Remove orphaned comments and tidy ScriptExpr/ScriptCmd enums

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Make the reader state optional for the Script class
2026-11-09 04:49:33 -10:00 · 2026-06-13 14:40:42 +09:00 · 2026-06-12 12:49:56 +09:00 · 2026-06-12 12:21:30 +09:00 · 2026-06-11 14:03:04 +09:00 · 2026-06-11 13:28:28 +09:00
152 changed files with 9497 additions and 1882 deletions
@@ -1,10 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
---
-
-Delete this message and describe the bug here. Note that we only fix bugs in the most recent release of mold, so please make sure that you are using the most recent version.
@@ -6,7 +6,24 @@ on:
  workflow_dispatch:

 jobs:
-  build-tarballs:
+  check-changes:
+    runs-on: ubuntu-24.04
+    outputs:
+      has_changes: ${{ github.event_name == 'workflow_dispatch' || steps.check.outputs.has_changes }}
+    steps:
+    - name: Check for new commits since last successful run
+      id: check
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        last=$(gh run list -R ${{ github.repository }} -w build-all.yml -b main -s success -L1 --json createdAt -q '.[0].createdAt')
+        if [ -z "$last" ] || [ "$last" = "null" ] || [ "$(gh api repos/${{ github.repository }}/commits?sha=main\&since=$last\&per_page=1 | jq length)" -gt 0 ]; then
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+        fi
+
+  build-linux:
+    needs: check-changes
+    if: needs.check-changes.outputs.has_changes == 'true'
    strategy:
      matrix:
        include:
@@ -26,7 +43,7 @@ jobs:

    steps:
    - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install Podman
      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
@@ -42,8 +59,35 @@ jobs:
      run: ./dist.sh ${{ matrix.target }}

    - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.target }}
        path: dist/mold-*.tar.gz
        compression-level: 0
+
+  build-windows:
+    needs: check-changes
+    if: needs.check-changes.outputs.has_changes == 'true'
+    runs-on: windows-latest
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v6
+
+    - name: Build and Archive
+      shell: pwsh
+      run: |
+        mkdir build
+        cd build
+        cmake -T clangcl ..
+        cmake --build . --config Release -j $Env:NUMBER_OF_PROCESSORS
+        cmake --install . --config Release --prefix ../mold-install
+        cd ..
+        New-Item -ItemType Directory -Force dist | Out-Null
+        $version = $Env:TAG -replace '^v', ''
+        Compress-Archive -Path mold-install\* -DestinationPath dist\mold-$version-windows-x86_64.zip
+
+    - name: Upload artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: win-x86_64
+        path: dist/mold-*.*
@@ -21,7 +21,7 @@ jobs:

    steps:
    - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install Podman
      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
@@ -37,7 +37,7 @@ jobs:
      run: ./dist.sh ${{ matrix.target }}

    - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.target }}
        path: dist/mold-*.tar.gz
@@ -5,7 +5,7 @@ on:
 env:
  UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
 jobs:
-  build-sanitizers:
+  build-asan-tsan:
    strategy:
      matrix:
        target:
@@ -13,8 +13,9 @@ jobs:
        - '-DMOLD_USE_ASAN=On'
        - '-DMOLD_USE_TSAN=On'
    runs-on: ubuntu-24.04
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - uses: rui314/setup-mold@staging
    - run: sudo ./install-build-deps.sh
    - name: build
@@ -26,7 +27,7 @@ jobs:
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: test-results-clang
@@ -34,10 +35,23 @@ jobs:
          build
          !build/CMakeFiles

+  build-msan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v6
+    - uses: redhat-actions/podman-login@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - run: .github/workflows/run-msan.sh
+
  build-multi-archs:
    runs-on: ubuntu-24.04
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: install-build-deps
      run: |
        sudo ./install-build-deps.sh
@@ -51,7 +65,7 @@ jobs:
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
        name: test-results-multi-archs
@@ -72,9 +86,10 @@ jobs:
        - ubuntu:22.04
        - ubuntu:25.04
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    container: ${{ matrix.distro }}
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - run: ./install-build-deps.sh
    - name: build
      run: |
@@ -83,19 +98,24 @@ jobs:
        cmake ..
        cmake --build . -j$(nproc)
    - run: cd build; ctest --output-on-failure -j$(nproc)
+    - name: sanitize distro name
+      if: failure()
+      id: sanitize
+      run: echo "name=$(echo '${{ matrix.distro }}' | tr '/:' '--')" >> "$GITHUB_OUTPUT"
    - name: archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      if: failure()
      with:
-        name: test-results-${{ matrix.distro }}
+        name: test-results-${{ steps.sanitize.outputs.name }}
        path: |
          build
          !build/CMakeFiles

