Bump mold version to 1.7.1

This reverts commit e228abfd5a because
it makes the linker to produce different executables with the same
build-id.

Fixes https://github.com/rui314/mold/issues/872

.cargo/config.toml

@@ -1,7 +0,0 @@
-# rustc's LoongArch targets use the medium code model, but the cc crate
-# compiles C code with the C compiler's default normal code model, whose
-# direct calls reach only ±128 MiB, unless -Ccode-model is given
-# explicitly. A debug build of mold has more text than that, so we pass
-# the model explicitly to make the cc crate pass -mcmodel=medium.
-[target.'cfg(target_arch = "loongarch64")']
-rustflags = ["-Ccode-model=medium"]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,10 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Delete this message and describe the bug here. Note that we only fix bugs in the most recent release of mold, so please make sure that you are using the most recent version.

.github/workflows/build-all.yml

@@ -1,86 +0,0 @@
-name: Build all tarballs
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  check-changes:
-    runs-on: ubuntu-24.04
-    outputs:
-      has_changes: ${{ github.event_name == 'workflow_dispatch' || steps.check.outputs.has_changes }}
-    steps:
-    - name: Check for new commits since last successful run
-      id: check
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        last=$(gh run list -R ${{ github.repository }} -w build-all.yml -b main -s success -L1 --json createdAt -q '.[0].createdAt')
-        if [ -z "$last" ] || [ "$last" = "null" ] || [ "$(gh api repos/${{ github.repository }}/commits?sha=main\&since=$last\&per_page=1 | jq length)" -gt 0 ]; then
-          echo "has_changes=true" >> "$GITHUB_OUTPUT"
-        fi
-
-  build-linux:
-    needs: check-changes
-    if: needs.check-changes.outputs.has_changes == 'true'
-    strategy:
-      matrix:
-        include:
-          - { target: x86_64,      os: ubuntu-24.04 }
-          - { target: aarch64,     os: ubuntu-24.04-arm }
-          - { target: arm,         os: ubuntu-24.04-arm }
-          - { target: riscv64,     os: ubuntu-24.04 }
-          - { target: ppc64le,     os: ubuntu-24.04 }
-          - { target: s390x,       os: ubuntu-24.04 }
-          - { target: loongarch64, os: ubuntu-24.04 }
-
-    runs-on: ${{ matrix.os }}
-
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@v7
-
-    - name: Install Podman
-      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
-
-    - name: Login to GitHub Container Registry
-      uses: redhat-actions/podman-login@v2
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Build a tarball
-      run: ./dist.sh ${{ matrix.target }}
-
-    - name: Upload artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: ${{ matrix.target }}
-        path: dist/mold-*.tar.gz
-        compression-level: 0
-
-  build-windows:
-    needs: check-changes
-    if: needs.check-changes.outputs.has_changes == 'true'
-    runs-on: windows-latest
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@v7
-
-    - uses: dtolnay/rust-toolchain@stable
-
-    - name: Build and Archive
-      shell: pwsh
-      run: ./.github/workflows/build-windows.ps1
-
-    - name: Upload artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: win-x86_64
-        path: dist/mold-*.*

.github/workflows/build-native.yml

@@ -1,44 +0,0 @@
-name: Build native tarballs
-
-on:
-  push:
-  workflow_dispatch:
-
-jobs:
-  build-tarballs:
-    strategy:
-      matrix:
-        include:
-          - { target: x86_64,  os: ubuntu-24.04 }
-          - { target: aarch64, os: ubuntu-24.04-arm }
-          - { target: arm,     os: ubuntu-24.04-arm }
-
-    runs-on: ${{ matrix.os }}
-
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@v7
-
-    - name: Install Podman
-      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
-
-    - name: Login to GitHub Container Registry
-      uses: redhat-actions/podman-login@v2
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Build a tarball
-      run: ./dist.sh ${{ matrix.target }}
-
-    - name: Upload artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: ${{ matrix.target }}
-        path: dist/mold-*.tar.gz
-        compression-level: 0

.github/workflows/build-windows.ps1

@@ -1,16 +0,0 @@
-$ErrorActionPreference = 'Stop'
-Set-Location "$PSScriptRoot/../.."
-
-cargo build --release --locked --package mold-cli
-if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-$metadata = cargo metadata --locked --no-deps --format-version 1 | ConvertFrom-Json
-if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-$version = ($metadata.packages | Where-Object name -eq 'mold-cli').version
-
-$stage = 'mold-install'
-New-Item -ItemType Directory -Force "$stage/bin", "$stage/share/man/man1", "$stage/share/doc/mold", dist | Out-Null
-Copy-Item target/release/mold.exe "$stage/bin/"
-Copy-Item docs/mold.1 "$stage/share/man/man1/"
-Copy-Item LICENSE "$stage/share/doc/mold/"
-Compress-Archive -Path "$stage/*" -DestinationPath "dist/mold-$version-x86_64-windows.zip" -Force

.github/workflows/ci.yml

@@ -1,192 +1,125 @@
 name: CI
-
 on:
   push:
+    branches: [ main ]
   pull_request:
-
+    branches: [ main ]
+env:
+  UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
+  MOLD_SUPPRESS_MACHO_WARNING: 1
 jobs:
-  test-all-targets:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      # Incremental artifacts and mold's own debug info are unused in CI.
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-    steps:
-    - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@stable
-    - name: install test dependencies
-      run: |
-        sudo ./install-test-deps.sh
-        sudo .github/workflows/install-extras.sh
-    - run: cargo build --locked
-    - name: check the build for 32-bit hosts
-      run: |
-        rustup target add armv7-unknown-linux-gnueabihf i686-unknown-linux-gnu \
-          powerpc-unknown-linux-gnu
-        cargo check --locked --workspace --all-targets --target armv7-unknown-linux-gnueabihf
-        # i386 aligns 64-bit integers to 4 bytes
-        cargo check --locked --workspace --all-targets --target i686-unknown-linux-gnu
-        # 32-bit PowerPC has no 64-bit atomics
-        cargo check --locked --workspace --all-targets --target powerpc-unknown-linux-gnu
-    - name: verify all target toolchains are available
-      run: |
-        cargo test --locked -p mold-cli --test integration -- --list |
-          tee "$RUNNER_TEMP/test-inventory.txt"
-        ! grep -q '^unavailable:' "$RUNNER_TEMP/test-inventory.txt"
-    # All workspace crates were built above. Avoid linking empty test binaries
-    # for the target crates and command.
-    - run: cargo test --locked -p mold -p mold-tests -p mold-cli --lib --test integration
-    - name: archive test results
-      uses: actions/upload-artifact@v7
-      if: failure()
-      with:
-        name: test-results-all-targets
-        path: target/debug/mold-test/out/test
-
-  test-sanitizers:
+  build-clang:
     strategy:
       matrix:
-        include:
-        - sanitizer: address
-          # Input files intentionally remain allocated until process exit.
-          runtime-options: detect_leaks=0:halt_on_error=1
-          test-prefix: ''
-          test-timeout: 30
-        - sanitizer: thread
-          runtime-options: halt_on_error=1
-          # TSan cannot model the atomic-fence synchronization in Rayon's
-          # work-stealing queue. Two CPUs still exercise parallel linker code.
-          test-prefix: taskset -c 0,1
-          test-timeout: 60
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    env:
-      CARGO_TARGET_DIR: target/${{ matrix.sanitizer }}
-      RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
-      RUSTDOCFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
+        target:
+        # Disable PCH for the default configuration. This prevents relying on implicit includes.
+        - '-DCMAKE_DISABLE_PRECOMPILE_HEADERS=On'
+        - '-DMOLD_USE_ASAN=On'
+        - '-DMOLD_USE_TSAN=On'
+    runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@nightly
-      with:
-        components: rust-src
-    - run: sudo ./install-test-deps.sh
-    - run: cargo +nightly build --locked -Zbuild-std --target x86_64-unknown-linux-gnu -p mold-cli --no-default-features --features system-allocator,x86_64
-    - run: |
-        if [ '${{ matrix.sanitizer }}' = address ]; then
-          export ASAN_OPTIONS='${{ matrix.runtime-options }}'
-        else
-          export TSAN_OPTIONS='${{ matrix.runtime-options }}'
-        fi
-        ${{ matrix.test-prefix }} cargo +nightly test --locked -Zbuild-std --target x86_64-unknown-linux-gnu -p mold-cli --no-default-features --features system-allocator,x86_64 --test integration -- --native --test-threads 1 --timeout ${{ matrix.test-timeout }}
-    - name: archive test results
-      uses: actions/upload-artifact@v7
-      if: failure()
-      with:
-        name: test-results-${{ matrix.sanitizer }}
-        path: target/${{ matrix.sanitizer }}/x86_64-unknown-linux-gnu/debug/mold-test/out/test
+    - uses: actions/checkout@v3
+    - uses: rui314/setup-mold@staging
+    - name: install-build-deps
+      run: sudo ./install-build-deps.sh update
+    - name: ccache
+      uses: hendrikmuhs/ccache-action@v1
+    - name: build and test
+      run: |
+        echo "/usr/lib/ccache:/usr/local/opt/ccache/libexec" >> $GITHUB_PATH
+        mkdir build
+        cd build
+        cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ${{ matrix.target }} ..
+        cmake --build . -j$(nproc)
+        ctest . -j$(nproc)
 
-  build-msan:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
+  build-gcc:
+    runs-on: ubuntu-20.04
+    container: gcc:11.1.0
     steps:
-    - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@nightly
-      with:
-        components: rust-src
-    - run: sudo ./install-test-deps.sh
-    - run: sudo apt-get install -y clang llvm
-    - run: .github/workflows/run-msan.sh
-    - name: archive test results
-      uses: actions/upload-artifact@v7
-      if: failure()
-      with:
-        name: test-results-msan
-        path: target/msan/x86_64-unknown-linux-gnu/debug/mold-test/out/test
+    - uses: actions/checkout@v3
+    - name: install-build-deps
+      run: |
+        # Install cross toolchains
+        dpkg --add-architecture i386
+        ./install-build-deps.sh update
+        apt-get install -y sudo qemu-user gdb zstd dwarfdump gcc-10-i686-linux-gnu gcc-10-aarch64-linux-gnu gcc-10-riscv64-linux-gnu gcc-10-arm-linux-gnueabihf gcc-10-powerpc64-linux-gnu gcc-10-powerpc64le-linux-gnu gcc-10-s390x-linux-gnu gcc-10-sparc64-linux-gnu gcc-10-m68k-linux-gnu g++-10-i686-linux-gnu g++-10-aarch64-linux-gnu g++-10-riscv64-linux-gnu g++-10-arm-linux-gnueabihf g++-10-powerpc64-linux-gnu g++-10-powerpc64le-linux-gnu g++-10-s390x-linux-gnu g++-10-sparc64-linux-gnu g++-10-m68k-linux-gnu
+        ln -sf /usr/bin/i686-linux-gnu-gcc-10 /usr/bin/i686-linux-gnu-gcc
+        ln -sf /usr/bin/i686-linux-gnu-g++-10 /usr/bin/i686-linux-gnu-g++
+        ln -sf /usr/bin/aarch64-linux-gnu-gcc-10 /usr/bin/aarch64-linux-gnu-gcc
+        ln -sf /usr/bin/aarch64-linux-gnu-g++-10 /usr/bin/aarch64-linux-gnu-g++
+        ln -sf /usr/bin/arm-linux-gnueabihf-gcc-10 /usr/bin/arm-linux-gnueabihf-gcc
+        ln -sf /usr/bin/arm-linux-gnueabihf-g++-10 /usr/bin/arm-linux-gnueabihf-g++
+        ln -sf /usr/bin/riscv64-linux-gnu-gcc-10 /usr/bin/riscv64-linux-gnu-gcc
+        ln -sf /usr/bin/riscv64-linux-gnu-g++-10 /usr/bin/riscv64-linux-gnu-g++
+        ln -sf /usr/bin/powerpc64-linux-gnu-gcc-10 /usr/bin/powerpc64-linux-gnu-gcc
+        ln -sf /usr/bin/powerpc64-linux-gnu-g++-10 /usr/bin/powerpc64-linux-gnu-g++
+        ln -sf /usr/bin/powerpc64le-linux-gnu-gcc-10 /usr/bin/powerpc64le-linux-gnu-gcc
+        ln -sf /usr/bin/powerpc64le-linux-gnu-g++-10 /usr/bin/powerpc64le-linux-gnu-g++
+        ln -sf /usr/bin/s390x-linux-gnu-gcc-10 /usr/bin/s390x-linux-gnu-gcc
+        ln -sf /usr/bin/s390x-linux-gnu-g++-10 /usr/bin/s390x-linux-gnu-g++
+        ln -sf /usr/bin/sparc64-linux-gnu-gcc-10 /usr/bin/sparc64-linux-gnu-gcc
+        ln -sf /usr/bin/sparc64-linux-gnu-g++-10 /usr/bin/sparc64-linux-gnu-g++
+        ln -sf /usr/bin/m68k-linux-gnu-gcc-10 /usr/bin/m68k-linux-gnu-gcc
+        ln -sf /usr/bin/m68k-linux-gnu-g++-10 /usr/bin/m68k-linux-gnu-g++
 
-  test-distros:
-    strategy:
-      matrix:
-        distro:
-        - alpine
-        - archlinux
-        - debian:12
-        - fedora
-        - gentoo/stage3
-        - opensuse/tumbleweed
-        - ubuntu:22.04
-        - ubuntu:25.04
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    # Tumbleweed does not declare PATH in its container configuration.
-    container:
-      image: ${{ matrix.distro }}
-      env:
-        PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-    steps:
-    - uses: actions/checkout@v6
-    - run: ./install-test-deps.sh
-    - uses: dtolnay/rust-toolchain@stable
-    - run: cargo build --locked -p mold-cli --no-default-features --features x86_64
-    - run: cargo test --locked -p mold-cli --no-default-features --features x86_64 --test integration -- --native
-    - name: sanitize distro name
-      if: failure()
-      id: sanitize
-      run: echo "name=$(echo '${{ matrix.distro }}' | tr '/:' '--')" >> "$GITHUB_OUTPUT"
+        # Install a RV32 toolchain from third party since it's not available
+        # as an Ubuntu package.
+        mkdir /usr/local/rv32
+        wget -O- -q https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2022.08.26/riscv32-glibc-ubuntu-20.04-nightly-2022.08.26-nightly.tar.gz | tar -C /usr/local/rv32 --strip-components=1 -xzf -
+
+        ln -sf /usr/local/rv32/sysroot /usr/riscv32-linux-gnu
+        ln -sf /usr/local/rv32/bin/riscv32-unknown-linux-gnu-objdump /usr/bin/riscv32-linux-gnu-objdump
+        echo '/usr/local/rv32/bin/riscv32-unknown-linux-gnu-gcc -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-gcc
+        echo '/usr/local/rv32/bin/riscv32-unknown-linux-gnu-g++ -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-g++
+        chmod 755 /usr/bin/riscv32-linux-gnu-gcc /usr/bin/riscv32-linux-gnu-g++
+    - name: ccache
+      uses: hendrikmuhs/ccache-action@v1
+    - name: build and test
+      run: |
+        echo "/usr/lib/ccache:/usr/local/opt/ccache/libexec" >> $GITHUB_PATH
+        mkdir build
+        cd build
+        cmake -DMOLD_ENABLE_QEMU_TESTS=On -DMOLD_ENABLE_QEMU_TESTS_RV32=On ..
+        cmake --build . -j$(nproc)
+        ctest . -j$(nproc)
     - name: archive test results
-      uses: actions/upload-artifact@v7
-      if: failure()
+      uses: actions/upload-artifact@v3
+      if: always()
       with:
-        name: test-results-${{ steps.sanitize.outputs.name }}
-        path: target/debug/mold-test/out/test
+        name: test-results
+        path: |
+          build/out
+          build/Testing
 
   build-macos:
-    runs-on: macos-latest
-    timeout-minutes: 60
+    runs-on: macos-11
+    strategy:
+      matrix:
+        target:
+        # Disable PCH for the default configuration. This prevents relying on implicit includes.
+        - '-DCMAKE_DISABLE_PRECOMPILE_HEADERS=On'
+        - '-DMOLD_USE_ASAN=On'
     steps:
-    - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@stable
-    - run: cargo build --locked -p mold-cli --no-default-features --features x86_64
+    - uses: actions/checkout@v3
+    - name: ccache
+      uses: hendrikmuhs/ccache-action@v1
+    - name: build and test
+      run: |
+        echo "/usr/lib/ccache:/usr/local/opt/ccache/libexec" >> $GITHUB_PATH
+        mkdir build
+        cd build
+        cmake ${{ matrix.target }} ..
+        cmake --build . -j$(sysctl -n hw.physicalcpu)
+        ctest . -j$(sysctl -n hw.physicalcpu)
 
   build-windows:
     runs-on: windows-latest
-    timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@stable
-    - run: cargo build --locked -p mold-cli --no-default-features --features x86_64
-
-  build-msys:
-    runs-on: windows-latest
-    timeout-minutes: 60
-    env:
-      CARGO_NET_GIT_FETCH_WITH_CLI: true
-    steps:
-    - uses: actions/checkout@v6
-    - uses: msys2/setup-msys2@v2
-      with:
-        msystem: UCRT64
-        update: true
-        install: git
-        pacboy: rust:p cc:p dlfcn:p
-    - shell: msys2 {0}
-      run: cargo build --locked -p mold-cli --no-default-features --features x86_64
-
-  build-freebsd:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    env:
-      # The VM has little disk space, so omit unused build artifacts.
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-    steps:
-    - uses: actions/checkout@v6
-    - uses: vmactions/freebsd-vm@v1
-      with:
-        usesh: true
-        run: |
-          pkg install -y rust
-          ./install-test-deps.sh
-          cargo build --locked -p mold-cli --no-default-features --features x86_64
-          cargo test --locked -p mold-cli --no-default-features --features x86_64 --test integration -- --native
+    - uses: actions/checkout@v3
+    - name: build
+      run: |
+        mkdir build
+        cd build
+        cmake -T clangcl ..
+        cmake --build . -j $Env:NUMBER_OF_PROCESSORS

.github/workflows/install-extras.sh

@@ -1,75 +0,0 @@
-#!/bin/bash -x
-
-apt-get update
-apt-get install -y wget xz-utils
-
-# Install a 32-bit RISC-V toolchain
-mkdir /rv32
-wget -O- --progress=dot:mega https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2025.06.13/riscv32-glibc-ubuntu-24.04-gcc-nightly-2025.06.13-nightly.tar.xz | tar -C /rv32 --strip-components=1 --xz -xf -
-
-ln -sf /rv32/sysroot /usr/riscv32-linux-gnu
-echo '/rv32/bin/riscv32-unknown-linux-gnu-gcc -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-gcc
-echo '/rv32/bin/riscv32-unknown-linux-gnu-g++ -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-g++
-chmod 755 /usr/bin/riscv32-linux-gnu-{gcc,g++}
-
-for i in objdump objcopy strip; do
-  ln -sf /rv32/bin/riscv32-unknown-linux-gnu-$i /usr/bin/riscv32-linux-gnu-$i
-done
-
-# Install a LoongArch toolchain
-mkdir /larch
-wget -O- --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/x86_64-cross-tools-loongarch64-binutils_2.44-gcc_15.1.0-glibc_2.41.tar.xz | tar -C /larch --strip-components=1 --xz -xf -
-
-cp -r /larch/loongarch64-unknown-linux-gnu/lib/* /larch/target/lib64
-ln -sf /larch/target /usr/loongarch64-linux-gnu
-
-for i in gcc g++ objdump objcopy strip; do
-  ln -sf /larch/bin/loongarch64-unknown-linux-gnu-$i /usr/bin/loongarch64-linux-gnu-$i
-done
-
-wget -O /usr/local/bin/qemu-loongarch64 --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/qemu-loongarch64
-chmod 755 /usr/local/bin/qemu-loongarch64
-
-# Install ARM32 big-endian toolchain
-mkdir /armeb
-wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/armebv7-eabihf/tarballs/armebv7-eabihf--glibc--stable-2024.05-1.tar.xz | tar -C /armeb --strip-components=1 --xz -xf -
-
-ln -sf /armeb/armeb-buildroot-linux-gnueabihf/sysroot /usr/armeb-linux-gnueabihf
-echo '/armeb/bin/armeb-linux-gcc -L/usr/armeb-linux-gnu "$@"' > /usr/bin/armeb-linux-gnueabihf-gcc
-echo '/armeb/bin/armeb-linux-g++ -L/usr/armeb-linux-gnu "$@"' > /usr/bin/armeb-linux-gnueabihf-g++
-chmod 755 /usr/bin/armeb-linux-gnueabihf-{gcc,g++}
-
-for i in objdump objcopy strip; do
-  ln -sf /armeb/bin/armeb-linux-$i /usr/bin/armeb-linux-gnueabihf-$i
-done
-
-# Install ARM64 big-endian toolchain
-mkdir /aarch64be
-wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64be/tarballs/aarch64be--glibc--stable-2024.05-1.tar.xz | tar -C /aarch64be --strip-components=1 --xz -xf -
-
-ln -sf /aarch64be/aarch64_be-buildroot-linux-gnu/sysroot /usr/aarch64_be-linux-gnu
-echo '/aarch64be/bin/aarch64_be-linux-gcc -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-gcc
-echo '/aarch64be/bin/aarch64_be-linux-g++ -L/usr/aarch64_be-linux-gnu "$@"' > /usr/bin/aarch64_be-linux-gnu-g++
-chmod 755 /usr/bin/aarch64_be-linux-gnu-{gcc,g++}
-
-for i in objdump objcopy strip; do
-  ln -sf /aarch64be/bin/aarch64_be-linux-$i /usr/bin/aarch64_be-linux-gnu-$i
-done
-
-# Install SH4 big-endian toolchain
-mkdir /sh4aeb
-wget -O- --progress=dot:mega https://toolchains.bootlin.com/downloads/releases/toolchains/sh-sh4aeb/tarballs/sh-sh4aeb--glibc--stable-2024.05-1.tar.xz | tar -C /sh4aeb --strip-components=1 --xz -xf -
-
-ln -sf /sh4aeb/sh4aeb-buildroot-linux-gnu/sysroot /usr/sh4aeb-linux-gnu
-echo '/sh4aeb/bin/sh4aeb-linux-gcc -L/usr/sh4aeb-linux-gnu "$@"' > /usr/bin/sh4aeb-linux-gnu-gcc
-echo '/sh4aeb/bin/sh4aeb-linux-g++ -L/usr/sh4aeb-linux-gnu "$@"' > /usr/bin/sh4aeb-linux-gnu-g++
-chmod 755 /usr/bin/sh4aeb-linux-gnu-{gcc,g++}
-
-for i in objdump objcopy strip; do
-  ln -sf /sh4aeb/bin/sh4aeb-linux-$i /usr/bin/sh4aeb-linux-gnu-$i
-done
-
-# Install Intel SDE CPU emulator for CET-related tests
-mkdir /sde
-wget -O- --progress=dot:mega https://downloadmirror.intel.com/850782/sde-external-9.53.0-2025-03-16-lin.tar.xz | tar -C /sde --strip-components=1 --xz -xf -
-ln -s /sde/sde64 /usr/bin

.github/workflows/release-assets.yml

@@ -1,97 +0,0 @@
-name: Build & attach tarballs on tag push
-
-on:
-  push:
-    tags: ['v[0-9]*']
-
-permissions:
-  contents: write
-  packages: write
-  id-token: write
-
-env:
-  TAG: ${{ github.ref_name }}
-
-jobs:
-  build-linux:
-    strategy:
-      matrix:
-        include:
-        - { target: x86_64,      os: ubuntu-24.04 }
-        - { target: aarch64,     os: ubuntu-24.04-arm }
-        - { target: arm,         os: ubuntu-24.04-arm }
-        - { target: riscv64,     os: ubuntu-24.04 }
-        - { target: ppc64le,     os: ubuntu-24.04 }
-        - { target: s390x,       os: ubuntu-24.04 }
-        - { target: loongarch64, os: ubuntu-24.04 }
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-    - uses: actions/checkout@v7
-
-    - name: Install Podman
-      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
-
-    - name: Login to GitHub Container Registry
-      uses: redhat-actions/podman-login@v2
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - run: ./dist.sh ${{ matrix.target }}
-
-    - uses: actions/upload-artifact@v7
-      with:
-        name: ${{ matrix.target }}
-        path: dist/mold-*.tar.gz
-
-  build-windows:
-    runs-on: windows-latest
-    steps:
-    - uses: actions/checkout@v7
-
-    - uses: dtolnay/rust-toolchain@stable
-
-    - name: Build and Archive
-      shell: pwsh
-      run: ./.github/workflows/build-windows.ps1
-
-    - uses: actions/upload-artifact@v7
-      with:
-        name: win-x86_64
-        path: dist/mold-*.*
-
-  publish:
-    needs: [build-linux, build-windows]
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v7
-
-    - uses: actions/download-artifact@v8
-      with:
-        path: dist
-        pattern: '*'
-        merge-multiple: true
-
-    - name: Ensure release exists (create if missing)
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        set -e
-        if gh release view "$TAG" >& /dev/null; then
-          echo "Existing release found for $TAG"
-        else
-          echo "Creating draft release for $TAG"
-          gh release create "$TAG" --draft \
-            --title "$TAG" \
-            --notes "Automated draft – fill the changelog later."
-        fi
-
-    - name: Upload tarballs
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh release upload "$TAG" dist/* --clobber
-        gh release view "$TAG" --json assets --jq '.assets[].name'

.github/workflows/run-msan.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-cd "$(dirname "$0")/../.."
-
-# MSan requires instrumented Rust, std, and native dependencies:
-# https://doc.rust-lang.org/unstable-book/compiler-flags/sanitizer.html#memorysanitizer
-export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-target/msan}"
-export RUSTFLAGS='-Zsanitizer=memory -Zsanitizer-memory-track-origins=2'
-export RUSTDOCFLAGS="$RUSTFLAGS"
-export CC_x86_64_unknown_linux_gnu=clang
-export CFLAGS_x86_64_unknown_linux_gnu='-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer'
-export LIBZ_SYS_STATIC=1
-export MSAN_OPTIONS=halt_on_error=1
-
-# The instrumented linker is too slow unoptimized for the heaviest tests
-# to finish within the per-test timeout.
-export CARGO_PROFILE_DEV_OPT_LEVEL=1
-
-# Use instrumentable implementations instead of BLAKE3/Zstd assembly, and
-# select mold as well as mold-cli so Cargo enables its dependency features.
-args=(
-  --locked -Zbuild-std --target x86_64-unknown-linux-gnu
-  --package mold --package mold-cli --no-default-features
-  --features mold-cli/system-allocator,mold-cli/x86_64,blake3/pure,zstd/no_asm
-  --test integration
-)
-cargo +nightly test "${args[@]}" --no-run
-
-# The preload wrapper runs inside uninstrumented compiler processes, not
-# inside mold. Rebuild it without MSan so those processes can load it.
-clang -shared -fPIC -o "$CARGO_TARGET_DIR/x86_64-unknown-linux-gnu/debug/mold-wrapper.so" \
-  c/mold-wrapper.c -ldl
-
-cargo +nightly test "${args[@]}" -- --native --test-threads 1 --timeout 60 "$@"

.github/workflows/update-manpage.yml

@@ -1,36 +0,0 @@
-name: Update manpage
-
-on:
-  push:
-    paths:
-      - 'docs/mold.md'
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  update-manpage:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v7
-
-    - name: Install ronn
-      run: sudo apt-get update && sudo apt-get install -y ronn
-
-    - name: Generate mold.1 from mold.md
-      run: ronn --roff docs/mold.md
-
-    - name: Configure Git
-      run: |
-        git config --global user.name 'Rui Ueyama'
-        git config --global user.email '[email protected]'
-
-    - name: Commit and push if mold.1 is updated
-      run: |
-        git add docs/mold.1
-        git diff --staged --quiet || (git commit -m "Update mold.1 (automated commit)" && git push)

.gitignore

@@ -1,6 +1,16 @@
-/target
-/dist
-/bench
-/.claude
-/.codex
+*.o
+*.so
 *~
+.cache
+compile_commands.json
+/mold
+/test/tmp
+options.inc
+core
+ld
+ld64
+ld64.mold
+gentoo
+out
+/mold-*.tar.gz
+/build*

CMakeLists.txt

@@ -0,0 +1,407 @@
+# You can customize a build by specifying CMake options. An option may be
+# given in the -Dvariable=value form. For a boolean variable, `ON` or `1`
+# means true while `OFF` or `0` means false.
+#
+# Here are a couple of common cmake options:
+#
+#  -DCMAKE_C_COMPILER=<command-name>
+#
+#   Specifies a C compiler name to use. The default value is `cc`.
+#
+#  -DCMAKE_CXX_COMPILER=<command-name>
+#
+#   Specifies a C++ compiler name to use. The default value is `c++`.
+#
+#  -DCMAKE_INSTALL_PREFIX=<directory>
+#
+#   Specifies an install target directory. The default value is `/usr/local`.
+#
+#  -DCMAKE_BUILD_TYPE=[Debug | Release | RelWithDebInfo | MinSizeRel]
+#
+#   Specifies a build type. The default is `Release` which is the right
+#   option unless you are debugging mold.
+#
+# An example of a cmake command line is shown below:
+#
+#   $ cmake -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_CXX_COMPILER=g++-12 ..
+#
+# where `..` refers this directory.
+#
+# With cmake, you may run `cmake --install .` instead of `make install` to
+# install build artifacts to system directories. If you want to install
+# artifacts to a temporary target directory, run `cmake --install . --prefix
+# <dir>`.
+#
+# You can see the current cmake variables and their values by running
+# `cmake -N -L .` in a build directory.
+#
+# Note that in this file, we provide various dials and knobs to configure
+# how to build mold. However, as a policy, we do not provide a way to
+# enable/disable any individual mold's feature. In other words, we do not
+# provide options like `--enable-foo` or `--disable-foo`. The motivation
+# behind it is build reproducibility. We want to guarantees that all builds
+# of the mold linker of the same version will have the exactly same set of
+# features and behave exactly the same.
+
+cmake_minimum_required(VERSION 3.13)
+project(mold VERSION 1.7.1)
+
+include(CMakeDependentOption)
+include(GNUInstallDirs)
+
+# Build mold itself using mold if -DMOLD_USE_MOLD=ON
+option(MOLD_USE_MOLD "Use mold to build mold" OFF)
+if(MOLD_USE_MOLD)
+  add_link_options(-fuse-ld=mold)
+endif()
+
+add_executable(mold)
+target_compile_features(mold PRIVATE cxx_std_20)
+target_link_libraries(mold PRIVATE ${CMAKE_DL_LIBS})
+
+if(NOT "${CMAKE_CXX_COMPILER_FRONTEND_VARIANT}" STREQUAL "MSVC")
+  target_compile_options(mold PRIVATE
+    -fno-exceptions
+    -fno-unwind-tables
+    -fno-asynchronous-unwind-tables
+    -Wno-sign-compare
+    -Wno-unused-function)
+endif()
+
+# Build mold with -flto if -DMOLD_LTO=ON
+option(MOLD_LTO "Build mold with link-time optimization enabled")
+if(MOLD_LTO)
+  set_property(TARGET mold PROPERTY INTERPROCEDURAL_OPTIMIZATION ON)
+endif()
+
+# Enable AddressSanitizer if -DMOLD_USE_ASAN=ON
+option(MOLD_USE_ASAN "Build mold with AddressSanitizer" OFF)
+if(MOLD_USE_ASAN)
+  target_compile_options(mold PRIVATE -fsanitize=address -fsanitize=undefined)
+  target_link_options(mold PRIVATE -fsanitize=address -fsanitize=undefined)
+endif()
+
+# Enabled ThreadSanitizer if -DMOLD_USE_TSAN=ON
+option(MOLD_USE_TSAN "Build mold with ThreadSanitizer" OFF)
+if(MOLD_USE_TSAN)
+  target_compile_options(mold PRIVATE -fsanitize=thread)
+  target_link_options(mold PRIVATE -fsanitize=thread)
+endif()
+
+# Statically-link libstdc++ and libcrypto if -DMOLD_MOSTLY_STATIC=ON.
+#
+# This option is intended to be used by `./dist.sh` script to create a
+# mold binary that works on various Linux distros. You probably don't
+# need nor want to set this to ON.
+option(MOLD_MOSTLY_STATIC "Statically link libstdc++ and libcrypto" OFF)
+if(MOLD_MOSTLY_STATIC)
+  target_link_options(mold PRIVATE -static-libstdc++)
+  target_link_libraries(mold PRIVATE libcrypto.a)
+endif()
+
+# Find zlib. If libz.so is not found, we compile a bundled one and
+# statically-link it to mold.
+find_package(ZLIB QUIET)
+if(ZLIB_FOUND)
+  target_link_libraries(mold PRIVATE ZLIB::ZLIB)
+else()
+  add_subdirectory(third-party/zlib EXCLUDE_FROM_ALL)
+  target_include_directories(zlibstatic INTERFACE third-party/zlib
+    $<TARGET_PROPERTY:zlibstatic,BINARY_DIR>)
+  target_link_libraries(mold PRIVATE zlibstatic)
+endif()
+
+# Find zstd compression library. Just like zlib, if libzstd.so is not
+# found, we compile a bundled one and statically-link it to mold.
+include(CheckIncludeFile)
+check_include_file(zstd.h HAVE_ZSTD_H)
+
+if(HAVE_ZSTD_H)
+  target_link_libraries(mold PRIVATE zstd)
+else()
+  add_subdirectory(third-party/zstd/build/cmake EXCLUDE_FROM_ALL)
+  target_compile_definitions(libzstd_static PRIVATE
+    ZSTD_BUILD_STATIC=1
+    ZSTD_BUILD_SHARED=0
+    ZSTD_BUILD_PROGRAMS=0
+    ZSTD_MULTITHREAD_SUPPORT=0
+    ZSTD_BUILD_TESTS=0)
+  target_include_directories(mold PUBLIC third-party/zstd/lib)
+  target_link_libraries(mold PRIVATE libzstd_static)
+endif()
+
+# Find mimalloc. mimalloc is an alternative malloc implementation
+# optimized for multi-threaded applications.
+#
+# If you want to use the usual libc's malloc, pass -DMOLD_USE_MIMALLOC=OFF.
+#
+# We enable mimalloc by default for 64-bit targets. It doesn't seem to
+# be stable on 32-bit targets.
+include(CheckCXXSourceCompiles)
+check_cxx_source_compiles(
+  "static_assert(sizeof(void *) == 4); int main() {}" P32)
+
+cmake_dependent_option(MOLD_USE_MIMALLOC "Use mimalloc" ON
+  "NOT APPLE; NOT ANDROID; NOT P32" OFF)
+cmake_dependent_option(
+  MOLD_USE_SYSTEM_MIMALLOC "Use system or vendored mimalloc" OFF
+  MOLD_USE_MIMALLOC OFF)
+
+# By default, we build a bundled mimalloc and statically-link it to
+# mold. If you want to dynamically link to the system's
+# libmimalloc.so, pass -DMOLD_USE_SYSTEM_MIMALLOC=ON.
+if(MOLD_USE_MIMALLOC)
+  if(MOLD_USE_SYSTEM_MIMALLOC)
+    find_package(mimalloc REQUIRED)
+    target_link_libraries(mold PRIVATE mimalloc)
+    target_compile_definitions(mold PRIVATE USE_SYSTEM_MIMALLOC)
+  else()
+    function(mold_add_mimalloc)
+      set(MI_BUILD_STATIC ON)
+      option(MI_BUILD_TESTS "Build test executables" OFF)
+      add_subdirectory(third-party/mimalloc EXCLUDE_FROM_ALL)
+      target_compile_definitions(mimalloc-static PRIVATE MI_USE_ENVIRON=0)
+      target_link_libraries(mold PRIVATE mimalloc-static)
+    endfunction()
+
+    mold_add_mimalloc()
+  endif()
+endif()
+
+# Find TBB. TBB (OneTBB or Intel TBB) is a high-level threading library.
+# Use of this library is mandatory.
+#
+# By default, we build a bundled one and statically-link the library
+# to mold. If you want to link to the system's libtbb2.so, pass
+# -DMOLD_USE_SYSTEM_TBB=ON.
+option(MOLD_USE_SYSTEM_TBB "Use system or vendored TBB" OFF)
+if(MOLD_USE_SYSTEM_TBB)
+  find_package(TBB REQUIRED)
+  target_link_libraries(mold PRIVATE TBB::tbb)
+else()
+  function(mold_add_tbb)
+    set(BUILD_SHARED_LIBS OFF)
+    set(TBB_TEST OFF CACHE INTERNAL "")
+    set(TBB_STRICT OFF CACHE INTERNAL "")
+    add_subdirectory(third-party/tbb EXCLUDE_FROM_ALL)
+    target_compile_definitions(tbb PRIVATE __TBB_DYNAMIC_LOAD_ENABLED=0)
+    target_link_libraries(mold PRIVATE TBB::tbb)
+  endfunction()
+
+  mold_add_tbb()
+endif()
+
+# We always use Clang to build mold on Windows. MSVC can't compile mold.
+if(WIN32)
+  if(NOT CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
+    message(FATAL_ERROR
+      "Your compiler is not supported; install Clang from Visual Studio Installer and re-run cmake with '-T clangcl'")
+  endif()
+
+  target_compile_definitions(mold PRIVATE NOGDI NOMINMAX)
+else()
+  include(CheckLibraryExists)
+  check_library_exists(m pow "" LIBM_FOUND)
+  if(LIBM_FOUND)
+    target_link_libraries(mold PRIVATE m)
+  endif()
+endif()
+
+# Build mold-wrapper.so
+if(NOT APPLE AND NOT WIN32)
+  add_library(mold-wrapper SHARED)
+  install(TARGETS mold-wrapper DESTINATION ${CMAKE_INSTALL_LIBDIR}/mold)
+
+  # Remove the default `lib` prefix
+  set_target_properties(mold-wrapper PROPERTIES PREFIX "")
+  target_link_libraries(mold-wrapper PRIVATE ${CMAKE_DL_LIBS})
+  target_sources(mold-wrapper PRIVATE elf/mold-wrapper.c)
+endif()
+
+if(NOT APPLE AND NOT WIN32 AND NOT MOLD_MOSTLY_STATIC)
+  find_package(OpenSSL REQUIRED COMPONENTS Crypto)
+  target_link_libraries(mold PRIVATE OpenSSL::Crypto)
+endif()
+
+# If atomics doesn't work by default, add -latomic.
+# We need the flag on riscv, armv6 and m68k.
+include(CheckCXXSourceCompiles)
+check_cxx_source_compiles("#include <cstdint>
+int main() {
+  uint64_t x = 1;
+  __atomic_add_fetch(&x, 0, __ATOMIC_RELAXED);
+  return x;
+}" HAVE_ATOMIC_ADD_FETCH)
+
+if(NOT HAVE_ATOMIC_ADD_FETCH)
+  target_link_libraries(mold PRIVATE atomic)
+endif()
+
+# Create a .cc file containing the current git hash for `mold --version`.
+add_custom_target(git_hash
+  COMMAND ${CMAKE_COMMAND}
+    -DSOURCE_DIR=${CMAKE_SOURCE_DIR}
+    -DOUTPUT_FILE=${CMAKE_BINARY_DIR}/git-hash.cc
+    -P ${CMAKE_SOURCE_DIR}/update-git-hash.cmake
+  DEPENDS update-git-hash.cmake
+  BYPRODUCTS git-hash.cc
+  VERBATIM)
+
+add_dependencies(mold git_hash)
+
+# Create config.h file
+configure_file(config.h.in config.h)
+include_directories(${CMAKE_CURRENT_BINARY_DIR})
+
+# Almost all functions are template in mold which take a target type
+# (e.g. X86_64) as its type parameter. Since we suport more than 10
+# targets, compiling a single source file for all the targets is very
+# slow.
+#
+# As a workaround, we create a .cc file for each target and spawn many
+# compiler instances. This is hacky but greatly reduces compile time
+# on a multicore machine.
+list(APPEND MOLD_ELF_TARGETS
+  X86_64 I386 ARM64 ARM32 RV32LE RV32BE RV64LE RV64BE
+  PPC64V1 PPC64V2 S390X SPARC64 M68K)
+
+list(APPEND MOLD_ELF_TEMPLATE_FILES
+  elf/cmdline.cc
+  elf/dwarf.cc
+  elf/gc-sections.cc
+  elf/icf.cc
+  elf/input-files.cc
+  elf/input-sections.cc
+  elf/linker-script.cc
+  elf/lto.cc
+  elf/main.cc
+  elf/mapfile.cc
+  elf/output-chunks.cc
+  elf/passes.cc
+  elf/relocatable.cc
+  elf/subprocess.cc
+  elf/thunks.cc
+  )
+
+list(APPEND MOLD_MACHO_TARGETS X86_64 ARM64)
+
+list(APPEND MOLD_MACHO_TEMPLATE_FILES
+  macho/cmdline.cc
+  macho/dead-strip.cc
+  macho/input-files.cc
+  macho/input-sections.cc
+  macho/lto.cc
+  macho/main.cc
+  macho/mapfile.cc
+  macho/output-chunks.cc
+  macho/tapi.cc
+  )
+
+function(mold_instantiate_templates SOURCE TARGET)
+  set(PATH ${CMAKE_BINARY_DIR}/${SOURCE}.${TARGET}.cc)
+  file(WRITE ${PATH} "#define MOLD_${TARGET} 1
+#define MOLD_TARGET ${TARGET}
+#include \"${CMAKE_SOURCE_DIR}/${SOURCE}\"
+")
+  target_sources(mold PRIVATE ${PATH})
+endfunction()
+
+foreach (SOURCE IN LISTS MOLD_ELF_TEMPLATE_FILES)
+  foreach(TARGET IN LISTS MOLD_ELF_TARGETS)
+    mold_instantiate_templates(${SOURCE} ${TARGET})
+  endforeach()
+endforeach()
+
+foreach (SOURCE IN LISTS MOLD_MACHO_TEMPLATE_FILES)
+  foreach(TARGET IN LISTS MOLD_MACHO_TARGETS)
+    mold_instantiate_templates(${SOURCE} ${TARGET})
+  endforeach()
+endforeach()
+
+# Add other non-template source files.
+target_sources(mold PRIVATE
+  compress.cc
+  demangle.cc
+  elf/arch-arm32.cc
+  elf/arch-arm64.cc
+  elf/arch-i386.cc
+  elf/arch-m68k.cc
+  elf/arch-ppc64v1.cc
+  elf/arch-ppc64v2.cc
+  elf/arch-riscv.cc
+  elf/arch-s390x.cc
+  elf/arch-sparc64.cc
+  elf/arch-x86-64.cc
+  filepath.cc
+  git-hash.cc
+  glob.cc
+  hyperloglog.cc
+  macho/arch-arm64.cc
+  macho/arch-x86-64.cc
+  macho/yaml.cc
+  main.cc
+  multi-glob.cc
+  perf.cc
+  tar.cc
+  third-party/rust-demangle/rust-demangle.c
+  uuid.cc
+  )
+
+# Add frequently included header files for pre-compiling.
+# target_precompile_headers is supported by CMake 3.16.0 or newer.
+if(${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.16.0")
+  target_precompile_headers(mold PRIVATE
+    "$<$<COMPILE_LANGUAGE:CXX>:${CMAKE_SOURCE_DIR}/elf/mold.h>"
+    "$<$<COMPILE_LANGUAGE:CXX>:${CMAKE_SOURCE_DIR}/macho/mold.h>")
+
+  # ccache needs this flag along with `sloppiness = pch_defines,time_macros`
+  # to enable caching
+  target_compile_options(mold PRIVATE -fpch-preprocess)
+endif()
+
+include(CTest)
+
+if(BUILD_TESTING)
+  # Create the ld and ld64 symlinks required for testing
+  if(NOT WIN32)
+    add_custom_command(
+      TARGET mold POST_BUILD
+      COMMAND ${CMAKE_COMMAND} -E create_symlink mold ld
+      COMMAND ${CMAKE_COMMAND} -E create_symlink mold ld64
+      BYPRODUCTS ld ld64
+      WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+      VERBATIM)
+  endif()
+
+  if(${APPLE})
+    add_subdirectory(test/macho)
+  elseif(${UNIX})
+    add_subdirectory(test/elf)
+  endif()
+endif()
+
+if(NOT CMAKE_SKIP_INSTALL_RULES)
+  install(TARGETS mold RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+  install(FILES LICENSE DESTINATION ${CMAKE_INSTALL_DOCDIR})
+  install(FILES docs/mold.1 DESTINATION ${CMAKE_INSTALL_MANDIR}/man1/)
+
+  function(mold_install_relative_symlink OLD NEW)
+    install(CODE "
+      get_filename_component(PREFIX_ABS \${CMAKE_INSTALL_PREFIX} ABSOLUTE)
+      get_filename_component(OLD_ABS ${OLD} ABSOLUTE BASE_DIR \${PREFIX_ABS})
+      get_filename_component(NEW_ABS ${NEW} ABSOLUTE BASE_DIR \${PREFIX_ABS})
+      get_filename_component(NEW_DIR \${NEW_ABS} DIRECTORY)
+      file(RELATIVE_PATH OLD_REL \${NEW_DIR} \${OLD_ABS})
+      message(STATUS \"Installing symlink: \$ENV{DESTDIR}/\${NEW_ABS} -> \${OLD_REL}\")
+      file(MAKE_DIRECTORY \$ENV{DESTDIR}/\${NEW_DIR})
+      file(CREATE_LINK \${OLD_REL} \$ENV{DESTDIR}/\${NEW_ABS} SYMBOLIC)")
+  endfunction()
+  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold
+    ${CMAKE_INSTALL_LIBEXECDIR}/mold/ld)
+  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold
+    ${CMAKE_INSTALL_BINDIR}/ld.mold)
+  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold
+    ${CMAKE_INSTALL_BINDIR}/ld64.mold)
+  mold_install_relative_symlink(${CMAKE_INSTALL_MANDIR}/man1/mold.1
+    ${CMAKE_INSTALL_MANDIR}/man1/ld.mold.1)
+endif()

CMakeSettings.json

@@ -0,0 +1,15 @@
+{
+  "configurations": [
+    {
+      "name": "x64-Debug",
+      "generator": "Ninja",
+      "configurationType": "Debug",
+      "inheritEnvironments": [ "clang_cl_x64" ],
+      "buildRoot": "${projectDir}\\out\\build\\${name}",
+      "installRoot": "${projectDir}\\out\\install\\${name}",
+      "cmakeCommandArgs": "",
+      "buildCommandArgs": "",
+      "ctestCommandArgs": ""
+    }
+  ]
+}

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to mold
+
+We request all patches to mold to be released under the dual license
+of the GNU AGPLv3 and the MIT license. Please read the following and
+sign-off your patch as an indication of agreement.
+
+> ## Developer's Certificate of Origin
+>
+> By making a contribution to this project, I certify that:
+>
+>  1. The contribution was created in whole or in part by me and I
+>     have the right to submit it under the Dual License of the GNU
+>     AGPLv3 and the MIT license; or
+>
+>  2. The contribution is based upon previous work that, to the best
+>     of my knowledge, is covered under the the Dual License and I
+>     have the right under the Dual License to submit that work with
+>     modifications, whether created in whole or in part by me, under
+>     the Dual License (unless I am permitted to submit under
+>     different licenses), as indicated in the file; or
+>
+>  3. The contribution was provided directly to me by some other
+>     person who certified (1), (2) or (3) and I have not modified it.
+>
+>  4. I understand and agree that this project and the contribution
+>     are public and that a record of the contribution (including all
+>     personal information I submit with it, including my sign-off) is
+>     maintained indefinitely and may be redistributed consistent with
+>     this project or the open source license(s) involved.
+
+If you agree, you just add a line saying:
+
+```
+Signed-off-by: Random J Developer <[email protected]>
+```
+
+using your real name (sorry, no pseudonyms or anonymous contributions.)
+This will be done for you automatically if you use ``git commit -s``.
+Reverts should also include "Signed-off-by". ``git revert -s`` does that
+for you.
+
+We assume that any contribution that's 10 lines or less does not meet
+the threshold of originality and therefore copyright does not apply.
+You don't need to add a "Signed-off-by" line to such small patches.

