@@ -59,9 +137,9 @@ std::optional<Glob> Glob::compile(std::string_view pat) {
            return {};

          for (i64 i = start; i <= end; i++)
-            bitset[i] = true;
+            chars[i] = true;
        } else {
-          bitset[(u8)pat[0]] = true;
+          chars[pat[0]] = true;
          pat = pat.substr(1);
        }
      }
@@ -70,87 +148,109 @@ std::optional<Glob> Glob::compile(std::string_view pat) {
        return {};

      if (negate)
-        bitset.flip();
+        chars.flip();
      break;
    }
-    case '?':
-      vec.emplace_back(QUESTION);
-      break;
-    case '*':
-      vec.emplace_back(STAR);
-      break;
-    case '\\':
-      if (pat.empty())
-        return {};
-      if (vec.empty() || vec.back().kind != STRING)
-        vec.emplace_back(STRING);
-      vec.back().str += pat[0];
-      pat = pat.substr(1);
-      break;
    default:
-      if (vec.empty() || vec.back().kind != STRING)
-        vec.emplace_back(STRING);
-      vec.back().str += c;
+      chars[c] = true;
      break;
    }
-  }

-  return {Glob{std::move(vec)}};
+    vec.push_back({chars, false});
+  }
+  return vec;
 }

-bool Glob::match(std::string_view str) {
-  return do_match(str, elements);
+// Instead of returning just a match/no match boolean value, our glob
+// matcher returns an integer value associated with each given pattern.
+// If multiple patterns match at the same time, the largest associated
+// value will be returned by find().
+bool MultiGlob::add(std::string_view pat, i64 val) {
+  std::vector<State> vec = parse_glob(pat);
+  if (vec.empty())
+    return false;
+  patterns.push_back({std::move(vec), val});
+  return true;
 }

-bool Glob::do_match(std::string_view str, std::span<Element> elements) {
-  while (!elements.empty()) {
-    Element &e = elements[0];
-    elements = elements.subspan(1);
+void MultiGlob::compile() {
+  if (patterns.empty())
+    return;

-    switch (e.kind) {
-    case STRING:
-      if (!str.starts_with(e.str))
-        return false;
-      str = str.substr(e.str.size());
-      break;
-    case STAR:
-      if (elements.empty())
-        return true;
+  ranges::stable_sort(patterns, ranges::greater(), &GlobPattern::value);

-      // Patterns like "*foo*bar*" should be much more common than more
-      // complex ones like "*foo*[abc]*" or "*foo**?bar*", so we optimize
-      // the former case here.
-      if (elements[0].kind == STRING) {
-        for (;;) {
-          size_t pos = str.find(elements[0].str);
-          if (pos == str.npos)
-            return false;
-          if (do_match(str.substr(pos + elements[0].str.size()),
-                       elements.subspan(1)))
-            return true;
-          str = str.substr(pos + 1);
-        }
-      }
+  std::vector<State> states;
+  for (GlobPattern &p : patterns)
+    append(states, p.states);
+  i64 sz = states.size();

-      // Other cases are handled here.
-      for (i64 j = 0; j < str.size(); j++)
-        if (do_match(str.substr(j), elements))
-          return true;
-      return false;
-    case QUESTION:
-      if (str.empty())
-        return false;
-      str = str.substr(1);
-      break;
-    case BRACKET:
-      if (str.empty() || !e.bitset[str[0]])
-        return false;
-      str = str.substr(1);
-      break;
-    }
+  start_states.resize(sz);
+  for (i64 pos = 0; GlobPattern &p : patterns) {
+    start_states[pos] = true;
+    pos += p.states.size();
  }

-  return str.empty();
+  star_mask.resize(sz);
+  for (i64 i = 0; i < sz; i++)
+    if (states[i].is_star)
+      star_mask[i] = true;
+
+  for (i64 i = 0; i < 256; i++) {
+    char_mask[i].resize(sz);
+    for (i64 j = 0; j < sz; j++)
+      if (states[j].incoming_edge[i])
+        char_mask[i][j] = true;
+  }
+}
+
+i64 MultiGlob::find(std::string_view str) {
+  if (patterns.empty())
+    return -1;
+
+  Bitvector bits = start_states;
+  Bitvector tmp;
+
+  for (u8 c : str) {
+    // This is equivalent to
+    //
+    //   bits = (bits & star_mask) | ((bits << 1) & char_mask[c])
+    //
+    // but we update the existing objects in place to avoid allocating
+    // temporary objects.
+    tmp = bits;
+    tmp &= star_mask;
+    bits <<= 1;
+    bits &= char_mask[c];
+    bits |= tmp;
+  }
+
+  for (i64 pos = 0; GlobPattern &p : patterns) {
+    pos += p.states.size();
+    if (bits[pos - 1])
+      return p.value;
+  }
+  return -1;
+}
+
+bool Glob::add(std::string_view pat, i64 val) {
+  assert(val >= 0);
+  assert(!is_compiled);
+
+  // If the pattern requires only a single substring search, the
+  // Aho-Corasick algorithm is even faster than our glob matcher.
+  if (aho_corasick.can_handle(pat))
+    return aho_corasick.add(pat, val);
+  return multi_glob.add(pat, val);
+}
+
+i64 Glob::find(std::string_view str) {
+  std::call_once(once, [&] {
+    multi_glob.compile();
+    aho_corasick.compile();
+    is_compiled = true;
+  });
+
+  return std::max(multi_glob.find(str), aho_corasick.find(str));
 }

 } // namespace mold
@@ -4,7 +4,7 @@
 // For more info, read
 // https://engineering.fb.com/2018/12/13/data-infrastructure/hyperloglog

-#include "common.h"
+#include "lib.h"

 #include <cmath>

@@ -5,24 +5,30 @@
 //
 // 1. mold is always a cross linker and should not depend on what host it
 //    is running on. For example, users should be able to run mold on a
-//    big-endian SPARC machine to create a little-endian RV64 binary.
+//    little-endian x86 machine to create a big-endian s390x binary.
 //
 // 2. Even though data members in all ELF data strucutres are naturally
 //    aligned, they are not guaranteed to be aligned on memory because of
-//    archive files. Archive files (.a files) align each member only to a
+//    archive files. Archive files (.a files) align each file only to a
 //    2 byte boundary, so anything larger than 2 bytes may be misaligned
 //    in an mmap'ed memory. Misaligned access is an undefined behavior in
 //    C/C++, so we shouldn't cast an arbitrary pointer to a uint32_t, for
 //    example, to read a 32 bit value.
 //
-// The data types defined in this file don't depend on host byte order and
-// don't do unaligned access. Note that modern compilers are smart enough
-// to recognize shift and bitwise OR patterns and compile them into a
-// single load instruction.
+// The data types defined in this file are independent of the host byte
+// order and are designed to avoid unaligned access.
+//
+// Note that in C/C++, memcpy is a portable and efficient way to access
+// unaligned data, as it is typically treated as an intrinsic. Compilers
+// can easily optimize memcpy calls in this file into a single load or
+// store instruction.

 #pragma once

+#include <bit>
 #include <cstdint>
+#include <cstring>
+#include <type_traits>

 #if !defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__)
 # if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
@@ -36,93 +42,70 @@

 namespace mold {

-typedef uint8_t u8;
-typedef uint16_t u16;
-typedef uint32_t u32;
-typedef uint64_t u64;
-
-typedef int8_t i8;
-typedef int16_t i16;
-typedef int32_t i32;
-typedef int64_t i64;
-
 template <typename T, bool is_le, int size = sizeof(T)>
 class Integer {
 public:
  constexpr Integer() = default;

-  constexpr Integer(T x) requires (is_le && size == 2)
-    : buf{(u8)x, (u8)(x >> 8)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 3)
-    : buf{(u8)x, (u8)(x >> 8), (u8)(x >> 16)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 4)
-    : buf{(u8)x, (u8)(x >> 8), (u8)(x >> 16), (u8)(x >> 24)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 8)
-    : buf{(u8)x,         (u8)(x >> 8),  (u8)(x >> 16), (u8)(x >> 24),
-          (u8)(x >> 32), (u8)(x >> 40), (u8)(x >> 48), (u8)(x >> 56)} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 2)
-    : buf{(u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 3)
-    : buf{(u8)(x >> 16), (u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 4)
-    : buf{(u8)(x >> 24), (u8)(x >> 16), (u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 8)
-    : buf{(u8)(x >> 56), (u8)(x >> 48), (u8)(x >> 40), (u8)(x >> 32),
-          (u8)(x >> 24), (u8)(x >> 16), (u8)(x >> 8),  (u8)x} {}
-
-  operator T() const {
-    if constexpr (is_le) {
-      if constexpr (size == 2)
-        return buf[1] << 8 | buf[0];
-      else if constexpr (size == 3)
-        return buf[2] << 16 | buf[1] << 8 | buf[0];
-      else if constexpr (size == 4)
-        return buf[3] << 24 | buf[2] << 16 | buf[1] << 8 | buf[0];
-      else
-        return (u64)buf[7] << 56 | (u64)buf[6] << 48 |
-               (u64)buf[5] << 40 | (u64)buf[4] << 32 |
-               (u64)buf[3] << 24 | (u64)buf[2] << 16 |
-               (u64)buf[1] << 8  | (u64)buf[0];
+  constexpr Integer(T v) {
+    if (std::is_constant_evaluated() || size == 3) {
+      for (int i = 0; i < size; i++)
+        buf[is_le ? i : (size - i - 1)] = v >> (i * 8);
    } else {
-      if constexpr (size == 2)
-        return buf[0] << 8 | buf[1];
-      else if constexpr (size == 3)
-        return buf[0] << 16 | buf[1] << 8 | buf[2];
-      else if constexpr (size == 4)
-        return buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
-      else
-        return (u64)buf[0] << 56 | (u64)buf[1] << 48 |
-               (u64)buf[2] << 40 | (u64)buf[3] << 32 |
-               (u64)buf[4] << 24 | (u64)buf[5] << 16 |
-               (u64)buf[6] << 8  | (u64)buf[7];
+      if (!is_native)
+        v = bswap(v);
+      memcpy(buf, &v, size);
    }
  }

-  Integer &operator=(T x) {
-    new (this) Integer(x);
-    return *this;
+  operator T() const {
+    if (size == 3) {
+      if (is_le)
+        return buf[2] << 16 | buf[1] << 8 | buf[0];
+      return buf[0] << 16 | buf[1] << 8 | buf[2];
+    }
+
+    T v;
+    memcpy(&v, buf, size);
+    return is_native ? v : bswap(v);
  }

+  Integer &operator=(T v)  { new (this) Integer(v); return *this; }
  Integer &operator++()    { return *this = *this + 1; }
-  Integer operator++(int)  { return ++*this - 1; }
+  Integer operator++(int)  { auto x = *this; ++*this; return x; }
  Integer &operator--()    { return *this = *this - 1; }
-  Integer operator--(int)  { return --*this + 1; }
-  Integer &operator+=(T x) { return *this = *this + x; }
-  Integer &operator-=(T x) { return *this = *this - x; }
-  Integer &operator&=(T x) { return *this = *this & x; }
-  Integer &operator|=(T x) { return *this = *this | x; }
+  Integer operator--(int)  { auto x = *this; --*this; return x; }
+  Integer &operator+=(T v) { return *this = *this + v; }
+  Integer &operator-=(T v) { return *this = *this - v; }
+  Integer &operator&=(T v) { return *this = *this & v; }
+  Integer &operator|=(T v) { return *this = *this | v; }

 private:
-  u8 buf[size];
+  static constexpr bool is_native =
+    (std::endian::native == (is_le ? std::endian::little : std::endian::big));
+
+  static T bswap(T v) {
+    switch (size) {
+    case 2: return __builtin_bswap16(v);
+    case 4: return __builtin_bswap32(v);
+    case 8: return __builtin_bswap64(v);
+    default: __builtin_unreachable();
+    }
+  }
+
+  uint8_t buf[size];
 };

+using i8 = int8_t;
+using i16 = int16_t;
+using i32 = int32_t;
+using i64 = int64_t;
+
+using u8 = uint8_t;
+using u16 = uint16_t;
+using u32 = uint32_t;
+using u64 = uint64_t;
+
 using il16 = Integer<i16, true>;
 using il32 = Integer<i32, true>;
 using il64 = Integer<i64, true>;
@@ -1,7 +1,8 @@
 #pragma once

-#include "config.h"
+#include "atomics.h"
 #include "integers.h"
+#include "bitvector.h"

 #include <array>
 #include <atomic>
@@ -64,199 +65,10 @@ namespace ranges = std::ranges;
 using namespace std::literals::string_literals;
 using namespace std::literals::string_view_literals;

-inline char *output_tmpfile;
-
-inline u8 *output_buffer_start = nullptr;
-inline u8 *output_buffer_end = nullptr;
-
-extern std::string mold_git_hash;
-
-std::string errno_string();
-void cleanup();
-void install_signal_handler();
-
 inline u64 combine_hash(u64 a, u64 b) {
  return a ^ (b + 0x9e3779b9 + (a << 6) + (a >> 2));
 }

-//
-// Error output
-//
-
-// Some C++ stdlibs don't support std::osyncstream even though
-// it's is in the C++20 standard. So we implement it ourselves.
-class SyncStream {
-public:
-  SyncStream(std::ostream &out) : out(out) {}
-
-  ~SyncStream() {
-    emit();
-  }
-
-  template <typename T> SyncStream &operator<<(T &&val) {
-    ss << std::forward<T>(val);
-    return *this;
-  }
-
-  void emit() {
-    if (emitted)
-      return;
-
-    std::scoped_lock lock(mu);
-    out << ss.str() << '\n';
-    emitted = true;
-  }
-
-private:
-  std::ostream &out;
-  std::stringstream ss;
-  bool emitted = false;
-  static inline std::mutex mu;
-};
-
-template <typename Context>
-class Out {
-public:
-  Out(Context &ctx) {}
-
-  template <typename T> Out &operator<<(T &&val) {
-    out << std::forward<T>(val);
-    return *this;
-  }
-
-private:
-  SyncStream out{std::cout};
-};
-
-static std::string_view fatal_mono = "mold: fatal: ";
-static std::string_view fatal_color = "mold: \033[0;1;31mfatal:\033[0m ";
-static std::string_view error_mono = "mold: error: ";
-static std::string_view error_color = "mold: \033[0;1;31merror:\033[0m ";
-static std::string_view warning_mono = "mold: warning: ";
-static std::string_view warning_color = "mold: \033[0;1;35mwarning:\033[0m ";
-
-template <typename Context>
-class Fatal {
-public:
-  Fatal(Context &ctx) {
-    out << (ctx.arg.color_diagnostics ? fatal_color : fatal_mono);
-  }
-
-  [[noreturn]] ~Fatal() {
-    out.emit();
-    cleanup();
-    _exit(1);
-  }
-
-  template <typename T> Fatal &operator<<(T &&val) {
-    out << std::forward<T>(val);
-    return *this;
-  }
-
-private:
-  SyncStream out{std::cerr};
-};
-
-template <typename Context>
-class Error {
-public:
-  Error(Context &ctx) {
-    if (ctx.arg.noinhibit_exec) {
-      out << (ctx.arg.color_diagnostics ? warning_color : warning_mono);
-    } else {
-      out << (ctx.arg.color_diagnostics ? error_color : error_mono);
-      ctx.has_error = true;
-    }
-  }
-
-  template <typename T> Error &operator<<(T &&val) {
-    out << std::forward<T>(val);
-    return *this;
-  }
-
-private:
-  SyncStream out{std::cerr};
-};
-
-template <typename Context>
-class Warn {
-public:
-  Warn(Context &ctx) {
-    if (ctx.arg.suppress_warnings)
-      return;
-
-    out.emplace(std::cerr);
-
-    if (ctx.arg.fatal_warnings) {
-      *out << (ctx.arg.color_diagnostics ? error_color : error_mono);
-      ctx.has_error = true;
-    } else {
-      *out << (ctx.arg.color_diagnostics ? warning_color : warning_mono);
-    }
-  }
-
-  template <typename T> Warn &operator<<(T &&val) {
-    if (out)
-      *out << std::forward<T>(val);
-    return *this;
-  }
-
-private:
-  std::optional<SyncStream> out;
-};
-
-//
-// Atomics
-//
-
-// This is the same as std::atomic except that the default memory
-// order is relaxed instead of sequential consistency.
-template <typename T>
-struct Atomic : std::atomic<T> {
-  static constexpr std::memory_order relaxed = std::memory_order_relaxed;
-
-  using std::atomic<T>::atomic;
-
-  Atomic(const Atomic<T> &other) : std::atomic<T>(other.load()) {}
-
-  Atomic<T> &operator=(const Atomic<T> &other) {
-    store(other.load());
-    return *this;
-  }
-
-  void operator=(T val) { store(val); }
-  operator T() const { return load(); }
-
-  void store(T val, std::memory_order order = relaxed) {
-    std::atomic<T>::store(val, order);
-  }
-
-  T load(std::memory_order order = relaxed) const {
-    return std::atomic<T>::load(order);
-  }
-
-  T exchange(T val) { return std::atomic<T>::exchange(val, relaxed); }
-  T operator|=(T val) { return std::atomic<T>::fetch_or(val, relaxed); }
-  T operator++() { return std::atomic<T>::fetch_add(1, relaxed) + 1; }
-  T operator--() { return std::atomic<T>::fetch_sub(1, relaxed) - 1; }
-  T operator++(int) { return std::atomic<T>::fetch_add(1, relaxed); }
-  T operator--(int) { return std::atomic<T>::fetch_sub(1, relaxed); }
-
-  bool test_and_set() {
-    // A relaxed load + branch (assuming miss) takes only around 20 cycles,
-    // while an atomic RMW can easily take hundreds on x86. We note that it's
-    // common that another thread beat us in marking, so doing an optimistic
-    // early test tends to improve performance in the ~20% ballpark.
-    return load() || exchange(true);
-  }
-};
-
-//
-// mimalloc.cc
-//
-
-void set_mimalloc_options();
-
 //
 // perf.cc
 //
@@ -583,11 +395,15 @@ public:
    this->nbuckets = std::max<i64>(MIN_NBUCKETS, bit_ceil(nbuckets));
    i64 bufsize = sizeof(Entry) * this->nbuckets;

-    // Allocate a zero-initialized buffer. We use mmap() if available
-    // because it's faster than malloc() and memset().
+    // Allocate a zero-initialized buffer. mmap() is faster than
+    // malloc()+memset(), and MAP_POPULATE pre-faults pages here to
+    // avoid CoW faults and TLB shootdowns under concurrent inserts.
 #ifdef _WIN32
    entries = (Entry *)_aligned_malloc(bufsize, alignof(Entry));
    memset((void *)entries, 0, bufsize);
+#elif MAP_POPULATE
+    entries = (Entry *)mmap(nullptr, bufsize, PROT_READ | PROT_WRITE,
+                            MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0);
 #else
    entries = (Entry *)mmap(nullptr, bufsize, PROT_READ | PROT_WRITE,
                            MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
@@ -667,7 +483,7 @@ public:

    // Since the shard is circular, we need to handle the last entries
    // as if they were next to the first entries.
-    while (entries[end - 1].key)
+    while (begin < end && entries[end - 1].key)
      vec.push_back(entries + --end);

    // Find entries contiguous in the buckets and sort them.
@@ -737,58 +553,72 @@ private:
 };

 //
-// glob.cc
+// aho-corasick.cc
 //

-class Glob {
-  typedef enum { STRING, STAR, QUESTION, BRACKET } Kind;
-
-  struct Element {
-    Element(Kind k) : kind(k) {}
-    Kind kind;
-    std::string str;
-    std::bitset<256> bitset;
-  };
-
+class AhoCorasick {
 public:
-  static std::optional<Glob> compile(std::string_view pat);
-  bool match(std::string_view str);
+  bool add(std::string_view pat, i64 val);
+  bool empty() const { return nodes.empty(); }
+  void compile();
+  i64 find(std::string_view str);
+
+  static bool can_handle(std::string_view str);

 private:
-  Glob(std::vector<Element> &&vec) : elements(vec) {}
-  static bool do_match(std::string_view str, std::span<Element> elements);
+  struct TrieNode {
+    TrieNode() { children.fill(-1); }
+    i64 value = -1;
+    i32 suffix_link = -1;
+    std::array<i32, 256> children;
+  };

-  std::vector<Element> elements;
+  void fix_suffix_links(i64 idx);
+  void fix_values();
+
+  std::vector<TrieNode> nodes;
 };

 //
-// multi-glob.cc
+// glob.cc
 //

 class MultiGlob {
 public:
  bool add(std::string_view pat, i64 val);
-  bool empty() const { return strings.empty(); }
-  std::optional<i64> find(std::string_view str);
+  bool empty() const { return patterns.empty(); }
+  void compile();
+  i64 find(std::string_view str);

-private:
-  struct TrieNode {
-    i64 value = -1;
-    TrieNode *suffix_link = nullptr;
-    std::unique_ptr<TrieNode> children[256];
+  struct State {
+    std::bitset<256> incoming_edge;
+    bool is_star = false;
  };

-  void compile();
-  void fix_suffix_links(TrieNode &node);
-  void fix_values();
-  i64 find_aho_corasick(std::string_view str);
+  struct GlobPattern {
+    std::vector<State> states;
+    i64 value = -1;
+  };

-  std::vector<std::string> strings;
-  std::unique_ptr<TrieNode> root;
-  std::vector<std::pair<Glob, i64>> globs;
+private:
+  std::vector<GlobPattern> patterns;
+  Bitvector start_states;
+  Bitvector star_mask;
+  Bitvector char_mask[256];
+};
+
+class Glob {
+public:
+  bool add(std::string_view pat, i64 val);
+  bool empty() const { return multi_glob.empty() && aho_corasick.empty(); }
+  i64 find(std::string_view str);
+
+private:
  std::once_flag once;
  bool is_compiled = false;
-  bool prefix_match = false;
+
+  MultiGlob multi_glob;
+  AhoCorasick aho_corasick;
 };

 //
@@ -816,13 +646,6 @@ std::string get_self_path();
 std::optional<std::string_view> demangle_cpp(std::string_view name);
 std::optional<std::string_view> demangle_rust(std::string_view name);

-//
-// jbos.cc
-//
-
-void acquire_global_lock();
-void release_global_lock();
-
 //
 // crc32.cc
 //
@@ -837,27 +660,26 @@ std::vector<u8> crc32_solve(u32 current, u32 desired);
 class Compressor {
 public:
  virtual void write_to(u8 *buf) = 0;
-  virtual ~Compressor() {}
+  virtual ~Compressor();
  i64 compressed_size = 0;
+
+protected:
+  std::vector<std::span<u8>> shards;
 };

 class ZlibCompressor : public Compressor {
 public:
-  ZlibCompressor(u8 *buf, i64 size);
+  ZlibCompressor(u8 *buf, i64 size, i64 level);
  void write_to(u8 *buf) override;

 private:
-  std::vector<std::vector<u8>> shards;
-  u64 checksum = 0;
+  u32 checksum = 0;
 };

 class ZstdCompressor : public Compressor {
 public:
-  ZstdCompressor(u8 *buf, i64 size);
+  ZstdCompressor(u8 *buf, i64 size, i64 level);
  void write_to(u8 *buf) override;
-
-private:
-  std::vector<std::vector<u8>> shards;
 };

 //
@@ -884,96 +706,4 @@ private:
  std::string basedir;
 };

-//
-// Memory-mapped file
-//
-
-// MappedFile represents an mmap'ed input file.
-// mold uses mmap-IO only.
-class MappedFile {
-public:
-  ~MappedFile() { unmap(); }
-  void unmap();
-  void close_fd();
-  void reopen_fd(const std::string &path);
-
-  template <typename Context>
-  MappedFile *slice(Context &ctx, std::string name, u64 start, u64 size) {
-    MappedFile *mf = new MappedFile;
-    mf->name = name;
-    mf->data = data + start;
-    mf->size = size;
-    mf->parent = this;
-
-    ctx.mf_pool.emplace_back(mf);
-    return mf;
-  }
-
-  std::string_view get_contents() {
-    return std::string_view((char *)data, size);
-  }
-
-  i64 get_offset() const {
-    return parent ? (data - parent->data + parent->get_offset()) : 0;
-  }
-
-  // Returns a string that uniquely identify a file that is possibly
-  // in an archive.
-  std::string get_identifier() const {
-    if (parent) {
-      // We use the file offset within an archive as an identifier
-      // because archive members may have the same name.
-      return parent->name + ":" + std::to_string(get_offset());
-    }
-
-    if (thin_parent) {
-      // If this is a thin archive member, the filename part is
-      // guaranteed to be unique.
-      return thin_parent->name + ":" + name;
-    }
-    return name;
-  }
-
-  std::string name;
-  u8 *data = nullptr;
-  i64 size = 0;
-  bool given_fullpath = true;
-  MappedFile *parent = nullptr;
-  MappedFile *thin_parent = nullptr;
-
-  // For --dependency-file
-  bool is_dependency = true;
-
-#ifdef _WIN32
-  HANDLE fd = INVALID_HANDLE_VALUE;
-#else
-  int fd = -1;
-#endif
-};
-
-MappedFile *open_file_impl(const std::string &path, std::string &error);
-
-template <typename Context>
-MappedFile *open_file(Context &ctx, std::string path) {
-  if (path.starts_with('/') && !ctx.arg.chroot.empty())
-    path = ctx.arg.chroot + "/" + path_clean(path);
-
-  std::string error;
-  MappedFile *mf = open_file_impl(path, error);
-  if (!error.empty())
-    Fatal(ctx) << error;
-
-  if (mf)
-    ctx.mf_pool.emplace_back(mf);
-  return mf;
-}
-
-template <typename Context>
-MappedFile *must_open_file(Context &ctx, std::string path) {
-  MappedFile *mf = open_file(ctx, path);
-  if (!mf)
-    Fatal(ctx) << "cannot open " << path << ": " << errno_string();
-  return mf;
-}
-
 } // namespace mold
@@ -1,24 +0,0 @@
-#include "common.h"
-
-// Including mimalloc-new-delete.h overrides new/delete operators.
-// We need it only when we are using mimalloc as a dynamic library.
-#if MOLD_USE_SYSTEM_MIMALLOC
-# include <mimalloc-new-delete.h>
-#endif
-
-// Silence mimalloc warning messages that users can just ignore.
-#if MOLD_USE_MIMALLOC
-# include <mimalloc.h>
-
-namespace mold {
-void set_mimalloc_options() {
-  mi_option_disable(mi_option_verbose);
-  mi_option_disable(mi_option_show_errors);
-}
-}
-
-#else
-namespace mold {
-void set_mimalloc_options() {}
-}
-#endif
@@ -1,186 +0,0 @@
-// This file implements the Aho-Corasick algorithm to match multiple
-// glob patterns to symbol strings as quickly as possible.
-//
-// Here are some examples of glob patterns:
-//
-//    qt_private_api_tag*
-//    *16QAccessibleCache*
-//    *32QAbstractFileIconProviderPrivate*
-//    *17QPixmapIconEngine*
-//
-// `*` is a wildcard that matches any substring. We sometimes have
-// hundreds of glob patterns and have to match them against millions
-// of symbol strings.
-//
-// Aho-Corasick cannot handle complex patterns such as `*foo*bar*`.
-// We handle such patterns with the Glob class. Glob is relatively
-// slow, but complex patterns are rare in practice, so it should be
-// OK.
-
-#include "common.h"
-
-#include <queue>
-#include <regex>
-
-namespace mold {
-
-std::optional<i64> MultiGlob::find(std::string_view str) {
-  std::call_once(once, [&] { compile(); });
-  i64 val = -1;
-
-  // Match against simple glob patterns
-  if (root)
-    val = find_aho_corasick(str);
-
-  // Match against complex glob patterns
-  for (std::pair<Glob, i64> &glob : globs)
-    if (glob.first.match(str))
-      val = std::max(val, glob.second);
-
-  if (val == -1)
-    return {};
-  return val;
-}
-
-i64 MultiGlob::find_aho_corasick(std::string_view str) {
-  TrieNode *node = root.get();
-  i64 val = -1;
-
-  auto walk = [&](u8 c) {
-    for (;;) {
-      if (node->children[c]) {
-        node = node->children[c].get();
-        val = std::max(val, node->value);
-        return;
-      }
-
-      if (!node->suffix_link)
-        return;
-      node = node->suffix_link;
-    }
-  };
-
-  walk('\0');
-
-  for (u8 c : str) {
-    if (prefix_match && node == root.get())
-      return val;
-    walk(c);
-  }
-
-  walk('\0');
-  return val;
-}
-
-static bool is_simple_pattern(std::string_view pat) {
-  static std::regex re(R"(\*?[^*[?]+\*?)", std::regex_constants::optimize);
-  return std::regex_match(pat.begin(), pat.end(), re);
-}
-
-static std::string handle_stars(std::string_view pat) {
-  std::string str(pat);
-
-  // Convert "foo" -> "\0foo\0", "*foo" -> "foo\0", "foo*" -> "\0foo"
-  // and "*foo*" -> "foo". Aho-Corasick can do only substring matching,
-  // so we use \0 as beginning/end-of-string markers.
-  if (str.starts_with('*') && str.ends_with('*'))
-    return str.substr(1, str.size() - 2);
-  if (str.starts_with('*'))
-    return str.substr(1) + "\0"s;
-  if (str.ends_with('*'))
-    return "\0"s + str.substr(0, str.size() - 1);
-  return "\0"s + str + "\0"s;
-}
-
-bool MultiGlob::add(std::string_view pat, i64 val) {
-  assert(!is_compiled);
-  assert(!pat.empty());
-
-  strings.emplace_back(pat);
-
-  // Complex glob pattern
-  if (!is_simple_pattern(pat)) {
-    if (std::optional<Glob> glob = Glob::compile(pat)) {
-      globs.emplace_back(std::move(*glob), val);
-      return true;
-    }
-    return false;
-  }
-
-  // Simple glob pattern
-  if (!root)
-    root.reset(new TrieNode);
-  TrieNode *node = root.get();
-
-  for (u8 c : handle_stars(pat)) {
-    if (!node->children[c])
-      node->children[c].reset(new TrieNode);
-    node = node->children[c].get();
-  }
-
-  node->value = std::max(node->value, val);
-  return true;
-}
-
-void MultiGlob::compile() {
-  is_compiled = true;
-  if (root) {
-    fix_suffix_links(*root);
-    fix_values();
-
-    // If no pattern starts with '*', set prefix_match to true.
-    // We'll use this flag for optimization.
-    prefix_match = true;
-    for (i64 i = 1; i < 256; i++) {
-      if (root->children[i]) {
-        prefix_match = false;
-        break;
-      }
-    }
-  }
-}
-
-void MultiGlob::fix_suffix_links(TrieNode &node) {
-  for (i64 i = 0; i < 256; i++) {
-    if (!node.children[i])
-      continue;
-
-    TrieNode &child = *node.children[i];
-
-    TrieNode *cur = node.suffix_link;
-    for (;;) {
-      if (!cur) {
-        child.suffix_link = root.get();
-        break;
-      }
-
-      if (cur->children[i]) {
-        child.suffix_link = cur->children[i].get();
-        break;
-      }
-
-      cur = cur->suffix_link;
-    }
-
-    fix_suffix_links(child);
-  }
-}
-
-void MultiGlob::fix_values() {
-  std::queue<TrieNode *> queue;
-  queue.push(root.get());
-
-  do {
-    TrieNode *node = queue.front();
-    queue.pop();
-
-    for (std::unique_ptr<TrieNode> &child : node->children) {
-      if (!child)
-        continue;
-      child->value = std::max(child->value, child->suffix_link->value);
-      queue.push(child.get());
-    }
-  } while (!queue.empty());
-}
-
-} // namespace mold
@@ -1,11 +1,13 @@
-#include "common.h"
+#include "lib.h"

 #include <functional>
 #include <iomanip>
 #include <ios>
 #include <tbb/concurrent_vector.h>

-#ifndef _WIN32
+#ifdef _WIN32
+#include <windows.h>
+#else
 #include <sys/resource.h>
 #include <sys/time.h>
 #endif
@@ -1,4 +1,4 @@
-#include "common.h"
+#include "lib.h"

 #include <random>

@@ -1,6 +1,6 @@
 // This file contains functions to create a tar file.

-#include "common.h"
+#include "lib.h"

 #ifdef _WIN32
 # define ftruncate _chsize_s
@@ -86,6 +86,9 @@ void TarWriter::append(std::string path, std::string_view data) {
  UstarHeader pax = {};

  std::string attr = encode_path(basedir, path);
+
+  if (attr.size() >= 0100'000'000'000)
+    unreachable();
  snprintf(pax.size, sizeof(pax.size), "%011zo", attr.size());
  pax.name[0] = '/';
  pax.typeflag[0] = 'x';
@@ -99,6 +102,8 @@ void TarWriter::append(std::string path, std::string_view data) {
  // Write Ustar header
  UstarHeader ustar = {};
  memcpy(ustar.mode, "0000664", 8);
+  if (data.size() >= 0100'000'000'000)
+    unreachable();
  snprintf(ustar.size, sizeof(ustar.size), "%011zo", data.size());
  finalize(ustar);
  fwrite(&ustar, sizeof(ustar), 1, out);
@@ -17,11 +17,11 @@ if(EXISTS "${SOURCE_DIR}/.git/HEAD")
 endif()