  build-macos:
    runs-on: macos-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: build
      run: |
        mkdir build
@@ -105,8 +125,9 @@ jobs:

  build-windows:
    runs-on: windows-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: build
      run: |
        mkdir build
@@ -116,8 +137,9 @@ jobs:

  build-msys:
    runs-on: windows-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: Setup MSYS2
      uses: msys2/setup-msys2@v2
      with:
@@ -134,8 +156,9 @@ jobs:

  build-freebsd:
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
    - name: Build and test
      uses: vmactions/freebsd-vm@v1
      with:
@@ -5,7 +5,7 @@ apt-get install -y wget xz-utils

 # Install a 32-bit RISC-V toolchain
 mkdir /rv32
-wget -O- --progress=dot:mega https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2025.01.20/riscv32-glibc-ubuntu-22.04-gcc-nightly-2025.01.20-nightly.tar.xz | tar -C /rv32 --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2025.06.13/riscv32-glibc-ubuntu-24.04-gcc-nightly-2025.06.13-nightly.tar.xz | tar -C /rv32 --strip-components=1 --xz -xf -

 ln -sf /rv32/sysroot /usr/riscv32-linux-gnu
 echo '/rv32/bin/riscv32-unknown-linux-gnu-gcc -L/usr/riscv32-linux-gnu "$@"' > /usr/bin/riscv32-linux-gnu-gcc
@@ -18,7 +18,7 @@ done

 # Install a LoongArch toolchain
 mkdir /larch
-wget -O- --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.02.21/x86_64-cross-tools-loongarch64-binutils_2.44-gcc_14.2.0-glibc_2.41.tar.xz | tar -C /larch --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/x86_64-cross-tools-loongarch64-binutils_2.44-gcc_15.1.0-glibc_2.41.tar.xz | tar -C /larch --strip-components=1 --xz -xf -

 cp -r /larch/loongarch64-unknown-linux-gnu/lib/* /larch/target/lib64
 ln -sf /larch/target /usr/loongarch64-linux-gnu
@@ -27,7 +27,7 @@ for i in gcc g++ objdump objcopy strip; do
  ln -sf /larch/bin/loongarch64-unknown-linux-gnu-$i /usr/bin/loongarch64-linux-gnu-$i
 done

-wget -O /usr/local/bin/qemu-loongarch64 --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2024.11.01/qemu-loongarch64
+wget -O /usr/local/bin/qemu-loongarch64 --progress=dot:mega https://github.com/loongson/build-tools/releases/download/2025.06.06/qemu-loongarch64
 chmod 755 /usr/local/bin/qemu-loongarch64

 # Install ARM32 big-endian toolchain
@@ -71,5 +71,5 @@ done

 # Install Intel SDE CPU emulator for CET-related tests
 mkdir /sde
-wget -O- --progress=dot:mega https://downloadmirror.intel.com/843185/sde-external-9.48.0-2024-11-25-lin.tar.xz | tar -C /sde --strip-components=1 --xz -xf -
+wget -O- --progress=dot:mega https://downloadmirror.intel.com/850782/sde-external-9.53.0-2025-03-16-lin.tar.xz | tar -C /sde --strip-components=1 --xz -xf -
 ln -s /sde/sde64 /usr/bin
@@ -6,75 +6,99 @@ on:

 permissions:
  contents: write
+  packages: write
  id-token: write

 env:
  TAG: ${{ github.ref_name }}

 jobs:
-  build:
+  build-linux:
    strategy:
      matrix:
        include:
-          - { target: x86_64,      os: ubuntu-24.04 }
-          - { target: aarch64,     os: ubuntu-24.04-arm }
-          - { target: arm,         os: ubuntu-24.04-arm }
-          - { target: riscv64,     os: ubuntu-24.04 }
-          - { target: ppc64le,     os: ubuntu-24.04 }
-          - { target: s390x,       os: ubuntu-24.04 }
-          - { target: loongarch64, os: ubuntu-24.04 }
+        - { target: x86_64,      os: ubuntu-24.04 }
+        - { target: aarch64,     os: ubuntu-24.04-arm }
+        - { target: arm,         os: ubuntu-24.04-arm }
+        - { target: riscv64,     os: ubuntu-24.04 }
+        - { target: ppc64le,     os: ubuntu-24.04 }
+        - { target: s390x,       os: ubuntu-24.04 }
+        - { target: loongarch64, os: ubuntu-24.04 }

    runs-on: ${{ matrix.os }}

    steps:
-      - uses: actions/checkout@v4
+    - uses: actions/checkout@v6

-      - name: Install Podman
-        run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static
+    - name: Install Podman
+      run: sudo apt-get update && sudo apt-get install -y podman qemu-user-static