Cargo.lock

@@ -1,590 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "allocator-api2"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-
-[[package]]
-name = "arrayvec"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
-
-[[package]]
-name = "blake3"
-version = "1.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d9e454fc11f76977dc803893aff6304ed33d6a26efae8696573bea74baa27ae"
-dependencies = [
- "arrayvec",
- "cc",
- "cfg-if",
- "constant_time_eq",
- "cpufeatures",
-]
-
-[[package]]
-name = "bstr"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
-dependencies = [
- "memchr",
- "regex-automata",
- "serde_core",
-]
-
-[[package]]
-name = "cc"
-version = "1.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "constant_time_eq"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
-
-[[package]]
-name = "cpp_demangle"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2bb79cb74d735044c972aae58ed0aaa9a837e85b01106a54c39e42e97f62253"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc32fast"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-
-[[package]]
-name = "either"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
-
-[[package]]
-name = "flate2"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
-dependencies = [
- "crc32fast",
- "libz-sys",
-]
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-dependencies = [
- "allocator-api2",
- "equivalent",
- "foldhash",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom",
- "libc",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.189"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
-
-[[package]]
-name = "libmimalloc-sys"
-version = "0.1.49"
-source = "git+https://github.com/rui314/mimalloc_rust?rev=3979460494f1cd1e7f936cb8e10f41e927c9f698#3979460494f1cd1e7f936cb8e10f41e927c9f698"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "memmap2"
-version = "0.9.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "mimalloc"
-version = "0.1.52"
-source = "git+https://github.com/rui314/mimalloc_rust?rev=3979460494f1cd1e7f936cb8e10f41e927c9f698#3979460494f1cd1e7f936cb8e10f41e927c9f698"
-dependencies = [
- "libmimalloc-sys",
-]
-
-[[package]]
-name = "mold"
-version = "3.0.0"
-dependencies = [
- "blake3",
- "bstr",
- "cc",
- "cpp_demangle",
- "crc32fast",
- "flate2",
- "getrandom",
- "hashbrown",
- "libc",
- "libz-sys",
- "memchr",
- "memmap2",
- "portable-atomic",
- "rayon",
- "rustc-demangle",
- "uuid",
- "xxhash-rust",
- "zstd",
-]
-
-[[package]]
-name = "mold-cli"
-version = "3.0.0"
-dependencies = [
- "mimalloc",
- "mold",
- "mold-target-arm32",
- "mold-target-arm32be",
- "mold-target-arm64",
- "mold-target-arm64be",
- "mold-target-i386",
- "mold-target-loongarch32",
- "mold-target-loongarch64",
- "mold-target-m68k",
- "mold-target-ppc32",
- "mold-target-ppc64v1",
- "mold-target-ppc64v2",
- "mold-target-riscv32",
- "mold-target-riscv32be",
- "mold-target-riscv64",
- "mold-target-riscv64be",
- "mold-target-s390x",
- "mold-target-sh4",
- "mold-target-sh4be",
- "mold-target-sparc64",
- "mold-target-x86_64",
- "mold-tests",
-]
-
-[[package]]
-name = "mold-target-arm32"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-arm32be"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-arm64"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-arm64be"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-i386"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-loongarch32"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-loongarch64"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-m68k"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-ppc32"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-ppc64v1"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-ppc64v2"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-riscv32"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-riscv32be"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-riscv64"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-riscv64be"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-s390x"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-sh4"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-sh4be"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-sparc64"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-target-x86_64"
-version = "3.0.0"
-dependencies = [
- "mold",
-]
-
-[[package]]
-name = "mold-tests"
-version = "3.0.0"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "pkg-config"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
-
-[[package]]
-name = "portable-atomic"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
-
-[[package]]
-name = "serde_core"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "syn"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "uuid"
-version = "1.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
-dependencies = [
- "getrandom",
-]
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "xxhash-rust"
-version = "0.8.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
-
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
-dependencies = [
- "cc",
- "pkg-config",
-]

Cargo.toml

@@ -1,53 +0,0 @@
-[package]
-name = "mold"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "A high-performance ELF linker, rewritten in Rust"
-license.workspace = true
-# tests/lib.rs belongs to the mold-tests workspace crate.
-autotests = false
-
-# The linker is generic over the target. Instantiating it for all twenty
-# targets in one crate keeps the compiler on a single core for minutes, so
-# each target is instantiated in a crate of its own under arch/, and the
-# executable in cli/ dispatches to them.
-[workspace]
-members = ["cli", "arch/*", "tests"]
-default-members = [".", "cli", "arch/*", "tests"]
-
-[workspace.package]
-version = "3.0.0"
-edition = "2024"
-rust-version = "1.95"
-license = "MIT"
-
-[workspace.dependencies]
-libc = "0.2"
-mold = { path = "." }
-
-[dependencies]
-blake3 = "1.8.7"
-bstr = "1"
-cpp_demangle = "0.4"
-crc32fast = "1"
-flate2 = { version = "1", default-features = false, features = ["zlib"] }
-getrandom = "0.4.3"
-hashbrown = "0.17.1"
-libc.workspace = true
-libz-sys = "1.1.29"
-memchr = "2.8.3"
-memmap2 = "0.9"
-# std has no 64-bit atomics on hosts such as 32-bit PowerPC.
-portable-atomic = "1"
-rayon = "1"
-rustc-demangle = "0.1"
-uuid = { version = "1.27", default-features = false, features = ["v4"] }
-xxhash-rust = { version = "0.8", features = ["xxh3"] }
-zstd = "0.13"
-
-[build-dependencies]
-cc = "1"
-
-[profile.release]
-panic = "abort"

Dockerfile

@@ -0,0 +1,22 @@
+# This dockerfile creates a reproducible build environment for mold.
+#
+# $ docker buildx create --use
+# $ docker buildx build --platform x86_64,aarch64,arm,ppc64le,s390x -t rui314/mold-builder:latest --push .
+
+FROM ubuntu:18.04
+ENV TZ=Europe/London
+RUN apt-get update && \
+  apt-get install -y --no-install-recommends software-properties-common && \
+  add-apt-repository -y ppa:ubuntu-toolchain-r/test && \
+  apt-get update && \
+  apt-get install -y --no-install-recommends build-essential wget libstdc++-11-dev zlib1g-dev gcc-10 g++-10 python3 && \
+  \
+  mkdir /openssl && cd /openssl && \
+  wget -O- -q https://www.openssl.org/source/openssl-3.0.7.tar.gz | tar --strip-components=1 -xzf - && \
+  ./Configure --prefix=/usr/local && \
+  make -j$(nproc) && \
+  make -j$(nproc) install && \
+  \
+  mkdir /cmake && cd /cmake && \
+  wget -O- -q https://github.com/Kitware/CMake/releases/download/v3.24.2/cmake-3.24.2.tar.gz | tar --strip-components=1 -xzf - && \
+  ./bootstrap --parallel=$(nproc) && make -j$(nproc) && make -j$(nproc) install

README.md

@@ -1,191 +1,122 @@
 # mold: A Modern Linker
 
-mold is a high-performance drop-in replacement for existing Unix linkers,
-designed to speed up builds. In our August 2026 benchmarks, it links 4.9x
-faster than [LLVM lld](https://lld.llvm.org) and 1.9x faster than
-[wild](https://github.com/wild-linker/wild) at the median; see
-[Benchmark](#benchmark) for the full results.
+mold is a faster drop-in replacement for existing Unix linkers.
+It is several times faster than the LLVM lld linker, the second-fastest
+open-source linker which I originally created a few years ago.
+mold is designed to increase developer productivity by reducing
+build time, especially in rapid debug-edit-rebuild cycles.
 
-mold is written by the original developer of LLVM lld, the linker that
-Android, Chrome, FreeBSD, PlayStation, Nintendo Switch, and other production
-systems are built with. mold started as an effort to build an even faster
-linker from scratch, free of the architectural limits its author had run into
-while optimizing lld. It has been in production use since 2021, and today it
-is the default linker of many large open-source projects and is used
-internally by many companies.
+Here is a performance comparison of GNU gold, LLVM lld, and mold for
+linking final debuginfo-enabled executables of major large programs
+on a simulated 8-core 16-threads machine.
 
-mold supports x86-64, i386, ARM 32/64, RISC-V 32/64, PowerPC 32/64, s390x,
-LoongArch 32/64, SPARC64, m68k, and SH-4.
+![Link speed comparison](docs/comparison.png)
 
-## Why does linking speed matter?
+| Program (linker output size)  | GNU gold | LLVM lld | mold
+|-------------------------------|----------|----------|--------
+| Chrome 96 (1.89 GiB)          | 53.86s   | 11.74s   | 2.21s
+| Clang 13 (3.18 GiB)           | 64.12s   | 5.82s    | 2.90s
+| Firefox 89 libxul (1.64 GiB)  | 32.95s   | 6.80s    | 1.42s
 
-If you are using a compiled language such as C, C++, or Rust, a build consists
-of two phases. In the first phase, a compiler compiles source files into
-object files (`.o` files). In the second phase, a linker takes all object
-files and combines them into a single executable or shared library file.
+mold is so fast that it is only 2x _slower_ than `cp` on the same
+machine. Feel free to [file a bug](https://github.com/rui314/mold/issues)
+if you find mold is not faster than other linkers.
 
-The second phase can be time-consuming if your build output is large. mold can
-speed up this process, saving you time and preventing distractions while
-waiting for a lengthy build to finish. The difference is most noticeable
-during rapid debug-edit-rebuild cycles.
+mold supports x86-64, i386, ARM64, ARM32, 64-bit/32-bit little/big-endian
+RISC-V, 64-bit big-endian PowerPC ELFv1, 64-bit little-endian PowerPC ELFv2,
+s390x, SPARC64 and m68k.
 
-## Benchmark
+## Why does the speed of linking matter?
 
-Here is a performance comparison of lld, wild, and mold when linking nine
-large programs on two machines:
+If you are using a compiled language such as C, C++ or Rust, a build
+consists of two phases. In the first phase, a compiler compiles
+source files into object files (`.o` files). In the second phase,
+a linker takes all object files to combine them into a single executable
+or a shared library file.
 
-- AMD Ryzen Threadripper 7980X (64 cores) running Ubuntu 24.04
-- Apple M1 Ultra (16 performance cores and 4 efficiency cores) running Fedora
-  Asahi Remix 42; the benchmark is restricted to the performance cores
+The second phase takes a long time if your build output is large.
+mold can make it faster, saving your time and keeping you from being
+distracted while waiting for a long build to finish. The difference is
+most noticeable when you are in rapid debug-edit-rebuild cycles.
 
-The Threadripper represents many-core workstation and server processors, and
-the M1 Ultra represents high-performance desktop processors.
+## Install
 
-All three linkers were built from source in release configuration as of
-2026-08-28 and ran with their default options. Times are wall-clock times as
-seen by the caller, the median of three runs after a warm-up. The ARM64 rows
-are the ARM64 builds of the same programs. The benchmark suite, including all
-linker inputs, is available on [Zenodo](https://zenodo.org/records/21882261).
-
-**AMD Ryzen Threadripper 7980X, debug builds**
-
-| Program (output size)             | lld    | wild  | mold  | wild/mold | lld/mold
-|-----------------------------------|--------|-------|-------|-----------|---------
-| Blender 5.2 (2.46 GiB)            | 4.72s  | 1.98s | 0.86s | 2.3x      | 5.5x
-| Chromium 145 (4.51 GiB)           | 16.64s | 3.98s | 1.65s | 2.4x      | 10.1x
-| Chromium 145 ARM64 (4.76 GiB)     | 20.91s | N/A   | 1.83s | N/A       | 11.4x
-| Clang 21 (4.19 GiB)               | 6.19s  | 3.71s | 1.34s | 2.8x      | 4.6x
-| ClickHouse 26.1 (5.58 GiB)        | 6.62s  | 4.40s | 0.98s | 4.5x      | 6.7x
-| Firefox 149 (2.37 GiB)            | 5.11s  | N/A   | 0.78s | N/A       | 6.5x
-| Firefox 149 ARM64 (2.43 GiB)      | 6.40s  | N/A   | 0.93s | N/A       | 6.9x
-| Godot 4.6 (1.01 GiB)              | 1.77s  | 1.08s | 0.46s | 2.3x      | 3.8x
-| LibreOffice 26.2 (0.98 GiB)       | 3.46s  | 1.41s | 0.44s | 3.2x      | 7.9x
-| PyTorch 2.9 (3.51 GiB)            | 4.35s  | 2.48s | 0.80s | 3.1x      | 5.4x
-| TensorFlow 2.21 (9.55 GiB)        | 50.73s | N/A   | 3.15s | N/A       | 16.1x
-
-**AMD Ryzen Threadripper 7980X, release builds**
-
-| Program (output size)             | lld   | wild  | mold  | wild/mold | lld/mold
-|-----------------------------------|-------|-------|-------|-----------|---------
-| Blender 5.2 (0.24 GiB)            | 0.85s | 0.30s | 0.20s | 1.5x      | 4.2x
-| Chromium 145 (0.58 GiB)           | 6.48s | N/A   | 0.64s | N/A       | 10.2x
-| Chromium 145 ARM64 (0.60 GiB)     | 7.91s | N/A   | 0.73s | N/A       | 10.8x
-| Clang 21 (0.21 GiB)               | 0.53s | 0.23s | 0.11s | 2.2x      | 5.0x
-| ClickHouse 26.1 (1.23 GiB)        | 3.18s | 2.07s | 0.41s | 5.0x      | 7.7x
-| Firefox 149 (0.22 GiB)            | 1.01s | 0.41s | 0.21s | 2.0x      | 4.9x
-| Godot 4.6 (0.15 GiB)              | 0.44s | 0.21s | 0.08s | 2.7x      | 5.8x
-| LibreOffice 26.2 (0.19 GiB)       | 1.13s | 0.57s | 0.19s | 3.0x      | 6.0x
-| PyTorch 2.9 (0.31 GiB)            | 0.68s | 0.32s | 0.15s | 2.2x      | 4.7x
-| TensorFlow 2.21 (0.73 GiB)        | 9.62s | N/A   | 0.70s | N/A       | 13.7x
-
-**Apple M1 Ultra, debug builds**
-
-| Program (output size)             | lld    | wild  | mold  | wild/mold | lld/mold
-|-----------------------------------|--------|-------|-------|-----------|---------
-| Blender 5.2 (2.46 GiB)            | 3.21s  | 1.81s | 1.56s | 1.2x      | 2.1x
-| Chromium 145 (4.51 GiB)           | 9.54s  | 3.49s | 2.22s | 1.6x      | 4.3x
-| Chromium 145 ARM64 (4.76 GiB)     | 12.67s | N/A   | 2.31s | N/A       | 5.5x
-| Clang 21 (4.19 GiB)               | 4.40s  | 2.78s | 2.96s | 0.9x      | 1.5x
-| ClickHouse 26.1 (5.58 GiB)        | 4.92s  | 3.50s | 1.71s | 2.1x      | 2.9x
-| Firefox 149 (2.37 GiB)            | 3.21s  | N/A   | 1.12s | N/A       | 2.9x
-| Firefox 149 ARM64 (2.43 GiB)      | 4.13s  | N/A   | 1.12s | N/A       | 3.7x
-| Godot 4.6 (1.01 GiB)              | 1.12s  | 0.81s | 0.62s | 1.3x      | 1.8x
-| LibreOffice 26.2 (0.98 GiB)       | 2.08s  | 0.94s | 0.63s | 1.5x      | 3.3x
-| PyTorch 2.9 (3.51 GiB)            | 3.07s  | 2.10s | 1.45s | 1.4x      | 2.1x
-| TensorFlow 2.21 (9.55 GiB)        | 43.68s | N/A   | 4.43s | N/A       | 9.9x
-
-**Apple M1 Ultra, release builds**
-
-| Program (output size)             | lld   | wild  | mold  | wild/mold | lld/mold
-|-----------------------------------|-------|-------|-------|-----------|---------
-| Blender 5.2 (0.24 GiB)            | 0.56s | 0.20s | 0.25s | 0.8x      | 2.3x
-| Chromium 145 (0.58 GiB)           | 4.25s | N/A   | 0.78s | N/A       | 5.5x
-| Chromium 145 ARM64 (0.60 GiB)     | 5.17s | N/A   | 0.91s | N/A       | 5.7x
-| Clang 21 (0.21 GiB)               | 0.30s | 0.15s | 0.14s | 1.0x      | 2.1x
-| ClickHouse 26.1 (1.23 GiB)        | 1.94s | 0.95s | 0.55s | 1.7x      | 3.5x
-| Firefox 149 (0.22 GiB)            | 0.56s | 0.23s | 0.20s | 1.1x      | 2.7x
-| Godot 4.6 (0.15 GiB)              | 0.26s | 0.11s | 0.11s | 1.0x      | 2.3x
-| LibreOffice 26.2 (0.19 GiB)       | 0.62s | 0.30s | 0.23s | 1.3x      | 2.7x
-| PyTorch 2.9 (0.31 GiB)            | 0.43s | 0.22s | 0.17s | 1.3x      | 2.5x
-| TensorFlow 2.21 (0.73 GiB)        | 8.07s | N/A   | 0.68s | N/A       | 11.9x
-
-N/A indicates that the linker cannot link that program. wild's Chromium
-release links are also marked N/A because wild does not implement `--icf=all`
-and links without identical code folding.
-
-## Why is mold so fast?
-
-mold owes its speed to pervasive parallelism and to efficient data structures
-and algorithms. For details, read our paper "mold: A Massively Parallel
-Linker" (ASPLOS 2027), available at https://arxiv.org/abs/2608.23228.
-
-## Installation
-
-Binary packages for the following systems are currently available:
+Binary packages for the following systems are currently available.
 
 [![Packaging status](https://repology.org/badge/vertical-allrepos/mold.svg)](https://repology.org/project/mold/versions)
 
-Prebuilt binaries for Linux on x86-64, ARM64, ARM32, RISC-V, PPC64LE, s390x,
-and LoongArch are also attached to each
-[GitHub release](https://github.com/rui314/mold/releases).
+## How to build
 
-## How to Build
+mold is written in C++20, so if you build mold yourself, you need a
+recent version of a C++ compiler and a C++ standard library. GCC 10.2
+or Clang 12.0.0 (or later) as well as libstdc++ 10 or libc++ 7 (or
+later) are recommended.
 
-mold is written in Rust and built with Cargo. It requires Rust 1.95 or later;
-if your system's Rust is older, install the stable toolchain with
-[rustup](https://rustup.rs/). You also need Git and a C compiler such as GCC or
-Clang, which you can install with your system's package manager.
+### Install dependencies
+
+To install build dependencies, run `./install-build-deps.sh` in this
+directory. It recognizes your Linux distribution and tries to install
+necessary packages. You may want to run it as root.
 
 ### Compile mold
 
 ```shell
 git clone https://github.com/rui314/mold.git
-cd mold
-cargo build --release
+mkdir mold/build
+cd mold/build
+git checkout v1.7.1
+../install-build-deps.sh
+cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=c++ ..
+cmake --build . -j $(nproc)
+sudo cmake --install .
 ```
 
-The executable and its companion preload library are
-`target/release/mold` and `target/release/mold-wrapper.so`.
+You may need to pass a C++20 compiler command name to `cmake`.
+In the above case, `c++` is passed. If it doesn't work for you,
+try a specific version of a compiler such as `g++-10` or `clang++-12`.
 
-### Install mold
+By default, `mold` is installed to `/usr/local/bin`. You can change
+that by passing `-DCMAKE_INSTALL_PREFIX=<directory>`. For other cmake
+options, see the comments in `CMakeLists.txt`.
 
-Run `sudo ./install-mold.sh` to install mold under `/usr/local`. To install it
-under a different prefix, set `PREFIX`, as in
-`sudo PREFIX=/usr ./install-mold.sh`. `mold-wrapper.so` is installed to
-`$PREFIX/lib/mold`. If your system uses another library directory, such as
-`/usr/lib64`, set `MOLD_LIBDIR` to it for both `cargo build` and
-`install-mold.sh`.
-
-You can also run `target/release/mold` directly without installing it.
+If you don't use a recent enough Linux distribution, or if for any reason
+`cmake` in the above commands doesn't work for you, you can use Docker to
+build it in a Docker environment. To do so, just run `./dist.sh` in this
+directory instead of `cmake`. The shell script pulls a Docker image,
+builds mold and auxiliary files inside it, and packs them into a
+single tar file `mold-$version-$arch-linux.tar.gz`.  You can extract
+the tar file anywhere and use `mold` executable in it.
 
 ## How to use
 
 <details><summary>A classic way to use mold</summary>
 
-On Unix, the linker command (usually `/usr/bin/ld`) is indirectly invoked by
-the compiler driver (typically `cc`, `gcc`, or `clang`), which is in turn
-indirectly invoked by `make` or other build system commands.
+On Unix, the linker command (which is usually `/usr/bin/ld`) is
+invoked indirectly by the compiler driver (which is usually `cc`,
+`gcc` or `clang`), which is typically in turn indirectly invoked by
+`make` or some other build system command.
 
-If you can specify an additional command line option for your compiler driver
-by modifying the build system's config files, add one of the following flags
-to use mold instead of `/usr/bin/ld`:
+If you can specify an additional command line option to your compiler
+driver by modifying build system's config files, add one of the
+following flags to use `mold` instead of `/usr/bin/ld`:
 
-- For Clang: pass `-fuse-ld=mold`
+- Clang: pass `-fuse-ld=mold`
 
-- For GCC 12.1.0 or later: pass `-fuse-ld=mold`
+- GCC 12.1.0 or later: pass `-fuse-ld=mold`
 
-- For GCC before 12.1.0: the `-fuse-ld` option does not accept `mold` as a
-  valid argument, so you need to use the `-B` option instead. The `-B` option
-  tells GCC where to look for external commands like `ld`.
+- GCC before 12.1.0: `-fuse-ld` does not accept `mold` as a valid
+  argument, so you need to use `-B` option instead. `-B` is an option
+  to tell GCC where to look for external commands such as `ld`.
 
-  If you installed mold using the script above, there is a directory named
-  `/usr/local/libexec/mold`, and the `ld` command there is a symlink to mold.
-  Pass `-B/usr/local/libexec/mold` to GCC. If you installed under another
-  prefix, use that prefix instead.
+  If you have installed mold with `make install`, there should be a
+  directory named `/usr/libexec/mold` (or `/usr/local/libexec/mold`,
+  depending on your `$PREFIX`), and `ld` command should be there. The
+  `ld` is actually a symlink to `mold`. So, all you need is to pass
+  `-B/usr/libexec/mold` (or `-B/usr/local/libexec/mold`) to GCC.
 
-If you haven't installed `ld.mold` to any `$PATH`, you can still pass
-`-fuse-ld=/absolute/path/to/mold` to clang to use mold. However, GCC does not
-accept an absolute path as an argument for `-fuse-ld`.
+If you haven't installed `mold` to any `$PATH`, you can still pass
+`-fuse-ld=/absolute/path/to/mold` to clang to use mold. GCC does not
+take an absolute path as an argument for `-fuse-ld` though.
 
 </details>
 
@@ -194,83 +125,85 @@ accept an absolute path as an argument for `-fuse-ld`.
 Create `.cargo/config.toml` in your project directory with the following:
 
 ```toml
-[target.'cfg(target_os = "linux")']
+[target.x86_64-unknown-linux-gnu]
 linker = "clang"
 rustflags = ["-C", "link-arg=-fuse-ld=/path/to/mold"]
 ```
 
-where `/path/to/mold` is an absolute path to the mold executable. In the
-example above, we use `clang` as a linker driver since it always accepts the
-`-fuse-ld` option. If your GCC is recent enough to recognize the option, you
-may be able to remove the `linker = "clang"` line.
+where `/path/to/mold` is an absolute path to `mold` exectuable. In the
+above example, we use `clang` as a linker driver as it can always take
+the `-fuse-ldd` option. If your GCC is recent enough to recognize the
+option, you may be able to remove the `linker = "clang"` line.
 
 ```toml
-[target.'cfg(target_os = "linux")']
-rustflags = ["-C", "link-arg=-fuse-ld=mold"]
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "link-arg=-fuse-ld=/path/to/mold"]
 ```
 
-If you want to use mold for all projects, add the above snippet to
+If you want to use mold for all projects, put the above snippet to
 `~/.cargo/config.toml`.
 
-</details>
+If you are using macOS, you can modify `config.toml` in a similar manner.
+Here is an example with `mold` installed via [Homebrew](https://brew.sh).
 
-<details><summary>If you are using Nim</summary>
+```toml
+[target.x86_64-apple-darwin]
+linker = "clang"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 
-Create `config.nims` in your project directory with the following:
-
-```nim
-when findExe("mold").len > 0 and defined(linux):
-  switch("passL", "-fuse-ld=mold")
+[target.aarch64-apple-darwin]
+linker = "clang"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 ```
 
-where `mold` must be included in the `PATH` environment variable. In this
-example, `gcc` is used as the linker driver. Use the `-fuse-ld` option if your
-GCC is recent enough to recognize this option.
-
-If you want to use mold for all projects, add the above snippet to
-`~/.config/config.nims`.
-
-</details>
-
-<details><summary>If you are using Conan package manager</summary>
-
-You can configure [Conan](https://github.com/conan-io) to download the latest
-version of `mold` and use it as the linker when building your dependencies and
-projects from source. Please see the instructions [here](https://conan.io/center/recipes/mold).
-
 </details>
 
 <details><summary>mold -run</summary>
 
-It is sometimes very hard to pass an appropriate command line option to `cc`
-to specify an alternative linker. To address this situation, mold has a
-feature to intercept all invocations of `ld`, `ld.bfd`, `ld.lld`, or `ld.gold`
-and redirect them to itself. To use this feature, run `make` (or another build
-command) as a subcommand of mold as follows:
+It is sometimes very hard to pass an appropriate command line option
+to `cc` to specify an alternative linker.  To deal with the situation,
+mold has a feature to intercept all invocations of `ld`, `ld.lld` or
+`ld.gold` and redirect it to itself. To use the feature, run `make`
+(or another build command) as a subcommand of mold as follows:
 
 ```shell
 mold -run make <make-options-if-any>
 ```
 
-Internally, mold invokes a given command with the `LD_PRELOAD` environment
-variable set to its companion shared object file. The shared object file
-intercepts all function calls to `exec(3)`-family functions to replace
-`argv[0]` with `mold` if it is `ld`, `ld.bfd`, `ld.gold`, or `ld.lld`.
+Internally, mold invokes a given command with `LD_PRELOAD` environment
+variable set to its companion shared object file. The shared object
+file intercepts all function calls to `exec(3)`-family functions to
+replace `argv[0]` with `mold` if it is `ld`, `ld.gold` or `ld.lld`.
+
+</details>
+
+<details><summary>On macOS</summary>
+
+mold/macOS is available as an alpha version. It can be used to build not
+only macOS apps but also iOS apps because their binary formats are the same.
+
+The command name of mold/macOS is `ld64.mold`. If you build mold on macOS,
+it still produces `mold` and `ld.mold`, but these executables are useful
+only for cross compilation (i.e. building Linux apps on macOS.)
+
+If you find any issue with mold/macOS, please file it to
+<a href=https://github.com/rui314/mold/issues>our GitHub Issues</a>.
 
 </details>
 
 <details><summary>GitHub Actions</summary>
 
-You can use our [setup-mold](https://github.com/rui314/setup-mold) GitHub
-Action to speed up GitHub-hosted continuous builds. Although GitHub Actions
-run on a 4 core machine, mold is still significantly faster than the default
-GNU linker, especially when linking large programs.
+You can use our <a href=https://github.com/rui314/setup-mold>setup-mold</a>
+GitHub Action to speed up GitHub-hosted continuous build. GitHub Actions
+runs on a two-core machine, but mold is still significantly faster than
+the default GNU linker there especially when a program being linked is
+large.
 
 </details>
 
 <details><summary>Verify that you are using mold</summary>
 
-mold leaves its identification string in the `.comment` section of an output
+mold leaves its identification string in `.comment` section in an output
 file. You can print it out to verify that you are actually using mold.
 
 ```shell
@@ -281,56 +214,66 @@ String dump of section '.comment':
   [    2b]  mold 9a1679b47d9b22012ec7dfbda97c8983956716f7
 ```
 
-If `mold` is present in the `.comment` section, the file was created by mold.
+If `mold` is in `.comment`, the file is created by mold.
 
 </details>
 
 <details><summary>Online manual</summary>
 
-Since mold is a drop-in replacement, you should be able to use it without
-reading its manual. However, if you need it, [mold's man page](docs/mold.md)
-is available online. You can read the same manual by running `man mold`.
+Since mold is a drop-in replacement, you should be able to use it
+without reading its manual. But just in case you need it, it's available
+online at <a href=https://rui314.github.io/mold.html>here</a>.
+You can also read the same manual by `man mold`.
 
 </details>
 
-## Stability
+## Why is mold so fast?
 
-mold has been developed in the open since 2020 and has more than 140
-contributors. Its test suite, which covers every linker feature, runs in CI for
-all supported target CPU architectures, natively or under QEMU, and under ASAN
-and TSAN. Before each release, we try to build all of Gentoo Linux's roughly
-19,000 packages with mold, using GNU ld as a control, to find regressions before
-they reach a release.
+One reason is because it simply uses faster algorithms and efficient
+data structures than other linkers do. The other reason is that the
+new linker is highly parallelized.
 
-## Sponsors
+Here is a side-by-side comparison of per-core CPU usage of lld (left)
+and mold (right). They are linking the same program, Chromium
+executable.
 
-mold is free to use, but keeping it maintained is continuous work: supporting
-new architectures and toolchain features, keeping up with the projects that
-depend on it, and making it faster. That work is funded by sponsors. If mold
-saves you or your company time, please consider becoming a
-[GitHub sponsor](https://github.com/sponsors/rui314).
+![CPU usage comparison in htop animation](docs/htop.gif)
 
-We thank everyone who sponsors the project. In particular, we'd like to
-acknowledge the following people and organizations who have sponsored
-$128/month or more:
+As you can see, mold uses all available cores throughout its execution
+and finishes quickly. On the other hand, lld failed to use available
+cores most of the time. In this demo, the maximum parallelism is
+artificially capped to 16 so that the bars fit in the GIF.
 
-### Corporate sponsors
+For details, please read [design notes](docs/design.md).
 
-<a href="https://mercury.com"><img src="docs/mercury-logo.png" align=center height=120 width=400 alt=Mercury></a>
+## License
 
-<a href="https://cybozu-global.com"><img src="docs/cyboze-logo.png" align=center height=120 width=133 alt=Cybozu></a>
+mold is available under AGPL. Note that that does not mean that you
+have to license your program under AGPL if you use mold to link your
+program. An output of the mold linker is a derived work of the object
+files and libraries you pass to the linker but not a derived work of
+the mold linker itself.
 
-<a href="https://www.emergetools.com"><img src="docs/emerge-tools-logo.png" align=center height=120 width=240 alt="Emerge Tools"></a><br>
+Besides that, you can also buy a commercial, non-AGPL license with
+technical support from our company, Blue Whale Systems PTE LTD. If you
+are a big company, please consider obtaining it before making hundreds
+or thousands of developers of your company to depend on mold. mold is
+mostly a single-person open-source project, and just like other
+open-source projects, we are not legally obligated to keep maintaining
+it. A legally-binding commercial license contract addresses the
+concern. By purchasing a license, you are guaranteed that mold will be
+maintained for you. Please [contact us](mailto:[email protected])
+for a commercial license inquiry.
 
-- [G-Research](https://www.gresearch.co.uk)
-- [Signal Slot Inc.](https://github.com/signal-slot)
-- [GlareDB](https://github.com/GlareDB)
+## Acknowledgement
 
-### Individual sponsors
+We accept donations via [GitHub Sponsors](https://github.com/sponsors/rui314)
+and [OpenCollective](https://opencollective.com/mold-linker).
+We thank you to everybody who sponsors our project. In particular,
+we'd like to acknowledge the following people and organizations who
+have sponsored $128/month or more:
 
+- [300baud](https://github.com/300baud)
+- [Mercury](https://github.com/MercuryTechnologies)
 - [Wei Wu](https://github.com/lazyparser)
-- [kyle-elliott](https://github.com/kyle-elliott)
-- [Bryant Biggs](https://github.com/bryantbiggs)
-- [kraptor23](https://github.com/kraptor23)
-- [Jinkyu Yi](https://github.com/jincreator)
-- [Pedro Navarro](https://github.com/pedronavf)
+- [Signal Slot Inc.](https://github.com/signal-slot)

arch/README.md

@@ -1,11 +0,0 @@
-# Architecture crates
-
-Each subdirectory is a small crate that instantiates the generic linker for
-one target architecture. Separate crates let Cargo compile the architectures
-in parallel. Instantiating all targets in one crate leaves a long serial
-compilation step.
-
-The shared linker implementation lives in [`src/`](../src/), with
-target-specific code in [`src/target/`](../src/target/). These crates provide
-entry points that the [`cli/`](../cli/) executable selects for the input
-files' target.

arch/arm32/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-arm32"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for arm32"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/arm32/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Arm32>(cmdline)
-}

arch/arm32be/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-arm32be"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for arm32be"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/arm32be/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Arm32Be>(cmdline)
-}

arch/arm64/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-arm64"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for arm64"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/arm64/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Arm64>(cmdline)
-}

arch/arm64be/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-arm64be"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for arm64be"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/arm64be/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Arm64Be>(cmdline)
-}

arch/i386/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-i386"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for i386"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/i386/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::I386>(cmdline)
-}

arch/loongarch32/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-loongarch32"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for loongarch32"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/loongarch32/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::LoongArch32>(cmdline)
-}

arch/loongarch64/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-loongarch64"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for loongarch64"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/loongarch64/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::LoongArch64>(cmdline)
-}

arch/m68k/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-m68k"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for m68k"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/m68k/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::M68k>(cmdline)
-}

arch/ppc32/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-ppc32"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for ppc32"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/ppc32/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Ppc32>(cmdline)
-}

arch/ppc64v1/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-ppc64v1"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for ppc64v1"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/ppc64v1/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Ppc64V1>(cmdline)
-}

arch/ppc64v2/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-ppc64v2"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for ppc64v2"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/ppc64v2/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Ppc64V2>(cmdline)
-}

arch/riscv32/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-riscv32"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for riscv32"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/riscv32/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Riscv32>(cmdline)
-}

arch/riscv32be/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-riscv32be"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for riscv32be"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/riscv32be/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Riscv32Be>(cmdline)
-}

arch/riscv64/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-riscv64"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for riscv64"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/riscv64/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Riscv64>(cmdline)
-}

arch/riscv64be/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-riscv64be"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for riscv64be"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/riscv64be/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Riscv64Be>(cmdline)
-}

arch/s390x/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-s390x"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for s390x"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/s390x/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::S390x>(cmdline)
-}

arch/sh4/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-sh4"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for sh4"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/sh4/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Sh4>(cmdline)
-}

arch/sh4be/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-sh4be"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for sh4be"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/sh4be/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Sh4Be>(cmdline)
-}

arch/sparc64/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-sparc64"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for sparc64"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/sparc64/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::Sparc64>(cmdline)
-}

arch/x86_64/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "mold-target-x86_64"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold linker instantiated for x86_64"
-license.workspace = true
-
-[lib]
-path = "lib.rs"
-
-[dependencies]
-mold.workspace = true

arch/x86_64/lib.rs

@@ -1,3 +0,0 @@
-pub fn link(cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    mold::driver::link::<mold::target::X86_64>(cmdline)
-}

archive-file.h

@@ -0,0 +1,179 @@
+// This file contains functions to read an archive file (.a file).
+// An archive file is just a bundle of object files. It's similar to
+// tar or zip, but the contents are not compressed.
+//
+// An archive file is either "regular" or "thin". A regular archive
+// contains object files directly, while a thin archive contains only
+// pathnames. In the latter case, actual file contents have to be read
+// from given pathnames. A regular archive is sometimes called "fat"
+// archive as opposed to "thin".
+//
+// If an archive file is given to the linker, the linker pulls out
+// object files that are needed to resolve undefined symbols. So,
+// bunding object files as an archive and giving that archive to the
+// linker has a different meaning than directly giving the same set of
+// object files to the linker. The former links only needed object
+// files, while the latter links all the given object files.
+//
+// Therefore, if you link libc.a for example, not all the libc
+// functions are linked to your binary. Instead, only object files
+// that provides functions and variables used in your program get
+// linked. To make this efficient, static library functions are
+// usually separated to each object file in an archive file. You can
+// see the contents of libc.a by runnning `ar t
+// /usr/lib/x86_64-linux-gnu/libc.a`.
+
+#pragma once
+
+#include "mold.h"
+#include "filetype.h"
+
+namespace mold {
+
+struct ArHdr {
+  char ar_name[16];
+  char ar_date[12];
+  char ar_uid[6];
+  char ar_gid[6];
+  char ar_mode[8];
+  char ar_size[10];
+  char ar_fmag[2];
+
+  bool starts_with(std::string_view s) const {
+    return std::string_view(ar_name, s.size()) == s;
+  }
+
+  bool is_strtab() const {
+    return starts_with("// ");
+  }
+
+  bool is_symtab() const {
+    return starts_with("/ ") || starts_with("/SYM64/ ");
+  }
+
+  std::string read_name(std::string_view strtab, u8 *&ptr) const {
+    // BSD-style long filename
+    if (starts_with("#1/")) {
+      int namelen = atoi(ar_name + 3);
+      std::string name{(char *)ptr, (size_t)namelen};
+      ptr += namelen;
+
+      if (size_t pos = name.find('\0'))
+        name = name.substr(0, pos);
+      return name;
+    }
+
+    // SysV-style long filename
+    if (starts_with("/")) {
+      const char *start = strtab.data() + atoi(ar_name + 1);
+      return {start, (const char *)strstr(start, "/\n")};
+    }
+
+    // Short fileanme
+    if (const char *end = (char *)memchr(ar_name, '/', sizeof(ar_name)))
+      return {ar_name, end};
+    return {ar_name, sizeof(ar_name)};
+  }
+};
+
+template <typename C>
+std::vector<MappedFile<C> *>
+read_thin_archive_members(C &ctx, MappedFile<C> *mf) {
+  u8 *begin = mf->data;
+  u8 *data = begin + 8;
+  std::vector<MappedFile<C> *> vec;
+  std::string_view strtab;
+
+  while (data < begin + mf->size) {
+    // Each header is aligned to a 2 byte boundary.
+    if ((begin - data) % 2)
+      data++;
+
+    ArHdr &hdr = *(ArHdr *)data;
+    u8 *body = data + sizeof(hdr);
+    u64 size = atol(hdr.ar_size);
+
+    // Read a string table.
+    if (hdr.is_strtab()) {
+      strtab = {(char *)body, (size_t)size};
+      data = body + size;
+      continue;
+    }
+
+    // Skip a symbol table.
+    if (hdr.is_symtab()) {
+      data = body + size;
+      continue;
+    }
+
+    if (!hdr.starts_with("#1/") && !hdr.starts_with("/"))
+      Fatal(ctx) << mf->name << ": filename is not stored as a long filename";
+
+    std::string name = hdr.read_name(strtab, body);
+
+    // Skip if symbol table
+    if (name == "__.SYMDEF" || name == "__.SYMDEF SORTED")
+      continue;
+
+    std::string path = name.starts_with('/') ?
+      name : (filepath(mf->name).parent_path() / name).string();
+    vec.push_back(MappedFile<C>::must_open(ctx, path));
+    vec.back()->thin_parent = mf;
+    data = body;
+  }
+  return vec;
+}
+
+template <typename C>
+std::vector<MappedFile<C> *>
+read_fat_archive_members(C &ctx, MappedFile<C> *mf) {
+  u8 *begin = mf->data;
+  u8 *data = begin + 8;
+  std::vector<MappedFile<C> *> vec;
+  std::string_view strtab;
+
+  while (begin + mf->size - data >= 2) {
+    if ((begin - data) % 2)
+      data++;
+
+    ArHdr &hdr = *(ArHdr *)data;
+    u8 *body = data + sizeof(hdr);
+    u64 size = atol(hdr.ar_size);
+    data = body + size;
+
+    // Read if string table
+    if (hdr.is_strtab()) {
+      strtab = {(char *)body, (size_t)size};
+      continue;
+    }
+
+    // Skip if symbol table
+    if (hdr.is_symtab())
+      continue;
+
+    // Read the name field
+    std::string name = hdr.read_name(strtab, body);
+
+    // Skip if symbol table
+    if (name == "__.SYMDEF" || name == "__.SYMDEF SORTED")
+      continue;
+
+    vec.push_back(mf->slice(ctx, name, body - begin, data - body));
+  }
+  return vec;
+}
+
+template <typename C>
+std::vector<MappedFile<C> *>
+read_archive_members(C &ctx, MappedFile<C> *mf) {
+  switch (get_file_type(mf)) {
+  case FileType::AR:
+    return read_fat_archive_members(ctx, mf);
+  case FileType::THIN_AR:
+    return read_thin_archive_members(ctx, mf);
+  default:
+    unreachable();
+  }
+}
+
+} // namespace mold

build.rs

@@ -1,115 +0,0 @@
-//! Builds the two small C parts of mold.
-//!
-//! `mold-wrapper.so` is the preload library behind `mold -run`. It
-//! interposes the exec family, including the C-variadic `execl` functions
-//! that stable Rust cannot define, so it is a C file. It is placed next to
-//! the `mold` executable, where `-run` looks for it.
-//!
-//! `lto-message.c` adapts the LTO plugin's printf-like diagnostics
-//! callback, which is C-variadic as well, and is linked into mold.
-
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-// Embed the current git commit hash into the mold executable. We ask git
-// instead of parsing files under .git because the repository format varies
-// (e.g. packed refs, reftable). When building from a source tarball, there's
-// no .git, and the hash is simply omitted.
-fn git_hash(source_dir: &Path) -> Option<String> {
-    let dot_git = source_dir.join(".git");
-    if !dot_git.exists() {
-        // Source archives use the package version. If Git metadata is added
-        // later, a clean rebuild is needed to embed the new commit hash.
-        return None;
-    }
-    if dot_git.is_file() {
-        println!("cargo:rerun-if-changed={}", dot_git.display());
-    }
-
-    let git_path = |name: &str| -> Option<PathBuf> {
-        let output = Command::new("git")
-            .arg("-C")
-            .arg(source_dir)
-            .args(["rev-parse", "--git-path", name])
-            .output()
-            .ok()?;
-        if !output.status.success() {
-            return None;
-        }
-        let path = PathBuf::from(String::from_utf8(output.stdout).ok()?.trim());
-        Some(if path.is_absolute() { path } else { source_dir.join(path) })
-    };
-
-    let reftable = git_path("reftable/tables.list").filter(|p| p.exists());
-    if let Some(head) = git_path("HEAD").filter(|p| p.exists()) {
-        println!("cargo:rerun-if-changed={}", head.display());
-        if let Ok(contents) = std::fs::read_to_string(&head)
-            && let Some(reference) =
-                contents.strip_prefix("ref: ").map(str::trim).filter(|_| reftable.is_none())
-            && let Some(path) = git_path(reference)
-        {
-            // A packed reference may acquire a loose file later.
-            // Watch its nearest existing directory until that happens.
-            if let Some(path) = path.ancestors().find(|p| p.exists()) {
-                println!("cargo:rerun-if-changed={}", path.display());
-            }
-        }
-    }
-    for path in git_path("packed-refs").into_iter().chain(reftable).filter(|p| p.exists()) {
-        println!("cargo:rerun-if-changed={}", path.display());
-    }
-
-    let output =
-        Command::new("git").arg("-C").arg(source_dir).args(["rev-parse", "HEAD"]).output().ok()?;
-    output.status.success().then(|| String::from_utf8_lossy(&output.stdout).trim().to_string())
-}
-
-fn main() {
-    let source_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
-    let version = std::env::var("CARGO_PKG_VERSION").unwrap();
-    let version = match git_hash(&source_dir) {
-        Some(hash) => format!("mold {version} ({hash}; compatible with GNU ld)"),
-        None => format!("mold {version} (compatible with GNU ld)"),
-    };
-    println!("cargo:rustc-env=MOLD_VERSION={version}");
-
-    println!("cargo:rerun-if-changed=c/mold-wrapper.c");
-    println!("cargo:rerun-if-changed=c/lto-message.c");
-
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();
-    let target_env = std::env::var("CARGO_CFG_TARGET_ENV").unwrap();
-    if target_os == "windows" && target_env == "msvc" {
-        return;
-    }
-
-    let out_dir = PathBuf::from(std::env::var("OUT_DIR").unwrap());
-    let mut build = cc::Build::new();
-    build.opt_level(2).pic(true);
-    if let Ok(sanitizer) = std::env::var("CARGO_CFG_SANITIZE") {
-        build.flag(format!("-fsanitize={sanitizer}"));
-    }
-    build.file("c/lto-message.c").compile("ltomessage");
-
-    if target_os == "windows" || target_os == "macos" {
-        return;
-    }
-
-    // The build directory is inside the actual profile directory. PROFILE
-    // only describes inheritance and need not be that directory's name.
-    let profile_dir = out_dir
-        .ancestors()
-        .find(|path| path.file_name().is_some_and(|name| name == "build"))
-        .and_then(Path::parent)
-        .expect("OUT_DIR must be inside Cargo's build directory");
-    let wrapper = profile_dir.join("mold-wrapper.so");
-    let mut command = build.get_compiler().to_command();
-    command.args(["-shared", "-o"]);
-    command.arg(&wrapper).arg("c/mold-wrapper.c");
-    if target_os == "android" || target_os == "linux" {
-        command.arg("-ldl");
-    }
-    let status = command.status();
-    if !matches!(status, Ok(s) if s.success()) {
-        println!("cargo:warning=could not build mold-wrapper.so; `mold -run` will not work");
-    }
-}

c/lto-message.c

@@ -1,18 +0,0 @@
-// The linker plugin reports diagnostics through a printf-like callback.
-// C-variadic functions can't be defined in stable Rust, so this adapter
-// formats the message and hands it to Rust.
-
-#include <stdarg.h>
-#include <stdio.h>
-
-void mold_lto_report(int level, const char *msg);
-
-int mold_lto_message(int level, const char *fmt, ...) {
-  char buf[1000];
-  va_list ap;
-  va_start(ap, fmt);
-  vsnprintf(buf, sizeof(buf), fmt, ap);
-  va_end(ap);
-  mold_lto_report(level, buf);
-  return 0;
-}

cli/Cargo.toml

@@ -1,72 +0,0 @@
-[package]
-name = "mold-cli"
-version.workspace = true
-edition.workspace = true
-rust-version.workspace = true
-description = "The mold executable"
-license.workspace = true
-
-[[bin]]
-name = "mold"
-path = "main.rs"
-
-[[test]]
-name = "integration"
-path = "integration.rs"
-harness = false
-
-[dependencies]
-mimalloc = { git = "https://github.com/rui314/mimalloc_rust", rev = "3979460494f1cd1e7f936cb8e10f41e927c9f698" }
-mold.workspace = true
-mold-target-x86_64 = { path = "../arch/x86_64", optional = true }
-mold-target-i386 = { path = "../arch/i386", optional = true }
-mold-target-arm32 = { path = "../arch/arm32", optional = true }
-mold-target-arm32be = { path = "../arch/arm32be", optional = true }
-mold-target-arm64 = { path = "../arch/arm64", optional = true }
-mold-target-arm64be = { path = "../arch/arm64be", optional = true }
-mold-target-riscv64 = { path = "../arch/riscv64", optional = true }
-mold-target-riscv64be = { path = "../arch/riscv64be", optional = true }
-mold-target-riscv32 = { path = "../arch/riscv32", optional = true }
-mold-target-riscv32be = { path = "../arch/riscv32be", optional = true }
-mold-target-ppc64v2 = { path = "../arch/ppc64v2", optional = true }
-mold-target-ppc32 = { path = "../arch/ppc32", optional = true }
-mold-target-ppc64v1 = { path = "../arch/ppc64v1", optional = true }
-mold-target-s390x = { path = "../arch/s390x", optional = true }
-mold-target-sparc64 = { path = "../arch/sparc64", optional = true }
-mold-target-m68k = { path = "../arch/m68k", optional = true }
-mold-target-sh4 = { path = "../arch/sh4", optional = true }
-mold-target-sh4be = { path = "../arch/sh4be", optional = true }
-mold-target-loongarch64 = { path = "../arch/loongarch64", optional = true }
-mold-target-loongarch32 = { path = "../arch/loongarch32", optional = true }
-
-[dev-dependencies]
-mold-tests = { path = "../tests" }
-
-# One feature per target. All are built by default; a build for one
-# target alone (`--no-default-features --features x86_64`) is much faster.
-[features]
-default = [
-    "x86_64", "i386", "arm32", "arm32be", "arm64", "arm64be", "riscv64", "riscv64be", "riscv32", "riscv32be",
-    "ppc64v2", "ppc32", "ppc64v1", "s390x", "sparc64", "m68k", "sh4", "sh4be", "loongarch64", "loongarch32",
-]
-system-allocator = []
-x86_64 = ["dep:mold-target-x86_64"]
-i386 = ["dep:mold-target-i386"]
-arm32 = ["dep:mold-target-arm32"]
-arm32be = ["dep:mold-target-arm32be"]
-arm64 = ["dep:mold-target-arm64"]
-arm64be = ["dep:mold-target-arm64be"]
-riscv64 = ["dep:mold-target-riscv64"]
-riscv64be = ["dep:mold-target-riscv64be"]
-riscv32 = ["dep:mold-target-riscv32"]
-riscv32be = ["dep:mold-target-riscv32be"]
-ppc64v2 = ["dep:mold-target-ppc64v2"]
-ppc32 = ["dep:mold-target-ppc32"]
-ppc64v1 = ["dep:mold-target-ppc64v1"]
-s390x = ["dep:mold-target-s390x"]
-sparc64 = ["dep:mold-target-sparc64"]
-m68k = ["dep:mold-target-m68k"]
-sh4 = ["dep:mold-target-sh4"]
-sh4be = ["dep:mold-target-sh4be"]
-loongarch64 = ["dep:mold-target-loongarch64"]
-loongarch32 = ["dep:mold-target-loongarch32"]

cli/build.rs

@@ -1,15 +0,0 @@
-//! Links libatomic into mold on hosts without 64-bit atomics, such as
-//! 32-bit PowerPC. mimalloc uses 64-bit atomics, which C compilers
-//! implement as calls into libatomic on those hosts.
-
-fn main() {
-    println!("cargo:rerun-if-changed=build.rs");
-
-    let widths = std::env::var("CARGO_CFG_TARGET_HAS_ATOMIC").unwrap_or_default();
-    if !widths.split(',').any(|w| w == "64") {
-        // rustc places libraries named by this crate before its dependencies
-        // on the linker command line, where --as-needed would drop libatomic.
-        // Link arguments come after all libraries.
-        println!("cargo:rustc-link-arg-bins=-latomic");
-    }
-}

cli/integration.rs

@@ -1,8 +0,0 @@
-use std::path::Path;
-use std::process::ExitCode;
-
-fn main() -> ExitCode {
-    let root = Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap();
-    let cases = [root.join("tests")];
-    mold_tests::run(&cases, Path::new(env!("CARGO_BIN_EXE_mold")))
-}