 # Create new file contents and update a given file if necessary.
-set(NEW_CONTENTS "#include <string>
-namespace mold {
-std::string mold_git_hash = \"${HASH}\";
-}
-")
+if("${HASH}" STREQUAL "")
+  set(NEW_CONTENTS "")
+else()
+  set(NEW_CONTENTS "#define MOLD_GIT_HASH \"${HASH}\"\n")
+endif()

 if(EXISTS "${OUTPUT_FILE}")
  file(READ "${OUTPUT_FILE}" OLD_CONTENTS)
@@ -1,285 +0,0 @@
-// r31 is blink. r30 is I believe a scratch register.
-//
-// Programs might use one of several branch, jump, and link instructions
-// to control execution flow through direct and indirect function calls
-// and branching. For function calling, the conditional branch-and-link
-// instruction has a maximum branch range of ±1 MiB, and the target
-// address is 32-bit-aligned. The unconditional branch-and-link format has
-// a maximum branch range of ±16 MiB.
-//
-// https://github.com/foss-for-synopsys-dwc-arc-processors/arc-ABI-manual/blob/master/ARCv2_ABI.pdf
-
-#include "mold.h"
-
-namespace mold {
-
-using E = ARC;
-
-// An integer-like class for the mixed-endian encoding
-class M32 {
-public:
-  operator u32() const {
-    return (buf[1] << 24) | (buf[0] << 16) | (buf[3] << 8) | buf[2];
-  }
-
-  M32 &operator=(u32 x) {
-    buf[0] = x >> 16;
-    buf[1] = x >> 24;
-    buf[2] = x;
-    buf[3] = x >> 8;
-    return *this;
-  }
-
-  M32 &operator&=(u32 x) { return *this = *this & x; }
-  M32 &operator|=(u32 x) { return *this = *this | x; }
-  u8 buf[4];
-};
-
-static void write_disp7u(u8 *loc, u32 val) {
-  *(ul16 *)loc |= (bits(val, 6, 3) << 4) | bits(val, 2, 0);
-}
-
-static void write_disp9(u8 *loc, u32 val) {
-  *(M32 *)loc |= bits(val, 8, 0);
-}
-
-static void write_disp9ls(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 7, 0) << 16) | (bit(val, 8) << 15);
-}
-
-static void write_disp9s(u8 *loc, u32 val) {
-  *(ul16 *)loc |= bits(val, 8, 0);
-}
-
-static void write_disp10u(u8 *loc, u32 val) {
-  *(ul16 *)loc |= bits(val, 9, 0);
-}
-
-static void write_disp13s(u8 *loc, u32 val) {
-  *(ul16 *)loc |= bits(val, 12, 0);
-}
-
-static void write_disp21h(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 10, 1) << 17) | (bits(val, 20, 11) << 6);
-}
-
-static void write_disp21w(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 10, 2) << 18) | (bits(val, 20, 11) << 6);
-}
-
-static void write_disp25h(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 10, 1) << 17) | (bits(val, 20, 11) << 6) |
-                  bits(val, 24, 21);
-}
-
-static void write_disp25w(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 10, 2) << 18) | (bits(val, 20, 11) << 6) |
-                  bits(val, 24, 21);
-}
-
-static void write_disps9(u8 *loc, u32 val) {
-  *(ul16 *)loc |= bits(val, 10, 2);
-}
-
-static void write_disps12(u8 *loc, u32 val) {
-  *(M32 *)loc |= (bits(val, 5, 0) << 6) | bits(val, 11, 6);
-}
-
-template <>
-void write_plt_header(Context<E> &ctx, u8 *buf) {
-  static const ul16 insn[] = {
-    0x2730, 0x7f8b, 0, 0, // ld r11, [pcl,0]
-    0x2730, 0x7f8a, 0, 0, // ld r10, [pcl,0]
-    0x2020, 0x0280,       // j       [r10]
-    0, 0,                 // (address of GOTPLT)
-  };
-
-  memcpy(buf, insn, sizeof(insn));
-  *(M32 *)(buf + 4) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr + 4;
-  *(M32 *)(buf + 12) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr;
-  *(M32 *)(buf + 20) = ctx.gotplt->shdr.sh_addr;
-}
-
-template <>
-void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
-  static const ul16 insn[] = {
-    0x2730, 0x7f8c, 0, 0, // ld  r12, [pcl,0]
-    0x2021, 0x0300,       // j.d [r12]
-    0x240a, 0x1fc0,       // mov r12,pcl
-  };
-
-  memcpy(buf, insn, sizeof(insn));
-  *(M32 *)(buf + 4) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx);
-}
-
-template <>
-void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
-  static const ul16 insn[] = {
-    0x2730, 0x7f8c, 0, 0, // ld  r12, [pcl,0]
-    0x2021, 0x0300,       // j.d [r12]
-    0x240a, 0x1fc0,       // mov r12,pcl
-  };
-
-  memcpy(buf, insn, sizeof(insn));
-  *(M32 *)(buf + 4) = sym.get_got_pltgot_addr(ctx) - sym.get_plt_addr(ctx);
-}
-
-template <>
-void EhFrameSection<E>::apply_eh_reloc(Context<E> &ctx, const ElfRel<E> &rel,
-                                       u64 offset, u64 val) {
-  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
-
-  switch (rel.r_type) {
-  case R_NONE:
-    break;
-  case R_ARC_32:
-    *(ul32 *)loc = val;
-    break;
-  case R_ARC_32_PCREL:
-    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
-    break;
-  default:
-    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
-  }
-}
-
-template <>
-void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
-  std::span<const ElfRel<E>> rels = get_rels(ctx);
-
-  for (i64 i = 0; i < rels.size(); i++) {
-    const ElfRel<E> &rel = rels[i];
-    if (rel.r_type == R_NONE)
-      continue;
-
-    Symbol<E> &sym = *file.symbols[rel.r_sym];
-    u8 *loc = base + rel.r_offset;
-
-    u64 S = sym.get_addr(ctx);
-    u64 A = rel.r_addend;
-    u64 P = get_addr() + rel.r_offset;
-    u64 G = sym.get_got_idx(ctx) * sizeof(Word<E>);
-    u64 GOT = ctx.got->shdr.sh_addr;
-
-    switch (rel.r_type) {
-    case R_ARC_32:
-      *(ul32 *)loc = S + A;
-      break;
-    case R_ARC_32_ME:
-      *(M32 *)loc = S + A;
-      break;
-    case R_ARC_S25H_PCREL:
-    case R_ARC_S25H_PCREL_PLT:
-      write_disp25h(loc, align_to(S + A - P, 2));
-      break;
-    case R_ARC_S25W_PCREL:
-    case R_ARC_S25W_PCREL_PLT:
-      write_disp25w(loc, align_to(S + A - P, 4));
-      break;
-    case R_ARC_PC32:
-      *(M32 *)loc = S + A - P;
-      break;
-    case R_ARC_32_PCREL:
-      *(ul32 *)loc = S + A - P;
-      break;
-    case R_ARC_GOTPC32:
-      *(M32 *)loc = GOT + G + A - P;
-      break;
-    case R_ARC_TLS_LE_32:
-      *(M32 *)loc = S + A - ctx.tp_addr;
-      break;
-    case R_ARC_TLS_IE_GOT:
-      *(M32 *)loc = sym.get_gottp_addr(ctx) + A - P;
-      break;
-    default:
-      unreachable();
-    }
-  }
-}
-
-template <>
-void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
-  std::span<const ElfRel<E>> rels = get_rels(ctx);
-
-  for (i64 i = 0; i < rels.size(); i++) {
-    const ElfRel<E> &rel = rels[i];
-    if (rel.r_type == R_NONE || record_undef_error(ctx, rel))
-      continue;
-
-    Symbol<E> &sym = *file.symbols[rel.r_sym];
-    u8 *loc = base + rel.r_offset;
-
-    SectionFragment<E> *frag;
-    i64 frag_addend;
-    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
-
-    u64 S = frag ? frag->get_addr(ctx) : sym.get_addr(ctx);
-    u64 A = frag ? frag_addend : (i64)rel.r_addend;
-
-    switch (rel.r_type) {
-    case R_ARC_32:
-      if (std::optional<u64> val = get_tombstone(sym, frag))
-        *(ul32 *)loc = *val;
-      else
-        *(ul32 *)loc = S + A;
-      break;
-    default:
-      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
-                 << rel;
-    }
-  }
-}
-
-template <>
-void InputSection<E>::scan_relocations(Context<E> &ctx) {
-  assert(shdr().sh_flags & SHF_ALLOC);
-  std::span<const ElfRel<E>> rels = get_rels(ctx);
-
-  for (i64 i = 0; i < rels.size(); i++) {
-    const ElfRel<E> &rel = rels[i];
-    if (rel.r_type == R_NONE || record_undef_error(ctx, rel))
-      continue;
-
-    Symbol<E> &sym = *file.symbols[rel.r_sym];
-
-    if (sym.is_ifunc())
-      Error(ctx) << sym << ": GNU ifunc symbol is not supported on m68k";
-
-    switch (rel.r_type) {
-    case R_ARC_32:
-      break;
-    case R_ARC_32_ME:
-      scan_absrel(ctx, sym, rel);
-      break;
-    case R_ARC_S25H_PCREL:
-    case R_ARC_S25W_PCREL:
-    case R_ARC_32_PCREL:
-    case R_ARC_PC32:
-      scan_pcrel(ctx, sym, rel);
-      break;
-    case R_ARC_S25H_PCREL_PLT:
-    case R_ARC_S25W_PCREL_PLT:
-      if (sym.is_imported)
-        sym.flags |= NEEDS_PLT;
-      break;
-    case R_ARC_GOTPC32:
-      sym.flags |= NEEDS_GOT;
-      break;
-    case R_ARC_TLS_LE_32:
-      check_tlsle(ctx, sym, rel);
-      break;
-    case R_ARC_TLS_IE_GOT:
-      sym.flags |= NEEDS_GOTTP;
-      break;
-    default:
-      Error(ctx) << *this << ": unknown relocation: " << rel;
-    }
-  }
-}
-
-template <>
-u64 get_eflags(Context<E> &ctx) {
-  return 0x406;
-}
-
-} // namespace mold
@@ -31,18 +31,21 @@
 //
 // https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst

+#if MOLD_ARM32LE || MOLD_ARM32BE
+
 #include "mold.h"

 #include <tbb/parallel_for.h>
+#include <tbb/parallel_for_each.h>

 namespace mold {

-using E = ARM32;
+using E = MOLD_TARGET;

 template <>
 i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
-  ul32 *arm = (ul32 *)loc;
-  ul16 *thm = (ul16 *)loc;
+  U32<E> *arm = (U32<E> *)loc;
+  U16<E> *thm = (U16<E> *)loc;

  switch (rel.r_type) {
  case R_ARM_ABS32:
@@ -59,7 +62,7 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
  case R_ARM_TLS_GOTDESC:
  case R_ARM_TARGET1:
  case R_ARM_TARGET2:
-    return (il32)*arm;
+    return (I32<E>)*arm;
  case R_ARM_THM_JUMP8:
    return sign_extend(thm[0], 8) << 1;
  case R_ARM_THM_JUMP11:
@@ -125,7 +128,7 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
 static void write_arm_mov(u8 *loc, u32 val) {
  u32 imm12 = bits(val, 11, 0);
  u32 imm4 = bits(val, 15, 12);
-  *(ul32 *)loc = (*(ul32 *)loc & 0xfff0'f000) | (imm4 << 16) | imm12;
+  *(U32<E> *)loc = (*(U32<E> *)loc & 0xfff0'f000) | (imm4 << 16) | imm12;
 }

 static void write_thm_b21(u8 *loc, u32 val) {
@@ -135,7 +138,7 @@ static void write_thm_b21(u8 *loc, u32 val) {
  u32 imm6 = bits(val, 17, 12);
  u32 imm11 = bits(val, 11, 1);

-  ul16 *buf = (ul16 *)loc;
+  U16<E> *buf = (U16<E> *)loc;
  buf[0] = (buf[0] & 0b1111'1011'1100'0000) | (S << 10) | imm6;
  buf[1] = (buf[1] & 0b1101'0000'0000'0000) | (J1 << 13) | (J2 << 11) | imm11;
 }
@@ -149,7 +152,7 @@ static void write_thm_b25(u8 *loc, u32 val) {
  u32 imm10 = bits(val, 21, 12);
  u32 imm11 = bits(val, 11, 1);

-  ul16 *buf = (ul16 *)loc;
+  U16<E> *buf = (U16<E> *)loc;
  buf[0] = (buf[0] & 0b1111'1000'0000'0000) | (S << 10) | imm10;
  buf[1] = (buf[1] & 0b1101'0000'0000'0000) | (J1 << 13) | (J2 << 11) | imm11;
 }
@@ -160,7 +163,7 @@ static void write_thm_mov(u8 *loc, u32 val) {
  u32 imm3 = bits(val, 10, 8);
  u32 imm8 = bits(val, 7, 0);

-  ul16 *buf = (ul16 *)loc;
+  U16<E> *buf = (U16<E> *)loc;
  buf[0] = (buf[0] & 0b1111'1011'1111'0000) | (i << 10) | imm4;
  buf[1] = (buf[1] & 0b1000'1111'0000'0000) | (imm3 << 12) | imm8;
 }
@@ -184,13 +187,13 @@ void write_addend(u8 *loc, i64 val, const ElfRel<E> &rel) {
  case R_ARM_TLS_GOTDESC:
  case R_ARM_TARGET1:
  case R_ARM_TARGET2:
-    *(ul32 *)loc = val;
+    *(U32<E> *)loc = val;
    break;
  case R_ARM_THM_JUMP8:
-    *(ul16 *)loc = (*(ul16 *)loc & 0xff00) | bits(val, 8, 1);
+    *(U16<E> *)loc = (*(U16<E> *)loc & 0xff00) | bits(val, 8, 1);
    break;
  case R_ARM_THM_JUMP11:
-    *(ul16 *)loc = (*(ul16 *)loc & 0xf800) | bits(val, 11, 1);
+    *(U16<E> *)loc = (*(U16<E> *)loc & 0xf800) | bits(val, 11, 1);
    break;
  case R_ARM_THM_CALL:
  case R_ARM_THM_JUMP24:
@@ -200,7 +203,7 @@ void write_addend(u8 *loc, i64 val, const ElfRel<E> &rel) {
  case R_ARM_CALL:
  case R_ARM_JUMP24:
  case R_ARM_PLT32:
-    *(ul32 *)loc = (*(ul32 *)loc & 0xff00'0000) | bits(val, 25, 2);
+    *(U32<E> *)loc = (*(U32<E> *)loc & 0xff00'0000) | bits(val, 25, 2);
    break;
  case R_ARM_MOVW_PREL_NC:
  case R_ARM_MOVW_ABS_NC:
@@ -209,7 +212,7 @@ void write_addend(u8 *loc, i64 val, const ElfRel<E> &rel) {
    write_arm_mov(loc, val);
    break;
  case R_ARM_PREL31:
-    *(ul32 *)loc = (*(ul32 *)loc & 0x8000'0000) | (val & 0x7fff'ffff);
+    *(U32<E> *)loc = (*(U32<E> *)loc & 0x8000'0000) | (val & 0x7fff'ffff);
    break;
  case R_ARM_THM_MOVW_PREL_NC:
  case R_ARM_THM_MOVW_ABS_NC:
@@ -236,7 +239,7 @@ void write_plt_header(Context<E> &ctx, u8 *buf) {
  };

  memcpy(buf, insn, sizeof(insn));
-  *(ul32 *)(buf + 16) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 16;
+  *(U32<E> *)(buf + 16) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 16;
 }

 static constexpr ul32 plt_entry[] = {
@@ -249,13 +252,13 @@ static constexpr ul32 plt_entry[] = {
 template <>
 void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
  memcpy(buf, plt_entry, sizeof(plt_entry));
-  *(ul32 *)(buf + 12) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx) - 12;
+  *(U32<E> *)(buf + 12) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx) - 12;
 }

 template <>
 void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
  memcpy(buf, plt_entry, sizeof(plt_entry));
-  *(ul32 *)(buf + 12) = sym.get_got_pltgot_addr(ctx) - sym.get_plt_addr(ctx) - 12;
+  *(U32<E> *)(buf + 12) = sym.get_got_pltgot_addr(ctx) - sym.get_plt_addr(ctx) - 12;
 }

 template <>
@@ -267,24 +270,16 @@ void EhFrameSection<E>::apply_eh_reloc(Context<E> &ctx, const ElfRel<E> &rel,
  case R_NONE:
    break;
  case R_ARM_ABS32:
-    *(ul32 *)loc = val;
+    *(U32<E> *)loc = val;
    break;
  case R_ARM_REL32:
-    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
+    *(U32<E> *)loc = val - this->shdr.sh_addr - offset;
    break;
  default:
    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
  }
 }

-static Thunk<E> &get_reachable_thunk(OutputSection<E> &osec, u64 addr) {
-  auto it = std::upper_bound(osec.thunks.begin(), osec.thunks.end(), addr,
-                             [](u64 addr, std::unique_ptr<Thunk<E>> &thunk) {
-    return addr < thunk->get_addr();
-  });
-  return **it;
-}
-
 template <>
 void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
  std::span<const ElfRel<E>> rels = get_rels(ctx);
@@ -312,7 +307,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    auto get_arm_thunk_addr   = [&] { return sym.get_thunk_addr(ctx, P) + 4; };

    auto get_tlsdesc_trampoline_addr = [&] {
-      return get_reachable_thunk(*output_section, P).get_addr();
+      auto it = ranges::upper_bound(output_section->thunks, P, {},
+                                    [](std::unique_ptr<Thunk<E>> &thunk) {
+        return thunk->get_addr();
+      });
+      return (*it)->get_addr();
    };

    switch (rel.r_type) {
@@ -320,13 +319,13 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_ARM_TARGET1:
      break;
    case R_ARM_REL32:
-      *(ul32 *)loc = S + A - P;
+      *(U32<E> *)loc = S + A - P;
      break;
    case R_ARM_THM_CALL: {
      if (sym.is_remaining_undef_weak()) {
        // On ARM, calling an weak undefined symbol jumps to the
        // next instruction.
-        *(ul32 *)loc = 0x8000'f3af; // NOP.W
+        *(U32<E> *)loc = 0x8000'f3af; // NOP.W
        break;
      }

@@ -337,61 +336,61 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      i64 val2 = align_to(S + A - P, 4);

      if (T && is_int(val1, 25)) {
-        *(ul16 *)(loc + 2) |= 0x1000;  // BL
+        *(U16<E> *)(loc + 2) |= 0x1000;  // BL
        write_thm_b25(loc, val1);
      } else if (!T && is_int(val2, 25)) {
-        *(ul16 *)(loc + 2) &= ~0x1000; // BLX
+        *(U16<E> *)(loc + 2) &= ~0x1000; // BLX
        write_thm_b25(loc, val2);
      } else {
-        *(ul16 *)(loc + 2) |= 0x1000;  // BL
+        *(U16<E> *)(loc + 2) |= 0x1000;  // BL
        write_thm_b25(loc, get_thumb_thunk_addr() + A - P);
      }
      break;
    }
    case R_ARM_BASE_PREL:
-      *(ul32 *)loc = GOT + A - P;
+      *(U32<E> *)loc = GOT + A - P;
      break;
    case R_ARM_GOTOFF32:
-      *(ul32 *)loc = ((S + A) | T) - GOT;
+      *(U32<E> *)loc = ((S + A) | T) - GOT;
      break;
    case R_ARM_GOT_PREL:
    case R_ARM_TARGET2:
-      *(ul32 *)loc = GOT + G + A - P;
+      *(U32<E> *)loc = GOT + G + A - P;
      break;
    case R_ARM_GOT_BREL:
-      *(ul32 *)loc = G + A;
+      *(U32<E> *)loc = G + A;
      break;
    case R_ARM_CALL: {
      if (sym.is_remaining_undef_weak()) {
-        *(ul32 *)loc = 0xe320'f000; // NOP
+        *(U32<E> *)loc = 0xe320'f000; // NOP
        break;
      }

      // Just like THM_CALL, ARM_CALL relocation refers to either BL or
      // BLX instruction. We may need to rewrite BL → BLX or BLX → BL.
-      bool is_bl = ((*(ul32 *)loc & 0xff00'0000) == 0xeb00'0000);
-      bool is_blx = ((*(ul32 *)loc & 0xfe00'0000) == 0xfa00'0000);
+      bool is_bl = ((*(U32<E> *)loc & 0xff00'0000) == 0xeb00'0000);
+      bool is_blx = ((*(U32<E> *)loc & 0xfe00'0000) == 0xfa00'0000);
      if (!is_bl && !is_blx)
        Fatal(ctx) << *this << ": R_ARM_CALL refers to neither BL nor BLX";

      i64 val = S + A - P;
      if (is_int(val, 26)) {
        if (T) {
-          *(ul32 *)loc = 0xfa00'0000; // BLX
-          *(ul32 *)loc |= (bit(val, 1) << 24) | bits(val, 25, 2);
+          *(U32<E> *)loc = 0xfa00'0000; // BLX
+          *(U32<E> *)loc |= (bit(val, 1) << 24) | bits(val, 25, 2);
        } else {
-          *(ul32 *)loc = 0xeb00'0000; // BL
-          *(ul32 *)loc |= bits(val, 25, 2);
+          *(U32<E> *)loc = 0xeb00'0000; // BL
+          *(U32<E> *)loc |= bits(val, 25, 2);
        }
      } else {
-        *(ul32 *)loc = 0xeb00'0000; // BL
-        *(ul32 *)loc |= bits(get_arm_thunk_addr() + A - P, 25, 2);
+        *(U32<E> *)loc = 0xeb00'0000; // BL
+        *(U32<E> *)loc |= bits(get_arm_thunk_addr() + A - P, 25, 2);
      }
      break;
    }
    case R_ARM_JUMP24: {
      if (sym.is_remaining_undef_weak()) {
-        *(ul32 *)loc = 0xe320'f000; // NOP
+        *(U32<E> *)loc = 0xe320'f000; // NOP
        break;
      }

@@ -404,26 +403,26 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      i64 val = S + A - P;
      if (T || !is_int(val, 26))
        val = get_arm_thunk_addr() + A - P;
-      *(ul32 *)loc = (*(ul32 *)loc & 0xff00'0000) | bits(val, 25, 2);
+      *(U32<E> *)loc = (*(U32<E> *)loc & 0xff00'0000) | bits(val, 25, 2);
      break;
    }
    case R_ARM_PLT32:
      if (sym.is_remaining_undef_weak()) {
-        *(ul32 *)loc = 0xe320'f000; // NOP
+        *(U32<E> *)loc = 0xe320'f000; // NOP
      } else {
        u64 val = (T ? get_arm_thunk_addr() : S) + A - P;
-        *(ul32 *)loc = (*(ul32 *)loc & 0xff00'0000) | bits(val, 25, 2);
+        *(U32<E> *)loc = (*(U32<E> *)loc & 0xff00'0000) | bits(val, 25, 2);
      }
      break;
    case R_ARM_THM_JUMP8:
      check(S + A - P, -(1 << 8), 1 << 8);
-      *(ul16 *)loc &= 0xff00;
-      *(ul16 *)loc |= bits(S + A - P, 8, 1);
+      *(U16<E> *)loc &= 0xff00;
+      *(U16<E> *)loc |= bits(S + A - P, 8, 1);
      break;
    case R_ARM_THM_JUMP11:
      check(S + A - P, -(1 << 11), 1 << 11);
-      *(ul16 *)loc &= 0xf800;
-      *(ul16 *)loc |= bits(S + A - P, 11, 1);
+      *(U16<E> *)loc &= 0xf800;
+      *(U16<E> *)loc |= bits(S + A - P, 11, 1);
      break;
    case R_ARM_THM_JUMP19:
      check(S + A - P, -(1 << 20), 1 << 20);
@@ -431,7 +430,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_ARM_THM_JUMP24: {
      if (sym.is_remaining_undef_weak()) {
-        *(ul32 *)loc = 0x8000'f3af; // NOP
+        *(U32<E> *)loc = 0x8000'f3af; // NOP
        break;
      }

@@ -454,8 +453,8 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_ARM_PREL31:
      check(S + A - P, -(1LL << 30), 1LL << 30);
-      *(ul32 *)loc &= 0x8000'0000;
-      *(ul32 *)loc |= (S + A - P) & 0x7fff'ffff;
+      *(U32<E> *)loc &= 0x8000'0000;
+      *(U32<E> *)loc |= (S + A - P) & 0x7fff'ffff;
      break;
    case R_ARM_THM_MOVW_ABS_NC:
      write_thm_mov(loc, (S + A) | T);
@@ -473,19 +472,19 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      write_thm_mov(loc, (S + A) >> 16);
      break;
    case R_ARM_TLS_GD32:
-      *(ul32 *)loc = sym.get_tlsgd_addr(ctx) + A - P;
+      *(U32<E> *)loc = sym.get_tlsgd_addr(ctx) + A - P;
      break;
    case R_ARM_TLS_LDM32:
-      *(ul32 *)loc = ctx.got->get_tlsld_addr(ctx) + A - P;
+      *(U32<E> *)loc = ctx.got->get_tlsld_addr(ctx) + A - P;
      break;
    case R_ARM_TLS_LDO32:
-      *(ul32 *)loc = S + A - ctx.dtp_addr;
+      *(U32<E> *)loc = S + A - ctx.dtp_addr;
      break;
    case R_ARM_TLS_IE32:
-      *(ul32 *)loc = sym.get_gottp_addr(ctx) + A - P;
+      *(U32<E> *)loc = sym.get_gottp_addr(ctx) + A - P;
      break;
    case R_ARM_TLS_LE32:
-      *(ul32 *)loc = S + A - ctx.tp_addr;
+      *(U32<E> *)loc = S + A - ctx.tp_addr;
      break;
    case R_ARM_TLS_GOTDESC:
      // ARM32 TLSDESC uses the following code sequence to materialize
@@ -514,35 +513,35 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      //  .L2: .word   foo(gottpoff) + . - .L1
      if (sym.has_tlsdesc(ctx)) {
        // A is odd if the corresponding TLS_CALL is Thumb.
-        *(ul32 *)loc = sym.get_tlsdesc_addr(ctx) - P + A - ((A & 1) ? 6 : 4);
+        *(U32<E> *)loc = sym.get_tlsdesc_addr(ctx) - P + A - ((A & 1) ? 6 : 4);
      } else if (sym.has_gottp(ctx)) {
-        *(ul32 *)loc = sym.get_gottp_addr(ctx) - P + A - ((A & 1) ? 5 : 8);
+        *(U32<E> *)loc = sym.get_gottp_addr(ctx) - P + A - ((A & 1) ? 5 : 8);
      } else {
-        *(ul32 *)loc = S - ctx.tp_addr;
+        *(U32<E> *)loc = S - ctx.tp_addr;
      }
      break;
    case R_ARM_TLS_CALL:
      if (sym.has_tlsdesc(ctx)) {
-        *(ul32 *)loc = 0xeb00'0000; // bl 0
-        *(ul32 *)loc |= bits(get_tlsdesc_trampoline_addr() - P - 8, 25, 2);
+        *(U32<E> *)loc = 0xeb00'0000; // bl 0
+        *(U32<E> *)loc |= bits(get_tlsdesc_trampoline_addr() - P - 8, 25, 2);
      } else if (sym.has_gottp(ctx)) {
-        *(ul32 *)loc = 0xe79f'0000; // ldr r0, [pc, r0]
+        *(U32<E> *)loc = 0xe79f'0000; // ldr r0, [pc, r0]
      } else {
-        *(ul32 *)loc = 0xe320'f000; // nop
+        *(U32<E> *)loc = 0xe320'f000; // nop
      }
      break;
    case R_ARM_THM_TLS_CALL:
      if (sym.has_tlsdesc(ctx)) {
        u64 val = align_to(get_tlsdesc_trampoline_addr() - P - 4, 4);
        write_thm_b25(loc, val);
-        *(ul16 *)(loc + 2) &= ~0x1000; // rewrite BL with BLX
+        *(U16<E> *)(loc + 2) &= ~0x1000; // rewrite BL with BLX
      } else if (sym.has_gottp(ctx)) {
        // Since `ldr r0, [pc, r0]` is not representable in Thumb,
        // we use two instructions instead.
-        *(ul16 *)loc = 0x4478;         // add r0, pc
-        *(ul16 *)(loc + 2) = 0x6800;   // ldr r0, [r0]
+        *(U16<E> *)loc = 0x4478;         // add r0, pc
+        *(U16<E> *)(loc + 2) = 0x6800;   // ldr r0, [r0]
      } else {
-        *(ul32 *)loc = 0x8000'f3af;    // nop.w
+        *(U32<E> *)loc = 0x8000'f3af;    // nop.w
      }
      break;
    default:
@@ -573,15 +572,15 @@ void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
    switch (rel.r_type) {
    case R_ARM_ABS32:
      if (std::optional<u64> val = get_tombstone(sym, frag))
-        *(ul32 *)loc = *val;
+        *(U32<E> *)loc = *val;
      else
-        *(ul32 *)loc = S + A;
+        *(U32<E> *)loc = S + A;
      break;
    case R_ARM_TLS_LDO32:
      if (std::optional<u64> val = get_tombstone(sym, frag))
-        *(ul32 *)loc = *val;
+        *(U32<E> *)loc = *val;
      else
-        *(ul32 *)loc = S + A - ctx.dtp_addr;
+        *(U32<E> *)loc = S + A - ctx.dtp_addr;
      break;
    default:
      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
@@ -695,27 +694,28 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_hdr_size == sizeof(hdr));
  static_assert(E::thunk_size == sizeof(entry));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  memcpy(buf, hdr, sizeof(hdr));
-  buf += sizeof(hdr);
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
+  memcpy(base, hdr, sizeof(hdr));

-  u64 P = output_section.shdr.sh_addr + offset + sizeof(hdr);
-
-  for (Symbol<E> *sym : symbols) {
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];
    memcpy(buf, entry, sizeof(entry));
-    *(ul32 *)(buf + 12) = sym->get_addr(ctx) - P - 16;
-
-    buf += sizeof(entry);
-    P += sizeof(entry);
+    *(U32<E> *)(buf + 12) = S - P - 16;
  }
 }

 template <>
 u64 get_eflags(Context<E> &ctx) {
-  return EF_ARM_EABI_VER5;
+  if constexpr (E::is_le)
+    return EF_ARM_EABI_VER5;
+  else
+    return EF_ARM_EABI_VER5 | EF_ARM_BE8;
 }

-void create_arm_exidx_section(Context<E> &ctx) {
+template <>
+void create_arm_exidx_section<E>(Context<E> &ctx) {
  for (i64 i = 0; i < ctx.chunks.size(); i++) {
    OutputSection<E> *osec = ctx.chunks[i]->to_osec();

@@ -732,28 +732,20 @@ void create_arm_exidx_section(Context<E> &ctx) {
  }
 }

-void Arm32ExidxSection::compute_section_size(Context<E> &ctx) {
+template <>
+void Arm32ExidxSection<E>::compute_section_size(Context<E> &ctx) {
  output_section.compute_section_size(ctx);
  this->shdr.sh_size = output_section.shdr.sh_size + 8; // +8 for sentinel
 }

-void Arm32ExidxSection::update_shdr(Context<E> &ctx) {
+template <>
+void Arm32ExidxSection<E>::update_shdr(Context<E> &ctx) {
  // .ARM.exidx's sh_link should be set to the .text section index.
  // Runtime doesn't care about it, but the binutils's strip command does.
  if (Chunk<E> *chunk = find_chunk(ctx, ".text"))
    this->shdr.sh_link = chunk->shndx;
 }

-void Arm32ExidxSection::remove_duplicate_entries(Context<E> &ctx) {
-  this->shdr.sh_size = get_contents(ctx).size();
-}
-
-void Arm32ExidxSection::copy_buf(Context<E> &ctx) {
-  std::vector<u8> contents = get_contents(ctx);
-  assert(this->shdr.sh_size == contents.size());
-  write_vector(ctx.buf + this->shdr.sh_offset, contents);
-}
-
 // Returns the end of the text segment
 static u64 get_text_end(Context<E> &ctx) {
  u64 ret = 0;
@@ -772,7 +764,8 @@ static u64 get_text_end(Context<E> &ctx) {
 // likely that it's due to some historical reason.
 //
 // This function returns contents of .ARM.exidx.
-std::vector<u8> Arm32ExidxSection::get_contents(Context<E> &ctx) {
+template <>
+std::vector<u8> Arm32ExidxSection<E>::get_contents(Context<E> &ctx) {
  // .ARM.exidx records consists of a signed 31-bit relative address
  // and a 32-bit value. The relative address indicates the start
  // address of a function that the record covers. The value is one of
@@ -788,8 +781,8 @@ std::vector<u8> Arm32ExidxSection::get_contents(Context<E> &ctx) {
  const u32 CANTUNWIND = 1;

  struct Entry {
-    ul32 addr;
-    ul32 val;
+    U32<E> addr;
+    U32<E> val;
  };

  // We reserve one extra slot for the sentinel
@@ -820,19 +813,13 @@ std::vector<u8> Arm32ExidxSection::get_contents(Context<E> &ctx) {
      ent[i].val = 0x7fff'ffff & (ent[i].val + offset);
  });

-  std::sort(ent, ent + num_entries, [](const Entry &a, const Entry &b) {
-    return a.addr < b.addr;
-  });
+  ranges::sort(ent, ent + num_entries, {}, &Entry::addr);

  // Remove duplicate adjacent entries. That is, if two adjacent functions
  // have the same compact unwind info or are both CANTUNWIND, we can
  // merge them into a single address range.
-  auto it = std::unique(ent, ent + num_entries,
-                        [](const Entry &a, const Entry &b) {
-    return a.val == b.val;
-  });
-
-  num_entries = it - ent;
+  auto tail = ranges::unique(ent, ent + num_entries, {}, &Entry::val);
+  num_entries -= tail.size();
  buf.resize(num_entries * sizeof(Entry));

  // Make addresses relative to themselves.
@@ -846,4 +833,84 @@ std::vector<u8> Arm32ExidxSection::get_contents(Context<E> &ctx) {
  return buf;
 }

+template <>
+void Arm32ExidxSection<E>::remove_duplicate_entries(Context<E> &ctx) {
+  this->shdr.sh_size = get_contents(ctx).size();
+}
+
+template <>
+void Arm32ExidxSection<E>::copy_buf(Context<E> &ctx) {
+  std::vector<u8> contents = get_contents(ctx);
+  assert(this->shdr.sh_size == contents.size());
+  write_vector(ctx.buf + this->shdr.sh_offset, contents);
+}
+
+// Even though using ARM32 in big-endian mode is very rare, the processor
+// technically supports both little- and big-endian modes. There are two
+// variants of big-endian mode: BE32 and BE8. In BE32, instructions and
+// data are encoded in big-endian. In BE8, instructions are encoded in
+// little-endian, and only data is in big-endian. BE8 is the de facto
+// standard for ARMv6 or later. We support only BE8.
+//
+// A tricky thing is that instructions in an object file are always
+// big-endian if the file is compiled for big-endian mode. In other words,
+// the compiler always emit code in BE32 if -mbig-endian is specified. It
+// is the linker's responsibility to rewrite instructions from big-endian
+// to little-endian for an BE8 output. This function does that.
+//
+// The text section may contain a mix of 32-bit ARM instructions, 16-bit
+// Thumb instructions, and data. We need to distinguish them to swap 4
+// bytes, 2 bytes, or not swap bytes, respectively. The beginning of ARM
+// code, Thumb code, and data is labeled with a mapping symbol of $a, $t,
+// and $d, respectively. We use mapping symbols to determine what to do
+// with the text section.
+//
+// This function is called after we copy the input section contents to the
+// output file. We rewrite instructions in the output buffer in place.
+#if MOLD_ARM32BE
+void arm32be_swap_bytes(Context<E> &ctx) {
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    // Collect mapping symbols
+    std::vector<Symbol<E> *> syms;
+
+    for (Symbol<E> *sym : file->get_local_syms())
+      if (InputSection<E> *isec = sym->get_input_section())
+        if (isec->is_alive && (isec->shdr().sh_flags & SHF_EXECINSTR))
+          if (std::string_view x = sym->name();
+              x == "$a" || x.starts_with("$a.") ||
+              x == "$t" || x.starts_with("$t.") ||
+              x == "$d" || x.starts_with("$d."))
+            syms.push_back(sym);
+
+    // Group mapping symbols by input section and sort by address
+    ranges::stable_sort(syms, {}, [](const Symbol<E> *sym) {
+      return std::tuple{(uintptr_t)sym->get_input_section(), sym->value};
+    });
+
+    // Swap bytes
+    for (i64 i = 0; i < syms.size(); i++) {
+      Symbol<E> &sym = *syms[i];
+      if (sym.name().starts_with("$d"))
+        continue;
+
+      InputSection<E> &isec = *sym.get_input_section();
+      u8 *base = ctx.buf + isec.output_section->shdr.sh_offset + isec.offset;
+      u8 *start = base + sym.value;
+      u8 *end;
+
+      if (i + 1 < syms.size() && syms[i + 1]->get_input_section() == &isec)
+        end = base + syms[i + 1]->value;
+      else
+        end = base + isec.sh_size;
+
+      i64 sz = sym.name().starts_with("$a") ? 4 : 2;
+      for (u8 *p = start; p < end; p += sz)
+        std::reverse(p, p + sz);
+    }
+  });
+}
+#endif
+
 } // namespace mold
+
+#endif
@@ -208,6 +208,30 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_AARCH64_MOVW_UABS_G3:
      *(ul32 *)loc |= bits(S + A, 63, 48) << 5;
      break;
+    case R_AARCH64_MOVW_PREL_G0:
+      check(S + A - P, -(1 << 15), 1 << 15);
+      write_movn_movz(loc, S + A - P);
+      break;
+    case R_AARCH64_MOVW_PREL_G0_NC:
+      *(ul32 *)loc |= bits(S + A - P, 15, 0) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G1:
+      check(S + A - P, -(1LL << 31), 1LL << 31);
+      write_movn_movz(loc, (i64)(S + A - P) >> 16);
+      break;
+    case R_AARCH64_MOVW_PREL_G1_NC:
+      *(ul32 *)loc |= bits(S + A - P, 31, 16) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G2:
+      check(S + A - P, -(1LL << 47), 1LL << 47);
+      write_movn_movz(loc, (i64)(S + A - P) >> 32);
+      break;
+    case R_AARCH64_MOVW_PREL_G2_NC:
+      *(ul32 *)loc |= bits(S + A - P, 47, 32) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G3:
+      *(ul32 *)loc |= bits(S + A - P, 63, 48) << 5;
+      break;
    case R_AARCH64_ADR_GOT_PAGE:
      if (sym.has_got(ctx)) {
        i64 val = page(G + GOT + A) - page(P);
@@ -283,6 +307,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check(S + A - P, -(1LL << 31), 1LL << 31);
      *(U32<E> *)loc = S + A - P;
      break;
+    case R_AARCH64_GOTPCREL32:
+      check(G + GOT + A - P, -(1LL << 31), 1LL << 31);
+      *(U32<E> *)loc = G + GOT + A - P;
+      break;
    case R_AARCH64_CONDBR19:
    case R_AARCH64_LD_PREL_LO19:
      check(S + A - P, -(1LL << 20), 1LL << 20);
@@ -525,6 +553,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      break;
    case R_AARCH64_LD64_GOT_LO12_NC:
    case R_AARCH64_LD64_GOTPAGE_LO15:
+    case R_AARCH64_GOTPCREL32:
      sym.flags |= NEEDS_GOT;
      break;
    case R_AARCH64_CALL26:
@@ -568,6 +597,13 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_AARCH64_MOVW_UABS_G1_NC:
    case R_AARCH64_MOVW_UABS_G2:
    case R_AARCH64_MOVW_UABS_G2_NC:
+    case R_AARCH64_MOVW_PREL_G0:
+    case R_AARCH64_MOVW_PREL_G0_NC:
+    case R_AARCH64_MOVW_PREL_G1:
+    case R_AARCH64_MOVW_PREL_G1_NC:
+    case R_AARCH64_MOVW_PREL_G2:
+    case R_AARCH64_MOVW_PREL_G2_NC:
+    case R_AARCH64_MOVW_PREL_G3:
    case R_AARCH64_PREL16:
    case R_AARCH64_PREL32:
    case R_AARCH64_PREL64:
@@ -587,31 +623,81 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
  }
 }

+// The size of a thunk entry varies on ARM64 depending on the distance to
+// the branch target. This function computes the size of each thunk entry.
+template <>
+void Thunk<E>::shrink_size(Context<E> &ctx) {
+  offsets.clear();
+  offsets.push_back(0);
+  i64 off = 0;
+
+  // The distance between S and P is only reduced by shrink_size(), but
+  // page(S) – page(P) may still increase by one page due to address
+  // changes, so we add a safety margin.
+  //
+  // For example, page(0x1200) – page(0x1000) is 0, whereas
+  // page(0x1100) – page(0xfff) is 0x1000, even though the latter
+  // distance is shorter than the former.
+  auto is_small = [](i64 prel) {
+    return is_int(prel + 0x1000, 33) && is_int(prel - 0x1000, 33);
+  };
+
+  for (Symbol<E> *sym : symbols) {
+    u64 S = sym->get_addr(ctx);
+    u64 P = get_addr() + off;
+    i64 prel = page(S) - page(P);
+    off += is_small(prel) ? 16 : 32;
+    offsets.push_back(off);
+  }
+}
+
 template <>
 void Thunk<E>::copy_buf(Context<E> &ctx) {
-  constexpr ul32 insn[] = {
-    0x9000'0010, // adrp x16, 0   # R_AARCH64_ADR_PREL_PG_HI21
-    0x9100'0210, // add  x16, x16 # R_AARCH64_ADD_ABS_LO12_NC
+  // Short thunk with a 33 bit displacement
+  constexpr ul32 insn1[] = {
+    0x9000'0010, // adrp x16, 0
+    0x9100'0210, // add  x16, x16
    0xd61f'0200, // br   x16
    0xd420'7d00, // brk
  };

-  static_assert(E::thunk_size == sizeof(insn));
+  // Long thunk with a 64 bit displacement
+  constexpr ul32 insn2[] = {
+    0x1000'0010, // adr  x16, 0
+    0xd2a0'0011, // movz x17, 0, lsl #16
+    0xf2c0'0011, // movk x17, 0, lsl #32
+    0xf2e0'0011, // movk x17, 0, lsl #48
+    0x8b11'0210, // add  x16, x16, x17
+    0xd61f'0200, // br   x16
+    0xd420'7d00, // brk
+    0xd420'7d00, // brk
+  };

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;

-  for (Symbol<E> *sym : symbols) {
-    u64 S = sym->get_addr(ctx);
-    memcpy(buf, insn, E::thunk_size);
-    write_adrp(buf, page(S) - page(P));
-    *(ul32 *)(buf + 4) |= bits(S, 11, 0) << 10;
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];