-      - name: Login to GitHub Container Registry
-        uses: redhat-actions/podman-login@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Login to GitHub Container Registry
+      uses: redhat-actions/podman-login@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}

-      - run: ./dist.sh ${{ matrix.target }}
+    - run: ./dist.sh ${{ matrix.target }}

-      - uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.target }}
-          path: dist/mold-*.tar.gz
+    - uses: actions/upload-artifact@v7
+      with:
+        name: ${{ matrix.target }}
+        path: dist/mold-*.tar.gz
+
+  build-windows:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Build and Archive
+      shell: pwsh
+      run: |
+        mkdir build
+        cd build
+        cmake -T clangcl ..
+        cmake --build . --config Release -j $Env:NUMBER_OF_PROCESSORS
+        cmake --install . --config Release --prefix ../mold-install
+        cd ..
+        New-Item -ItemType Directory -Force dist | Out-Null
+        $version = $Env:TAG -replace '^v', ''
+        Compress-Archive -Path mold-install\* -DestinationPath dist\mold-$version-x86_64-windows.zip
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: win-x86_64
+        path: dist/mold-*.*

  publish:
-    needs: build
+    needs: [build-linux, build-windows]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+    - uses: actions/checkout@v6

-      - uses: actions/download-artifact@v4
-        with:
-          path: dist
-          pattern: '*'
-          merge-multiple: true
+    - uses: actions/download-artifact@v8
+      with:
+        path: dist
+        pattern: '*'
+        merge-multiple: true

-      - name: Ensure release exists (create if missing)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -e
-          if gh release view "$TAG" >& /dev/null; then
-            echo "Existing release found for $TAG"
-          else
-            echo "Creating draft release for $TAG"
-            gh release create "$TAG" --draft \
-              --title "$TAG" \
-              --notes "Automated draft – fill the changelog later."
-          fi
+    - name: Ensure release exists (create if missing)
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        set -e
+        if gh release view "$TAG" >& /dev/null; then
+          echo "Existing release found for $TAG"
+        else
+          echo "Creating draft release for $TAG"
+          gh release create "$TAG" --draft \
+            --title "$TAG" \
+            --notes "Automated draft – fill the changelog later."
+        fi

-      - name: Upload tarballs
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh release upload "$TAG" dist/* --clobber
-          gh release view "$TAG" --json assets --jq '.assets[].name'
+    - name: Upload tarballs
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh release upload "$TAG" dist/* --clobber
+        gh release view "$TAG" --json assets --jq '.assets[].name'
@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e -x
+cd "$(dirname $0)"/../..
+
+if [ "$GITHUB_REPOSITORY" = '' ]; then
+  image=mold-msan
+  image_build="podman build -t $image -"
+else
+  # If this script is running on GitHub Actions, we want to cache
+  # the created container image in GitHub's container repostiory.
+  image=ghcr.io/$GITHUB_REPOSITORY/mold-msan
+  image_build="podman build -t $image --output=type=registry --layers --cache-to $image --cache-from $image -"
+fi
+
+cat <<EOF | $image_build
+FROM mirror.gcr.io/library/ubuntu:24.04
+RUN apt-get update && \
+  apt-get install -y --no-install-recommends build-essential gcc g++ wget ca-certificates make cmake ninja-build python3 clang-20 llvm-20-dev libclang-20-dev libclang-rt-20-dev libtbb-dev mold && \
+  rm -rf /var/lib/apt/lists
+RUN mkdir /llvm && \
+  cd /llvm && \
+  wget -O- --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-21.1.1.tar.gz | tar xzf - --strip-components=1 && \
+  cmake -S ./runtimes -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_RUNTIMES='libcxx;libcxxabi;libunwind' -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 -DLLVM_USE_SANITIZER=MemoryWithOrigins && \
+  cmake --build build -j\$(nproc) && \
+  cmake --install build --prefix /msan && \
+  rm -rf /llvm
+EOF
+
+# Build mold and run its tests
+podman run -it --rm --pull=never -v "$(pwd):/mold:ro" --security-opt seccomp=unconfined $image bash -c "
+set -e
+mkdir /build
+cd /build
+cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 -DMOLD_USE_MSAN=ON -DMOLD_STDLIB_PREFIX=/msan -DMOLD_USE_MIMALLOC=0 -DMOLD_USE_SYSTEM_TBB=1 -DMOLD_USE_MOLD=1 /mold
+cmake --build . -j\$(nproc)
+setarch -R ctest --output-on-failure -j\$(nproc)
+"
@@ -14,7 +14,7 @@ jobs:

    steps:
    - name: Check out repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Install ronn
      run: sudo apt-get update && sudo apt-get install -y ronn
@@ -44,7 +44,7 @@
 # features and behave exactly the same.