cli/main.rs

@@ -1,79 +0,0 @@
-//! The `mold` executable: runs the linker instantiated for the target the
-//! inputs are for. Each target is instantiated in a crate of its own so
-//! that the compiler can build them in parallel, and a feature per target
-//! decides which of them are built in.
-
-// A Rust executable can define only one global allocator, so select mimalloc
-// here rather than in the linker library.
-#[cfg(not(feature = "system-allocator"))]
-#[global_allocator]
-static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
-
-type LinkFn = fn(mold::driver::Cmdline) -> mold::driver::LinkResult;
-
-// Each target has its own monomorphized link function. Start with the first
-// enabled target and switch to the matching function if the inputs differ.
-const TARGETS: &[(&str, LinkFn)] = &[
-    #[cfg(feature = "x86_64")]
-    ("x86_64", mold_target_x86_64::link),
-    #[cfg(feature = "i386")]
-    ("i386", mold_target_i386::link),
-    #[cfg(feature = "arm32")]
-    ("arm32", mold_target_arm32::link),
-    #[cfg(feature = "arm32be")]
-    ("arm32be", mold_target_arm32be::link),
-    #[cfg(feature = "arm64")]
-    ("arm64", mold_target_arm64::link),
-    #[cfg(feature = "arm64be")]
-    ("arm64be", mold_target_arm64be::link),
-    #[cfg(feature = "riscv64")]
-    ("riscv64", mold_target_riscv64::link),
-    #[cfg(feature = "riscv64be")]
-    ("riscv64be", mold_target_riscv64be::link),
-    #[cfg(feature = "riscv32")]
-    ("riscv32", mold_target_riscv32::link),
-    #[cfg(feature = "riscv32be")]
-    ("riscv32be", mold_target_riscv32be::link),
-    #[cfg(feature = "ppc64v2")]
-    ("ppc64v2", mold_target_ppc64v2::link),
-    #[cfg(feature = "ppc32")]
-    ("ppc32", mold_target_ppc32::link),
-    #[cfg(feature = "ppc64v1")]
-    ("ppc64v1", mold_target_ppc64v1::link),
-    #[cfg(feature = "s390x")]
-    ("s390x", mold_target_s390x::link),
-    #[cfg(feature = "sparc64")]
-    ("sparc64", mold_target_sparc64::link),
-    #[cfg(feature = "m68k")]
-    ("m68k", mold_target_m68k::link),
-    #[cfg(feature = "sh4")]
-    ("sh4", mold_target_sh4::link),
-    #[cfg(feature = "sh4be")]
-    ("sh4be", mold_target_sh4be::link),
-    #[cfg(feature = "loongarch64")]
-    ("loongarch64", mold_target_loongarch64::link),
-    #[cfg(feature = "loongarch32")]
-    ("loongarch32", mold_target_loongarch32::link),
-];
-
-fn link_for_target(target: &str, cmdline: mold::driver::Cmdline) -> mold::driver::LinkResult {
-    for &(name, link) in TARGETS {
-        if name == target {
-            return link(cmdline);
-        }
-    }
-    eprintln!(
-        "mold: unsupported target: {target}; rebuild mold with the appropriate target support"
-    );
-    std::process::exit(1);
-}
-
-fn main() {
-    let Some(&(initial_target, _)) = TARGETS.first() else {
-        eprintln!("mold: no targets enabled; rebuild mold with the appropriate target support");
-        std::process::exit(1);
-    };
-    let args = std::env::args_os().collect();
-    let status = mold::driver::main(args, initial_target, link_for_target);
-    std::process::exit(status);
-}

cmdline.h

@@ -0,0 +1,76 @@
+#pragma once
+
+#include "mold.h"
+
+namespace mold {
+
+template <typename C>
+std::vector<std::string_view>
+read_response_file(C &ctx, std::string_view path) {
+  std::vector<std::string_view> vec;
+  MappedFile<C> *mf = MappedFile<C>::must_open(ctx, std::string(path));
+  u8 *data = mf->data;
+
+  auto read_quoted = [&](i64 i, char quote) {
+    std::string buf;
+    while (i < mf->size && data[i] != quote) {
+      if (data[i] == '\\') {
+        buf.append(1, data[i + 1]);
+        i += 2;
+      } else {
+        buf.append(1, data[i++]);
+      }
+    }
+    if (i >= mf->size)
+      Fatal(ctx) << path << ": premature end of input";
+    vec.push_back(save_string(ctx, buf));
+    return i + 1;
+  };
+
+  auto read_unquoted = [&](i64 i) {
+    std::string buf;
+    while (i < mf->size && !isspace(data[i]))
+      buf.append(1, data[i++]);
+    vec.push_back(save_string(ctx, buf));
+    return i;
+  };
+
+  for (i64 i = 0; i < mf->size;) {
+    if (isspace(data[i]))
+      i++;
+    else if (data[i] == '\'')
+      i = read_quoted(i + 1, '\'');
+    else if (data[i] == '\"')
+      i = read_quoted(i + 1, '\"');
+    else
+      i = read_unquoted(i);
+  }
+  return vec;
+}
+
+// Replace "@path/to/some/text/file" with its file contents.
+template <typename C>
+std::vector<std::string_view> expand_response_files(C &ctx, char **argv) {
+  std::vector<std::string_view> vec;
+  for (i64 i = 0; argv[i]; i++) {
+    if (argv[i][0] == '@')
+      append(vec, read_response_file(ctx, argv[i] + 1));
+    else
+      vec.push_back(argv[i]);
+  }
+  return vec;
+}
+
+static inline std::string_view string_trim(std::string_view str) {
+  size_t pos = str.find_first_not_of(" \t");
+  if (pos == str.npos)
+    return "";
+  str = str.substr(pos);
+
+  pos = str.find_last_not_of(" \t");
+  if (pos == str.npos)
+    return str;
+  return str.substr(0, pos + 1);
+}
+
+} // namespace mold

compress.cc

@@ -0,0 +1,185 @@
+// This file implements a multi-threaded zlib and zstd compression
+// routine.
+//
+// zlib-compressed data can be merged just by concatenation as long as
+// each piece of data is flushed with Z_SYNC_FLUSH. In this file, we
+// split input data into multiple shards, compress them individually
+// and concatenate them. We then append a header, a trailer and a
+// checksum so that the concatenated data is valid zlib-format data.
+//
+// zstd-compressed data can be merged in the same way.
+//
+// Using threads to compress data has a downside. Since the dictionary
+// is reset on boundaries of shards, compression ratio is sacrificed
+// a little bit. However, if a shard size is large enough, that loss
+// is negligible in practice.
+
+#include "mold.h"
+
+#include <tbb/parallel_for_each.h>
+#include <zlib.h>
+#include <zstd.h>
+
+#define CHECK(fn)                               \
+  do {                                          \
+    [[maybe_unused]] int r = (fn);              \
+    assert(r == Z_OK);                          \
+  } while (0)
+
+namespace mold {
+
+static constexpr i64 SHARD_SIZE = 1024 * 1024;
+
+static std::vector<std::string_view> split(std::string_view input) {
+  std::vector<std::string_view> shards;
+
+  while (input.size() >= SHARD_SIZE) {
+    shards.push_back(input.substr(0, SHARD_SIZE));
+    input = input.substr(SHARD_SIZE);
+  }
+  if (!input.empty())
+    shards.push_back(input);
+  return shards;
+}
+
+static std::vector<u8> zlib_compress(std::string_view input) {
+  // Initialize zlib stream. Since debug info is generally compressed
+  // pretty well with lower compression levels, we chose compression
+  // level 1.
+  z_stream strm;
+  strm.zalloc = Z_NULL;
+  strm.zfree = Z_NULL;
+  strm.opaque = Z_NULL;
+
+  CHECK(deflateInit2(&strm, 1, Z_DEFLATED, -15, 8, Z_DEFAULT_STRATEGY));
+
+  // Set an input buffer
+  strm.avail_in = input.size();
+  strm.next_in = (u8 *)input.data();
+
+  // Set an output buffer. deflateBound() returns an upper bound
+  // on the compression size. +16 for Z_SYNC_FLUSH.
+  std::vector<u8> buf(deflateBound(&strm, strm.avail_in) + 16);
+
+  // Compress data. It writes all compressed bytes except the last
+  // partial byte, so up to 7 bits can be held to be written to the
+  // buffer.
+  strm.avail_out = buf.size();
+  strm.next_out = buf.data();
+  CHECK(deflate(&strm, Z_BLOCK));
+
+  // This is a workaround for libbacktrace before 2022-04-06.
+  //
+  // Zlib is a bit stream, and what Z_SYNC_FLUSH does is to write a
+  // three bit value indicating the start of an uncompressed data
+  // block followed by four byte data 00 00 ff ff which indicates that
+  // the length of the block is zero. libbacktrace uses its own zlib
+  // inflate routine, and it had a bug that if that particular three
+  // bit value happens to end at a byte boundary, it accidentally
+  // skipped the next byte.
+  //
+  // In order to avoid triggering that bug, we should avoid calling
+  // deflate() with Z_SYNC_FLUSH if the current bit position is 5.
+  // If it's 5, we insert an empty block consisting of 10 bits so
+  // that the bit position is 7 in the next byte.
+  //
+  // https://github.com/ianlancetaylor/libbacktrace/pull/87
+  int nbits;
+  deflatePending(&strm, Z_NULL, &nbits);
+  if (nbits == 5)
+    CHECK(deflatePrime(&strm, 10, 2));
+  CHECK(deflate(&strm, Z_SYNC_FLUSH));
+
+  assert(strm.avail_out > 0);
+  buf.resize(buf.size() - strm.avail_out);
+  buf.shrink_to_fit();
+  deflateEnd(&strm);
+  return buf;
+}
+
+ZlibCompressor::ZlibCompressor(u8 *buf, i64 size) {
+  std::string_view input{(char *)buf, (size_t)size};
+  std::vector<std::string_view> inputs = split(input);
+  std::vector<u64> adlers(inputs.size());
+  shards.resize(inputs.size());
+
+  // Compress each shard
+  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
+    adlers[i] = adler32(1, (u8 *)inputs[i].data(), inputs[i].size());
+    shards[i] = zlib_compress(inputs[i]);
+  });
+
+  // Combine checksums
+  checksum = adlers[0];
+  for (i64 i = 1; i < inputs.size(); i++)
+    checksum = adler32_combine(checksum, adlers[i], inputs[i].size());
+
+  // Comput the total size
+  compressed_size = 8; // the header and the trailer
+  for (std::vector<u8> &shard : shards)
+    compressed_size += shard.size();
+}
+
+void ZlibCompressor::write_to(u8 *buf) {
+  // Write a zlib-format header
+  buf[0] = 0x78;
+  buf[1] = 0x9c;
+
+  // Copy compressed data
+  std::vector<i64> offsets(shards.size());
+  offsets[0] = 2; // +2 for header
+  for (i64 i = 1; i < shards.size(); i++)
+    offsets[i] = offsets[i - 1] + shards[i - 1].size();
+
+  tbb::parallel_for((i64)0, (i64)shards.size(), [&](i64 i) {
+    memcpy(&buf[offsets[i]], shards[i].data(), shards[i].size());
+  });
+
+  // Write a trailer
+  u8 *end = buf + compressed_size;
+  end[-6] = 3;
+  end[-5] = 0;
+
+  // Write a checksum
+  *(ub32 *)(end - 4) = checksum;
+}
+
+static std::vector<u8> zstd_compress(std::string_view input) {
+  std::vector<u8> buf(ZSTD_COMPRESSBOUND(input.size()));
+  constexpr int level = 3; // compression level; must be between 1 to 22
+
+  size_t sz = ZSTD_compress(buf.data(), buf.size(), input.data(), input.size(),
+                            level);
+  assert(!ZSTD_isError(sz));
+  buf.resize(sz);
+  buf.shrink_to_fit();
+  return buf;
+}
+
+ZstdCompressor::ZstdCompressor(u8 *buf, i64 size) {
+  std::string_view input{(char *)buf, (size_t)size};
+  std::vector<std::string_view> inputs = split(input);
+  shards.resize(inputs.size());
+
+  // Compress each shard
+  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
+    shards[i] = zstd_compress(inputs[i]);
+  });
+
+  compressed_size = 0;
+  for (std::vector<u8> &shard : shards)
+    compressed_size += shard.size();
+}
+
+void ZstdCompressor::write_to(u8 *buf) {
+  // Copy compressed data
+  std::vector<i64> offsets(shards.size());
+  for (i64 i = 1; i < shards.size(); i++)
+    offsets[i] = offsets[i - 1] + shards[i - 1].size();
+
+  tbb::parallel_for((i64)0, (i64)shards.size(), [&](i64 i) {
+    memcpy(&buf[offsets[i]], shards[i].data(), shards[i].size());
+  });
+}
+
+} // namespace mold

config.h.in

@@ -0,0 +1,2 @@
+#define MOLD_VERSION "@mold_VERSION@"
+#define MOLD_LIBDIR "@CMAKE_INSTALL_FULL_LIBDIR@"

demangle.cc

@@ -0,0 +1,51 @@
+#include "mold.h"
+
+#include <cstdlib>
+
+#ifndef _WIN32
+#include <cxxabi.h>
+#endif
+
+#include "third-party/rust-demangle/rust-demangle.h"
+
+namespace mold {
+
+std::string_view demangle(std::string_view name) {
+  static thread_local char *p;
+  if (p)
+    free(p);
+
+  // Try to demangle as a Rust symbol. Since legacy-style Rust symbols
+  // are also valid as a C++ mangled name, we need to call this before
+  // cpp_demangle.
+  p = rust_demangle(std::string(name).c_str(), 0);
+  if (p)
+    return p;
+
+  // Try to demangle as a C++ symbol.
+  if (std::optional<std::string_view> s = cpp_demangle(name))
+    return *s;
+  return name;
+}
+
+std::optional<std::string_view> cpp_demangle(std::string_view name) {
+  static thread_local char *buf;
+  static thread_local size_t buflen;
+
+  // TODO(cwasser): Actually demangle Symbols on Windows using e.g.
+  // `UnDecorateSymbolName` from Dbghelp, maybe even Itanium symbols?
+#ifndef _WIN32
+  if (name.starts_with("_Z")) {
+    int status;
+    char *p = abi::__cxa_demangle(std::string(name).c_str(), buf, &buflen, &status);
+    if (status == 0) {
+      buf = p;
+      return p;
+    }
+  }
+#endif
+
+  return {};
+}
+
+} // namespace mold

dist.sh

@@ -1,198 +1,33 @@
 #!/bin/bash
+# This script creates a mold binary distribution. The output is
+# written in this directory as `mold-$version-$arch-linux.tar.gz`
+# (e.g. `mold-1.0.3-x86_64-linux.tar.gz`).
 #
-# This script creates a mold binary distribution. The output is written to
-# the `dist` directory as `mold-$version-$arch-linux.tar.gz` (e.g.
-# `mold-2.42.0-x86_64-linux.tar.gz`).
-#
-# This script aims to produce reproducible outputs. The container images,
-# Rust toolchain, Cargo dependencies and file timestamps are pinned so that
-# the same git commit can produce a bit-for-bit identical binary file. This
-# property serves as a strong safeguard against supply chain attacks. With
-# a reproducible build, anyone can independently verify that the binary
-# files published on our GitHub release page were built from the git commit
-# tagged for release by rebuilding the binaries themselves.
-#
-# Debian provides snapshot.debian.org to host all historical binary
-# packages. Distro package repositories must be pinned as well as the base
-# image before a build is fully reproducible. The loongarch64 build still
-# uses the live Debian sid repository, so it does not yet have that property.
-#
-# The mold executable created by this script is dynamically linked to the
-# system C runtime and other standard system libraries. We can't statically
-# link glibc because doing so would disable dlopen(), which is required to
-# load the LTO linker plugin.
-#
-# We use a reasonably old Debian version for the build environment because
-# a binary dynamically linked against a newer version of glibc won't work
-# on a system with an older version of glibc.
-#
-# The Rust toolchain is downloaded from the official Rust distribution
-# site. Its version and SHA-256 hash are recorded below, so the toolchain
-# is another pinned build input.
-#
-# This script can be used to create non-native binaries (e.g., building
-# aarch64 binary on x86-64) because Podman automatically runs everything
-# under QEMU if the container image is not native. To use this script for
-# non-native builds, you may need to install the qemu-user-static package.
+# The mold executable created by this script is statically-linked to
+# libstdc++ and libcrypto but dynamically-linked to libc, libm, libz
+# and librt, as they almost always exist on any Linux systems.
 
-set -e -x
-cd "$(dirname "$0")"
-
-# The executable embeds the hash of the Git commit it is built from, and
-# the commit's timestamp is used as the file timestamp, so this script
-# must run in a Git clone. A worktree doesn't work either because its
-# `.git` file refers to a directory outside the build container.
-if [ ! -d .git ]; then
-  echo "$0: must be run in a Git clone of mold" >&2
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 [ x86_64 | aarch64 | arm | ppc64le | s390x ]"
   exit 1
 fi
 
-usage() {
-  echo "Usage: $0 [ x86_64 | aarch64 | arm | riscv64 | ppc64le | s390x | loongarch64 ]"
-  exit 1
-}
+arch=$1
+echo $arch | grep -Eq '^(x86_64|aarch64|arm|ppc64le|s390x)$' || \
+  { echo "Error: no docker image for $arch"; exit 1; }
 
-case $# in
-0)
-  arch=$(uname -m)
-  if [ "$arch" = arm64 ]; then
-    arch=aarch64
-  elif [[ "$arch" = arm* ]]; then
-    arch=arm
-  fi
-  ;;
-1)
-  arch=$1
-  ;;
-*)
-  usage
-  ;;
-esac
-
-rust_version=1.97.1
-
-# Switch to the pinned snapshot.debian.org sources that the Debian images
-# ship commented out; the live mirrors no longer carry every architecture.
-apt_setup="sed -i -e '/^deb/d' -e 's/^# deb /deb /g' /etc/apt/sources.list"
-
-case $arch in
-x86_64)
-  # Debian 9 (Stretch) released in June 2017.
-  #
-  # We use a Google-provided mirror (mirror.gcr.io) instead of the official
-  # Docker Hub (docker.io) because docker.io has a strict rate limit policy.
-  base_image=mirror.gcr.io/library/debian:stretch@sha256:c5c5200ff1e9c73ffbf188b4a67eb1c91531b644856b4aefe86a58d2f0cb05be
-  rust_target=x86_64-unknown-linux-gnu
-  rust_sha256=b4cdbc7cc6b0ee0a2666b1872769fdb2ad8393b28b63952f6493b4b400e4832b
-  ;;
-aarch64)
-  # Debian 11 (Bullseye) released in August 2021.
-  base_image=mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
-  rust_target=aarch64-unknown-linux-gnu
-  rust_sha256=2f2496c70bd336a66a4c8baf2d303ba161f3552f192444c3639ba903c7c1e2c5
-  ;;
-arm)
-  # Debian 11 (Bullseye) released in August 2021.
-  base_image=mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
-  rust_target=armv7-unknown-linux-gnueabihf
-  rust_sha256=e89c5e33aaddc6ef56857000c9117875c2997e9a1a500bd7b16277c9874b002f
-  ;;
-riscv64)
-  base_image=mirror.gcr.io/riscv64/debian:unstable-20240926@sha256:25654919c2926f38952cdd14b3300d83d13f2d820715f78c9f4b7a1d9399bf48
-  apt_setup="sed -i -e '/^URIs/d' -e 's/^# http/URIs: http/' /etc/apt/sources.list.d/debian.sources"
-  rust_target=riscv64gc-unknown-linux-gnu
-  rust_sha256=59bec35d8febb2ab918fa41cffbaa5b07146a63bdc33f029ff756d70a3151ece
-  ;;
-ppc64le)
-  # Debian 11 (Bullseye) released in August 2021.
-  base_image=mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
-  rust_target=powerpc64le-unknown-linux-gnu
-  rust_sha256=ff524eef5a59d801df09ccad5cdaf9ea1f0a07d75cbed2a7e9f013a9eb76a3c1
-  ;;
-s390x)
-  # Debian 11 (Bullseye) released in August 2021.
-  base_image=mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
-  rust_target=s390x-unknown-linux-gnu
-  rust_sha256=808268af9e880d41b8cb32b242e38c9bd3ea7aba6409b02fbffa0fbc5370c538
-  ;;
-loongarch64)
-  base_image=mirror.gcr.io/loongarch64/debian:sid@sha256:0356df4e494bbb86bb469377a00789a5b42bbf67d5ff649a3f9721b745cbef77
-  apt_setup="echo 'deb http://deb.debian.org/debian sid main' > /etc/apt/sources.list"
-  rust_target=loongarch64-unknown-linux-gnu
-  rust_sha256=d5a925962854730ae7641420d8337af93988ea4ff47b503a856ec53776c87841
-  ;;
-*)
-  usage
-  ;;
-esac
-
-# Create a Podman image containing the native C tools and a pinned Rust
-# toolchain. The downloaded archive is checked before it is unpacked.
-image=mold-rust-builder-$arch
-archive=rust-$rust_version-$rust_target.tar.gz
-
-podman build --arch "$arch" -t "$image" - <<EOF
-FROM $base_image
-ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN $apt_setup && \
-  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
-  apt-get update && \
-  apt-get install -y --no-install-recommends build-essential ca-certificates git wget && \
-  rm -rf /var/lib/apt/lists
-RUN mkdir /tmp/rust && \
-  cd /tmp/rust && \
-  wget --progress=dot:mega https://static.rust-lang.org/dist/$archive && \
-  echo '$rust_sha256 $archive' | sha256sum -c && \
-  tar xf $archive && \
-  ./${archive%.tar.gz}/install.sh --prefix=/usr/local --disable-ldconfig && \
-  cd / && \
-  rm -rf /tmp/rust
-EOF
-
-version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml)
+version=$(sed -n 's/^project(mold VERSION \(.*\))/\1/p' $(dirname $0)/CMakeLists.txt)
 dest=mold-$version-$arch-linux
+set -e -x
 
-# We use the timestamp of the last Git commit as the file timestamp
-# for build artifacts.
-timestamp=$(git log -1 --format=%ct)
-
-# `uname -m` in an ARM32 container running on an ARM64 host reports it
-# not as ARM32 but as ARM64. Keep the reported machine consistent with
-# the ARM32 userspace for any build tool that inspects it.
-setarch=
-[ "$arch" = arm ] && setarch='setarch linux32'
-
-mkdir -p dist "target/dist-vendor-$arch"
-
-# Cargo verifies registry packages against the checksums in Cargo.lock and
-# checks out Git dependencies at the commit recorded there. Vendor them in a
-# separate networked step so that the actual build can run without a network.
-# Cargo's own cache is a tmpfs because the libgit2 inside a 32-bit cargo can't
-# read a bind-mounted ext4 directory (readdir fails with EOVERFLOW under QEMU).
-podman run --arch "$arch" -it --rm --userns=host --pids-limit=-1 \
-  --pull=never --env CARGO_HOME=/cargo --tmpfs /cargo -v "$(pwd):/mold:ro" \
-  -v "$(pwd)/target/dist-vendor-$arch:/vendor" "$image" $setarch \
-  bash -c 'cd /mold && cargo vendor --locked /vendor/sources > /vendor/config.toml'
-
-# Build mold in a container.
-#
-# SOURCE_DATE_EPOCH is a standardized environment variable that allows
-# build artifacts to appear as if they were built at a specific time.
-# Fixed source, vendor and target paths keep embedded build paths stable.
-podman run --arch "$arch" -it --rm --userns=host --pids-limit=-1 --network=none \
-  --pull=never --env SOURCE_DATE_EPOCH="$timestamp" --env DEST="$dest" \
-  -v "$(pwd):/mold:ro" -v "$(pwd)/dist:/dist" \
-  -v "$(pwd)/target/dist-vendor-$arch:/vendor:ro" "$image" \
-  $setarch bash -c '
-set -e
-export CARGO_TARGET_DIR=/build/target
-cd /mold
-cargo build --release --frozen --config /vendor/config.toml --package mold-cli
-stage=/build/$DEST
-DESTDIR=/build PREFIX=/$DEST ./install-mold.sh
-strip --strip-unneeded "$stage/bin/mold" "$stage/lib/mold/mold-wrapper.so"
-find "$stage" -print | xargs touch --no-dereference --date="@$SOURCE_DATE_EPOCH"
-cd /build
-find "$DEST" -print | sort | tar -cf - --no-recursion --files-from=- | gzip -9nc > "/dist/$DEST.tar.gz"
-sha256sum "/dist/$DEST.tar.gz"
-'
+docker run --platform linux/$arch -it --rm -v "$(pwd):/mold" \
+  -e "OWNER=$(id -u):$(id -g)" rui314/mold-builder:latest \
+  bash -c "mkdir /tmp/build &&
+cd /tmp/build &&
+cmake -DCMAKE_C_COMPILER=gcc-10 -DCMAKE_CXX_COMPILER=g++-10 -DMOLD_MOSTLY_STATIC=On -DCMAKE_BUILD_TYPE=Release /mold &&
+cmake --build . -j\$(nproc) &&
+[ $arch = arm ] || ctest -j\$(nproc) &&
+cmake --install . --prefix $dest --strip &&
+tar czf /mold/$dest.tar.gz $dest &&
+cp mold mold-wrapper.so /mold &&
+chown \$OWNER /mold/mold /mold/mold-wrapper.so /mold/$dest.tar.gz"

docs/bugs.md

@@ -0,0 +1,150 @@
+This is a note about interesting bugs that I met during the
+development of the mold linker.
+
+## GNU IFUNC
+
+Problem: A statically-linked "hello world" program mysteriously
+crashed in `__libc_start_main` function which is called just after
+`_start`.
+
+Investigation: I opened up gdb and found that the program reads a
+bogus value from some array. It looks like `memcpy` failed to copy
+proper data there.  After some investigation, I noticed that `memcpy`
+did't copy data at all but instead returned the address of
+`__memcpy_avx_unaligned` function, which is a real `memcpy` function
+optimized for machines with the AVX registers.
+
+This odd issue was caused by the GNU IFUNC mechanism.  That is, if a
+function symbol has type `STT_GNU_IFUNC`, the function does not do
+what its name suggests to do but instead returns a pointer to a
+function that does the actual job. In this case, `memcpy` is an IFUNC
+function, and it returns an address of `__memcpy_avx_unaligned` which
+is a real `memcpy` function.
+
+IFUNC function addresses are stored to `.got` section in an ELF
+executable.  The dynamic loader executes all IFUNC functions at
+startup to replace their GOT entries with their return values. This
+mechanism allows programs to choose the best implementation among
+variants of the same function at runtime based on the machine info.
+
+If a program is statically-linked, there's no dynamic loader that
+rewrites the GOT entries. Therefore, if a program is
+statically-linked, a libc's startup routine does that on behalf of the
+dynamic loader. Concretely, a startup routine interprets all dynamic
+relocations between `__rela_iplt_start` and `__rela_iplt_stop`
+symbols.  It is linker's responsibility to emit dynamic relocations
+for IFUNC symbols even if it is linking a statically-linked program
+and mark the beginning and the ending of a `.rela.dyn` section with
+the symbols, so that the startup routine can find the relocations.
+
+The bug was my linker didn't define `__rela_iplt_start` and
+`__rela_iplt_stop` symbols. Since these symbols are weak, they are
+initialized to zero. From the point of the initializer function,
+there's no dynamic relocations between `__rela_iplt_start` and
+`__rela_iplt_stop` symbols. That left GOT entries for IFUNC symbols
+untouched.
+
+The proper fix was to emit dynamic relocations for IFUNC symbols and
+define the linker-synthesized symbols. I did that, and the bug was
+fixed.
+
+## stdio buffering
+
+Problem: A statically-linked "Hello world" program prints out the
+message if executed as `./hello`, but it doesn't output anything if
+executed as `./hello | cat`.
+
+Investigation: I knew that the default buffering mode for stdout is
+line buffering (buffer is flushed on every '\n'), but if it is not
+connected to the terminal (i.e. `isatty(2)` returns 0 on
+`STDOUT_FILENO`), it automatically switches to full buffering (buffer
+is flushed when it becomes full). So, it looks like libc failed to
+flush the stdout on program exit for some reason.
+
+I traced all function calls using gdb and noticed that `__libc_atexit`
+was not called. That function seemed to be responsible for buffer
+flushing. I don't know how exactly I found the root cause, but after
+spending an hour or two, I found that `__start___libc_atexit` and
+`__stop___libc_atexit` have value 0 in my linker's output while they
+mark a section containing the address of `__libc_atexit` in GNU ld's
+output.
+
+So, libc doesn't directly call `__libc_atexit` but instead call all
+function pointers between `__start___libc_atexit` and
+`__stop___libc_atexit` symbols. libc puts `__libc_atexit` address in
+`_libc_atexit` section, expecting that the linker automatically
+creates the start and the end marker symbols for the section.
+
+There's an obscure linker feature: if a section name is valid as a C
+identifier (e.g. `foo` or `_foo_bar` but not `.foo`), the linker
+automatically creates marker symbols by prepending `__start_` and
+`__stop_` to the section name. My linker lacked the feature.
+
+I implemented the feature, and the bug was fixed.
+
+## TLS variable initialization
+
+Problem: A statically-linked "hello world" program crashes after
+reading a thread-local variable.
+
+Investigation: Thread-local variables are very different from other
+types of varaibles because there may be more than one instance of the
+same variable in memory. Each thread has its copy of thread-local
+varaibles. `%fs` segment register points the end of the variable area
+for the current thread, and the variables are accessed as an offset
+from `%fs`.
+
+Thread-local variables may be initialized (e.g. `thread_local int x =
+5;`). The linker gathers all thread-local variables and put them into
+`PT_TLS` segment. At runtime, the contents of the segment is used as
+an "initialization image" for new threads. When a new thread is
+created, the image is memcpy'ed to the new thread's thread-local
+variable area. The initialization image itself is read-only at
+runtime.
+
+It took more than a day to find out that memcpy copies the
+initialization image to a different place than the thread-local
+variables reside. That means, thread-local variables had garbage as
+initial values, and the program crashed when using them.
+
+The problem is that I set a very large value (4096) to the alignment
+of `PT_TLS` segment. All `PT_LOAD` segments are naturally aligned to
+the page boundary, so I use the same value for `PT_TLS`, but that was
+a mistake. When a thread initialization routine sets a value to `%fs`,
+it first aligns the end of the thread-local variable area address to
+`PT_TLS` alignment value. So, if you set a large value to `PT_TLS`
+alignment, `%fs` is set to a wrong place.
+
+I fixed `PT_TLS` alignment, and the bug was gone.
+
+## stdio buffering (another issue)
+
+I noticed that a dynamically-linked "hello world" program didn't
+flush its stdout buffer on exit. The cause of the problem was that the
+executable had more than one DT_NEEDED entry for `libc.so`.
+
+DT_NEEDED entries in `.dynamic` section specify a list of shared
+object file names which need to be linked at runtime. I added one
+DT_NEEDED entry for each library specified with the `-l` option.
+The pitfall is, unlike object files, libraries are allowed to
+appear more than once in a command line, and the linker has to
+de-duplicate them before processing. Adding more than one DT_NEEDED
+entry for the same shared object causes mysterious issues like this.
+
+# Copy relocations and symbol aliases
+
+environ, _environ and __environ point to the same location in libc.so,
+so when we create a copy relocation for one of the symbols, we need to
+do that for all of them. Otherwise, they'll end up pointing to different
+places which causes a very mysterious issue.
+
+# DT_DEBUG and gdb
+
+If you forget to add an entry with type DT_DEBUG to .dynamic, gdb's
+`info sharedlibrary` command doesn't print out a list of shared
+libraries loaded to memory. The value of the entry doesn't matter, so
+it can be just zero. The existence of it is important.
+
+#
+
+__EH_FRAME_BEGIN__ in libgcc/crtstuff.c

docs/coding-guidelines.md

@@ -0,0 +1,46 @@
+# Coding Guidelines
+
+mold is written in C++20, but as is the case with every C++ project,
+it has local coding rules. In this document, I'll explain some of them
+and try to give justifications for why I chose such rules.
+
+## DOs
+
+- Always use `i64` (which is a type alias for `int64_t` in mold) for
+  integers unless you have a reason not to. For example, even if you know
+  that a loop counter won't exceed 100, you should stop thinking about it
+  and just use `i64`.
+
+  Justification: Local variables are usually on CPU registers, so on
+  64-bit CPUs, there's no performance peanlty on choosing `i64` over
+  `i32`. Even if a compiler has to spill register values to the stack,
+  I don't think there's an observable difference between `i32` and
+  `i64`. Therefore, extra 32 bits are essentially free. On 32-bit CPUs,
+  they are not free, but that's OK because we are writing mold for modern
+  computers. mold will still run on 32-bit computers but a bit slowly.
+
+  By always using `i64`, we can eliminate the need to think about the
+  "right" size for each variable. It also reduces the risk of integer
+  overflow.
+
+  Exceptions: If you have to allocate a very large number (e.g. millions)
+  of the same object, its size matters. In that case, use a smaller type.
+
+## DON'Ts
+
+- Don't use `auto` unless its actual type is obvious in the very narrow
+  context. Currently, we use `auto` only for lambdas.
+
+  Justification: I think `auto` makes code writing easier but code reading
+  harder, because readers have to make a guess as to what is the actual
+  type of `auto`. If you are already familiar with the existing codebase,
+  you may be able to guess it easily, but that's not always the case.
+  I want to keep the mold codebase friendly to first-time readers.
+
+- Don't over-use inheritance. In mold, most classes don't have parents,
+  and even if they do, their class hierarchy is very shallow. Currently
+  its height is just two (i.e. abstract classes and their implementations).
+
+  Justification: Designing class hierarchies is fun as it feels like
+  taxonomy, but I don't think that always help writing code. It looks like
+  simpler class hierarchy makes its code simpler.

docs/design.md

@@ -0,0 +1,486 @@
+## Design and implementation of mold
+
+For the rest of this documentation, I'll explain the design and the
+implementation of mold. If you are only interested in using mold, you
+don't need to read the below.
+
+### Motivation
+
+Here is why I'm writing a new linker:
+
+- Even though lld has significantly improved the situation, linking is
+  still one of the slowest steps in a build. It is especially
+  annoying when I changed one line of code and had to wait for a few
+  seconds or even more for a linker to complete. It should be
+  instantaneous. There's a need for a faster linker.
+
+- The number of cores on a PC has increased a lot lately, and this
+  trend is expected to continue. However, the existing linkers can't
+  take the advantage of the trend because they don't scale well for more
+  cores. I have a 64-core/128-thread machine, so my goal is to create
+  a linker that uses the CPU nicely. mold should be much faster than
+  other linkers on 4 or 8-core machines too, though.
+
+- It looks to me that the designs of the existing linkers are somewhat
+  too similar, and I believe there are a lot of drastically different
+  designs that haven't been explored yet. Developers generally don't
+  care about linkers as long as they work correctly, and they don't
+  even think about creating a new one. So there may be lots of low
+  hanging fruits there in this area.
+
+### Basic design
+
+- In order to achieve a `cp`-like performance, the most important
+  thing is to fix the layout of an output file as quickly as possible, so
+  that we can start copying actual data from input object files to an
+  output file as soon as possible.
+
+- Copying data from input files to an output file is I/O-bounded, so
+  there should be room for doing computationally-intensive tasks while
+  copying data from one file to another.
+
+- We should allow the linker to preload object files from disk and
+  parse them in memory before a complete set of input object files
+  is ready. To do so, we need
+  to split the linker into two in such a way that the latter half of
+  the process finishes as quickly as possible by speculatively parsing
+  and preprocessing input files in the first half of the process.
+
+- One of the most computationally-intensive stage among linker stages
+  is symbol resolution. To resolve symbols, we basically have to throw
+  all symbol strings into a hash table to match undefined symbols with
+  defined symbols. But this can be done in the preloading stage using
+  [string interning](https://en.wikipedia.org/wiki/String_interning).
+
+- Object files may contain a special section called a mergeable string
+  section. The section contains lots of null-terminated strings, and
+  the linker is expected to gather all mergeable string sections and
+  merge their contents. So, if two object files contain the same
+  string literal, for example, the resulting output will contain a
+  single merged string. This step is computationally intensive, but string
+  merging can be done in the preloading stage using string interning.
+
+- Static archives (.a files) contain object files, but the static
+  archive's string table contains only defined symbols of member
+  object files and lacks other types of symbols. That makes static
+  archives unsuitable for speculative parsing. Therefore, the linker
+  should ignore the symbol table of static archive and directly read
+  static archive members.
+
+- If there's a relocation that uses a GOT of a symbol, then we have to
+  create a GOT entry for that symbol. Otherwise, we shouldn't. That
+  means we need to scan all relocation tables to fix the length and
+  the contents of a .got section. This is computationally intensive,
+  but this step is parallelizable.
+
+### Linker Script
+
+Linker script is an embedded language for the linker. It is mainly
+used to control how input sections are mapped to output sections and
+the layout of the output, but it can also do a lot of tricky stuff.
+Its feature is useful especially for embedded programming, but it's
+also an awfully underdocumented and complex language.
+
+We have to implement a subset of the linker script language anwyay,
+because on Linux, /usr/lib/x86_64-linux-gnu/libc.so is (despite its
+name) not a shared object file but actually an ASCII file containing
+linker script code to load the _actual_ libc.so file. But the feature
+set for this purpose is very limited, and it is okay to implement them
+to mold.
+
+Besides that, we really don't want to implement the linker script
+language. But at the same time, we want to satisfy the user needs that
+are currently satisfied with the linker script language. So, what
+should we do? Here is my observation:
+
+- Linker script allows doing a lot of tricky stuff, such as specifying
+  the exact layout of a file, inserting arbitrary bytes between
+  sections, etc. But most of them can be done with a post-link binary
+  editing tool (such as `objcopy`).
+
+- It looks like there are two things that truly cannot be done by a
+  post-link editing tool: (a) mapping input sections to output
+  sections, and (b) applying relocations.
+
+From the above observation, I believe we need to provide only the
+following features instead of the entire linker script language:
+
+- A method to specify how input sections are mapped to output
+  sections, and
+
+- a method to set addresses to output sections, so that relocations
+  are applied based on desired addresses.
+
+I believe everything else can be done with a post-link binary editing
+tool.
+
+### Details
+
+- As we aim to the 1-second goal for Chromium, every millisecond
+  counts. We can't ignore the latency of process exit. If we mmap a
+  lot of files, \_exit(2) is not instantaneous but takes a few hundred
+  milliseconds because the kernel has to clean up a lot of
+  resources. As a workaround, we should organize the linker command as
+  two processes; the first process forks the second process, and the
+  second process does the actual work. As soon as the second process
+  writes a result file to a filesystem, it notifies the first process,
+  and the first process exits. The second process can take time to
+  exit, because it is not an interactive process.
+
+- At least on Linux, it looks like the filesystem's performance to
+  allocate new blocks to a new file is the limiting factor when
+  creating a new large file and filling its contents using mmap.
+  If you already have a large file in the buffer cache, writing to it is
+  much faster than creating a new fresh file and writing to it.
+  Based on this observation, mold overwrites to an existing
+  executable file if exists. My quick benchmark showed that I could
+  save 300 milliseconds when creating a 2 GiB output file.
+  Linux doesn't allow to open an executable for writing if it is
+  running (you'll get a "text busy" error if you attempt). mold
+  falls back to the usual way if it fails to open an output file.
+
+- The output from the linker should be deterministic for the sake of
+  [build reproducibility](https://en.wikipedia.org/wiki/Reproducible_builds)
+  and ease of debugging. This might add a little bit of overhead to
+  the linker, but that shouldn't be too much.
+
+- A .build-id, a unique ID embedded to an output file, is usually
+  computed by applying a cryptographic hash function (e.g. SHA-1) to
+  an output file. This is a slow step, but we can speed it up by
+  splitting a file into small chunks, computing SHA-1 for each chunk,
+  and then computing SHA-1 of the concatenated SHA-1 hashes
+  (i.e. constructing a [Merkle
+  Tree](https://en.wikipedia.org/wiki/Merkle_tree) of height 2).
+  Modern x86 processors have purpose-built instructions for SHA-1 and
+  can compute SHA-1 pretty quickly at about 2 GiB/s. Using 16
+  cores, a build-id for a 2 GiB executable can be computed in 60 to 70
+  milliseconds.
+
+- BFD, gold, and lld support section garbage collection. That is, a
+  linker runs a mark-sweep garbage collection on an input graph, where
+  sections are vertices and relocations are edges, to discard all
+  sections that are not reachable from the entry point symbol
+  (i.e. `_start`) or a few other root sections. In mold, we are using
+  multiple threads to mark sections concurrently.
+
+- Similarly, BFD, gold an lld support Identical Comdat Folding (ICF)
+  as yet another size optimization. ICF merges two or more read-only
+  sections that happen to have the same contents and relocations.
+  To do that, we have to find isomorphic subgraphs from larger graphs.
+  I implemented a new algorithm for mold, which is 5x faster than lld
+  to do ICF for Chromium (from 5 seconds to 1 second).
+
+- [Intel Threading Building
+  Blocks](https://github.com/oneapi-src/oneTBB) (TBB) is a good
+  library for parallel execution and has several concurrent
+  containers. We are particularly interested in using
+  `parallel_for_each` and `concurrent_hash_map`.
+
+- TBB provides `tbbmalloc` which works better for multi-threaded
+  applications than the glib'c malloc, but it looks like
+  [jemalloc](https://github.com/jemalloc/jemalloc) and
+  [mimalloc](https://github.com/microsoft/mimalloc) are a little bit
+  more scalable than `tbbmalloc`.
+
+### Size of the problem
+
+When linking Chrome, a linker reads 3,430,966,844 bytes of data in
+total. The data contains the following items:
+
+| Data item                | Number
+| ------------------------ | ------
+| Object files             | 30,723
+| Public undefined symbols | 1,428,149
+| Mergeable strings        | 1,579,996
+| Comdat groups            | 9,914,510
+| Regular sections¹        | 10,345,314
+| Public defined symbols   | 10,512,135
+| Symbols                  | 23,953,607
+| Sections                 | 27,543,225
+| Relocations against SHF_ALLOC sections | 39,496,375
+| Relocations              | 62,024,719
+
+¹ Sections that have to be copied from input object files to an
+output file. Sections that contain relocations or symbols are for
+example excluded.
+
+### Internals
+
+In this section, I'll explain the internals of mold linker.
+
+#### A brief history of Unix and the Unix linker
+
+Conceptually, what a linker does is pretty simple. A compiler compiles
+a fragment of a program (a single source file) into a fragment of
+machine code and data (an object file, which typically has the .o
+extension), and a linker stitches them together into a single
+executable or a shared library image.
+
+In reality, modern linkers for Unix-like systems are much more
+complicated than the naive understanding because they have gradually
+gained one feature at a time over the 50 years history of Unix, and
+they are now something like a bag of lots of miscellaneous features in
+which none of the features is more important than the others. It is
+very easy to miss the forest for the trees, since for those who don't
+know the details of the Unix linker, it is not clear which feature is
+essential and which is not.
+
+That being said, one thing is clear that at any point of Unix history,
+a Unix linker has a coherent feature set for the Unix of that age. So,
+let me entangle the history to see how the operating system, runtime,
+and linker have gained features that we see today. That should give
+you an idea of why a particular feature has been added to a linker in the
+first place.
+
+1. Original Unix didn't support shared libraries, and a program was
+   always loaded to a fixed address. An executable was something like
+   a memory dump that was just loaded to a particular address by the
+   kernel. After loading, the kernel started executing the program by
+   setting the instruction pointer to a particular address.
+
+   The most essential feature for any linker is relocation processing.
+   The original Unix linker of course supported that. Let me explain
+   what that is.
+
+   Individual object files are inevitably incomplete as a program,
+   because when a compiler created them, it only see a part of an
+   entire program. For example, if an object file contains a function
+   call that refers to another object file, the `call` instruction in the
+   object cannot be complete, as the compiler has no idea as to what
+   is the called function's address. To deal with this, the compiler
+   emits a placeholder value (typically just zero) instead of a real
+   address and leaves metadata in an object file saying "fix offset X
+   of this file with an address of Y". That metadata is called
+   "relocation". Relocations are typically processed by the linker.
+
+   It is easy for a linker to apply relocations for the original Unix
+   because a program is always loaded to a fixed address. It exactly
+   knows the addresses of all functions and data when linking a
+   program.
+
+   Static library support, which is still an important feature of Unix
+   linker, also dates back to this early period of Unix history.
+   To understand what it is, imagine that you are trying to compile
+   a program for the early Unix. You don't want to waste time to
+   compile libc functions every time you compile your program (the
+   computers of the era were incredibly slow), so you have already
+   placed each libc function into a separate source file and compiled
+   them individually. That means you have object files for each libc
+   function, e.g., printf.o, scanf.o, atoi.o, write.o, etc.
+
+   Given this configuration, all you have to do to link your program
+   against libc functions is to pick up the right set of libc object
+   files and give them to the linker along with the object files of your
+   program. But, keeping the linker command line in sync with the
+   libc functions you are using in your program is bothersome. You can
+   be conservative; you can specify all libc object files to the
+   command line, but that leads to program bloat because the linker
+   unconditionally link all object files given to it no matter whether
+   they are used or not. So, a new feature was added to the linker to
+   fix the problem. That is the static library, which is also called
+   the archive file.
+
+   An archive file is just a bundle of object files, just like zip
+   file but in an uncompressed form. An archive file typically has the
+   .a file extension and named after its contents. For example, the
+   archive file containing all libc objects is named `libc.a`.
+
+   If you pass an archive file along with other object files to the
+   linker, the linker pulls out an object file from the archive _only
+   when_ it is referenced by other object files. In other words,
+   unlike object files directly given to a linker, object files
+   wrapped in an archive are not linked to the output by default.
+   An archive works as a supplement to complete your program.
+
+   Even today, you can still find a libc archive file. Run `ar t
+   /usr/lib/x86_64-linux-gnu/libc.a` on Linux should give you a list
+   of object files in the libc archive.
+
+2. In the '80s, Sun Microsystems, a leading commercial Unix vendor at the
+   time, added shared library support to their Unix variant, SunOS.
+
+(This section is incomplete.)
+
+### Concurrency strategy
+
+In this section, I'll explain the high-level concurrency strategy of
+mold.
+
+In most places, mold adopts data parallelism. That is, we have a huge
+number of pieces of data of the same kind, and we process each of them
+individually using parallel for-loop. For example, after identifying
+the exact set of input object files, we need to scan all relocation
+tables to determine the sizes of .got and .plt sections. We do that
+using a parallel for-loop. The granularity of parallel processing in
+this case is the relocation table.
+
+Data parallelism is very efficient and scalable because there's no
+need for threads to communicate with each other while working on each
+element of data. In addition to that, data parallelism is easy to
+understand, as it is just a for-loop in which multiple iterations may
+be executed in parallel. We don't use high-level communication or
+synchronization mechanisms such as channels, futures, promises,
+latches or something like that in mold.
+
+In some cases, we need to share a little bit of data between threads
+while executing a parallel for-loop. For example, the loop to scan
+relocations turns on "requires GOT" or "requires PLT" flags in a
+symbol. Symbol is a shared resource, and writing to them from multiple
+threads without synchronization is unsafe. To deal with it, we made
+the flag an atomic variable.
+
+The other common pattern you can find in mold which is build on top of
+the parallel for-loop is the map-reduce pattern. That is, we run a
+parallel for-loop on a large data set to produce a small data set and
+process the small data set with a single thread. Let me take a
+build-id computation as an example. Build-id is typically computed by
+applying a cryptographic hash function such as SHA-1 on a linker's
+output file. To compute it, we first consider an output as a sequence
+of 1 MiB blocks and compute a SHA-1 hash for each block in parallel.
+Then, we concatenate the SHA-1 hashes and compute a SHA-1 hash on the
+hashes to get a final build-id.
+
+Finally, we use concurrent hashmap at a few places in mold. Concurrent
+hashmap is a hashmap to which multiple threads can safely insert items
+in parallel. We use it in the symbol resolution stage, for example.
+To resolve symbols, we basically have to throw in all defined symbols
+into a hash table, so that we can find a matching defined symbol for
+an undefined symbol by name. We do the hash table insertion from a
+parallel for-loop which iterates over a list of input files.
+
+Overall, even though mold is highly scalable, it succeeded to avoid
+complexties you often find in complex parallel programs. From high
+level, mold just serially executes the linker's internal passes one by
+one. Each pass is parallelized using parallel for-loops.
+
+### Rejected ideas
+
+In this section, I'll explain the alternative designs I currently do
+not plan to implement and why I turned them down.
+
+- Placing variable-length sections at end of an output file and start
+  copying file contents before fixing the output file layout
+
+  Idea: Fixing the layout of regular sections seems easy, and if we
+  place them at beginning of a file, we can start copying their
+  contents from their input files to an output file. While copying
+  file contents, we can compute the sizes of variable-length sections
+  such as .got or .plt and place them at end of the file.
+
+  Reason for rejection: I did not choose this design because I doubt
+  if it could actually shorten link time and I think I don't need it
+  anyway.
+
+  The linker has to de-duplicate comdat sections (i.e. inline
+  functions that are included in multiple object files), so we
+  cannot compute the layout of regular sections until we resolve all
+  symbols and de-duplicate comdats. That takes a few hundred
+  milliseconds. After that, we can compute the sizes of
+  variable-length sections in less than 100 milliseconds. It's quite
+  fast, so it doesn't seem to make much sense to proceed without
+  fixing the final file layout.
+
+  The other reason to reject this idea is because there's good a
+  chance for this idea to have a negative impact on linker's overall
+  performance. If we copy file contents before fixing the layout, we
+  can't apply relocations to them while copying because symbol
+  addresses are not available yet. If we fix the file layout first, we
+  can apply relocations while copying, which is effectively zero-cost
+  due to a very good data locality. On the other hand, if we apply
+  relocations long after we copy file contents, it's pretty expensive
+  because section contents are very likely to have been evicted from
+  CPU cache.
+
+- Incremental linking
+
+  Idea: Incremental linking is a technique to patch a previous linker's
+  output file so that only functions or data that are updated from the
+  previous build are written to it. It is expected to significantly
+  reduce the amount of data copied from input files to an output file
+  and thus speed up linking. GNU BFD and gold linkers support it.
+
+  Reason for rejection: I turned it down because it (1) is
+  complicated, (2) doesn't seem to speed it up that much and (3) has
+  several practical issues. Let me explain each of them.
+
+  First, incremental linking for real C/C++ programs is not as easy as
+  one might think. Let me take malloc as an example. malloc is usually
+  defined by libc, but you can implement it in your program, and if
+  that's the case, the symbol `malloc` will be resolved to your
+  function instead of the one in libc. If you include a library that
+  defines malloc (such as libjemalloc or libtbbmallc) before libc,
+  their malloc will override libc's malloc.
+
+  Assume that you are using a nonstandard malloc. What if you remove
+  your malloc from your code, or remove `-ljemalloc` from your
+  Makefile? The linker has to include a malloc from libc, which may
+  include more object files to satisfy its dependencies. Such code
+  change can affect the entire program rather than just replacing one
+  function. The same is true for adding malloc to your program. Making
+  a local change doesn't necessarily result in a local change in the
+  binary level.  It can easily have cascading effects.
+
+  Some ELF fancy features make incremental linking even harder to
+  implement. Take the weak symbol as an example. If you define `atoi`
+  as a weak symbol in your program, and if you are not using `atoi`
+  at all in your program, that symbol will be resolved to address
+  0. But if you start using some libc function that indirectly calls
+  `atoi`, then `atoi` will be included in your program, and your weak
+  symbol will be resolved to that function. I don't know how to
+  efficiently fix up a binary for this case.
+
+  This is a hard problem, so existing linkers don't try too hard to
+  solve it. For example, IIRC, gold falls back to full link if any
+  function is removed from a previous build. If you want to not annoy
+  users in the fallback case, you need to make full link fast anyway.
+
+  Second, incremental linking itself has an overhead. It has to detect
+  updated files, patch an existing output file and write additional
+  data to an output file for future incremental linking. GNU gold, for
+  instance, takes almost 30 seconds on my machine to do a null
+  incremental link (i.e. no object files are updated from a previous
+  build) for chrome. It's just too slow.
+
+  Third, there are other practical issues in incremental linking. It's
+  not reproducible, so your binary isn't going to be the same as other
+  binaries even if you are compiling the same source tree using the
+  same compiler toolchain. Or, it is complex and there might be a bug
+  in it. If something doesn't work correctly, "remove --incremental
+  from your Makefile and try again" could be a piece of advice, but
+  that isn't ideal.
+
+  So, all in all, incremental linking is tricky. I wanted to make full
+  link as fast as possible, so that we don't have to think about how
+  to work around the slowness of full link.
+
+- Defining a completely new file format and use it
+
+  Idea: Sometimes, the ELF file format itself seems to be a limiting
+  factor in improving the linker's performance. We might be able to make a
+  far better one if we create a new file format.
+
+  Reason for rejection: I rejected the idea because it apparently has
+  a practical issue (backward compatibility issue) and also doesn't
+  seem to improve the performance of linkers that much. As clearly
+  demonstrated by mold, we can create a fast linker for ELF. I believe
+  ELF isn't that bad, after all. The semantics of the existing Unix
+  linkers, such as the name resolution algorithm or the linker script,
+  have slowed the linkers down, but that's not a problem of the file
+  format itself.
+
+- Watching object files using inotify(2)
+
+  Idea: When mold is running as a daemon for preloading, use
+  inotify(2) to watch file system updates so that it can reload files
+  as soon as they are updated.
+
+  Reason for rejection: Just like the maximum number of files you can
+  simultaneously open, the maximum number of files you can watch using
+  inotify(2) isn't that large. Maybe just a single instance of mold is
+  fine with inotify(2), but it may fail if you run multiple of it.
+
+  The other reason for not doing it is because mold is quite fast
+  without it anyway. Invoking stat(2) on each file for file update
+  check takes less than 100 milliseconds for Chrome, and if most of
+  the input files are not updated, parsing updated files takes almost
+  no time.