-    buf += E::thunk_size;
-    P += E::thunk_size;
+    if (offsets[i + 1] - offsets[i] == 16) {
+      i64 prel = page(S) - page(P);
+      assert(is_int(prel, 33));
+      memcpy(buf, insn1, sizeof(insn1));
+      write_adrp(buf, prel);
+      *(ul32 *)(buf + 4) |= bits(S, 11, 0) << 10;
+    } else {
+      memcpy(buf, insn2, sizeof(insn2));
+      write_adr(buf, bits(S - P, 15, 0));
+      *(ul32 *)(buf + 4) |= bits(S - P, 31, 16) << 5;
+      *(ul32 *)(buf + 8) |= bits(S - P, 47, 32) << 5;
+      *(ul32 *)(buf + 12) |= bits(S - P, 63, 48) << 5;
+    }
  }
 }

+template class Thunk<E>;
+
 } // namespace mold

 #endif
@@ -33,6 +33,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/i386.pdf

+#if MOLD_I386
+
 #include "mold.h"

 namespace mold {
@@ -44,10 +46,10 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
  switch (rel.r_type) {
  case R_386_8:
  case R_386_PC8:
-    return *loc;
+    return *(i8 *)loc;
  case R_386_16:
  case R_386_PC16:
-    return *(ul16 *)loc;
+    return *(il16 *)loc;
  case R_386_32:
  case R_386_PC32:
  case R_386_GOT32:
@@ -63,7 +65,7 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
  case R_386_TLS_LDO_32:
  case R_386_SIZE32:
  case R_386_TLS_GOTDESC:
-    return *(ul32 *)loc;
+    return *(il32 *)loc;
  default:
    return 0;
  }
@@ -596,3 +598,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -66,7 +66,7 @@ static u64 higher(u64 val, u64 pc) {
  // LU52I.D simply set bits to [51:31] and to [63:53], respectively.
  //
  // Compensating all the sign-extensions is a bit complicated. The
-  // psABI gave the following formula.
+  // psABI gives the following formula.
  val = val + 0x8000'0000 + ((val & 0x800) ? (0x1000 - 0x1'0000'0000) : 0);
  return page(val) - page(pc - 8);
 }
@@ -518,6 +518,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ul64 *)loc -= S + A;
      break;
    case R_LARCH_32_PCREL:
+      check(S + A - P, -(1LL << 31), 1LL << 31);
      *(ul32 *)loc = S + A - P;
      break;
    case R_LARCH_64_PCREL:
@@ -980,7 +981,7 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
      //   pcaddi    $t0, <offset>
      if (is_relaxable_got_load(ctx, isec, i))
        if (i64 dist = compute_distance(ctx, sym, isec, r);
-            is_int(dist, 22))
+            is_int(dist, 22) && (dist & 3) == 0)
          remove(4);
      break;
    case R_LARCH_TLS_DESC_PC_HI20:
@@ -1009,6 +1010,87 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
  isec.sh_size -= r_delta;
 }

+// With --emit-relocs, rewrite the emitted relocations to match the
+// instructions that relaxation produced. The logic parallels apply_reloc_alloc.
+template <>
+void rewrite_reloc_types(Context<E> &ctx, InputSection<E> &isec, ElfRel<E> *buf) {
+  std::span<const ElfRel<E>> rels = isec.get_rels(ctx);
+  std::span<RelocDelta> deltas = isec.extra.r_deltas;
+  i64 k = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+
+    i64 removed_bytes = 0;
+    if (!deltas.empty()) {
+      while (k < deltas.size() && deltas[k].offset < rel.r_offset)
+        k++;
+      if (k < deltas.size() && deltas[k].offset == rel.r_offset)
+        removed_bytes = get_removed_bytes(deltas, k);
+    }
+
+    switch (rel.r_type) {
+    case R_LARCH_TLS_LE_HI20_R:
+    case R_LARCH_TLS_LE_ADD_R:
+      // lu12i.w + add.d + addi.d => addi.d
+      if (removed_bytes)
+        buf[i].r_type = R_LARCH_NONE;
+      break;
+    case R_LARCH_PCALA_HI20:
+    case R_LARCH_GOT_PC_HI20:
+      // pcalau12i + addi.d/ld.d => pcaddi. The high part vanishes and the low
+      // part becomes the pcaddi's PC-relative relocation.
+      if (removed_bytes) {
+        buf[i].r_type = R_LARCH_NONE;
+        buf[i + 2].r_type = R_LARCH_PCREL20_S2;
+        i += 3;
+      }
+      break;
+    case R_LARCH_CALL36:
+      // pcaddu18i + jirl => b or bl
+      if (removed_bytes)
+        buf[i].r_type = R_LARCH_B26;
+      break;
+    case R_LARCH_TLS_DESC_PC_HI20:
+      // pcalau12i + addi.d => pcaddi when TLSDESC is kept; both deleted when it
+      // is relaxed to IE/LE.
+      if (!sym.has_tlsdesc(ctx)) {
+        buf[i].r_type = R_LARCH_NONE;
+      } else if (removed_bytes) {
+        buf[i].r_type = R_LARCH_NONE;
+        buf[i + 2].r_type = R_LARCH_TLS_DESC_PCREL20_S2;
+      }
+      break;
+    case R_LARCH_TLS_DESC_PC_LO12:
+      if (!sym.has_tlsdesc(ctx))
+        buf[i].r_type = R_LARCH_NONE;
+      break;
+    case R_LARCH_TLS_DESC_LD:
+      // TLSDESC is relaxed to IE or LE. The ld.d slot holds the first
+      // instruction of the resulting sequence.
+      if (sym.has_tlsdesc(ctx))
+        break;
+      if (sym.has_gottp(ctx))
+        buf[i].r_type = R_LARCH_TLS_IE_PC_HI20;   // pcalau12i
+      else if (removed_bytes)
+        buf[i].r_type = R_LARCH_NONE;             // small TP offset (deleted)
+      else
+        buf[i].r_type = R_LARCH_TLS_LE_HI20;      // large TP offset (lu12i.w)
+      break;
+    case R_LARCH_TLS_DESC_CALL:
+      // The jirl slot holds the second instruction of the IE or LE sequence.
+      if (sym.has_tlsdesc(ctx))
+        break;
+      if (sym.has_gottp(ctx))
+        buf[i].r_type = R_LARCH_TLS_IE_PC_LO12;   // ld.d
+      else
+        buf[i].r_type = R_LARCH_TLS_LE_LO12;      // ori or addi.w
+      break;
+    }
+  }
+}
+
 } // namespace mold

 #endif
@@ -14,6 +14,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/m68k.pdf

+#if MOLD_M68K
+
 #include "mold.h"

 namespace mold {
@@ -310,3 +312,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -40,6 +40,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc32.pdf

+#if MOLD_PPC32
+
 #include "mold.h"

 namespace mold {
@@ -306,6 +308,12 @@ void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
      else
        *(ub32 *)loc = S + A;
      break;
+    case R_PPC_DTPREL32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub32 *)loc = *val;
+      else
+        *(ub32 *)loc = S + A - ctx.dtp_addr;
+      break;
    default:
      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
                 << rel;
@@ -416,27 +424,28 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(plt_entry));
  static_assert(E::thunk_size == sizeof(local_thunk));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_plt(ctx)) {
-      u64 got =
-        sym->has_got(ctx) ? sym->get_got_addr(ctx) : sym->get_gotplt_addr(ctx);
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];
+
+    if (sym.has_plt(ctx)) {
+      u64 got = sym.has_got(ctx) ? sym.get_got_addr(ctx) : sym.get_gotplt_addr(ctx);
      i64 val = got - P - 8;
      memcpy(buf, plt_entry, sizeof(plt_entry));
      *(ub32 *)(buf + 16) |= higha(val);
      *(ub32 *)(buf + 20) |= lo(val);
    } else {
-      i64 val = sym->get_addr(ctx) - P - 8;
+      i64 val = sym.get_addr(ctx) - P - 8;
      memcpy(buf, local_thunk, sizeof(local_thunk));
      *(ub32 *)(buf + 16) |= higha(val);
      *(ub32 *)(buf + 20) |= lo(val);
    }
-
-    buf += E::thunk_size;
-    P += E::thunk_size;
  }
 }

 } // namespace mold
+
+#endif
@@ -45,6 +45,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc64v1.pdf

+#if MOLD_PPC64V1
+
 #include "mold.h"

 #include <algorithm>
@@ -217,6 +219,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_PPC64_REL16_LO:
      *(ub16 *)loc = lo(S + A - P);
      break;
+    case R_PPC64_GOT16:
+      *(ub16 *)loc = G - TOC;
+      break;
    case R_PPC64_PLT16_HA:
      *(ub16 *)loc = ha(G + GOT - TOC);
      break;
@@ -351,6 +356,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      if (sym.is_imported)
        sym.flags |= NEEDS_PLT;
      break;
+    case R_PPC64_GOT16:
    case R_PPC64_PLT16_HA:
      sym.flags |= NEEDS_GOT;
      break;
@@ -452,49 +458,46 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(plt_thunk));
  static_assert(E::thunk_size == sizeof(local_thunk));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
+  u64 TOC = ctx.extra.TOC->value;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_got(ctx)) {
-      i64 val = sym->get_got_addr(ctx) - ctx.extra.TOC->value;
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u8 *buf = base + offsets[i];
+
+    if (sym.has_got(ctx)) {
      memcpy(buf, pltgot_thunk, sizeof(pltgot_thunk));
+      i64 val = sym.get_got_addr(ctx) - TOC;
      *(ub32 *)(buf + 4) |= higha(val);
      *(ub32 *)(buf + 8) |= lo(val);
-    } else if(sym->has_plt(ctx)) {
-      i64 val = sym->get_gotplt_addr(ctx) - ctx.extra.TOC->value;
+    } else if(sym.has_plt(ctx)) {
      memcpy(buf, plt_thunk, sizeof(plt_thunk));
+      i64 val = sym.get_gotplt_addr(ctx) - TOC;
      *(ub32 *)(buf + 4) |= higha(val);
      *(ub32 *)(buf + 8) |= lo(val);
    } else {
-      i64 val = sym->get_addr(ctx, NO_OPD) - ctx.extra.TOC->value;
      memcpy(buf, local_thunk, sizeof(local_thunk));
+      i64 val = sym.get_addr(ctx, NO_OPD) - TOC;
      *(ub32 *)buf |= higha(val);
      *(ub32 *)(buf + 4) |= lo(val);
    }
-
-    buf += E::thunk_size;
  }
 }

 static InputSection<E> *get_opd_section(ObjectFile<E> &file) {
  for (std::unique_ptr<InputSection<E>> &isec : file.sections)
-    if (isec && isec->name() == ".opd")
+    if (isec && isec->name == ".opd")
      return isec.get();
  return nullptr;
 }

 static ElfRel<E> *
-get_relocation_at(Context<E> &ctx, InputSection<E> &isec, i64 offset) {
+get_relocation_at(Context<E> &ctx, InputSection<E> &isec, u64 offset) {
  std::span<ElfRel<E>> rels = isec.get_rels(ctx);
-
-  auto it = std::lower_bound(rels.begin(), rels.end(), offset,
-                             [](const ElfRel<E> &r, i64 offset) {
-    return r.r_offset < offset;
+  auto it = ranges::lower_bound(rels, offset, {}, [](const ElfRel<E> &r) {
+    return (u64)r.r_offset;
  });
-
-  if (it == rels.end())
-    return nullptr;
-  if (it->r_offset != offset)
+  if (it == rels.end() || it->r_offset != offset)
    return nullptr;
  return &*it;
 }
@@ -509,9 +512,7 @@ struct OpdSymbol {
 static Symbol<E> *
 get_opd_sym_at(std::span<OpdSymbol> syms, u64 offset) {
  auto it = ranges::lower_bound(syms, offset, {}, &OpdSymbol::r_offset);
-  if (it == syms.end())
-    return nullptr;
-  if (it->r_offset != offset)
+  if (it == syms.end() || it->r_offset != offset)
    return nullptr;
  return it->sym;
 }
@@ -642,31 +643,31 @@ void PPC64OpdSection::add_symbol(Context<E> &ctx, Symbol<E> *sym) {
  this->shdr.sh_size += ENTRY_SIZE;
 }

-i64 PPC64OpdSection::get_reldyn_size(Context<E> &ctx) const {
-  if (ctx.arg.pic)
-    return symbols.size() * 2;
-  return 0;
+std::vector<ElfRel<E>> PPC64OpdSection::collect_dynrels(Context<E> &ctx) const {
+  if (!ctx.arg.pic)
+    return {};
+
+  std::vector<ElfRel<E>> rels;
+
+  for (Symbol<E> *sym : symbols) {
+    u64 loc = sym->get_opd_addr(ctx);
+    rels.emplace_back(loc, E::R_RELATIVE, 0, sym->get_addr(ctx, NO_PLT | NO_OPD));
+    rels.emplace_back(loc + 8, E::R_RELATIVE, 0, ctx.extra.TOC->value);
+  }
+  return rels;
 }

 void PPC64OpdSection::copy_buf(Context<E> &ctx) {
  ub64 *buf = (ub64 *)(ctx.buf + this->shdr.sh_offset);

-  ElfRel<E> *rel = nullptr;
-  if (ctx.arg.pic)
-    rel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset + reldyn_offset);
-
  for (Symbol<E> *sym : symbols) {
    u64 addr = sym->get_addr(ctx, NO_PLT | NO_OPD);
    *buf++ = addr;
    *buf++ = ctx.extra.TOC->value;
    *buf++ = 0;
-
-    if (ctx.arg.pic) {
-      u64 loc = sym->get_opd_addr(ctx);
-      *rel++ = ElfRel<E>(loc, E::R_RELATIVE, 0, addr);
-      *rel++ = ElfRel<E>(loc + 8, E::R_RELATIVE, 0, ctx.extra.TOC->value);
-    }
  }
 }

 } // namespace mold
+
+#endif
@@ -80,6 +80,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc64v2.pdf

+#if MOLD_PPC64V2
+
 #include "mold.h"

 namespace mold {
@@ -243,6 +245,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ul32 *)loc |= bits(val, 25, 2) << 2;
      }
      break;
+    case R_PPC64_REL14:
+      *(ul32 *)loc |= bits(S + A - P, 15, 2) << 2;
+      break;
    case R_PPC64_REL32:
      *(ul32 *)loc = S + A - P;
      break;
@@ -255,6 +260,18 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_PPC64_REL16_LO:
      *(ul16 *)loc = lo(S + A - P);
      break;
+    case R_PPC64_GOT16:
+      *(ul16 *)loc = G - TOC;
+      break;
+    case R_PPC64_GOT16_LO:
+      *(ul16 *)loc = lo(G - TOC);
+      break;
+    case R_PPC64_GOT16_HI:
+      *(ul16 *)loc = hi(G - TOC);
+      break;
+    case R_PPC64_GOT16_HA:
+      *(ul16 *)loc = ha(G - TOC);
+      break;
    case R_PPC64_PLT16_HA:
      *(ul16 *)loc = ha(G + GOT - TOC);
      break;
@@ -416,6 +433,10 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_PLT;
      ctx.extra.is_power10 = true;
      break;
+    case R_PPC64_GOT16:
+    case R_PPC64_GOT16_LO:
+    case R_PPC64_GOT16_HI:
+    case R_PPC64_GOT16_HA:
    case R_PPC64_PLT16_HA:
    case R_PPC64_PLT_PCREL34:
    case R_PPC64_PLT_PCREL34_NOTOC:
@@ -431,12 +452,11 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      ctx.needs_tlsld = true;
      break;
    case R_PPC64_TPREL16_HA:
-    case R_PPC64_TPREL16_LO:
-    case R_PPC64_TPREL16_LO_DS:
    case R_PPC64_TPREL34:
      check_tlsle(ctx, sym, rel);
      break;
    case R_PPC64_ADDR64:
+    case R_PPC64_REL14:
    case R_PPC64_REL32:
    case R_PPC64_REL64:
    case R_PPC64_TOC16_HA:
@@ -456,6 +476,8 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_PPC64_GOT_TPREL16_LO_DS:
    case R_PPC64_GOT_TLSGD16_LO:
    case R_PPC64_GOT_TLSLD16_LO:
+    case R_PPC64_TPREL16_LO:
+    case R_PPC64_TPREL16_LO_DS:
    case R_PPC64_TLS:
    case R_PPC64_TLSGD:
    case R_PPC64_TLSLD:
@@ -518,15 +540,16 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(local_thunk));
  static_assert(E::thunk_size == sizeof(local_thunk_power10));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
  u64 TOC = ctx.extra.TOC->value;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_plt(ctx)) {
-      u64 got =
-        sym->has_got(ctx) ? sym->get_got_addr(ctx) : sym->get_gotplt_addr(ctx);
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];

+    if (sym.has_plt(ctx)) {
+      u64 got = sym.has_got(ctx) ? sym.get_got_addr(ctx) : sym.get_gotplt_addr(ctx);
      if (ctx.extra.is_power10) {
        memcpy(buf, plt_thunk_power10, E::thunk_size);
        write34(buf + 8, got - P - 8);
@@ -536,7 +559,7 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
        *(ul32 *)(buf + 12) |= lo(got - TOC);
      }
    } else {
-      u64 S = sym->get_addr(ctx);
+      u64 S = sym.get_addr(ctx);
      if (ctx.extra.is_power10) {
        memcpy(buf, local_thunk_power10, E::thunk_size);
        write34(buf + 8, S - P - 8);
@@ -546,9 +569,6 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
        *(ul32 *)(buf + 12) |= lo(S - TOC);
      }
    }
-
-    buf += E::thunk_size;
-    P += E::thunk_size;
  }
 }

@@ -658,3 +678,5 @@ u64 get_eflags(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -301,10 +301,15 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check_range(ctx, i, val, lo, hi);
    };

+    auto utype = [&](i64 val) {
+      check(val, -(1LL << 31) - 0x800, (1LL << 31) - 0x800);
+      write_utype(loc, val);
+    };
+
    switch (rel.r_type) {
    case R_RISCV_32:
-      assert(E::is_64);
-      *(U32<E> *)loc = S + A;
+      if (E::is_64)
+        *(U32<E> *)loc = S + A;
      break;
    case R_RISCV_64:
      break;
@@ -321,12 +326,6 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      i64 val = S + A - P;
      i64 rd = get_rd(buf + rel.r_offset + 4);

-      // Calling an undefined weak symbol does not make sense.
-      // We make such call into an infinite loop. This should
-      // help debugging of a faulty program.
-      if (sym.esym().is_undef_weak())
-        val = 0;
-
      if (removed_bytes == 4) {
        // auipc + jalr -> jal
        *(ul32 *)loc = (rd << 7) | 0b1101111;
@@ -342,8 +341,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        write_cjtype(loc, val);
      } else {
        assert(removed_bytes == 0);
-        check(val, -(1LL << 31), 1LL << 31);
-        write_utype(loc, val);
+        utype(val);
        write_itype(loc + 4, val);
      }
      break;
@@ -372,26 +370,26 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        if (ctx.arg.relax && sym.is_pcrel_linktime_const(ctx) &&
            is_got_load_pair(ctx, *this, rels, i) && is_int(val, 32)) {
          // auipc <rd>, %hi20(val)
-          write_utype(loc, val);
+          utype(val);

          // addi <rd>, <rd>, %lo12(val)
          *(ul32 *)(loc + 4) = 0b0010011 | (rd << 15) | (rd << 7);
          write_itype(loc + 4, val);
          i += 3;
        } else {
-          write_utype(loc, G + GOT + A - P);
+          utype(G + GOT + A - P);
        }
      }
      break;
    }
    case R_RISCV_TLS_GOT_HI20:
-      write_utype(loc, sym.get_gottp_addr(ctx) + A - P);
+      utype(sym.get_gottp_addr(ctx) + A - P);
      break;
    case R_RISCV_TLS_GD_HI20:
-      write_utype(loc, sym.get_tlsgd_addr(ctx) + A - P);
+      utype(sym.get_tlsgd_addr(ctx) + A - P);
      break;
    case R_RISCV_PCREL_HI20:
-      write_utype(loc, S + A - P);
+      utype(S + A - P);
      break;
    case R_RISCV_PCREL_LO12_I:
    case R_RISCV_PCREL_LO12_S: {
@@ -429,8 +427,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ul16 *)loc = 0b011'0'00000'00000'01 | (rd << 7);
        write_citype(loc, (S + A + 0x800) >> 12);
      } else if (removed_bytes == 0) {
-        check(S + A, -(1LL << 31), 1LL << 31);
-        write_utype(loc, S + A);
+        utype(S + A);
      }
      break;
    case R_RISCV_LO12_I:
@@ -449,7 +446,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_RISCV_TPREL_HI20:
      assert(removed_bytes == 0 || removed_bytes == 4);
      if (removed_bytes == 0)
-        write_utype(loc, S + A - ctx.tp_addr);
+        utype(S + A - ctx.tp_addr);
      break;
    case R_RISCV_TPREL_ADD:
      // This relocation just annotates an ADD instruction that can be
@@ -473,7 +470,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    }
    case R_RISCV_TLSDESC_HI20:
      // RISC-V TLSDESC uses the following code sequence to materialize
-      // a TP-relative address in x0.
+      // a TP-relative address in a0.
      //
      //   .L0:
      //   auipc  tX, 0
@@ -511,7 +508,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      // original useless instructions instead of deleting them, but we
      // accept that because relaxations are enabled by default.
      if (sym.has_tlsdesc(ctx) && removed_bytes == 0)
-        write_utype(loc, sym.get_tlsdesc_addr(ctx) + A - P);
+        utype(sym.get_tlsdesc_addr(ctx) + A - P);
      break;
    case R_RISCV_TLSDESC_LOAD_LO12:
    case R_RISCV_TLSDESC_ADD_LO12:
@@ -538,10 +535,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
          write_itype(loc, sym2.get_tlsdesc_addr(ctx) + A - P);
        } else if (sym2.has_gottp(ctx)) {
          *(ul32 *)loc = 0x517; // auipc a0,<hi20>
-          write_utype(loc, sym2.get_gottp_addr(ctx) + A - P);
+          utype(sym2.get_gottp_addr(ctx) + A - P);
        } else {
          *(ul32 *)loc = 0x537; // lui a0,<hi20>
-          write_utype(loc, S + A - ctx.tp_addr);
+          utype(S + A - ctx.tp_addr);
        }
        break;
      case R_RISCV_TLSDESC_CALL:
@@ -632,6 +629,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_RISCV_32_PCREL:
      *(U32<E> *)loc = S + A - P;
      break;
+    case R_RISCV_GOT32_PCREL:
+      *(U32<E> *)loc = G + GOT + A - P;
+      break;
    case R_RISCV_SET_ULEB128:
      overwrite_uleb(loc, S + A);
      break;
@@ -757,6 +757,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_PLT;
      break;
    case R_RISCV_GOT_HI20:
+    case R_RISCV_GOT32_PCREL:
      sym.flags |= NEEDS_GOT;
      break;
    case R_RISCV_TLS_GOT_HI20:
@@ -773,9 +774,6 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      scan_pcrel(ctx, sym, rel);
      break;
    case R_RISCV_TPREL_HI20:
-    case R_RISCV_TPREL_LO12_I:
-    case R_RISCV_TPREL_LO12_S:
-    case R_RISCV_TPREL_ADD:
      check_tlsle(ctx, sym, rel);
      break;
    case R_RISCV_64:
@@ -785,6 +783,9 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_RISCV_PCREL_LO12_S:
    case R_RISCV_LO12_I:
    case R_RISCV_LO12_S:
+    case R_RISCV_TPREL_LO12_I:
+    case R_RISCV_TPREL_LO12_S:
+    case R_RISCV_TPREL_ADD:
    case R_RISCV_TLSDESC_LOAD_LO12:
    case R_RISCV_TLSDESC_ADD_LO12:
    case R_RISCV_TLSDESC_CALL:
@@ -999,6 +1000,72 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
  isec.sh_size -= r_delta;
 }

+// With --emit-relocs, rewrite the emitted relocations to match the
+// instructions that relaxation produced. The logic parallels apply_reloc_alloc.
+template <>
+void rewrite_reloc_types(Context<E> &ctx, InputSection<E> &isec, ElfRel<E> *buf) {
+  std::span<const ElfRel<E>> rels = isec.get_rels(ctx);
+  std::span<RelocDelta> deltas = isec.extra.r_deltas;
+  i64 k = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+
+    i64 removed_bytes = 0;
+    if (!deltas.empty()) {
+      while (k < deltas.size() && deltas[k].offset < rel.r_offset)
+        k++;
+      if (k < deltas.size() && deltas[k].offset == rel.r_offset)
+        removed_bytes = get_removed_bytes(deltas, k);
+    }
+
+    switch (rel.r_type) {
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT:
+      // auipc + jalr => jal, or c.j/c.jal
+      if (removed_bytes == 4)
+        buf[i].r_type = R_RISCV_JAL;
+      else if (removed_bytes == 6)
+        buf[i].r_type = R_RISCV_RVC_JUMP;
+      break;
+    case R_RISCV_GOT_HI20:
+      // auipc + l[dw] GOT load => the value is materialized directly, so both
+      // this and the paired PCREL_LO12 (the load) no longer need a relocation.
+      if (removed_bytes) {
+        buf[i].r_type = R_RISCV_NONE;
+        buf[i + 2].r_type = R_RISCV_NONE;
+        i += 3;
+      }
+      break;
+    case R_RISCV_HI20:
+      // lui (+ addi) => an instruction holding a link-time constant.
+      if (removed_bytes)
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TPREL_HI20:
+    case R_RISCV_TPREL_ADD:
+      // lui + add => deleted; the variable is accessed relative to tp directly.
+      if (removed_bytes)
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TLSDESC_HI20:
+      if (!sym.has_tlsdesc(ctx))
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TLSDESC_LOAD_LO12:
+    case R_RISCV_TLSDESC_ADD_LO12:
+    case R_RISCV_TLSDESC_CALL: {
+      Symbol<E> &sym2 =
+        *isec.file.symbols[find_paired_reloc(ctx, isec, rels, sym, i).r_sym];
+      if (!sym2.has_tlsdesc(ctx))
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    }
+    }
+  }
+}
+
 // ISA name handlers
 //
 // An example of ISA name is "rv64i2p1_m2p0_a2p1_f2p2_d2p2_c2p0_zicsr2p0".
@@ -35,6 +35,8 @@
 //
 // https://github.com/IBM/s390x-abi/releases/download/v1.6.1/lzsabi_s390x.pdf

+#if MOLD_S390X
+
 #include "mold.h"

 namespace mold {
@@ -48,18 +50,24 @@ static void write_mid20(u8 *loc, u64 val) {
 template <>
 void write_plt_header(Context<E> &ctx, u8 *buf) {
  static u8 insn[] = {
-    // Compute PLT_INDEX
+    // Compute the offset into .rela.plt. This is equivalent to
+    // (%r0 - %r1 - 48 - 14) * 3/2 where %r0 is the PLT entry address
+    // plus 14, %r1 is the start address of .plt, and 48 is the size
+    // of this PLT header. We multiply by 3/2 because each PLT entry
+    // is 16 bytes, whereas each .rela.plt entry is 24 bytes.
    0xb9, 0x09, 0x00, 0x01,             // sgr   %r0, %r1
    0xa7, 0x0b, 0xff, 0xc2,             // aghi  %r0, -62
    0xeb, 0x10, 0x00, 0x01, 0x00, 0x0c, // srlg  %r1, %r0, 1
    0xb9, 0x08, 0x00, 0x01,             // agr   %r0, %r1
+    // Store the computed value to 56(%r15) and .got.plt[1] to 48(%15)
+    // where %r15 is the stack pointer.
    0xe3, 0x00, 0xf0, 0x38, 0x00, 0x24, // stg   %r0, 56(%r15)
-    // Branch to _dl_runtime_resolve
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_OFFSET
    0xd2, 0x07, 0xf0, 0x30, 0x10, 0x08, // mvc   48(8, %r15), 8(%r1)
+    // Branch to _dl_runtime_resolve
    0xe3, 0x10, 0x10, 0x10, 0x00, 0x04, // lg    %r1, 16(%r1)
    0x07, 0xf1,                         // br    %r1
-    0x07, 0x00, 0x07, 0x00,             // nopr; nopr
+    0x00, 0x00, 0x00, 0x00,             // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -73,7 +81,7 @@ void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_ENTRY_OFFSET
    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
    0x0d, 0x01,                         // basr  %r0, %r1
-    0x07, 0x00,                         // nopr
+    0x00, 0x00,                         // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -86,7 +94,7 @@ void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOT_ENTRY_OFFSET
    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
    0x07, 0xf1,                         // br    %r1
-    0x07, 0x00,                         // nopr
+    0x00, 0x00,                         // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -483,3 +491,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -137,7 +137,7 @@ void write_plt_header(Context<E> &ctx, u8 *buf) {
      0x5221, //    mov.l   @(4, r2), r2
      0x402b, //    jmp     @r0
      0xe000, //    mov     #0, r0
-      0x0009, //    nop
+      0xfffd, //    (illegal)
      0, 0,   // 1: .long GOTPLT
    };

@@ -53,6 +53,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/sparc.pdf

+#if MOLD_SPARC64
+
 #include "mold.h"

 namespace mold {
@@ -76,26 +78,77 @@ void write_plt_header(Context<E> &ctx, u8 *buf) {
  memset(buf, 0, E::plt_hdr_size);
 }

+// Returns the byte offset within .plt of the data pointer for a large SPARC
+// PLT entry. See write_plt_entry below for the block layout this assumes.
+i64 sparc_plt_ptr_offset(Context<E> &ctx, i64 pltidx) {
+  i64 i = pltidx - sparc_num_small_plt;
+  i64 block = i / 160;
+  i64 nlarge = (i64)ctx.plt->symbols.size() - sparc_num_small_plt;
+  i64 nstub = std::min<i64>(160, nlarge - block * 160);
+  return 0x100000 + block * 5120 + nstub * 24 + (i % 160) * 8;
+}
+
 template <>
 void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
-  static ub32 insn[] = {
-    0x0300'0000, // sethi (. - .PLT0), %g1
-    0x3068'0000, // ba,a  %xcc, .PLT1
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-  };
+  // SPARC uses two PLT entry formats. A "small" entry branches directly to
+  // the resolver stub (.PLT1) with a BPcc instruction whose reach is only
+  // ±1 MiB. Once the PLT grows past that (0x100000 bytes), we switch to a
+  // "large" format: rather than branching to the resolver, a large entry
+  // loads a 64-bit value from a nearby data pointer and jumps to (that value
+  // + its own address).
+  //
+  // Large entries are grouped into blocks of 160: each block is 160 code
+  // stubs followed by 160 8-byte data pointers, one per stub. The stubs must
+  // sit on a fixed grid, 24 bytes apart, because that is how the loader finds
+  // them: on a lazy bind the stub jumps to the resolver (.PLT0) with only its
+  // own address, and the loader derives which symbol to resolve from that
+  // address. Nothing may sit between two stubs, so each stub's pointer lives
+  // in the block's pointer region, which it reaches with a signed 13-bit ldx
+  // offset (see to_plt_offset). This layout is dictated by the loader; we
+  // cannot rearrange or simplify it.
+  i64 idx = sym.get_plt_idx(ctx);

-  u64 plt0 = ctx.plt->shdr.sh_addr;
-  u64 plt1 = ctx.plt->shdr.sh_addr + E::plt_size;
-  u64 entry = sym.get_plt_addr(ctx);
+  if (idx < sparc_num_small_plt) {
+    static ub32 insn[] = {
+      0x0300'0000, // sethi (. - .PLT0), %g1
+      0x3068'0000, // ba,a  %xcc, .PLT1
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+    };

-  memcpy(buf, insn, sizeof(insn));
-  *(ub32 *)buf |= bits(entry - plt0, 21, 0);
-  *(ub32 *)(buf + 4) |= bits(plt1 - entry - 4, 20, 2);
+    u64 plt0 = ctx.plt->shdr.sh_addr;
+    u64 plt1 = ctx.plt->shdr.sh_addr + E::plt_size;
+    u64 entry = sym.get_plt_addr(ctx);
+
+    memcpy(buf, insn, sizeof(insn));
+    *(ub32 *)buf |= bits(entry - plt0, 21, 0);
+    *(ub32 *)(buf + 4) |= bits(plt1 - entry - 4, 20, 2);
+  } else {
+    static ub32 insn[] = {
+      0x8a10'000f, // mov  %o7, %g5
+      0x4000'0002, // call . + 8
+      0x0100'0000, // nop
+      0xc25b'e000, // ldx  [ %o7 + .ptr ], %g1
+      0x83c3'c001, // jmpl %o7 + %g1, %g1
+      0x9e10'0005, // mov  %g5, %o7
+    };
+
+    u64 plt = ctx.plt->shdr.sh_addr;
+    u64 call = sym.get_plt_addr(ctx) + 4;
+    i64 ptroff = sparc_plt_ptr_offset(ctx, idx);
+
+    memcpy(buf, insn, sizeof(insn));
+    *(ub32 *)(buf + 12) |= bits(plt + ptroff - call, 12, 0);
+
+    // The data pointer initially holds (.PLT0 - call) so that the first call
+    // jumps to .PLT0, where the loader's lazy resolver lives. The resolver
+    // later overwrites it with (target - call).
+    *(ub64 *)(ctx.buf + ctx.plt->shdr.sh_offset + ptroff) = plt - call;
+  }
 }

 template <>
@@ -139,7 +192,9 @@ template <>
 void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
  std::span<const ElfRel<E>> rels = get_rels(ctx);

-  for (i64 i = 0; i < rels.size(); i++) {
+  // We iterate over relocations in reverse order so that it is easy
+  // to swap instructions for R_SPARC_TLS_GD_CALL.
+  for (i64 i = (i64)rels.size() - 1; i >= 0; i--) {
    const ElfRel<E> &rel = rels[i];
    if (rel.r_type == R_NONE)
      continue;
@@ -157,6 +212,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check_range(ctx, i, val, lo, hi);
    };

+    auto rs1 = [&] { return *(ub32 *)loc & (0b11111 << 14); };
+    auto rs2 = [&] { return *(ub32 *)loc & 0b11111; };
+    auto rd  = [&] { return *(ub32 *)loc & (0b11111 << 25); };
+
    switch (rel.r_type) {
    case R_SPARC_5:
      check(S + A, 0, 1 << 5);
@@ -172,7 +231,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_SPARC_8:
      check(S + A, 0, 1 << 8);
-      *(u8 *)loc = S + A;
+      *loc = S + A;
      break;
    case R_SPARC_10:
      check(S + A, 0, 1 << 10);
@@ -206,13 +265,12 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ub32 *)loc = S + A;
      break;
    case R_SPARC_PLT64:
-    case R_SPARC_UA64:
    case R_SPARC_REGISTER:
      *(ub64 *)loc = S + A;
      break;
    case R_SPARC_DISP8:
      check(S + A - P, -(1 << 7), 1 << 7);
-      *(u8 *)loc = S + A - P;
+      *loc = S + A - P;
      break;
    case R_SPARC_DISP16:
      check(S + A - P, -(1 << 15), 1 << 15);
@@ -297,12 +355,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_SPARC_GOTDATA_OP:
      if (sym.is_absolute()) {
-        // ldx [ %g2 + %g1 ], %g1  →  nop
-        *(ub32 *)loc = 0x0100'0000;
+        // ldx [ %rs1 + %rs2 ], %rd  →  mov %rs2, %rd
+        *(ub32 *)loc = 0x8010'0000 | rs2() | rd();
      } else if (sym.is_pcrel_linktime_const(ctx)) {
-        // ldx [ %g2 + %g1 ], %g1  →  add %g2, %g1, %g1
-        *(ub32 *)loc &= 0b00'11111'000000'11111'1'11111111'11111;
-        *(ub32 *)loc |= 0b10'00000'000000'00000'0'00000000'00000;
+        // ldx [ %rs1 + %rs2 ], %rd  →  add %rs1, %rs2, %rd
+        *(ub32 *)loc = 0x8000'0000 | rs1() | rs2() | rd();
      }
      break;
    case R_SPARC_PC10:
@@ -357,12 +414,12 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      if (sym.has_tlsgd(ctx)) {
        *(ub32 *)loc |= bits(sym.get_tlsgd_addr(ctx) + A - GOT, 9, 0);
      } else if (sym.has_gottp(ctx)) {
-        u32 rd = bits(*(ub32 *)loc, 29, 25);
-        *(ub32 *)loc = 0x8010'2000 | (rd << 25) | (rd << 14); // or  %reg, $0, %reg
+        // add %rs1, %rs2, %rd → or  %rs1, $imm, %rd
+        *(ub32 *)loc = 0x8010'2000 | rs1() | rd();
        *(ub32 *)loc |= bits(sym.get_gottp_addr(ctx) + A - GOT, 9, 0);
      } else {
-        u32 rd = bits(*(ub32 *)loc, 29, 25);
-        *(ub32 *)loc = 0x8018'2000 | (rd << 25) | (rd << 14); // xor %reg, $0, %reg
+        // add %rs1, %rs2, %rd → xor %rs1, $imm, %rd
+        *(ub32 *)loc = 0x8018'2000 | rs1() | rd();
        *(ub32 *)loc |= bits(S + A - ctx.tp_addr, 9, 0) | 0b1'1100'0000'0000;
      }
      break;
@@ -370,11 +427,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      if (sym.has_tlsgd(ctx)) {
        // do nothing
      } else if (sym.has_gottp(ctx)) {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0xd05d'c000 | rs2; // ldx [ %l7 + %reg ], %o0
+        // add %rs1, %rs2, %rd → ldx [ %rs1 + %rs2 ], %rd
+        *(ub32 *)loc = 0xc058'0000 | rs1() | rs2() | rd();
      } else {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0x9001'c000 | rs2; // add %g7, %reg, %o0
+        // add %rs1, %rs2, %rd → add %g7, %rs2, %rd
+        *(ub32 *)loc = 0x8001'c000 | rs2() | rd();
      }
      break;
    case R_SPARC_TLS_GD_CALL:
@@ -382,9 +439,17 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        u64 addr = ctx.extra.tls_get_addr->get_addr(ctx);
        *(ub32 *)loc |= bits(addr + A - P, 31, 2);
      } else if (sym.has_gottp(ctx)) {
-        *(ub32 *)loc = 0x9001'c008; // add %g7, %o0, %o0
+        // When we rewrite a branch instruction with a non-branch one,
+        // we need to swap the instruction and the following one so that
+        // the original execution order, which is inverted due to the
+        // branch delay slot, is preserved.
+        //
+        // Since we apply relocations from the end to the beginning,
+        // the instruction at loc + 4 is already complete.
+        memcpy(loc, loc + 4, 4);
+        *(ub32 *)(loc + 4) = 0x9001'c008; // add %g7, %o0, %o0
      } else {
-        *(ub32 *)loc = 0x0100'0000; // nop
+        *(ub32 *)loc = 0x0100'0000; // call → nop
      }
      break;
    case R_SPARC_TLS_LDM_HI22:
@@ -400,12 +465,8 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ub32 *)loc |= bits(ctx.tp_addr - ctx.tls_begin, 9, 0);
      break;
    case R_SPARC_TLS_LDM_ADD:
-      if (ctx.got->has_tlsld(ctx)) {
-        // do nothing
-      } else {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0x9021'c000 | rs2; // sub %g7, %reg, %o0
-      }
+      if (!ctx.got->has_tlsld(ctx))
+        *(ub32 *)loc = 0x8021'c000 | rs2() | rd(); // sub %g7, %rs2, %rd
      break;
    case R_SPARC_TLS_LDM_CALL:
      if (ctx.got->has_tlsld(ctx)) {
@@ -437,6 +498,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ub32 *)loc = sym.esym().st_size + A;
      break;
    case R_SPARC_64:
+    case R_SPARC_UA64:
    case R_SPARC_TLS_LDO_ADD:
    case R_SPARC_TLS_IE_LD:
    case R_SPARC_TLS_IE_LDX:
@@ -500,6 +562,7 @@ template <>
 void InputSection<E>::scan_relocations(Context<E> &ctx) {
  assert(shdr().sh_flags & SHF_ALLOC);
  std::span<const ElfRel<E>> rels = get_rels(ctx);
+  bool needs_tlsgd = false;

  // Scan relocations
  for (i64 i = 0; i < rels.size(); i++) {
@@ -526,7 +589,6 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_SPARC_REGISTER:
    case R_SPARC_UA16:
    case R_SPARC_UA32:
-    case R_SPARC_UA64:
    case R_SPARC_PC_HM10:
    case R_SPARC_OLO10:
    case R_SPARC_LOX10:
@@ -584,6 +646,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_GOTTP;
      } else {
        sym.flags |= NEEDS_TLSGD;
+        needs_tlsgd = true;
      }
      break;
    case R_SPARC_TLS_LDM_HI22:
@@ -597,23 +660,21 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_SPARC_TLS_IE_HI22:
      sym.flags |= NEEDS_GOTTP;
      break;
-    case R_SPARC_TLS_GD_CALL:
-    case R_SPARC_TLS_LDM_CALL:
-      if (Symbol<E> *sym = ctx.extra.tls_get_addr; sym->is_imported)
-        sym->flags |= NEEDS_PLT;
-      break;
    case R_SPARC_TLS_LE_HIX22:
    case R_SPARC_TLS_LE_LOX10:
      check_tlsle(ctx, sym, rel);
      break;
    case R_SPARC_64:
+    case R_SPARC_UA64:
    case R_SPARC_GOTDATA_OP_LOX10:
    case R_SPARC_GOTDATA_OP:
    case R_SPARC_GOTDATA_LOX10:
    case R_SPARC_TLS_GD_LO10:
    case R_SPARC_TLS_GD_ADD:
+    case R_SPARC_TLS_GD_CALL:
    case R_SPARC_TLS_LDM_LO10:
    case R_SPARC_TLS_LDM_ADD:
+    case R_SPARC_TLS_LDM_CALL:
    case R_SPARC_TLS_LDO_HIX22:
    case R_SPARC_TLS_LDO_LOX10:
    case R_SPARC_TLS_LDO_ADD:
@@ -627,6 +688,14 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      Error(ctx) << *this << ": unknown relocation: " << rel;
    }
  }
+
+  // TLS_GD_CALL and TLS_LDM_CALL relocations implicitly refer to
+  // __tls_get_addr, which may be dynamically linked from libc.so.
+  Symbol<E> &sym = *ctx.extra.tls_get_addr;
+  if (sym.is_imported && (needs_tlsgd || ctx.needs_tlsld))
+    sym.flags |= NEEDS_PLT;
 }

 } // namespace mold
+
+#endif
@@ -25,8 +25,9 @@
 //
 // https://gitlab.com/x86-psABIs/x86-64-ABI

-#include "mold.h"
+#if MOLD_X86_64

+#include "mold.h"
 #include <tbb/parallel_for_each.h>

 namespace mold {
@@ -950,3 +951,5 @@ void rewrite_endbr(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -23,12 +23,11 @@
 // see the contents of libc.a by running `ar t
 // /usr/lib/x86_64-linux-gnu/libc.a`.