 cmake_minimum_required(VERSION 3.14)
-project(mold VERSION 2.40.1)
+project(mold VERSION 2.41.0)

 include(CMakeDependentOption)
 include(CheckSymbolExists)
@@ -117,6 +117,22 @@ if(MOLD_USE_TSAN)
  target_link_options(mold PRIVATE -fsanitize=thread)
 endif()

+# Enable MemorySanitizer if -DMOLD_USE_MSAN=ON
+option(MOLD_USE_MSAN "Build mold with MemorySanitizer" OFF)
+if(MOLD_USE_MSAN)
+  set(MOLD_STDLIB_PREFIX /usr CACHE FILEPATH "prefix of instrumented stdlib")
+  target_compile_options(mold PRIVATE
+    -g -Og -fsanitize=memory -fsanitize-memory-track-origins
+    -nostdinc++ -isystem ${MOLD_STDLIB_PREFIX}/include/c++/v1
+    -DENABLE_MSAN_UNPOISON
+  )
+  target_link_options(mold PRIVATE
+    -fsanitize=memory
+    -nostdlib++ -L ${MOLD_STDLIB_PREFIX}/lib -lc++
+    -Wl,-rpath,${MOLD_STDLIB_PREFIX}/lib
+  )
+endif()
+
 # Statically-link libstdc++ if -DMOLD_MOSTLY_STATIC=ON.
 #
 # This option is intended to be used by `./dist.sh` script to create a
@@ -201,6 +217,7 @@ if(MOLD_USE_MIMALLOC)
    function(mold_add_mimalloc)
      set(MI_BUILD_STATIC ON CACHE INTERNAL "")
      set(MI_BUILD_TESTS OFF CACHE INTERNAL "")
+      set(MI_NO_OPT_ARCH ON CACHE INTERNAL "")
      add_subdirectory(third-party/mimalloc EXCLUDE_FROM_ALL)
      target_compile_definitions(mimalloc-static PRIVATE MI_USE_ENVIRON=0)
      target_link_libraries(mold PRIVATE mimalloc-static)
@@ -301,10 +318,6 @@ add_custom_target(git_hash

 add_dependencies(mold git_hash)

-# Create config.h file
-configure_file(lib/config.h.in config.h)
-include_directories(${CMAKE_CURRENT_BINARY_DIR})
-
 # Almost all functions are template in mold which take a target type
 # (e.g. X86_64) as its type parameter. Since we suport more than 10
 # targets, compiling a single source file for all the targets is very
@@ -313,17 +326,35 @@ include_directories(${CMAKE_CURRENT_BINARY_DIR})
 # As a workaround, we create a .cc file for each target and spawn many
 # compiler instances. This is hacky but greatly reduces compile time
 # on a multicore machine.
-list(APPEND MOLD_ELF_TARGETS
+#
+# You can build mold for a specific set of targets by passing, e.g.,
+# -DMOLD_TARGETS='X86_64;ARM64LE', though this is strongly discouraged
+# for build reproducibility. Use this option only if you build mold
+# frequently for your personal use; otherwise, always build mold with all
+# targets enabled. We provide this flag in the trust that you will not
+# abuse it, so please don’t betray that trust.
+set(MOLD_TARGETS
  X86_64 I386 ARM64LE ARM64BE ARM32LE ARM32BE RV32LE RV32BE RV64LE
  RV64BE PPC32 PPC64V1 PPC64V2 S390X SPARC64 M68K SH4LE SH4BE
-  LOONGARCH32 LOONGARCH64)
+  LOONGARCH32 LOONGARCH64
+  CACHE STRING "List of supported targets")