docs/execstack.md

@@ -0,0 +1,55 @@
+This page explains the following warning message and how to fix it.
+mold emits this message when it sees an object file that may not be
+compatible with mold.
+
+
+```
+mold: warning: foo.o: this file may cause a segmentation fault because it requires an executable stack. See https://github.com/rui314/mold/tree/main/docs/execstack.md for more info.
+```
+
+# Background
+
+On modern computers, the stack area (to which local variables are
+stored) cannot contain executable code. If the control reaches the
+stack area, the CPU refuses to execute any code there and the program
+is usually terminated due to segmentation fault.
+
+This is a security measure. The stack area used to be executable (old
+CPUs generally execute any code as long as it is in a readable memory
+region), but that provided an easy attack vector to a malicious user.
+They wrote executable code to the stack area using some buffer
+overflow bug and jumped there to run arbitrary code in a remote server
+process.
+
+To prevent this type of attack, the stack area is no longer executable
+since the early 2000s. On Linux, the stack's executable-ness is
+controlled by a bit in an executable, and the loader respect that
+bit. The bit is set by the linker.
+
+GCC had (and still have) a feature that depends on the executable
+stack, so they invented a way to tell the linker to mark the stack
+executable. Specifically, if an object file contains a
+`.note.GNU-stack` section with the `SHF_EXECSTACK` bit, GNU linker
+silently makes the stack of an output file executable.
+
+But the GNU linker's behavior is dangerous. If you accidentally link
+an object file that has that marker section, the entire stack area
+silently becomes executable, disabling the security mechanism.
+
+Therefore, mold simply ignores that marker section. If you are using
+mold, you need to explicitly pass `-z execstack` to the linker to make
+the stack executable.
+
+# What caused this issue?
+
+You are likely to use GCC's [Nested
+Functions](https://gcc.gnu.org/onlinedocs/gcc/Nested-Functions.html)
+feature which still depends on the executable stack.
+
+# How to fix it?
+
+If you know what you are doing, pass `-z execstack` to mold. Beaware
+that this will significantly weaken your program's security.
+
+If you don't want to pass `-z execstack`, rewrite your code so that
+your code does not depends on the executable stack.

docs/glossary.md

@@ -0,0 +1,158 @@
+The very concept of linking is simple: a compiler compiles a piece of
+source code into an object file (a file containing machine code), and
+a linker combines object files into a single executable or a shared
+library file. However, the actual implementation of the linker for
+modern systems is much more complicated because hardware, operating
+system, compiler and linker all have many more features.
+
+In this file, I'll explain random topics in the glossary format that
+you need to understand to read mold code.
+
+## DSO
+
+A .so file. Short for Dynamic Shared Object. Often called as a
+shared library, a dynamic libray or a shared object as well.
+
+An DSO contains common functions and data that are used by multiple
+executables and/or other DSOs. At runtime, a DSO is loaded to a
+contiguous region in the virtual address.
+
+## Object file
+
+A .o file. An object file contains machine code and data, but it
+cannot be executed because it's not self-contained. For example,
+if you compile a C source file containing a call of `printf`,
+the actual function code of `printf` is not included in the resulting
+object file. You include `stdio.h`, but that teaches the compiler
+only about `printf`'s type, and the compiler still don't know what
+`printf` actually does. Therefore, it cannot emit code for `printf`.
+
+You need to link an object file with other object file or a shared
+library to make it exectuable.
+
+## Virtual address space
+
+A pointer has a value like 0x803020 which is an address of the
+pointee. But it doesn't mean that the pointee resides at the
+physical memory address 0x803020 on the computer. Modern CPUs
+contains so-called Mmeory Management Unit (MMU), and all access to
+the memory are first translated by MMU to the physical address.
+The address before translation is called the "virtual address".
+Unless you are doing the kernel programming, all addresses you
+handle are virtual addresses.
+
+The OS kernel controls the MMU so that each process owns the entire
+virtual address space. So, even if two process uses the same virtual
+address, they don't conflict. They are mapped to different physical
+addresses.
+
+The existence of MMU has several implications to the linker. First,
+we can link the main executable to a specific address. On process
+startup, there's no code or data in the virtual address space, so
+the mapping of the main executable always succeed. However, it's not
+true to DSOs because they are loaded after the main executable and
+possibly other DSOs. Therefore, shared libraries must be linked in a
+way that they can be loaded to any address in the virtual address
+space.
+
+## Relocation
+
+A piece of information for the linker as to how to link object files
+or a dynamic objects.
+
+Object files can refer functions or data in other object files. For
+example, if you compile a function which calls a non-local function
+`foo`, the resulting code contains something like this:
+
+```
+  26:   e8 00 00 00 00          callq  2b <bar+0xb>
+                        27: R_X86_64_PLT32      foo-0x4
+```
+
+The above `callq` is the instruction to call a function at the
+machine code level. It's opcode is `0xe8` in x86-64, so the
+instruction begins with `0xe8`. The following four bytes are
+displacement; that is, the address of the branch target relative to
+the end of this `callq` instruction. Notice that the displacement is
+0. The compiler couldn't fill the displacement because it has no
+idea as to where `foo` will be at runtime. So, the compiler write 0
+as a placeholder and instead write a relocation `R_X86_64_PLT32`
+with `foo` as its associated symbol. The linker reads this
+relocation, computes the offsets between this call instruction and
+function `foo` and overwrite the placeholder value 0 with an actual
+displacement.
+
+There are many different types of relocations. For example, if you
+want to fix up not with a displacement but with an absolute address
+of a symbol, you need to use `R_X86_64_ABS64` instead.
+
+## Static library
+
+A .a file. Often called as an archive file or just archive as well.
+
+A static library is a container just like tar or zip. Actually,
+there's no technical reason to not use tar or (uncompressed) zip,
+but traditionally the .a file format is used by the linker.
+
+A static library contains object files and can be passed to the
+linker along with other object files and/or archives.
+
+A linker pulls out object files from an archive only if it is needed
+to resolve undefined symbols. In other words, object files in an
+archive are not linked by default and used as a complement to supply
+missing definitions. This is ideal for a library because you don't
+want to link library functions unless you are actually using them.
+
+Contrary to archive files, object files directly given to a linker
+are always linked to the output.
+
+To maximize the benefit of archive files, a library often used as a
+static library is broken down to small files to separate each
+function individually (for example, look at
+https://git.musl-libc.org/cgit/musl/tree/src/stdio). By doing this,
+you import only used functions.
+
+A static file is created by `ar`, whose command line arguments are
+similar to `tar`. A static library contains the symbol table which
+offers a quick way to look up an object file for a defined symbol,
+but mold does not use the static library's symbol table. mold
+doesdn't need a symbol table to exist in an archive, and if exists,
+mold just ignores it.
+
+See also: DSO (dynamic library)
+
+## Symbol
+
+A symbol is a label assigned to a specific location in an input file
+or an output file. For example, if you define function `foo` and
+compile it, the resulting object file contains a symbol `foo`
+pointing to the beginning of the machine code for `foo`.
+
+Usually, a symbol name is a function or a variable name. If an
+object is anonymous (such the one for a string literal), a compiler
+generated a unique symbol, which often starts with `.` to avoid
+conflict with user-defined symbols.
+
+For C++, symbol name is a complex "mangled" name. We need to mangle
+identifiers because a simple name such as `foo` cannot be uniquely
+identify a function or a data in C++, because for example `foo` may
+be in a namespace or defined as a static member in some class. If
+`foo` is an overloaded function, we need to distinguish different
+`foo`s by its type. Therefore, C++ compiler mangles an identifier by
+appending nmaepsace names, type information and such so that
+different things get different names.
+
+For example, a function `int foo(int)` in a namespace `bar` is
+mangled as `_ZN3bar3fooEi`.
+
+A symbol can be either defined or undefined. A defined symbol points
+to some location in a file which may contain the function's machine
+code or the variable's initial value. An undefined symbol does not
+point to anywhere. It needs to be merged with a defined symbol with
+the same name at link-time. This merging process is called "name
+resolution".
+
+For example, if your program is using `printf`, it usually contains
+`printf` as an undefined symbol. You need to link it with `libc.a`
+or `libc.so`, which contain a defined symbol of `printf`, to make a
+complete program.

elf/arch-arm32.cc

@@ -0,0 +1,651 @@
+// ARM32 is a bit special from the linker's viewpoint because ARM
+// processors support two different instruction encodings: Thumb and
+// ARM (in a narrower sense). Thumb instructions are either 16 bits or
+// 32 bits, while ARM instructions are all 32 bits. Feature-wise,
+// thumb is a subset of ARM, so not all ARM instructions are
+// representable in Thumb.
+//
+// ARM processors originally supported only ARM instructions. Thumb
+// instructions were later added to increase code density.
+//
+// ARM processors runs in either ARM mode or Thumb mode. The mode can
+// be switched using BX (branch and mode exchange)-family instructions.
+// We need to use that instructions to, for example, call a function
+// encoded in Thumb from a function encoded in ARM. Sometimes, the
+// linker even has to emit an interworking thunk code to switch mode.
+//
+// ARM instructions are aligned to 4 byte boundaries. Thumb are to 2
+// byte boundaries.
+//
+// You can distinguish Thumb functions from ARM functions by looking
+// at the least significant bit (LSB) of its "address". If LSB is 0,
+// it's ARM; otherwise, Thumb.
+//
+// For example, if a symbol `foo` is of type STT_FUNC and has value
+// 0x2001, `foo` is a function using Thumb instructions whose address
+// is 0x2000 (not 0x2001, as Thumb instructions are always 2-byte
+// aligned). Likewise, if a function pointer has value 0x2001, it
+// refers a Thumb function at 0x2000.
+//
+// https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst
+
+#include "mold.h"
+
+#include <tbb/parallel_for.h>
+#include <tbb/parallel_for_each.h>
+#include <tbb/parallel_sort.h>
+
+namespace mold::elf {
+
+using E = ARM32;
+
+static void write_mov_imm(u8 *loc, u32 val) {
+  u32 imm12 = bits(val, 11, 0);
+  u32 imm4 = bits(val, 15, 12);
+  *(ul32 *)loc = (*(ul32 *)loc & 0xfff0f000) | (imm4 << 16) | imm12;
+}
+
+static void write_thm_b_imm(u8 *loc, u32 val) {
+  // https://developer.arm.com/documentation/ddi0406/cb/Application-Level-Architecture/Instruction-Details/Alphabetical-list-of-instructions/BL--BLX--immediate-
+  u32 sign = bit(val, 24);
+  u32 I1 = bit(val, 23);
+  u32 I2 = bit(val, 22);
+  u32 J1 = !I1 ^ sign;
+  u32 J2 = !I2 ^ sign;
+  u32 imm10 = bits(val, 21, 12);
+  u32 imm11 = bits(val, 11, 1);
+
+  ul16 *buf = (ul16 *)loc;
+  buf[0] = (buf[0] & 0b1111'1000'0000'0000) | (sign << 10) | imm10;
+  buf[1] = (buf[1] & 0b1101'0000'0000'0000) | (J1 << 13) | (J2 << 11) | imm11;
+}
+
+static void write_thm_mov_imm(u8 *loc, u32 val) {
+  // https://developer.arm.com/documentation/ddi0406/cb/Application-Level-Architecture/Instruction-Details/Alphabetical-list-of-instructions/MOVT
+  u32 imm4 = bits(val, 15, 12);
+  u32 i = bit(val, 11);
+  u32 imm3 = bits(val, 10, 8);
+  u32 imm8 = bits(val, 7, 0);
+
+  ul16 *buf = (ul16 *)loc;
+  buf[0] = (buf[0] & 0b1111'1011'1111'0000) | (i << 10) | imm4;
+  buf[1] = (buf[1] & 0b1000'1111'0000'0000) | (imm3 << 12) | imm8;
+}
+
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const ul32 insn[] = {
+    0xe52d'e004, // push {lr}
+    0xe59f'e004, // ldr lr, 2f
+    0xe08f'e00e, // 1: add lr, pc, lr
+    0xe5be'f008, // ldr pc, [lr, #8]!
+    0x0000'0000, // 2: .word .got.plt - 1b - 8
+    0xe320'f000, // nop
+    0xe320'f000, // nop
+    0xe320'f000, // nop
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ul32 *)(buf + 16) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 16;
+}
+
+static const ul32 plt_entry[] = {
+  0xe59f'c004, // 1: ldr ip, 2f
+  0xe08c'c00f, // add ip, ip, pc
+  0xe59c'f000, // ldr pc, [ip]
+  0x0000'0000, // 2: .word sym@GOT - 1b
+};
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  memcpy(buf, plt_entry, sizeof(plt_entry));
+  *(ul32 *)(buf + 12) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx) - 12;
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  memcpy(buf, plt_entry, sizeof(plt_entry));
+  *(ul32 *)(buf + 12) = sym.get_got_addr(ctx) - sym.get_plt_addr(ctx) - 12;
+}
+
+// ARM does not use .eh_frame for exception handling. Instead, it uses
+// .ARM.exidx and .ARM.extab. So this function is empty.
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {}
+
+// ARM and Thumb branch instructions can jump within ±16 MiB.
+static bool is_jump_reachable(i64 val) {
+  return sign_extend(val, 24) == val;
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  i64 trampoline_idx = 0;
+
+  auto get_trampoline_addr = [&](u64 addr) {
+    for (; trampoline_idx < output_section->thunks.size(); trampoline_idx++) {
+      RangeExtensionThunk<E> &thunk = *output_section->thunks[trampoline_idx];
+      i64 disp = output_section->shdr.sh_addr + thunk.offset - addr;
+      if (is_jump_reachable(disp))
+        return disp;
+    }
+    unreachable();
+  };
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE || rel.r_type == R_ARM_V4BX)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   this->get_addend(rel)
+#define P   (get_addr() + rel.r_offset)
+#define T   (sym.get_addr(ctx) & 1)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    auto get_thumb_thunk_addr = [&] {
+      RangeExtensionRef ref = extra.range_extn[i];
+      assert(ref.thunk_idx != -1);
+      u64 addr = output_section->thunks[ref.thunk_idx]->get_addr(ref.sym_idx);
+      assert(is_jump_reachable(addr + A - P));
+      return addr;
+    };
+
+    auto get_arm_thunk_addr = [&] {
+      return get_thumb_thunk_addr() + 4;
+    };
+
+    switch (rel.r_type) {
+    case R_ARM_ABS32:
+    case R_ARM_TARGET1:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_ARM_REL32:
+      *(ul32 *)loc = S + A - P;
+      break;
+    case R_ARM_THM_CALL: {
+      // THM_CALL relocation refers either BL or BLX instruction.
+      // They are different in only one bit. We need to use BL if
+      // the jump target is Thumb. Otherwise, use BLX.
+      if (sym.is_remaining_undef_weak()) {
+        // On ARM, calling an weak undefined symbol jumps to the
+        // next instruction.
+        *(ul32 *)loc = 0x8000'f3af; // NOP.W
+        break;
+      }
+
+      i64 val = S + A - P;
+      if (is_jump_reachable(val)) {
+        if (T) {
+          write_thm_b_imm(loc, val);
+          *(ul16 *)(loc + 2) |= 0x1000;  // rewrite to BL
+        } else {
+          write_thm_b_imm(loc, align_to(val, 4));
+          *(ul16 *)(loc + 2) &= ~0x1000; // rewrite to BLX
+        }
+      } else {
+        write_thm_b_imm(loc, align_to(get_arm_thunk_addr() + A - P, 4));
+        *(ul16 *)(loc + 2) &= ~0x1000;  // rewrite to BLX
+      }
+      break;
+    }
+    case R_ARM_BASE_PREL:
+      *(ul32 *)loc = GOT + A - P;
+      break;
+    case R_ARM_GOT_PREL:
+    case R_ARM_TARGET2:
+      *(ul32 *)loc = GOT + G + A - P;
+      break;
+    case R_ARM_GOT_BREL:
+      *(ul32 *)loc = G + A;
+      break;
+    case R_ARM_CALL: {
+      // Just like THM_CALL, ARM_CALL relocation refers either BL or
+      // BLX instruction. We may need to rewrite BL → BLX or BLX → BL.
+      bool is_bl = ((*(ul32 *)loc & 0xff00'0000) == 0xeb00'0000);
+      bool is_blx = ((*(ul32 *)loc & 0xfe00'0000) == 0xfa00'0000);
+      if (!is_bl && !is_blx)
+        Fatal(ctx) << *this << ": R_ARM_CALL refers neither BL nor BLX";
+
+      if (sym.is_remaining_undef_weak()) {
+        // On ARM, calling an weak undefined symbol jumps to the
+        // next instruction.
+        *(ul32 *)loc = 0xe320'f000; // NOP
+        break;
+      }
+
+      u64 val = S + A - P;
+      if (is_jump_reachable(val)) {
+        if (T)
+          *(ul32 *)loc = 0xfa00'0000 | (bit(val, 1) << 24) | bits(val, 25, 2);
+        else
+          *(ul32 *)loc = 0xeb00'0000 | bits(val, 25, 2);
+      } else {
+        *(ul32 *)loc = 0xeb00'0000 | bits(get_arm_thunk_addr() + A - P, 25, 2);
+      }
+      break;
+    }
+    case R_ARM_JUMP24:
+      if (sym.is_remaining_undef_weak()) {
+        *(ul32 *)loc = 0xe320'f000; // NOP
+      } else {
+        // Unlike BL and BLX, we can't rewrite B to BX because BX doesn't
+        // takes an immediate; it takes only a register. So if mode switch
+        // is required, we jump to a linker-synthesized thunk which constructs
+        // a branch destination in a register and branches to that address.
+        u64 val = S + A - P;
+        if (!is_jump_reachable(val) || T)
+          val = get_arm_thunk_addr() + A - P;
+        *(ul32 *)loc = (*(ul32 *)loc & 0xff00'0000) | bits(val, 25, 2);
+      }
+      break;
+    case R_ARM_THM_JUMP11: {
+      assert(T);
+      i64 val = S + A - P;
+      check(val, -(1 << 11), 1 << 11);
+      *(ul16 *)loc = (*(ul16 *)loc & 0xf800) | bits(val, 11, 1);
+      break;
+    }
+    case R_ARM_THM_JUMP19: {
+      i64 val = S + A - P;
+      check(val, -(1 << 19), 1 << 19);
+
+      // sign:J2:J1:imm6:imm11:'0'
+      u32 sign = bit(val, 20);
+      u32 J2 = bit(val, 19);
+      u32 J1 = bit(val, 18);
+      u32 imm6 = bits(val, 17, 12);
+      u32 imm11 = bits(val, 11, 1);
+
+      *(ul16 *)loc &= 0b1111'1011'1100'0000;
+      *(ul16 *)loc |= (sign << 10) | imm6;
+
+      *(ul16 *)(loc + 2) &= 0b1101'0000'0000'0000;
+      *(ul16 *)(loc + 2) |= (J2 << 13) | (J1 << 11) | imm11;
+      break;
+    }
+    case R_ARM_THM_JUMP24:
+      if (sym.is_remaining_undef_weak()) {
+        *(ul32 *)loc = 0x8000'f3af; // NOP.W
+      } else {
+        // Just like R_ARM_JUMP24, we need to jump to a thunk if we need to
+        // switch processor mode.
+        u64 val = S + A - P;
+        if (!is_jump_reachable(val) || !T)
+          val = get_thumb_thunk_addr() + A - P;
+        write_thm_b_imm(loc, val);
+      }
+      break;
+    case R_ARM_MOVW_PREL_NC:
+      write_mov_imm(loc, ((S + A) | T) - P);
+      break;
+    case R_ARM_MOVW_ABS_NC:
+      write_mov_imm(loc, (S + A) | T);
+      break;
+    case R_ARM_THM_MOVW_PREL_NC:
+      write_thm_mov_imm(loc, ((S + A) | T) - P);
+      break;
+    case R_ARM_PREL31: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 30), 1LL << 30);
+      *(ul32 *)loc = (*(ul32 *)loc & 0x8000'0000) | ((val) & 0x7fff'ffff);
+      break;
+    }
+    case R_ARM_THM_MOVW_ABS_NC:
+      write_thm_mov_imm(loc, (S + A) | T);
+      break;
+    case R_ARM_MOVT_PREL:
+      write_mov_imm(loc, (S + A - P) >> 16);
+      break;
+    case R_ARM_THM_MOVT_PREL:
+      write_thm_mov_imm(loc, (S + A - P) >> 16);
+      break;
+    case R_ARM_MOVT_ABS:
+      write_mov_imm(loc, (S + A) >> 16);
+      break;
+    case R_ARM_THM_MOVT_ABS:
+      write_thm_mov_imm(loc, (S + A) >> 16);
+      break;
+    case R_ARM_TLS_GD32:
+      *(ul32 *)loc = sym.get_tlsgd_addr(ctx) + A - P;
+      break;
+    case R_ARM_TLS_LDM32:
+      *(ul32 *)loc = ctx.got->get_tlsld_addr(ctx) + A - P;
+      break;
+    case R_ARM_TLS_LDO32:
+      *(ul32 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_ARM_TLS_IE32:
+      *(ul32 *)loc = sym.get_gottp_addr(ctx) + A - P;
+      break;
+    case R_ARM_TLS_LE32:
+      *(ul32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_ARM_TLS_GOTDESC:
+      if (sym.has_tlsdesc(ctx)) {
+        // A is odd if the corresponding TLS_CALL is Thumb.
+        if (A & 1)
+          *(ul32 *)loc = sym.get_tlsdesc_addr(ctx) - P + A - 6;
+        else
+          *(ul32 *)loc = sym.get_tlsdesc_addr(ctx) - P + A - 4;
+      } else {
+        *(ul32 *)loc = S - ctx.tp_addr;
+      }
+      break;
+    case R_ARM_TLS_CALL:
+      if (sym.has_tlsdesc(ctx)) {
+        // BL <tls_trampoline>
+        *(ul32 *)loc = 0xeb00'0000 | bits(get_trampoline_addr(P + 8), 25, 2);
+      } else {
+        // BL -> NOP
+        *(ul32 *)loc = 0xe320'f000;
+      }
+      break;
+    case R_ARM_THM_TLS_CALL:
+      if (sym.has_tlsdesc(ctx)) {
+        u64 val = align_to(get_trampoline_addr(P + 4), 4);
+        write_thm_b_imm(loc, val);
+        *(ul16 *)(loc + 2) &= ~0x1000; // rewrite BL with BLX
+      } else {
+        // BL -> NOP.W
+        *(ul32 *)loc = 0x8000'f3af;
+      }
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+
+#undef S
+#undef A
+#undef P
+#undef T
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : this->get_addend(rel))
+
+    switch (rel.r_type) {
+    case R_ARM_ABS32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul32 *)loc = *val;
+      else
+        *(ul32 *)loc = S + A;
+      break;
+    case R_ARM_TLS_LDO32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul32 *)loc = *val;
+      else
+        *(ul32 *)loc = S + A - ctx.tls_begin;
+      break;
+    default:
+      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
+                 << rel;
+      break;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_ARM_ABS32:
+    case R_ARM_MOVT_ABS:
+    case R_ARM_THM_MOVT_ABS:
+    case R_ARM_TARGET1:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_ARM_THM_CALL:
+    case R_ARM_CALL:
+    case R_ARM_JUMP24:
+    case R_ARM_THM_JUMP24:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_ARM_GOT_PREL:
+    case R_ARM_GOT_BREL:
+    case R_ARM_TARGET2:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_ARM_MOVT_PREL:
+    case R_ARM_THM_MOVT_PREL:
+    case R_ARM_PREL31:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_ARM_TLS_GD32:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_ARM_TLS_LDM32:
+      ctx.needs_tlsld = true;
+      break;
+    case R_ARM_TLS_IE32:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_ARM_TLS_GOTDESC:
+      if (!relax_tlsdesc(ctx, sym))
+        sym.flags |= NEEDS_TLSDESC;
+      break;
+    case R_ARM_REL32:
+    case R_ARM_BASE_PREL:
+    case R_ARM_THM_JUMP11:
+    case R_ARM_THM_JUMP19:
+    case R_ARM_MOVW_PREL_NC:
+    case R_ARM_MOVW_ABS_NC:
+    case R_ARM_THM_MOVW_PREL_NC:
+    case R_ARM_THM_MOVW_ABS_NC:
+    case R_ARM_TLS_LDO32:
+    case R_ARM_TLS_LE32:
+    case R_ARM_TLS_CALL:
+    case R_ARM_THM_TLS_CALL:
+    case R_ARM_V4BX:
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+template <>
+void RangeExtensionThunk<E>::copy_buf(Context<E> &ctx) {
+  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+
+  // TLS trampoline code. ARM32's TLSDESC is designed so that this
+  // common piece of code is factored out from object files to reduce
+  // output size. Since no one provide, the linker has to synthesize it.
+  static ul32 hdr[] = {
+    0xe08e'0000, // add r0, lr, r0
+    0xe590'1004, // ldr r1, [r0, #4]
+    0xe12f'ff11, // bx  r1
+  };
+
+  // This is a range extension and mode switch thunk.
+  // It has two entry points: +0 for Thumb and +4 for ARM.
+  const u8 entry[] = {
+    // .thumb
+    0xfc, 0x46,             //    mov  ip, pc
+    0x60, 0x47,             //    bx   ip  # jumps to the following `ldr` insn
+    // .arm
+    0x04, 0xc0, 0x9f, 0xe5, //    ldr  ip, 2f
+    0x0f, 0xc0, 0x8c, 0xe0, // 1: add  ip, ip, pc
+    0x1c, 0xff, 0x2f, 0xe1, //    bx   ip
+    0x00, 0x00, 0x00, 0x00, // 2: .word sym - 1b
+  };
+
+  static_assert(E::thunk_hdr_size == sizeof(hdr));
+  static_assert(E::thunk_size == sizeof(entry));
+
+  memcpy(buf, hdr, sizeof(hdr));
+
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u8 *loc = buf + sizeof(hdr) + i * sizeof(entry);
+    memcpy(loc, entry, sizeof(entry));
+
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = output_section.shdr.sh_addr + offset + sizeof(hdr) + i * sizeof(entry);
+    *(ul32 *)(loc + 16) = S - P - 16;
+  }
+}
+
+// ARM executables use an .ARM.exidx section to look up an exception
+// handling record for the current instruction pointer. The table needs
+// to be sorted by their addresses.
+//
+// Other target uses .eh_frame_hdr instead for the same purpose.
+// I don't know why only ARM uses the different mechanism, but it's
+// likely that it's due to some historical reason.
+//
+// This function sorts .ARM.exidx records.
+static void sort_exidx(Context<E> &ctx, OutputSection<E> &osec) {
+  // .ARM.exidx records consists of a signed 31-bit relative address
+  // and a 32-bit value. The relative address indicates the start
+  // address of a function that the record covers. The value is one of
+  // the followings:
+  //
+  // 1. CANTUNWIND indicating that there's no unwinding info for the function,
+  // 2. a compact unwinding record encoded into a 32-bit value, or
+  // 3. a 31-bit relative address which points to a larger record in
+  //    the .ARM.extab section.
+  //
+  // CANTUNWIND is value 1. The most significant bit is set in (2) but
+  // not in (3). So we can distinguished them just by looking at a value.
+  const u32 EXIDX_CANTUNWIND = 1;
+
+  struct Entry {
+    ul32 addr;
+    ul32 val;
+  };
+
+  if (osec.shdr.sh_size % sizeof(Entry))
+    Fatal(ctx) << "invalid .ARM.exidx section size";
+
+  Entry *ent = (Entry *)(ctx.buf + osec.shdr.sh_offset);
+  i64 num_entries = osec.shdr.sh_size / sizeof(Entry);
+
+  // Entry's addresses are relative to themselves. In order to sort
+  // records by addresses, we first translate them so that the addresses
+  // are relative to the beginning of the section.
+  auto is_relative = [](u32 val) {
+    return val != EXIDX_CANTUNWIND && !(val & 0x8000'0000);
+  };
+
+  tbb::parallel_for((i64)0, num_entries, [&](i64 i) {
+    i64 offset = sizeof(Entry) * i;
+    ent[i].addr = sign_extend(ent[i].addr, 30) + offset;
+    if (is_relative(ent[i].val))
+      ent[i].val = 0x7fff'ffff & (ent[i].val + offset);
+  });
+
+  tbb::parallel_sort(ent, ent + num_entries, [](const Entry &a, const Entry &b) {
+    return a.addr < b.addr;
+  });
+
+  // Make addresses relative to themselves.
+  tbb::parallel_for((i64)0, num_entries, [&](i64 i) {
+    i64 offset = sizeof(Entry) * i;
+    ent[i].addr = 0x7fff'ffff & (ent[i].addr - offset);
+    if (is_relative(ent[i].val))
+      ent[i].val = 0x7fff'ffff & (ent[i].val - offset);
+  });
+}
+
+void fixup_arm_exidx_section(Context<E> &ctx) {
+  Timer t(ctx, "fixup_arm_exidx_section");
+
+  auto find_exidx = [&]() -> OutputSection<E> * {
+    for (std::unique_ptr<OutputSection<E>> &osec : ctx.output_sections)
+      if (osec->shdr.sh_type == SHT_ARM_EXIDX)
+        return osec.get();
+    return nullptr;
+  };
+
+  OutputSection<E> *exidx = find_exidx();
+  if (!exidx)
+    return;
+
+  // Sort .ARM.exidx contents
+  sort_exidx(ctx, *exidx);
+
+  // .ARM.exidx's sh_link should be set to the .text section index.
+  // Runtime doesn't care about it, but the binutils's strip command does.
+  if (ctx.shdr) {
+    auto find_text = [&]() -> OutputSection<E> * {
+      for (std::unique_ptr<OutputSection<E>> &osec : ctx.output_sections)
+        if (osec->name == ".text")
+          return osec.get();
+      return nullptr;
+    };
+
+    if (OutputSection<E> *text = find_text()) {
+      exidx->shdr.sh_link = text->shndx;
+      ctx.shdr->copy_buf(ctx);
+    }
+  }
+}
+
+} // namespace mold::elf

elf/arch-arm64.cc

@@ -0,0 +1,513 @@
+// This file contains ARM64-specific code. Being new, the ARM64's ELF
+// psABI doesn't have anything peculiar. ARM64 is a clean RISC
+// instruction set that supports PC-relative load/store instructions.
+//
+// Unlike ARM32, instructions length doesn't vary. All ARM64
+// instructions are 4 bytes long.
+//
+// Branch instructions used for function call can jump within ±128 MiB.
+// We need to create range extension thunks to support binaries whose
+// .text is larger than that.
+//
+// Unlike most other targets, the TLSDESC access model is used by default
+// for -fPIC to access thread-local variables instead of the less
+// efficient GD model. You can still enable GD but it needs the
+// -mtls-dialect=trad flag. Since GD is used rarely, we don't need to
+// implement GD → LE relaxation.
+//
+// https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = ARM64;
+
+static void write_adrp(u8 *buf, u64 val) {
+  u32 hi = bits(val, 32, 14);
+  u32 lo = bits(val, 13, 12);
+  *(ul32 *)buf &= 0b1001'1111'0000'0000'0000'0000'0001'1111;
+  *(ul32 *)buf |= (lo << 29) | (hi << 5);
+}
+
+static void write_adr(u8 *buf, u64 val) {
+  u32 hi = bits(val, 20, 2);
+  u32 lo = bits(val, 1, 0);
+  *(ul32 *)buf &= 0b1001'1111'0000'0000'0000'0000'0001'1111;
+  *(ul32 *)buf |= (lo << 29) | (hi << 5);
+}
+
+static u64 page(u64 val) {
+  return val & 0xffff'ffff'ffff'f000;
+}
+
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const ul32 insn[] = {
+    0xa9bf'7bf0, // stp  x16, x30, [sp,#-16]!
+    0x9000'0010, // adrp x16, .got.plt[2]
+    0xf940'0211, // ldr  x17, [x16, .got.plt[2]]
+    0x9100'0210, // add  x16, x16, .got.plt[2]
+    0xd61f'0220, // br   x17
+    0xd503'201f, // nop
+    0xd503'201f, // nop
+    0xd503'201f, // nop
+  };
+
+  u64 gotplt = ctx.gotplt->shdr.sh_addr + 16;
+  u64 plt = ctx.plt->shdr.sh_addr;
+
+  memcpy(buf, insn, sizeof(insn));
+  write_adrp(buf + 4, page(gotplt) - page(plt + 4));
+  *(ul32 *)(buf + 8) |= bits(gotplt, 11, 3) << 10;
+  *(ul32 *)(buf + 12) |= (gotplt & 0xfff) << 10;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const ul32 insn[] = {
+    0x9000'0010, // adrp x16, .got.plt[n]
+    0xf940'0211, // ldr  x17, [x16, .got.plt[n]]
+    0x9100'0210, // add  x16, x16, .got.plt[n]
+    0xd61f'0220, // br   x17
+  };
+
+  u64 gotplt = sym.get_gotplt_addr(ctx);
+  u64 plt = sym.get_plt_addr(ctx);
+
+  memcpy(buf, insn, sizeof(insn));
+  write_adrp(buf, page(gotplt) - page(plt));
+  *(ul32 *)(buf + 4) |= bits(gotplt, 11, 3) << 10;
+  *(ul32 *)(buf + 8) |= (gotplt & 0xfff) << 10;
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const ul32 insn[] = {
+    0x9000'0010, // adrp x16, GOT[n]
+    0xf940'0211, // ldr  x17, [x16, GOT[n]]
+    0xd61f'0220, // br   x17
+    0xd503'201f, // nop
+  };
+
+  u64 got = sym.get_got_addr(ctx);
+  u64 plt = sym.get_plt_addr(ctx);
+
+  memcpy(buf, insn, sizeof(insn));
+  write_adrp(buf, page(got) - page(plt));
+  *(ul32 *)(buf + 4) |= bits(got, 11, 3) << 10;
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_AARCH64_ABS64:
+    *(ul64 *)loc = val;
+    break;
+  case R_AARCH64_PREL32:
+    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  case R_AARCH64_PREL64:
+    *(ul64 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_AARCH64_ABS64:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_AARCH64_LDST8_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 0) << 10;
+      break;
+    case R_AARCH64_LDST16_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 1) << 10;
+      break;
+    case R_AARCH64_LDST32_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 2) << 10;
+      break;
+    case R_AARCH64_LDST64_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 3) << 10;
+      break;
+    case R_AARCH64_LDST128_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 4) << 10;
+      break;
+    case R_AARCH64_ADD_ABS_LO12_NC:
+      *(ul32 *)loc |= bits(S + A, 11, 0) << 10;
+      break;
+    case R_AARCH64_MOVW_UABS_G0: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ul32 *)loc |= bits(val, 15, 0) << 5;
+      break;
+    }
+    case R_AARCH64_MOVW_UABS_G0_NC:
+      *(ul32 *)loc |= bits(S + A, 15, 0) << 5;
+      break;
+    case R_AARCH64_MOVW_UABS_G1: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ul32 *)loc |= bits(val, 31, 16) << 5;
+      break;
+    }
+    case R_AARCH64_MOVW_UABS_G1_NC:
+      *(ul32 *)loc |= bits(S + A, 31, 16) << 5;
+      break;
+    case R_AARCH64_MOVW_UABS_G2: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 48);
+      *(ul32 *)loc |= bits(val, 47, 32) << 5;
+      break;
+    }
+    case R_AARCH64_MOVW_UABS_G2_NC:
+      *(ul32 *)loc |= bits(S + A, 47, 32) << 5;
+      break;
+    case R_AARCH64_MOVW_UABS_G3:
+      *(ul32 *)loc |= bits(S + A, 63, 48) << 5;
+      break;
+    case R_AARCH64_ADR_GOT_PAGE: {
+      i64 val = page(G + GOT + A) - page(P);
+      check(val, -(1LL << 32), 1LL << 32);
+      write_adrp(loc, val);
+      break;
+    }
+    case R_AARCH64_ADR_PREL_PG_HI21: {
+      i64 val = page(S + A) - page(P);
+      check(val, -(1LL << 32), 1LL << 32);
+      write_adrp(loc, val);
+      break;
+    }
+    case R_AARCH64_ADR_PREL_LO21: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 20), 1LL << 20);
+      write_adr(loc, val);
+      break;
+    }
+    case R_AARCH64_CALL26:
+    case R_AARCH64_JUMP26: {
+      if (sym.is_remaining_undef_weak()) {
+        // On ARM, calling an weak undefined symbol jumps to the
+        // next instruction.
+        *(ul32 *)loc = 0xd503'201f; // nop
+        break;
+      }
+
+      i64 lo = -(1 << 27);
+      i64 hi = 1 << 27;
+      i64 val = S + A - P;
+
+      if (val < lo || hi <= val) {
+        RangeExtensionRef ref = extra.range_extn[i];
+        val = output_section->thunks[ref.thunk_idx]->get_addr(ref.sym_idx) + A - P;
+        assert(lo <= val && val < hi);
+      }
+
+      *(ul32 *)loc |= (val >> 2) & 0x03ff'ffff;
+      break;
+    }
+    case R_AARCH64_CONDBR19:
+    case R_AARCH64_LD_PREL_LO19: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 20), 1LL << 20);
+      *(ul32 *)loc |= bits(val, 20, 2) << 5;
+      break;
+    }
+    case R_AARCH64_PREL16: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 15), 1LL << 15);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_AARCH64_PREL32: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 31), 1LL << 32);
+      *(ul32 *)loc = val;
+      break;
+    }
+    case R_AARCH64_PREL64:
+      *(ul64 *)loc = S + A - P;
+      break;
+    case R_AARCH64_LD64_GOT_LO12_NC:
+      *(ul32 *)loc |= bits(G + GOT + A, 11, 3) << 10;
+      break;
+    case R_AARCH64_LD64_GOTPAGE_LO15: {
+      i64 val = G + GOT + A - page(GOT);
+      check(val, 0, 1 << 15);
+      *(ul32 *)loc |= bits(val, 14, 3) << 10;
+      break;
+    }
+    case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: {
+      i64 val = page(sym.get_gottp_addr(ctx) + A) - page(P);
+      check(val, -(1LL << 32), 1LL << 32);
+      write_adrp(loc, val);
+      break;
+    }
+    case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
+      *(ul32 *)loc |= bits(sym.get_gottp_addr(ctx) + A, 11, 3) << 10;
+      break;
+    case R_AARCH64_TLSLE_ADD_TPREL_HI12: {
+      i64 val = S + A - ctx.tp_addr;
+      check(val, 0, 1LL << 24);
+      *(ul32 *)loc |= bits(val, 23, 12) << 10;
+      break;
+    }
+    case R_AARCH64_TLSLE_ADD_TPREL_LO12:
+    case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
+      *(ul32 *)loc |= bits(S + A - ctx.tp_addr, 11, 0) << 10;
+      break;
+    case R_AARCH64_TLSGD_ADR_PAGE21: {
+      i64 val = page(sym.get_tlsgd_addr(ctx) + A) - page(P);
+      check(val, -(1LL << 32), 1LL << 32);
+      write_adrp(loc, val);
+      break;
+    }
+    case R_AARCH64_TLSGD_ADD_LO12_NC:
+      *(ul32 *)loc |= bits(sym.get_tlsgd_addr(ctx) + A, 11, 0) << 10;
+      break;
+    case R_AARCH64_TLSDESC_ADR_PAGE21:
+      if (sym.has_tlsdesc(ctx)) {
+        i64 val = page(sym.get_tlsdesc_addr(ctx) + A) - page(P);
+        check(val, -(1LL << 32), 1LL << 32);
+        write_adrp(loc, val);
+      } else {
+        // adrp x0, 0 -> movz x0, #tls_ofset_hi, lsl #16
+        i64 val = (S + A - ctx.tp_addr);
+        check(val, -(1LL << 32), 1LL << 32);
+        *(ul32 *)loc = 0xd2a0'0000 | (bits(val, 32, 16) << 5);
+      }
+      break;
+    case R_AARCH64_TLSDESC_LD64_LO12:
+      if (sym.has_tlsdesc(ctx)) {
+        *(ul32 *)loc |= bits(sym.get_tlsdesc_addr(ctx) + A, 11, 3) << 10;
+      } else {
+        // ldr x2, [x0] -> movk x0, #tls_ofset_lo
+        u32 offset_lo = (S + A - ctx.tp_addr) & 0xffff;
+        *(ul32 *)loc = 0xf280'0000 | (offset_lo << 5);
+      }
+      break;
+    case R_AARCH64_TLSDESC_ADD_LO12:
+      if (sym.has_tlsdesc(ctx)) {
+        *(ul32 *)loc |= bits(sym.get_tlsdesc_addr(ctx) + A, 11, 0) << 10;
+      } else {
+        // add x0, x0, #0 -> nop
+        *(ul32 *)loc = 0xd503'201f;
+      }
+      break;
+    case R_AARCH64_TLSDESC_CALL:
+      if (!sym.has_tlsdesc(ctx)) {
+        // blr x2 -> nop
+        *(ul32 *)loc = 0xd503'201f;
+      }
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_AARCH64_ABS64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul64 *)loc = *val;
+      else
+        *(ul64 *)loc = S + A;
+      break;
+    case R_AARCH64_ABS32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ul32 *)loc = val;
+      break;
+    }
+    default:
+      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
+                 << rel;
+      break;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_AARCH64_ABS64:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_AARCH64_ADR_GOT_PAGE:
+    case R_AARCH64_LD64_GOT_LO12_NC:
+    case R_AARCH64_LD64_GOTPAGE_LO15:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_AARCH64_CALL26:
+    case R_AARCH64_JUMP26:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
+    case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_AARCH64_ADR_PREL_PG_HI21:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_AARCH64_TLSGD_ADR_PAGE21:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_AARCH64_TLSDESC_ADR_PAGE21:
+    case R_AARCH64_TLSDESC_LD64_LO12:
+    case R_AARCH64_TLSDESC_ADD_LO12:
+      if (!relax_tlsdesc(ctx, sym))
+        sym.flags |= NEEDS_TLSDESC;
+      break;
+    case R_AARCH64_ADD_ABS_LO12_NC:
+    case R_AARCH64_ADR_PREL_LO21:
+    case R_AARCH64_CONDBR19:
+    case R_AARCH64_LD_PREL_LO19:
+    case R_AARCH64_LDST16_ABS_LO12_NC:
+    case R_AARCH64_LDST32_ABS_LO12_NC:
+    case R_AARCH64_LDST64_ABS_LO12_NC:
+    case R_AARCH64_LDST128_ABS_LO12_NC:
+    case R_AARCH64_LDST8_ABS_LO12_NC:
+    case R_AARCH64_MOVW_UABS_G0:
+    case R_AARCH64_MOVW_UABS_G0_NC:
+    case R_AARCH64_MOVW_UABS_G1:
+    case R_AARCH64_MOVW_UABS_G1_NC:
+    case R_AARCH64_MOVW_UABS_G2:
+    case R_AARCH64_MOVW_UABS_G2_NC:
+    case R_AARCH64_MOVW_UABS_G3:
+    case R_AARCH64_PREL16:
+    case R_AARCH64_PREL32:
+    case R_AARCH64_PREL64:
+    case R_AARCH64_TLSLE_ADD_TPREL_HI12:
+    case R_AARCH64_TLSLE_ADD_TPREL_LO12:
+    case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
+    case R_AARCH64_TLSGD_ADD_LO12_NC:
+    case R_AARCH64_TLSDESC_CALL:
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+template <>
+void RangeExtensionThunk<E>::copy_buf(Context<E> &ctx) {
+  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+
+  static const ul32 data[] = {
+    0x9000'0010, // adrp x16, 0   # R_AARCH64_ADR_PREL_PG_HI21
+    0x9100'0210, // add  x16, x16 # R_AARCH64_ADD_ABS_LO12_NC
+    0xd61f'0200, // br   x16
+  };
+
+  static_assert(E::thunk_size == sizeof(data));
+
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = output_section.shdr.sh_addr + offset + i * E::thunk_size;
+
+    u8 *loc = buf + i * E::thunk_size;
+    memcpy(loc , data, sizeof(data));
+    write_adrp(loc, page(S) - page(P));
+    *(ul32 *)(loc + 4) |= bits(S, 11, 0) << 10;
+  }
+}
+
+} // namespace mold::elf