-#pragma once
-
-#include "common.h"
+#include "mold.h"

 namespace mold {

+namespace {
 struct ArHdr {
  char ar_name[16];
  char ar_date[12];
@@ -74,10 +73,11 @@ struct ArHdr {
    return {ar_name, sizeof(ar_name)};
  }
 };
+}

-template <typename Context>
+template <typename E>
 std::vector<MappedFile *>
-read_thin_archive_members(Context &ctx, MappedFile *mf) {
+read_thin_archive_members(Context<E> &ctx, MappedFile *mf) {
  u8 *begin = mf->data;
  u8 *data = begin + 8;
  std::vector<MappedFile *> vec;
@@ -123,8 +123,9 @@ read_thin_archive_members(Context &ctx, MappedFile *mf) {
  return vec;
 }

-template <typename Context>
-std::vector<MappedFile *> read_fat_archive_members(Context &ctx, MappedFile *mf) {
+template <typename E>
+std::vector<MappedFile *>
+read_fat_archive_members(Context<E> &ctx, MappedFile *mf) {
  u8 *begin = mf->data;
  u8 *data = begin + 8;
  std::vector<MappedFile *> vec;
@@ -161,13 +162,27 @@ std::vector<MappedFile *> read_fat_archive_members(Context &ctx, MappedFile *mf)
  return vec;
 }

-template <typename Context>
-std::vector<MappedFile *> read_archive_members(Context &ctx, MappedFile *mf) {
+template <typename E>
+std::vector<MappedFile *>
+read_archive_members(Context<E> &ctx, MappedFile *mf) {
  std::string_view str = mf->get_contents();
+
  if (str.starts_with("!<arch>\n"))
    return read_fat_archive_members(ctx, mf);
+
  assert(str.starts_with("!<thin>\n"));
  return read_thin_archive_members(ctx, mf);
 }

+using E = MOLD_TARGET;
+
+template std::vector<MappedFile *>
+read_thin_archive_members(Context<E> &, MappedFile *);
+
+template std::vector<MappedFile *>
+read_fat_archive_members(Context<E> &, MappedFile *);
+
+template std::vector<MappedFile *>
+read_archive_members(Context<E> &, MappedFile *);
+
 } // namespace mold
@@ -1,3 +1,4 @@
+#include "config.h"
 #include "mold.h"

 #include <filesystem>
@@ -15,6 +16,7 @@
 #if __has_include(<unistd.h>)
 # include <unistd.h>
 #else
+# include <direct.h>
 # define isatty _isatty
 # define STDERR_FILENO (_fileno(stderr))
 #endif
@@ -59,6 +61,7 @@ Options:
  -s, --strip-all             Strip .symtab section
  -u SYMBOL, --undefined SYMBOL
                              Force to resolve SYMBOL
+  -w, --no-warnings           Suppress warnings
  -y SYMBOL, --trace-symbol SYMBOL
                              Trace references to SYMBOL
  --Bdynamic, --dy            Link against shared libraries (default)
@@ -86,7 +89,7 @@ Options:
  --color-diagnostics=[auto,always,never]
                              Use colors in diagnostics
  --color-diagnostics         Alias for --color-diagnostics=always
-  --compress-debug-sections [none,zlib,zlib-gabi,zstd]
+  --compress-debug-sections=[none,zlib,zlib:0,...,zlib:9,zstd,zstd:1,...,zstd:22]
                              Compress .debug_* sections
  --dc                        Ignored
  --dependency-file=FILE      Write Makefile-style dependency rules to FILE
@@ -128,7 +131,7 @@ Options:
  --no-undefined              Report undefined symbols (even with --shared)
  --noinhibit-exec            Create an output file even if errors occur
  --oformat=binary            Omit ELF, section, and program headers
-  --pack-dyn-relocs=[relr,none]
+  --pack-dyn-relocs=[relr,android,android+relr,none]
                              Pack dynamic relocations
  --package-metadata=PERCENT_ENCODED_STRING
                              Set a given string to .note.package
@@ -136,9 +139,9 @@ Options:
  --pie, --pic-executable     Create a position-independent executable
    --no-pie, --no-pic-executable
  --pop-state                 Restore the state of flags governing input file handling
-  --print-gc-sections         Print removed unreferenced sections
+  --print-gc-sections[=FILE]  Print, or save in FILE, removed unreferenced sections
    --no-print-gc-sections
-  --print-icf-sections        Print folded identical sections
+  --print-icf-sections[=FILE] Print, or save in FILE, folded identical sections
    --no-print-icf-sections
  --push-state                Save the state of flags governing input file handling
  --quick-exit                Use quick_exit to exit (default)
@@ -191,6 +194,7 @@ Options:
  --whole-archive             Include all objects from static archives
    --no-whole-archive
  --wrap SYMBOL               Use a wrapper function for a given symbol
+  --zero-to-bss               Convert all-zero data sections into BSS
  -z defs                     Report undefined symbols (even with --shared)
    -z nodefs
  -z common-page-size=VALUE   Ignored
@@ -233,75 +237,112 @@ Options:
 mold: supported targets: elf32-i386 elf64-x86-64 elf32-littlearm elf64-littleaarch64 elf64-bigaarch64 elf32-littleriscv elf32-bigriscv elf64-littleriscv elf64-bigriscv elf32-powerpc elf64-powerpc elf64-powerpc elf64-powerpcle elf64-s390 elf64-sparc elf32-m68k elf32-sh-linux elf64-loongarch elf32-loongarch
 mold: supported emulations: elf_i386 elf_x86_64 armelf_linux_eabi aarch64elf aarch64linux aarch64elfb aarch64linuxb elf32lriscv elf32briscv elf64lriscv elf64briscv elf32ppc elf32ppclinux elf64ppc elf64lppc elf64_s390 elf64_sparc m68kelf shlelf_linux shelf_linux elf64loongarch elf32loongarch)";

+// If a command line argument is in the form of `@path/to/some/file` (i.e.
+// it starts with an atsign), the linker reads the given file and
+// interprets its contents as a list of command line arguments. A file
+// containing command line arguments is called a "response file".
+//
+// A response file is often used to pass a very large number of arguments
+// to the linker without exceeding the kernel's command line length limit.
+//
+// This function opens a given file, tokenizes its contents, and returns a
+// list of tokens.
 template <typename E>
 static std::vector<std::string_view>
 read_response_file(Context<E> &ctx, std::string_view path, i64 depth) {
  if (depth > 10)
    Fatal(ctx) << path << ": response file nesting too deep";

-  std::vector<std::string_view> vec;
  MappedFile *mf = must_open_file(ctx, std::string(path));
-  std::string_view data((char *)mf->data, mf->size);
-
  mf->is_dependency = false;

-  while (!data.empty()) {
-    if (isspace(data[0])) {
-      data = data.substr(1);
-      continue;
-    }
+  std::vector<std::string> vec;
+  std::ostringstream os;
+  char quote = 0;

-    auto read_quoted = [&]() {
-      char quote = data[0];
-      data = data.substr(1);
+  // Each state represents the type of characters currently being read.
+  // SPACE indicates blank characters between tokens, BARE indicates an
+  // unquoted token, and QUOTED indicates a quoted token.
+  enum { SPACE, BARE, QUOTED } state = SPACE;

-      std::string buf;
-      while (!data.empty() && data[0] != quote) {
-        if (data[0] == '\\' && data.size() >= 1) {
-          buf.append(1, data[1]);
-          data = data.substr(2);
-        } else {
-          buf.append(1, data[0]);
-          data = data.substr(1);
-        }
-      }
-      if (data.empty())
-        Fatal(ctx) << path << ": premature end of input";
-      data = data.substr(1);
-      return save_string(ctx, buf);
-    };
+  for (i64 i = 0; i <= mf->size; i++) {
+    char c = (i < mf->size) ? mf->data[i] : 0;
+    char c2 = (i + 1 < mf->size) ? mf->data[i + 1] : 0;

-    auto read_unquoted = [&] {
-      std::string buf;
-      while (!data.empty()) {
-        if (data[0] == '\\' && data.size() >= 1) {
-          buf.append(1, data[1]);
-          data = data.substr(2);
-          continue;
-        }
+    if (c == '\\' && c2 == 0)
+      Fatal(ctx) << path << ": premature end of input";

-        if (!isspace(data[0])) {
-          buf.append(1, data[0]);
-          data = data.substr(1);
-          continue;
-        }
+    switch (state) {
+    case SPACE:
+      if (c == 0 || isspace(c))
+        break;
+
+      if (c == '\\') {
+        os << c2;
+        state = BARE;
+        i++;
        break;
      }
-      return save_string(ctx, buf);
-    };

-    std::string_view tok;
-    if (data[0] == '\'' || data[0] == '\"')
-      tok = read_quoted();
-    else
-      tok = read_unquoted();
+      if (c == '\'' || c == '"') {
+        quote = c;
+        state = QUOTED;
+        break;
+      }

-    if (tok.starts_with('@'))
-      append(vec, read_response_file(ctx, tok.substr(1), depth + 1));
-    else
-      vec.push_back(tok);
+      os << c;
+      state = BARE;
+      break;
+    case BARE:
+      if (c == 0 || isspace(c)) {
+        vec.push_back(os.str());
+        os = {};
+        state = SPACE;
+        break;
+      }
+
+      if (c == '\\') {
+        os << c2;
+        i++;
+        break;
+      }
+
+      if (c == '\'' || c == '"') {
+        quote = c;
+        state = QUOTED;
+        break;
+      }
+
+      os << c;
+      break;
+    case QUOTED:
+      if (c == 0)
+        Fatal(ctx) << path << ": premature end of input";
+
+      if (c == '\\') {
+        os << c2;
+        i++;
+        break;
+      }
+
+      if (c == quote) {
+        state = BARE;
+        break;
+      }
+
+      os << c;
+      break;
+    }
  }
-  return vec;
+
+  std::vector<std::string_view> vec2;
+  for (std::string &tok : vec) {
+    if (tok.starts_with('@'))
+      append(vec2, read_response_file(ctx, tok.substr(1), depth + 1));
+    else
+      vec2.push_back(save_string(ctx, tok));
+  }
+  return vec2;
 }

 // Replace "@path/to/some/text/file" with its file contents.
@@ -318,13 +359,6 @@ expand_response_files(Context<E> &ctx, char **argv) {
  return vec;
 }

-static i64 get_default_thread_count() {
-  // mold doesn't scale well above 32 threads.
-  int n = tbb::global_control::active_value(
-    tbb::global_control::max_allowed_parallelism);
-  return std::min(n, 32);
-}
-
 static std::string_view string_trim(std::string_view str) {
  size_t pos = str.find_first_not_of(" \t");
  if (pos == str.npos)
@@ -427,11 +461,11 @@ parse_package_metadata(Context<E> &ctx, std::string_view arg) {
 }

 static std::vector<std::string_view>
-split_by_comma_or_colon(std::string_view str) {
+split_string(std::string_view str, std::string_view sep) {
  std::vector<std::string_view> vec;

  for (;;) {
-    i64 pos = str.find_first_of(",:");
+    i64 pos = str.find_first_of(sep);
    if (pos == str.npos) {
      vec.push_back(str);
      break;
@@ -473,63 +507,6 @@ static bool is_file(const std::filesystem::path& path) {
  return !std::filesystem::is_directory(path, error) && !error;
 }

-template <typename E>
-static std::vector<SectionOrder>
-parse_section_order(Context<E> &ctx, std::string_view arg) {
-  auto flags = std::regex_constants::ECMAScript | std::regex_constants::icase |
-               std::regex_constants::optimize;
-  static std::regex re1(R"(^\s*(TEXT|DATA|RODATA|BSS)(?:\s|$))", flags);
-  static std::regex re2(R"(^\s*([a-zA-Z0-9_.][^\s]*|EHDR|PHDR)(?:\s|$))", flags);
-  static std::regex re3(R"(^\s*=(0x[0-9a-f]+|\d+)(?:\s|$))", flags);
-  static std::regex re4(R"(^\s*%(0x[0-9a-f]+|\d*)(?:\s|$))", flags);
-  static std::regex re5(R"(^\s*!(\S+)(?:\s|$))", flags);
-
-  std::vector<SectionOrder> vec;
-  arg = string_trim(arg);
-
-  while (!arg.empty()) {
-    SectionOrder ord;
-    std::cmatch m;
-
-    if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re1)) {
-      ord.type = SectionOrder::GROUP;
-      ord.name = m[1].str();
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re2)) {
-      ord.type = SectionOrder::SECTION;
-      ord.name = m[1].str();
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re3)) {
-      ord.type = SectionOrder::ADDR;
-      std::string s = m[1];
-      ord.value = std::stoull(s, nullptr, s.starts_with("0x") ? 16 : 10);
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re4)) {
-      ord.type = SectionOrder::ALIGN;
-      std::string s = m[1];
-      ord.value = std::stoull(s, nullptr, s.starts_with("0x") ? 16 : 10);
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re5)) {
-      ord.type = SectionOrder::SYMBOL;
-      ord.name = m[1].str();
-    } else {
-      Fatal(ctx) << "--section-order: parse error: " << arg;
-    }
-
-    vec.push_back(ord);
-    arg = arg.substr(m[0].length());
-  }
-
-  bool is_first = true;
-  for (SectionOrder &ord : vec) {
-    if (ord.type == SectionOrder::SECTION) {
-      if (is_first) {
-        is_first = false;
-      } else if (ord.name == "EHDR")
-        Fatal(ctx) << "--section-order: EHDR must be the first "
-                   << "section specifier: " << arg;
-    }
-  }
-
-  return vec;
-}
-
 template <typename E>
 static std::variant<Symbol<E> *, u64>
 parse_defsym_value(Context<E> &ctx, std::string_view s) {
@@ -587,6 +564,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  bool warn_shared_textrel = false;
  bool error_unresolved_symbols = true;
  std::optional<SeparateCodeKind> z_separate_code;
+  std::optional<bool> allow_shlib_undefined;
  std::optional<bool> report_undefined;
  std::optional<bool> z_relro;
  std::optional<bool> z_dynamic_undefined_weak;
@@ -705,65 +683,90 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("no-dynamic-linker")) {
      ctx.arg.dynamic_linker = "";
    } else if (read_flag("v")) {
-      Out(ctx) << get_mold_version();
+      Out(ctx) << mold_version;
      version_shown = true;
    } else if (read_flag("version")) {
-      Out(ctx) << get_mold_version();
+      Out(ctx) << mold_version;
      exit(0);
    } else if (read_flag("V")) {
-      Out(ctx) << get_mold_version()
+      Out(ctx) << mold_version
               << "\n  Supported emulations:\n   elf_x86_64\n   elf_i386\n"
               << "   aarch64elf\n   aarch64linux\n   aarch64elfb\n"
               << "   aarch64linuxb\n   armelf_linux_eabi\n   elf64lriscv\n"
               << "   elf64briscv\n   elf32lriscv\n   elf32briscv\n"
               << "   elf32ppc\n   elf64ppc\n   elf64lppc\n   elf64_s390\n"
               << "   elf64_sparc\n   m68kelf\n   shlelf_linux\n"
-               << "   shelf_linux\n   elf64loongarch\n   elf32loongarch\n"
-               << "   arclinux";
+               << "   shelf_linux\n   elf64loongarch\n   elf32loongarch";
      version_shown = true;
    } else if (read_arg("mllvm")) {
      ctx.arg.plugin_opt.emplace_back(arg);
    } else if (read_arg("m")) {
+      auto check = [&](bool supported, std::string_view name) {
+        if (!supported)
+          Fatal(ctx) << "'-m " << arg << "' is not supported; you may want to"
+                     << " rebuild mold with " << name << " support";
+      };
+
      if (arg == "elf_x86_64") {
+        check(HAVE_TARGET_X86_64, X86_64::name);
        ctx.arg.emulation = X86_64::name;
      } else if (arg == "elf_i386") {
+        check(HAVE_TARGET_I386, I386::name);
        ctx.arg.emulation = I386::name;
      } else if (arg == "aarch64elf" || arg == "aarch64linux") {
+        check(HAVE_TARGET_ARM64LE, ARM64LE::name);
        ctx.arg.emulation = ARM64LE::name;
      } else if (arg == "aarch64elfb" || arg == "aarch64linuxb") {
+        check(HAVE_TARGET_ARM64BE, ARM64BE::name);
        ctx.arg.emulation = ARM64BE::name;
      } else if (arg == "armelf_linux_eabi") {
-        ctx.arg.emulation = ARM32::name;
+        check(HAVE_TARGET_ARM32LE, ARM32LE::name);
+        ctx.arg.emulation = ARM32LE::name;
+      } else if (arg == "armelfb_linux_eabi") {
+        check(HAVE_TARGET_ARM32BE, ARM32BE::name);
+        ctx.arg.emulation = ARM32BE::name;
      } else if (arg == "elf64lriscv") {
+        check(HAVE_TARGET_RV64LE, RV64LE::name);
        ctx.arg.emulation = RV64LE::name;
      } else if (arg == "elf64briscv") {
+        check(HAVE_TARGET_RV64BE, RV64BE::name);
        ctx.arg.emulation = RV64BE::name;
      } else if (arg == "elf32lriscv") {
+        check(HAVE_TARGET_RV32LE, RV32LE::name);
        ctx.arg.emulation = RV32LE::name;
      } else if (arg == "elf32briscv") {
+        check(HAVE_TARGET_RV32BE, RV32BE::name);
        ctx.arg.emulation = RV32BE::name;
      } else if (arg == "elf32ppc" || arg == "elf32ppclinux") {
+        check(HAVE_TARGET_PPC32, PPC32::name);
        ctx.arg.emulation = PPC32::name;
      } else if (arg == "elf64ppc") {
+        check(HAVE_TARGET_PPC64V1, PPC64V1::name);
        ctx.arg.emulation = PPC64V1::name;
      } else if (arg == "elf64lppc") {
+        check(HAVE_TARGET_PPC64V2, PPC64V2::name);
        ctx.arg.emulation = PPC64V2::name;
      } else if (arg == "elf64_s390") {
+        check(HAVE_TARGET_S390X, S390X::name);
        ctx.arg.emulation = S390X::name;
      } else if (arg == "elf64_sparc") {
+        check(HAVE_TARGET_SPARC64, SPARC64::name);
        ctx.arg.emulation = SPARC64::name;
      } else if (arg == "m68kelf") {
+        check(HAVE_TARGET_M68K, M68K::name);
        ctx.arg.emulation = M68K::name;
      } else if (arg == "shlelf" || arg == "shlelf_linux") {
+        check(HAVE_TARGET_SH4LE, SH4LE::name);
        ctx.arg.emulation = SH4LE::name;
      } else if (arg == "shelf" || arg == "shelf_linux") {
+        check(HAVE_TARGET_SH4BE, SH4BE::name);
        ctx.arg.emulation = SH4BE::name;
      } else if (arg == "elf64loongarch") {
+        check(HAVE_TARGET_LOONGARCH64, LOONGARCH64::name);
        ctx.arg.emulation = LOONGARCH64::name;
      } else if (arg == "elf32loongarch") {
+        check(HAVE_TARGET_LOONGARCH32, LOONGARCH32::name);
        ctx.arg.emulation = LOONGARCH32::name;
-      } else if (arg == "arclinux") {
-        ctx.arg.emulation = ARC::name;
      } else {
        Fatal(ctx) << "unknown -m argument: " << arg;
      }
@@ -784,7 +787,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("Bno-symbolic")) {
      ctx.arg.Bsymbolic = BSYMBOLIC_NONE;
    } else if (read_arg("exclude-libs")) {
-      append(ctx.arg.exclude_libs, split_by_comma_or_colon(arg));
+      for (std::string_view lib : split_string(arg, ",:"))
+        ctx.arg.exclude_libs.insert(lib);
    } else if (read_flag("q") || read_flag("emit-relocs")) {
      ctx.arg.emit_relocs = true;
      ctx.arg.discard_locals = false;
@@ -798,10 +802,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("print-map") || read_flag("M")) {
      ctx.arg.print_map = true;
    } else if (read_flag("Bstatic") || read_flag("dn") || read_flag("static")) {
-      ctx.arg.static_ = true;
      remaining.emplace_back("--Bstatic");
    } else if (read_flag("Bdynamic") || read_flag("dy")) {
-      ctx.arg.static_ = false;
      remaining.emplace_back("--Bdynamic");
    } else if (read_flag("shared") || read_flag("Bshareable")) {
      ctx.arg.shared = true;
@@ -834,6 +836,13 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.detach = true;
    } else if (read_flag("no-detach")) {
      ctx.arg.detach = false;
+    } else if (read_arg("orphan-handling")) {
+      if (arg != "place" && arg != "warn" && arg != "error")
+        Fatal(ctx) << "--orphan-handling: unsupported mode: " << arg;
+      ctx.arg.orphan_handling = arg;
+    } else if (read_flag("warn-rwx-segments") ||
+               read_flag("no-warn-rwx-segments")) {
+      // mold doesn't warn about RWX segments
    } else if (read_flag("default-symver")) {
      ctx.arg.default_symver = true;
    } else if (read_flag("noinhibit-exec")) {
@@ -858,10 +867,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_arg("sysroot")) {
      ctx.arg.sysroot = arg;
    } else if (read_arg("unique")) {
-      std::optional<Glob> pat = Glob::compile(arg);
-      if (!pat)
+      if (!ctx.arg.unique.add(arg, 1))
        Fatal(ctx) << "-unique: invalid glob pattern: " << arg;
-      ctx.arg.unique = std::move(*pat);
    } else if (read_arg("unresolved-symbols")) {
      if (arg == "report-all" || arg == "ignore-in-shared-libs")
        report_undefined = true;
@@ -944,9 +951,21 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("pack-dyn-relocs=relr") ||
               read_z_flag("pack-relative-relocs")) {
      ctx.arg.pack_dyn_relocs_relr = true;
+      ctx.arg.pack_dyn_relocs_android = false;
+    } else if (read_flag("pack-dyn-relocs=android")) {
+      ctx.arg.pack_dyn_relocs_android = true;
+      ctx.arg.pack_dyn_relocs_relr = false;
+    } else if (read_flag("pack-dyn-relocs=android+relr")) {
+      ctx.arg.pack_dyn_relocs_android = true;
+      ctx.arg.pack_dyn_relocs_relr = true;
    } else if (read_flag("pack-dyn-relocs=none") ||
               read_z_flag("nopack-relative-relocs")) {
      ctx.arg.pack_dyn_relocs_relr = false;
+      ctx.arg.pack_dyn_relocs_android = false;
+    } else if (read_flag("use-android-relr-tags")) {
+      ctx.arg.use_android_relr_tags = true;
+    } else if (read_flag("no-use-android-relr-tags")) {
+      ctx.arg.use_android_relr_tags = false;
    } else if (read_arg("package-metadata")) {
      ctx.arg.package_metadata = parse_package_metadata(ctx, arg);
    } else if (read_flag("stats")) {
@@ -979,20 +998,39 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.enable_new_dtags = false;
    } else if (read_flag("execute-only")) {
      ctx.arg.execute_only = true;
+    } else if (read_flag("zero-to-bss")) {
+      ctx.arg.zero_to_bss = true;
    } else if (read_arg("compress-debug-sections")) {
-      if (arg == "zlib" || arg == "zlib-gabi")
-        ctx.arg.compress_debug_sections = COMPRESS_ZLIB;
-      else if (arg == "zstd")
-        ctx.arg.compress_debug_sections = COMPRESS_ZSTD;
-      else if (arg == "none")
-        ctx.arg.compress_debug_sections = COMPRESS_NONE;
-      else
+      if (arg == "zlib" || arg == "zlib-gabi") {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZLIB;
+        ctx.arg.compress_debug_sections_level = 1;
+      } else if (arg.starts_with("zlib:")) {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZLIB;
+        i64 level = parse_number(ctx, "compress-debug-sections", arg.substr(5));
+        if (level < 0 || 9 < level)
+          Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg
+                     << " (zlib level must be between 0 and 9)";
+        ctx.arg.compress_debug_sections_level = level;
+      } else if (arg == "zstd") {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZSTD;
+        ctx.arg.compress_debug_sections_level = 3;
+      } else if (arg.starts_with("zstd:")) {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZSTD;
+        i64 level = parse_number(ctx, "compress-debug-sections", arg.substr(5));
+        if (level < 1 || 22 < level)
+          Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg
+                     << " (zstd level must be between 1 and 22)";
+        ctx.arg.compress_debug_sections_level = level;
+      } else if (arg == "none") {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_NONE;
+      } else {
        Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg;
+      }
    } else if (read_arg("wrap")) {
      ctx.arg.wrap.insert(arg);
    } else if (read_flag("omagic") || read_flag("N")) {
      ctx.arg.omagic = true;
-      ctx.arg.static_ = true;
+      remaining.emplace_back("--Bstatic");
    } else if (read_flag("no-omagic")) {
      ctx.arg.omagic = false;
    } else if (read_arg("oformat")) {
@@ -1015,8 +1053,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
        Fatal(ctx) << "--section-start: syntax error: " << arg;
      ctx.arg.section_start[arg.substr(0, pos)] =
        parse_hex(ctx, "section-start", arg.substr(pos + 1));
-    } else if (read_arg("section-order")) {
-      ctx.arg.section_order = parse_section_order(ctx, arg);
    } else if (read_arg("Tbss")) {
      ctx.arg.section_start[".bss"] = parse_hex(ctx, "Tbss", arg);
    } else if (read_arg("Tdata")) {
@@ -1132,6 +1168,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.fatal_warnings = true;
    } else if (read_flag("no-fatal-warnings")) {
      ctx.arg.fatal_warnings = false;
+    } else if (read_flag("w") || read_flag("no-warnings")) {
+      ctx.arg.suppress_warnings = true;
    } else if (read_flag("fork")) {
      ctx.arg.fork = true;
    } else if (read_flag("no-fork")) {
@@ -1141,9 +1179,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("no-gc-sections")) {
      ctx.arg.gc_sections = false;
    } else if (read_flag("print-gc-sections")) {
-      ctx.arg.print_gc_sections = true;
+      ctx.arg.print_gc_sections = "-";
+    } else if (read_eq("print-gc-sections")) {
+      ctx.arg.print_gc_sections = arg;
    } else if (read_flag("no-print-gc-sections")) {
-      ctx.arg.print_gc_sections = false;
+      ctx.arg.print_gc_sections = "";
    } else if (read_arg("discard-section")) {
      ctx.arg.discard_section.insert(arg);
    } else if (read_arg("no-discard-section")) {
@@ -1165,12 +1205,12 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.ignore_data_address_equality = true;
    } else if (read_arg("image-base")) {
      ctx.arg.image_base = parse_number(ctx, "image-base", arg);
-    } else if (read_arg("physical-image-base")) {
-      ctx.arg.physical_image_base = parse_number(ctx, "physical-image-base", arg);
    } else if (read_flag("print-icf-sections")) {
-      ctx.arg.print_icf_sections = true;
+      ctx.arg.print_icf_sections = "-";
+    } else if (read_eq("print-icf-sections")) {
+      ctx.arg.print_icf_sections = arg;
    } else if (read_flag("no-print-icf-sections")) {
-      ctx.arg.print_icf_sections = false;
+      ctx.arg.print_icf_sections = "";
    } else if (read_flag("quick-exit")) {
      ctx.arg.quick_exit = true;
    } else if (read_flag("no-quick-exit")) {
@@ -1241,7 +1281,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_arg("thread-count")) {
      ctx.arg.thread_count = parse_number(ctx, "thread-count", arg);
    } else if (read_flag("threads")) {
-      ctx.arg.thread_count = 0;
+      ctx.arg.thread_count.reset();
    } else if (read_flag("no-threads")) {
      ctx.arg.thread_count = 1;
    } else if (read_eq("threads")) {
@@ -1294,6 +1334,10 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      }
    } else if (read_flag("no-build-id")) {
      ctx.arg.build_id.kind = BuildId::NONE;
+    } else if (read_flag("be8")) {
+      ctx.arg.be8 = true;
+    } else if (read_flag("be32")) {
+      ctx.arg.be8 = false;
    } else if (read_arg("format") || read_arg("b")) {
      if (arg == "binary")
        Fatal(ctx)
@@ -1301,14 +1345,15 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
          << " binary file into an object file, use `objcopy -I binary -O"
          << " default <input-file> <output-file.o>` instead.";
      Fatal(ctx) << "unknown command line option: -b " << arg;
+    } else if (read_arg("fuse-ld")) {
    } else if (read_arg("auxiliary") || read_arg("f")) {
      ctx.arg.auxiliary.push_back(arg);
    } else if (read_arg("filter") || read_arg("F")) {
      ctx.arg.filter.push_back(arg);
    } else if (read_flag("allow-shlib-undefined")) {
-      ctx.arg.allow_shlib_undefined = true;
+      allow_shlib_undefined = true;
    } else if (read_flag("no-allow-shlib-undefined")) {
-      ctx.arg.allow_shlib_undefined = false;
+      allow_shlib_undefined = false;
    } else if (read_arg("O")) {
    } else if (read_flag("EB")) {
    } else if (read_flag("EL")) {
@@ -1395,6 +1440,22 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    }
  }

+  if (!ctx.arg.chroot.empty()) {
+    if (!ctx.arg.Map.empty())
+      ctx.arg.Map = ctx.arg.chroot + "/" + ctx.arg.Map;
+
+    if (!ctx.arg.dependency_file.empty())
+      ctx.arg.dependency_file = ctx.arg.chroot + "/" + ctx.arg.dependency_file;
+  }
+
+  if (!ctx.arg.directory.empty()) {
+    std::error_code ec;
+    std::filesystem::current_path(ctx.arg.directory, ec);
+    if (ec)
+      Fatal(ctx) << "chdir failed: " << ctx.arg.directory
+                 << ": " << ec.message();
+  }
+
  if (!ctx.arg.sysroot.empty()) {
    for (std::string &path : ctx.arg.library_paths) {
      if (std::string_view(path).starts_with('='))
@@ -1415,6 +1476,16 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  if (ctx.arg.pic)
    ctx.arg.image_base = 0;

+  // A shared library is loaded by the dynamic linker, so it doesn't need
+  // PT_INTERP. (-pie makes the output an executable even with -shared.)
+  if (ctx.arg.shared && !ctx.arg.pie)
+    ctx.arg.dynamic_linker = "";
+
+  if (allow_shlib_undefined)
+    ctx.arg.allow_shlib_undefined = *allow_shlib_undefined;
+  else
+    ctx.arg.allow_shlib_undefined = ctx.arg.shared;
+
  if (!report_undefined)
    report_undefined = !ctx.arg.shared;

@@ -1432,9 +1503,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    ctx.arg.discard_all = false;
  }

-  if (ctx.arg.relocatable)
-    ctx.arg.static_ = true;
-
  if (ctx.arg.shuffle_sections == SHUFFLE_SECTIONS_SHUFFLE) {
    if (shuffle_sections_seed)
      ctx.arg.shuffle_sections_seed = *shuffle_sections_seed;
@@ -1443,11 +1511,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
        ((u64)std::random_device()() << 32) | std::random_device()();
  }

-  // --section-order implies `-z separate-loadable-segments`
  if (z_separate_code)
    ctx.arg.z_separate_code = *z_separate_code;
-  else if (!ctx.arg.section_order.empty())
-    ctx.arg.z_separate_code = SEPARATE_LOADABLE_SEGMENTS;

  // `-z dynamic-undefined-weak` is enabled by default for DSOs.
  if (z_dynamic_undefined_weak)
@@ -1455,13 +1520,10 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  else
    ctx.arg.z_dynamic_undefined_weak = ctx.arg.shared;

-  // --section-order implies `-z norelro`
  if (z_relro)
    ctx.arg.z_relro = *z_relro;
-  else if (!ctx.arg.section_order.empty())
-    ctx.arg.z_relro = false;

-  if (ctx.arg.nmagic)
+  if (ctx.arg.nmagic || ctx.arg.omagic)
    ctx.arg.z_relro = false;

  if (!ctx.arg.shared) {
@@ -1482,14 +1544,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    if (ctx.arg.apply_dynamic_relocs)
      Fatal(ctx) << "--apply-dynamic-relocs may not be used on SPARC64";

-  if (!ctx.arg.section_start.empty() && !ctx.arg.section_order.empty())
-    Fatal(ctx) << "--section-start may not be used with --section-order";
-
  if (ctx.arg.image_base % ctx.page_size)
    Fatal(ctx) << "-image-base must be a multiple of -max-page-size";

-  if (ctx.arg.thread_count == 0)
-    ctx.arg.thread_count = get_default_thread_count();
+  if (ctx.arg.emulation == ARM32BE::name && !ctx.arg.be8)
+    Fatal(ctx) << "--be32 is not supported";

  if (char *env = getenv("MOLD_REPRO"); env && env[0])
    ctx.arg.repro = true;
@@ -1498,9 +1557,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    std::string ver = ctx.arg.soname;
    if (ver.empty())
      ver = path_filename(ctx.arg.output);
-
    ctx.arg.version_definitions.push_back(ver);
-    ctx.default_version = VER_NDX_LAST_RESERVED + 1;
  }

  for (std::string_view path : version_scripts) {
@@ -1514,8 +1571,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      Fatal(ctx) << "--version-script: file not found: " << path;
    };

-    ReaderContext rctx;
-    Script(ctx, rctx, open()).parse_version_script();
+    Script(ctx, open()).parse_version_script();
  }

  if (separate_debug_file) {
@@ -1532,8 +1588,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  if (ctx.arg.stats || ctx.arg.perf)
    ctx.arg.detach = false;