elf/arch-i386.cc

@@ -0,0 +1,528 @@
+// i386 is similar to x86-64 but lacks PC-relative memory access
+// instructions. So it's not straightforward to support position-
+// independent code (PIC) on that target.
+//
+// If an object file is compiled with -fPIC, a function that needs to load
+// a value from memory first obtains its own address with the following
+// code
+//
+//   call __x86.get_pc_thunk.bx
+//
+// where __x86.get_pc_thunk.bx is defined as
+//
+//   __x86.get_pc_thunk.bx:
+//     mov (%esp), %ebx  # move the return address to %ebx
+//     ret
+//
+// . With the function's own address (or, more precisely, the address
+// immediately after the call instruction), the function can compute an
+// absolute address of a variable with its address + link-time constant.
+//
+// Executing call-mov-ret isn't very cheap, and allocating one register to
+// store PC isn't cheap too, especially given that i386 has only 8
+// general-purpose registers. But that's the cost of PIC on i386. You need
+// to pay it when creating a .so and a position-independent executable.
+//
+// When a position-independent function calls another function, it sets
+// %ebx to the address of .got. Position-independent PLT entries use that
+// register to load values from .got.plt/.got.
+//
+// If we are creating a position-dependent executable (PDE), we can't
+// assume that %ebx is set to .got. For PDE, we need to create position-
+// dependent PLT entries which don't use %ebx.
+//
+// https://github.com/rui314/mold/wiki/i386-psabi.pdf
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = I386;
+
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  if (ctx.arg.pic) {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb, // endbr32
+      0x51,                   // push   %ecx
+      0x8d, 0x8b, 0, 0, 0, 0, // lea    GOTPLT+4(%ebx), %ecx
+      0xff, 0x31,             // push   (%ecx)
+      0xff, 0x61, 0x04,       // jmp    *0x4(%ecx)
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 7) = ctx.gotplt->shdr.sh_addr - ctx.got->shdr.sh_addr + 4;
+  } else {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb, // endbr32
+      0x51,                   // push   %ecx
+      0xb9, 0, 0, 0, 0,       // mov    GOTPLT+4, %ecx
+      0xff, 0x31,             // push   (%ecx)
+      0xff, 0x61, 0x04,       // jmp    *0x4(%ecx)
+      0x90,                   // nop
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 6) = ctx.gotplt->shdr.sh_addr + 4;
+  }
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  if (ctx.arg.pic) {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb, // endbr32
+      0xb9, 0, 0, 0, 0,       // mov $reloc_offset, %ecx
+      0xff, 0xa3, 0, 0, 0, 0, // jmp *foo@GOT(%ebx)
+      0x90,                   // nop
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 11) = sym.get_gotplt_addr(ctx) - ctx.got->shdr.sh_addr;
+  } else {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb, // endbr32
+      0xb9, 0, 0, 0, 0,       // mov $reloc_offset, %ecx
+      0xff, 0x25, 0, 0, 0, 0, // jmp *foo@GOT
+      0x90,                   // nop
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 11) = sym.get_gotplt_addr(ctx);
+  }
+
+  *(ul32 *)(buf + 5) = sym.get_plt_idx(ctx) * sizeof(ElfRel<E>);
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  if (ctx.arg.pic) {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb,             // endbr32
+      0xff, 0xa3, 0, 0, 0, 0,             // jmp *foo@GOT(%ebx)
+      0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00, // nop
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 6) = sym.get_got_addr(ctx) - ctx.got->shdr.sh_addr;
+  } else {
+    static const u8 insn[] = {
+      0xf3, 0x0f, 0x1e, 0xfb,             // endbr32
+      0xff, 0x25, 0, 0, 0, 0,             // jmp *foo@GOT
+      0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00, // nop
+    };
+    memcpy(buf, insn, sizeof(insn));
+    *(ul32 *)(buf + 6) = sym.get_got_addr(ctx);
+  }
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_386_32:
+    *(ul32 *)loc = val;
+    break;
+  case R_386_PC32:
+    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+static u32 relax_got32x(u8 *loc) {
+  // mov imm(%reg1), %reg2 -> lea imm(%reg1), %reg2
+  if (loc[0] == 0x8b)
+    return 0x8d00 | loc[1];
+  return 0;
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   this->get_addend(rel)
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_386_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *loc = val;
+      break;
+    }
+    case R_386_16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_386_32:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_386_PC8: {
+      i64 val = S + A - P;
+      check(val, -(1 << 7), 1 << 7);
+      *loc = val;
+      break;
+    }
+    case R_386_PC16: {
+      i64 val = S + A - P;
+      check(val, -(1 << 15), 1 << 15);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_386_PC32:
+    case R_386_PLT32:
+      *(ul32 *)loc = S + A - P;
+      break;
+    case R_386_GOT32:
+      *(ul32 *)loc = G + A;
+      break;
+    case R_386_GOT32X:
+      if (sym.has_got(ctx)) {
+        *(ul32 *)loc = G + A;
+      } else {
+        u32 insn = relax_got32x(loc - 2);
+        assert(insn);
+        loc[-2] = insn >> 8;
+        loc[-1] = insn;
+        *(ul32 *)loc = S + A - GOT;
+      }
+      break;
+    case R_386_GOTOFF:
+      *(ul32 *)loc = S + A - GOT;
+      break;
+    case R_386_GOTPC:
+      *(ul32 *)loc = GOT + A - P;
+      break;
+    case R_386_TLS_GOTIE:
+      *(ul32 *)loc = sym.get_gottp_addr(ctx) + A - GOT;
+      break;
+    case R_386_TLS_LE:
+      *(ul32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_386_TLS_IE:
+      *(ul32 *)loc = sym.get_gottp_addr(ctx) + A;
+      break;
+    case R_386_TLS_GD:
+      if (sym.has_tlsgd(ctx)) {
+        *(ul32 *)loc = sym.get_tlsgd_addr(ctx) + A - GOT;
+      } else {
+        // Relax GD to LE
+        switch (rels[i + 1].r_type) {
+        case R_386_PLT32:
+        case R_386_PC32: {
+          static const u8 insn[] = {
+            0x65, 0xa1, 0, 0, 0, 0, // mov %gs:0, %eax
+            0x81, 0xe8, 0, 0, 0, 0, // add $val, %eax
+          };
+          memcpy(loc - 3, insn, sizeof(insn));
+          *(ul32 *)(loc + 5) = ctx.tp_addr - S - A;
+          break;
+        }
+        case R_386_GOT32:
+        case R_386_GOT32X: {
+          static const u8 insn[] = {
+            0x65, 0xa1, 0, 0, 0, 0, // mov %gs:0, %eax
+            0x81, 0xe8, 0, 0, 0, 0, // add $val, %eax
+          };
+          memcpy(loc - 2, insn, sizeof(insn));
+          *(ul32 *)(loc + 6) = ctx.tp_addr - S - A;
+          break;
+        }
+        default:
+          unreachable();
+        }
+
+        i++;
+      }
+      break;
+    case R_386_TLS_LDM:
+      if (ctx.got->has_tlsld(ctx)) {
+        *(ul32 *)loc = ctx.got->get_tlsld_addr(ctx) + A - GOT;
+      } else {
+        // Relax LD to LE
+        switch (rels[i + 1].r_type) {
+        case R_386_PLT32:
+        case R_386_PC32: {
+          static const u8 insn[] = {
+            0x31, 0xc0,             // xor %eax, %eax
+            0x65, 0x8b, 0x00,       // mov %gs:(%eax), %eax
+            0x81, 0xe8, 0, 0, 0, 0, // sub $tls_size, %eax
+          };
+          memcpy(loc - 2, insn, sizeof(insn));
+          break;
+        }
+        case R_386_GOT32:
+        case R_386_GOT32X: {
+          static const u8 insn[] = {
+            0x31, 0xc0,             // xor %eax, %eax
+            0x65, 0x8b, 0x00,       // mov %gs:(%eax), %eax
+            0x81, 0xe8, 0, 0, 0, 0, // sub $tls_size, %eax
+            0x90,                   // nop
+          };
+          memcpy(loc - 2, insn, sizeof(insn));
+          break;
+        }
+        default:
+          unreachable();
+        }
+
+        *(ul32 *)(loc + 5) = ctx.tp_addr - ctx.tls_begin;
+        i++;
+      }
+      break;
+    case R_386_TLS_LDO_32:
+      *(ul32 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_386_SIZE32:
+      *(ul32 *)loc = sym.esym().st_size + A;
+      break;
+    case R_386_TLS_GOTDESC:
+      if (sym.has_tlsdesc(ctx)) {
+        *(ul32 *)loc = sym.get_tlsdesc_addr(ctx) + A - GOT;
+      } else {
+        static const u8 insn[] = {
+          0x8d, 0x05, 0, 0, 0, 0, // lea 0, %eax
+        };
+        memcpy(loc - 2, insn, sizeof(insn));
+        *(ul32 *)loc = S + A - ctx.tp_addr;
+      }
+      break;
+    case R_386_TLS_DESC_CALL:
+      if (!sym.has_tlsdesc(ctx)) {
+        // call *(%eax) -> nop
+        loc[0] = 0x66;
+        loc[1] = 0x90;
+      }
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : this->get_addend(rel))
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_386_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *loc = val;
+      break;
+    }
+    case R_386_16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_386_32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul32 *)loc = *val;
+      else
+        *(ul32 *)loc = S + A;
+      break;
+    case R_386_PC8: {
+      i64 val = S + A;
+      check(val, -(1 << 7), 1 << 7);
+      *loc = val;
+      break;
+    }
+    case R_386_PC16: {
+      i64 val = S + A;
+      check(val, -(1 << 15), 1 << 15);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_386_PC32:
+      *(ul32 *)loc = S + A;
+      break;
+    case R_386_GOTPC:
+      *(ul32 *)loc = GOT + A;
+      break;
+    case R_386_GOTOFF:
+      *(ul32 *)loc = S + A - GOT;
+      break;
+    case R_386_TLS_LDO_32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul32 *)loc = *val;
+      else
+        *(ul32 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_386_SIZE32:
+      *(ul32 *)loc = sym.esym().st_size + A;
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = (u8 *)(contents.data() + rel.r_offset);
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_386_8:
+    case R_386_16:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_386_32:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_386_PC8:
+    case R_386_PC16:
+    case R_386_PC32:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_386_GOT32:
+    case R_386_GOTPC:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_386_GOT32X: {
+      bool do_relax = ctx.arg.relax && !sym.is_imported &&
+                      sym.is_relative() && relax_got32x(loc - 2);
+      if (!do_relax)
+        sym.flags |= NEEDS_GOT;
+      break;
+    }
+    case R_386_PLT32:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_386_TLS_GOTIE:
+    case R_386_TLS_LE:
+    case R_386_TLS_IE:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_386_TLS_GD:
+      if (i + 1 == rels.size())
+        Fatal(ctx) << *this << ": TLS_GD reloc must be followed by PLT or GOT32";
+
+      if (u32 ty = rels[i + 1].r_type;
+          ty != R_386_PLT32 && ty != R_386_PC32 &&
+          ty != R_386_GOT32 && ty != R_386_GOT32X)
+        Fatal(ctx) << *this << ": TLS_GD reloc must be followed by PLT or GOT32";
+
+      if (relax_tlsgd(ctx, sym))
+        i++;
+      else
+        sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_386_TLS_LDM:
+      if (i + 1 == rels.size())
+        Fatal(ctx) << *this << ": TLS_LDM reloc must be followed by PLT or GOT32";
+
+      if (u32 ty = rels[i + 1].r_type;
+          ty != R_386_PLT32 && ty != R_386_PC32 &&
+          ty != R_386_GOT32 && ty != R_386_GOT32X)
+        Fatal(ctx) << *this << ": TLS_LDM reloc must be followed by PLT or GOT32";
+
+      if (relax_tlsld(ctx))
+        i++;
+      else
+        ctx.needs_tlsld = true;
+      break;
+    case R_386_TLS_GOTDESC:
+      if (!relax_tlsdesc(ctx, sym))
+        sym.flags |= NEEDS_TLSDESC;
+      break;
+    case R_386_GOTOFF:
+    case R_386_TLS_LDO_32:
+    case R_386_SIZE32:
+    case R_386_TLS_DESC_CALL:
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+} // namespace mold::elf

elf/arch-m68k.cc

@@ -0,0 +1,340 @@
+// This file contains code for the Motorola 68000 series microprocessors,
+// which is often abbreviated as m68k. Running a Unix-like system on a
+// m68k-based machine today is probably a retro-computing hobby activity,
+// but the processor was a popular choice to build Unix computers during
+// '80s. Early Sun workstations for example used m68k. Macintosh until
+// 1994 were based on m68k as well until they switched to PowerPC (and
+// then to x86 and to ARM.)
+//
+// From the linker's point of view, it is not hard to support m68k. It's
+// just a 32-bit big-endian CISC ISA. Compared to comtemporary i386,
+// m68k's psABI is actually simpler because m68k has PC-relative memory
+// access instructions and therefore can support position-independent
+// code without too much hassle.
+//
+// https://github.com/rui314/mold/wiki/m68k-psabi.pdf
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = M68K;
+
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const u8 insn[] = {
+    0x2f, 0x00,                         // move.l %d0, -(%sp)
+    0x2f, 0x3b, 0x01, 0x70, 0, 0, 0, 0, // move.l (GOTPLT+4, %pc), -(%sp)
+    0x4e, 0xfb, 0x01, 0x71, 0, 0, 0, 0, // jmp    ([GOTPLT+8, %pc])
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 6) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr;
+  *(ub32 *)(buf + 14) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 4;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const u8 insn[] = {
+    0x20, 0x3c, 0, 0, 0, 0,             // move.l PLT_OFFSET, %d0
+    0x4e, 0xfb, 0x01, 0x71, 0, 0, 0, 0, // jmp    ([GOTPLT_ENTRY, %pc])
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 2) = sym.get_plt_idx(ctx) * sizeof(ElfRel<E>);
+  *(ub32 *)(buf + 10) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx) - 8;
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const u8 insn[] = {
+    0x4e, 0xfb, 0x01, 0x71, 0, 0, 0, 0, // jmp ([GOT_ENTRY, %pc])
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 4) = sym.get_got_addr(ctx) - sym.get_plt_addr(ctx) - 2;
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_68K_32:
+    *(ub32 *)loc = val;
+    break;
+  case R_68K_PC32:
+    *(ub32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    auto write16 = [&](u64 val) {
+      check(val, 0, 1 << 16);
+      *(ub16 *)loc = val;
+    };
+
+    auto write16s = [&](u64 val) {
+      check(val, -(1 << 15), 1 << 15);
+      *(ub16 *)loc = val;
+    };
+
+    auto write8 = [&](u64 val) {
+      check(val, 0, 1 << 8);
+      *loc = val;
+    };
+
+    auto write8s = [&](u64 val) {
+      check(val, -(1 << 7), 1 << 7);
+      *loc = val;
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_68K_32:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_68K_16:
+      write16(S + A);
+      break;
+    case R_68K_8:
+      write8(S + A);
+      break;
+    case R_68K_PC32:
+    case R_68K_PLT32:
+      *(ub32 *)loc = S + A - P;
+      break;
+    case R_68K_PC16:
+    case R_68K_PLT16:
+      write16s(S + A - P);
+      break;
+    case R_68K_PC8:
+    case R_68K_PLT8:
+      write8s(S + A - P);
+      break;
+    case R_68K_GOTPCREL32:
+      *(ub32 *)loc = GOT + A - P;
+      break;
+    case R_68K_GOTPCREL16:
+      write16s(GOT + A - P);
+      break;
+    case R_68K_GOTPCREL8:
+      write8s(GOT + A - P);
+      break;
+    case R_68K_GOTOFF32:
+      *(ub32 *)loc = G + A;
+      break;
+    case R_68K_GOTOFF16:
+      write16(G + A);
+      break;
+    case R_68K_GOTOFF8:
+      write8(G + A);
+      break;
+    case R_68K_TLS_GD32:
+      *(ub32 *)loc = sym.get_tlsgd_addr(ctx) + A - GOT;
+      break;
+    case R_68K_TLS_GD16:
+      write16(sym.get_tlsgd_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_GD8:
+      write8(sym.get_tlsgd_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_LDM32:
+      *(ub32 *)loc = ctx.got->get_tlsld_addr(ctx) + A - GOT;
+      break;
+    case R_68K_TLS_LDM16:
+      write16(ctx.got->get_tlsld_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_LDM8:
+      write8(ctx.got->get_tlsld_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_LDO32:
+      *(ub32 *)loc = S + A - ctx.tls_begin - E::tls_dtp_offset;
+      break;
+    case R_68K_TLS_LDO16:
+      write16s(S + A - ctx.tls_begin - E::tls_dtp_offset);
+      break;
+    case R_68K_TLS_LDO8:
+      write8s(S + A - ctx.tls_begin - E::tls_dtp_offset);
+      break;
+    case R_68K_TLS_IE32:
+      *(ub32 *)loc = sym.get_gottp_addr(ctx) + A - GOT;
+      break;
+    case R_68K_TLS_IE16:
+      write16(sym.get_gottp_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_IE8:
+      write8(sym.get_gottp_addr(ctx) + A - GOT);
+      break;
+    case R_68K_TLS_LE32:
+      *(ub32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_68K_TLS_LE16:
+      write16(S + A - ctx.tp_addr);
+      break;
+    case R_68K_TLS_LE8:
+      write8(S + A - ctx.tp_addr);
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_68K_32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub32 *)loc = *val;
+      else
+        *(ub32 *)loc = S + A;
+      break;
+    default:
+      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
+                 << rel;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      Error(ctx) << sym << ": GNU ifunc symbol is not supported on m68k";
+
+    switch (rel.r_type) {
+    case R_68K_32:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_68K_16:
+    case R_68K_8:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_68K_PC32:
+    case R_68K_PC16:
+    case R_68K_PC8:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_68K_GOTPCREL32:
+    case R_68K_GOTPCREL16:
+    case R_68K_GOTPCREL8:
+    case R_68K_GOTOFF32:
+    case R_68K_GOTOFF16:
+    case R_68K_GOTOFF8:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_68K_PLT32:
+    case R_68K_PLT16:
+    case R_68K_PLT8:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_68K_TLS_GD32:
+    case R_68K_TLS_GD16:
+    case R_68K_TLS_GD8:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_68K_TLS_LDM32:
+    case R_68K_TLS_LDM16:
+    case R_68K_TLS_LDM8:
+      ctx.needs_tlsld = true;
+      break;
+    case R_68K_TLS_IE32:
+    case R_68K_TLS_IE16:
+    case R_68K_TLS_IE8:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_68K_TLS_LDO32:
+    case R_68K_TLS_LDO16:
+    case R_68K_TLS_LDO8:
+    case R_68K_TLS_LE32:
+    case R_68K_TLS_LE16:
+    case R_68K_TLS_LE8:
+      break;
+    default:
+      Fatal(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+} // namespace mold::elf

elf/arch-ppc64v1.cc

@@ -0,0 +1,678 @@
+// This file contains code for the 64-bit PowerPC ELFv1 ABI that is
+// commonly used for big-endian PPC systems. Modern PPC systems that use
+// the processor in the little-endian mode use the ELFv2 ABI instead. For
+// ELFv2, see arch-ppc64v2.cc.
+//
+// Even though they are similiar, ELFv1 isn't only different from ELFv2 in
+// endianness. The most notable difference is, in ELFv1, a function
+// pointer doesn't directly refer the entry point of a function but
+// instead refers a data structure so-called "function descriptor".
+//
+// The function descriptor is essentially a pair of a function entry point
+// address and a value that should be set to %r2 before calling that
+// function. There is actually a third member, but we don't need to know
+// what that is. In total, the function descriptor is 24 bytes long. Here
+// is why we need it.
+//
+// PPC generally lacks PC-relative data access instructions. Position-
+// independent code sets GOT + 0x8000 to %r2 and access global variables
+// relative to %r2.
+//
+// Each ELF file has its own GOT. If a function calls another function in
+// the same ELF file, it doesn't have to reset %r2. However, if it is in
+// other file (e.g. other .so), it has to set a new value to %r2 so that
+// the register contains the callee's GOT + 0x8000.
+//
+// In this way, you can't call a function just by knowing the function's
+// entry point address. You also need to know a proper %r2 value for the
+// function. This is why a function pointer refers a tuple of an address
+// and a %r2 value.
+//
+// If a function call is made through PLT, PLT takes care of restoring %r2.
+// Therefore, the caller has to restore %r2 only for function calls
+// through function pointers.
+//
+// .opd (short for "official procedure descriptors") contains function
+// descriptors.
+//
+// You can think OPD as this: even in other targets, a function can have a
+// few different addresses for different purposes. It may not only have an
+// entry point address but may also have PLT and/or GOT addresses.
+// In PPCV1, it may have an OPD address in addition to these. OPD address
+// is used for relocations that refers the address of a function as a
+// function pointer.
+
+#include "mold.h"
+
+#include <algorithm>
+#include <tbb/parallel_for_each.h>
+
+namespace mold::elf {
+
+using E = PPC64V1;
+
+static u64 lo(u64 x)       { return x & 0xffff; }
+static u64 hi(u64 x)       { return x >> 16; }
+static u64 ha(u64 x)       { return (x + 0x8000) >> 16; }
+static u64 high(u64 x)     { return (x >> 16) & 0xffff; }
+static u64 higha(u64 x)    { return ((x + 0x8000) >> 16) & 0xffff; }
+static u64 higher(u64 x)   { return (x >> 32) & 0xffff; }
+static u64 highera(u64 x)  { return ((x + 0x8000) >> 32) & 0xffff; }
+static u64 highest(u64 x)  { return x >> 48; }
+static u64 highesta(u64 x) { return (x + 0x8000) >> 48; }
+
+static constexpr ScanAction toc_table[3][4] = {
+  // Absolute  Local    Imported data  Imported code
+  {  NONE,     BASEREL, DYNREL,        DYNREL },  // Shared object
+  {  NONE,     BASEREL, DYNREL,        DYNREL },  // Position-independent exec
+  {  NONE,     NONE,    DYNREL,        DYNREL },  // Position-dependent exec
+};
+
+// .plt is used only for lazy symbol resolution on PPC64. All PLT
+// calls are made via range extension thunks even if they are within
+// reach. Thunks read addresses from .got.plt and jump there.
+// Therefore, once PLT symbols are resolved and final addresses are
+// written to .got.plt, thunks just skip .plt and directly jump to the
+// resolved addresses.
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const ub32 insn[] = {
+    0x7d88'02a6, // mflr    r12
+    0x429f'0005, // bcl     20, 31, 4 // obtain PC
+    0x7d68'02a6, // mflr    r11
+    0xe84b'0024, // ld      r2,36(r11)
+    0x7d88'03a6, // mtlr    r12
+    0x7d62'5a14, // add     r11,r2,r11
+    0xe98b'0000, // ld      r12,0(r11)
+    0xe84b'0008, // ld      r2,8(r11)
+    0x7d89'03a6, // mtctr   r12
+    0xe96b'0010, // ld      r11,16(r11)
+    0x4e80'0420, // bctr
+    // .quad .got.plt - .plt - 8
+    0x0000'0000,
+    0x0000'0000,
+  };
+
+  static_assert(sizeof(insn) == E::plt_hdr_size);
+  memcpy(buf, insn, sizeof(insn));
+  *(ub64 *)(buf + 44) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 8;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  i64 offset = ctx.plt->shdr.sh_addr - sym.get_plt_addr(ctx) - 4;
+  *(ub32 *)(buf + 0) = 0x3800'0000 | sym.get_plt_idx(ctx);   // li %r0, PLT_INDEX
+  *(ub32 *)(buf + 4) = 0x4b00'0000 | (offset & 0x00ff'ffff); // b  plt0
+}
+
+// .plt.got is not necessary on PPC64 because range extension thunks
+// directly read GOT entries and jump there.
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_PPC64_ADDR64:
+    *(ub64 *)loc = val;
+    break;
+  case R_PPC64_REL32:
+    *(ub32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  case R_PPC64_REL64:
+    *(ub64 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (sym.is_ifunc()) {
+        *dynrel++ = ElfRel<E>(P, E::R_IRELATIVE, 0, S + A);
+        if (ctx.arg.apply_dynamic_relocs)
+          *(ub64 *)loc = S + A;
+      } else {
+        apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel, toc_table);
+      }
+      break;
+    case R_PPC64_TOC:
+      apply_dyn_absrel(ctx, *ctx.TOC, rel, loc, ctx.TOC->value, A, P, dynrel,
+                       toc_table);
+      break;
+    case R_PPC64_TOC16_HA:
+      *(ub16 *)loc = ha(S + A - ctx.TOC->value);
+      break;
+    case R_PPC64_TOC16_LO:
+      *(ub16 *)loc = S + A - ctx.TOC->value;
+      break;
+    case R_PPC64_TOC16_DS: {
+      i64 val = S + A - ctx.TOC->value;
+      check(val, -(1 << 15), 1 << 15);
+      *(ub16 *)loc |= val & 0xfffc;
+      break;
+    }
+    case R_PPC64_TOC16_LO_DS:
+      *(ub16 *)loc |= (S + A - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_REL24: {
+      i64 val = sym.get_addr(ctx, NO_OPD) + A - P;
+
+      if (sym.has_plt(ctx) || sign_extend(val, 25) != val) {
+        RangeExtensionRef ref = extra.range_extn[i];
+        assert(ref.thunk_idx != -1);
+
+        RangeExtensionThunk<E> &thunk = *output_section->thunks[ref.thunk_idx];
+        val = thunk.get_addr(ref.sym_idx) + A - P;
+      }
+
+      check(val, -(1 << 25), 1 << 25);
+      *(ub32 *)loc |= bits(val, 25, 2) << 2;
+
+      // If a callee is an external function, PLT saves %r2 to the
+      // caller's r2 save slot. We need to restore it after function
+      // return. To do so, there's usually a NOP as a placeholder
+      // after a BL. 0x6000'0000 is a NOP.
+      if (sym.has_plt(ctx) && *(ub32 *)(loc + 4) == 0x6000'0000)
+        *(ub32 *)(loc + 4) = 0xe841'0028; // ld r2, 40(r1)
+      break;
+    }
+    case R_PPC64_REL64:
+      *(ub64 *)loc = S + A - P;
+      break;
+    case R_PPC64_REL16_HA:
+      *(ub16 *)loc = ha(S + A - P);
+      break;
+    case R_PPC64_REL16_LO:
+      *(ub16 *)loc = S + A - P;
+      break;
+    case R_PPC64_PLT16_HA:
+      *(ub16 *)loc = ha(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_HI:
+      *(ub16 *)loc = hi(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_LO:
+      *(ub16 *)loc = lo(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_LO_DS:
+      *(ub16 *)loc |= (G + GOT - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_GOT_TPREL16_HA:
+      *(ub16 *)loc = ha(sym.get_gottp_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSGD16_HA:
+      *(ub16 *)loc = ha(sym.get_tlsgd_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSGD16_LO:
+      *(ub16 *)loc = sym.get_tlsgd_addr(ctx) - ctx.TOC->value;
+      break;
+    case R_PPC64_GOT_TLSLD16_HA:
+      *(ub16 *)loc = ha(ctx.got->get_tlsld_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSLD16_LO:
+      *(ub16 *)loc = ctx.got->get_tlsld_addr(ctx) - ctx.TOC->value;
+      break;
+    case R_PPC64_DTPREL16_HA:
+      *(ub16 *)loc = ha(S + A - ctx.tls_begin - E::tls_dtp_offset);
+      break;
+    case R_PPC64_TPREL16_HA:
+      *(ub16 *)loc = ha(S + A - ctx.tp_addr);
+      break;
+    case R_PPC64_DTPREL16_LO:
+      *(ub16 *)loc = S + A - ctx.tls_begin - E::tls_dtp_offset;
+      break;
+    case R_PPC64_TPREL16_LO:
+      *(ub16 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_PPC64_GOT_TPREL16_LO_DS:
+      *(ub16 *)loc |= (sym.get_gottp_addr(ctx) - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_PLTSEQ:
+    case R_PPC64_PLTCALL:
+    case R_PPC64_TLS:
+    case R_PPC64_TLSGD:
+    case R_PPC64_TLSLD:
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_alloc relocation: " << rel;
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub64 *)loc = *val;
+      else
+        *(ub64 *)loc = S + A;
+      break;
+    case R_PPC64_ADDR32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_PPC64_DTPREL64:
+      *(ub64 *)loc = S + A - ctx.tls_begin - E::tls_dtp_offset;
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_nonalloc: " << rel;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT | NEEDS_OPD);
+
+    if (rel.r_type != R_PPC64_REL24 && sym.get_type() == STT_FUNC)
+      sym.flags |= NEEDS_OPD;
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (sym.is_ifunc())
+        this->file.num_dynrel++;
+      else
+        scan_rel(ctx, sym, rel, toc_table);
+      break;
+    case R_PPC64_TOC:
+      scan_rel(ctx, sym, rel, toc_table);
+      break;
+    case R_PPC64_GOT_TPREL16_HA:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_PPC64_REL24:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_PPC64_PLT16_HA:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_PPC64_GOT_TLSGD16_HA:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_PPC64_GOT_TLSLD16_HA:
+      ctx.needs_tlsld = true;
+      break;
+    case R_PPC64_REL64:
+    case R_PPC64_TOC16_HA:
+    case R_PPC64_TOC16_LO:
+    case R_PPC64_TOC16_LO_DS:
+    case R_PPC64_TOC16_DS:
+    case R_PPC64_REL16_HA:
+    case R_PPC64_REL16_LO:
+    case R_PPC64_PLT16_HI:
+    case R_PPC64_PLT16_LO:
+    case R_PPC64_PLT16_LO_DS:
+    case R_PPC64_PLTSEQ:
+    case R_PPC64_PLTCALL:
+    case R_PPC64_TPREL16_HA:
+    case R_PPC64_TPREL16_LO:
+    case R_PPC64_GOT_TPREL16_LO_DS:
+    case R_PPC64_GOT_TLSGD16_LO:
+    case R_PPC64_GOT_TLSLD16_LO:
+    case R_PPC64_TLS:
+    case R_PPC64_TLSGD:
+    case R_PPC64_TLSLD:
+    case R_PPC64_DTPREL16_HA:
+    case R_PPC64_DTPREL16_LO:
+      break;
+    default:
+      Fatal(ctx) << *this << ": scan_relocations: " << rel;
+    }
+  }
+}
+
+template <>
+void RangeExtensionThunk<E>::copy_buf(Context<E> &ctx) {
+  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+
+  // If the destination is .plt.got, we save the current r2, read an
+  // address of a function descriptor from .got, restore %r2 and jump
+  // to the function.
+  static const ub32 pltgot_thunk[] = {
+    // Store the caller's %r2
+    0xf841'0028, // std   %r2, 40(%r1)
+    // Load an address of a function descriptor
+    0x3d82'0000, // addis %r12, %r2,  foo@got@toc@ha
+    0xe98c'0000, // ld    %r12, foo@got@toc@lo(%r12)
+    // Restore the callee's %r2
+    0xe84c'0008, // ld    %r2,  8(%r12)
+    // Jump to the function
+    0xe98c'0000, // ld    %r12, 0(%r12)
+    0x7d89'03a6, // mtctr %r12
+    0x4e80'0420, // bctr
+  };
+
+  // If the destination is .plt, read a function descriptor from .got.plt.
+  static const ub32 plt_thunk[] = {
+    // Store the caller's %r2
+    0xf841'0028, // std   %r2, 40(%r1)
+    // Materialize an address of a function descriptor
+    0x3d82'0000, // addis %r12, %r2,  foo@gotplt@toc@ha
+    0x398c'0000, // addi  %r12, %r12, foo@gotplt@toc@lo
+    // Restore the callee's %r2
+    0xe84c'0008, // ld    %r2,  8(%r12)
+    // Jump to the function
+    0xe98c'0000, // ld    %r12, 0(%r12)
+    0x7d89'03a6, // mtctr %r12
+    0x4e80'0420, // bctr
+  };
+
+  // If the destination is a non-imported function, we directly jump
+  // to the function entry address.
+  static const ub32 local_thunk[] = {
+    0x3d82'0000, // addis r12, r2,  foo@toc@ha
+    0x398c'0000, // addi  r12, r12, foo@toc@lo
+    0x7d89'03a6, // mtctr r12
+    0x4e80'0420, // bctr
+    0x6000'0000, // nop
+    0x6000'0000, // nop
+    0x6000'0000, // nop
+  };
+
+  static_assert(E::thunk_size == sizeof(pltgot_thunk));
+  static_assert(E::thunk_size == sizeof(plt_thunk));
+  static_assert(E::thunk_size == sizeof(local_thunk));
+
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    ub32 *loc = (ub32 *)(buf + i * E::thunk_size);
+
+    if (sym.has_got(ctx)) {
+      memcpy(loc, pltgot_thunk, sizeof(pltgot_thunk));
+      i64 val = sym.get_got_addr(ctx) - ctx.TOC->value;
+      loc[1] |= higha(val);
+      loc[2] |= lo(val);
+    } else if(sym.has_plt(ctx)) {
+      memcpy(loc, plt_thunk, sizeof(plt_thunk));
+      i64 val = sym.get_gotplt_addr(ctx) - ctx.TOC->value;
+      loc[1] |= higha(val);
+      loc[2] |= lo(val);
+    } else {
+      memcpy(loc, local_thunk, sizeof(local_thunk));
+      i64 val = sym.get_addr(ctx, NO_OPD) - ctx.TOC->value;
+      loc[0] |= higha(val);
+      loc[1] |= lo(val);
+    }
+  }
+}
+
+static InputSection<E> *get_opd_section(ObjectFile<E> &file) {
+  for (std::unique_ptr<InputSection<E>> &isec : file.sections)
+    if (isec && isec->name() == ".opd")
+      return isec.get();
+  return nullptr;
+}
+
+static ElfRel<E> *
+get_relocation_at(Context<E> &ctx, InputSection<E> &isec, i64 offset) {
+  std::span<ElfRel<E>> rels = isec.get_rels(ctx);
+
+  auto it = std::lower_bound(rels.begin(), rels.end(), offset,
+                             [](const ElfRel<E> &r, i64 offset) {
+    return r.r_offset < offset;
+  });
+
+  if (it == rels.end())
+    return nullptr;
+  if (it->r_offset != offset)
+    return nullptr;
+  return &*it;
+}
+
+struct OpdSymbol {
+  u64 r_offset = 0;
+  Symbol<E> *sym = nullptr;
+};
+
+static Symbol<E> *
+get_opd_sym_at(Context<E> &ctx, std::span<OpdSymbol> syms, i64 offset) {
+  auto it = std::lower_bound(syms.begin(), syms.end(), offset,
+                             [](const OpdSymbol &ent, i64 offset) {
+    return ent.r_offset < offset;
+  });
+
+  if (it == syms.end())
+    return nullptr;
+  if (it->r_offset != offset)
+    return nullptr;
+  return it->sym;
+}
+
+// Compiler creates an .opd entry for each function symbol. The intention
+// is to make it possible to create an output .opd section just by linking
+// input .opd sections in the same manner as we do to other normal input
+// sections.
+//
+// However, in reality, .opd isn't a normal input section. It needs many
+// special treatments as follows:
+//
+// 1. A function symbol refers not a .text but an .opd. Its address works
+//    fine for address-taking relocations such as R_PPC64_ADDR64. However,
+//    R_PPC64_REL24 (which is used for branch instruction) needs a
+//    function's real address instead of the function's .opd address.
+//    We need to read .opd contents to find out a function entry point
+//    address to apply R_PPC64_REL24.
+//
+// 2. Output .opd entries are needed only for functions whose addresses
+//    are taken. Just copying input .opd sections to an output would
+//    produces lots of dead .opd entries.
+//
+// 3. In this design, all function symbols refer an .opd section, and that
+//    doesn't work well with graph traversal optimizations such as garbage
+//    collection or identical comdat folding. For example, garbage
+//    collector would mark an .opd alive which in turn mark all functions
+//    thatare referenced by .opd as alive, effectively keeping all
+//    functions as alive.
+//
+// The problem is that the compiler creates a half-baked .opd section, and
+// the linker has to figure out what all these .opd entries and
+// relocations are trying to achieve. It's like the compiler would emit a
+// half-baked .plt section in an object file and the linker has to deal
+// with that. That's not a good design.
+//
+// So, in this function, we undo what the compiler did to .opd. We remove
+// function symbols from .opd and reattach them to their function entry
+// points. We also rewrite relocations that directly refer an input .opd
+// section so that they refer function symbols instead. We then mark input
+// .opd sections as dead.
+//
+// After this function, we mark symbols with the NEEDS_OPD flag if the
+// symbol needs an .opd entry. We then create an output .opd just like we
+// do for .plt or .got.
+void ppc64v1_rewrite_opd(Context<E> &ctx) {
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    InputSection<E> *opd = get_opd_section(*file);
+    if (!opd)
+      return;
+    opd->is_alive = false;
+
+    // Move symbols from .opd to .text.
+    std::vector<OpdSymbol> opd_syms;
+
+    for (Symbol<E> *sym : file->symbols) {
+      if (sym->file != file || sym->get_input_section() != opd)
+        continue;
+
+      if (u32 ty = sym->get_type(); ty != STT_FUNC && ty != STT_GNU_IFUNC)
+        continue;
+
+      ElfRel<E> *rel = get_relocation_at(ctx, *opd, sym->value);
+      if (!rel)
+        Fatal(ctx) << *file << ": cannot find a relocation in .opd for "
+                   << *sym << " at offset 0x" << std::hex << (u32)sym->value;
+
+      Symbol<E> *sym2 = file->symbols[rel->r_sym];
+      if (sym2->get_type() != STT_SECTION)
+        Fatal(ctx) << *file << ": bad relocation in .opd referring " << *sym2;
+
+      opd_syms.push_back({sym->value, sym});
+
+      sym->set_input_section(sym2->get_input_section());
+      sym->value = rel->r_addend;
+    }
+
+    // Sort symbols so that get_opd_sym_at() can do binary search.
+    sort(opd_syms, [](const OpdSymbol &a, const OpdSymbol &b) {
+      return a.r_offset < b.r_offset;
+    });
+
+    // Rewrite relocations directly referring .opd.
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+      if (!isec || !isec->is_alive || isec.get() == opd)
+        continue;
+
+      for (ElfRel<E> &r : isec->get_rels(ctx)) {
+        Symbol<E> &sym = *file->symbols[r.r_sym];
+        if (sym.get_input_section() != opd)
+          continue;
+
+        Symbol<E> *real_sym = get_opd_sym_at(ctx, opd_syms, r.r_addend);
+        if (!real_sym)
+          Fatal(ctx) << *isec << ": cannot find a symbol in .opd for " << r
+                     << " at offset 0x" << std::hex << (u32)r.r_addend;
+
+        r.r_sym = real_sym->sym_idx;
+        r.r_addend = 0;
+      }
+    }
+  });
+}
+
+// When a function is exported, the dynamic symbol for the function should
+// refers the function's .opd entry. This function marks such symbols with
+// NEEDS_OPD.
+void ppc64v1_scan_symbols(Context<E> &ctx) {
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (Symbol<E> *sym : file->symbols)
+      if (sym->file == file && sym->is_exported)
+        if (u32 ty = sym->get_type(); ty == STT_FUNC || ty == STT_GNU_IFUNC)
+          sym->flags |= NEEDS_OPD;
+  });
+
+  // Functions referenced by the ELF header also have to have .opd entries.
+  auto mark = [&](std::string_view name) {
+    if (!name.empty())
+      if (Symbol<E> &sym = *get_symbol(ctx, name); !sym.is_imported)
+        sym.flags |= NEEDS_OPD;
+  };
+
+  mark(ctx.arg.entry);
+  mark(ctx.arg.init);
+  mark(ctx.arg.fini);
+}
+
+void PPC64OpdSection::add_symbol(Context<E> &ctx, Symbol<E> *sym) {
+  sym->set_opd_idx(ctx, symbols.size());
+  symbols.push_back(sym);
+  this->shdr.sh_size += ENTRY_SIZE;
+}
+
+void PPC64OpdSection::copy_buf(Context<E> &ctx) {
+  ub64 *buf = (ub64 *)(ctx.buf + this->shdr.sh_offset);
+
+  for (Symbol<E> *sym : symbols) {
+    *buf++ = sym->get_addr(ctx, NO_PLT | NO_OPD);
+    *buf++ = ctx.TOC->value;
+    *buf++ = 0;
+  }
+}
+
+} // namespace mold::elf

elf/arch-ppc64v2.cc

@@ -0,0 +1,477 @@
+// This file implements the PowerPC ELFv2 ABI which was standardized in
+// 2014. Modern little-endian PowerPC systems are based on this ABI.
+// The ABI is often referred to as "ppc64le". This shouldn't be confused
+// with "ppc64" which refers the original, big-endian PowerPC systems.
+//
+// PPC64 is a bit tricky to support because PC-relative load/store
+// instructions are generally not available. Therefore, it's not easy
+// for position-independent code to load a value from, for example,
+// .got, as we can't do that with [PC + the offset to the .got entry].
+//
+// We can get the program counter by the following four instructions
+//
+//   mflr  r1  // save the current link register to r1
+//   bl    .+4 // branch to the next instruction as if it were a function
+//   mflr  r0  // copy the return address to r0
+//   mtlr  r1  // restore the original link register value
+//
+// , but that's too expensive to do if we do this for each load/store.
+//
+// As a workaround, most functions are compiled in such a way that r2 is
+// assumed to always contain the address of .got + 0x8000. With this, we
+// can for example load the first entry of .got with a single instruction
+// `lw r0, -0x8000(r2)`. r2 is called the TOC pointer.
+//
+// There's only one .got for each ELF module. Therefore, if a callee is in
+// the same ELF module, r2 doesn't have to be recomputed. Most function
+// calls are usually within the same ELF module, so this mechanism is
+// efficient.
+//
+// In PPC64, a function usually have two entry points, global and local.
+// The global entry point is usually 8 bytes precedes the local entry
+// point. In between is the following instructions:
+//
+//   addis r2, r12, .TOC.@ha
+//   addi  r2, r2,  .TOC.@lo + 4;
+//
+// The global entry point assumes that the address of itself is in r12,
+// and it computes its own TOC pointer from r12. It's easy to do so for
+// the callee because the offset between its .got + 0x8000 and the
+// function is known at link-time. The above code sequence then falls
+// through to the local entry point that assumes r2 is .got + 0x8000.
+//
+// So, if a callee's TOC pointer is different from the current one
+// (e.g. calling a function in another .so), we first load the callee's
+// address to r12 (e.g. from .got.plt with a r2-relative load) and branch
+// to that address. Then the callee computes its own TOC pointer using
+// r12.
+//
+// Note on section names: the PPC64 psABI uses a weird naming convention
+// which calls .got.plt .plt. We ignored that part because it's just
+// confusing. Since the runtime only cares about segments, we should be
+// able to name sections whatever we want.
+//
+// https://openpowerfoundation.org/specifications/64bitelfabi/
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = PPC64V2;
+
+// As a special case, we do not create copy relocations nor canonical
+// PLTs for .toc sections. PPC64's .toc is a compiler-generated
+// GOT-like section, and no user-generated code directly uses values
+// in it.
+static constexpr ScanAction toc_table[3][4] = {
+  // Absolute  Local    Imported data  Imported code
+  {  NONE,     BASEREL, DYNREL,        DYNREL },  // Shared object
+  {  NONE,     BASEREL, DYNREL,        DYNREL },  // Position-independent exec
+  {  NONE,     NONE,    DYNREL,        DYNREL },  // Position-dependent exec
+};
+
+static u64 lo(u64 x)       { return x & 0xffff; }
+static u64 hi(u64 x)       { return x >> 16; }
+static u64 ha(u64 x)       { return (x + 0x8000) >> 16; }
+static u64 high(u64 x)     { return (x >> 16) & 0xffff; }
+static u64 higha(u64 x)    { return ((x + 0x8000) >> 16) & 0xffff; }
+static u64 higher(u64 x)   { return (x >> 32) & 0xffff; }
+static u64 highera(u64 x)  { return ((x + 0x8000) >> 32) & 0xffff; }
+static u64 highest(u64 x)  { return x >> 48; }
+static u64 highesta(u64 x) { return (x + 0x8000) >> 48; }
+
+// .plt is used only for lazy symbol resolution on PPC64. All PLT
+// calls are made via range extension thunks even if they are within
+// reach. Thunks read addresses from .got.plt and jump there.
+// Therefore, once PLT symbols are resolved and final addresses are
+// written to .got.plt, thunks just skip .plt and directly jump to the
+// resolved addresses.
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const ul32 insn[] = {
+    // Get PC
+    0x7c08'02a6, // mflr    r0
+    0x429f'0005, // bcl     20, 31, 4 // obtain PC
+    0x7d68'02a6, // mflr    r11
+    0x7c08'03a6, // mtlr    r0
+    // Compute the PLT entry index
+    0xe80b'002c, // ld      r0, 44(r11)
+    0x7d8b'6050, // subf    r12, r11, r12
+    0x7d60'5a14, // add     r11, r0, r11
+    0x380c'ffcc, // addi    r0, r12, -52
+    0x7800'f082, // rldicl  r0, r0, 62, 2
+    // Load .got.plt[0] and .got.plt[1] and branch to .got.plt[0]
+    0xe98b'0000, // ld      r12, 0(r11)
+    0x7d89'03a6, // mtctr   r12
+    0xe96b'0008, // ld      r11, 8(r11)
+    0x4e80'0420, // bctr
+    // .quad .got.plt - .plt - 8
+    0x0000'0000,
+    0x0000'0000,
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ul64 *)(buf + 52) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 8;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  // bl plt0
+  *(ul32 *)buf = 0x4b00'0000;
+  *(ul32 *)buf |= (ctx.plt->shdr.sh_addr - sym.get_plt_addr(ctx)) & 0x00ff'ffff;
+}
+
+// .plt.got is not necessary on PPC64 because range extension thunks
+// directly read GOT entries and jump there.
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_PPC64_ADDR64:
+    *(ul64 *)loc = val;
+    break;
+  case R_PPC64_REL32:
+    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  case R_PPC64_REL64:
+    *(ul64 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+static u64 get_local_entry_offset(Context<E> &ctx, Symbol<E> &sym) {
+  i64 val = sym.esym().ppc_local_entry;
+  if (val == 0 || val == 1)
+    return 0;
+  if (val == 7)
+    Fatal(ctx) << sym << ": local entry offset 7 is reserved";
+  return 1 << val;
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (name() == ".toc")
+        apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel, toc_table);
+      else
+        apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel, dyn_absrel_table);
+      break;
+    case R_PPC64_TOC16_HA:
+      *(ul16 *)loc = ha(S + A - ctx.TOC->value);
+      break;
+    case R_PPC64_TOC16_LO:
+      *(ul16 *)loc = S + A - ctx.TOC->value;
+      break;
+    case R_PPC64_TOC16_DS:
+    case R_PPC64_TOC16_LO_DS:
+      *(ul16 *)loc |= (S + A - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_REL24: {
+      i64 val = S + A - P + get_local_entry_offset(ctx, sym);
+
+      if (sym.has_plt(ctx) || sign_extend(val, 25) != val) {
+        RangeExtensionRef ref = extra.range_extn[i];
+        assert(ref.thunk_idx != -1);
+        val = output_section->thunks[ref.thunk_idx]->get_addr(ref.sym_idx) + A - P;
+      }
+
+      check(val, -(1 << 25), 1 << 25);
+      *(ul32 *)loc |= bits(val, 25, 2) << 2;
+
+      // If a callee is an external function, PLT saves %r2 to the
+      // caller's r2 save slot. We need to restore it after function
+      // return. To do so, there's usually a NOP as a placeholder
+      // after a BL. 0x6000'0000 is a NOP.
+      if (sym.has_plt(ctx) && *(ul32 *)(loc + 4) == 0x6000'0000)
+        *(ul32 *)(loc + 4) = 0xe841'0018; // ld r2, 24(r1)
+      break;
+    }
+    case R_PPC64_REL64:
+      *(ul64 *)loc = S + A - P;
+      break;
+    case R_PPC64_REL16_HA:
+      *(ul16 *)loc = ha(S + A - P);
+      break;
+    case R_PPC64_REL16_LO:
+      *(ul16 *)loc = S + A - P;
+      break;
+    case R_PPC64_PLT16_HA:
+      *(ul16 *)loc = ha(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_HI:
+      *(ul16 *)loc = hi(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_LO:
+      *(ul16 *)loc = lo(G + GOT - ctx.TOC->value);
+      break;
+    case R_PPC64_PLT16_LO_DS:
+      *(ul16 *)loc |= (G + GOT - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_GOT_TPREL16_HA:
+      *(ul16 *)loc = ha(sym.get_gottp_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSGD16_HA:
+      *(ul16 *)loc = ha(sym.get_tlsgd_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSGD16_LO:
+      *(ul16 *)loc = sym.get_tlsgd_addr(ctx) - ctx.TOC->value;
+      break;
+    case R_PPC64_GOT_TLSLD16_HA:
+      *(ul16 *)loc = ha(ctx.got->get_tlsld_addr(ctx) - ctx.TOC->value);
+      break;
+    case R_PPC64_GOT_TLSLD16_LO:
+      *(ul16 *)loc = ctx.got->get_tlsld_addr(ctx) - ctx.TOC->value;
+      break;
+    case R_PPC64_DTPREL16_HA:
+      *(ul16 *)loc = ha(S + A - ctx.tls_begin - E::tls_dtp_offset);
+      break;
+    case R_PPC64_TPREL16_HA:
+      *(ul16 *)loc = ha(S + A - ctx.tp_addr);
+      break;
+    case R_PPC64_DTPREL16_LO:
+      *(ul16 *)loc = S + A - ctx.tls_begin - E::tls_dtp_offset;
+      break;
+    case R_PPC64_TPREL16_LO:
+      *(ul16 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_PPC64_GOT_TPREL16_LO_DS:
+      *(ul16 *)loc |= (sym.get_gottp_addr(ctx) - ctx.TOC->value) & 0xfffc;
+      break;
+    case R_PPC64_PLTSEQ:
+    case R_PPC64_PLTCALL:
+    case R_PPC64_TLS:
+    case R_PPC64_TLSGD:
+    case R_PPC64_TLSLD:
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_alloc relocation: " << rel;
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul64 *)loc = *val;
+      else
+        *(ul64 *)loc = S + A;
+      break;
+    case R_PPC64_ADDR32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ul32 *)loc = val;
+      break;
+    }
+    case R_PPC64_DTPREL64:
+      *(ul64 *)loc = S + A - ctx.tls_begin - E::tls_dtp_offset;
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_nonalloc: " << rel;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_PPC64_ADDR64:
+      if (name() == ".toc")
+        scan_rel(ctx, sym, rel, toc_table);
+      else
+        scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_PPC64_GOT_TPREL16_HA:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_PPC64_REL24:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_PPC64_PLT16_HA:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_PPC64_GOT_TLSGD16_HA:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_PPC64_GOT_TLSLD16_HA:
+      ctx.needs_tlsld = true;
+      break;
+    case R_PPC64_REL64:
+    case R_PPC64_TOC16_HA:
+    case R_PPC64_TOC16_LO:
+    case R_PPC64_TOC16_LO_DS:
+    case R_PPC64_TOC16_DS:
+    case R_PPC64_REL16_HA:
+    case R_PPC64_REL16_LO:
+    case R_PPC64_PLT16_HI:
+    case R_PPC64_PLT16_LO:
+    case R_PPC64_PLT16_LO_DS:
+    case R_PPC64_PLTSEQ:
+    case R_PPC64_PLTCALL:
+    case R_PPC64_TPREL16_HA:
+    case R_PPC64_TPREL16_LO:
+    case R_PPC64_GOT_TPREL16_LO_DS:
+    case R_PPC64_GOT_TLSGD16_LO:
+    case R_PPC64_GOT_TLSLD16_LO:
+    case R_PPC64_TLS:
+    case R_PPC64_TLSGD:
+    case R_PPC64_TLSLD:
+    case R_PPC64_DTPREL16_HA:
+    case R_PPC64_DTPREL16_LO:
+      break;
+    default:
+      Fatal(ctx) << *this << ": scan_relocations: " << rel;
+    }
+  }
+}
+
+template <>
+void RangeExtensionThunk<E>::copy_buf(Context<E> &ctx) {
+  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+
+  // If the destination is PLT, we read an address from .got.plt or .got
+  // and jump there.
+  static const ul32 plt_thunk[] = {
+    // Save r2 to the r2 save slot reserved in the caller's stack frame
+    0xf841'0018, // std   r2, 24(r1)
+    // Jump to a PLT entry
+    0x3d82'0000, // addis r12, r2, foo@gotplt@toc@ha
+    0xe98c'0000, // ld    r12, foo@gotplt@toc@lo(r12)
+    0x7d89'03a6, // mtctr r12
+    0x4e80'0420, // bctr
+  };
+
+  // If the destination is a non-imported function, we directly jump
+  // to its local entry point.
+  static const ul32 local_thunk[] = {
+    // Jump to a local entry point
+    0x3d82'0000, // addis r12, r2,  foo@toc@ha
+    0x398c'0000, // addi  r12, r12, foo@toc@lo
+    0x7d89'03a6, // mtctr r12
+    0x4e80'0420, // bctr
+    0x6000'0000, // nop
+  };
+
+  static_assert(E::thunk_size == sizeof(plt_thunk));
+  static_assert(E::thunk_size == sizeof(local_thunk));
+
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    ul32 *loc = (ul32 *)(buf + i * E::thunk_size);
+
+    if (sym.has_plt(ctx)) {
+      memcpy(loc, plt_thunk, sizeof(plt_thunk));
+      u64 got = sym.has_got(ctx) ? sym.get_got_addr(ctx) : sym.get_gotplt_addr(ctx);
+      i64 val = got - ctx.TOC->value;
+      loc[1] |= higha(val);
+      loc[2] |= lo(val);
+    } else {
+      memcpy(loc, local_thunk, sizeof(local_thunk));
+      i64 val = sym.get_addr(ctx) + get_local_entry_offset(ctx, sym) -
+                ctx.TOC->value;
+      loc[0] |= higha(val);
+      loc[1] |= lo(val);
+    }
+  }
+}
+
+} // namespace mold::elf

elf/arch-riscv.cc

@@ -0,0 +1,964 @@
+// RISC-V is a clean RISC ISA. It supports PC-relative load/store for
+// position-independent code. Its 32-bit and 64-bit ISAs are almost
+// identical. That is, you can think RV32 as a RV64 without 64-bit
+// operations. In this file, we support both RV64 and RV32.
+//
+// RISC-V is essentially little-endian, but the big-endian version is
+// available as an extension. GCC supports `-mbig-endian` to generate
+// big-endian code. Even in big-endian mode, machine instructions are
+// defined to be encoded in little-endian, though. Only the behavior of
+// load/store instructions are different between LE RISC-V and BE RISC-V.
+//
+// From the linker's point of view, the RISC-V's psABI is unique because
+// sections in input object files can be shrunk while being copied to the
+// output file. That is contrary to other psABIs in which sections are an
+// atomic unit of copying. Let me explain it in more details.
+//
+// Since RISC-V instructions are 16-bit or 32-bit long, there's no way to
+// embed a very large immediate into a branch instruction. In fact, JAL
+// (jump and link) instruction can jump to only within PC ± 1 MiB because
+// its immediate is only 21 bits long. If the destination is out of its
+// reach, we need to use two instructions instead; the first instruction
+// being AUIPC which sets upper 20 bits to a register and the second being
+// JALR with a 12-bit immediate and the register. Combined, they specify a
+// 32 bits displacement.
+//
+// Other RISC ISAs have the same limitation, and they solved the problem by
+// letting the linker create so-called "range extension thunks". It works as
+// follows: the compiler optimistically emits single jump instructions for
+// function calls. If the linker finds that a branch target is out of reach,
+// it emits a small piece of machine code near the branch instruction and
+// redirect the branch to the linker-synthesized code. The code constructs a
+// full 32-bit address in a register and jump to the destination. That
+// linker-synthesized code is called "range extension thunks" or just
+// "thunks".
+//
+// The RISC-V psABI is unique that it works the other way around. That is,
+// for RISC-V, the compiler always emits two instructions (AUIPC + JAL) for
+// function calls. If the linker finds the destination is reachable with a
+// single instruction, it replaces the two instructions with the one and
+// shrink the section size by one instruction length, instead of filling the
+// gap with a nop.
+//
+// With the presence of this relaxation, sections can no longer be
+// considered as an atomic unit. If we delete 4 bytes from the middle of a
+// section, all contents after that point needs to be shifted by 4. Symbol
+// values and relocation offsets have to be adjusted accordingly if they
+// refer past the deleted bytes.
+//
+// In mold, we use `r_deltas` to memorize how many bytes have be adjusted
+// for relocations. For symbols, we directly mutate their `value` member.
+//
+// RISC-V object files tend to have way more relocations than those for
+// other targets. This is because all branches, including ones that jump
+// within the same section, are explicitly expressed with relocations.
+// Here is why we need them: all control-flow statements such as `if` or
+// `for` are implemented using branch instructions. For other targets, the
+// compiler doesn't emit relocations for such branches because they know
+// at compile-time exactly how many bytes has to be skipped. That's not
+// true to RISC-V because the linker may delete bytes between a branch and
+// its destination. Therefore, all branches including in-section ones have
+// to be explicitly expressed with relocations.
+//
+// Note that this mechanism only shrink sections and never enlarge, as
+// the compiler always emits the longest instruction sequence. This
+// makes the linker implementation a bit simpler because we don't need
+// to worry about oscillation.
+//
+// https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc
+
+#include "mold.h"
+
+#include <tbb/parallel_for.h>
+#include <tbb/parallel_for_each.h>
+
+namespace mold::elf {
+
+static u32 itype(u32 val) {
+  return val << 20;
+}
+
+static u32 stype(u32 val) {
+  return bits(val, 11, 5) << 25 | bits(val, 4, 0) << 7;
+}
+
+static u32 btype(u32 val) {
+  return bit(val, 12) << 31 | bits(val, 10, 5) << 25 |
+         bits(val, 4, 1) << 8 | bit(val, 11) << 7;
+}
+
+static u32 utype(u32 val) {
+  // U-type instructions are used in combination with I-type
+  // instructions. U-type insn sets an immediate to the upper 20-bits
+  // of a register. I-type insn sign-extends a 12-bits immediate and
+  // adds it to a register value to construct a complete value. 0x800
+  // is added here to compensate for the sign-extension.
+  return (val + 0x800) & 0xffff'f000;
+}
+
+static u32 jtype(u32 val) {
+  return bit(val, 20) << 31 | bits(val, 10, 1)  << 21 |
+         bit(val, 11) << 20 | bits(val, 19, 12) << 12;
+}
+
+static u32 cbtype(u32 val) {
+  return bit(val, 8) << 12 | bit(val, 4) << 11 | bit(val, 3) << 10 |
+         bit(val, 7) << 6  | bit(val, 6) << 5  | bit(val, 2) << 4  |
+         bit(val, 1) << 3  | bit(val, 5) << 2;
+}
+
+static u32 cjtype(u32 val) {
+  return bit(val, 11) << 12 | bit(val, 4)  << 11 | bit(val, 9) << 10 |
+         bit(val, 8)  << 9  | bit(val, 10) << 8  | bit(val, 6) << 7  |
+         bit(val, 7)  << 6  | bit(val, 3)  << 5  | bit(val, 2) << 4  |
+         bit(val, 1)  << 3  | bit(val, 5)  << 2;
+}
+
+static void write_itype(u8 *loc, u32 val) {
+  *(ul32 *)loc &= 0b000000'00000'11111'111'11111'1111111;
+  *(ul32 *)loc |= itype(val);
+}
+
+static void write_stype(u8 *loc, u32 val) {
+  *(ul32 *)loc &= 0b000000'11111'11111'111'00000'1111111;
+  *(ul32 *)loc |= stype(val);
+}
+
+static void write_btype(u8 *loc, u32 val) {
+  *(ul32 *)loc &= 0b000000'11111'11111'111'00000'1111111;
+  *(ul32 *)loc |= btype(val);
+}
+
+static void write_utype(u8 *loc, u32 val) {
+  *(ul32 *)loc &= 0b000000'00000'00000'000'11111'1111111;
+  *(ul32 *)loc |= utype(val);
+}
+
+static void write_jtype(u8 *loc, u32 val) {
+  *(ul32 *)loc &= 0b000000'00000'00000'000'11111'1111111;
+  *(ul32 *)loc |= jtype(val);
+}
+
+static void write_cbtype(u8 *loc, u32 val) {
+  *(ul16 *)loc &= 0b111'000'111'00000'11;
+  *(ul16 *)loc |= cbtype(val);
+}
+
+static void write_cjtype(u8 *loc, u32 val) {
+  *(ul16 *)loc &= 0b111'00000000000'11;
+  *(ul16 *)loc |= cjtype(val);
+}
+
+// Returns the rd register of an R/I/U/J-type instruction.
+static u32 get_rd(u32 val) {
+  return bits(val, 11, 7);
+}
+
+static void set_rs1(u8 *loc, u32 rs1) {
+  assert(rs1 < 32);
+  *(ul32 *)loc &= 0b111111'11111'00000'111'11111'1111111;
+  *(ul32 *)loc |= rs1 << 15;
+}
+
+template <typename E>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const ul32 insn_64[] = {
+    0x0000'0397, // auipc  t2, %pcrel_hi(.got.plt)
+    0x41c3'0333, // sub    t1, t1, t3               # .plt entry + hdr + 12
+    0x0003'be03, // ld     t3, %pcrel_lo(1b)(t2)    # _dl_runtime_resolve
+    0xfd43'0313, // addi   t1, t1, -44              # .plt entry
+    0x0003'8293, // addi   t0, t2, %pcrel_lo(1b)    # &.got.plt
+    0x0013'5313, // srli   t1, t1, 1                # .plt entry offset
+    0x0082'b283, // ld     t0, 8(t0)                # link map
+    0x000e'0067, // jr     t3
+  };
+
+  static const ul32 insn_32[] = {
+    0x0000'0397, // auipc  t2, %pcrel_hi(.got.plt)
+    0x41c3'0333, // sub    t1, t1, t3               # .plt entry + hdr + 12
+    0x0003'ae03, // lw     t3, %pcrel_lo(1b)(t2)    # _dl_runtime_resolve
+    0xfd43'0313, // addi   t1, t1, -44              # .plt entry
+    0x0003'8293, // addi   t0, t2, %pcrel_lo(1b)    # &.got.plt
+    0x0023'5313, // srli   t1, t1, 2                # .plt entry offset
+    0x0042'a283, // lw     t0, 4(t0)                # link map
+    0x000e'0067, // jr     t3
+  };
+
+  if constexpr (E::is_64)
+    memcpy(buf, insn_64, sizeof(insn_64));
+  else
+    memcpy(buf, insn_32, sizeof(insn_32));
+
+  u64 gotplt = ctx.gotplt->shdr.sh_addr;
+  u64 plt = ctx.plt->shdr.sh_addr;
+  write_utype(buf, gotplt - plt);
+  write_itype(buf + 8, gotplt - plt);
+  write_itype(buf + 16, gotplt - plt);
+}
+
+static const ul32 plt_entry_64[] = {
+  0x0000'0e17, // auipc   t3, %pcrel_hi([email protected])
+  0x000e'3e03, // ld      t3, %pcrel_lo(1b)(t3)
+  0x000e'0367, // jalr    t1, t3
+  0x0000'0013, // nop
+};
+
+static const ul32 plt_entry_32[] = {
+  0x0000'0e17, // auipc   t3, %pcrel_hi([email protected])
+  0x000e'2e03, // lw      t3, %pcrel_lo(1b)(t3)
+  0x000e'0367, // jalr    t1, t3
+  0x0000'0013, // nop
+};
+
+template <typename E>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  if constexpr (E::is_64)
+    memcpy(buf, plt_entry_64, sizeof(plt_entry_64));
+  else
+    memcpy(buf, plt_entry_32, sizeof(plt_entry_32));
+
+  u64 gotplt = sym.get_gotplt_addr(ctx);
+  u64 plt = sym.get_plt_addr(ctx);
+  write_utype(buf, gotplt - plt);
+  write_itype(buf + 4, gotplt - plt);
+}
+
+template <typename E>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  if constexpr (E::is_64)
+    memcpy(buf, plt_entry_64, sizeof(plt_entry_64));
+  else
+    memcpy(buf, plt_entry_32, sizeof(plt_entry_32));
+
+  u64 got = sym.get_got_addr(ctx);
+  u64 plt = sym.get_plt_addr(ctx);
+  write_utype(buf, got - plt);
+  write_itype(buf + 4, got - plt);
+}
+
+template <typename E>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_RISCV_ADD32:
+    *(U32<E> *)loc += val;
+    break;
+  case R_RISCV_SUB8:
+    *loc -= val;
+    break;
+  case R_RISCV_SUB16:
+    *(U16<E> *)loc -= val;
+    break;
+  case R_RISCV_SUB32:
+    *(U32<E> *)loc -= val;
+    break;
+  case R_RISCV_SUB6:
+    *loc = (*loc & 0b1100'0000) | ((*loc - val) & 0b0011'1111);
+    break;
+  case R_RISCV_SET6:
+    *loc = (*loc & 0b1100'0000) | (val & 0b0011'1111);
+    break;
+  case R_RISCV_SET8:
+    *loc = val;
+    break;
+  case R_RISCV_SET16:
+    *(U16<E> *)loc = val;
+    break;
+  case R_RISCV_SET32:
+    *(U32<E> *)loc = val;
+    break;
+  case R_RISCV_32_PCREL:
+    *(U32<E> *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <typename E>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  auto get_r_delta = [&](i64 idx) {
+    return extra.r_deltas.empty() ? 0 : extra.r_deltas[idx];
+  };
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE || rel.r_type == R_RISCV_RELAX)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    i64 r_offset = rel.r_offset - get_r_delta(i);
+    i64 removed_bytes = get_r_delta(i + 1) - get_r_delta(i);
+    u8 *loc = base + r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_RISCV_32:
+      if constexpr (E::is_64)
+        *(U32<E> *)loc = S + A;
+      else
+        apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_RISCV_64:
+      assert(E::is_64);
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_RISCV_BRANCH: {
+      i64 val = S + A - P;
+      check(val, -(1 << 12), 1 << 12);
+      write_btype(loc, val);
+      break;
+    }
+    case R_RISCV_JAL: {
+      i64 val = S + A - P;
+      check(val, -(1 << 20), 1 << 20);
+      write_jtype(loc, val);
+      break;
+    }
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT: {
+      u32 rd = get_rd(*(ul32 *)(contents.data() + rel.r_offset + 4));
+
+      if (removed_bytes == 4) {
+        // auipc + jalr -> jal
+        *(ul32 *)loc = (rd << 7) | 0b1101111;
+        write_jtype(loc, S + A - P);
+      } else if (removed_bytes == 6 && rd == 0) {
+        // auipc + jalr -> c.j
+        *(ul16 *)loc = 0b101'00000000000'01;
+        write_cjtype(loc, S + A - P);
+      } else if (removed_bytes == 6 && rd == 1) {
+        // auipc + jalr -> c.jal
+        assert(!E::is_64);
+        *(ul16 *)loc = 0b001'00000000000'01;
+        write_cjtype(loc, S + A - P);
+      } else {
+        assert(removed_bytes == 0);
+        u64 val = sym.esym().is_undef_weak() ? 0 : S + A - P;
+        check(val, -(1LL << 31), 1LL << 31);
+        write_utype(loc, val);
+        write_itype(loc + 4, val);
+      }
+      break;
+    }
+    case R_RISCV_GOT_HI20:
+      *(ul32 *)loc = G + GOT + A - P;
+      break;
+    case R_RISCV_TLS_GOT_HI20:
+      *(ul32 *)loc = sym.get_gottp_addr(ctx) + A - P;
+      break;
+    case R_RISCV_TLS_GD_HI20:
+      *(ul32 *)loc = sym.get_tlsgd_addr(ctx) + A - P;
+      break;
+    case R_RISCV_PCREL_HI20:
+      if (sym.esym().is_undef_weak()) {
+        // Calling an undefined weak symbol does not make sense.
+        // We make such call into an infinite loop. This should
+        // help debugging of a faulty program.
+        *(ul32 *)loc = 0;
+      } else {
+        *(ul32 *)loc = S + A - P;
+      }
+      break;
+    case R_RISCV_HI20: {
+      i64 val = S + A;
+      if (removed_bytes == 0) {
+        check(val, -(1LL << 31), 1LL << 31);
+        write_utype(loc, val);
+      } else {
+        assert(removed_bytes == 4);
+        assert(sign_extend(val, 11) == val);
+      }
+      break;
+    }
+    case R_RISCV_LO12_I:
+    case R_RISCV_LO12_S: {
+      i64 val = S + A;
+      if (rel.r_type == R_RISCV_LO12_I)
+        write_itype(loc, val);
+      else
+        write_stype(loc, val);
+
+      // Rewrite `lw t1, 0(t0)` with `lw t1, 0(x0)` if the address is
+      // accessible relative to the zero register. If the upper 20 bits
+      // are all zero, the corresponding LUI might have been removed.
+      if (sign_extend(val, 11) == val)
+        set_rs1(loc, 0);
+      break;
+    }
+    case R_RISCV_TPREL_HI20:
+      assert(removed_bytes == 0 || removed_bytes == 4);
+      if (removed_bytes == 0)
+        write_utype(loc, S + A - ctx.tp_addr);
+      break;
+    case R_RISCV_TPREL_ADD:
+      break;
+    case R_RISCV_TPREL_LO12_I:
+    case R_RISCV_TPREL_LO12_S: {
+      i64 val = S + A - ctx.tp_addr;
+      if (rel.r_type == R_RISCV_TPREL_LO12_I)
+        write_itype(loc, val);
+      else
+        write_stype(loc, val);
+
+      // Rewrite `lw t1, 0(t0)` with `lw t1, 0(tp)` if the address is
+      // directly accessible using tp. tp is x4.
+      if (sign_extend(val, 11) == val)
+        set_rs1(loc, 4);
+      break;
+    }
+    case R_RISCV_ADD8:
+      loc += S + A;
+      break;
+    case R_RISCV_ADD16:
+      *(U16<E> *)loc += S + A;
+      break;
+    case R_RISCV_ADD32:
+      *(U32<E> *)loc += S + A;
+      break;
+    case R_RISCV_ADD64:
+      *(U64<E> *)loc += S + A;
+      break;
+    case R_RISCV_SUB8:
+      loc -= S + A;
+      break;
+    case R_RISCV_SUB16:
+      *(U16<E> *)loc -= S + A;
+      break;
+    case R_RISCV_SUB32:
+      *(U32<E> *)loc -= S + A;
+      break;
+    case R_RISCV_SUB64:
+      *(U64<E> *)loc -= S + A;
+      break;
+    case R_RISCV_ALIGN: {
+      // A R_RISCV_ALIGN is followed by a NOP sequence. We need to remove
+      // zero or more bytes so that the instruction after R_RISCV_ALIGN is
+      // aligned to a given alignment boundary.
+      //
+      // We need to guarantee that the NOP sequence is valid after byte
+      // removal (e.g. we can't remove the first 2 bytes of a 4-byte NOP).
+      // For the sake of simplicity, we always rewrite the entire NOP sequence.
+      i64 padding_bytes = rel.r_addend - removed_bytes;
+      assert((padding_bytes & 1) == 0);
+
+      i64 i = 0;
+      for (; i <= padding_bytes - 4; i += 4)
+        *(ul32 *)(loc + i) = 0x0000'0013; // nop
+      if (i < padding_bytes)
+        *(ul16 *)(loc + i) = 0x0001;      // c.nop
+      break;
+    }
+    case R_RISCV_RVC_BRANCH: {
+      i64 val = S + A - P;
+      check(val, -(1 << 8), 1 << 8);
+      write_cbtype(loc, val);
+      break;
+    }
+    case R_RISCV_RVC_JUMP: {
+      i64 val = S + A - P;
+      check(val, -(1 << 11), 1 << 11);
+      write_cjtype(loc, val);
+      break;
+    }
+    case R_RISCV_SUB6:
+      *loc = (*loc & 0b1100'0000) | ((*loc - (S + A)) & 0b0011'1111);
+      break;
+    case R_RISCV_SET6:
+      *loc = (*loc & 0b1100'0000) | ((S + A) & 0b0011'1111);
+      break;
+    case R_RISCV_SET8:
+      *loc = S + A;
+      break;
+    case R_RISCV_SET16:
+      *(U16<E> *)loc = S + A;
+      break;
+    case R_RISCV_SET32:
+      *(U32<E> *)loc = S + A;
+      break;
+    case R_RISCV_32_PCREL:
+      *(U32<E> *)loc = S + A - P;
+      break;
+    case R_RISCV_PCREL_LO12_I:
+    case R_RISCV_PCREL_LO12_S:
+      // These relocations are handled in the next loop.
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+
+  // Handle PC-relative LO12 relocations. In the above loop, pcrel HI20
+  // relocations overwrote instructions with full 32-bit values to allow
+  // their corresponding pcrel LO12 relocations to read their values.
+  for (i64 i = 0; i < rels.size(); i++) {
+    switch (rels[i].r_type) {
+    case R_RISCV_PCREL_LO12_I:
+    case R_RISCV_PCREL_LO12_S: {
+      Symbol<E> &sym = *file.symbols[rels[i].r_sym];
+      assert(sym.get_input_section() == this);
+
+      u8 *loc = base + rels[i].r_offset - get_r_delta(i);
+      u32 val = *(ul32 *)(base + sym.value);
+
+      if (rels[i].r_type == R_RISCV_PCREL_LO12_I)
+        write_itype(loc, val);
+      else
+        write_stype(loc, val);
+    }
+    }
+  }
+
+  // Restore the original instructions pcrel HI20 relocations overwrote.
+  for (i64 i = 0; i < rels.size(); i++) {
+    switch (rels[i].r_type) {
+    case R_RISCV_GOT_HI20:
+    case R_RISCV_PCREL_HI20:
+    case R_RISCV_TLS_GOT_HI20:
+    case R_RISCV_TLS_GD_HI20: {
+      u8 *loc = base + rels[i].r_offset - get_r_delta(i);
+      u32 val = *(ul32 *)loc;
+      memcpy(loc, contents.data() + rels[i].r_offset, 4);
+      write_utype(loc, val);
+    }
+    }
+  }
+}
+
+template <typename E>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_RISCV_32:
+      *(U32<E> *)loc = S + A;
+      break;
+    case R_RISCV_64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(U64<E> *)loc = *val;
+      else
+        *(U64<E> *)loc = S + A;
+      break;
+    case R_RISCV_ADD8:
+      *loc += S + A;
+      break;
+    case R_RISCV_ADD16:
+      *(U16<E> *)loc += S + A;
+      break;
+    case R_RISCV_ADD32:
+      *(U32<E> *)loc += S + A;
+      break;
+    case R_RISCV_ADD64:
+      *(U64<E> *)loc += S + A;
+      break;
+    case R_RISCV_SUB8:
+      *loc -= S + A;
+      break;
+    case R_RISCV_SUB16:
+      *(U16<E> *)loc -= S + A;
+      break;
+    case R_RISCV_SUB32:
+      *(U32<E> *)loc -= S + A;
+      break;
+    case R_RISCV_SUB64:
+      *(U64<E> *)loc -= S + A;
+      break;
+    case R_RISCV_SUB6:
+      *loc = (*loc & 0b1100'0000) | ((*loc - (S + A)) & 0b0011'1111);
+      break;
+    case R_RISCV_SET6:
+      *loc = (*loc & 0b1100'0000) | ((S + A) & 0b0011'1111);
+      break;
+    case R_RISCV_SET8:
+      *loc = S + A;
+      break;
+    case R_RISCV_SET16:
+      *(U16<E> *)loc = S + A;
+      break;
+    case R_RISCV_SET32:
+      *(U32<E> *)loc = S + A;
+      break;
+    default:
+      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
+                 << rel;
+      break;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <typename E>
+void InputSection<E>::copy_contents_riscv(Context<E> &ctx, u8 *buf) {
+  // If a section is not relaxed, we can copy it as a one big chunk.
+  if (extra.r_deltas.empty()) {
+    uncompress_to(ctx, buf);
+    return;
+  }
+
+  // Memory-allocated sections may be relaxed, so copy each segment
+  // individually.
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+  i64 pos = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    i64 delta = extra.r_deltas[i + 1] - extra.r_deltas[i];
+    if (delta == 0)
+      continue;
+    assert(delta > 0);
+
+    const ElfRel<E> &r = rels[i];
+    memcpy(buf, contents.data() + pos, r.r_offset - pos);
+    buf += r.r_offset - pos;
+    pos = r.r_offset + delta;
+  }
+
+  memcpy(buf, contents.data() + pos, contents.size() - pos);
+}
+
+template <typename E>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_RISCV_32:
+      if constexpr (E::is_64)
+        scan_rel(ctx, sym, rel, absrel_table);
+      else
+        scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_RISCV_HI20:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_RISCV_64:
+      if constexpr (!E::is_64)
+        Fatal(ctx) << *this << ": R_RISCV_64 cannot be used on RV32";
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_RISCV_GOT_HI20:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_RISCV_TLS_GOT_HI20:
+      ctx.has_gottp_rel = true;
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_RISCV_TLS_GD_HI20:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_RISCV_32_PCREL:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_RISCV_BRANCH:
+    case R_RISCV_JAL:
+    case R_RISCV_PCREL_HI20:
+    case R_RISCV_PCREL_LO12_I:
+    case R_RISCV_PCREL_LO12_S:
+    case R_RISCV_LO12_I:
+    case R_RISCV_LO12_S:
+    case R_RISCV_TPREL_HI20:
+    case R_RISCV_TPREL_LO12_I:
+    case R_RISCV_TPREL_LO12_S:
+    case R_RISCV_TPREL_ADD:
+    case R_RISCV_ADD8:
+    case R_RISCV_ADD16:
+    case R_RISCV_ADD32:
+    case R_RISCV_ADD64:
+    case R_RISCV_SUB8:
+    case R_RISCV_SUB16:
+    case R_RISCV_SUB32:
+    case R_RISCV_SUB64:
+    case R_RISCV_ALIGN:
+    case R_RISCV_RVC_BRANCH:
+    case R_RISCV_RVC_JUMP:
+    case R_RISCV_RELAX:
+    case R_RISCV_SUB6:
+    case R_RISCV_SET6:
+    case R_RISCV_SET8:
+    case R_RISCV_SET16:
+    case R_RISCV_SET32:
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+template <typename E>
+static bool is_resizable(Context<E> &ctx, InputSection<E> *isec) {
+  return isec && isec->is_alive && (isec->shdr().sh_flags & SHF_ALLOC) &&
+         (isec->shdr().sh_flags & SHF_EXECINSTR);
+}
+
+// Returns the distance between a relocated place and a symbol.
+template <typename E>
+static i64 compute_distance(Context<E> &ctx, Symbol<E> &sym,
+                            InputSection<E> &isec, const ElfRel<E> &rel) {
+  // We handle absolute symbols as if they were infinitely far away
+  // because `shrink_section` may increase a distance between a branch
+  // instruction and an absolute symbol. Branching to an absolute
+  // location is extremely rare in real code, though.
+  if (sym.is_absolute())
+    return INT32_MAX;
+
+  // Likewise, relocations against weak undefined symbols won't be relaxed.
+  if (sym.esym().is_undef_weak())
+    return INT32_MAX;
+
+  // Compute a distance between the relocated place and the symbol.
+  i64 S = sym.get_addr(ctx);
+  i64 A = rel.r_addend;
+  i64 P = isec.get_addr() + rel.r_offset;
+  return S + A - P;
+}
+
+// Scan relocations to shrink sections.
+template <typename E>
+static void shrink_section(Context<E> &ctx, InputSection<E> &isec, bool use_rvc) {
+  std::span<const ElfRel<E>> rels = isec.get_rels(ctx);
+  isec.extra.r_deltas.resize(rels.size() + 1);
+
+  i64 delta = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &r = rels[i];
+    Symbol<E> &sym = *isec.file.symbols[r.r_sym];
+    isec.extra.r_deltas[i] = delta;
+
+    // Handling R_RISCV_ALIGN is mandatory.
+    //
+    // R_RISCV_ALIGN refers NOP instructions. We need to eliminate some
+    // or all of the instructions so that the instruction that immediately
+    // follows the NOPs is aligned to a specified alignment boundary.
+    if (r.r_type == R_RISCV_ALIGN) {
+      // The total bytes of NOPs is stored to r_addend, so the next
+      // instruction is r_addend away.
+      u64 loc = isec.get_addr() + r.r_offset - delta;
+      u64 next_loc = loc + r.r_addend;
+      u64 alignment = bit_ceil(r.r_addend + 1);
+      assert(alignment <= (1 << isec.p2align));
+      delta += next_loc - align_to(loc, alignment);
+      continue;
+    }
+
+    // Handling other relocations is optional.
+    if (!ctx.arg.relax || i == rels.size() - 1 ||
+        rels[i + 1].r_type != R_RISCV_RELAX)
+      continue;
+
+    // Linker-synthesized symbols haven't been assigned their final
+    // values when we are shrinking sections because actual values can
+    // be computed only after we fix the file layout. Therefore, we
+    // assume that relocations against such symbols are always
+    // non-relaxable.
+    if (sym.file == ctx.internal_obj)
+      continue;
+
+    switch (r.r_type) {
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT: {
+      // These relocations refer an AUIPC + JALR instruction pair to
+      // allow to jump to anywhere in PC ± 2 GiB. If the jump target is
+      // close enough to PC, we can use C.J, C.JAL or JAL instead.
+      i64 dist = compute_distance(ctx, sym, isec, r);
+      if (dist & 1)
+        break;
+
+      std::string_view contents = isec.contents;
+      i64 rd = get_rd(*(ul32 *)(contents.data() + r.r_offset + 4));
+
+      if (rd == 0 && sign_extend(dist, 11) == dist && use_rvc) {
+        // If rd is x0 and the jump target is within ±2 KiB, we can use
+        // C.J, saving 6 bytes.
+        delta += 6;
+      } else if (rd == 1 && sign_extend(dist, 11) == dist && use_rvc && !E::is_64) {
+        // If rd is x1 and the jump target is within ±2 KiB, we can use
+        // C.JAL. This is RV32 only because C.JAL is RV32-only instruction.
+        delta += 6;
+      } else if (sign_extend(dist, 20) == dist) {
+        // If the jump target is within ±1 MiB, we can use JAL.
+        delta += 4;
+      }
+      break;
+    }
+    case R_RISCV_HI20: {
+      // If the upper 20 bits are all zero, we can remove LUI.
+      // The corresponding instructions referred by LO12_I/LO12_S
+      // relocations will use the zero register instead.
+      i64 val = sym.get_addr(ctx);
+      if (sign_extend(val, 11) == val)
+        delta += 4;
+      break;
+    }
+    case R_RISCV_TPREL_HI20:
+    case R_RISCV_TPREL_ADD: {
+      // These relocations are used to materialize the upper 20 bits of
+      // an address relative to the thread pointer as follows:
+      //
+      //  lui  a5,%tprel_hi(foo)         # R_RISCV_TPREL_HI20 (symbol)
+      //  add  a5,a5,tp,%tprel_add(foo)  # R_RISCV_TPREL_ADD (symbol)
+      //
+      // Then thread-local variable `foo` is accessed with a 12-bit offset
+      // like this:
+      //
+      //  sw   t0,%tprel_lo(foo)(a5)     # R_RISCV_TPREL_LO12_S (symbol)
+      //
+      // However, if the offset is ±2 KiB, we don't need to materialize
+      // the upper 20 bits in a register. We can instead access the
+      // thread-local variable directly with TP like this:
+      //
+      //  sw   t0,%tprel_lo(foo)(tp)
+      //
+      // Here, we remove `lui` and `add` if the offset is within ±2 KiB.
+      i64 val = sym.get_addr(ctx) + r.r_addend - ctx.tp_addr;
+      if (sign_extend(val, 11) == val)
+        delta += 4;
+      break;
+    }
+    }
+  }
+
+  isec.extra.r_deltas[rels.size()] = delta;
+  isec.sh_size -= delta;
+}
+
+// Shrink sections by interpreting relocations.
+//
+// This operation seems to be optional, because by default longest
+// instructions are being used. However, calling this function is actually
+// mandatory because of R_RISCV_ALIGN. R_RISCV_ALIGN is a directive to the
+// linker to align the location referred to by the relocation to a
+// specified byte boundary. We at least have to interpret them to satisfy
+// the alignment constraints.
+template <typename E>
+i64 riscv_resize_sections(Context<E> &ctx) {
+  Timer t(ctx, "riscv_resize_sections");
+
+  // True if we can use the 2-byte instructions. This is usually true on
+  // Unix because RV64GC is generally considered the baseline hardware.
+  bool use_rvc = get_eflags(ctx) & EF_RISCV_RVC;
+
+  // Find all the relocations that can be relaxed.
+  // This step should only shrink sections.
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections)
+      if (is_resizable(ctx, isec.get()))
+        shrink_section(ctx, *isec, use_rvc);
+  });
+
+  // Fix symbol values.
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (Symbol<E> *sym : file->symbols) {
+      if (sym->file != file)
+        continue;
+
+      InputSection<E> *isec = sym->get_input_section();
+      if (!isec || isec->extra.r_deltas.empty())
+        continue;
+
+      std::span<const ElfRel<E>> rels = isec->get_rels(ctx);
+      auto it = std::lower_bound(rels.begin(), rels.end(), sym->value,
+                                 [&](const ElfRel<E> &r, u64 val) {
+        return r.r_offset < val;
+      });
+
+      sym->value -= isec->extra.r_deltas[it - rels.begin()];
+    }
+  });
+
+  // Re-compute section offset again to finalize them.
+  compute_section_sizes(ctx);
+  return set_osec_offsets(ctx);
+}
+
+#define INSTANTIATE(E)                                                       \
+  template void write_plt_header(Context<E> &, u8 *);                        \
+  template void write_plt_entry(Context<E> &, u8 *, Symbol<E> &);            \
+  template void write_pltgot_entry(Context<E> &, u8 *, Symbol<E> &);         \
+  template void                                                              \
+  EhFrameSection<E>::apply_reloc(Context<E> &, const ElfRel<E> &, u64, u64); \
+  template void InputSection<E>::apply_reloc_alloc(Context<E> &, u8 *);      \
+  template void InputSection<E>::apply_reloc_nonalloc(Context<E> &, u8 *);   \
+  template void InputSection<E>::copy_contents_riscv(Context<E> &, u8 *);    \
+  template void InputSection<E>::scan_relocations(Context<E> &);             \
+  template i64 riscv_resize_sections(Context<E> &);
+
+INSTANTIATE(RV64LE);
+INSTANTIATE(RV64BE);
+INSTANTIATE(RV32LE);
+INSTANTIATE(RV32BE);
+
+} // namespace mold::elf

elf/arch-s390x.cc

@@ -0,0 +1,559 @@
+// This file contains code for the IBM z/Architecture 64-bit ISA, which is
+// commonly referred to as "s390x" on Linux.
+//
+// z/Architecture is a 64-bit CISC ISA developed by IBM around 2000 for
+// IBM's "big iron" mainframe computers. The computers are direct
+// descendents of IBM System/360 all the way back in 1966. I've never
+// actually seen a mainframe, and you probaly haven't either, but it looks
+// like the mainframe market is still large enough to sustain its ecosystem.
+// Ubuntu for example provides the official support for s390x as of 2022.
+// Since they are being actively maintained, we need to support them.
+//
+// As an instruction set, s390x isn't particularly odd. It has 16 general-
+// purpose registers. Instructions are 2, 4 or 6 bytes long and always
+// aligned to 2 bytes boundaries. Despite unfamiliarty, I found that it
+// just feels like a 64-bit i386 in a parallel universe.
+//
+// Here is the register usage in this ABI:
+//
+//   r0-r1: reserved as scratch registers so we can use them in our PLT
+//   r2:    parameter passing and return values
+//   r3-r6: parameter passing
+//   r12:   address of GOT if position-independent code
+//   r14:   return address
+//   r15:   stack pointer
+//   a1:    upper 32 bits of TP (thread pointer)
+//   a2:    lower 32 bits of TP (thread pointer)
+//
+// TLS is supported on s390x in the same way as it is on other targets
+// with one exeption. On other targets, __tls_get_addr is used to get an
+// address of a thread-local variable. On s390x, __tls_get_offset is used
+// instead. The difference is __tls_get_offset returns an address of a
+// thread-local variable as an offset from TP. So we need to add TP to a
+// return value before use. I don't know why it is different, but that is
+// the way it is.
+//
+// https://github.com/IBM/s390x-abi/releases/download/v1.6/lzsabi_s390x.pdf
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = S390X;
+
+static void write_low12(u8 *loc, u64 val) {
+  *(ub16 *)loc &= 0xf000;
+  *(ub16 *)loc |= val & 0x0fff;
+}
+
+static void write_mid20(u8 *loc, u64 val) {
+  *(ub32 *)loc &= 0xf000'00ff;
+  *(ub32 *)loc |= (bits(val, 11, 0) << 16) | (bits(val, 19, 12) << 8);
+}
+
+static void write_low24(u8 *loc, u64 val) {
+  *(ub32 *)loc &= 0xff00'0000;
+  *(ub32 *)loc |= val & 0x00ff'ffff;
+}
+
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static u8 insn[] = {
+    0xe3, 0x00, 0xf0, 0x38, 0x00, 0x24, // stg   %r0, 56(%r15)
+    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_OFFSET
+    0xd2, 0x07, 0xf0, 0x30, 0x10, 0x08, // mvc   48(8, %r15), 8(%r1)
+    0xe3, 0x10, 0x10, 0x10, 0x00, 0x04, // lg    %r1, 16(%r1)
+    0x07, 0xf1,                         // br    %r1
+    0x07, 0x00, 0x07, 0x00, 0x07, 0x00, // nopr; nopr; nopr
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 8) = (ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 6) >> 1;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static u8 insn[] = {
+    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_ENTRY_OFFSET
+    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
+    0xc0, 0x01, 0, 0, 0, 0,             // lgfi  %r0, PLT_INDEX
+    0x07, 0xf1,                         // br    %r1
+    0x07, 0x00, 0x07, 0x00, 0x07, 0x00, // nopr; nopr; nopr
+    0x07, 0x00, 0x07, 0x00, 0x07, 0x00, // nopr; nopr; nopr
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 2) = (sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx)) >> 1;
+  *(ub32 *)(buf + 14) = sym.get_plt_idx(ctx) * sizeof(ElfRel<E>);
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static u8 insn[] = {
+    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOT_ENTRY_OFFSET
+    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
+    0x07, 0xf1,                         // br    %r1
+    0x07, 0x00,                         // nopr
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)(buf + 2) = (sym.get_got_addr(ctx) - sym.get_plt_addr(ctx)) >> 1;
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_390_PC32:
+    *(ub32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  case R_390_64:
+    *(ub64 *)loc = val;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    auto check_dbl = [&](i64 val, i64 lo, i64 hi) {
+      check(val, lo, hi);
+
+      // R_390_*DBL relocs should never refer a symbol at an odd address
+      if (val & 1)
+        Error(ctx) << *this << ": misaligned symbol " << sym
+                   << " for relocation " << rel;
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_390_64:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_390_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *loc = val;
+      break;
+    }
+    case R_390_12: {
+      i64 val = S + A;
+      check(val, 0, 1 << 12);
+      write_low12(loc, val);
+      break;
+    }
+    case R_390_16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_390_20: {
+      i64 val = S + A;
+      check(val, 0, 1 << 20);
+      write_mid20(loc, val);
+      break;
+    }
+    case R_390_32:
+    case R_390_PLT32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_390_PLT64:
+      *(ub64 *)loc = S + A;
+      break;
+    case R_390_PC12DBL:
+    case R_390_PLT12DBL: {
+      i64 val = S + A - P;
+      check_dbl(val, -(1 << 12), 1 << 12);
+      write_low12(loc, val >> 1);
+      break;
+    }
+    case R_390_PC16: {
+      i64 val = S + A - P;
+      check(val, -(1 << 15), 1 << 15);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_390_PC32: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_390_PC64:
+      *(ub64 *)loc = S + A - P;
+      break;
+    case R_390_PC16DBL:
+    case R_390_PLT16DBL: {
+      i64 val = S + A - P;
+      check_dbl(val, -(1 << 16), 1 << 16);
+      *(ub16 *)loc = val >> 1;
+      break;
+    }
+    case R_390_PC24DBL:
+    case R_390_PLT24DBL: {
+      i64 val = S + A - P;
+      check_dbl(val, -(1 << 24), 1 << 24);
+      write_low24(loc, val >> 1);
+      break;
+    }
+    case R_390_PC32DBL:
+    case R_390_PLT32DBL:
+      if (ctx.is_static && &sym == ctx.tls_get_offset) {
+        // __tls_get_offset() in libc.a is stub code that calls abort().
+        // So we provide a replacement function.
+        *(ub32 *)loc = (ctx.s390x_tls_get_offset->shdr.sh_addr - P) >> 1;
+      } else {
+        i64 val = S + A - P;
+        check_dbl(val, -(1LL << 32), 1LL << 32);
+        *(ub32 *)loc = val >> 1;
+      }
+      break;
+    case R_390_GOT12:
+    case R_390_GOTPLT12: {
+      i64 val = G + A;
+      check(val, 0, 1 << 12);
+      write_low12(loc, val);
+      break;
+    }
+    case R_390_GOT16:
+    case R_390_GOTPLT16: {
+      i64 val = G + A;
+      check(val, 0, 1 << 16);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_390_GOT20:
+    case R_390_GOTPLT20: {
+      i64 val = G + A;
+      check(val, 0, 1 << 20);
+      write_mid20(loc, val);
+      break;
+    }
+    case R_390_GOT32:
+    case R_390_GOTPLT32: {
+      i64 val = G + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_390_GOT64:
+    case R_390_GOTPLT64:
+      *(ub64 *)loc = G + A;
+      break;
+    case R_390_GOTOFF16:
+    case R_390_PLTOFF16: {
+      i64 val = S + A - GOT;
+      check(val, -(1 << 15), 1 << 15);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_390_GOTOFF32:
+    case R_390_PLTOFF32: {
+      i64 val = S + A - GOT;
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_390_GOTOFF64:
+    case R_390_PLTOFF64:
+      *(ub64 *)loc = S + A - GOT;
+      break;
+    case R_390_GOTPC:
+      *(ub64 *)loc = GOT + A - P;
+      break;
+    case R_390_GOTPCDBL: {
+      i64 val = GOT + A - P;
+      check_dbl(val, -(1LL << 32), 1LL << 32);
+      *(ub32 *)loc = val >> 1;
+      break;
+    }
+    case R_390_GOTENT: {
+      i64 val = GOT + G + A - P;
+      check(val, -(1LL << 32), 1LL << 32);
+      *(ub32 *)loc = val >> 1;
+      break;
+    }
+    case R_390_TLS_LE32:
+      *(ub32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_LE64:
+      *(ub64 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_GOTIE20:
+      write_mid20(loc, sym.get_gottp_addr(ctx) + A - GOT);
+      break;
+    case R_390_TLS_IEENT:
+      *(ub32 *)loc = (sym.get_gottp_addr(ctx) + A - P) >> 1;
+      break;
+    case R_390_TLS_GD32:
+      if (sym.has_tlsgd(ctx))
+        *(ub32 *)loc = sym.get_tlsgd_addr(ctx) + A - GOT;
+      else
+        *(ub32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_GD64:
+      if (sym.has_tlsgd(ctx))
+        *(ub64 *)loc = sym.get_tlsgd_addr(ctx) + A - GOT;
+      else
+        *(ub64 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_GDCALL:
+      if (!sym.has_tlsgd(ctx)) {
+        static u8 nop[] = { 0xc0, 0x04, 0x00, 0x00, 0x00, 0x00 };
+        memcpy(loc, nop, sizeof(nop));
+      }
+      break;
+    case R_390_TLS_LDM32:
+      if (ctx.got->has_tlsld(ctx))
+        *(ub32 *)loc = ctx.got->get_tlsld_addr(ctx) + A - GOT;
+      break;
+    case R_390_TLS_LDM64:
+      if (ctx.got->has_tlsld(ctx))
+        *(ub64 *)loc = ctx.got->get_tlsld_addr(ctx) + A - GOT;
+      break;
+    case R_390_TLS_LDO32:
+      if (ctx.got->has_tlsld(ctx))
+        *(ub32 *)loc = S + A - ctx.tls_begin;
+      else
+        *(ub32 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_LDO64:
+      if (ctx.got->has_tlsld(ctx))
+        *(ub64 *)loc = S + A - ctx.tls_begin;
+      else
+        *(ub64 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_390_TLS_LDCALL:
+      if (!ctx.got->has_tlsld(ctx)) {
+        static u8 nop[] = { 0xc0, 0x04, 0x00, 0x00, 0x00, 0x00 };
+        memcpy(loc, nop, sizeof(nop));
+      }
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_390_32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_390_64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub64 *)loc = *val;
+      else
+        *(ub64 *)loc = S + A;
+      break;
+    case R_390_TLS_LDO64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub64 *)loc = *val;
+      else
+        *(ub64 *)loc = S + A - ctx.tls_begin;
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_nonalloc: " << rel;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_390_64:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_390_8:
+    case R_390_12:
+    case R_390_16:
+    case R_390_20:
+    case R_390_32:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_390_PC16:
+    case R_390_PC16DBL:
+    case R_390_PC32:
+    case R_390_PC32DBL:
+    case R_390_PC64:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_390_GOT12:
+    case R_390_GOT16:
+    case R_390_GOT20:
+    case R_390_GOT32:
+    case R_390_GOT64:
+    case R_390_GOTOFF16:
+    case R_390_GOTOFF32:
+    case R_390_GOTOFF64:
+    case R_390_GOTPLT12:
+    case R_390_GOTPLT16:
+    case R_390_GOTPLT20:
+    case R_390_GOTPLT32:
+    case R_390_GOTPLT64:
+    case R_390_GOTPC:
+    case R_390_GOTPCDBL:
+    case R_390_GOTENT:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_390_PLT12DBL:
+    case R_390_PLT16DBL:
+    case R_390_PLT24DBL:
+    case R_390_PLT32:
+    case R_390_PLT32DBL:
+    case R_390_PLT64:
+    case R_390_PLTOFF16:
+    case R_390_PLTOFF32:
+    case R_390_PLTOFF64:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_390_TLS_GOTIE20:
+    case R_390_TLS_IEENT:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_390_TLS_GD32:
+    case R_390_TLS_GD64:
+      if (!relax_tlsgd(ctx, sym))
+        sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_390_TLS_LDM32:
+    case R_390_TLS_LDM64:
+      if (!relax_tlsld(ctx))
+        ctx.needs_tlsld = true;
+      break;
+    case R_390_TLS_LE32:
+    case R_390_TLS_LE64:
+    case R_390_TLS_LDO32:
+    case R_390_TLS_LDO64:
+    case R_390_TLS_GDCALL:
+    case R_390_TLS_LDCALL:
+      break;
+    default:
+      Fatal(ctx) << *this << ": scan_relocations: " << rel;
+    }
+  }
+}
+
+// __tls_get_offset() in libc.a just calls abort(), assuming that the
+// linker always relaxes TLS calls for statically-linkd executables.
+// We don't always do that because we believe --relax and --static
+// should be orthogonal.
+//
+// This section provides a replacement for __tls_get_offset() in libc.a.
+void S390XTlsGetOffsetSection::copy_buf(Context<E> &ctx) {
+  static const u8 insn[] = {
+    0xc0, 0x10, 0, 0, 0, 0,             // larl %r1, GOT
+    0xb9, 0x08, 0x00, 0x21,             // agr  %r2, %r1
+    0xe3, 0x20, 0x20, 0x08, 0x00, 0x04, // lg   %r2, 8(%r2)
+    0xc0, 0x11, 0, 0, 0, 0,             // lgfi %r1, TLS_BLOCK_SIZE
+    0xb9, 0x09, 0x00, 0x21,             // sgr  %r2, %r1
+    0x07, 0xfe,                         // br   %r14
+  };
+
+  assert(this->shdr.sh_size == sizeof(insn));
+
+  u8 *loc = ctx.buf + this->shdr.sh_offset;
+  memcpy(loc, insn, sizeof(insn));
+  *(ub32 *)(loc + 2) = (ctx.got->shdr.sh_addr - this->shdr.sh_addr) >> 1;
+  *(ub32 *)(loc + 18) = ctx.tp_addr - ctx.tls_begin;
+}
+
+} // namespace mold::elf