-  ctx.arg.undefined.push_back(ctx.arg.entry);
-
  for (i64 i = 0; i < ctx.arg.defsyms.size(); i++) {
    std::variant<Symbol<E> *, u64> &val = ctx.arg.defsyms[i].second;
    if (Symbol<E> **sym = std::get_if<Symbol<E> *>(&val))
@@ -1558,20 +1612,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  // object file.
  ctx.overwrite_output_file = (!ctx.arg.shared && returns_etxtbsy());

-  if (!ctx.arg.chroot.empty()) {
-    if (!ctx.arg.Map.empty())
-      ctx.arg.Map = ctx.arg.chroot + "/" + ctx.arg.Map;
-
-    if (!ctx.arg.dependency_file.empty())
-      ctx.arg.dependency_file = ctx.arg.chroot + "/" + ctx.arg.dependency_file;
-  }
-
  // Mark GC root symbols
  for (Symbol<E> *sym : ctx.arg.undefined)
    sym->gc_root = true;
  for (Symbol<E> *sym : ctx.arg.require_defined)
    sym->gc_root = true;
-  ctx.arg.entry->gc_root = true;

  if (version_shown && remaining.empty())
    exit(0);
@@ -1,12 +0,0 @@
-#include "mold.h"
-
-namespace mold {
-
-std::string get_mold_version() {
-  if (mold_git_hash.empty())
-    return "mold "s + MOLD_VERSION + " (compatible with GNU ld)";
-  return "mold "s + MOLD_VERSION + " (" + mold_git_hash +
-         "; compatible with GNU ld)";
-}
-
-} // namespace mold
@@ -1,11 +1,12 @@
 #include "elf.h"
+#include <sstream>

 namespace mold {

 static std::string unknown_type(u32 r_type) {
-  char buf[50];
-  snprintf(buf, sizeof(buf), "unknown (0x%x)", r_type);
-  return buf;
+  std::stringstream ss;
+  ss << "unknown (0x" << std::hex << r_type << ")";
+  return ss.str();
 }

 #define CASE(x) case x: return #x
@@ -160,6 +161,7 @@ std::string rel_to_string<ARM64LE>(u32 r_type) {
  CASE(R_AARCH64_LD64_GOT_LO12_NC);
  CASE(R_AARCH64_LD64_GOTPAGE_LO15);
  CASE(R_AARCH64_PLT32);
+  CASE(R_AARCH64_GOTPCREL32);
  CASE(R_AARCH64_TLSGD_ADR_PREL21);
  CASE(R_AARCH64_TLSGD_ADR_PAGE21);
  CASE(R_AARCH64_TLSGD_ADD_LO12_NC);
@@ -232,7 +234,7 @@ std::string rel_to_string<ARM64BE>(u32 r_type) {
 }

 template <>
-std::string rel_to_string<ARM32>(u32 r_type) {
+std::string rel_to_string<ARM32LE>(u32 r_type) {
  switch (r_type) {
  CASE(R_ARM_NONE);
  CASE(R_ARM_PC24);
@@ -373,6 +375,11 @@ std::string rel_to_string<ARM32>(u32 r_type) {
  return unknown_type(r_type);
 }

+template <>
+std::string rel_to_string<ARM32BE>(u32 r_type) {
+  return rel_to_string<ARM32LE>(r_type);
+}
+
 template <>
 std::string rel_to_string<RV64LE>(u32 r_type) {
  switch (r_type) {
@@ -1038,73 +1045,4 @@ std::string rel_to_string<LOONGARCH32>(u32 r_type) {
  return rel_to_string<LOONGARCH64>(r_type);
 }

-template <>
-std::string rel_to_string<ARC>(u32 r_type) {
-  switch (r_type) {
-  CASE(R_ARC_8);
-  CASE(R_ARC_16);
-  CASE(R_ARC_24);
-  CASE(R_ARC_32);
-  CASE(R_ARC_N8);
-  CASE(R_ARC_N16);
-  CASE(R_ARC_N24);
-  CASE(R_ARC_N32);
-  CASE(R_ARC_SDA);
-  CASE(R_ARC_SECTOFF);
-  CASE(R_ARC_S21H_PCREL);
-  CASE(R_ARC_S21W_PCREL);
-  CASE(R_ARC_S25H_PCREL);
-  CASE(R_ARC_S25W_PCREL);
-  CASE(R_ARC_SDA32);
-  CASE(R_ARC_SDA_LDST);
-  CASE(R_ARC_SDA_LDST1);
-  CASE(R_ARC_SDA_LDST2);
-  CASE(R_ARC_SDA16_LD);
-  CASE(R_ARC_SDA16_LD1);
-  CASE(R_ARC_SDA16_LD2);
-  CASE(R_ARC_S13_PCREL);
-  CASE(R_ARC_W);
-  CASE(R_ARC_32_ME);
-  CASE(R_ARC_32_ME_S);
-  CASE(R_ARC_N32_ME);
-  CASE(R_ARC_SECTOFF_ME);
-  CASE(R_ARC_SDA32_ME);
-  CASE(R_ARC_W_ME);
-  CASE(R_ARC_SECTOFF_ME_1);
-  CASE(R_ARC_SECTOFF_ME_2);
-  CASE(R_ARC_SECTOFF_1);
-  CASE(R_ARC_SECTOFF_2);
-  CASE(R_ARC_SDA_12);
-  CASE(R_ARC_SDA16_ST2);
-  CASE(R_ARC_32_PCREL);
-  CASE(R_ARC_PC32);
-  CASE(R_ARC_GOT32);
-  CASE(R_ARC_GOTPC32);
-  CASE(R_ARC_PLT32);
-  CASE(R_ARC_COPY);
-  CASE(R_ARC_GLOB_DAT);
-  CASE(R_ARC_JMP_SLOT);
-  CASE(R_ARC_RELATIVE);
-  CASE(R_ARC_GOTOFF);
-  CASE(R_ARC_GOTPC);
-  CASE(R_ARC_S21W_PCREL_PLT);
-  CASE(R_ARC_S25H_PCREL_PLT);
-  CASE(R_ARC_JLI_SECTOFF);
-  CASE(R_ARC_TLS_DTPMOD);
-  CASE(R_ARC_TLS_TPOFF);
-  CASE(R_ARC_TLS_GD_GOT);
-  CASE(R_ARC_TLS_GD_LD);
-  CASE(R_ARC_TLS_GD_CALL);
-  CASE(R_ARC_TLS_IE_GOT);
-  CASE(R_ARC_TLS_DTPOFF);
-  CASE(R_ARC_TLS_DTPOFF_S9);
-  CASE(R_ARC_TLS_LE_S9);
-  CASE(R_ARC_TLS_LE_32);
-  CASE(R_ARC_S25W_PCREL_PLT);
-  CASE(R_ARC_S21H_PCREL_PLT);
-  CASE(R_ARC_NPS_CMEM16);
-  }
-  return unknown_type(r_type);
-}
-
 } // namespace mold
@@ -13,7 +13,8 @@ struct X86_64;
 struct I386;
 struct ARM64LE;
 struct ARM64BE;
-struct ARM32;
+struct ARM32LE;
+struct ARM32BE;
 struct RV64LE;
 struct RV64BE;
 struct RV32LE;
@@ -28,7 +29,6 @@ struct SH4LE;
 struct SH4BE;
 struct LOONGARCH64;
 struct LOONGARCH32;
-struct ARC;

 template <typename E> struct ElfSym;
 template <typename E> struct ElfShdr;
@@ -81,7 +81,11 @@ enum : u32 {
  SHT_RELR = 19,
  SHT_CREL = 0x40000014,
  SHT_LOOS = 0x60000000,
+  SHT_ANDROID_REL = 0x60000001,
+  SHT_ANDROID_RELA = 0x60000002,
  SHT_LLVM_ADDRSIG = 0x6fff4c03,
+  SHT_ANDROID_RELR = 0x6fffff00,
+  SHT_GNU_SFRAME = 0x6ffffff4,
  SHT_GNU_HASH = 0x6ffffff6,
  SHT_GNU_VERDEF = 0x6ffffffd,
  SHT_GNU_VERNEED = 0x6ffffffe,
@@ -89,7 +93,6 @@ enum : u32 {
  SHT_HIOS = 0x6fffffff,
  SHT_X86_64_UNWIND = 0x70000001,
  SHT_ARM_EXIDX = 0x70000001,
-  SHT_ARC_ATTRIBUTES = 0x70000001,
  SHT_ARM_ATTRIBUTES = 0x70000003,
  SHT_RISCV_ATTRIBUTES = 0x70000003,
  SHT_LOUSER = 0x80000000,
@@ -192,6 +195,7 @@ enum : u32 {
  PT_GNU_STACK = 0x6474e551,
  PT_GNU_RELRO = 0x6474e552,
  PT_GNU_PROPERTY = 0x6474e553,
+  PT_GNU_SFRAME = 0x6474e554,
  PT_OPENBSD_RANDOMIZE = 0x65a3dbe6,
  PT_ARM_EXIDX = 0x70000001,
  PT_RISCV_ATTRIBUTES = 0x70000003,
@@ -237,7 +241,6 @@ enum : u32 {
  EM_SPARC64 = 43,
  EM_X86_64 = 62,
  EM_AARCH64 = 183,
-  EM_ARC_COMPACT2 = 195,
  EM_RISCV = 243,
  EM_LOONGARCH = 258,
 };
@@ -287,6 +290,13 @@ enum : u32 {
  DT_RELRSZ = 35,
  DT_RELR = 36,
  DT_RELRENT = 37,
+  DT_ANDROID_REL = 0x6000000f,
+  DT_ANDROID_RELSZ = 0x60000010,
+  DT_ANDROID_RELA = 0x60000011,
+  DT_ANDROID_RELASZ = 0x60000012,
+  DT_ANDROID_RELR = 0x6fffe000,
+  DT_ANDROID_RELRSZ = 0x6fffe001,
+  DT_ANDROID_RELRENT = 0x6fffe003,
  DT_GNU_HASH = 0x6ffffef5,
  DT_DEPAUDIT = 0x6ffffefb,
  DT_AUDIT = 0x6ffffefc,
@@ -355,14 +365,16 @@ enum : u32 {
 };

 enum : u32 {
+  ELFCOMPRESS_NONE = 0,
  ELFCOMPRESS_ZLIB = 1,
  ELFCOMPRESS_ZSTD = 2,
 };

 enum : u32 {
-  EF_ARM_ABI_FLOAT_SOFT = 0x00000200,
-  EF_ARM_ABI_FLOAT_HARD = 0x00000400,
-  EF_ARM_EABI_VER5 = 0x05000000,
+  EF_ARM_ABI_FLOAT_SOFT = 0x200,
+  EF_ARM_ABI_FLOAT_HARD = 0x400,
+  EF_ARM_BE8 = 0x800000,
+  EF_ARM_EABI_VER5 = 0x5000000,
 };

 enum : u32 {
@@ -557,6 +569,7 @@ enum : u32 {
  R_AARCH64_LD64_GOT_LO12_NC = 0x138,
  R_AARCH64_LD64_GOTPAGE_LO15 = 0x139,
  R_AARCH64_PLT32 = 0x13a,
+  R_AARCH64_GOTPCREL32 = 0x13b,
  R_AARCH64_TLSGD_ADR_PREL21 = 0x200,
  R_AARCH64_TLSGD_ADR_PAGE21 = 0x201,
  R_AARCH64_TLSGD_ADD_LO12_NC = 0x202,
@@ -807,6 +820,7 @@ enum : u32 {
  R_RISCV_SET8 = 54,
  R_RISCV_SET16 = 55,
  R_RISCV_SET32 = 56,
+  R_RISCV_GOT32_PCREL = 41,
  R_RISCV_32_PCREL = 57,
  R_RISCV_IRELATIVE = 58,
  R_RISCV_PLT32 = 59,
@@ -1365,71 +1379,6 @@ enum : u32 {
  R_LARCH_TLS_DESC_PCREL20_S2 = 126,
 };

-enum : u32 {
-  R_ARC_8 = 1,
-  R_ARC_16 = 2,
-  R_ARC_24 = 3,
-  R_ARC_32 = 4,
-  R_ARC_N8 = 8,
-  R_ARC_N16 = 9,
-  R_ARC_N24 = 10,
-  R_ARC_N32 = 11,
-  R_ARC_SDA = 12,
-  R_ARC_SECTOFF = 13,
-  R_ARC_S21H_PCREL = 14,
-  R_ARC_S21W_PCREL = 15,
-  R_ARC_S25H_PCREL = 16,
-  R_ARC_S25W_PCREL = 17,
-  R_ARC_SDA32 = 18,
-  R_ARC_SDA_LDST = 19,
-  R_ARC_SDA_LDST1 = 20,
-  R_ARC_SDA_LDST2 = 21,
-  R_ARC_SDA16_LD = 22,
-  R_ARC_SDA16_LD1 = 23,
-  R_ARC_SDA16_LD2 = 24,
-  R_ARC_S13_PCREL = 25,
-  R_ARC_W = 26,
-  R_ARC_32_ME = 27,
-  R_ARC_32_ME_S = 105,
-  R_ARC_N32_ME = 28,
-  R_ARC_SECTOFF_ME = 29,
-  R_ARC_SDA32_ME = 30,
-  R_ARC_W_ME = 31,
-  R_ARC_SECTOFF_ME_1 = 41,
-  R_ARC_SECTOFF_ME_2 = 42,
-  R_ARC_SECTOFF_1 = 43,
-  R_ARC_SECTOFF_2 = 44,
-  R_ARC_SDA_12 = 45,
-  R_ARC_SDA16_ST2 = 48,
-  R_ARC_32_PCREL = 49,
-  R_ARC_PC32 = 50,
-  R_ARC_GOT32 = 59,
-  R_ARC_GOTPC32 = 51,
-  R_ARC_PLT32 = 52,
-  R_ARC_COPY = 53,
-  R_ARC_GLOB_DAT = 54,
-  R_ARC_JMP_SLOT = 55,
-  R_ARC_RELATIVE = 56,
-  R_ARC_GOTOFF = 57,
-  R_ARC_GOTPC = 58,
-  R_ARC_S21W_PCREL_PLT = 60,
-  R_ARC_S25H_PCREL_PLT = 61,
-  R_ARC_JLI_SECTOFF = 63,
-  R_ARC_TLS_DTPMOD = 66,
-  R_ARC_TLS_TPOFF = 68,
-  R_ARC_TLS_GD_GOT = 69,
-  R_ARC_TLS_GD_LD = 70,
-  R_ARC_TLS_GD_CALL = 71,
-  R_ARC_TLS_IE_GOT = 72,
-  R_ARC_TLS_DTPOFF = 67,
-  R_ARC_TLS_DTPOFF_S9 = 73,
-  R_ARC_TLS_LE_S9 = 74,
-  R_ARC_TLS_LE_32 = 75,
-  R_ARC_S25W_PCREL_PLT = 76,
-  R_ARC_S21H_PCREL_PLT = 77,
-  R_ARC_NPS_CMEM16 = 78,
-};
-
 // Returns true if a given relocation is of type used for direct
 // function call.
 template <typename E>
@@ -1556,6 +1505,52 @@ template <typename E> using U64 = std::conditional_t<E::is_le, ul64, ub64>;
 template <typename E> using Word = std::conditional_t<E::is_64, U64<E>, U32<E>>;
 template <typename E> using SWord = std::conditional_t<E::is_64, I64<E>, I32<E>>;

+//
+// SFrame is a simple unwind information format used as a lightweight
+// alternative to .eh_frame. A .sframe section consists of a header, an
+// array of Function Descriptor Entries (FDEs) sorted by PC, and a blob
+// of Frame Row Entries (FREs). mold understands SFrame Version 3.
+//
+// https://sourceware.org/binutils/docs/sframe-spec.html
+//
+
+static constexpr u16 SFRAME_MAGIC = 0xdee2;
+
+static constexpr u8 SFRAME_F_FDE_SORTED = 0x1;
+static constexpr u8 SFRAME_F_FRAME_POINTER = 0x2;
+static constexpr u8 SFRAME_F_FDE_FUNC_START_PCREL = 0x4;
+
+static constexpr u8 SFRAME_ABI_AARCH64_ENDIAN_BIG = 1;
+static constexpr u8 SFRAME_ABI_AARCH64_ENDIAN_LITTLE = 2;
+static constexpr u8 SFRAME_ABI_AMD64_ENDIAN_LITTLE = 3;
+static constexpr u8 SFRAME_ABI_S390X_ENDIAN_BIG = 4;
+
+template <typename E>
+struct SFrameHeader {
+  U16<E> magic;
+  u8 version;
+  u8 flags;
+  u8 abi_arch;
+  i8 cfa_fixed_fp_offset;
+  i8 cfa_fixed_ra_offset;
+  u8 auxhdr_len;
+  U32<E> num_fdes;
+  U32<E> num_fres;
+  U32<E> fre_len;
+  U32<E> fdeoff;
+  U32<E> freoff;
+};
+
+// The index part of an SFrame Version 3 FDE. The func_start_offset field
+// is PC-relative (relative to its own address) when the section flag
+// SFRAME_F_FDE_FUNC_START_PCREL is set, which is how mold always emits it.
+template <typename E>
+struct SFrameFdeIdx {
+  I64<E> func_start_offset;
+  U32<E> func_size;
+  U32<E> func_start_fre_off;
+};
+
 template <typename E> requires E::is_64
 struct ElfSym<E> {
  bool is_undef() const { return st_shndx == SHN_UNDEF; }
@@ -1872,13 +1867,15 @@ struct ElfRel<SH4BE> {

 template <typename E> concept supports_ifunc = requires { E::R_IRELATIVE; };
 template <typename E> concept supports_tlsdesc = requires { E::R_TLSDESC; };
+template <typename E> concept supports_sframe = requires { E::sframe_abi; };
 template <typename E> concept needs_thunk = requires { E::thunk_size; };

 template <typename E> concept is_x86_64 = std::same_as<E, X86_64>;
 template <typename E> concept is_i386 = std::same_as<E, I386>;
 template <typename E> concept is_arm64le = std::same_as<E, ARM64LE>;
 template <typename E> concept is_arm64be = std::same_as<E, ARM64BE>;
-template <typename E> concept is_arm32 = std::same_as<E, ARM32>;
+template <typename E> concept is_arm32le = std::same_as<E, ARM32LE>;
+template <typename E> concept is_arm32be = std::same_as<E, ARM32BE>;
 template <typename E> concept is_rv64le = std::same_as<E, RV64LE>;
 template <typename E> concept is_rv64be = std::same_as<E, RV64BE>;
 template <typename E> concept is_rv32le = std::same_as<E, RV32LE>;
@@ -1893,9 +1890,9 @@ template <typename E> concept is_sh4le = std::same_as<E, SH4LE>;
 template <typename E> concept is_sh4be = std::same_as<E, SH4BE>;
 template <typename E> concept is_loongarch64 = std::same_as<E, LOONGARCH64>;
 template <typename E> concept is_loongarch32 = std::same_as<E, LOONGARCH32>;
-template <typename E> concept is_arc = std::same_as<E, ARC>;

 template <typename E> concept is_x86 = is_x86_64<E> || is_i386<E>;
+template <typename E> concept is_arm32 = is_arm32le<E> || is_arm32be<E>;
 template <typename E> concept is_arm64 = is_arm64le<E> || is_arm64be<E>;
 template <typename E> concept is_arm = is_arm64<E> || is_arm32<E>;
 template <typename E> concept is_rv64 = is_rv64le<E> || is_rv64be<E>;
@@ -1914,10 +1911,11 @@ struct X86_64 {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 4096;
  static constexpr u32 e_machine = EM_X86_64;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AMD64_ENDIAN_LITTLE;
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0xcc }; // int3
+  static constexpr u8 trap[] = { 0xcc }; // int3

  static constexpr u32 R_COPY = R_X86_64_COPY;
  static constexpr u32 R_GLOB_DAT = R_X86_64_GLOB_DAT;
@@ -1929,6 +1927,7 @@ struct X86_64 {
  static constexpr u32 R_TPOFF = R_X86_64_TPOFF64;
  static constexpr u32 R_DTPMOD = R_X86_64_DTPMOD64;
  static constexpr u32 R_TLSDESC = R_X86_64_TLSDESC;
+  static constexpr u32 R_SFRAME = R_X86_64_PC64;
  static constexpr u32 R_FUNCALL[] = { R_X86_64_PLT32, R_X86_64_PLTOFF64 };
 };

@@ -1942,7 +1941,7 @@ struct I386 {
  static constexpr u32 plt_hdr_size = 16;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0xcc }; // int3
+  static constexpr u8 trap[] = { 0xcc }; // int3

  static constexpr u32 R_COPY = R_386_COPY;
  static constexpr u32 R_GLOB_DAT = R_386_GLOB_DAT;
@@ -1964,12 +1963,13 @@ struct ARM64LE {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 65536;
  static constexpr u32 e_machine = EM_AARCH64;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AARCH64_ENDIAN_LITTLE;
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
  static constexpr u32 thunk_hdr_size = 0;
-  static constexpr u32 thunk_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x7d, 0x20, 0xd4 }; // brk
+  static constexpr u32 thunk_size = 32;
+  static constexpr u8 trap[] = { 0x00, 0x7d, 0x20, 0xd4 }; // brk

  static constexpr u32 R_COPY = R_AARCH64_COPY;
  static constexpr u32 R_GLOB_DAT = R_AARCH64_GLOB_DAT;
@@ -1981,15 +1981,17 @@ struct ARM64LE {
  static constexpr u32 R_TPOFF = R_AARCH64_TLS_TPREL64;
  static constexpr u32 R_DTPMOD = R_AARCH64_TLS_DTPMOD64;
  static constexpr u32 R_TLSDESC = R_AARCH64_TLSDESC;
+  static constexpr u32 R_SFRAME = R_AARCH64_PREL64;
  static constexpr u32 R_FUNCALL[] = { R_AARCH64_JUMP26, R_AARCH64_CALL26 };
 };

 struct ARM64BE : ARM64LE {
  static constexpr std::string_view name = "arm64be";
  static constexpr bool is_le = false;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AARCH64_ENDIAN_BIG;
 };

-struct ARM32 {
+struct ARM32LE {
  static constexpr std::string_view name = "arm32";
  static constexpr bool is_64 = false;
  static constexpr bool is_le = true;
@@ -2001,7 +2003,7 @@ struct ARM32 {
  static constexpr u32 pltgot_size = 16;
  static constexpr u32 thunk_hdr_size = 16;
  static constexpr u32 thunk_size = 16;
-  static constexpr u8 filler[] = { 0xff, 0xde }; // udf
+  static constexpr u8 trap[] = { 0xff, 0xde }; // udf

  static constexpr u32 R_COPY = R_ARM_COPY;
  static constexpr u32 R_GLOB_DAT = R_ARM_GLOB_DAT;
@@ -2019,6 +2021,11 @@ struct ARM32 {
  };
 };

+struct ARM32BE : ARM32LE {
+  static constexpr std::string_view name = "arm32be";
+  static constexpr bool is_le = false;
+};
+
 struct RV64LE {
  static constexpr std::string_view name = "riscv64";
  static constexpr bool is_64 = true;
@@ -2029,7 +2036,7 @@ struct RV64LE {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x02, 0x90 }; // c.ebreak
+  static constexpr u8 trap[] = { 0x02, 0x90 }; // c.ebreak

  static constexpr u32 R_COPY = R_RISCV_COPY;
  static constexpr u32 R_GLOB_DAT = R_RISCV_64;
@@ -2059,7 +2066,7 @@ struct RV32LE {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x02, 0x90 }; // c.ebreak
+  static constexpr u8 trap[] = { 0x02, 0x90 }; // c.ebreak

  static constexpr u32 R_COPY = R_RISCV_COPY;
  static constexpr u32 R_GLOB_DAT = R_RISCV_32;
@@ -2091,7 +2098,7 @@ struct PPC32 {
  static constexpr u32 pltgot_size = 36;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 36;
-  static constexpr u8 filler[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
+  static constexpr u8 trap[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap

  static constexpr u32 R_COPY = R_PPC_COPY;
  static constexpr u32 R_GLOB_DAT = R_PPC_GLOB_DAT;
@@ -2133,7 +2140,7 @@ struct PPC64V1 : PPC64 {
  static constexpr u32 pltgot_size = 0;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 28;
-  static constexpr u8 filler[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
+  static constexpr u8 trap[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
 };

 struct PPC64V2 : PPC64 {
@@ -2144,7 +2151,7 @@ struct PPC64V2 : PPC64 {
  static constexpr u32 pltgot_size = 0;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 24;
-  static constexpr u8 filler[] = { 0x08, 0x00, 0xe0, 0x7f }; // trap
+  static constexpr u8 trap[] = { 0x08, 0x00, 0xe0, 0x7f }; // trap
 };

 struct S390X {
@@ -2154,10 +2161,11 @@ struct S390X {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 4096;
  static constexpr u32 e_machine = EM_S390X;
+  static constexpr u8 sframe_abi = SFRAME_ABI_S390X_ENDIAN_BIG;
  static constexpr u32 plt_hdr_size = 48;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x07, 0x00 }; // nop
+  static constexpr u8 trap[] = { 0x00, 0x00 }; // invalid

  static constexpr u32 R_COPY = R_390_COPY;
  static constexpr u32 R_GLOB_DAT = R_390_GLOB_DAT;
@@ -2168,6 +2176,7 @@ struct S390X {
  static constexpr u32 R_DTPOFF = R_390_TLS_DTPOFF;
  static constexpr u32 R_TPOFF = R_390_TLS_TPOFF;
  static constexpr u32 R_DTPMOD = R_390_TLS_DTPMOD;
+  static constexpr u32 R_SFRAME = R_390_PC64;
  static constexpr u32 R_FUNCALL[] = { R_390_PLT32DBL };
 };

@@ -2181,7 +2190,7 @@ struct SPARC64 {
  static constexpr u32 plt_hdr_size = 128;
  static constexpr u32 plt_size = 32;
  static constexpr u32 pltgot_size = 32;
-  static constexpr u8 filler[] = { 0x91, 0xd0, 0x20, 0x05 }; // ta 5
+  static constexpr u8 trap[] = { 0x91, 0xd0, 0x20, 0x05 }; // ta 5

  static constexpr u32 R_COPY = R_SPARC_COPY;
  static constexpr u32 R_GLOB_DAT = R_SPARC_GLOB_DAT;
@@ -2205,7 +2214,7 @@ struct M68K {
  static constexpr u32 plt_hdr_size = 18;
  static constexpr u32 plt_size = 14;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0x4a, 0xfc }; // illegal
+  static constexpr u8 trap[] = { 0x4a, 0xfc }; // illegal

  static constexpr u32 R_COPY = R_68K_COPY;
  static constexpr u32 R_GLOB_DAT = R_68K_GLOB_DAT;
@@ -2228,7 +2237,7 @@ struct SH4LE {
  static constexpr u32 plt_hdr_size = 16;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 12;
-  static constexpr u8 filler[] = { 0x00, 0x90 }; // nop
+  static constexpr u8 trap[] = { 0xfd, 0xff }; // illegal

  static constexpr u32 R_COPY = R_SH_COPY;
  static constexpr u32 R_GLOB_DAT = R_SH_GLOB_DAT;
@@ -2244,7 +2253,7 @@ struct SH4LE {
 struct SH4BE : SH4LE {
  static constexpr std::string_view name = "sh4be";
  static constexpr bool is_le = false;
-  static constexpr u8 filler[] = { 0x90, 0x00 }; // nop
+  static constexpr u8 trap[] = { 0xff, 0xfd }; // illegal
 };

 struct LOONGARCH64 {
@@ -2257,7 +2266,7 @@ struct LOONGARCH64 {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0
+  static constexpr u8 trap[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0

  static constexpr u32 R_COPY = R_LARCH_COPY;
  static constexpr u32 R_GLOB_DAT = R_LARCH_64;
@@ -2282,7 +2291,7 @@ struct LOONGARCH32 {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0
+  static constexpr u8 trap[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0

  static constexpr u32 R_COPY = R_LARCH_COPY;
  static constexpr u32 R_GLOB_DAT = R_LARCH_32;
@@ -2297,27 +2306,4 @@ struct LOONGARCH32 {
  static constexpr u32 R_FUNCALL[] = { R_LARCH_B26, R_LARCH_CALL36 };
 };

-struct ARC {
-  static constexpr std::string_view name = "arc";
-  static constexpr bool is_64 = false;
-  static constexpr bool is_le = true;
-  static constexpr bool is_rela = true;
-  static constexpr u32 page_size = 8192;
-  static constexpr u32 e_machine = EM_ARC_COMPACT2;
-  static constexpr u32 plt_hdr_size = 24;
-  static constexpr u32 plt_size = 16;
-  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0, 0, 0, 0 };
-
-  static constexpr u32 R_COPY = R_ARC_COPY;
-  static constexpr u32 R_GLOB_DAT = R_ARC_GLOB_DAT;
-  static constexpr u32 R_JUMP_SLOT = R_ARC_JMP_SLOT;
-  static constexpr u32 R_ABS = R_ARC_32;
-  static constexpr u32 R_RELATIVE = R_ARC_RELATIVE;
-  static constexpr u32 R_DTPOFF = R_ARC_TLS_DTPOFF;
-  static constexpr u32 R_TPOFF = R_ARC_TLS_TPOFF;
-  static constexpr u32 R_DTPMOD = R_ARC_TLS_DTPMOD;
-  static constexpr u32 R_FUNCALL[] = { R_ARC_S25W_PCREL_PLT };
-};
-
 } // namespace mold
@@ -0,0 +1,32 @@
+#include "config.h"
+#include "mold.h"
+#include "mold-git-hash.h"
+
+#if MOLD_USE_MIMALLOC
+# include <mimalloc.h>
+#endif
+
+#if MOLD_USE_SYSTEM_MIMALLOC
+// Including mimalloc-new-delete.h overrides the new/delete operators.
+// We need it only when using mimalloc as a dynamic library.
+// This header should be included in only one source file, so we do
+// it in this file.
+# include <mimalloc-new-delete.h>
+#endif
+
+std::string mold::mold_version =
+#ifdef MOLD_GIT_HASH
+  "mold " MOLD_VERSION " (" MOLD_GIT_HASH "; compatible with GNU ld)";
+#else
+  "mold " MOLD_VERSION " (compatible with GNU ld)";
+#endif
+
+int main(int argc, char **argv) {
+#if MOLD_USE_MIMALLOC
+  // Silence mimalloc warnings that users can ignore
+  mi_option_disable(mi_option_verbose);
+  mi_option_disable(mi_option_show_errors);
+#endif
+
+  return mold::mold_main<mold::MOLD_FIRST_TARGET>(argc, argv);
+}
@@ -0,0 +1,55 @@
+#include "mold.h"
+
+namespace mold {
+
+static std::string_view fatal_mono = "mold: fatal: ";
+static std::string_view fatal_color = "mold: \033[0;1;31mfatal:\033[0m ";
+static std::string_view error_mono = "mold: error: ";
+static std::string_view error_color = "mold: \033[0;1;31merror:\033[0m ";
+static std::string_view warning_mono = "mold: warning: ";
+static std::string_view warning_color = "mold: \033[0;1;35mwarning:\033[0m ";
+
+template <typename E>
+Fatal<E>::Fatal(Context<E> &ctx) {
+  out << (ctx.arg.color_diagnostics ? fatal_color : fatal_mono);
+}
+
+template <typename E>
+[[noreturn]] Fatal<E>::~Fatal() {
+  out.emit();
+  cleanup();
+  _exit(1);
+}
+
+template <typename E>
+Error<E>::Error(Context<E> &ctx) {
+  if (ctx.arg.noinhibit_exec) {
+    out << (ctx.arg.color_diagnostics ? warning_color : warning_mono);
+  } else {
+    out << (ctx.arg.color_diagnostics ? error_color : error_mono);
+    ctx.has_error = true;
+  }
+}
+
+template <typename E>
+Warn<E>::Warn(Context<E> &ctx) {
+  if (ctx.arg.suppress_warnings)
+    return;
+
+  out.emplace(std::cerr);
+
+  if (ctx.arg.fatal_warnings) {
+    *out << (ctx.arg.color_diagnostics ? error_color : error_mono);
+    ctx.has_error = true;
+  } else {
+    *out << (ctx.arg.color_diagnostics ? warning_color : warning_mono);
+  }
+}
+
+using E = MOLD_TARGET;
+
+template class Fatal<E>;
+template class Error<E>;
+template class Warn<E>;
+
+} // namespace mold
@@ -1,5 +1,4 @@
 #include "mold.h"
-#include "../lib/archive-file.h"

 namespace mold {

@@ -14,7 +13,7 @@ static bool is_text_file(MappedFile *mf) {
 }

 template <typename E>
-static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
+static bool is_gcc_lto_obj(MappedFile *mf, bool has_gcc_plugin) {
  const char *data = mf->get_contents().data();
  ElfEhdr<E> &ehdr = *(ElfEhdr<E> *)data;
  ElfShdr<E> *sh_begin = (ElfShdr<E> *)(data + ehdr.e_shoff);
@@ -31,7 +30,7 @@ static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
    // the LTO linker plugin is available and falls back as regular
    // objects otherwise. GCC FAT LTO object can be identified by the
    // presence of `.gcc.lto_.symtab` section.
-    if (has_plugin) {
+    if (has_gcc_plugin) {
      std::string_view name = data + shdrs[shstrtab_idx].sh_offset + sec.sh_name;
      if (name.starts_with(".gnu.lto_.symtab."))
        return true;
@@ -69,11 +68,15 @@ static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
 template <typename E>
 FileType get_file_type(Context<E> &ctx, MappedFile *mf) {
  std::string_view data = mf->get_contents();
-  bool has_plugin = !ctx.arg.plugin.empty();
-
  if (data.empty())
    return FileType::EMPTY;

+  // GCC FAT LTO objects can be linked as regular ELF objects. If the active
+  // plugin is LLVM's, treat them as regular objects so that we can fall back
+  // to native code instead of routing them through GCC LTO handling.
+  bool has_gcc_plugin = !ctx.arg.plugin.empty() &&
+                        ctx.arg.plugin.find("LLVMgold.") == std::string_view::npos;
+
  if (data.starts_with("\177ELF")) {
    u8 byte_order = ((ElfEhdr<I386> *)data.data())->e_ident[EI_DATA];

@@ -82,10 +85,10 @@ FileType get_file_type(Context<E> &ctx, MappedFile *mf) {

      if (ehdr.e_type == ET_REL) {
        if (ehdr.e_ident[EI_CLASS] == ELFCLASS32) {
-          if (is_gcc_lto_obj<I386>(mf, has_plugin))
+          if (is_gcc_lto_obj<I386>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        } else {
-          if (is_gcc_lto_obj<X86_64>(mf, has_plugin))
+          if (is_gcc_lto_obj<X86_64>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        }
        return FileType::ELF_OBJ;
@@ -98,10 +101,10 @@ FileType get_file_type(Context<E> &ctx, MappedFile *mf) {

      if (ehdr.e_type == ET_REL) {
        if (ehdr.e_ident[EI_CLASS] == ELFCLASS32) {
-          if (is_gcc_lto_obj<M68K>(mf, has_plugin))
+          if (is_gcc_lto_obj<M68K>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        } else {
-          if (is_gcc_lto_obj<SPARC64>(mf, has_plugin))
+          if (is_gcc_lto_obj<SPARC64>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        }
        return FileType::ELF_OBJ;
@@ -139,7 +142,7 @@ static std::string_view get_elf_type(u8 *buf) {
  case EM_X86_64:
    return X86_64::name;
  case EM_ARM:
-    return ARM32::name;
+    return is_le ? ARM32LE::name : ARM32BE::name;
  case EM_AARCH64:
    return is_le ? ARM64LE::name : ARM64BE::name;
  case EM_RISCV:
@@ -160,8 +163,6 @@ static std::string_view get_elf_type(u8 *buf) {
    return is_le ? SH4LE::name : SH4BE::name;
  case EM_LOONGARCH:
    return is_64 ? LOONGARCH64::name : LOONGARCH32::name;
-  case EM_ARC_COMPACT2:
-    return ARC::name;
  default:
    return "";
  }
@@ -190,7 +191,7 @@ get_machine_type(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
        return get_elf_type(child->data);
    return "";
  case FileType::TEXT:
-    return Script(ctx, rctx, mf).get_script_output_type();
+    return Script(ctx, mf, &rctx).get_script_output_type();
  default:
    return "";
  }
@@ -4,31 +4,58 @@

 #include "mold.h"

+#include <fstream>
+#include <tbb/concurrent_unordered_map.h>
 #include <tbb/concurrent_vector.h>
 #include <tbb/parallel_for_each.h>

 namespace mold {

 template <typename E>
-static bool should_keep(const InputSection<E> &isec) {
+static bool should_keep(Context<E> &ctx, const InputSection<E> &isec) {
  u32 type = isec.shdr().sh_type;
  u32 flags = isec.shdr().sh_flags;
-  std::string_view name = isec.name();
-
  if constexpr (is_ppc32<E>)
-    if (name == ".got2")
+    if (isec.name == ".got2")
      return true;

+  // KEEP'ed by a linker script
+  if (!isec.file.script_match.empty()) {
+    i32 rank = isec.file.script_match[isec.shndx];
+    if (rank != -1 && ctx.script_ranks[rank].keep)
+      return true;
+  }
+
  return (flags & SHF_GNU_RETAIN) ||
         type == SHT_NOTE ||
         type == SHT_INIT_ARRAY ||
         type == SHT_FINI_ARRAY ||
         type == SHT_PREINIT_ARRAY ||
-         name.starts_with(".ctors") ||
-         name.starts_with(".dtors") ||
-         name.starts_with(".init") ||
-         name.starts_with(".fini") ||
-         is_c_identifier(name);
+         isec.name.starts_with(".ctors") ||
+         isec.name.starts_with(".dtors") ||
+         isec.name.starts_with(".init") ||
+         isec.name.starts_with(".fini");
+}
+
+// Sections whose names are valid C identifiers can be referenced via
+// __start_<name>/__stop_<name> symbols, which the linker synthesizes.
+// Such sections must be kept alive only if such a marker symbol is
+// referenced from a live section. This map lets us find all sections
+// of a given name when we encounter such a reference during marking.
+template <typename E>
+using StartStopMap =
+  tbb::concurrent_unordered_multimap<std::string_view, InputSection<E> *>;
+
+template <typename E>
+static StartStopMap<E> build_start_stop_map(Context<E> &ctx) {
+  StartStopMap<E> map;
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections)
+      if (isec && isec->is_alive && (isec->shdr().sh_flags & SHF_ALLOC) &&
+          is_c_identifier(isec->name))
+        map.insert({isec->name, isec.get()});
+  });
+  return map;
 }

 template <typename E>
@@ -66,11 +93,12 @@ collect_root_set(Context<E> &ctx) {
      // reduce the amount of non-memory-mapped segments, you should
      // use `strip` command, compile without debug info or use
      // --strip-all linker option.
-      u32 flags = isec->shdr().sh_flags;
-      if (!(flags & SHF_ALLOC))
+      if (!(isec->shdr().sh_flags & SHF_ALLOC)) {
        isec->is_visited = true;
+        continue;
+      }

-      if (should_keep(*isec))
+      if (should_keep(ctx, *isec))
        enqueue_section(isec.get());
    }
  });
@@ -94,9 +122,18 @@ collect_root_set(Context<E> &ctx) {
  return rootset;
 }

+static std::string_view start_stop_name(std::string_view sym) {
+  if (sym.starts_with("__start_"))
+    return sym.substr(8);
+  if (sym.starts_with("__stop_"))
+    return sym.substr(7);
+  return "";
+}
+
 template <typename E>
-static void visit(Context<E> &ctx, InputSection<E> *isec,
-                  tbb::feeder<InputSection<E> *> &feeder, i64 depth) {
+static void visit_section(Context<E> &ctx, InputSection<E> *isec,
+                          tbb::feeder<InputSection<E> *> &feeder, i64 depth,
+                          const StartStopMap<E> &start_stop_map) {
  assert(isec->is_visited);

  // Mark a section alive. For better performacne, we don't call
@@ -104,7 +141,7 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
  auto mark = [&](InputSection<E> *sec) {
    if (mark_section(sec)) {
      if (depth < 3)
-        visit(ctx, sec, feeder, depth + 1);
+        visit_section(ctx, sec, feeder, depth + 1, start_stop_map);
      else
        feeder.add(sec);
    }
@@ -121,10 +158,21 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
  for (const ElfRel<E> &rel : isec->get_rels(ctx)) {
    // Symbol can refer to either a section fragment or an input section.
    Symbol<E> &sym = *isec->file.symbols[rel.r_sym];
-    if (SectionFragment<E> *frag = sym.get_frag())
+    if (SectionFragment<E> *frag = sym.get_frag()) {
      frag->is_alive = true;
-    else
-      mark(sym.get_input_section());
+      continue;
+    }
+
+    mark(sym.get_input_section());
+
+    // A reference to __start_<name> or __stop_<name> keeps every section
+    // named <name> alive, mirroring how those symbols are defined.
+    if (std::string_view sec = start_stop_name(sym.name());
+        !sec.empty()) {
+      auto [i, end] = start_stop_map.equal_range(sec);
+      for (; i != end; ++i)
+        mark(i->second);
+    }
  }

  if constexpr (is_arm32<E>)
@@ -134,12 +182,13 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
 // Mark all reachable sections
 template <typename E>
 static void mark(Context<E> &ctx,
-                 tbb::concurrent_vector<InputSection<E> *> &rootset) {
+                 tbb::concurrent_vector<InputSection<E> *> &rootset,
+                 const StartStopMap<E> &start_stop_map) {
  Timer t(ctx, "mark");

  tbb::parallel_for_each(rootset, [&](InputSection<E> *isec,
                                      tbb::feeder<InputSection<E> *> &feeder) {
-    visit(ctx, isec, feeder, 0);
+    visit_section(ctx, isec, feeder, 0, start_stop_map);
  });
 }

@@ -147,25 +196,49 @@ static void mark(Context<E> &ctx,
 template <typename E>
 static void sweep(Context<E> &ctx) {
  Timer t(ctx, "sweep");
-  static Counter counter("garbage_sections");

-  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
-    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+  std::vector<std::vector<InputSection<E> *>> sections(ctx.objs.size());
+
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    ObjectFile<E> &file = *ctx.objs[i];
+
+    for (std::unique_ptr<InputSection<E>> &isec : file.sections) {
      if (isec && isec->is_alive && !isec->is_visited) {
-        if (ctx.arg.print_gc_sections)
-          Out(ctx) << "removing unused section " << *isec;
        isec->kill();
-        counter++;
+        sections[i].push_back(isec.get());
      }
    }
  });
+
+  std::string &path = ctx.arg.print_gc_sections;
+
+  if (!path.empty()) {
+    std::ostream *out = &std::cout;
+    std::ofstream file;
+
+    if (path != "-") {
+      file.open(path);
+      if (file.fail())
+        Fatal(ctx) << "--print-gc-sections: cannot open " << path << ": "
+                   << errno_string();
+      out = &file;
+    }
+
+    i64 saved_bytes = 0;
+    for (std::span<InputSection<E> *> vec : sections)
+      for (InputSection<E> *isec : vec)
+        *out << "removing unused section " << *isec << '\n';
+
+    *out << "GC saved " << saved_bytes << " bytes\n";
+  }
 }

 template <typename E>
 void gc_sections(Context<E> &ctx) {
  Timer t(ctx, "gc");
  tbb::concurrent_vector<InputSection<E> *> rootset = collect_root_set(ctx);
-  mark(ctx, rootset);
+  StartStopMap<E> start_stop_map = build_start_stop_map(ctx);
+  mark(ctx, rootset, start_stop_map);
  sweep(ctx);
 }

@@ -456,11 +456,8 @@ read_address_ranges(Context<E> &ctx, const Compunit &cu) {
        Fatal(ctx) << "--gdb-index: missing DW_AT_rnglists_base";

      u8 *base = buf + rnglists_base;
-      i64 num_offsets = *(U32<E> *)(base - 4);
      Offset *offsets = (Offset *)base;
-
-      for (i64 i = 0; i < num_offsets; i++)
-        read_rnglist_range<E>(vec, base + offsets[i], addrx, low_pc.value);
+      read_rnglist_range<E>(vec, base + offsets[ranges.value], addrx, low_pc.value);
    }
    return vec;
  }
@@ -629,8 +626,10 @@ static std::vector<Compunit> read_compunits(Context<E> &ctx) {

 template <typename E>
 std::span<u8> get_buffer(Context<E> &ctx, Chunk<E> *chunk) {
-  if (chunk->is_compressed)
-    return chunk->uncompressed_data;
+  if (chunk->is_compressed) {
+    CompressedSection<E> &sec = *(CompressedSection<E> *)chunk;
+    return {sec.uncompressed_data.get(), (size_t)sec.chdr.ch_size};
+  }
  return {ctx.buf + chunk->shdr.sh_offset, (size_t)chunk->shdr.sh_size};
 }

@@ -713,9 +712,11 @@ void write_gdb_index(Context<E> &ctx) {

  i64 bufsize = hdr.const_pool_offset + offset;

-  // Allocate an output buffer
-  ctx.output_file->buf2.resize(bufsize);
-  u8 *buf = ctx.output_file->buf2.data();
+  // Allocate an output buffer. We use malloc instead of vector to
+  // avoid zero-initializing the entire buffer.
+  ctx.output_file->buf2 = (u8 *)malloc(bufsize);
+  ctx.output_file->buf2_size = bufsize;
+  u8 *buf = ctx.output_file->buf2;

  // Write a section header
  memcpy(buf, &hdr, sizeof(hdr));
@@ -730,18 +731,25 @@ void write_gdb_index(Context<E> &ctx) {
  }

  // Write address areas
-  for (i64 i = 0; i < cus.size(); i++) {
-    for (std::pair<u64, u64> range : cus[i].ranges) {
+  std::vector<i64> range_offsets(cus.size());
+  for (i64 i = 1; i < cus.size(); i++)
+    range_offsets[i] = range_offsets[i - 1] + cus[i - 1].ranges.size() * 20;
+
+  tbb::parallel_for_each(cus, [&](Compunit &cu) {
+    i64 i = &cu - cus.data();
+    u8 *p = buf + hdr.ranges_offset + range_offsets[i];
+    for (std::pair<u64, u64> range : cu.ranges) {
      *(ul64 *)p = range.first;
      *(ul64 *)(p + 8) = range.second;
      *(ul32 *)(p + 16) = i;
      p += 20;
    }
-  }
+  });

  // Write a symbol table
  u32 mask = ht_size - 1;
  ul32 *ht = (ul32 *)(buf + hdr.symtab_offset);
+  memset(ht, 0, ht_size * 8);

  for (Entry *ent : entries) {
    u32 hash = ent->value.gdb_hash;
@@ -755,22 +763,35 @@ void write_gdb_index(Context<E> &ctx) {
    ht[j * 2 + 1] = ent->value.type_offset;
  }

-  // Write types
-  for (i64 i = 0; i < cus.size(); i++) {
-    Compunit &cu = cus[i];
-    u8 *base = buf + hdr.const_pool_offset;
+  // Write types. Use MapValue::count as an atomic slot counter.
+  u8 *base = buf + hdr.const_pool_offset;

+  for (Entry *ent : entries)
+    ent->value.count = 0;
+
+  tbb::parallel_for_each(cus, [&](Compunit &cu) {
+    i64 i = &cu - cus.data();
    for (i64 j = 0; j < cu.nametypes.size(); j++) {
-      ul32 *p = (ul32 *)(base + cu.entries[j]->type_offset);
-      i64 idx = ++p[0];
+      MapValue *ent = cu.entries[j];
+      ul32 *p = (ul32 *)(base + ent->type_offset);
+      i64 idx = ++ent->count;
      p[idx] = (cu.nametypes[j].type << 24) | i;
    }
-  }
+  });
+
+  // Write the final counts into the buffer.
+  tbb::parallel_for_each(entries, [&](Entry *ent) {
+    ul32 *p = (ul32 *)(base + ent->value.type_offset);
+    p[0] = ent->value.count;
+    // Sort entries for deterministic output
+    std::sort(p + 1, p + 1 + ent->value.count);
+  });

  // Write names
  tbb::parallel_for_each(entries, [&](Entry *ent) {
-    memcpy(buf + hdr.const_pool_offset + ent->value.name_offset,
-           ent->key, ent->keylen);
+    u8 *dst = buf + hdr.const_pool_offset + ent->value.name_offset;
+    memcpy(dst, ent->key, ent->keylen);
+    dst[ent->keylen] = '\0';
  });

  // Update the section size and rewrite the section header
@@ -69,6 +69,7 @@

 #include <array>
 #include <cstdio>
+#include <fstream>
 #include <tbb/concurrent_unordered_map.h>
 #include <tbb/concurrent_vector.h>
 #include <tbb/enumerable_thread_specific.h>
@@ -122,18 +123,24 @@ static void uniquify_cies(Context<E> &ctx) {
 template <typename E>
 static bool is_eligible(Context<E> &ctx, InputSection<E> &isec) {
  const ElfShdr<E> &shdr = isec.shdr();
-  std::string_view name = isec.name();

  if (shdr.sh_size == 0 || !(shdr.sh_flags & SHF_ALLOC) ||
-      shdr.sh_type == SHT_NOBITS || is_c_identifier(name))
+      shdr.sh_type == SHT_NOBITS || is_c_identifier(isec.name))
    return false;

  if (shdr.sh_flags & SHF_EXECINSTR)
    return (ctx.arg.icf_all || !isec.address_taken) &&
-           name != ".init" && name != ".fini";
+           isec.name != ".init" && isec.name != ".fini";
+
+  // .gcc_except_table contains a compiler-generated table. Pointer
+  // equality for the section is not significant because only the C++
+  // exception handling code will use the table at runtime.
+  if (isec.name == ".gcc_except_table" ||
+      isec.name.starts_with(".gcc_except_table."))
+    return true;

  bool is_readonly = !(shdr.sh_flags & SHF_WRITE);
-  bool is_relro = isec.name().starts_with(".data.rel.ro");
+  bool is_relro = isec.name.starts_with(".data.rel.ro");
  return (ctx.arg.ignore_data_address_equality || !isec.address_taken) &&
         (is_readonly || is_relro);
 }
@@ -248,7 +255,7 @@ static Digest compute_digest(Context<E> &ctx, InputSection<E> &isec) {
  auto hash_symbol = [&](Symbol<E> &sym) {
    InputSection<E> *isec = sym.get_input_section();

-    if (!sym.file) {
+    if (!sym.file || sym.is_imported) {
      hash('1');
      hash((u64)&sym);
    } else if (SectionFragment<E> *frag = sym.get_frag()) {
@@ -472,24 +479,32 @@ static void print_icf_sections(Context<E> &ctx) {
                       return a->get_priority() < b->get_priority();
                     });

+  std::ostream *out = &std::cout;
+  std::ofstream file;
+
+  std::string &path = ctx.arg.print_icf_sections;
+  if (path != "-") {
+    file.open(path);
+    if (file.fail())
+      Fatal(ctx) << "--print-icf-sections: cannot open " << path << ": "
+                 << errno_string();
+    out = &file;
+  }
+
  i64 saved_bytes = 0;

  for (InputSection<E> *leader : leaders) {
    auto [begin, end] = map.equal_range(leader);
-    if (begin == end)
-      continue;
-
-    Out(ctx) << "selected section " << *leader;
-
-    i64 n = 0;
-    for (auto it = begin; it != end; it++) {
-      Out(ctx) << "  removing identical section " << *it->second;
-      n++;
+    if (begin != end) {
+      *out << "selected section " << *leader << '\n';
+      for (auto it = begin; it != end; it++) {
+        *out << "  removing identical section " << *it->second << '\n';
+        saved_bytes += leader->contents.size();
+      }
    }
-    saved_bytes += leader->contents.size() * n;
  }

-  Out(ctx) << "ICF saved " << saved_bytes << " bytes";
+  *out << "ICF saved " << saved_bytes << " bytes\n";
 }

 template <typename E>
@@ -596,9 +611,21 @@ void icf_sections(Context<E> &ctx) {
    ctx.on_exit.push_back([=] { delete map; });
  }

-  if (ctx.arg.print_icf_sections)
+  if (!ctx.arg.print_icf_sections.empty())
    print_icf_sections(ctx);

+  // Update alignment of leaders.
+  {
+    Timer t(ctx, "update_alignment");
+    tbb::parallel_for_each(ctx.objs, [](ObjectFile<E> *file) {
+      for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+        if (isec && isec->is_alive && isec->leader && isec->leader != isec.get()) {
+          update_maximum(isec->leader->p2align, isec->p2align);
+        }
+      }
+    });
+  }
+
  // Eliminate duplicate sections.
  // Symbols pointing to eliminated sections will be redirected on the fly when
  // exporting to the symtab.
@@ -93,6 +93,15 @@ InputFile<E>::InputFile(Context<E> &ctx, MappedFile *mf)
  shstrtab = this->get_string(ctx, shstrtab_idx);
 }

+template <typename E>
+void InputFile<E>::populate_symbol_names() {
+  symbol_names.reserve(elf_syms.size());
+  for (const ElfSym<E> &esym : elf_syms) {
+    const char *p = symbol_strtab.data() + esym.st_name;
+    symbol_names.emplace_back(p, strlen(p));
+  }
+}
+
 template <typename E>
 ElfShdr<E> *InputFile<E>::find_section(i64 type) {
  for (ElfShdr<E> &sec : elf_sections)
@@ -112,7 +121,7 @@ std::string_view InputFile<E>::get_source_name() const {

 template <typename E>
 static bool is_debug_section(const ElfShdr<E> &shdr, std::string_view name) {
-  return !(shdr.sh_flags & SHF_ALLOC) && name.starts_with(".debug");
+  return !(shdr.sh_flags & SHF_ALLOC) && name.starts_with(".debug_");
 }

 template <typename E>
@@ -317,10 +326,6 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
      }
    }

-    if constexpr (is_arc<E>)
-      if (shdr.sh_type == SHT_ARC_ATTRIBUTES)
-        continue;
-
    switch (shdr.sh_type) {
    case SHT_GROUP: {
      // Get the signature of this section group.
@@ -333,7 +338,7 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
        signature = this->shstrtab.data() +
                    this->elf_sections[get_shndx(esym)].sh_name;
      } else {
-        signature = this->symbol_strtab.data() + esym.st_name;
+        signature = this->symbol_names[shdr.sh_info];
      }

      // Ignore a broken comdat group GCC emits for .debug_macros.
@@ -429,6 +434,7 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
        continue;

      this->sections[i] = std::make_unique<InputSection<E>>(ctx, *this, i);
+      InputSection<E> *isec = this->sections[i].get();

      // Save .llvm_addrsig for --icf=safe.
      if (shdr.sh_type == SHT_LLVM_ADDRSIG && !ctx.arg.relocatable) {
@@ -450,19 +456,21 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
        this->has_ctors = true;

      if (name == ".eh_frame")
-        eh_frame_sections.push_back(this->sections[i].get());
+        eh_frame_sections.push_back(isec);
+
+      if constexpr (supports_sframe<E>)
+        if (name == ".sframe")
+          sframe_sections.push_back(isec);
+
+      if (name == ".debug_info" && !(shdr.sh_flags & SHF_ALLOC))
+        debug_info = isec;

      if constexpr (is_ppc32<E>)
        if (name == ".got2")
-          extra.got2 = this->sections[i].get();
+          extra.got2 = isec;

      // Save debug sections for --gdb-index.
      if (ctx.arg.gdb_index) {
-        InputSection<E> *isec = this->sections[i].get();
-
-        if (name == ".debug_info")
-          debug_info = isec;
-
        // If --gdb-index is given, contents of .debug_gnu_pubnames and
        // .debug_gnu_pubtypes are copied to .gdb_index, so keeping them
        // in an output file is just a waste of space.
@@ -629,6 +637,96 @@ void ObjectFile<E>::parse_ehframe(Context<E> &ctx) {
  }
 }

+// Returns the byte length of the SFrame FRE block at offset `offset`:
+// a 5-byte attribute header followed by a series of frame row
+// entries, each of which is a start address (whose width is given by
+// the attribute header), a one-byte info field and a number of
+// variable-width data words encoded in that info field.
+template <typename E>
+static i64 sframe_fre_block_size(std::string_view data, i64 offset) {
+  const u8 *attr = (const u8 *)data.data() + offset;
+  i64 num_fres = *(U16<E> *)attr;
+  i64 addr_size = 1 << bits(attr[2], 3, 0);
+
+  i64 p = offset + 5;
+  for (i64 i = 0; i < num_fres; i++) {
+    u8 info = data[p + addr_size];
+    i64 num_words = bits(info, 4, 1);
+    i64 word_size = 1 << bits(info, 6, 5);
+    p += addr_size + 1 + num_words * word_size;
+  }
+  return p - offset;
+}
+
+// .sframe is a compact stack-unwinding format. Just like .eh_frame, the
+// linker has to understand its contents: an output .sframe section is a
+// single header followed by a PC-sorted index of function descriptor
+// entries (FDEs) and a blob of frame row entries (FREs). This function
+// parses an input .sframe section into individual FDEs so that we can
+// later drop the dead ones, sort the survivors and rewrite the header.
+//
+// Unlike .eh_frame, the variable-length FRE data carries no relocations,
+// so we copy it to the output verbatim. The only relocated field is each
+// FDE's func_start, which points to the function the FDE describes; we
+// use it both to find the function (for garbage collection and to obtain
+// its output address) and to re-emit a PC-relative offset.
+template <typename E>
+void ObjectFile<E>::parse_sframe(Context<E> &ctx) requires supports_sframe<E> {
+  for (InputSection<E> *isec : sframe_sections) {
+    // The input section is consumed by the linker; it's not copied to the
+    // output as-is but reconstructed into ctx.sframe.
+    isec->is_alive = false;
+
+    std::string_view data = this->get_string(ctx, isec->shdr());
+    const SFrameHeader<E> &hdr = *(const SFrameHeader<E> *)data.data();
+
+    if (hdr.magic != SFRAME_MAGIC)
+      Fatal(ctx) << *isec << ": corrupted .sframe section";
+    if (hdr.abi_arch != E::sframe_abi)
+      Fatal(ctx) << *isec << ": .sframe is incompatible with " << E::name;
+
+    // We support only SFrame Version 3. A section written in an older
+    // version (e.g. by an old assembler) isn't an error; we just ignore
+    // it, so the functions it covers won't have SFrame info in the output.
+    if (hdr.version != 3)
+      continue;
+
+    i64 hdr_len = sizeof(SFrameHeader<E>) + hdr.auxhdr_len;
+    i64 num_fdes = hdr.num_fdes;
+    i64 fde_off = hdr_len + hdr.fdeoff;
+    i64 fre_off = hdr_len + hdr.freoff;
+
+    std::span<ElfRel<E>> rels = isec->get_rels(ctx);
+    i64 rel_idx = 0;
+
+    for (i64 i = 0; i < num_fdes; i++) {
+      i64 idx_off = fde_off + i * sizeof(SFrameFdeIdx<E>);
+      const SFrameFdeIdx<E> &ent =
+        *(const SFrameFdeIdx<E> *)(data.data() + idx_off);
+
+      // Find the relocation for this FDE's func_start field. An FDE without
+      // one isn't tied to any function (`ld -r` can emit such dead FDEs),
+      // so we drop it.
+      while (rel_idx < rels.size() && rels[rel_idx].r_offset < idx_off)
+        rel_idx++;
+      if (rel_idx == rels.size() || rels[rel_idx].r_offset != idx_off)
+        continue;
+
+      const ElfRel<E> &rel = rels[rel_idx];
+      i64 off = fre_off + ent.func_start_fre_off;
+
+      SFrameFde<E> fde;
+      fde.isec = get_section(this->elf_syms[rel.r_sym]);
+      fde.sym = this->symbols[rel.r_sym];
+      fde.addend = rel.r_addend;
+      fde.fre = data.substr(off, sframe_fre_block_size<E>(data, off));
+      fde.func_size = ent.func_size;
+      fde.num_fres = *(U16<E> *)(data.data() + off);
+      sframe_fdes.push_back(fde);
+    }
+  }
+}
+
 template <typename E>
 void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
  if (this->elf_syms.empty())
@@ -651,7 +749,7 @@ void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
    if (esym.st_type == STT_SECTION)
      name = this->shstrtab.data() + this->elf_sections[get_shndx(esym)].sh_name;
    else
-      name = this->symbol_strtab.data() + esym.st_name;
+      name = this->symbol_names[i];

    Symbol<E> &sym = this->local_syms[i];
    sym.set_name(name);
@@ -679,7 +777,7 @@ void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
      has_common_symbol = true;

    // Get a symbol name
-    std::string_view key = this->symbol_strtab.data() + esym.st_name;
+    std::string_view key = this->symbol_names[i];
    std::string_view name = key;

    // Parse symbol version after atsign
@@ -739,11 +837,21 @@ void ObjectFile<E>::convert_mergeable_sections(Context<E> &ctx) {
      continue;

    const ElfShdr<E> &shdr = isec->shdr();
-    if (!(shdr.sh_flags & SHF_MERGE))
+    if (!(shdr.sh_flags & SHF_MERGE) || !isec->is_alive)
      continue;

+    // Under a SECTIONS-driven layout, sections matched by different
+    // output section descriptions merge separately
+    i64 cmd = -1;
+    i32 rank = INT32_MAX;
+    if (!this->script_match.empty())
+      if (i32 r = this->script_match[i]; r != -1) {
+        cmd = ctx.script_ranks[r].cmd;
+        rank = r;
+      }
+
    MergedSection<E> *parent =
-      MergedSection<E>::get_instance(ctx, isec->name(), shdr);
+      MergedSection<E>::get_instance(ctx, isec->name, shdr, cmd, rank);

    if (parent) {
      this->mergeable_sections[i] =
@@ -894,6 +1002,7 @@ void ObjectFile<E>::parse(Context<E> &ctx) {
    this->first_global = symtab_sec->sh_info;
    this->elf_syms = this->template get_data<ElfSym<E>>(ctx, *symtab_sec);
    this->symbol_strtab = this->get_string(ctx, symtab_sec->sh_link);
+    this->populate_symbol_names();

    if (ElfShdr<E> *shdr = this->find_section(SHT_SYMTAB_SHNDX))
      symtab_shndx_sec = this->template get_data<U32<E>>(ctx, *shdr);
@@ -1003,6 +1112,7 @@ void ObjectFile<E>::resolve_symbols(Context<E> &ctx) {
    }

    std::scoped_lock lock(sym.mu);
+
    if (get_rank(this, esym, !this->is_reachable) < get_rank(sym)) {
      sym.file = this;
      sym.set_input_section(isec);
@@ -1010,6 +1120,7 @@ void ObjectFile<E>::resolve_symbols(Context<E> &ctx) {
      sym.sym_idx = i;
      sym.ver_idx = ctx.default_version;
      sym.is_weak = esym.is_weak();
+      sym.is_versioned_default = false;
    }
  }
 }
@@ -1209,7 +1320,7 @@ void ObjectFile<E>::populate_symtab(Context<E> &ctx) {
    if (ctx.symtab_shndx)
      xindex = (U32<E> *)(ctx.buf + ctx.symtab_shndx->shdr.sh_offset) + idx;

-    symtab_base[idx] = to_output_esym(ctx, sym, strtab_off, xindex);
+    symtab_base[idx] = *to_output_esym(ctx, sym, strtab_off, xindex);
    strtab_off += write_string(strtab_base + strtab_off, sym.name());
  };

@@ -1263,7 +1374,7 @@ void SharedFile<E>::parse(Context<E> &ctx) {

  this->symbol_strtab = this->get_string(ctx, symtab_sec->sh_link);
  soname = get_soname(ctx);
-  version_strings = read_verdef(ctx);
+  version_strings = read_version_strings(ctx);

  // Read a symbol table.
  std::span<ElfSym<E>> esyms = this->template get_data<ElfSym<E>>(ctx, *symtab_sec);
@@ -1273,27 +1384,61 @@ void SharedFile<E>::parse(Context<E> &ctx) {
    vers = this->template get_data<U16<E>>(ctx, *sec);

  for (i64 i = symtab_sec->sh_info; i < esyms.size(); i++) {
-    u16 ver;
-    if (vers.empty() || esyms[i].is_undef())
-      ver = VER_NDX_GLOBAL;
-    else
-      ver = (vers[i] & ~VERSYM_HIDDEN);
+    u16 ver = vers.empty() ? VER_NDX_GLOBAL : (vers[i] & ~VERSYM_HIDDEN);

-    if (ver == VER_NDX_LOCAL)
+    // A defined symbol with VER_NDX_LOCAL is bound locally and isn't
+    // really exposed for dynamic linking; skip it. We never skip
+    // undefined references — the dynamic loader doesn't distinguish
+    // local vs global on the undef side, and dropping them would hide
+    // the DSO's reference from us.
+    if (ver == VER_NDX_LOCAL && !esyms[i].is_undef())
      continue;

-    std::string_view name = this->symbol_strtab.data() + esyms[i].st_name;
-    bool is_default = vers.empty() || !(vers[i] & VERSYM_HIDDEN);
-
    this->elf_syms2.push_back(esyms[i]);
-    this->versyms.push_back(ver);

-    if (is_default) {
-      this->symbols.push_back(get_symbol(ctx, name));
-    } else {
-      std::string_view mangled_name = save_string(
+    // resolve_symbols only consults versyms[] for defined symbols
+    // (see SharedFile::resolve_symbols), so VER_NDX_GLOBAL is fine
+    // for undefined entries.
+    this->versyms.push_back(esyms[i].is_undef() ? (u16)VER_NDX_GLOBAL : ver);
+
+    std::string_view name = this->symbol_strtab.data() + esyms[i].st_name;
+
+    bool has_version = ver != VER_NDX_GLOBAL && ver < version_strings.size() &&
+                       !version_strings[ver].empty();
+
+    auto get_versioned_sym = [&] {
+      std::string_view key = save_string(
        ctx, std::string(name) + "@" + std::string(version_strings[ver]));
-      this->symbols.push_back(get_symbol(ctx, mangled_name, name));
+      return get_symbol(ctx, key, name);
+    };
+
+    // Symbol resolution involving symbol versioning is tricky because one
+    // symbol can be resolved with two different identifiers. Among
+    // symbols with the same name but different versions, one of them is
+    // always marked as the "default" one. This symbol is often denoted
+    // with two atsigns as `foo@@VERSION` and can be referred to either
+    // as `foo` or `foo@VERSION`. No other symbols have two names like that.
+    //
+    // On contrary, a versioned non-default symbol can be referred only
+    // with an explicit version suffix, e.g., `foo@VERSION`.
+    //
+    // Here is how we resolve versioned default symbols. We resolve `foo`
+    // and `foo@VERSION` as usual, but with information to forward
+    // references to `foo@VERSION` to `foo`. After name resolution, we
+    // visit all symbol references to redirect `foo@VERSION` to `foo`.
+    if (!has_version) {
+      // Unversioned symbol
+      this->symbols.push_back(get_symbol(ctx, name));
+      this->symbols2.push_back(nullptr);
+    } else if (esyms[i].is_undef() || (vers[i] & VERSYM_HIDDEN)) {
+      // Versioned non-default symbol, or undefined reference whose
+      // version comes from .gnu.version_r.
+      this->symbols.push_back(get_versioned_sym());
+      this->symbols2.push_back(nullptr);
+    } else {
+      // Versioned default symbol
+      this->symbols.push_back(get_symbol(ctx, name));
+      this->symbols2.push_back(get_versioned_sym());
    }
  }

@@ -1353,32 +1498,61 @@ std::string_view SharedFile<E>::get_dt_audit(Context<E> &ctx) {
 // If an undefiend symbol `foo` is resolved to a symbol defined by the
 // shared object, it's marked so that it'll be resolved to (`foo`, the
 // default version of the library) at load-time.
+//
+// Reads .gnu.version_d and .gnu.version_r and returns a vector of
+// version names indexed by versym value. The versym index space is
+// shared between the two sections (vd_ndx for defined symbols and
+// vna_other for undefined ones), so a single vector covers both.
 template <typename E>
-std::vector<std::string_view> SharedFile<E>::read_verdef(Context<E> &ctx) {
-  ElfShdr<E> *verdef_sec = this->find_section(SHT_GNU_VERDEF);
-  if (!verdef_sec)
-    return {};
-
-  std::string_view verdef = this->get_string(ctx, *verdef_sec);
-  std::string_view strtab = this->get_string(ctx, verdef_sec->sh_link);
-
+std::vector<std::string_view>
+SharedFile<E>::read_version_strings(Context<E> &ctx) {
  std::vector<std::string_view> vec;
-  u8 *ptr = (u8 *)verdef.data();

-  for (;;) {
-    ElfVerdef<E> *ver = (ElfVerdef<E> *)ptr;
-    if (ver->vd_ndx == VER_NDX_UNSPECIFIED)
-      Fatal(ctx) << *this << ": symbol version too large";
+  if (ElfShdr<E> *sec = this->find_section(SHT_GNU_VERDEF)) {
+    std::string_view verdef = this->get_string(ctx, *sec);
+    std::string_view strtab = this->get_string(ctx, sec->sh_link);
+    u8 *ptr = (u8 *)verdef.data();

-    if (vec.size() <= ver->vd_ndx)
-      vec.resize(ver->vd_ndx + 1);
+    for (;;) {
+      ElfVerdef<E> *ver = (ElfVerdef<E> *)ptr;
+      if (ver->vd_ndx == VER_NDX_UNSPECIFIED)
+        Fatal(ctx) << *this << ": symbol version too large";

-    ElfVerdaux<E> *aux = (ElfVerdaux<E> *)(ptr + ver->vd_aux);
-    vec[ver->vd_ndx] = strtab.data() + aux->vda_name;
-    if (!ver->vd_next)
-      break;
-    ptr += ver->vd_next;
+      if (vec.size() <= ver->vd_ndx)
+        vec.resize(ver->vd_ndx + 1);
+
+      ElfVerdaux<E> *aux = (ElfVerdaux<E> *)(ptr + ver->vd_aux);
+      vec[ver->vd_ndx] = strtab.data() + aux->vda_name;
+      if (!ver->vd_next)
+        break;
+      ptr += ver->vd_next;
+    }
  }
+
+  if (ElfShdr<E> *sec = this->find_section(SHT_GNU_VERNEED)) {
+    std::string_view verneed = this->get_string(ctx, *sec);
+    std::string_view strtab = this->get_string(ctx, sec->sh_link);
+    u8 *ptr = (u8 *)verneed.data();
+
+    for (;;) {
+      ElfVerneed<E> *vn = (ElfVerneed<E> *)ptr;
+      u8 *aux_ptr = ptr + vn->vn_aux;
+      for (i64 i = 0; i < vn->vn_cnt; i++) {
+        ElfVernaux<E> *aux = (ElfVernaux<E> *)aux_ptr;
+        u16 idx = aux->vna_other & ~VERSYM_HIDDEN;
+        if (vec.size() <= idx)
+          vec.resize(idx + 1);
+        vec[idx] = strtab.data() + aux->vna_name;
+        if (!aux->vna_next)
+          break;
+        aux_ptr += aux->vna_next;
+      }
+      if (!vn->vn_next)
+        break;
+      ptr += vn->vn_next;
+    }
+  }
+
  return vec;
 }

@@ -1400,6 +1574,22 @@ void SharedFile<E>::resolve_symbols(Context<E> &ctx) {
      sym.sym_idx = i;
      sym.ver_idx = versyms[i];
      sym.is_weak = true;
+      sym.is_versioned_default = false;
+    }
+
+    // A symbol with the default version is a special case because, unlike
+    // other symbols, the symbol can be referred by two names, `foo` and
+    // `foo@VERSION`. Here, we resolve `foo@VERSOIN` as a proxy of `foo`.
+    Symbol<E> *sym2 = this->symbols2[i];
+    if (sym2 && sym2 != &sym) {
+      std::scoped_lock lock2(sym2->mu);
+
+      if (get_rank(this, esym, false) < get_rank(*sym2)) {
+        sym2->file = this;
+        sym2->origin = (uintptr_t)&sym;
+        sym2->sym_idx = i;
+        sym2->is_versioned_default = true;
+      }
    }
  }
 }
@@ -1518,7 +1708,7 @@ void SharedFile<E>::populate_symtab(Context<E> &ctx) {
      xindex = (U32<E> *)(ctx.buf + ctx.symtab_shndx->shdr.sh_offset) +
               this->global_symtab_idx + i;

-    *symtab++ = to_output_esym(ctx, *sym, strtab_off, xindex);
+    *symtab++ = *to_output_esym(ctx, *sym, strtab_off, xindex);
    strtab_off += write_string(strtab + strtab_off, sym->name());
    i++;
  }
@@ -33,8 +33,12 @@ bool cie_equals(const CieRecord<E> &a, const CieRecord<E> &b) {
 template <typename E>
 InputSection<E>::InputSection(Context<E> &ctx, ObjectFile<E> &file, i64 shndx)
  : file(file), shndx(shndx) {
-  if (shndx < file.elf_sections.size())
+  if (shndx < file.elf_sections.size()) {
+    name = file.shstrtab.data() + file.elf_sections[shndx].sh_name;
    contents = {(char *)file.mf->data + shdr().sh_offset, (size_t)shdr().sh_size};
+  } else {
+    name = (shdr().sh_flags & SHF_TLS) ? ".tls_common" : ".common";
+  }

  if (shdr().sh_flags & SHF_COMPRESSED) {
    ElfChdr<E> &chdr = *(ElfChdr<E> *)&contents[0];
@@ -63,16 +67,16 @@ void InputSection<E>::uncompress(Context<E> &ctx) {
    return;

  u8 *buf = new u8[sh_size];
-  copy_contents(ctx, buf);
+  copy_contents_to(ctx, buf, sh_size);
  contents = std::string_view((char *)buf, sh_size);
  ctx.string_pool.emplace_back(buf);
  uncompressed = true;
 }

 template <typename E>
-void InputSection<E>::copy_contents(Context<E> &ctx, u8 *buf) {
+void InputSection<E>::copy_contents_to(Context<E> &ctx, u8 *buf, i64 sz) {
  if (!(shdr().sh_flags & SHF_COMPRESSED) || uncompressed) {
-    memcpy(buf, contents.data(), contents.size());
+    memcpy(buf, contents.data(), sz);
    return;
  }

@@ -84,22 +88,46 @@ void InputSection<E>::copy_contents(Context<E> &ctx, u8 *buf) {

  switch (hdr.ch_type) {
  case ELFCOMPRESS_ZLIB: {
-    unsigned long size = sh_size;
-    if (::uncompress(buf, &size, (u8 *)data.data(), data.size()) != Z_OK)
-      Fatal(ctx) << *this << ": uncompress failed";
-    assert(size == sh_size);
+    z_stream s = {};
+    inflateInit(&s);
+    s.next_in = (u8 *)data.data();
+    s.avail_in = data.size();
+    s.next_out = buf;
+    s.avail_out = sz;
+
+    int r;
+    while (s.total_out < sz && (r = inflate(&s, Z_NO_FLUSH)) == Z_OK);
+    if (s.total_out < sz && r != Z_STREAM_END)
+      Fatal(ctx) << *this << ": uncompress failed: " << s.msg;
+    inflateEnd(&s);
+    msan_unpoison(buf, sz);
    break;
  }
-  case ELFCOMPRESS_ZSTD:
-    if (ZSTD_decompress(buf, sh_size, (u8 *)data.data(), data.size()) != sh_size)
-      Fatal(ctx) << *this << ": ZSTD_decompress failed";
+  case ELFCOMPRESS_ZSTD: {
+    ZSTD_DCtx *dctx = ZSTD_createDCtx();
+    ZSTD_inBuffer in = { data.data(), data.size() };
+    ZSTD_outBuffer out = { buf, (size_t)sz };
+
+    while (out.pos < out.size) {
+      size_t r = ZSTD_decompressStream(dctx, &out, &in);
+      if (ZSTD_isError(r))
+        Fatal(ctx) << *this << ": uncompress failed: " << ZSTD_getErrorName(r);
+      if (r == 0 && out.pos < out.size)
+        Fatal(ctx) << *this << ": uncompress failed: premature end of input";
+    }
+    ZSTD_freeDCtx(dctx);
+    msan_unpoison(buf, sz);
    break;
+  }
  default:
    Fatal(ctx) << *this << ": unsupported compression type: 0x"
               << std::hex << hdr.ch_type;
  }
 }

+// wingdi.h defines ERROR as a macro, so undefine it before use
+#undef ERROR
+
 typedef enum : u8 { NONE, ERROR, COPYREL, PLT, CPLT } Action;

 template <typename E>
@@ -114,12 +142,6 @@ static void do_action(Context<E> &ctx, Action action, InputSection<E> &isec,
               << sym << "' can not be used; recompile with -fPIC";
    break;
  case COPYREL:
-    // Create a copy relocation
-    if (!sym.file->is_dso) {
-      assert(sym.esym().is_undef_weak());
-      Error(ctx) << isec << ": cannot create a copy relocation for "
-                 << sym <<"; recompile with -fPIE or -fPIC";
-    }
    sym.flags |= NEEDS_COPYREL;
    break;
  case PLT:
@@ -234,7 +256,7 @@ void InputSection<E>::write_to(Context<E> &ctx, u8 *buf) {

    if (deltas.empty()) {
      // If a section is not relaxed, we can copy it as a one big chunk.
-      copy_contents(ctx, buf);
+      copy_contents_to(ctx, buf, sh_size);
    } else {
      // A relaxed section is copied piece-wise.
      memcpy(buf, contents.data(), deltas[0].offset);
@@ -250,7 +272,7 @@ void InputSection<E>::write_to(Context<E> &ctx, u8 *buf) {
      }
    }
  } else {
-    copy_contents(ctx, buf);
+    copy_contents_to(ctx, buf, sh_size);
  }

  // Apply relocations
@@ -266,17 +288,12 @@ void InputSection<E>::write_to(Context<E> &ctx, u8 *buf) {
 template <typename E>
 std::string_view
 InputSection<E>::get_func_name(Context<E> &ctx, i64 offset) const {
-  for (Symbol<E> *sym : file.symbols) {
-    if (sym->file == &file) {
-      const ElfSym<E> &esym = sym->esym();
-      if (esym.st_shndx == shndx && esym.st_type == STT_FUNC &&
-          esym.st_value <= offset && offset < esym.st_value + esym.st_size) {
-        if (ctx.arg.demangle)
-          return demangle(*sym);
-        return sym->name();
-      }
-    }
-  }
+  for (Symbol<E> *sym : file.symbols)
+    if (sym->file == &file)
+      if (const ElfSym<E> &esym = sym->esym();
+          esym.st_shndx == shndx && esym.st_type == STT_FUNC &&
+          esym.st_value <= offset && offset < esym.st_value + esym.st_size)
+        return ctx.arg.demangle ? demangle(*sym) : sym->name();
  return "";
 }

@@ -343,8 +360,8 @@ bool InputSection<E>::record_undef_error(Context<E> &ctx, const ElfRel<E> &rel)
 template <typename E>
 MergeableSection<E>::MergeableSection(Context<E> &ctx, MergedSection<E> &parent,
                                      std::unique_ptr<InputSection<E>> &isec)
-  : parent(parent), p2align(isec->p2align), section(std::move(isec)) {
-  section->uncompress(ctx);
+  : parent(parent), p2align(isec->p2align), input_section(std::move(isec)) {
+  input_section->uncompress(ctx);

  std::scoped_lock lock(parent.mu);
  parent.members.push_back(this);
@@ -380,9 +397,9 @@ static size_t find_null(std::string_view data, i64 pos, i64 entsize) {
 // We do not support mergeable sections that have relocations.
 template <typename E>
 void MergeableSection<E>::split_contents(Context<E> &ctx) {
-  std::string_view data = section->contents;
+  std::string_view data = input_section->contents;
  if (data.size() > UINT32_MAX)
-    Fatal(ctx) << *section << ": mergeable section too large";
+    Fatal(ctx) << *input_section << ": mergeable section too large";

  i64 entsize = parent.shdr.sh_entsize;

@@ -392,12 +409,13 @@ void MergeableSection<E>::split_contents(Context<E> &ctx) {
      frag_offsets.push_back(pos);
      size_t end = find_null(data, pos, entsize);
      if (end == data.npos)
-        Fatal(ctx) << *section << ": string is not null terminated";
+        Fatal(ctx) << *input_section << ": string is not null terminated";
      pos = end + entsize;
    }
  } else {
    if (data.size() % entsize)
-      Fatal(ctx) << *section << ": section size is not multiple of sh_entsize";
+      Fatal(ctx) << *input_section
+                 << ": section size is not multiple of sh_entsize";
    frag_offsets.reserve(data.size() / entsize);

    for (i64 pos = 0; pos < data.size(); pos += entsize)
@@ -9,7 +9,7 @@
 // mold processes to just 1 for each user. It is intended to be used as
 // `MOLD_JOBS=1 ninja` or `MOLD_JOBS=1 make -j$(nproc)`.