elf/arch-sparc64.cc

@@ -0,0 +1,667 @@
+// SPARC is a RISC ISA developed by Sun Microsystems.
+//
+// The byte order of the processor is big-endian. Anything larger than a
+// byte is stored in the "reverse" order compared to little-endian
+// processors such as x86-64.
+//
+// All instructions are 4 bytes long and aligned to 4 bytes boundaries.
+//
+// A notable feature of SPARC is that, unlike other RISC ISAs, it doesn't
+// need range extension thunks. It is because the SPARC's CALL instruction
+// contains a whopping 30 bits immediate. The processor scales it by 4 to
+// extend it to 32 bits (this is doable because all instructions are
+// aligned to 4 bytes boundaries, so the least significant two bits are
+// always zero). That means CALL's reach is PC ± 2 GiB, elinating the
+// need of range extension thunks. It comes with the cost that the CALL
+// instruction alone takes 1/4th of the instruction encoding space,
+// though.
+//
+// SPARC has 32 general purpose registers. CALL instruction saves a return
+// address to %o7, which is an alias for %r15. Thread pointer is stored to
+// %g7 which is %r7.
+//
+// SPARC does not have PC-relative load/store instructions. To access data
+// in the position-independent manner, we usually first set the address of
+// .got to, for example, %l7, with the following piece of code
+//
+//   sethi  %hi(. - _GLOBAL_OFFSET_TABLE_), %l7
+//   add  %l7, %lo(. - _GLOBAL_OFFSET_TABLE_), %l7
+//   call __sparc_get_pc_thunk.l7
+//   nop
+//
+// where __sparc_get_pc_thunk.l7 is defined as
+//
+//   retl
+//   add  %o7, %l7, %l7
+//
+// . SETHI and the following ADD materialize a 32 bits offset to .got.
+// CALL instruction sets a return address to $o7, and the subsequent ADD
+// adds it to the GOT offset to materialize the absolute address of .got.
+//
+// Note that we have a NOP after CALL and an ADD after RETL because of
+// SPARC's delay branch slots. That is, the SPARC processor always
+// executes one instruction after a branch even if the branch is taken.
+// This may seem like an odd behavior, and indeed it is considered as such
+// (that's a premature optimization for the early pipelined SPARC
+// processors), but that's been a part of the ISA's spec so that's what it
+// is.
+//
+// Note also that the .got address obtained this way is not shared between
+// functions, so functions can use an arbitrary register to hold the .got
+// address. That also means each function needs to execute the above piece
+// of code to become position-independent.
+//
+// This scheme is very similar to i386. That may not be a coincidence
+// because the i386 ELF psABI is created by Sun Microsystems too.
+//
+// https://docs.oracle.com/cd/E36784_01/html/E36857/chapter6-62988.html
+// https://docs.oracle.com/cd/E19120-01/open.solaris/819-0690/chapter8-40/index.html
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = SPARC64;
+
+// SPARC's PLT section is writable despite containing executable code.
+// We don't need to write the PLT header entry because the dynamic loader
+// will do that for us.
+//
+// We also don't need a .got.plt section to store the result of lazy PLT
+// symbol resolution because the dynamic symbol resolver directly mutates
+// instructions in PLT so that they jump to the right places next time.
+// That's why each PLT entry contains lots of NOPs; they are a placeholder
+// for the runtime to add more instructions.
+//
+// Self-modifying code is nowadays considered really bad from the security
+// point of view, though.
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  memset(buf, 0, E::plt_hdr_size);
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static ub32 insn[] = {
+    0x0300'0000, // sethi (. - .PLT0), %g1
+    0x3068'0000, // ba,a  %xcc, .PLT1
+    0x0100'0000, // nop
+    0x0100'0000, // nop
+    0x0100'0000, // nop
+    0x0100'0000, // nop
+    0x0100'0000, // nop
+    0x0100'0000, // nop
+  };
+
+  u64 plt0 = ctx.plt->shdr.sh_addr;
+  u64 plt1 = ctx.plt->shdr.sh_addr + E::plt_size;
+  u64 entry = sym.get_plt_addr(ctx);
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ub32 *)buf |= bits(entry - plt0, 21, 0);
+  *(ub32 *)(buf + 4) |= bits(plt1 - entry - 4, 20, 2);
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static ub32 entry[] = {
+    0x8a10'000f, // mov  %o7, %g5
+    0x4000'0002, // call . + 8
+    0xc25b'e014, // ldx  [ %o7 + 20 ], %g1
+    0xc25b'c001, // ldx  [ %o7 + %g1 ], %g1
+    0x81c0'4000, // jmp  %g1
+    0x9e10'0005, // mov  %g5, %o7
+    0x0000'0000, // .quad $plt_entry - $got_entry
+    0x0000'0000,
+  };
+
+  memcpy(buf, entry, sizeof(entry));
+  *(ub64 *)(buf + 24) = sym.get_got_addr(ctx) - sym.get_plt_addr(ctx) - 4;
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_SPARC_64:
+  case R_SPARC_UA64:
+    *(ub64 *)loc = val;
+    break;
+  case R_SPARC_DISP32:
+    *(ub32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_idx(ctx) * sizeof(Word<E>))
+#define GOT ctx.got->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_SPARC_64:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_SPARC_5: {
+      i64 val = S + A;
+      check(val, 0, 1 << 5);
+      *(ub32 *)loc |= bits(val, 4, 0);
+      break;
+    }
+    case R_SPARC_6: {
+      i64 val = S + A;
+      check(val, 0, 1 << 6);
+      *(ub32 *)loc |= bits(val, 5, 0);
+      break;
+    }
+    case R_SPARC_7: {
+      i64 val = S + A;
+      check(val, 0, 1 << 7);
+      *(ub32 *)loc |= bits(val, 6, 0);
+      break;
+    }
+    case R_SPARC_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *(u8 *)loc = val;
+      break;
+    }
+    case R_SPARC_10: {
+      i64 val = S + A;
+      check(val, 0, 1 << 10);
+      *(ub32 *)loc |= bits(val, 9, 0);
+      break;
+    }
+    case R_SPARC_LO10:
+    case R_SPARC_LOPLT10:
+      *(ub32 *)loc |= bits(S + A, 9, 0);
+      break;
+    case R_SPARC_11: {
+      i64 val = S + A;
+      check(val, 0, 1 << 11);
+      *(ub32 *)loc |= bits(val, 10, 0);
+      break;
+    }
+    case R_SPARC_13: {
+      i64 val = S + A;
+      check(val, 0, 1 << 13);
+      *(ub32 *)loc |= bits(val, 12, 0);
+      break;
+    }
+    case R_SPARC_16:
+    case R_SPARC_UA16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_SPARC_22: {
+      i64 val = S + A;
+      check(val, 0, 1 << 22);
+      *(ub32 *)loc |= bits(val, 21, 0);
+      break;
+    }
+    case R_SPARC_32:
+    case R_SPARC_UA32:
+    case R_SPARC_PLT32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_SPARC_PLT64:
+    case R_SPARC_UA64:
+    case R_SPARC_REGISTER:
+      *(ub64 *)loc = S + A;
+      break;
+    case R_SPARC_DISP8: {
+      i64 val = S + A - P;
+      check(val, -(1 << 7), 1 << 7);
+      *(u8 *)loc = val;
+      break;
+    }
+    case R_SPARC_DISP16: {
+      i64 val = S + A - P;
+      check(val, -(1 << 15), 1 << 15);
+      *(ub16 *)loc = val;
+      break;
+    }
+    case R_SPARC_DISP32:
+    case R_SPARC_PCPLT32: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_SPARC_DISP64:
+      *(ub64 *)loc = S + A - P;
+      break;
+    case R_SPARC_WDISP16: {
+      i64 val = S + A - P;
+      check(val, -(1 << 16), 1 << 16);
+      *(ub16 *)loc |= (bit(val, 16) << 21) | bits(val, 15, 2);
+      break;
+    }
+    case R_SPARC_WDISP19: {
+      i64 val = S + A - P;
+      check(val, -(1 << 20), 1 << 20);
+      *(ub32 *)loc |= bits(val, 20, 2);
+      break;
+    }
+    case R_SPARC_WDISP22: {
+      i64 val = S + A - P;
+      check(val, -(1 << 23), 1 << 23);
+      *(ub32 *)loc |= bits(val, 23, 2);
+      break;
+    }
+    case R_SPARC_WDISP30:
+    case R_SPARC_WPLT30: {
+      i64 val = S + A - P;
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ub32 *)loc |= bits(val, 31, 2);
+      break;
+    }
+    case R_SPARC_HI22:
+    case R_SPARC_HIPLT22:
+    case R_SPARC_LM22:
+      *(ub32 *)loc |= bits(S + A, 31, 10);
+      break;
+    case R_SPARC_GOT10:
+      *(ub32 *)loc |= bits(G, 9, 0);
+      break;
+    case R_SPARC_GOT13:
+      check(G, 0, 1 << 12);
+      *(ub32 *)loc |= bits(G, 12, 0);
+      break;
+    case R_SPARC_GOT22:
+      *(ub32 *)loc |= bits(G, 31, 10);
+      break;
+    case R_SPARC_GOTDATA_HIX22: {
+      i64 val = S + A - GOT;
+      *(ub32 *)loc |= bits(val < 0 ? ~val : val, 31, 10);
+      break;
+    }
+    case R_SPARC_GOTDATA_LOX10: {
+      i64 val = S + A - GOT;
+      *(ub32 *)loc |= bits(val, 9, 0) | (val < 0 ? 0b1'1100'0000'0000 : 0);
+      break;
+    }
+    case R_SPARC_GOTDATA_OP_HIX22:
+      // We always have to relax a GOT load to a load immediate if a
+      // symbol is local, because R_SPARC_GOTDATA_OP cannot represent
+      // an addend for a local symbol.
+      if (sym.is_imported) {
+        *(ub32 *)loc |= bits(G, 31, 10);
+      } else if (sym.is_absolute()) {
+        i64 val = S + A;
+        *(ub32 *)loc |= bits(val < 0 ? ~val : val, 31, 10);
+      } else {
+        i64 val = S + A - GOT;
+        *(ub32 *)loc |= bits(val < 0 ? ~val : val, 31, 10);
+      }
+      break;
+    case R_SPARC_GOTDATA_OP_LOX10: {
+      if (sym.is_imported) {
+        *(ub32 *)loc |= bits(G, 9, 0);
+      } else if (sym.is_absolute()) {
+        i64 val = S + A;
+        *(ub32 *)loc |= bits(val, 9, 0) | (val < 0 ? 0b1'1100'0000'0000 : 0);
+      } else {
+        i64 val = S + A - GOT;
+        *(ub32 *)loc |= bits(val, 9, 0) | (val < 0 ? 0b1'1100'0000'0000 : 0);
+      }
+      break;
+    }
+    case R_SPARC_GOTDATA_OP:
+      if (sym.is_imported)
+        break;
+
+      if (sym.is_absolute()) {
+        // ldx [ %g2 + %g1 ], %g1  →  nop
+        *(ub32 *)loc = 0x0100'0000;
+      } else {
+        // ldx [ %g2 + %g1 ], %g1  →  add %g2, %g1, %g1
+        *(ub32 *)loc &= 0b00'11111'000000'11111'1'11111111'11111;
+        *(ub32 *)loc |= 0b10'00000'000000'00000'0'00000000'00000;
+      }
+      break;
+    case R_SPARC_PC10:
+    case R_SPARC_PCPLT10:
+      *(ub32 *)loc |= bits(S + A - P, 9, 0);
+      break;
+    case R_SPARC_PC22:
+    case R_SPARC_PCPLT22:
+    case R_SPARC_PC_LM22:
+      *(ub32 *)loc |= bits(S + A - P, 31, 10);
+      break;
+    case R_SPARC_OLO10:
+      *(ub32 *)loc |= bits(bits(S + A, 9, 0) + rel.r_type_data, 12, 0);
+      break;
+    case R_SPARC_HH22:
+      *(ub32 *)loc |= bits(S + A, 63, 42);
+      break;
+    case R_SPARC_HM10:
+      *(ub32 *)loc |= bits(S + A, 41, 32);
+      break;
+    case R_SPARC_PC_HH22:
+      *(ub32 *)loc |= bits(S + A - P, 63, 42);
+      break;
+    case R_SPARC_PC_HM10:
+      *(ub32 *)loc |= bits(S + A - P, 41, 32);
+      break;
+    case R_SPARC_HIX22:
+      *(ub32 *)loc |= bits(~(S + A), 31, 10);
+      break;
+    case R_SPARC_LOX10:
+      *(ub32 *)loc |= bits(S + A, 9, 0) | 0b1'1100'0000'0000;
+      break;
+    case R_SPARC_H44:
+      *(ub32 *)loc |= bits(S + A, 43, 22);
+      break;
+    case R_SPARC_M44:
+      *(ub32 *)loc |= bits(S + A, 21, 12);
+      break;
+    case R_SPARC_L44:
+      *(ub32 *)loc |= bits(S + A, 11, 0);
+      break;
+    case R_SPARC_TLS_GD_HI22:
+      *(ub32 *)loc |= bits(sym.get_tlsgd_addr(ctx) + A - GOT, 31, 10);
+      break;
+    case R_SPARC_TLS_GD_LO10:
+      *(ub32 *)loc |= bits(sym.get_tlsgd_addr(ctx) + A - GOT, 9, 0);
+      break;
+    case R_SPARC_TLS_GD_CALL:
+    case R_SPARC_TLS_LDM_CALL:
+      if (ctx.arg.is_static)
+        *(ub32 *)loc |= bits(ctx.sparc_tls_get_addr->shdr.sh_addr + A - P, 31, 2);
+      else
+        *(ub32 *)loc |= bits(ctx.tls_get_addr->get_addr(ctx) + A - P, 31, 2);
+      break;
+    case R_SPARC_TLS_LDM_HI22:
+      *(ub32 *)loc |= bits(ctx.got->get_tlsld_addr(ctx) + A - GOT, 31, 10);
+      break;
+    case R_SPARC_TLS_LDM_LO10:
+      *(ub32 *)loc |= bits(ctx.got->get_tlsld_addr(ctx) + A - GOT, 9, 0);
+      break;
+    case R_SPARC_TLS_LDO_HIX22:
+      *(ub32 *)loc |= bits(S + A - ctx.tls_begin, 31, 10);
+      break;
+    case R_SPARC_TLS_LDO_LOX10:
+      *(ub32 *)loc |= bits(S + A - ctx.tls_begin, 9, 0);
+      break;
+    case R_SPARC_TLS_IE_HI22:
+      *(ub32 *)loc |= bits(sym.get_gottp_addr(ctx) + A - GOT, 31, 10);
+      break;
+    case R_SPARC_TLS_IE_LO10:
+      *(ub32 *)loc |= bits(sym.get_gottp_addr(ctx) + A - GOT, 9, 0);
+      break;
+    case R_SPARC_TLS_LE_HIX22:
+      *(ub32 *)loc |= bits(~(S + A - ctx.tp_addr), 31, 10);
+      break;
+    case R_SPARC_TLS_LE_LOX10:
+      *(ub32 *)loc |= bits(S + A - ctx.tp_addr, 9, 0) | 0b1'1100'0000'0000;
+      break;
+    case R_SPARC_SIZE32:
+      *(ub32 *)loc = sym.esym().st_size + A;
+      break;
+    case R_SPARC_TLS_GD_ADD:
+    case R_SPARC_TLS_LDM_ADD:
+    case R_SPARC_TLS_LDO_ADD:
+    case R_SPARC_TLS_IE_LD:
+    case R_SPARC_TLS_IE_LDX:
+    case R_SPARC_TLS_IE_ADD:
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_SPARC_64:
+    case R_SPARC_UA64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub64 *)loc = *val;
+      else
+        *(ub64 *)loc = S + A;
+      break;
+    case R_SPARC_32:
+    case R_SPARC_UA32: {
+      i64 val = S + A;
+      check(val, 0, 1LL << 32);
+      *(ub32 *)loc = val;
+      break;
+    }
+    case R_SPARC_TLS_DTPOFF32:
+      *(ub32 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_SPARC_TLS_DTPOFF64:
+      *(ub64 *)loc = S + A - ctx.tls_begin;
+      break;
+    default:
+      Fatal(ctx) << *this << ": apply_reloc_nonalloc: " << rel;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_SPARC_64:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_SPARC_8:
+    case R_SPARC_5:
+    case R_SPARC_6:
+    case R_SPARC_7:
+    case R_SPARC_10:
+    case R_SPARC_11:
+    case R_SPARC_13:
+    case R_SPARC_16:
+    case R_SPARC_22:
+    case R_SPARC_32:
+    case R_SPARC_REGISTER:
+    case R_SPARC_UA16:
+    case R_SPARC_UA32:
+    case R_SPARC_UA64:
+    case R_SPARC_PC_HM10:
+    case R_SPARC_OLO10:
+    case R_SPARC_LOX10:
+    case R_SPARC_HM10:
+    case R_SPARC_M44:
+    case R_SPARC_HIX22:
+    case R_SPARC_LO10:
+    case R_SPARC_L44:
+    case R_SPARC_LM22:
+    case R_SPARC_HI22:
+    case R_SPARC_H44:
+    case R_SPARC_HH22:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_SPARC_PLT32:
+    case R_SPARC_WPLT30:
+    case R_SPARC_WDISP30:
+    case R_SPARC_HIPLT22:
+    case R_SPARC_LOPLT10:
+    case R_SPARC_PCPLT32:
+    case R_SPARC_PCPLT22:
+    case R_SPARC_PCPLT10:
+    case R_SPARC_PLT64:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_SPARC_GOT13:
+    case R_SPARC_GOT10:
+    case R_SPARC_GOT22:
+    case R_SPARC_GOTDATA_HIX22:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_SPARC_GOTDATA_OP_HIX22:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_GOT;
+      break;
+    case R_SPARC_DISP16:
+    case R_SPARC_DISP32:
+    case R_SPARC_DISP64:
+    case R_SPARC_DISP8:
+    case R_SPARC_PC10:
+    case R_SPARC_PC22:
+    case R_SPARC_PC_LM22:
+    case R_SPARC_WDISP16:
+    case R_SPARC_WDISP19:
+    case R_SPARC_WDISP22:
+    case R_SPARC_PC_HH22:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_SPARC_TLS_GD_HI22:
+      sym.flags |= NEEDS_TLSGD;
+      break;
+    case R_SPARC_TLS_LDM_HI22:
+      ctx.needs_tlsld = true;
+      break;
+    case R_SPARC_TLS_IE_HI22:
+      sym.flags |= NEEDS_GOTTP;
+      break;
+    case R_SPARC_TLS_GD_CALL:
+    case R_SPARC_TLS_LDM_CALL:
+      if (!ctx.arg.is_static && ctx.tls_get_addr->is_imported)
+        ctx.tls_get_addr->flags |= NEEDS_PLT;
+      break;
+    case R_SPARC_GOTDATA_OP_LOX10:
+    case R_SPARC_GOTDATA_OP:
+    case R_SPARC_GOTDATA_LOX10:
+    case R_SPARC_TLS_GD_LO10:
+    case R_SPARC_TLS_GD_ADD:
+    case R_SPARC_TLS_LDM_LO10:
+    case R_SPARC_TLS_LDM_ADD:
+    case R_SPARC_TLS_LDO_HIX22:
+    case R_SPARC_TLS_LDO_LOX10:
+    case R_SPARC_TLS_LDO_ADD:
+    case R_SPARC_TLS_IE_ADD:
+    case R_SPARC_TLS_IE_LD:
+    case R_SPARC_TLS_IE_LDX:
+    case R_SPARC_TLS_IE_LO10:
+    case R_SPARC_TLS_LE_HIX22:
+    case R_SPARC_TLS_LE_LOX10:
+    case R_SPARC_SIZE32:
+      break;
+    default:
+      Fatal(ctx) << *this << ": scan_relocations: " << rel;
+    }
+  }
+}
+
+// __tls_get_addr is not defined by libc.a, so we can't use that function
+// in statically-linked executables. This section provides a replacement.
+void SparcTlsGetAddrSection::copy_buf(Context<E> &ctx) {
+  ub32 *buf = (ub32 *)(ctx.buf + this->shdr.sh_offset);
+
+  static const ub32 insn[] = {
+    0x0300'0000, // sethi  %hi(TP_SIZE), %g1
+    0x8210'6000, // or   %g1, %lo(TP_SIZE), %g1
+    0x8221'c001, // sub  %g7, %g1, %g1
+    0xd05a'2008, // ldx  [ %o0 + 8 ], %o0
+    0x81c3'e008, // retl
+    0x9000'4008, // add  %g1, %o0, %o0
+  };
+
+  assert(this->shdr.sh_size == sizeof(insn));
+  memcpy(buf, insn, sizeof(insn));
+
+  buf[0] |= bits(ctx.tp_addr - ctx.tls_begin, 31, 10);
+  buf[1] |= bits(ctx.tp_addr - ctx.tls_begin, 9, 0);
+}
+
+} // namespace mold::elf

elf/arch-x86-64.cc

@@ -0,0 +1,760 @@
+// Supporting x86-64 is straightforward. Unlike its predecessor, i386,
+// x86-64 supports PC-relative addressing for position-independent code.
+// Being CISC, its instructions are variable in size. Branch instructions
+// take 4 bytes offsets, so we don't need range extension thunks.
+//
+// The psABI specifies %r11 as neither caller- nor callee-saved. It's
+// intentionally left out so that we can use it as a scratch register in
+// PLT.
+//
+// Thread Pointer (TP) is stored not to a general-purpose register but to
+// FS segment register. Segment register is a 64-bits register which can
+// be used as a base address for memory access. Each thread has a unique
+// FS value, and they access their thread-local variables relative to FS
+// as %fs:offset_from_tp.
+//
+// The value of a segment register itself is not generally readable from
+// the user space. As a workaround, libc initializes %fs:0 (the first word
+// referenced by FS) to the value of %fs itself. So we can obtain TP just
+// by `mov %fs:0, %rax` if we need it.
+//
+// For historical reasons, TP points past the end of the TLS block on x86.
+// This is contrary to other psABIs which usually use the beginning of the
+// TLS block as TP (with some addend). As a result, offsets from TP to
+// thread-local variables (TLVs) in the main executable are all negative.
+//
+// https://github.com/rui314/mold/wiki/x86-64-psabi.pdf
+
+#include "mold.h"
+
+namespace mold::elf {
+
+using E = X86_64;
+
+// This is a security-enhanced version of the regular PLT. The PLT
+// header and each PLT entry starts with endbr64 for the Intel's
+// control-flow enforcement security mechanism.
+//
+// Note that our IBT-enabled PLT instruction sequence is different
+// from the one used in GNU ld. GNU's IBTPLT implementation uses two
+// separate sections (.plt and .plt.sec) in which one PLT entry takes
+// 32 bytes in total. Our IBTPLT consists of just .plt and each entry
+// is 16 bytes long.
+//
+// Our PLT entry clobbers %r11, but that's fine because the resolver
+// function (_dl_runtime_resolve) clobbers %r11 anyway.
+template <>
+void write_plt_header(Context<E> &ctx, u8 *buf) {
+  static const u8 insn[] = {
+    0xf3, 0x0f, 0x1e, 0xfa, // endbr64
+    0x41, 0x53,             // push %r11
+    0xff, 0x35, 0, 0, 0, 0, // push GOTPLT+8(%rip)
+    0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
+    0xcc, 0xcc, 0xcc, 0xcc, // (padding)
+    0xcc, 0xcc, 0xcc, 0xcc, // (padding)
+    0xcc, 0xcc, 0xcc, 0xcc, // (padding)
+    0xcc, 0xcc,             // (padding)
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ul32 *)(buf + 8) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 4;
+  *(ul32 *)(buf + 14) = ctx.gotplt->shdr.sh_addr - ctx.plt->shdr.sh_addr - 2;
+}
+
+template <>
+void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const u8 insn[] = {
+    0xf3, 0x0f, 0x1e, 0xfa, // endbr64
+    0x41, 0xbb, 0, 0, 0, 0, // mov $index_in_relplt, %r11d
+    0xff, 0x25, 0, 0, 0, 0, // jmp *foo@GOTPLT
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ul32 *)(buf + 6) = sym.get_plt_idx(ctx);
+  *(ul32 *)(buf + 12) = sym.get_gotplt_addr(ctx) - sym.get_plt_addr(ctx) - 16;
+}
+
+template <>
+void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
+  static const u8 insn[] = {
+    0xf3, 0x0f, 0x1e, 0xfa, // endbr64
+    0xff, 0x25, 0, 0, 0, 0, // jmp *foo@GOT
+    0xcc, 0xcc, 0xcc, 0xcc, // (padding)
+    0xcc, 0xcc,             // (padding)
+  };
+
+  memcpy(buf, insn, sizeof(insn));
+  *(ul32 *)(buf + 6) = sym.get_got_addr(ctx) - sym.get_plt_addr(ctx) - 10;
+}
+
+template <>
+void EhFrameSection<E>::apply_reloc(Context<E> &ctx, const ElfRel<E> &rel,
+                                    u64 offset, u64 val) {
+  u8 *loc = ctx.buf + this->shdr.sh_offset + offset;
+
+  switch (rel.r_type) {
+  case R_NONE:
+    break;
+  case R_X86_64_32:
+    *(ul32 *)loc = val;
+    break;
+  case R_X86_64_64:
+    *(ul64 *)loc = val;
+    break;
+  case R_X86_64_PC32:
+    *(ul32 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  case R_X86_64_PC64:
+    *(ul64 *)loc = val - this->shdr.sh_addr - offset;
+    break;
+  default:
+    Fatal(ctx) << "unsupported relocation in .eh_frame: " << rel;
+  }
+}
+
+static u32 relax_gotpcrelx(u8 *loc) {
+  switch ((loc[0] << 8) | loc[1]) {
+  case 0xff15: return 0x90e8; // call *0(%rip) -> call 0
+  case 0xff25: return 0x90e9; // jmp  *0(%rip) -> jmp  0
+  }
+  return 0;
+}
+
+static u32 relax_rex_gotpcrelx(u8 *loc) {
+  switch ((loc[0] << 16) | (loc[1] << 8) | loc[2]) {
+  case 0x488b05: return 0x488d05; // mov 0(%rip), %rax -> lea 0(%rip), %rax
+  case 0x488b0d: return 0x488d0d; // mov 0(%rip), %rcx -> lea 0(%rip), %rcx
+  case 0x488b15: return 0x488d15; // mov 0(%rip), %rdx -> lea 0(%rip), %rdx
+  case 0x488b1d: return 0x488d1d; // mov 0(%rip), %rbx -> lea 0(%rip), %rbx
+  case 0x488b25: return 0x488d25; // mov 0(%rip), %rsp -> lea 0(%rip), %rsp
+  case 0x488b2d: return 0x488d2d; // mov 0(%rip), %rbp -> lea 0(%rip), %rbp
+  case 0x488b35: return 0x488d35; // mov 0(%rip), %rsi -> lea 0(%rip), %rsi
+  case 0x488b3d: return 0x488d3d; // mov 0(%rip), %rdi -> lea 0(%rip), %rdi
+  case 0x4c8b05: return 0x4c8d05; // mov 0(%rip), %r8  -> lea 0(%rip), %r8
+  case 0x4c8b0d: return 0x4c8d0d; // mov 0(%rip), %r9  -> lea 0(%rip), %r9
+  case 0x4c8b15: return 0x4c8d15; // mov 0(%rip), %r10 -> lea 0(%rip), %r10
+  case 0x4c8b1d: return 0x4c8d1d; // mov 0(%rip), %r11 -> lea 0(%rip), %r11
+  case 0x4c8b25: return 0x4c8d25; // mov 0(%rip), %r12 -> lea 0(%rip), %r12
+  case 0x4c8b2d: return 0x4c8d2d; // mov 0(%rip), %r13 -> lea 0(%rip), %r13
+  case 0x4c8b35: return 0x4c8d35; // mov 0(%rip), %r14 -> lea 0(%rip), %r14
+  case 0x4c8b3d: return 0x4c8d3d; // mov 0(%rip), %r15 -> lea 0(%rip), %r15
+  }
+  return 0;
+}
+
+static u32 relax_gottpoff(u8 *loc) {
+  switch ((loc[0] << 16) | (loc[1] << 8) | loc[2]) {
+  case 0x488b05: return 0x48c7c0; // mov 0(%rip), %rax -> mov $0, %rax
+  case 0x488b0d: return 0x48c7c1; // mov 0(%rip), %rcx -> mov $0, %rcx
+  case 0x488b15: return 0x48c7c2; // mov 0(%rip), %rdx -> mov $0, %rdx
+  case 0x488b1d: return 0x48c7c3; // mov 0(%rip), %rbx -> mov $0, %rbx
+  case 0x488b25: return 0x48c7c4; // mov 0(%rip), %rsp -> mov $0, %rsp
+  case 0x488b2d: return 0x48c7c5; // mov 0(%rip), %rbp -> mov $0, %rbp
+  case 0x488b35: return 0x48c7c6; // mov 0(%rip), %rsi -> mov $0, %rsi
+  case 0x488b3d: return 0x48c7c7; // mov 0(%rip), %rdi -> mov $0, %rdi
+  case 0x4c8b05: return 0x49c7c0; // mov 0(%rip), %r8  -> mov $0, %r8
+  case 0x4c8b0d: return 0x49c7c1; // mov 0(%rip), %r9  -> mov $0, %r9
+  case 0x4c8b15: return 0x49c7c2; // mov 0(%rip), %r10 -> mov $0, %r10
+  case 0x4c8b1d: return 0x49c7c3; // mov 0(%rip), %r11 -> mov $0, %r11
+  case 0x4c8b25: return 0x49c7c4; // mov 0(%rip), %r12 -> mov $0, %r12
+  case 0x4c8b2d: return 0x49c7c5; // mov 0(%rip), %r13 -> mov $0, %r13
+  case 0x4c8b35: return 0x49c7c6; // mov 0(%rip), %r14 -> mov $0, %r14
+  case 0x4c8b3d: return 0x49c7c7; // mov 0(%rip), %r15 -> mov $0, %r15
+  }
+  return 0;
+}
+
+static u32 relax_gotpc32_tlsdesc(u8 *loc) {
+  switch ((loc[0] << 16) | (loc[1] << 8) | loc[2]) {
+  case 0x488d05: return 0x48c7c0; // lea 0(%rip), %rax -> mov $0, %rax
+  case 0x488d0d: return 0x48c7c1; // lea 0(%rip), %rcx -> mov $0, %rcx
+  case 0x488d15: return 0x48c7c2; // lea 0(%rip), %rdx -> mov $0, %rdx
+  case 0x488d1d: return 0x48c7c3; // lea 0(%rip), %rbx -> mov $0, %rbx
+  case 0x488d25: return 0x48c7c4; // lea 0(%rip), %rsp -> mov $0, %rsp
+  case 0x488d2d: return 0x48c7c5; // lea 0(%rip), %rbp -> mov $0, %rbp
+  case 0x488d35: return 0x48c7c6; // lea 0(%rip), %rsi -> mov $0, %rsi
+  case 0x488d3d: return 0x48c7c7; // lea 0(%rip), %rdi -> mov $0, %rdi
+  case 0x4c8d05: return 0x49c7c0; // lea 0(%rip), %r8  -> mov $0, %r8
+  case 0x4c8d0d: return 0x49c7c1; // lea 0(%rip), %r9  -> mov $0, %r9
+  case 0x4c8d15: return 0x49c7c2; // lea 0(%rip), %r10 -> mov $0, %r10
+  case 0x4c8d1d: return 0x49c7c3; // lea 0(%rip), %r11 -> mov $0, %r11
+  case 0x4c8d25: return 0x49c7c4; // lea 0(%rip), %r12 -> mov $0, %r12
+  case 0x4c8d2d: return 0x49c7c5; // lea 0(%rip), %r13 -> mov $0, %r13
+  case 0x4c8d35: return 0x49c7c6; // lea 0(%rip), %r14 -> mov $0, %r14
+  case 0x4c8d3d: return 0x49c7c7; // lea 0(%rip), %r15 -> mov $0, %r15
+  }
+  return 0;
+}
+
+// Apply relocations to SHF_ALLOC sections (i.e. sections that are
+// mapped to memory at runtime) based on the result of
+// scan_relocations().
+template <>
+void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  ElfRel<E> *dynrel = nullptr;
+  if (ctx.reldyn)
+    dynrel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset +
+                           file.reldyn_offset + this->reldyn_offset);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    auto write32 = [&](u64 val) {
+      check(val, 0, 1LL << 32);
+      *(ul32 *)loc = val;
+    };
+
+    auto write32s = [&](u64 val) {
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ul32 *)loc = val;
+    };
+
+#define S   sym.get_addr(ctx)
+#define A   rel.r_addend
+#define P   (get_addr() + rel.r_offset)
+#define G   (sym.get_got_addr(ctx) - ctx.gotplt->shdr.sh_addr)
+#define GOT ctx.gotplt->shdr.sh_addr
+
+    switch (rel.r_type) {
+    case R_X86_64_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *loc = val;
+      break;
+    }
+    case R_X86_64_16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_X86_64_32:
+      write32(S + A);
+      break;
+    case R_X86_64_32S:
+      write32s(S + A);
+      break;
+    case R_X86_64_64:
+      apply_dyn_absrel(ctx, sym, rel, loc, S, A, P, dynrel);
+      break;
+    case R_X86_64_PC8: {
+      i64 val = S + A - P;
+      check(val, -(1 << 7), 1 << 7);
+      *loc = val;
+      break;
+    }
+    case R_X86_64_PC16: {
+      i64 val = S + A - P;
+      check(val, -(1 << 15), 1 << 15);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_X86_64_PC32:
+    case R_X86_64_PLT32:
+      write32s(S + A - P);
+      break;
+    case R_X86_64_PC64:
+      *(ul64 *)loc = S + A - P;
+      break;
+    case R_X86_64_GOT32:
+      write32s(G + A);
+      break;
+    case R_X86_64_GOT64:
+      *(ul64 *)loc = G + A;
+      break;
+    case R_X86_64_GOTOFF64:
+    case R_X86_64_PLTOFF64:
+      *(ul64 *)loc = S + A - GOT;
+      break;
+    case R_X86_64_GOTPC32:
+      write32s(GOT + A - P);
+      break;
+    case R_X86_64_GOTPC64:
+      *(ul64 *)loc = GOT + A - P;
+      break;
+    case R_X86_64_GOTPCREL:
+      write32s(G + GOT + A - P);
+      break;
+    case R_X86_64_GOTPCREL64:
+      *(ul64 *)loc = G + GOT + A - P;
+      break;
+    case R_X86_64_GOTPCRELX:
+      if (sym.has_got(ctx)) {
+        write32s(G + GOT + A - P);
+      } else {
+        u32 insn = relax_gotpcrelx(loc - 2);
+        loc[-2] = insn >> 8;
+        loc[-1] = insn;
+        write32s(S + A - P);
+      }
+      break;
+    case R_X86_64_REX_GOTPCRELX:
+      if (sym.has_got(ctx)) {
+        write32s(G + GOT + A - P);
+      } else {
+        u32 insn = relax_rex_gotpcrelx(loc - 3);
+        loc[-3] = insn >> 16;
+        loc[-2] = insn >> 8;
+        loc[-1] = insn;
+        write32s(S + A - P);
+      }
+      break;
+    case R_X86_64_TLSGD:
+      if (sym.has_tlsgd(ctx)) {
+        write32s(sym.get_tlsgd_addr(ctx) + A - P);
+      } else {
+        // Relax GD to LE. If we are creating an exectuable, the offset of
+        // a thread-local variable from TP is a link-time constant. So we
+        // don't need to call __tls_get_addr to obtain the address of a TLV.
+        i64 val = S - ctx.tp_addr;
+        assert(A == -4);
+        check(val, -(1LL << 31), 1LL << 31);
+
+        switch (rels[i + 1].r_type) {
+        case R_X86_64_PLT32:
+        case R_X86_64_PC32:
+        case R_X86_64_GOTPCREL:
+        case R_X86_64_GOTPCRELX: {
+          // The original instructions are the following:
+          //
+          //  66 48 8d 3d 00 00 00 00    lea  foo@tlsgd(%rip), %rdi
+          //  66 66 48 e8 00 00 00 00    call __tls_get_addr
+          //
+          // or
+          //
+          //  66 48 8d 3d 00 00 00 00    lea foo@tlsgd(%rip), %rdi
+          //  66 48 ff 15 00 00 00 00    call *__tls_get_addr@GOT(%rip)
+          static const u8 insn[] = {
+            0x64, 0x48, 0x8b, 0x04, 0x25, 0, 0, 0, 0, // mov %fs:0, %rax
+            0x48, 0x81, 0xc0, 0, 0, 0, 0,             // add $val, %rax
+          };
+          memcpy(loc - 4, insn, sizeof(insn));
+          *(ul32 *)(loc + 8) = val;
+          break;
+        }
+        case R_X86_64_PLTOFF64: {
+          // The original instructions are the following:
+          //
+          //  48 8d 3d 00 00 00 00           lea    foo@tlsgd(%rip), %rdi
+          //  48 b8 00 00 00 00 00 00 00 00  movabs __tls_get_addr, %rax
+          //  48 01 d8                       add    %rbx, %rax
+          //  ff d0                          call   *%rax
+          static const u8 insn[] = {
+            0x64, 0x48, 0x8b, 0x04, 0x25, 0, 0, 0, 0, // mov %fs:0, %rax
+            0x48, 0x81, 0xc0, 0, 0, 0, 0,             // add $val, %rax
+            0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00,       // nop
+          };
+          memcpy(loc - 3, insn, sizeof(insn));
+          *(ul32 *)(loc + 9) = val;
+          break;
+        }
+        default:
+          unreachable();
+        }
+
+        i++;
+      }
+      break;
+    case R_X86_64_TLSLD:
+      if (ctx.got->has_tlsld(ctx)) {
+        write32s(ctx.got->get_tlsld_addr(ctx) + A - P);
+      } else {
+        // Relax LD to LE. If we are creating an executable, we don't need
+        // to call __tls_get_addr to obtain the address of the beginning
+        // of the current TLS block. TP points past the end of the TLS
+        // block, and we know the exact size of the TLS block we have
+        // created, so we can just subtract it from TP.
+        switch (rels[i + 1].r_type) {
+        case R_X86_64_PLT32:
+        case R_X86_64_PC32: {
+          // The original instructions are the following:
+          //
+          //  48 8d 3d 00 00 00 00    lea    foo@tlsld(%rip), %rdi
+          //  e8 00 00 00 00          call   __tls_get_addr
+          static const u8 insn[] = {
+            0x31, 0xc0,                   // xor %eax, %eax
+            0x64, 0x48, 0x8b, 0x00,       // mov %fs:(%rax), %rax
+            0x48, 0x2d, 0, 0, 0, 0,       // sub $tls_size, %rax
+          };
+          memcpy(loc - 3, insn, sizeof(insn));
+          break;
+        }
+        case R_X86_64_GOTPCREL:
+        case R_X86_64_GOTPCRELX: {
+          // The original instructions are the following:
+          //
+          //  48 8d 3d 00 00 00 00    lea    foo@tlsld(%rip), %rdi
+          //  ff 15 00 00 00 00       call   *__tls_get_addr@GOT(%rip)
+          static const u8 insn[] = {
+            0x31, 0xc0,                   // xor %eax, %eax
+            0x64, 0x48, 0x8b, 0x00,       // mov %fs:(%rax), %rax
+            0x48, 0x2d, 0, 0, 0, 0,       // sub $tls_size, %rax
+            0x90,                         // nop
+          };
+          memcpy(loc - 3, insn, sizeof(insn));
+          break;
+        }
+        case R_X86_64_PLTOFF64: {
+          // The original instructions are the following:
+          //
+          //  48 8d 3d 00 00 00 00           lea    foo@tlsld(%rip), %rdi
+          //  48 b8 00 00 00 00 00 00 00 00  movabs __tls_get_addr@GOTOFF, %rax
+          //  48 01 d8                       add    %rbx, %rax
+          //  ff d0                          call   *%rax
+          static const u8 insn[] = {
+            0x31, 0xc0,                   // xor %eax, %eax
+            0x64, 0x48, 0x8b, 0x00,       // mov %fs:(%rax), %rax
+            0x48, 0x2d, 0, 0, 0, 0,       // sub $tls_size, %rax
+            0x0f, 0x1f, 0x44, 0x00, 0x00, // nop
+            0x0f, 0x1f, 0x44, 0x00, 0x00, // nop
+          };
+          memcpy(loc - 3, insn, sizeof(insn));
+          break;
+        }
+        default:
+          unreachable();
+        }
+
+        *(ul32 *)(loc + 5) = ctx.tp_addr - ctx.tls_begin;
+        assert(A == -4);
+        i++;
+      }
+      break;
+    case R_X86_64_DTPOFF32:
+      write32s(S + A - ctx.tls_begin);
+      break;
+    case R_X86_64_DTPOFF64:
+      *(ul64 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_X86_64_TPOFF32:
+      write32s(S + A - ctx.tp_addr);
+      break;
+    case R_X86_64_TPOFF64:
+      *(ul64 *)loc = S + A - ctx.tp_addr;
+      break;
+    case R_X86_64_GOTTPOFF:
+      if (sym.has_gottp(ctx)) {
+        write32s(sym.get_gottp_addr(ctx) + A - P);
+      } else {
+        u32 insn = relax_gottpoff(loc - 3);
+        loc[-3] = insn >> 16;
+        loc[-2] = insn >> 8;
+        loc[-1] = insn;
+        write32s(S - ctx.tp_addr);
+        assert(A == -4);
+      }
+      break;
+    case R_X86_64_GOTPC32_TLSDESC:
+      if (sym.has_tlsdesc(ctx)) {
+        write32s(sym.get_tlsdesc_addr(ctx) + A - P);
+      } else {
+        u32 insn = relax_gotpc32_tlsdesc(loc - 3);
+        loc[-3] = insn >> 16;
+        loc[-2] = insn >> 8;
+        loc[-1] = insn;
+        write32s(S - ctx.tp_addr);
+        assert(A == -4);
+      }
+      break;
+    case R_X86_64_SIZE32:
+      write32(sym.esym().st_size + A);
+      break;
+    case R_X86_64_SIZE64:
+      *(ul64 *)loc = sym.esym().st_size + A;
+      break;
+    case R_X86_64_TLSDESC_CALL:
+      if (!sym.has_tlsdesc(ctx)) {
+        // call *(%rax) -> nop
+        loc[0] = 0x66;
+        loc[1] = 0x90;
+      }
+      break;
+    default:
+      unreachable();
+    }
+
+#undef S
+#undef A
+#undef P
+#undef G
+#undef GOT
+  }
+}
+
+// This function is responsible for applying relocations against
+// non-SHF_ALLOC sections (i.e. sections that are not mapped to memory
+// at runtime).
+//
+// Relocations against non-SHF_ALLOC sections are much easier to
+// handle than that against SHF_ALLOC sections. It is because, since
+// they are not mapped to memory, they don't contain any variable or
+// function and never need PLT or GOT. Non-SHF_ALLOC sections are
+// mostly debug info sections.
+//
+// Relocations against non-SHF_ALLOC sections are not scanned by
+// scan_relocations.
+template <>
+void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = base + rel.r_offset;
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    auto check = [&](i64 val, i64 lo, i64 hi) {
+      if (val < lo || hi <= val)
+        Error(ctx) << *this << ": relocation " << rel << " against "
+                   << sym << " out of range: " << val << " is not in ["
+                   << lo << ", " << hi << ")";
+    };
+
+    auto write32 = [&](u64 val) {
+      check(val, 0, 1LL << 32);
+      *(ul32 *)loc = val;
+    };
+
+    auto write32s = [&](u64 val) {
+      check(val, -(1LL << 31), 1LL << 31);
+      *(ul32 *)loc = val;
+    };
+
+    SectionFragment<E> *frag;
+    i64 frag_addend;
+    std::tie(frag, frag_addend) = get_fragment(ctx, rel);
+
+#define S (frag ? frag->get_addr(ctx) : sym.get_addr(ctx))
+#define A (frag ? frag_addend : (i64)rel.r_addend)
+
+    switch (rel.r_type) {
+    case R_X86_64_8: {
+      i64 val = S + A;
+      check(val, 0, 1 << 8);
+      *loc = val;
+      break;
+    }
+    case R_X86_64_16: {
+      i64 val = S + A;
+      check(val, 0, 1 << 16);
+      *(ul16 *)loc = val;
+      break;
+    }
+    case R_X86_64_32:
+      write32(S + A);
+      break;
+    case R_X86_64_32S:
+      write32s(S + A);
+      break;
+    case R_X86_64_64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul64 *)loc = *val;
+      else
+        *(ul64 *)loc = S + A;
+      break;
+    case R_X86_64_DTPOFF32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul32 *)loc = *val;
+      else
+        write32s(S + A - ctx.tls_begin);
+      break;
+    case R_X86_64_DTPOFF64:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ul64 *)loc = *val;
+      else
+        *(ul64 *)loc = S + A - ctx.tls_begin;
+      break;
+    case R_X86_64_SIZE32:
+      write32(sym.esym().st_size + A);
+      break;
+    case R_X86_64_SIZE64:
+      *(ul64 *)loc = sym.esym().st_size + A;
+      break;
+    default:
+      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
+                 << rel;
+      break;
+    }
+
+#undef S
+#undef A
+  }
+}
+
+// Linker has to create data structures in an output file to apply
+// some type of relocations. For example, if a relocation refers a GOT
+// or a PLT entry of a symbol, linker has to create an entry in .got
+// or in .plt for that symbol. In order to fix the file layout, we
+// need to scan relocations.
+template <>
+void InputSection<E>::scan_relocations(Context<E> &ctx) {
+  assert(shdr().sh_flags & SHF_ALLOC);
+
+  this->reldyn_offset = file.num_dynrel * sizeof(ElfRel<E>);
+  std::span<const ElfRel<E>> rels = get_rels(ctx);
+
+  // Scan relocations
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    if (rel.r_type == R_NONE)
+      continue;
+
+    Symbol<E> &sym = *file.symbols[rel.r_sym];
+    u8 *loc = (u8 *)(contents.data() + rel.r_offset);
+
+    if (!sym.file) {
+      record_undef_error(ctx, rel);
+      continue;
+    }
+
+    if (sym.is_ifunc())
+      sym.flags |= (NEEDS_GOT | NEEDS_PLT);
+
+    switch (rel.r_type) {
+    case R_X86_64_8:
+    case R_X86_64_16:
+    case R_X86_64_32:
+    case R_X86_64_32S:
+      scan_rel(ctx, sym, rel, absrel_table);
+      break;
+    case R_X86_64_64:
+      scan_rel(ctx, sym, rel, dyn_absrel_table);
+      break;
+    case R_X86_64_PC8:
+    case R_X86_64_PC16:
+    case R_X86_64_PC32:
+    case R_X86_64_PC64:
+      scan_rel(ctx, sym, rel, pcrel_table);
+      break;
+    case R_X86_64_GOT32:
+    case R_X86_64_GOT64:
+    case R_X86_64_GOTPC32:
+    case R_X86_64_GOTPC64:
+    case R_X86_64_GOTPCREL:
+    case R_X86_64_GOTPCREL64:
+      sym.flags |= NEEDS_GOT;
+      break;
+    case R_X86_64_GOTPCRELX: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_GOTPCRELX";
+
+      bool do_relax = ctx.arg.relax && !sym.is_imported &&
+                      sym.is_relative() && relax_gotpcrelx(loc - 2);
+      if (!do_relax)
+        sym.flags |= NEEDS_GOT;
+      break;
+    }
+    case R_X86_64_REX_GOTPCRELX: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_REX_GOTPCRELX";
+
+      bool do_relax = ctx.arg.relax && !sym.is_imported &&
+                      sym.is_relative() && relax_rex_gotpcrelx(loc - 3);
+      if (!do_relax)
+        sym.flags |= NEEDS_GOT;
+      break;
+    }
+    case R_X86_64_PLT32:
+    case R_X86_64_PLTOFF64:
+      if (sym.is_imported)
+        sym.flags |= NEEDS_PLT;
+      break;
+    case R_X86_64_TLSGD: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_TLSGD";
+
+      if (i + 1 == rels.size())
+        Fatal(ctx) << *this << ": TLSGD reloc must be followed by PLT or GOTPCREL";
+
+      if (u32 ty = rels[i + 1].r_type;
+          ty != R_X86_64_PLT32 && ty != R_X86_64_PC32 &&
+          ty != R_X86_64_PLTOFF64 && ty != R_X86_64_GOTPCREL &&
+          ty != R_X86_64_GOTPCRELX)
+        Fatal(ctx) << *this << ": TLSGD reloc must be followed by PLT or GOTPCREL";
+
+      if (relax_tlsgd(ctx, sym))
+        i++;
+      else
+        sym.flags |= NEEDS_TLSGD;
+      break;
+    }
+    case R_X86_64_TLSLD: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_TLSLD";
+
+      if (i + 1 == rels.size())
+        Fatal(ctx) << *this << ": TLSLD reloc must be followed by PLT or GOTPCREL";
+
+      if (u32 ty = rels[i + 1].r_type;
+          ty != R_X86_64_PLT32 && ty != R_X86_64_PC32 &&
+          ty != R_X86_64_PLTOFF64 && ty != R_X86_64_GOTPCREL &&
+          ty != R_X86_64_GOTPCRELX)
+        Fatal(ctx) << *this << ": TLSLD reloc must be followed by PLT or GOTPCREL";
+
+      if (relax_tlsld(ctx))
+        i++;
+      else
+        ctx.needs_tlsld = true;
+      break;
+    }
+    case R_X86_64_GOTTPOFF: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_GOTTPOFF";
+
+      ctx.has_gottp_rel = true;
+
+      bool do_relax = ctx.arg.relax && !ctx.arg.shared &&
+                      !sym.is_imported && relax_gottpoff(loc - 3);
+      if (!do_relax)
+        sym.flags |= NEEDS_GOTTP;
+      break;
+    }
+    case R_X86_64_GOTPC32_TLSDESC: {
+      if (rel.r_addend != -4)
+        Fatal(ctx) << *this << ": bad r_addend for R_X86_64_GOTPC32_TLSDESC";
+
+      if (relax_gotpc32_tlsdesc(loc - 3) == 0)
+        Fatal(ctx) << *this << ": GOTPC32_TLSDESC relocation is used"
+                   << " against an invalid code sequence";
+
+      if (!relax_tlsdesc(ctx, sym))
+        sym.flags |= NEEDS_TLSDESC;
+      break;
+    }
+    case R_X86_64_GOTOFF64:
+    case R_X86_64_DTPOFF32:
+    case R_X86_64_DTPOFF64:
+    case R_X86_64_TPOFF32:
+    case R_X86_64_TPOFF64:
+    case R_X86_64_SIZE32:
+    case R_X86_64_SIZE64:
+    case R_X86_64_TLSDESC_CALL:
+      break;
+    default:
+      Error(ctx) << *this << ": unknown relocation: " << rel;
+    }
+  }
+}
+
+} // namespace mold::elf

elf/dwarf.cc

@@ -0,0 +1,554 @@
+// This file contains code to read DWARF debug info to create .gdb_index.
+//
+// .gdb_index is an optional section to speed up GNU debugger. It contains
+// two maps: 1) a map from function/variable/type names to compunits, and
+// 2) a map from function address ranges to compunits. gdb uses these
+// maps to quickly find a compunit given a name or an instruction pointer.
+//
+// (Terminology: a compilation unit, which often abbreviated as compunit
+// or cu, is a unit of debug info. An input .debug_info section usually
+// contains one compunit, and thus an output .debug_info contains as
+// many compunits as the number of input files.)
+//
+// .gdb_index is not mandatory. All the information in .gdb_index is
+// also in other debug info sections. You can actually create an
+// executable without .gdb_index and later add it using `gdb-add-index`
+// post-processing tool that comes with gdb.
+//
+// The mapping from names to compunits is 1:n while the mapping from
+// address ranges to compunits is 1:1. That is, two object files may
+// define the same type name (with the same definition), while there
+// should be no two functions that overlap with each other in memory.
+//
+// .gdb_index contains an on-disk hash table for names, so gdb can
+// lookup names without loading all strings into memory and construct an
+// in-memory hash table.
+//
+// Names are in .debug_gnu_pubnames and .debug_gnu_pubtypes input
+// sections. These sections are created if `-ggnu-pubnames` is given.
+// Besides names, these sections contains attributes for each name so
+// that gdb can distinguish type names from function names, for example.
+//
+// A compunit contains one or more function address ranges. If an
+// object file is compiled without -ffunction-sections, it contains
+// only one .text section and therefore contains a single address range.
+// Such range is typically stored directly to the compunit.
+//
+// If an object file is compiled with -fucntion-sections, it contains
+// more than one .text section, and it has as many address ranges as
+// the number of .text sections. Such discontiguous address ranges are
+// stored to .debug_ranges in DWARF 2/3/4/5 and
+// .debug_rnglists/.debug_addr in DWARF 5.
+//
+// .debug_info section contains DWARF debug info. Although we don't need
+// to parse the whole .debug_info section to read address ranges, we
+// have to do a little bit. DWARF is complicated and often handled using
+// a library such as libdwarf. But we don't use any library because we
+// don't want to add an extra run-time dependency just for --gdb-index.
+//
+// This page explains the format of .gdb_index:
+// https://sourceware.org/gdb/onlinedocs/gdb/Index-Section-Format.html
+
+#include "mold.h"
+
+namespace mold::elf {
+
+// The hash function for .gdb_index.
+static u32 gdb_hash(std::string_view name) {
+  u32 h = 0;
+  for (u8 c : name) {
+    if ('A' <= c && c <= 'Z')
+      c = 'a' + c - 'A';
+    h = h * 67 + c - 113;
+  }
+  return h;
+}
+
+// Split .debug_info into so-called "compilation units". A .debug_info
+// section usually contains one compunit unless it was created by `ld -r`.
+// This is for --gdb-index.
+template <typename E>
+std::vector<std::string_view>
+read_compunits(Context<E> &ctx, ObjectFile<E> &file) {
+  file.debug_info->uncompress(ctx);
+  std::string_view data = file.debug_info->contents;
+  std::vector<std::string_view> vec;
+
+  while (!data.empty()) {
+    if (data.size() < 4)
+      Fatal(ctx) << *file.debug_info << ": corrupted .debug_info";
+    if (*(U32<E> *)data.data() == 0xffffffff)
+      Fatal(ctx) << *file.debug_info << ": --gdb-index: DWARF64 not supported";
+    i64 len = *(U32<E> *)data.data() + 4;
+    vec.push_back(data.substr(0, len));
+    data = data.substr(len);
+  }
+  return vec;
+}
+
+// Parses .debug_gnu_pubnames and .debug_gnu_pubtypes. These sections
+// start with a 14 bytes header followed by (4-byte offset, 1-byte type,
+// null-terminated string) tuples.
+//
+// The 4-byte offset is an offset into .debug_info that contains details
+// about the name. The 1-byte type is a type of the corresponding name
+// (e.g. function, variable or datatype). The string is a name of a
+// function, a variable or a type.
+template <typename E>
+std::vector<GdbIndexName> read_pubnames(Context<E> &ctx, ObjectFile<E> &file) {
+  std::vector<GdbIndexName> vec;
+
+  auto get_cu_idx = [&](InputSection<E> &isec, i64 offset) {
+    i64 off = 0;
+    for (i64 i = 0; i < file.compunits.size(); i++) {
+      if (offset == off)
+        return file.compunits_idx + i;
+      off += file.compunits[i].size();
+    }
+    Fatal(ctx) << isec << ": corrupted debug_info_offset";
+  };
+
+  auto read = [&](InputSection<E> &isec) {
+    isec.uncompress(ctx);
+    std::string_view contents = isec.contents;
+
+    while (!contents.empty()) {
+      if (contents.size() < 14)
+        Fatal(ctx) << isec << ": corrupted header";
+
+      u32 len = *(U32<E> *)contents.data() + 4;
+      u32 debug_info_offset = *(U32<E> *)(contents.data() + 6);
+      u32 cu_idx = get_cu_idx(isec, debug_info_offset);
+
+      std::string_view data = contents.substr(14, len - 14);
+      contents = contents.substr(len);
+
+      while (!data.empty()) {
+        u32 offset = *(U32<E> *)data.data();
+        data = data.substr(4);
+        if (offset == 0)
+          break;
+
+        u8 type = data[0];
+        data = data.substr(1);
+
+        std::string_view name = data.data();
+        data = data.substr(name.size() + 1);
+
+        vec.push_back({name, gdb_hash(name), (type << 24) | cu_idx});
+      }
+    }
+  };
+
+  if (file.debug_pubnames)
+    read(*file.debug_pubnames);
+  if (file.debug_pubtypes)
+    read(*file.debug_pubtypes);
+
+  // Uniquify elements because GCC 11 seems to emit one record for each
+  // comdat group which results in having a lot of duplicate records.
+  auto less = [](const GdbIndexName &a, const GdbIndexName &b) {
+    return std::tuple{a.hash, a.attr, a.name} <
+           std::tuple{b.hash, b.attr, b.name};
+  };
+
+  auto equal = [](const GdbIndexName &a, const GdbIndexName &b) {
+    return std::tuple{a.hash, a.attr, a.name} ==
+           std::tuple{b.hash, b.attr, b.name};
+  };
+
+  std::sort(vec.begin(), vec.end(), less);
+  vec.erase(std::unique(vec.begin(), vec.end(), equal), vec.end());
+  return vec;
+}
+
+template <typename E>
+static u8 *get_buffer(Context<E> &ctx, Chunk<E> *chunk) {
+  if (u8 *buf = chunk->get_uncompressed_data())
+    return buf;
+  return ctx.buf + chunk->shdr.sh_offset;
+}
+
+// Try to find a compilation unit from .debug_info and its
+// corresponding record from .debug_abbrev and returns them.
+template <typename E>
+static std::tuple<u8 *, u8 *, u32>
+find_compunit(Context<E> &ctx, ObjectFile<E> &file, i64 offset) {
+  // Read .debug_info to find the record at a given offset.
+  u8 *cu = get_buffer(ctx, ctx.debug_info) + offset;
+  u32 dwarf_version = *(U16<E> *)(cu + 4);
+  u32 abbrev_offset;
+
+  // Skip a header.
+  switch (dwarf_version) {
+  case 2:
+  case 3:
+  case 4:
+    abbrev_offset = *(U32<E> *)(cu + 6);
+    if (u32 address_size = cu[10]; address_size != sizeof(Word<E>))
+      Fatal(ctx) << file << ": --gdb-index: unsupported address size "
+                 << address_size;
+    cu += 11;
+    break;
+  case 5: {
+    abbrev_offset = *(U32<E> *)(cu + 8);
+    if (u32 address_size = cu[7]; address_size != sizeof(Word<E>))
+      Fatal(ctx) << file << ": --gdb-index: unsupported address size "
+                 << address_size;
+
+    switch (u32 unit_type = cu[6]; unit_type) {
+    case DW_UT_compile:
+    case DW_UT_partial:
+      cu += 12;
+      break;
+    case DW_UT_skeleton:
+    case DW_UT_split_compile:
+      cu += 20;
+      break;
+    default:
+      Fatal(ctx) << file << ": --gdb-index: unknown DW_UT_* value: 0x"
+                 << std::hex << unit_type;
+    }
+    break;
+  }
+  default:
+    Fatal(ctx) << file << ": --gdb-index: unknown DWARF version: "
+               << dwarf_version;
+  }
+
+  u32 abbrev_code = read_uleb(cu);
+
+  // Find a .debug_abbrev record corresponding to the .debug_info record.
+  // We assume the .debug_info record at a given offset is of
+  // DW_TAG_compile_unit which describes a compunit.
+  u8 *abbrev = get_buffer(ctx, ctx.debug_abbrev) + abbrev_offset;
+
+  for (;;) {
+    u32 code = read_uleb(abbrev);
+    if (code == 0)
+      Fatal(ctx) << file << ": --gdb-index: .debug_abbrev does not contain"
+                 << " a record for the first .debug_info record";
+
+    if (code == abbrev_code) {
+      // Found a record
+      u64 abbrev_tag = read_uleb(abbrev);
+      if (abbrev_tag != DW_TAG_compile_unit && abbrev_tag != DW_TAG_skeleton_unit)
+        Fatal(ctx) << file << ": --gdb-index: the first entry's tag is not"
+                   << " DW_TAG_compile_unit/DW_TAG_skeleton_unit but 0x"
+                   << std::hex << abbrev_tag;
+      break;
+    }
+
+    // Skip an uninteresting record
+    read_uleb(abbrev); // tag
+    abbrev++; // has_children byte
+    for (;;) {
+      u64 name = read_uleb(abbrev);
+      u64 form = read_uleb(abbrev);
+      if (name == 0 && form == 0)
+        break;
+      if (form == DW_FORM_implicit_const)
+        read_uleb(abbrev);
+    }
+  }
+
+  abbrev++; // skip has_children byte
+  return {cu, abbrev, dwarf_version};
+}
+
+// Estimate the number of address ranges contained in a given file.
+// It may over-estimate but never under-estimate.
+template <typename E>
+i64 estimate_address_areas(Context<E> &ctx, ObjectFile<E> &file) {
+  // Each CU contains zero or one address area.
+  i64 ret = file.compunits.size();
+
+  // In DWARF 4, a CU can refer address ranges in .debug_ranges.
+  // .debug_ranges contains a vector of [begin, end) address pairs.
+  // The last entry must be a null terminator, so we do -1.
+  if (file.debug_ranges)
+    ret += file.debug_ranges->sh_size / sizeof(Word<E>) / 2 - 1;
+
+  // In DWARF 5, a CU can refer address ranges in .debug_rnglists, which
+  // contains variable-length entries. The smallest possible range entry
+  // is one byte for the code and two ULEB128 values (each can be as
+  // small as one byte), so 3 bytes.
+  if (file.debug_rnglists)
+    ret += file.debug_rnglists->sh_size / 3;
+  return ret;
+}
+
+// .debug_info contains variable-length fields. This class reads them.
+template <typename E>
+class DebugInfoReader {
+public:
+  DebugInfoReader(Context<E> &ctx, ObjectFile<E> &file, u8 *cu)
+    : ctx(ctx), file(file), cu(cu) {}
+
+  u64 read(u64 form);
+
+  Context<E> &ctx;
+  ObjectFile<E> &file;
+  u8 *cu;
+};
+
+// Read value of the given DW_FORM_* form. If a value is not scalar,
+// returns a dummy value 0.
+template <typename E>
+inline u64 DebugInfoReader<E>::read(u64 form) {
+  switch (form) {
+  case DW_FORM_flag_present:
+    return 0;
+  case DW_FORM_data1:
+  case DW_FORM_flag:
+  case DW_FORM_strx1:
+  case DW_FORM_addrx1:
+  case DW_FORM_ref1:
+    return *cu++;
+  case DW_FORM_data2:
+  case DW_FORM_strx2:
+  case DW_FORM_addrx2:
+  case DW_FORM_ref2: {
+    u64 val = *(U16<E> *)cu;
+    cu += 2;
+    return val;
+  }
+  case DW_FORM_strx3:
+  case DW_FORM_addrx3: {
+    u64 val = *(U24<E> *)cu;
+    cu += 3;
+    return val;
+  }
+  case DW_FORM_data4:
+  case DW_FORM_strp:
+  case DW_FORM_sec_offset:
+  case DW_FORM_line_strp:
+  case DW_FORM_strx4:
+  case DW_FORM_addrx4:
+  case DW_FORM_ref4: {
+    u64 val = *(U32<E> *)cu;
+    cu += 4;
+    return val;
+  }
+  case DW_FORM_data8:
+  case DW_FORM_ref8: {
+    u64 val = *(U64<E> *)cu;
+    cu += 8;
+    return val;
+  }
+  case DW_FORM_addr:
+  case DW_FORM_ref_addr: {
+    u64 val = *(Word<E> *)cu;
+    cu += sizeof(Word<E>);
+    return val;
+  }
+  case DW_FORM_strx:
+  case DW_FORM_addrx:
+  case DW_FORM_udata:
+  case DW_FORM_ref_udata:
+  case DW_FORM_loclistx:
+  case DW_FORM_rnglistx:
+    return read_uleb(cu);
+  case DW_FORM_string:
+    cu += strlen((char *)cu) + 1;
+    return 0;
+  default:
+    Fatal(ctx) << file << ": --gdb-index: unhandled debug info form: 0x"
+               << std::hex << form;
+    return 0;
+  }
+}
+
+// Read a range list from .debug_ranges starting at the given offset.
+template <typename E>
+static std::vector<u64>
+read_debug_range(Context<E> &ctx, ObjectFile<E> &file, Word<E> *range) {
+  std::vector<u64> vec;
+  u64 base = 0;
+
+  for (i64 i = 0; range[i] || range[i + 1]; i += 2) {
+    if (range[i] + 1 == 0) {
+      // base address selection entry
+      base = range[i + 1];
+    } else {
+      vec.push_back(range[i] + base);
+      vec.push_back(range[i + 1] + base);
+    }
+  }
+  return vec;
+}
+
+// Read a range list from .debug_rnglists starting at the given offset.
+template <typename E>
+static std::vector<u64>
+read_rnglist_range(Context<E> &ctx, ObjectFile<E> &file, u8 *rnglist,
+                   Word<E> *addrx) {
+  std::vector<u64> vec;
+  u64 base = 0;
+
+  for (;;) {
+    switch (*rnglist++) {
+    case DW_RLE_end_of_list:
+      return vec;
+    case DW_RLE_base_addressx:
+      base = addrx[read_uleb(rnglist)];
+      break;
+    case DW_RLE_startx_endx:
+      vec.push_back(addrx[read_uleb(rnglist)]);
+      vec.push_back(addrx[read_uleb(rnglist)]);
+      break;
+    case DW_RLE_startx_length:
+      vec.push_back(addrx[read_uleb(rnglist)]);
+      vec.push_back(vec.back() + read_uleb(rnglist));
+      break;
+    case DW_RLE_offset_pair:
+      vec.push_back(base + read_uleb(rnglist));
+      vec.push_back(base + read_uleb(rnglist));
+      break;
+    case DW_RLE_base_address:
+      base = *(Word<E> *)rnglist;
+      rnglist += sizeof(Word<E>);
+      break;
+    case DW_RLE_start_end:
+      vec.push_back(*(Word<E> *)rnglist);
+      rnglist += sizeof(Word<E>);
+      vec.push_back(*(Word<E> *)rnglist);
+      rnglist += sizeof(Word<E>);
+      break;
+    case DW_RLE_start_length:
+      vec.push_back(*(Word<E> *)rnglist);
+      rnglist += sizeof(Word<E>);
+      vec.push_back(vec.back() + read_uleb(rnglist));
+      break;
+    }
+  }
+}
+
+// Returns a list of address ranges explained by a compunit at the
+// `offset` in an output .debug_info section.
+//
+// .debug_info contains DWARF debug info records, so this function
+// parses DWARF. If a designated compunit contains multiple ranges, the
+// ranges are read from .debug_ranges (or .debug_rnglists for DWARF5).
+// Otherwise, a range is read directly from .debug_info (or possibly
+// from .debug_addr for DWARF5).
+template <typename E>
+std::vector<u64>
+read_address_areas(Context<E> &ctx, ObjectFile<E> &file, i64 offset) {
+  u8 *cu;
+  u8 *abbrev;
+  u32 dwarf_version;
+  std::tie(cu, abbrev, dwarf_version) = find_compunit(ctx, file, offset);
+
+  DebugInfoReader<E> reader{ctx, file, cu};
+
+  struct Record {
+    u64 form = 0;
+    u64 value = 0;
+  };
+
+  Record low_pc;
+  Record high_pc;
+  Record ranges;
+  std::optional<u64> rnglists_base;
+  Word<E> *addrx = nullptr;
+
+  // Read all interesting debug records.
+  for (;;) {
+    u64 name = read_uleb(abbrev);
+    u64 form = read_uleb(abbrev);
+    if (name == 0 && form == 0)
+      break;
+
+    u64 val = reader.read(form);
+
+    switch (name) {
+    case DW_AT_low_pc:
+      low_pc = {form, val};
+      break;
+    case DW_AT_high_pc:
+      high_pc = {form, val};
+      break;
+    case DW_AT_rnglists_base:
+      rnglists_base = val;
+      break;
+    case DW_AT_addr_base:
+      addrx = (Word<E> *)(get_buffer(ctx, ctx.debug_addr) + val);
+      break;
+    case DW_AT_ranges:
+      ranges = {form, val};
+      break;
+    }
+  }
+
+  // Handle non-contiguous address ranges.
+  if (ranges.form) {
+    if (dwarf_version <= 4) {
+       Word<E> *range_begin =
+        (Word<E> *)(get_buffer(ctx, ctx.debug_ranges) + ranges.value);
+      return read_debug_range(ctx, file, range_begin);
+    }
+
+    assert(dwarf_version == 5);
+
+    u8 *buf = get_buffer(ctx, ctx.debug_rnglists);
+    if (ranges.form == DW_FORM_sec_offset)
+      return read_rnglist_range(ctx, file, buf + ranges.value, addrx);
+
+    if (!rnglists_base)
+      Fatal(ctx) << file << ": --gdb-index: missing DW_AT_rnglists_base";
+
+    u8 *base = buf + *rnglists_base;
+    return read_rnglist_range(ctx, file, base + *(U32<E> *)base, addrx);
+  }
+
+  // Handle a contiguous address range.
+  if (low_pc.form && high_pc.form) {
+    u64 lo;
+
+    switch (low_pc.form) {
+    case DW_FORM_addr:
+      lo = low_pc.value;
+      break;
+    case DW_FORM_addrx:
+    case DW_FORM_addrx1:
+    case DW_FORM_addrx2:
+    case DW_FORM_addrx4:
+      lo = addrx[low_pc.value];
+      break;
+    default:
+      Fatal(ctx) << file << ": --gdb-index: unhandled form for DW_AT_low_pc: 0x"
+                 << std::hex << high_pc.form;
+    }
+
+    switch (high_pc.form) {
+    case DW_FORM_addr:
+      return {lo, high_pc.value};
+    case DW_FORM_addrx:
+    case DW_FORM_addrx1:
+    case DW_FORM_addrx2:
+    case DW_FORM_addrx4:
+      return {lo, addrx[high_pc.value]};
+    case DW_FORM_udata:
+    case DW_FORM_data1:
+    case DW_FORM_data2:
+    case DW_FORM_data4:
+    case DW_FORM_data8:
+      return {lo, lo + high_pc.value};
+    default:
+      Fatal(ctx) << file << ": --gdb-index: unhandled form for DW_AT_high_pc: 0x"
+                 << std::hex << high_pc.form;
+    }
+  }
+
+  return {};
+}
+
+using E = MOLD_TARGET;
+
+template std::vector<std::string_view> read_compunits(Context<E> &, ObjectFile<E> &);
+template std::vector<GdbIndexName> read_pubnames(Context<E> &, ObjectFile<E> &);
+template i64 estimate_address_areas(Context<E> &, ObjectFile<E> &);
+template std::vector<u64> read_address_areas(Context<E> &, ObjectFile<E> &, i64);
+
+} // namespace mold::elf

elf/gc-sections.cc

@@ -0,0 +1,197 @@
+// This file implements a mark-sweep garbage collector for -gc-sections.
+// In this algorithm, vertices are sections and edges are relocations.
+// Any section that is reachable from a root section is considered alive.
+
+#include "mold.h"
+
+#include <tbb/concurrent_vector.h>
+#include <tbb/parallel_for_each.h>
+
+namespace mold::elf {
+
+template <typename E>
+static bool should_keep(const InputSection<E> &isec) {
+  u32 type = isec.shdr().sh_type;
+  u32 flags = isec.shdr().sh_flags;
+  std::string_view name = isec.name();
+
+  return (flags & SHF_GNU_RETAIN) ||
+         type == SHT_NOTE ||
+         type == SHT_INIT_ARRAY ||
+         type == SHT_FINI_ARRAY ||
+         type == SHT_PREINIT_ARRAY ||
+         (std::is_same_v<E, ARM32> && type == SHT_ARM_EXIDX) ||
+         name.starts_with(".ctors") ||
+         name.starts_with(".dtors") ||
+         name.starts_with(".init") ||
+         name.starts_with(".fini") ||
+         is_c_identifier(name);
+}
+
+template <typename E>
+static bool mark_section(InputSection<E> *isec) {
+  return isec && isec->is_alive && fast_mark(isec->is_visited);
+}
+
+template <typename E>
+static void visit(Context<E> &ctx, InputSection<E> *isec,
+                  tbb::feeder<InputSection<E> *> &feeder, i64 depth) {
+  assert(isec->is_visited);
+
+  // If this is a text section, .eh_frame may contain records
+  // describing how to handle exceptions for that function.
+  // We want to keep associated .eh_frame records.
+  for (FdeRecord<E> &fde : isec->get_fdes())
+    for (const ElfRel<E> &rel : fde.get_rels(isec->file).subspan(1))
+      if (Symbol<E> *sym = isec->file.symbols[rel.r_sym])
+        if (mark_section(sym->get_input_section()))
+          feeder.add(sym->get_input_section());
+
+  for (const ElfRel<E> &rel : isec->get_rels(ctx)) {
+    Symbol<E> &sym = *isec->file.symbols[rel.r_sym];
+
+    // Symbol can refer either a section fragment or an input section.
+    // Mark a fragment as alive.
+    if (SectionFragment<E> *frag = sym.get_frag()) {
+      frag->is_alive.store(true, std::memory_order_relaxed);
+      continue;
+    }
+
+    if (!mark_section(sym.get_input_section()))
+      continue;
+
+    // Mark a section alive. For better performacne, we don't call
+    // `feeder.add` too often.
+    if (depth < 3)
+      visit(ctx, sym.get_input_section(), feeder, depth + 1);
+    else
+      feeder.add(sym.get_input_section());
+  }
+}
+
+template <typename E>
+static void collect_root_set(Context<E> &ctx,
+                             tbb::concurrent_vector<InputSection<E> *> &rootset) {
+  Timer t(ctx, "collect_root_set");
+
+  auto enqueue_section = [&](InputSection<E> *isec) {
+    if (mark_section(isec))
+      rootset.push_back(isec);
+  };
+
+  auto enqueue_symbol = [&](Symbol<E> *sym) {
+    if (sym) {
+      if (SectionFragment<E> *frag = sym->get_frag())
+        frag->is_alive.store(true, std::memory_order_relaxed);
+      else
+        enqueue_section(sym->get_input_section());
+    }
+  };
+
+  // Add sections that are not subject to garbage collection.
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+      if (!isec || !isec->is_alive)
+        continue;
+
+      // -gc-sections discards only SHF_ALLOC sections. If you want to
+      // reduce the amount of non-memory-mapped segments, you should
+      // use `strip` command, compile without debug info or use
+      // -strip-all linker option.
+      u32 flags = isec->shdr().sh_flags;
+      if (!(flags & SHF_ALLOC))
+        isec->is_visited = true;
+
+      if (should_keep(*isec))
+        enqueue_section(isec.get());
+    }
+  });
+
+  // Add sections containing exported symbols
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (Symbol<E> *sym : file->symbols)
+      if (sym->file == file && sym->is_exported)
+        enqueue_symbol(sym);
+  });
+
+  // Add sections referenced by root symbols.
+  enqueue_symbol(get_symbol(ctx, ctx.arg.entry));
+
+  for (std::string_view name : ctx.arg.undefined)
+    enqueue_symbol(get_symbol(ctx, name));
+
+  for (std::string_view name : ctx.arg.require_defined)
+    enqueue_symbol(get_symbol(ctx, name));
+
+  // .eh_frame consists of variable-length records called CIE and FDE
+  // records, and they are a unit of inclusion or exclusion.
+  // We just keep all CIEs and everything that are referenced by them.
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (CieRecord<E> &cie : file->cies)
+      for (const ElfRel<E> &rel : cie.get_rels())
+        enqueue_symbol(file->symbols[rel.r_sym]);
+  });
+}
+
+// Mark all reachable sections
+template <typename E>
+static void mark(Context<E> &ctx,
+                 tbb::concurrent_vector<InputSection<E> *> &rootset) {
+  Timer t(ctx, "mark");
+
+  tbb::parallel_for_each(rootset, [&](InputSection<E> *isec,
+                                    tbb::feeder<InputSection<E> *> &feeder) {
+    visit(ctx, isec, feeder, 0);
+  });
+}
+
+// Remove unreachable sections
+template <typename E>
+static void sweep(Context<E> &ctx) {
+  Timer t(ctx, "sweep");
+  static Counter counter("garbage_sections");
+
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+      if (isec && isec->is_alive && !isec->is_visited) {
+        if (ctx.arg.print_gc_sections)
+          SyncOut(ctx) << "removing unused section " << *isec;
+        isec->kill();
+        counter++;
+      }
+    }
+  });
+}
+
+// Non-alloc section fragments are not subject of garbage collection.
+// This function marks such fragments.
+template <typename E>
+static void mark_nonalloc_fragments(Context<E> &ctx) {
+  Timer t(ctx, "mark_nonalloc_fragments");
+
+  tbb::parallel_for_each(ctx.objs, [](ObjectFile<E> *file) {
+    for (std::unique_ptr<MergeableSection<E>> &m : file->mergeable_sections)
+      if (m)
+        for (SectionFragment<E> *frag : m->fragments)
+          if (!(frag->output_section.shdr.sh_flags & SHF_ALLOC))
+            frag->is_alive.store(true, std::memory_order_relaxed);
+  });
+}
+
+template <typename E>
+void gc_sections(Context<E> &ctx) {
+  Timer t(ctx, "gc");
+
+  mark_nonalloc_fragments(ctx);
+
+  tbb::concurrent_vector<InputSection<E> *> rootset;
+  collect_root_set(ctx, rootset);
+  mark(ctx, rootset);
+  sweep(ctx);
+}
+
+using E = MOLD_TARGET;
+
+template void gc_sections(Context<E> &ctx);
+
+} // namespace mold::elf

elf/icf.cc

@@ -0,0 +1,630 @@
+// This file implements the Identical Code Folding feature which can
+// reduce the output file size of a typical program by a few percent.
+// ICF identifies read-only input sections that happen to be identical
+// and thus can be used interchangeably. ICF leaves one of them and discards
+// the others.
+//
+// ICF is usually used in combination with -ffunction-sections and
+// -fdata-sections compiler options, so that object files have one section
+// for each function or variable instead of having one large .text or .data.
+// The unit of ICF merging is section.
+//
+// Two sections are considered identical by ICF if they have the exact
+// same contents, metadata such as section flags, exception handling
+// records, and relocations. The last one is interesting because two
+// relocations are considered identical if they point to the _same_
+// section in terms of ICF.
+//
+// To see what that means, consider two sections, A and B, which are
+// identical except for one pair of relocations. Say, A has a relocation to
+// section C, and B has a relocation to D. In this case, A and B are
+// considered identical if C and D are considered identical. C and D can be
+// either really the same section or two different sections that are
+// considered identical by ICF. Below is an example of such inputs, A, B, C
+// and D:
+//
+//   void A() { C(); }
+//   void B() { D(); }
+//   void C() { A(); }
+//   void D() { B(); }
+//
+// If we assume A and B are mergeable, we can merge C and D, which makes A
+// and B mergeable. There's no contradiction in our assumption, so we can
+// conclude that A and B as well as C and D are mergeable.
+//
+// This problem boils down to one in graph theory. Input to ICF can be
+// considered as a directed graph in which vertices are sections and edges
+// are relocations. Vertices have labels (section contents, etc.), and so
+// are edges (relocation offsets, etc.). Two vertices are considered
+// identical if and only if the (possibly infinite) their unfoldings into
+// regular trees are equal. Given this formulation, we want to find as
+// many identical vertices as possible.
+//
+// Just like a lot of problems with graph, this problem doesn't have a
+// straightforward "optimal" solution, and we need to resort to heuristics.
+//
+// mold approaches this problem by hashing program trees with increasing depth
+// on each iteration.
+// For example, when we start, we only hash individual functions with
+// their call into other functions omitted. From the second iteration, we
+// put the function they call into the hash by appending the hash of those
+// functions from the previous iteration. This means that the nth iteration
+// hashes call chain up to (n-1) levels deep.
+// We use a cryptographic hash function, so the unique number of hashes will
+// only monotonically increase as we take into account of deeper trees with
+// iterations (otherwise, that means we have found a hash collision). We stop
+// when the unique number of hashes stop increasing; this is based on the fact
+// that once we observe an iteration with the same amount of unique hashes as
+// the previous iteration, it will remain unchanged for further iterations.
+// This is provable, but here we omit the proof for brevity.
+//
+// When compared to other approaches, mold's approach has a relatively cheaper
+// cost per iteration, and as a bonus, is highly parallelizable.
+// For Chromium, mold's ICF finishes in less than 1 second with 20 threads,
+// whereas lld takes 5 seconds and gold takes 50 seconds under the same
+// conditions.
+
+#include "mold.h"
+#include "../sha.h"
+
+#include <array>
+#include <cstdio>
+#include <tbb/concurrent_unordered_map.h>
+#include <tbb/concurrent_vector.h>
+#include <tbb/enumerable_thread_specific.h>
+#include <tbb/parallel_for.h>
+#include <tbb/parallel_for_each.h>
+#include <tbb/parallel_sort.h>
+
+static constexpr int64_t HASH_SIZE = 16;
+
+typedef std::array<uint8_t, HASH_SIZE> Digest;
+
+namespace std {
+template<> struct hash<Digest> {
+  size_t operator()(const Digest &k) const {
+    return *(int64_t *)&k[0];
+  }
+};
+}
+
+namespace mold::elf {
+
+class BitVector {
+public:
+  BitVector(u32 size) : vec((size + 7) / 8) {}
+  bool get(u32 idx) const { return vec[idx / 8] & (1 << (idx % 8)); }
+  void set(u32 idx) { vec[idx / 8] |= 1 << (idx % 8); }
+
+private:
+  std::vector<u8> vec;
+};
+
+template <typename E>
+static void uniquify_cies(Context<E> &ctx) {
+  Timer t(ctx, "uniquify_cies");
+  std::vector<CieRecord<E> *> cies;
+
+  for (ObjectFile<E> *file : ctx.objs) {
+    for (CieRecord<E> &cie : file->cies) {
+      for (i64 i = 0; i < cies.size(); i++) {
+        if (cie.equals(*cies[i])) {
+          cie.icf_idx = i;
+          goto found;
+        }
+      }
+      cie.icf_idx = cies.size();
+      cies.push_back(&cie);
+    found:;
+    }
+  }
+}
+
+template <typename E>
+static bool is_eligible(Context<E> &ctx, InputSection<E> &isec) {
+  const ElfShdr<E> &shdr = isec.shdr();
+  std::string_view name = isec.name();
+
+  bool is_alloc = (shdr.sh_flags & SHF_ALLOC);
+  bool is_exec = (shdr.sh_flags & SHF_EXECINSTR) ||
+                 ctx.arg.ignore_data_address_equality;
+  bool is_relro = (name == ".data.rel.ro" ||
+                   name.starts_with(".data.rel.ro."));
+  bool is_readonly = !(shdr.sh_flags & SHF_WRITE) || is_relro;
+  bool is_bss = (shdr.sh_type == SHT_NOBITS);
+  bool is_empty = (shdr.sh_size == 0);
+  bool is_init = (shdr.sh_type == SHT_INIT_ARRAY || name == ".init");
+  bool is_fini = (shdr.sh_type == SHT_FINI_ARRAY || name == ".fini");
+  bool is_enumerable = is_c_identifier(name);
+  bool is_addr_taken = !ctx.arg.icf_all && isec.address_significant;
+
+  return is_alloc && is_exec && is_readonly && !is_bss && !is_empty &&
+         !is_init && !is_fini && !is_enumerable && !is_addr_taken;
+}
+
+static Digest digest_final(SHA256Hash &sha) {
+  u8 buf[SHA256_SIZE];
+  sha.finish(buf);
+
+  Digest digest;
+  memcpy(digest.data(), buf, HASH_SIZE);
+  return digest;
+}
+
+template <typename E>
+static bool is_leaf(Context<E> &ctx, InputSection<E> &isec) {
+  if (!isec.get_rels(ctx).empty())
+    return false;
+
+  for (FdeRecord<E> &fde : isec.get_fdes())
+    if (fde.get_rels(isec.file).size() > 1)
+      return false;
+
+  return true;
+}
+
+static u64 combine_hash(u64 a, u64 b) {
+  return a ^ (b + 0x9e3779b9 + (a << 6) + (a >> 2));
+}
+
+template <typename E>
+struct LeafHasher {
+  size_t operator()(InputSection<E> *isec) const {
+    u64 h = hash_string(isec->contents);
+    for (FdeRecord<E> &fde : isec->get_fdes()) {
+      u64 h2 = hash_string(fde.get_contents(isec->file).substr(8));
+      h = combine_hash(h, h2);
+    }
+    return h;
+  }
+};
+
+template <typename E>
+struct LeafEq {
+  bool operator()(InputSection<E> *a, InputSection<E> *b) const {
+    if (a->contents != b->contents)
+      return false;
+
+    std::span<FdeRecord<E>> x = a->get_fdes();
+    std::span<FdeRecord<E>> y = b->get_fdes();
+
+    if (x.size() != y.size())
+      return false;
+
+    for (i64 i = 0; i < x.size(); i++)
+      if (x[i].get_contents(a->file).substr(8) !=
+          y[i].get_contents(b->file).substr(8))
+        return false;
+    return true;
+  }
+};
+
+// Early merge of leaf nodes, which can be processed without constructing the
+// entire graph. This reduces the vertex count and improves memory efficiency.
+template <typename E>
+static void merge_leaf_nodes(Context<E> &ctx) {
+  Timer t(ctx, "merge_leaf_nodes");
+
+  static Counter eligible("icf_eligibles");
+  static Counter non_eligible("icf_non_eligibles");
+  static Counter leaf("icf_leaf_nodes");
+
+  tbb::concurrent_unordered_map<InputSection<E> *, InputSection<E> *,
+                                LeafHasher<E>, LeafEq<E>> map;
+
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    for (std::unique_ptr<InputSection<E>> &isec : ctx.objs[i]->sections) {
+      if (!isec || !isec->is_alive)
+        continue;
+
+      if (!is_eligible(ctx, *isec)) {
+        non_eligible++;
+        continue;
+      }
+
+      if (is_leaf(ctx, *isec)) {
+        leaf++;
+        isec->icf_leaf = true;
+        auto [it, inserted] = map.insert({isec.get(), isec.get()});
+        if (!inserted && isec->get_priority() < it->second->get_priority())
+          it->second = isec.get();
+      } else {
+        eligible++;
+        isec->icf_eligible = true;
+      }
+    }
+  });
+
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    for (std::unique_ptr<InputSection<E>> &isec : ctx.objs[i]->sections) {
+      if (isec && isec->is_alive && isec->icf_leaf) {
+        auto it = map.find(isec.get());
+        assert(it != map.end());
+        isec->leader = it->second;
+      }
+    }
+  });
+}
+
+template <typename E>
+static Digest compute_digest(Context<E> &ctx, InputSection<E> &isec) {
+  SHA256Hash sha;
+
+  auto hash = [&](auto val) {
+    sha.update((u8 *)&val, sizeof(val));
+  };
+
+  auto hash_string = [&](std::string_view str) {
+    hash(str.size());
+    sha.update((u8 *)str.data(), str.size());
+  };
+
+  auto hash_symbol = [&](Symbol<E> &sym) {
+    InputSection<E> *isec = sym.get_input_section();
+
+    if (!sym.file) {
+      hash('1');
+      hash((u64)&sym);
+    } else if (SectionFragment<E> *frag = sym.get_frag()) {
+      hash('2');
+      hash((u64)frag);
+    } else if (!isec) {
+      hash('3');
+    } else if (isec->leader) {
+      hash('4');
+      hash((u64)isec->leader);
+    } else if (isec->icf_eligible) {
+      hash('5');
+    } else {
+      hash('6');
+      hash((u64)isec);
+    }
+    hash(sym.value);
+  };
+
+  hash_string(isec.contents);
+  hash(isec.shdr().sh_flags);
+  hash(isec.get_fdes().size());
+  hash(isec.get_rels(ctx).size());
+
+  for (FdeRecord<E> &fde : isec.get_fdes()) {
+    hash(isec.file.cies[fde.cie_idx].icf_idx);
+
+    // Bytes 0 to 4 contain the length of this record, and
+    // bytes 4 to 8 contain an offset to CIE.
+    hash_string(fde.get_contents(isec.file).substr(8));
+
+    hash(fde.get_rels(isec.file).size());
+
+    for (const ElfRel<E> &rel : fde.get_rels(isec.file).subspan(1)) {
+      hash_symbol(*isec.file.symbols[rel.r_sym]);
+      hash(rel.r_type);
+      hash(rel.r_offset - fde.input_offset);
+      hash(isec.file.cies[fde.cie_idx].input_section.get_addend(rel));
+    }
+  }
+
+  for (i64 i = 0; i < isec.get_rels(ctx).size(); i++) {
+    const ElfRel<E> &rel = isec.get_rels(ctx)[i];
+    hash(rel.r_offset);
+    hash(rel.r_type);
+    hash(isec.get_addend(rel));
+    hash_symbol(*isec.file.symbols[rel.r_sym]);
+  }
+
+  return digest_final(sha);
+}
+
+template <typename E>
+static std::vector<InputSection<E> *> gather_sections(Context<E> &ctx) {
+  Timer t(ctx, "gather_sections");
+
+  // Count the number of input sections for each input file.
+  std::vector<i64> num_sections(ctx.objs.size());
+
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    for (std::unique_ptr<InputSection<E>> &isec : ctx.objs[i]->sections)
+      if (isec && isec->is_alive && isec->icf_eligible)
+        num_sections[i]++;
+  });
+
+  std::vector<i64> section_indices(ctx.objs.size());
+  for (i64 i = 0; i < ctx.objs.size() - 1; i++)
+    section_indices[i + 1] = section_indices[i] + num_sections[i];
+
+  std::vector<InputSection<E> *> sections(
+    section_indices.back() + num_sections.back());
+
+  // Fill `sections` contents.
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    i64 idx = section_indices[i];
+    for (std::unique_ptr<InputSection<E>> &isec : ctx.objs[i]->sections)
+      if (isec && isec->is_alive && isec->icf_eligible)
+        sections[idx++] = isec.get();
+  });
+
+  tbb::parallel_for((i64)0, (i64)sections.size(), [&](i64 i) {
+    sections[i]->icf_idx = i;
+  });
+
+  return sections;
+}
+
+template <typename E>
+static std::vector<Digest>
+compute_digests(Context<E> &ctx, std::span<InputSection<E> *> sections) {
+  Timer t(ctx, "compute_digests");
+
+  std::vector<Digest> digests(sections.size());
+  tbb::parallel_for((i64)0, (i64)sections.size(), [&](i64 i) {
+    digests[i] = compute_digest(ctx, *sections[i]);
+  });
+  return digests;
+}
+
+// Build a graph, treating every function as a vertex and every function call
+// as an edge. See the description at the top for a more detailed formulation.
+// We use u32 indices here to improve cache locality.
+template <typename E>
+static void gather_edges(Context<E> &ctx,
+                         std::span<InputSection<E> *> sections,
+                         std::vector<u32> &edges,
+                         std::vector<u32> &edge_indices) {
+  Timer t(ctx, "gather_edges");
+
+  if (sections.empty())
+    return;
+
+  std::vector<i64> num_edges(sections.size());
+  edge_indices.resize(sections.size());
+
+  tbb::parallel_for((i64)0, (i64)sections.size(), [&](i64 i) {
+    InputSection<E> &isec = *sections[i];
+    assert(isec.icf_eligible);
+
+    for (i64 j = 0; j < isec.get_rels(ctx).size(); j++) {
+      const ElfRel<E> &rel = isec.get_rels(ctx)[j];
+      Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+      if (!sym.get_frag())
+        if (InputSection<E> *isec = sym.get_input_section())
+          if (isec->icf_eligible)
+            num_edges[i]++;
+    }
+  });
+
+  for (i64 i = 0; i < num_edges.size() - 1; i++)
+    edge_indices[i + 1] = edge_indices[i] + num_edges[i];
+
+  edges.resize(edge_indices.back() + num_edges.back());
+
+  tbb::parallel_for((i64)0, (i64)num_edges.size(), [&](i64 i) {
+    InputSection<E> &isec = *sections[i];
+    i64 idx = edge_indices[i];
+
+    for (i64 j = 0; j < isec.get_rels(ctx).size(); j++) {
+      const ElfRel<E> &rel = isec.get_rels(ctx)[j];
+      Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+      if (!sym.get_frag())
+        if (InputSection<E> *isec = sym.get_input_section())
+          if (isec->icf_eligible)
+            edges[idx++] = isec->icf_idx;
+    }
+  });
+}
+
+template <typename E>
+static i64 propagate(std::span<std::vector<Digest>> digests,
+                     std::span<u32> edges, std::span<u32> edge_indices,
+                     bool &slot, BitVector &converged,
+                     tbb::affinity_partitioner &ap) {
+  static Counter round("icf_round");
+  round++;
+
+  i64 num_digests = digests[0].size();
+  tbb::enumerable_thread_specific<i64> changed;
+
+  tbb::parallel_for((i64)0, num_digests, [&](i64 i) {
+    if (converged.get(i))
+      return;
+
+    SHA256Hash sha;
+    sha.update(digests[2][i].data(), HASH_SIZE);
+
+    i64 begin = edge_indices[i];
+    i64 end = (i + 1 == num_digests) ? edges.size() : edge_indices[i + 1];
+
+    for (i64 j : edges.subspan(begin, end - begin))
+      sha.update(digests[slot][j].data(), HASH_SIZE);
+
+    digests[!slot][i] = digest_final(sha);
+
+    if (digests[slot][i] == digests[!slot][i]) {
+      // This node has converged. Skip further iterations as it will
+      // yield the same hash.
+      converged.set(i);
+    } else {
+      changed.local()++;
+    }
+  }, ap);
+
+  slot = !slot;
+  return changed.combine(std::plus());
+}
+
+template <typename E>
+static i64 count_num_classes(std::span<Digest> digests,
+                             tbb::affinity_partitioner &ap) {
+  std::vector<Digest> vec(digests.begin(), digests.end());
+  tbb::parallel_sort(vec);
+
+  tbb::enumerable_thread_specific<i64> num_classes;
+  tbb::parallel_for((i64)0, (i64)vec.size() - 1, [&](i64 i) {
+    if (vec[i] != vec[i + 1])
+      num_classes.local()++;
+  }, ap);
+  return num_classes.combine(std::plus());
+}
+
+template <typename E>
+static void print_icf_sections(Context<E> &ctx) {
+  tbb::concurrent_vector<InputSection<E> *> leaders;
+  tbb::concurrent_unordered_multimap<InputSection<E> *, InputSection<E> *> map;
+
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+      if (isec && isec->is_alive && isec->leader) {
+        if (isec.get() == isec->leader)
+          leaders.push_back(isec.get());
+        else
+          map.insert({isec->leader, isec.get()});
+      }
+    }
+  });
+
+  tbb::parallel_sort(leaders.begin(), leaders.end(),
+                     [&](InputSection<E> *a, InputSection<E> *b) {
+                       return a->get_priority() < b->get_priority();
+                     });
+
+  i64 saved_bytes = 0;
+
+  for (InputSection<E> *leader : leaders) {
+    auto [begin, end] = map.equal_range(leader);
+    if (begin == end)
+      continue;
+
+    SyncOut(ctx) << "selected section " << *leader;
+
+    i64 n = 0;
+    for (auto it = begin; it != end; it++) {
+      SyncOut(ctx) << "  removing identical section " << *it->second;
+      n++;
+    }
+    saved_bytes += leader->contents.size() * n;
+  }
+
+  SyncOut(ctx) << "ICF saved " << saved_bytes << " bytes";
+}
+
+template <typename E>
+void icf_sections(Context<E> &ctx) {
+  Timer t(ctx, "icf");
+  if (ctx.objs.empty())
+    return;
+
+  uniquify_cies(ctx);
+  merge_leaf_nodes(ctx);
+
+  // Prepare for the propagation rounds.
+  std::vector<InputSection<E> *> sections = gather_sections(ctx);
+
+  // We allocate 3 arrays to store hashes for each vertex.
+  //
+  // Index 0 and 1 are used for tree hashes from the previous
+  // iteration and the current iteration. They switch roles every
+  // iteration. See `slot` below.
+  //
+  // Index 2 stores the initial, single-vertex hash. This is combined
+  // with hashes from the connected vertices to form the tree hash
+  // described above.
+  std::vector<std::vector<Digest>> digests(3);
+  digests[0] = compute_digests<E>(ctx, sections);
+  digests[1].resize(digests[0].size());
+  digests[2] = digests[0];
+
+  std::vector<u32> edges;
+  std::vector<u32> edge_indices;
+  gather_edges<E>(ctx, sections, edges, edge_indices);
+
+  BitVector converged(digests[0].size());
+  bool slot = 0;
+
+  // Execute the propagation rounds until convergence is obtained.
+  {
+    Timer t(ctx, "propagate");
+    tbb::affinity_partitioner ap;
+
+    // A cheap test that the graph hasn't converged yet.
+    // The loop after this one uses a strict condition, but it's expensive
+    // as it requires sorting the entire hash collection.
+    //
+    // For nodes that have a cycle in downstream (i.e. recursive
+    // functions and functions that calls recursive functions) will always
+    // change with the iterations. Nodes that doesn't (i.e. non-recursive
+    // functions) will stop changing as soon as the propagation depth reaches
+    // the call tree depth.
+    // Here, we test whether we have reached sufficient depth for the latter,
+    // which is a necessary (but not sufficient) condition for convergence.
+    i64 num_changed = -1;
+    for (;;) {
+      i64 n = propagate<E>(digests, edges, edge_indices, slot, converged, ap);
+      if (n == num_changed)
+        break;
+      num_changed = n;
+    }
+
+    // Run the pass until the unique number of hashes stop increasing, at which
+    // point we have achieved convergence (proof omitted for brevity).
+    i64 num_classes = -1;
+    for (;;) {
+      // count_num_classes requires sorting which is O(n log n), so do a little
+      // more work beforehand to amortize that log factor.
+      for (i64 i = 0; i < 10; i++)
+        propagate<E>(digests, edges, edge_indices, slot, converged, ap);
+
+      i64 n = count_num_classes<E>(digests[slot], ap);
+      if (n == num_classes)
+        break;
+      num_classes = n;
+    }
+  }
+
+  // Group sections by SHA digest.
+  {
+    Timer t(ctx, "group");
+
+    auto *map = new tbb::concurrent_unordered_map<Digest, InputSection<E> *>;
+    std::span<Digest> digest = digests[slot];
+
+    tbb::parallel_for((i64)0, (i64)sections.size(), [&](i64 i) {
+      InputSection<E> *isec = sections[i];
+      auto [it, inserted] = map->insert({digest[i], isec});
+      if (!inserted && isec->get_priority() < it->second->get_priority())
+        it->second = isec;
+    });
+
+    tbb::parallel_for((i64)0, (i64)sections.size(), [&](i64 i) {
+      auto it = map->find(digest[i]);
+      assert(it != map->end());
+      sections[i]->leader = it->second;
+    });
+
+    // Since free'ing the map is slow, postpone it.
+    ctx.on_exit.push_back([=] { delete map; });
+  }
+
+  if (ctx.arg.print_icf_sections)
+    print_icf_sections(ctx);
+
+  // Eliminate duplicate sections.
+  // Symbols pointing to eliminated sections will be redirected on the fly when
+  // exporting to the symtab.
+  {
+    Timer t(ctx, "sweep");
+    static Counter eliminated("icf_eliminated");
+    tbb::parallel_for_each(ctx.objs, [](ObjectFile<E> *file) {
+      for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+        if (isec && isec->is_alive && isec->is_killed_by_icf()) {
+          isec->kill();
+          eliminated++;
+        }
+      }
+    });
+  }
+}
+
+using E = MOLD_TARGET;
+
+template void icf_sections(Context<E> &ctx);
+
+} // namespace mold::elf