-#include "common.h"
+#include "mold.h"

 #include <cstdlib>
 #include <fcntl.h>
@@ -29,8 +29,8 @@
 //
 //  4. Continue the rest of the linking process as usual.
 //
-// When gcc or clang inovkes ld, they pass `-plugin linker-plugin.so` to
-// the linker. The given .so file provides a way to call the compiler
+// When gcc or clang inovkes ld, they pass `-plugin /path/to/linker-plugin.so`
+// to the linker. The given .so file provides a way to call the compiler
 // backend.
 //
 // The linker plugin API is documented at
@@ -425,7 +425,7 @@ get_api_version(const char *plugin_identifier,
  if (LAPI_V1 < minimal_api_supported)
    Fatal(*gctx<E>) << "LTO plugin does not support V0 or V1 API";

-  std::string version = get_mold_version() + "\0"s;
+  std::string version = mold_version + "\0"s;

  *linker_identifier = "mold";
  *linker_version = version.data();
@@ -536,8 +536,6 @@ static ElfSym<E> to_elf_sym(PluginSymbol &psym) {
  }

  switch (psym.symbol_type) {
-  case LDST_UNKNOWN:
-    break;
  case LDST_FUNCTION:
    esym.st_type = STT_FUNC;
    break;
@@ -547,8 +545,6 @@ static ElfSym<E> to_elf_sym(PluginSymbol &psym) {
  };

  switch (psym.visibility) {
-  case LDPV_DEFAULT:
-    break;
  case LDPV_PROTECTED:
    esym.st_visibility = STV_PROTECTED;
    break;
@@ -600,10 +596,10 @@ create_plugin_input_file(Context<E> &ctx, MappedFile *mf) {
 template <typename E>
 ObjectFile<E> *read_lto_object(Context<E> &ctx, MappedFile *mf) {
  if (ctx.arg.plugin.empty())
-    Fatal(ctx) << mf->name << ": don't know how to handle this LTO object file "
-               << "because no -plugin option was given. Please make sure you "
-               << "added -flto not only for creating object files but also for "
-               << "creating the final executable.";
+    Fatal(ctx) << mf->name << ": unable to handle this LTO object file because "
+               << "the -plugin option was not provided. Please make sure you "
+               << "added -flto not only when creating object files but also "
+               << "when linking the final executable.";

  load_lto_plugin(ctx);

@@ -633,17 +629,18 @@ ObjectFile<E> *read_lto_object(Context<E> &ctx, MappedFile *mf) {
  // claim_file_hook() calls add_symbols() which initializes `plugin_symbols`
  int claimed = false;
  claim_file_hook(&file, &claimed);
-  if (!claimed)
-    Fatal(ctx) << mf->name << ": not claimed by the LTO plugin;"
-               << " please make sure you are using the same compiler of the"
-               << " same version for all object files";

-  // It looks like GCC doesn't need fd after claim_file_hook() while
-  // LLVM needs it and takes the ownership of fd. To prevent "too many
-  // open files" issue, we close fd only for GCC. This is ugly, though.
-  if (!is_llvm(ctx)) {
-    MappedFile *mf2 = mf->parent ? mf->parent : mf;
-    mf2->close_fd();
+  if (mf->parent)
+    mf->parent->close_fd();
+  else
+    mf->close_fd();
+
+  if (!claimed) {
+    if (!mf->parent && !mf->thin_parent)
+      Fatal(ctx) << mf->name << ": not claimed by the LTO plugin;"
+                 << " please make sure you are using the same compiler of the"
+                 << " same version for all object files";
+    return nullptr;
  }

  // Create a symbol strtab
@@ -670,12 +667,15 @@ ObjectFile<E> *read_lto_object(Context<E> &ctx, MappedFile *mf) {
    // section. We handle such symbols differently than comdat symbols in
    // a regular file because, unlike regular object files, IR files don't
    // have input sections.
-    if (psym.comdat_key)
-      obj->lto_comdat_groups[i + 1] = insert_comdat_group(ctx, psym.comdat_key);
+    if (psym.comdat_key) {
+      std::string_view key = save_string(ctx, psym.comdat_key);
+      obj->lto_comdat_groups[i + 1] = insert_comdat_group(ctx, key);
+    }
  }

  obj->symbol_strtab = save_string(ctx, strtab);
  obj->elf_syms = obj->lto_elf_syms;
+  obj->populate_symbol_names();
  obj->initialize_symbols(ctx);
  plugin_symbols.clear();
  return obj;
@@ -1,27 +1,13 @@
 #include "mold.h"
-#include "../lib/archive-file.h"
+#include "config.h"

 #include <cstring>
+#include <filesystem>
 #include <functional>
 #include <sys/stat.h>
 #include <sys/types.h>
-#include <tbb/global_control.h>
 #include <unordered_set>

-#ifdef _WIN32
-# include <direct.h>
-# define chdir _chdir
-#else
-# include <unistd.h>
-#endif
-
-#ifdef MOLD_X86_64
-int main(int argc, char **argv) {
-  mold::set_mimalloc_options();
-  return mold::mold_main<mold::X86_64>(argc, argv);
-}
-#endif
-
 namespace mold {

 template <typename E>
@@ -44,9 +30,10 @@ static ObjectFile<E> *new_object_file(Context<E> &ctx, ReaderContext &rctx,
  ObjectFile<E> *file = new ObjectFile<E>(ctx, mf, archive_name);
  ctx.obj_pool.emplace_back(file);
  file->priority = ctx.file_priority++;
-  file->is_reachable =
-    !rctx.in_lib && (archive_name.empty() || rctx.whole_archive);
+  file->as_needed =
+    rctx.in_lib || (!archive_name.empty() && !rctx.whole_archive);

+  assert(rctx.tg);
  rctx.tg->run([file, &ctx] { file->parse(ctx); });
  if (ctx.arg.trace)
    Out(ctx) << "trace: " << *file;
@@ -63,10 +50,13 @@ static ObjectFile<E> *new_lto_obj(Context<E> &ctx, ReaderContext &rctx,
    return nullptr;

  ObjectFile<E> *file = read_lto_object(ctx, mf);
+  if (!file)
+    return nullptr;
+
  file->priority = ctx.file_priority++;
  file->archive_name = archive_name;
-  file->is_reachable =
-    !rctx.in_lib && (archive_name.empty() || rctx.whole_archive);
+  file->as_needed =
+    rctx.in_lib || (!archive_name.empty() && !rctx.whole_archive);

  if (ctx.arg.trace)
    Out(ctx) << "trace: " << *file;
@@ -81,8 +71,9 @@ new_shared_file(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
  SharedFile<E> *file = new SharedFile<E>(ctx, mf);
  ctx.dso_pool.emplace_back(file);
  file->priority = ctx.file_priority++;
-  file->is_reachable = !rctx.as_needed;
+  file->as_needed = rctx.as_needed;

+  assert(rctx.tg);
  rctx.tg->run([file, &ctx] { file->parse(ctx); });
  if (ctx.arg.trace)
    Out(ctx) << "trace: " << *file;
@@ -120,7 +111,7 @@ void read_file(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
    }
    return;
  case FileType::TEXT:
-    Script(ctx, rctx, mf).parse_linker_script();
+    Script(ctx, mf, &rctx).parse_linker_script();
    return;
  case FileType::GCC_LTO_OBJ:
  case FileType::LLVM_BITCODE:
@@ -158,7 +149,7 @@ detect_machine_type(Context<E> &ctx, std::vector<std::string> args) {
      if (MappedFile *mf = open_file(ctx, arg))
        if (get_file_type(ctx, mf) == FileType::TEXT)
          if (std::string_view target =
-              Script(ctx, rctx, mf).get_script_output_type();
+              Script(ctx, mf, &rctx).get_script_output_type();
              !target.empty())
            return target;
    }
@@ -256,9 +247,14 @@ static void read_input_files(Context<E> &ctx, std::span<std::string> args) {
    }
  }

-  if (ctx.objs.empty())
+  if (ctx.objs.empty() && ctx.dsos.empty())
    Fatal(ctx) << "no input files";

+  if (rctx.static_ || ctx.arg.relocatable) {
+    ctx.arg.static_ = true;
+    ctx.arg.dynamic_linker = "";
+  }
+
  tg.wait();
 }

@@ -270,6 +266,17 @@ static bool has_lto_obj(Context<E> &ctx) {
  return false;
 }

+template <typename E>
+static i64 get_thread_count(Context<E> &ctx) {
+  if (ctx.arg.thread_count.has_value())
+    return *ctx.arg.thread_count;
+
+  // mold doesn't scale well with too many threads, so limit it to 32.
+  int n = tbb::global_control::active_value(
+    tbb::global_control::max_allowed_parallelism);
+  return std::min(n, 32);
+}
+
 template <typename E>
 int mold_main(int argc, char **argv) {
  Context<E> ctx;
@@ -278,6 +285,12 @@ int mold_main(int argc, char **argv) {
  if (argc >= 2 && (argv[1] == "-run"sv || argv[1] == "--run"sv))
    process_run_subcommand(ctx, argc, argv);

+  // parse_nonpositional_args() may chdir(2) for -C. If we end up
+  // restarting in redo_main(), we need to re-enter from the original
+  // directory so relative paths (e.g. response files) still resolve.
+  std::error_code ec;
+  std::filesystem::path orig_cwd = std::filesystem::current_path(ec);
+
  // Parse non-positional command line options
  ctx.cmdline_args = expand_response_files(ctx, argv);
  std::vector<std::string> file_args = parse_nonpositional_args(ctx);
@@ -286,28 +299,25 @@ int mold_main(int argc, char **argv) {
  if (ctx.arg.emulation.empty())
    ctx.arg.emulation = detect_machine_type(ctx, file_args);

-  // Redo if -m is not x86-64.
-  if constexpr (is_x86_64<E>)
-    if (ctx.arg.emulation != X86_64::name)
-      return redo_main(ctx, argc, argv);
+  // Redo if -m does not match with our speculation.
+  if (ctx.arg.emulation != E::name) {
+    if (!ec)
+      std::filesystem::current_path(orig_cwd, ec);
+    return redo_main<E>(ctx.arg.emulation, argc, argv);
+  }

  Timer t_all(ctx, "all");

  install_signal_handler();

-  if (!ctx.arg.directory.empty())
-    if (chdir(ctx.arg.directory.c_str()) == -1)
-      Fatal(ctx) << "chdir failed: " << ctx.arg.directory
-                 << ": " << errno_string();
-
  // Fork a subprocess unless --no-fork is given.
  if (ctx.arg.fork)
-    fork_child();
+    fork_child<E>();

  acquire_global_lock();

-  tbb::global_control tbb_cont(tbb::global_control::max_allowed_parallelism,
-                               ctx.arg.thread_count);
+  ctx.global_limit.emplace(tbb::global_control::max_allowed_parallelism,
+                           get_thread_count(ctx));

  // Handle --wrap options if any.
  for (std::string_view name : ctx.arg.wrap)
@@ -324,6 +334,13 @@ int mold_main(int argc, char **argv) {
  // Parse input files
  read_input_files(ctx, file_args);

+  // The entry point is given by -e, by an ENTRY command in a linker
+  // script, or defaults to _start
+  if (!ctx.arg.entry)
+    ctx.arg.entry = get_symbol(ctx, "_start");
+  ctx.arg.entry->gc_root = true;
+  ctx.arg.undefined.push_back(ctx.arg.entry);
+
  // Uniquify shared object files by soname
  {
    std::unordered_set<std::string_view> seen;
@@ -360,9 +377,19 @@ int mold_main(int argc, char **argv) {
  std::erase_if(ctx.objs, [](InputFile<E> *file) { return !file->is_reachable; });
  std::erase_if(ctx.dsos, [](InputFile<E> *file) { return !file->is_reachable; });

+  // Remove input sections that match a /DISCARD/ pattern and
+  // compute, for each input section, the output section description
+  // it matches. This runs before mergeable sections are split
+  // because the patterns match the original input sections.
+  apply_script_discards(ctx);
+  match_script_sections(ctx);
+
  // Parse .eh_frame section contents.
  parse_eh_frame_sections(ctx);

+  // Parse .sframe section contents.
+  parse_sframe_sections(ctx);
+
  // Split mergeable section contents into section pieces.
  create_merged_sections(ctx);

@@ -377,6 +404,9 @@ int mold_main(int argc, char **argv) {
  // Create .bss sections for common symbols.
  convert_common_symbols(ctx);

+  // Define symbols PROVIDE'd by linker scripts.
+  add_provided_symbols(ctx);
+
  // Apply version scripts.
  apply_version_script(ctx);

@@ -390,6 +420,11 @@ int mold_main(int argc, char **argv) {
  if (!ctx.arg.allow_multiple_definition)
    check_duplicate_symbols(ctx);

+  // Handle --zero-to-bss, which converts data sections containing only
+  // zeros into BSS.
+  if (ctx.arg.zero_to_bss)
+    convert_zero_to_bss(ctx);
+
  // Set "address-taken" bits for input sections.
  if (ctx.arg.icf)
    compute_address_significance(ctx);
@@ -496,24 +531,23 @@ int mold_main(int argc, char **argv) {
  // create as few segments as possible.
  sort_output_sections(ctx);

-  if (!ctx.arg.separate_debug_file.empty())
+  // Handle --separate-debug-file.
+  if (ctx.gnu_debuglink)
    separate_debug_sections(ctx);

  // Compute sizes of output sections while assigning offsets
  // within an output section to input sections.
  compute_section_sizes(ctx);

-  // If --packed_dyn_relocs=relr was given, base relocations are stored
-  // to a .relr.dyn section in a compressed form. Construct a compressed
-  // relocations now so that we can fix section sizes and file layout.
-  if (ctx.arg.pack_dyn_relocs_relr)
-    construct_relr(ctx);
-
  // Reserve a space for dynamic symbol strings in .dynstr and sort
  // .dynsym contents if necessary. Beyond this point, no symbol will
  // be added to .dynsym.
  sort_dynsyms(ctx);

+  // Sort .debug_info contents so that DWARF32 debug info precedes that of
+  // DWARF64. This is to mitigate the possibility of a relocation overflow.
+  sort_debug_info_sections(ctx);
+
  // Print reports about undefined symbols, if needed.
  if (ctx.arg.unresolved_symbols == UNRESOLVED_ERROR)
    report_undef_errors(ctx);
@@ -531,18 +565,16 @@ int mold_main(int argc, char **argv) {
  // Here, we construct output .eh_frame contents.
  ctx.eh_frame->construct(ctx);

+  // .sframe is likewise parsed and reconstructed by the linker. Build
+  // the merged, PC-sorted output .sframe.
+  if constexpr (supports_sframe<E>)
+    ctx.sframe->construct(ctx);
+
  // If --emit-relocs is given, we'll copy relocation sections from input
  // files to an output file.
  if (ctx.arg.emit_relocs)
    create_reloc_sections(ctx);

-  // We've created range extension thunks with a pessimistive assumption
-  // that all out-of-section references are out of range. Now that we are
-  // able to assign addresses to all SHF_ALLOC output sections, we can
-  // eliminate excessive thunks.
-  if constexpr (needs_thunk<E>)
-    remove_redundant_thunks(ctx);
-
  // Compute .symtab and .strtab sizes for each file.
  if (!ctx.arg.strip_all)
    create_output_symtab(ctx);
@@ -562,6 +594,14 @@ int mold_main(int argc, char **argv) {
    filesize = set_osec_offsets(ctx);
  }

+  // We've created range extension thunks with a pessimistive assumption
+  // that all out-of-section references are out of range. Now that we know
+  // the addresses of all sections,, we can eliminate excessive thunks.
+  if constexpr (needs_thunk<E>) {
+    remove_redundant_thunks(ctx);
+    filesize = set_osec_offsets(ctx);
+  }
+
  if constexpr (is_arm32<E>) {
    if (ctx.extra.exidx) {
      ctx.extra.exidx->remove_duplicate_entries(ctx);
@@ -578,18 +618,26 @@ int mold_main(int argc, char **argv) {
  // GOT or PLT addresses have a correct final value.

  // If --compress-debug-sections is given, compress .debug_* sections
-  // using zlib.
-  if (ctx.arg.compress_debug_sections != COMPRESS_NONE) {
+  // using zlib or zstd.
+  if (ctx.arg.compress_debug_sections != ELFCOMPRESS_NONE) {
    compress_debug_sections(ctx);
    filesize = set_osec_offsets(ctx);
  }

-  // At this point, both memory and file layouts are fixed.
-
  // Gather thunk symbols and attach them to themselves.
  if constexpr (needs_thunk<E>)
    gather_thunk_addresses(ctx);

+  // Re-finalize layout. fix_synthetic_symbols above may have changed
+  // addends for dynamic relocations referencing synthetic symbols, which
+  // can shift the encoded size of .rela.dyn under --pack-dyn-relocs=android.
+  // For other modes this is a cheap no-op convergence.
+  filesize = set_osec_offsets(ctx);
+
+  // At this point, both memory and file layouts are fixed.
+
+  ctx.reldyn->update_shdr(ctx);
+
  t_before_copy.stop();

  // Create an output file
@@ -601,6 +649,9 @@ int mold_main(int argc, char **argv) {
  // Copy input sections to the output file and apply relocations.
  copy_chunks(ctx);

+  if constexpr (is_arm32be<E>)
+    arm32be_swap_bytes(ctx);
+
  if constexpr (is_x86_64<E>)
    if (ctx.arg.z_rewrite_endbr)
      rewrite_endbr(ctx);
@@ -612,7 +663,7 @@ int mold_main(int argc, char **argv) {
  // .gdb_index's contents cannot be constructed before applying
  // relocations to other debug sections. We have relocated debug
  // sections now, so write the .gdb_index section.
-  if (ctx.gdb_index && ctx.arg.separate_debug_file.empty())
+  if (ctx.gdb_index && !ctx.gnu_debuglink)
    write_gdb_index(ctx);

  // .note.gnu.build-id section contains a cryptographic hash of the
@@ -621,7 +672,7 @@ int mold_main(int argc, char **argv) {
  if (ctx.buildid)
    write_build_id(ctx);

-  if (!ctx.arg.separate_debug_file.empty())
+  if (ctx.gnu_debuglink)
    write_gnu_debuglink(ctx);

  t_copy.stop();
@@ -642,7 +693,7 @@ int mold_main(int argc, char **argv) {
  if (ctx.arg.print_map)
    print_map(ctx);

-  if (!ctx.arg.separate_debug_file.empty())
+  if (ctx.gnu_debuglink)
    write_separate_debug_file(ctx);

  // Show stats numbers
@@ -655,7 +706,7 @@ int mold_main(int argc, char **argv) {
  std::cout << std::flush;
  std::cerr << std::flush;

-  notify_parent();
+  notify_parent<E>();
  release_global_lock();

  if (ctx.arg.quick_exit)
@@ -19,14 +19,12 @@ static Map<E> get_map(Context<E> &ctx) {

  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
    for (Symbol<E> *sym : file->symbols) {
-      if (sym->file != file || sym->get_type() == STT_SECTION)
-        continue;
-
-      if (InputSection<E> *isec = sym->get_input_section()) {
-        assert(file == &isec->file);
-        typename Map<E>::accessor acc;
-        map.insert(acc, {isec, {}});
-        acc->second.push_back(sym);
+      if (sym->file == file && sym->get_type() != STT_SECTION) {
+        if (InputSection<E> *isec = sym->get_input_section()) {
+          typename Map<E>::accessor acc;
+          map.insert(acc, {isec, {}});
+          acc->second.push_back(sym);
+        }
      }
    }
  });
@@ -48,10 +46,11 @@ void print_map(Context<E> &ctx) {
  std::ostream *out = &std::cout;
  std::ofstream file;

-  if (!ctx.arg.Map.empty()) {
+  if (!ctx.arg.Map.empty() && ctx.arg.Map != "-") {
    file.open(ctx.arg.Map);
-    if (!file.is_open())
-      Fatal(ctx) << "cannot open " << ctx.arg.Map << ": " << errno_string();
+    if (file.fail())
+      Fatal(ctx) << "--print-map: cannot open " << ctx.arg.Map << ": "
+                 << errno_string();
    out = &file;
  }

@@ -1,4 +1,4 @@
-#include "common.h"
+#include "mold.h"

 namespace mold {

@@ -1,4 +1,4 @@
-#include "common.h"
+#include "mold.h"

 namespace mold {

@@ -6,6 +6,11 @@
 #include <sys/mman.h>
 #include <system_error>

+#ifdef __linux__
+# include <sys/vfs.h>
+# include <linux/magic.h>
+#endif
+
 namespace mold {

 static u32 get_umask() {
@@ -54,7 +59,11 @@ public:
    output_tmpfile = (char *)save_string(ctx, tmpfile).data();

 #ifdef __linux__
-    fallocate(this->fd, 0, 0, filesize);
+    // Calling falllocate speeds up later linking passes on ext4,
+    // while it just takes time with not benefits on tmpfs.
+    if (struct statfs fs;
+        fstatfs(this->fd, &fs) || fs.f_type != TMPFS_MAGIC)
+      fallocate(this->fd, 0, 0, filesize);
 #endif

    this->buf = (u8 *)mmap(nullptr, filesize, PROT_READ | PROT_WRITE,
@@ -77,12 +86,12 @@ public:
    if (!this->is_unmapped)
      munmap(this->buf, this->filesize);

-    if (this->buf2.empty()) {
+    if (!this->buf2) {
      ::close(this->fd);
    } else {
      FILE *out = fdopen(this->fd, "w");
      fseek(out, 0, SEEK_END);
-      fwrite(&this->buf2[0], this->buf2.size(), 1, out);
+      fwrite(this->buf2, this->buf2_size, 1, out);
      fclose(out);
    }

@@ -176,10 +185,10 @@ void LockingOutputFile<E>::close(Context<E> &ctx) {
  if (!this->is_unmapped)
    munmap(this->buf, this->filesize);

-  if (!this->buf2.empty()) {
+  if (this->buf2) {
    FILE *out = fdopen(this->fd, "w");
    fseek(out, 0, SEEK_END);
-    fwrite(&this->buf2[0], this->buf2.size(), 1, out);
+    fwrite(this->buf2, this->buf2_size, 1, out);
    fclose(out);
  }

@@ -44,13 +44,13 @@ public:

    UnmapViewOfFile(this->buf);

-    if (!this->buf2.empty()) {
+    if (this->buf2) {
      if (SetFilePointer(handle, 0, nullptr, FILE_END) == INVALID_SET_FILE_POINTER)
        Fatal(ctx) << this->path << ": SetFilePointer failed: "
                   << GetLastError();

      DWORD written;
-      if (!WriteFile(handle, this->buf2.data(), this->buf2.size(), &written,
+      if (!WriteFile(handle, this->buf2, this->buf2_size, &written,
                     nullptr))
        Fatal(ctx) << this->path << ": WriteFile failed: " << GetLastError();
    }
@@ -50,6 +50,8 @@ static void r_create_synthetic_sections(Context<E> &ctx) {
  ctx.shdr = push(new OutputShdr<E>);
  ctx.eh_frame = push(new EhFrameSection<E>);
  ctx.eh_frame_reloc = push(new EhFrameRelocSection<E>);
+  ctx.sframe = push(new SFrameSection<E>);
+  ctx.sframe_reloc = push(new SFrameRelocSection<E>);
  ctx.strtab = push(new StrtabSection<E>);
  ctx.symtab = push(new SymtabSection<E>);
  ctx.shstrtab = push(new ShstrtabSection<E>);
@@ -161,6 +163,9 @@ void combine_objects(Context<E> &ctx) {

  ctx.eh_frame->construct(ctx);

+  if constexpr (supports_sframe<E>)
+    ctx.sframe->construct(ctx);
+
  create_reloc_sections(ctx);

  create_comdat_group_sections(ctx);
@@ -122,10 +122,6 @@ i64 compute_distance(Context<E> &ctx, Symbol<E> &sym,
  if (sym.is_absolute())
    return INT64_MAX;

-  // Likewise, relocations against weak undefined symbols won't be relaxed.
-  if (sym.esym().is_undef_weak())
-    return INT64_MAX;
-
  // Compute a distance between the relocated place and the symbol.
  i64 S = sym.get_addr(ctx);
  i64 A = rel.r_addend;
@@ -1,4 +1,4 @@
-#include "common.h"
+#include "mold.h"

 #include <csignal>
 #include <tbb/version.h>
@@ -28,8 +28,7 @@ void cleanup() {
 // for the first time.
 //
 // If a disk becomes full as a result of a write to an mmap'ed memory
-// region, the failure of the write is reported as a SIGBUS or structured
-// exeption with code EXCEPTION_IN_PAGE_ERROR on Windows. This
+// region, the failure of the write is reported as a SIGBUS. This
 // signal handler catches that signal and prints out a user-friendly
 // error message. Without this, it is very hard to realize that the
 // disk might be full.
@@ -74,7 +73,7 @@ void install_signal_handler() {
  sigaction(SIGBUS, &action, NULL);

  // OneTBB 2021.9.0 has the interface version 12090.
-  if (TBB_runtime_interface_version() < 12090) {
+  if (TBB_runtime_interface_version() <= 12090) {
    sigabrt_msg = "mold: aborted\n"
      "mold: mold with libtbb version 2021.9.0 or older is known to be unstable "
      "under heavy load. Your libtbb version is " +
@@ -1,4 +1,4 @@
-#include "common.h"
+#include "mold.h"

 #include <windows.h>

@@ -1,3 +1,4 @@
+#include "config.h"
 #include "mold.h"

 #include <csignal>
@@ -10,12 +11,12 @@

 namespace mold {

-#ifdef MOLD_X86_64
 static int pipe_write_fd = -1;

 // Exiting from a program with large memory usage is slow --
 // it may take a few hundred milliseconds. To hide the latency,
 // we fork a child and let it do the actual linking work.
+template <typename E>
 void fork_child() {
  int pipefd[2];
  if (pipe(pipefd) == -1) {
@@ -52,6 +53,7 @@ void fork_child() {
  pipe_write_fd = pipefd[1];
 }

+template <typename E>
 void notify_parent() {
  if (pipe_write_fd == -1)
    return;
@@ -61,7 +63,6 @@ void notify_parent() {
  assert(n == 1);
  pipe_write_fd = -1;
 }
-#endif

 template <typename E>
 static std::string find_dso(Context<E> &ctx, std::filesystem::path self) {
@@ -104,7 +105,7 @@ void process_run_subcommand(Context<E> &ctx, int argc, char **argv) {
  setenv("LD_PRELOAD", dso_path.c_str(), 1);
  setenv("MOLD_PATH", self.c_str(), 1);

-  // If ld, ld.lld or ld.gold is specified, run mold itself
+  // If ld, ld.lld or ld.gold is specified, run mold instead
  if (std::string cmd = path_filename(argv[2]);
      cmd == "ld" || cmd == "ld.lld" || cmd == "ld.gold") {
    std::vector<char *> args;
@@ -123,6 +124,8 @@ void process_run_subcommand(Context<E> &ctx, int argc, char **argv) {

 using E = MOLD_TARGET;

+template void fork_child<E>();
+template void notify_parent<E>();
 template void process_run_subcommand(Context<E> &, int, char **);

 } // namespace mold
@@ -2,10 +2,11 @@

 namespace mold {

-#ifdef MOLD_X86_64
+template <typename E>
 void fork_child() {}
+
+template <typename E>
 void notify_parent() {}
-#endif

 template <typename E>
 [[noreturn]]
@@ -15,6 +16,8 @@ void process_run_subcommand(Context<E> &ctx, int argc, char **argv) {

 using E = MOLD_TARGET;

+template void fork_child<E>();
+template void notify_parent<E>();
 template void process_run_subcommand(Context<E> &, int, char **);

 } // namespace mold
@@ -20,8 +20,8 @@
 // we don't need to try too hard to reduce thunk size to the absolute
 // minimum.

-#if MOLD_ARM32 || MOLD_ARM64LE || MOLD_ARM64BE || MOLD_PPC32 || \
-    MOLD_PPC64V1 || MOLD_PPC64V2
+#if MOLD_ARM32LE || MOLD_ARM32BE || MOLD_ARM64LE || MOLD_ARM64BE || \
+    MOLD_PPC32 || MOLD_PPC64V1 || MOLD_PPC64V2

 #include "mold.h"

@@ -32,12 +32,14 @@ namespace mold {

 using E = MOLD_TARGET;

-// We create thunks for each 25.6/3.2/6.4 MiB code block for
+// We create thunks for each 32/8/16 MiB code block for
 // ARM64/ARM32/PPC, respectively.
-static constexpr i64 batch_size = branch_distance<E> / 5;
+static constexpr i64 batch_size =
+  (is_arm64<E> ? 32 : is_arm32<E> ? 8 : 16) * 1024 * 1024;

-// We assume that a single thunk group is smaller than 1 MiB.
-static constexpr i64 max_thunk_size = 1024 * 1024;
+// We assume that a single thunk group is smaller than 16/4/8 MiB
+// for ARM64/ARM32/PPC, respectively.
+static constexpr i64 max_thunk_size = batch_size / 2;

 // We align thunks to 16 byte boundaries because many processor vendors
 // recommend we align branch targets to 16 byte boundaries for performance
@@ -45,68 +47,74 @@ static constexpr i64 max_thunk_size = 1024 * 1024;
 static constexpr i64 thunk_align = 16;

 template <typename E>
-static bool is_reachable(Context<E> &ctx, bool first_pass, InputSection<E> &isec,
-                         Symbol<E> &sym, const ElfRel<E> &rel) {
-  // If the target section is in the same output section but
-  // hasn't got any address yet, that's unreacahble.
-  InputSection<E> *isec2 = sym.get_input_section();
-  if (isec2 && isec.output_section == isec2->output_section &&
-      isec2->offset == -1)
+static bool
+requires_thunk(Context<E> &ctx, InputSection<E> &isec, const ElfRel<E> &rel,
+               bool first_pass) {
+  if (!is_func_call_rel(rel))
    return false;
+  Symbol<E> &sym = *isec.file.symbols[rel.r_sym];

-  // We don't know about the final file layout on the first pass, so
-  // we assume pessimistically that all out-of-section relocations are
-  // out-of-range. Excessive thunks will be removed on the second pass.
  if (first_pass) {
+    // On the first pass, we pessimistically assume that all out-of-section
+    // relocations are out of range.
+    InputSection<E> *isec2 = sym.get_input_section();
    if (!isec2 || isec.output_section != isec2->output_section)
-      return false;
+      return true;
+
+    // If the target section is in the same output section but
+    // hasn't got any address yet, that's unreacahble.
+    if (isec2->offset == -1)
+      return true;

    // Even if the target is the same section, we branch to its PLT
    // if it has one. So a symbol with a PLT is also considered an
    // out-of-section reference.
    if (sym.has_plt(ctx))
-      return false;
+      return true;
  }

+  // Thumb and ARM B instructions cannot be converted to BX, so we
+  // always have to make them jump to a thunk to switch processor mode
+  // even if their destinations are reachable.
+  if constexpr (is_arm32<E>)
+    if (bool is_thumb = sym.get_addr(ctx) & 1;
+        (rel.r_type == R_ARM_JUMP24 && is_thumb) ||
+        (rel.r_type == R_ARM_PLT32 && is_thumb) ||
+        (rel.r_type == R_ARM_THM_JUMP24 && !is_thumb))
+      return true;
+
+  // On PowerPC, all PLT calls go through range extension thunks.
+  if constexpr (is_ppc<E>)
+    if (sym.has_plt(ctx))
+      return true;
+
+  // PowerPC before Power9 lacks PC-relative load/store instructions.
+  // Functions compiled for Power9 or earlier assume that r2 points to
+  // GOT+0x8000, while those for Power10 uses r2 as a scratch register.
+  // We need a thunk to recompute r2 for interworking.
+  if constexpr (is_ppc64v2<E>)
+    if ((rel.r_type == R_PPC64_REL24 && !sym.esym().ppc64_preserves_r2()) ||
+        (rel.r_type == R_PPC64_REL24_NOTOC && sym.esym().ppc64_uses_toc()))
+      return true;
+
  // Compute a distance between the relocated place and the symbol
  // and check if they are within reach.
  i64 S = sym.get_addr(ctx, NO_OPD);
  i64 A = get_addend(isec, rel);
  i64 P = isec.get_addr() + rel.r_offset;
  i64 val = S + A - P;
-  return -branch_distance<E> <= val && val < branch_distance<E>;
-}
-
-template <typename E>
-static bool needs_shim(Context<E> &ctx, Symbol<E> &sym, const ElfRel<E> &rel) {
-  // Thumb and ARM B instructions cannot be converted to BX, so we
-  // always have to make them jump to a thunk to switch processor mode
-  // even if their destinations are within their ranges.
-  if constexpr (is_arm32<E>) {
-    bool is_thumb = sym.get_addr(ctx) & 1;
-    return (rel.r_type == R_ARM_THM_JUMP24 && !is_thumb) ||
-           (rel.r_type == R_ARM_JUMP24 && is_thumb) ||
-           (rel.r_type == R_ARM_PLT32 && is_thumb);
-  }
-
-  // On PowerPC, all PLT calls go through range extension thunks.
-  if constexpr (is_ppc32<E> || is_ppc64v1<E>)
-    return sym.has_plt(ctx);
-
-  // PowerPC before Power9 lacks PC-relative load/store instructions.
-  // Functions compiled for Power9 or earlier assume that r2 points to
-  // GOT+0x8000, while those for Power10 uses r2 as a scratch register.
-  // We need to a thunk to recompute r2 for interworking.
-  if constexpr (is_ppc64v2<E>)
-    return sym.has_plt(ctx) ||
-           (rel.r_type == R_PPC64_REL24 && !sym.esym().ppc64_preserves_r2()) ||
-           (rel.r_type == R_PPC64_REL24_NOTOC && sym.esym().ppc64_uses_toc());
-  return false;
+  return val < -branch_distance<E> || branch_distance<E> <= val;
 }

 template <>
-void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,
-                                                     bool first_pass) {
+void Thunk<E>::compute_size() {
+  offsets.clear();
+  for (i64 i = 0; i <= symbols.size(); i++)
+    offsets.push_back(E::thunk_hdr_size + i * E::thunk_size);
+}
+
+template <>
+void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx) {
  std::span<InputSection<E> *> m = members;
  if (m.empty())
    return;
@@ -122,7 +130,7 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,
  // We manage progress using four offsets which increase monotonically.
  // The locations they point to are always A <= B <= C <= D.
  //
-  // Input sections between B and C are in the current batch.
+  // Input sections between B and C are the current batch.
  //
  // A is the input section with the smallest address than can reach
  // from the current batch.
@@ -181,33 +189,21 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,
    // Create a new thunk and place it at D.
    offset = align_to(offset, thunk_align);
    thunks.emplace_back(std::make_unique<Thunk<E>>(*this, offset));
+
    Thunk<E> &thunk = *thunks.back();
+    std::mutex mu;

    // Scan relocations between B and C to collect symbols that need
    // entries in the new thunk.
-    std::mutex mu;
-
    tbb::parallel_for(b, c, [&](i64 i) {
      InputSection<E> &isec = *m[i];
-
      for (const ElfRel<E> &rel : isec.get_rels(ctx)) {
-        if (!is_func_call_rel(rel))
-          continue;
-
-        // Skip if the symbol is undefined. apply_reloc() will report an error.
-        Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
-        if (!sym.file)
-          continue;
-
-        // Skip if we can directly branch to the destination.
-        if (is_reachable(ctx, first_pass, isec, sym, rel) &&
-            !needs_shim(ctx, sym, rel))
-          continue;
-
-        // Add the symbol to the current thunk if it's not added already.
-        if (!sym.flags.test_and_set()) {
-          std::scoped_lock lock(mu);
-          thunk.symbols.push_back(&sym);
+        if (requires_thunk(ctx, isec, rel, true)) {
+          if (Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+              !sym.flags.test_and_set()) {
+            std::scoped_lock lock(mu);
+            thunk.symbols.push_back(&sym);
+          }
        }
      }
    });
@@ -219,6 +215,7 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,

    // Now that we know the number of symbols in the thunk, we can compute
    // the thunk's size.
+    thunk.compute_size();
    assert(thunk.size() < max_thunk_size);
    offset += thunk.size();

@@ -226,6 +223,7 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,
    b = c;
  }

+  // Reset flags for future use
  for (; t < thunks.size(); t++)
    for (Symbol<E> *sym : thunks[t]->symbols)
      sym->flags = 0;
@@ -233,15 +231,75 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx,
  this->shdr.sh_size = offset;
 }

+// create_range_extension_thunks() creates thunks with a pessimistic
+// assumption that all out-of-section references are out of range.
+// After computing output section addresses, we revisit all thunks to
+// remove unneeded entries from them.
+//
+// We create more thunks than necessary and then eliminate some of
+// them later, instead of just creating thunks at this stage. This is
+// because we can safely shrink sections after assigning addresses to
+// them without worrying about making existing references to thunks go
+// out of range. On the other hand, if we insert thunks after
+// assigning addresses to sections, references to thunks could become
+// out of range due to the new extra gaps for thunks. Thus, the
+// creation of thunks is a two-pass process.
 template <>
 void remove_redundant_thunks(Context<E> &ctx) {
  Timer t(ctx, "remove_redundant_thunks");
-  set_osec_offsets(ctx);

+  // Gather output executable sections
+  std::vector<OutputSection<E> *> sections;
  for (Chunk<E> *chunk : ctx.chunks)
    if (OutputSection<E> *osec = chunk->to_osec())
      if (osec->shdr.sh_flags & SHF_EXECINSTR)
-        osec->create_range_extension_thunks(ctx, false);
+        sections.push_back(osec);
+
+  // Mark all symbols that actually need range extension thunks
+  for (OutputSection<E> *osec : sections) {
+    tbb::parallel_for_each(osec->members, [&](InputSection<E> *isec) {
+      for (const ElfRel<E> &rel : isec->get_rels(ctx))
+        if (requires_thunk(ctx, *isec, rel, false))
+          isec->file.symbols[rel.r_sym]->flags.test_and_set();
+    });
+  }
+
+  // Remove symbols from thunks if they don't actually need range
+  // extension thunks
+  for (OutputSection<E> *osec : sections) {
+    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks) {
+      std::erase_if(thunk->symbols, [&](Symbol<E> *sym) { return !sym->flags; });
+      thunk->shrink_size(ctx);
+    }
+  }
+
+  // Recompute section sizes
+  tbb::parallel_for_each(sections, [&](OutputSection<E> *osec) {
+    std::span<InputSection<E> *> m = osec->members;
+    std::span<std::unique_ptr<Thunk<E>>> t = osec->thunks;
+    i64 offset = 0;
+
+    while (!m.empty() || !t.empty()) {
+      if (!m.empty() && (t.empty() || m[0]->offset < t[0]->offset)) {
+        offset = align_to(offset, 1 << m[0]->p2align);
+        m[0]->offset = offset;
+        offset += m[0]->sh_size;
+        m = m.subspan(1);
+      } else {
+        offset = align_to(offset, thunk_align);
+        t[0]->offset = offset;
+        offset += t[0]->size();
+        t = t.subspan(1);
+      }
+    }
+    osec->shdr.sh_size = offset;
+  });
+
+  // Reset flags for future use
+  for (OutputSection<E> *osec : sections)
+    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks)
+      for (Symbol<E> *sym : thunk->symbols)
+        sym->flags = 0;
 }

 // When applying relocations, we want to know the address in a reachable
@@ -259,7 +317,8 @@ void gather_thunk_addresses(Context<E> &ctx) {
  std::vector<OutputSection<E> *> sections;
  for (Chunk<E> *chunk : ctx.chunks)
    if (OutputSection<E> *osec = chunk->to_osec())
-      sections.push_back(osec);
+      if (osec->shdr.sh_flags & SHF_EXECINSTR)
+        sections.push_back(osec);

  ranges::stable_sort(sections, {}, [](OutputSection<E> *x) {
    return x->shdr.sh_addr;
@@ -269,8 +328,8 @@ void gather_thunk_addresses(Context<E> &ctx) {
    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks) {
      for (i64 i = 0; i < thunk->symbols.size(); i++) {
        Symbol<E> &sym = *thunk->symbols[i];
-        sym.add_aux(ctx);
-        ctx.symbol_aux[sym.aux_idx].thunk_addrs.push_back(thunk->get_addr(i));
+        u64 addr = thunk->get_addr() + thunk->offsets[i];
+        sym.add_thunk_addr(ctx, addr);
      }
    }
  }
@@ -162,7 +162,7 @@ u64 get_tp_addr(const ElfPhdr<E> &phdr) {
    // and %a0/%a1 on s390x) refers to past the end of the TLS block for
    // historical reasons. TLVs are accessed with negative offsets from TP.
    return align_to(phdr.p_vaddr + phdr.p_memsz, phdr.p_align);
-  } else if constexpr (is_arm<E> || is_sh4<E> || is_arc<E>) {
+  } else if constexpr (is_arm<E> || is_sh4<E>) {
    // On ARM and SH4, the runtime appends two words at the beginning
    // of TLV template image when copying TLVs to the TLS block, so we need
    // to offset it.
@@ -30,8 +30,8 @@ endif()

 if(MOLD_ENABLE_QEMU_TESTS)
  list(APPEND QEMU_ARCHS
-    x86_64 i386 arm aarch64 aarch64_be ppc ppc64 ppc64le sparc64 sh4 sh4eb
-    s390x riscv64 riscv32 m68k loongarch64 arc)
+    x86_64 i386 arm armeb aarch64 aarch64_be ppc ppc64 ppc64le sparc64
+    sh4 sh4eb s390x riscv64 riscv32 m68k loongarch64)

  LIST(APPEND TRIPLES
    x86_64-linux-gnu
@@ -39,6 +39,7 @@ if(MOLD_ENABLE_QEMU_TESTS)
    aarch64-linux-gnu
    aarch64_be-linux-gnu
    arm-linux-gnueabihf
+    armeb-linux-gnueabihf
    riscv64-linux-gnu
    powerpc-linux-gnu
    powerpc64-linux-gnu
@@ -49,8 +50,7 @@ if(MOLD_ENABLE_QEMU_TESTS)
    sh4aeb-linux-gnu
    riscv32-linux-gnu
    m68k-linux-gnu
-    loongarch64-linux-gnu
-    arc-linux-gnu)
+    loongarch64-linux-gnu)

  foreach(ARCH IN LISTS QEMU_ARCHS)
    find_program(HAS_qemu-${ARCH} qemu-${ARCH})
@@ -122,6 +122,10 @@ if(${MACHINE} STREQUAL "arm" OR (HAS_qemu-arm AND HAS_arm-linux-gnueabihf-gcc))
  add_target(arm arm-linux-gnueabihf)
 endif()

+if(${MACHINE} STREQUAL "armeb" OR (HAS_qemu-armeb AND HAS_armeb-linux-gnueabihf-gcc))
+  add_target(armeb armeb-linux-gnueabihf)
+endif()
+
 if(${MACHINE} STREQUAL "riscv64" OR (HAS_qemu-riscv64 AND HAS_riscv64-linux-gnu-gcc))
  add_target(riscv64 riscv64-linux-gnu)
 endif()
@@ -185,7 +189,3 @@ endif()
 if(${MACHINE} STREQUAL "loongarch64" OR (HAS_qemu-loongarch64 AND HAS_loongarch64-linux-gnu-gcc))
  add_target(loongarch64 loongarch64-linux-gnu)
 endif()
-
-if(${MACHINE} STREQUAL "arc" OR (HAS_qemu-loongarch64 AND HAS_arc-linux-gnu-gcc))
-  add_target(arc arc-linux-gnu)
-endif()
@@ -0,0 +1,51 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF > $t/a.c
+#include <stdio.h>
+
+void fn3();
+void fn4();
+
+__attribute__((section(".low"))) void fn1() { printf(" fn1"); fn3(); }
+__attribute__((section(".low"))) void fn2() { printf(" fn2"); fn4(); }
+
+int main() {
+  printf(" main");
+  fn1();
+  printf("\n");
+}
+EOF
+
+cat <<EOF > $t/b.c
+#include <stdio.h>
+
+void fn1();
+void fn2();
+
+__attribute__((section(".high"))) void fn3() { printf(" fn3"); fn2(); }
+__attribute__((section(".high"))) void fn4() { printf(" fn4"); }
+EOF
+
+$CC -c -o $t/c.o $t/a.c
+$CC -c -o $t/d.o $t/b.c
+
+$CC -B. -o $t/exe1 $t/c.o $t/d.o \
+  -Wl,--section-start=.low=0x10000000,--section-start=.high=0x100000000
+$QEMU $t/exe1 | grep 'main fn1 fn3 fn2 fn4'
+
+$CC -B. -o $t/exe2 $t/c.o $t/d.o \
+  -Wl,--section-start=.high=0x10000000,--section-start=.low=0x100000000
+$QEMU $t/exe2 | grep 'main fn1 fn3 fn2 fn4'
+
+
+$CC -c -o $t/e.o $t/a.c -fno-PIC -mcmodel=large
+$CC -c -o $t/f.o $t/b.c -fno-PIC -mcmodel=large
+
+$CC -B. -o $t/exe3 $t/e.o $t/f.o -pie \
+  -Wl,--section-start=.low=0x10000000,--section-start=.high=0x400000000
+$QEMU $t/exe3 | grep 'main fn1 fn3 fn2 fn4'
+
+$CC -B. -o $t/exe4 $t/e.o $t/f.o -pie \
+  -Wl,--section-start=.high=0x10000000,--section-start=.low=0x400000000
+$QEMU $t/exe4 | grep 'main fn1 fn3 fn2 fn4'
@@ -0,0 +1,36 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+[ $MACHINE = aarch64 ] || skip
+command -v timeout >/dev/null || skip
+
+cat <<EOF | $CC -c -o $t/a.o -fPIC -xassembler - 2> /dev/null || skip
+.section .custom_rodata_a, "a", %progbits
+.hidden A
+.global A
+A:
+  .space 8
+
+.section .custom_rodata_b_huge, "a", %progbits
+.balign 16384
+.hidden B
+.global B
+B:
+  .space 8
+
+.section .data, "aw", %progbits
+.rept 7439
+  .quad A
+.endr
+
+.global P_1
+P_1:
+  .quad A
+
+.global P_2
+P_2:
+  .quad B
+EOF
+
+timeout 5s ./mold -m aarch64elf -shared -o $t/b.so $t/a.o \
+  --pack-dyn-relocs=android -z max-page-size=16384
@@ -0,0 +1,8 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() {}
+EOF
+
+not $CC -B. -o $t/exe $t/a.o -mbe32 |& grep 'be32 is not supported'
@@ -0,0 +1,51 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# In the REL relocation format, an addend is read from the relocated
+# place itself, and its value is signed. The Linux kernel's real-mode
+# setup code, for example, presets fields relocated with R_386_8 and
+# R_386_16 with negative values such as -1 and -512. Make sure we
+# sign-extend such in-place addends instead of zero-extending them.
+
+cat <<'EOF' | $CC -c -o $t/a.o -xassembler -
+.data
+.globl x8, x16, xpc8, xpc16
+x8:    .byte  abs8 - 1
+x16:   .short abs16 - 512
+xpc8:  .byte  target - . - 1
+xpc16: .short target - . - 512
+
+.section .nonalloc
+.byte  abs8 - 1
+.short abs16 - 512
+EOF
+
+cat <<'EOF' | $CC -c -o $t/b.o -xassembler -
+.globl abs8, abs16
+abs8 = 100
+abs16 = 1000
+
+.data
+.globl target
+target:
+.byte 0
+EOF
+
+cat <<'EOF' | $CC -c -o $t/c.o -xc -
+#include <stdio.h>
+
+extern char target;
+extern unsigned char x8, xpc8;
+extern unsigned short x16, xpc16;
+
+int main() {
+  printf("%d %d %d %d\n", x8, x16,
+         (signed char)xpc8 == (char *)&target - (char *)&xpc8 - 1,
+         (short)xpc16 == (char *)&target - (char *)&xpc16 - 512);
+}
+EOF
+
+$CC -B. -no-pie -o $t/exe $t/a.o $t/b.o $t/c.o
+$QEMU $t/exe | grep '^99 488 1 1$'
+
+$OBJDUMP -s -j .nonalloc $t/exe | grep -w 63e801
@@ -0,0 +1,80 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# When mold relaxes an instruction sequence, the relocations attached to the
+# original instructions no longer match the relaxed code. With --emit-relocs,
+# mold must rewrite them so that the emitted relocations describe the relaxed
+# instructions, both in type and in offset.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xassembler -
+.text
+.globl _start
+_start:
+  # pcaddu18i + jirl => bl  (R_LARCH_CALL36 => R_LARCH_B26)
+  .reloc ., R_LARCH_RELAX
+  pcaddu18i $ra, %call36(get_zero)
+  jirl $ra, $ra, 0
+
+  # pcalau12i + addi.d => pcaddi  (R_LARCH_PCALA_* => R_LARCH_PCREL20_S2)
+  .reloc ., R_LARCH_RELAX
+  pcalau12i $t0, %pc_hi20(v)
+  .reloc ., R_LARCH_RELAX
+  addi.d $t0, $t0, %pc_lo12(v)
+  ld.w $t0, $t0, 0
+  or $a0, $a0, $t0
+
+  # pcalau12i + ld.d => pcaddi  (R_LARCH_GOT_PC_* => R_LARCH_PCREL20_S2)
+  .reloc ., R_LARCH_RELAX
+  pcalau12i $t1, %got_pc_hi20(v)
+  .reloc ., R_LARCH_RELAX
+  ld.d $t1, $t1, %got_pc_lo12(v)
+  ld.w $t1, $t1, 0
+  or $a0, $a0, $t1
+
+  li.w $a7, 93           # __NR_exit
+  syscall 0
+
+get_zero:
+  li.w $a0, 0
+  ret
+
+.section .rodata,"a"
+.p2align 2
+.hidden v
+v:
+  .word 0
+EOF
+
+$CC -B. -o $t/exe $t/a.o --static -nostdlib -Wl,-e,_start,--emit-relocs,--relax
+$QEMU $t/exe
+
+$OBJDUMP -dr $t/exe > $t/exe.objdump
+
+# Relaxation took place.
+grep -Fw pcaddi $t/exe.objdump
+grep -Fw bl $t/exe.objdump
+
+# The relocations were rewritten to match the relaxed instructions. The dead
+# high-part relocations are turned into R_LARCH_NONE.
+grep -Fw R_LARCH_PCREL20_S2 $t/exe.objdump
+grep -Fw R_LARCH_B26 $t/exe.objdump
+grep -Fw R_LARCH_NONE $t/exe.objdump
+
+# The stale pre-relaxation relocations are gone.
+not grep -Fw R_LARCH_PCALA_HI20 $t/exe.objdump
+not grep -Fw R_LARCH_PCALA_LO12 $t/exe.objdump
+not grep -Fw R_LARCH_GOT_PC_HI20 $t/exe.objdump
+not grep -Fw R_LARCH_GOT_PC_LO12 $t/exe.objdump
+not grep -Fw R_LARCH_CALL36 $t/exe.objdump
+
+# Each rewritten relocation must sit at the address of the relaxed instruction
+# it describes, not at its original pre-relaxation offset. This checks that the
+# relocation offsets were adjusted: R_LARCH_PCREL20_S2 must land on a pcaddi
+# and R_LARCH_B26 on a b/bl.
+awk '
+  $3 == "pcaddi"             { insn[$1] = $3 }
+  $3 == "b" || $3 == "bl"    { insn[$1] = $3 }
+  $2 == "R_LARCH_PCREL20_S2" { if (insn[$1] != "pcaddi")       { bad=1; print "bad offset: " $0 } }
+  $2 == "R_LARCH_B26"        { if (insn[$1] !~ /^bl?$/)        { bad=1; print "bad offset: " $0 } }
+  END { exit bad+0 }
+' $t/exe.objdump
@@ -0,0 +1,90 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Depending on the symbol, mold relaxes a TLSDESC sequence into a local-exec
+# (LE) or initial-exec (IE) sequence, or keeps it as TLSDESC but folds its
+# first two instructions into a single pcaddi. With --emit-relocs, the emitted
+# relocations must be rewritten to match whichever relaxation was applied.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xc - -fPIC
+_Thread_local char foo[4] = "foo";
+_Thread_local char padding[100000] = "pad";
+_Thread_local char bar[4] = "bar";
+EOF
+
+cat <<'EOF' | $CC -o $t/b.o -c -xc - -fPIC -mtls-dialect=desc -O2
+extern _Thread_local char foo[4];
+extern _Thread_local char bar[4];
+char *get_foo() { return foo; }
+char *get_bar() { return bar; }
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc - -mtls-dialect=desc
+#include <stdio.h>
+char *get_foo();
+char *get_bar();
+int main() { printf("%s %s\n", get_foo(), get_bar()); }
+EOF
+
+#
+# Local TLS in an executable: TLSDESC => LE
+#
+$CC -B. -o $t/exe1 $t/a.o $t/b.o $t/c.o -Wl,--emit-relocs,--relax
+{ $QEMU $t/exe1; true; } |& grep -q 'unexpected reloc type' && skip
+$QEMU $t/exe1 | grep -F 'foo bar'
+
+$OBJDUMP -dr $t/exe1 > $t/exe1.objdump
+
+# foo has a small TP offset, so its sequence relaxes to a single instruction
+# with only a low-part relocation. bar has a large offset, so it keeps both
+# the high- and low-part relocations.
+grep -E $'R_LARCH_TLS_LE_LO12[ \t]+foo' $t/exe1.objdump
+not grep -E $'R_LARCH_TLS_LE_HI20[ \t]+foo' $t/exe1.objdump
+grep -E $'R_LARCH_TLS_LE_HI20[ \t]+bar' $t/exe1.objdump
+grep -E $'R_LARCH_TLS_LE_LO12[ \t]+bar' $t/exe1.objdump
+
+# No TLSDESC relocation survives.
+not grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_LD $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_CALL $t/exe1.objdump
+
+#
+# TLS defined in a shared library: TLSDESC => IE
+#
+$CC -B. -shared -o $t/d.so $t/a.o -Wl,--relax
+$CC -B. -o $t/exe2 $t/b.o $t/c.o $t/d.so -Wl,--emit-relocs,--relax -Wl,-rpath=$t
+$QEMU $t/exe2 | grep -F 'foo bar'
+
+$OBJDUMP -dr $t/exe2 > $t/exe2.objdump
+grep -Fw R_LARCH_TLS_IE_PC_HI20 $t/exe2.objdump
+grep -Fw R_LARCH_TLS_IE_PC_LO12 $t/exe2.objdump
+not grep -Fw R_LARCH_TLS_DESC_LD $t/exe2.objdump
+not grep -Fw R_LARCH_TLS_DESC_CALL $t/exe2.objdump
+
+#
+# Shared library output: TLSDESC is kept, but pcalau12i+addi.d => pcaddi, so
+# the low-part relocation becomes the pcaddi's TLS_DESC_PCREL20_S2 while the
+# ld.d/jirl relocations are left unchanged.
+#
+$CC -B. -shared -o $t/e.so $t/a.o $t/b.o -Wl,--emit-relocs,--relax
+$OBJDUMP -dr $t/e.so > $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_PCREL20_S2 $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_LD $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_CALL $t/e.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/e.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/e.objdump
+
+#
+# Relocatable output: no relaxation happens and TLSDESC is not downgraded, so
+# every relocation must be passed through unchanged rather than rewritten as
+# if it had been relaxed to LE/IE.
+#
+$CC -B. -o $t/reloc.o $t/b.o -r
+$OBJDUMP -r $t/reloc.o > $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_LD $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_CALL $t/reloc.objdump
+not grep -Fw R_LARCH_TLS_LE_HI20 $t/reloc.objdump
+not grep -Fw R_LARCH_TLS_LE_LO12 $t/reloc.objdump
@@ -0,0 +1,33 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# pcaddi takes a 20-bit immediate that is shifted left by 2 to form
+# a PC-relative offset. Therefore, relaxing a GOT load (pcalau12i +
+# ld.d) to pcaddi is valid only when the symbol's address is 4-byte
+# aligned. Here, `foo` is placed at an odd address, so the relaxation
+# must not happen.
+
+cat <<EOF | $CC -o $t/a.o -c -xassembler -
+.data
+.byte 0
+.globl foo
+.type foo, @object
+foo:
+.byte 0x42
+.size foo, 1
+EOF
+
+cat <<EOF | $CC -o $t/b.o -c -xc - -fPIC -O
+extern char foo;
+int get_foo() { return foo; }
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc -
+#include <stdio.h>
+int get_foo();
+int main() { printf("%d\n", get_foo()); }
+EOF
+
+$CC -B. -o $t/exe $t/a.o $t/b.o $t/c.o -pie -Wl,--relax
+$QEMU $t/exe | grep '^66$'
+$OBJDUMP -d $t/exe | grep -A2 '<get_foo>:' | grep -Fw pcalau12i
@@ -0,0 +1,98 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# When mold relaxes instructions, the relocations attached to the relaxed code
+# must be rewritten for --emit-relocs. A shortened call still references its
+# symbol, so R_RISCV_CALL_PLT becomes R_RISCV_JAL or R_RISCV_RVC_JUMP. A
+# relaxation that folds an address into the instruction as a link-time
+# constant (lui/addi or an AUIPC+LD GOT load) leaves the instruction without a
+# relocation, so we emit R_RISCV_NONE.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xassembler -
+.text
+.globl _start
+_start:
+  # CALL_PLT => jal (near target)
+  .reloc ., R_RISCV_RELAX
+  call func
+
+  # lui + addi of a small absolute symbol => lui is deleted (HI20 => NONE),
+  # while the low-part relocation stays.
+  lui t0, %hi(small)
+  .reloc ., R_RISCV_RELAX
+  addi t0, t0, %lo(small)
+
+  # GOT load of an absolute symbol => the value is materialized directly
+  # (GOT_HI20 and its paired PCREL_LO12_I both => NONE).
+got_anchor:
+  .reloc ., R_RISCV_GOT_HI20, small
+  .reloc ., R_RISCV_RELAX
+  auipc t1, 0
+  .reloc ., R_RISCV_PCREL_LO12_I, got_anchor
+  .reloc ., R_RISCV_RELAX
+  ld t1, 0(t1)
+
+  # CALL with rd=zero (tail call) to a near target => c.j (=> RVC_JUMP)
+  .reloc ., R_RISCV_RELAX
+  tail do_exit
+
+func:
+  ret
+
+do_exit:
+  li a0, 0
+  li a7, 93           # __NR_exit
+  ecall
+EOF
+
+cat <<'EOF' | $CC -o $t/b.o -c -xassembler -
+.globl small
+small = 0xba
+EOF
+
+$CC -B. -o $t/exe $t/a.o $t/b.o --static -nostdlib -Wl,-e,_start,--emit-relocs,--relax
+$QEMU $t/exe
+
+$OBJDUMP -dr $t/exe > $t/exe.objdump
+
+# A shortened call keeps a relocation that names the symbol.
+grep -Fw R_RISCV_JAL $t/exe.objdump
+grep -Fw R_RISCV_RVC_JUMP $t/exe.objdump
+
+# Address-materializing relaxations drop their relocations.
+grep -Fw R_RISCV_NONE $t/exe.objdump
+
+# The stale pre-relaxation relocations are gone.
+not grep -Fw R_RISCV_CALL_PLT $t/exe.objdump
+not grep -Fw R_RISCV_GOT_HI20 $t/exe.objdump
+not grep -Fw R_RISCV_HI20 $t/exe.objdump
+
+# The low-part relocation of the lui/addi pair survives (the addi is kept).
+grep -Fw R_RISCV_LO12_I $t/exe.objdump
+
+# Each rewritten call relocation must sit on the relaxed instruction it
+# describes: R_RISCV_JAL on a jal and R_RISCV_RVC_JUMP on a c.j. This checks
+# that the relocation offsets were adjusted for the deleted bytes.
+awk '
+  $3 == "jal"              { insn[$1] = "jal" }
+  $3 == "j" || $3 == "c.j" { insn[$1] = "cj" }
+  $2 == "R_RISCV_JAL"      { if (insn[$1] != "jal") { bad=1; print "bad offset: " $0 } }
+  $2 == "R_RISCV_RVC_JUMP" { if (insn[$1] != "cj")  { bad=1; print "bad offset: " $0 } }
+  END { exit bad+0 }
+' $t/exe.objdump
+
+# TLS local-exec: `lui + add` that materializes TP + %tprel_hi are deleted for
+# a variable within 2 KiB of TP (TPREL_HI20 and TPREL_ADD => NONE), while the
+# access relative to TP keeps its low-part relocation.
+cat <<'EOF' | $CC -o $t/tls.o -c -xc - -O2 -fno-section-anchors
+__thread int tv;
+int main(void) { return tv; }     // tv is zero-initialized, so exits 0
+EOF
+
+$CC -B. -o $t/tls $t/tls.o -static -Wl,--emit-relocs,--relax
+$QEMU $t/tls
+
+$OBJDUMP -dr $t/tls > $t/tls.objdump
+grep -E $'R_RISCV_TPREL_LO12_[IS][ \t]+tv' $t/tls.objdump
+not grep -E $'R_RISCV_TPREL_HI20[ \t]+tv' $t/tls.objdump
+not grep -E $'R_RISCV_TPREL_ADD[ \t]+tv' $t/tls.objdump
@@ -0,0 +1,26 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -x assembler -
+.section .foo, "ax"
+foo:
+  call bar
+EOF
+
+cat <<EOF | $CC -o $t/b.o -c -x assembler -
+.globl bar
+.section .bar, "ax"
+bar:
+  ret
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc -
+int main() {}
+EOF
+
+$CC -B. -o $t/exe1 $t/a.o $t/b.o $t/c.o -Wl,--section-start=.foo=0x10000 \
+  -Wl,--section-start=.bar=0x8000f000
+
+not $CC -B. -o $t/exe2 $t/a.o $t/b.o $t/c.o -Wl,--section-start=.foo=0x10000 \
+  -Wl,--section-start=.bar=0x8000f800 |&
+  grep -F 'relocation R_RISCV_CALL_PLT against bar out of range'
@@ -1,4 +1,6 @@
 #!/bin/bash
 . $(dirname $0)/common.inc

+nm -D mold | grep __msan_init && skip
+
 not ./mold -m elf_x86_64 '' |& grep 'cannot open :'
@@ -0,0 +1,38 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+supports_ifunc || skip
+
+cat <<EOF | $CXX -c -fPIC -o $t/a.o -xc++ -
+__attribute__((target("default"))) void myfunc(int) {}
+__attribute__((target("avx512f"))) void myfunc(int) {}
+
+template <typename T>
+struct MyClass {
+  MyClass(T data) { myfunc(data); }
+};
+
+template struct MyClass<int>;
+EOF
+
+$CXX -shared -o $t/b.so $t/a.o
+
+cat <<EOF | $CXX -c -fPIC -o $t/c.o -xc++ -
+__attribute__((target("default"))) void myfunc(int);
+__attribute__((target("avx512f"))) void myfunc(int);
+
+template <typename T>
+struct MyClass {
+  MyClass(T data) { myfunc(data); }
+};
+
+extern template struct MyClass<int>;
+
+int main() {
+  MyClass<int> obj(3);
+}
+EOF
+
+$CXX -B. -o $t/exe $t/c.o $t/b.so -fno-PIE
+$QEMU $t/exe |& grep 'circular dependency' || skip
+$QEMU $t/exe
@@ -0,0 +1,39 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# This regression reproduces a mixed LTO + regular-object COMDAT case.
+# The regular object has a non-COMDAT section referring to a symbol in a
+# COMDAT group with signature "mix". An LTO object contributes the same
+# COMDAT key. If IR COMDAT ownership is allowed to override reachable regular
+# object ownership, the regular COMDAT member can be discarded incorrectly.
+
+[ $MACHINE = $(uname -m) ] || skip
+
+CLANG="${TEST_CLANG:-clang}"
+$CLANG --version >& /dev/null || skip
+echo 'int main() {}' | $CLANG -B. -flto -o /dev/null -xc - >& /dev/null || skip
+
+cat <<'EOF' > $t/a.ll
+$mix = comdat any
+@mix_lto = global i32 1, comdat($mix)
+EOF
+
+cat <<'EOF' > $t/b.s
+.globl keep_me
+.section .text.keep_me,"axG",@progbits,mix,comdat
+keep_me:
+  ret
+
+.text
+.globl main
+main:
+  call keep_me
+  xor %eax, %eax
+  ret
+EOF
+
+$CLANG -S -emit-llvm -flto -o $t/a.bc $t/a.ll
+$CC -o $t/b.o -c -x assembler $t/b.s
+$CLANG -B. -o $t/exe -flto $t/a.bc $t/b.o
+
+$QEMU $t/exe
@@ -44,7 +44,7 @@ str2:
  .ascii "mnopqr\n\0"
 EOF

-$CC -B. -static -o $t/exe $t/a.o
+$CC -B. -static -no-pie -o $t/exe $t/a.o

 $QEMU $t/exe | grep '^abcdef$'
 $QEMU $t/exe | grep '^bcdef$'
@@ -26,7 +26,7 @@ foo:
  .string "foo world\n"
 EOF

-$CC -B. -static -o $t/exe $t/a.o
+$CC -B. -static -no-pie -o $t/exe $t/a.o
 $QEMU $t/exe | grep 'Hello world'

 readelf -sW $t/exe | grep -E '[0-9] foo$'
@@ -0,0 +1,167 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Verify that the .sframe section mold produces is not just well-formed but
+# actually usable for stack unwinding. We link a program that, using only
+# its own merged .sframe (read via libsframe), walks a known call chain and
+# checks that each recovered frame maps to the expected function.
+
+# Skip unless the assembler emits SFrame Version 3.
+cat <<EOF | $CC -Wa,--gsframe -o $t/probe.o -c -xc - 2>/dev/null || skip
+int main() { return 0; }
+EOF
+readelf --sframe=.sframe $t/probe.o 2>/dev/null | grep -q SFRAME_VERSION_3 || skip
+
+# Skip unless libsframe and its header are available.
+echo 'int main(){return 0;}' | \
+  $CC -o $t/probe -xc - -lsframe -include sframe-api.h 2>/dev/null || skip
+
+cat <<'EOF' | $CC -O0 -g -fno-omit-frame-pointer -Wa,--gsframe -B. -o $t/exe -xc - -lsframe
+#define _GNU_SOURCE
+#include <sframe-api.h>
+#include <link.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#ifndef PT_GNU_SFRAME
+#define PT_GNU_SFRAME 0x6474e554
+#endif
+
+static uintptr_t sec_addr;
+static size_t sec_size;
+
+static int find_cb(struct dl_phdr_info *info, size_t sz, void *u) {
+  (void)sz; (void)u;
+  for (int i = 0; i < info->dlpi_phnum; i++) {
+    const ElfW(Phdr) *p = &info->dlpi_phdr[i];
+    if (p->p_type == PT_GNU_SFRAME) {
+      sec_addr = info->dlpi_addr + p->p_vaddr;
+      sec_size = p->p_memsz;
+      return 1;
+    }
+  }
+  return 0;
+}
+
+static sframe_decoder_ctx *dctx;
+static int32_t fixed_ra;
+
+#define MAXF 4096
+static uintptr_t fstart[MAXF], fend[MAXF];
+static int nfde;
+
+static int find_fde(uintptr_t pc) {
+  for (int i = 0; i < nfde; i++)
+    if (fstart[i] <= pc && pc < fend[i])
+      return i;
+  return -1;
+}
+
+// One SFrame unwind step per loop iteration; records the start address of
+// the function each frame belongs to.
+static int unwind(uintptr_t pc, uintptr_t sp, uintptr_t fp,
+                  uintptr_t *out, int max) {
+  int n = 0;
+  while (n < max) {
+    int idx = find_fde(pc);
+    if (idx < 0)
+      break;
+    out[n++] = fstart[idx];
+
+    uint32_t num_fres, func_size;
+    int64_t spo;
+    unsigned char fi, fi2;
+    uint8_t rep;
+    if (sframe_decoder_get_funcdesc_v3(dctx, idx, &num_fres, &func_size,
+                                       &spo, &fi, &fi2, &rep))
+      break;
+    uint32_t fde_type = SFRAME_V3_FDE_TYPE(fi2);
+
+    int64_t off = pc - fstart[idx];
+    sframe_frame_row_entry fre, cur;
+    int have = 0;
+    for (uint32_t k = 0; k < num_fres; k++) {
+      if (sframe_decoder_get_fre(dctx, idx, k, &cur))
+        break;
+      if ((int64_t)cur.fre_start_addr <= off) { fre = cur; have = 1; }
+      else break;
+    }
+    if (!have)
+      break;
+
+    int e = 0;
+    int base = sframe_fre_get_base_reg_id(&fre, &e);
+    int32_t cfa_off = sframe_fre_get_cfa_offset(dctx, &fre, fde_type, &e);
+    uintptr_t cfa = (base == SFRAME_BASE_REG_SP ? sp : fp) + cfa_off;
+    uintptr_t ra = *(uintptr_t *)(cfa + fixed_ra);
+
+    e = 0;
+    int32_t fp_off = sframe_fre_get_fp_offset(dctx, &fre, fde_type, &e);
+    uintptr_t next_fp = (e == 0) ? *(uintptr_t *)(cfa + fp_off) : fp;
+
+    if (!ra)
+      break;
+    sp = cfa;
+    fp = next_fp;
+    pc = ra;
+  }
+  return n;
+}
+
+static uintptr_t chain[16];
+static int chain_n;
+
+__attribute__((noinline)) static int level3(int x) {
+  uintptr_t pc, sp, fp;
+  asm volatile("leaq 1f(%%rip), %0\n1:\n\t"
+               "movq %%rsp, %1\n\t"
+               "movq %%rbp, %2"
+               : "=r"(pc), "=r"(sp), "=r"(fp));
+  chain_n = unwind(pc, sp, fp, chain, 16);
+  return x + 1;
+}
+
+__attribute__((noinline)) static int level2(int x) { return level3(x) + x; }
+__attribute__((noinline)) static int level1(int x) { return level2(x) + x; }
+
+int main(void) {
+  if (!dl_iterate_phdr(find_cb, NULL) || !sec_addr)
+    return 1;
+
+  int err = 0;
+  dctx = sframe_decode((const char *)sec_addr, sec_size, &err);
+  if (!dctx)
+    return 1;
+  fixed_ra = sframe_decoder_get_fixed_ra_offset(dctx);
+
+  uint32_t num = sframe_decoder_get_num_fidx(dctx);
+  for (uint32_t i = 0; i < num && nfde < MAXF; i++) {
+    uint32_t num_fres, func_size;
+    int64_t spo;
+    unsigned char fi, fi2;
+    uint8_t rep;
+    if (sframe_decoder_get_funcdesc_v3(dctx, i, &num_fres, &func_size,
+                                       &spo, &fi, &fi2, &rep))
+      continue;
+    int e = 0;
+    uint32_t fo = sframe_decoder_get_offsetof_fde_start_addr(dctx, i, &e);
+    fstart[nfde] = sec_addr + fo + spo; // PCREL: relative to the field
+    fend[nfde] = fstart[nfde] + func_size;
+    nfde++;
+  }
+
+  level1(0);
+
+  uintptr_t want[] = { (uintptr_t)&level3, (uintptr_t)&level2,
+                       (uintptr_t)&level1, (uintptr_t)&main };
+  int n = sizeof(want) / sizeof(want[0]);
+  if (chain_n < n)
+    return 1;
+  for (int i = 0; i < n; i++)
+    if (chain[i] != want[i])
+      return 1;
+  return 0;
+}
+EOF
+
+$QEMU $t/exe