-list(APPEND MOLD_ELF_TEMPLATE_FILES
+list(GET MOLD_TARGETS 0 MOLD_FIRST_TARGET)
+
+list(APPEND MOLD_TEMPLATE_FILES
  src/arch-arm32.cc
  src/arch-arm64.cc
+  src/arch-i386.cc
  src/arch-loongarch.cc
+  src/arch-m68k.cc
+  src/arch-ppc32.cc
+  src/arch-ppc64v1.cc
+  src/arch-ppc64v2.cc
  src/arch-riscv.cc
+  src/arch-s390x.cc
  src/arch-sh4.cc
+  src/arch-sparc64.cc
+  src/arch-x86-64.cc
  src/archive-file.cc
  src/cmdline.cc
  src/error.cc
@@ -345,18 +376,18 @@ list(APPEND MOLD_ELF_TEMPLATE_FILES
  )

 if(WIN32 AND NOT MINGW)
-  list(APPEND MOLD_ELF_TEMPLATE_FILES src/lto-win32.cc)
+  list(APPEND MOLD_TEMPLATE_FILES src/lto-win32.cc)
 else()
-  list(APPEND MOLD_ELF_TEMPLATE_FILES src/lto-unix.cc)
+  list(APPEND MOLD_TEMPLATE_FILES src/lto-unix.cc)
 endif()

 if(WIN32)
-  list(APPEND MOLD_ELF_TEMPLATE_FILES
+  list(APPEND MOLD_TEMPLATE_FILES
    src/output-file-win32.cc
    src/subprocess-win32.cc
    )
 else()
-  list(APPEND MOLD_ELF_TEMPLATE_FILES
+  list(APPEND MOLD_TEMPLATE_FILES
    src/output-file-unix.cc
    src/subprocess-unix.cc
  )
@@ -373,15 +404,17 @@ function(mold_instantiate_templates SOURCE TARGET)
  target_sources(mold PRIVATE ${PATH})
 endfunction()

-foreach (SOURCE IN LISTS MOLD_ELF_TEMPLATE_FILES)
-  foreach(TARGET IN LISTS MOLD_ELF_TARGETS)
+foreach (SOURCE IN LISTS MOLD_TEMPLATE_FILES)
+  foreach(TARGET IN LISTS MOLD_TARGETS)
    mold_instantiate_templates(${SOURCE} ${TARGET})
+    set(HAVE_TARGET_${TARGET} 1)
  endforeach()
 endforeach()

 # Add other non-template source files.
 target_sources(mold PRIVATE
  lib/aho-corasick.cc
+  lib/compress.cc
  lib/crc32.cc
  lib/demangle.cc
  lib/filepath.cc
@@ -390,15 +423,6 @@ target_sources(mold PRIVATE
  lib/perf.cc
  lib/random.cc
  lib/tar.cc
-  src/arch-i386.cc
-  src/arch-m68k.cc
-  src/arch-ppc32.cc
-  src/arch-ppc64v1.cc
-  src/arch-ppc64v2.cc
-  src/arch-s390x.cc
-  src/arch-sparc64.cc
-  src/arch-x86-64.cc
-  src/compress.cc
  src/elf.cc
  src/entry.cc
  third-party/rust-demangle/rust-demangle.c
@@ -418,6 +442,11 @@ else()
    )
 endif()

+# Create config.h file
+configure_file(lib/config.h.in config.h)
+include_directories(${CMAKE_CURRENT_BINARY_DIR})
+
+# Test configs
 include(CTest)

 if(BUILD_TESTING)
@@ -453,10 +482,12 @@ if(NOT CMAKE_SKIP_INSTALL_RULES)
      file(CREATE_LINK \${OLD_REL} \$ENV{DESTDIR}\${NEW_ABS} SYMBOLIC)")
  endfunction()

-  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
-    ${CMAKE_INSTALL_LIBEXECDIR}/mold/ld${CMAKE_EXECUTABLE_SUFFIX})
-  mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
-    ${CMAKE_INSTALL_BINDIR}/ld.mold${CMAKE_EXECUTABLE_SUFFIX})
-  mold_install_relative_symlink(${CMAKE_INSTALL_MANDIR}/man1/mold.1
-    ${CMAKE_INSTALL_MANDIR}/man1/ld.mold.1)
+  if(NOT WIN32)
+    mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
+      ${CMAKE_INSTALL_LIBEXECDIR}/mold/ld${CMAKE_EXECUTABLE_SUFFIX})
+    mold_install_relative_symlink(${CMAKE_INSTALL_BINDIR}/mold${CMAKE_EXECUTABLE_SUFFIX}
+      ${CMAKE_INSTALL_BINDIR}/ld.mold${CMAKE_EXECUTABLE_SUFFIX})
+    mold_install_relative_symlink(${CMAKE_INSTALL_MANDIR}/man1/mold.1
+      ${CMAKE_INSTALL_MANDIR}/man1/ld.mold.1)
+  endif()
 endif()
@@ -48,7 +48,7 @@ Binary packages for the following systems are currently available:

 mold is written in C++20, so if you build mold yourself, you will need a
 recent version of a C++ compiler and a C++ standard library. We recommend GCC
-10.2 or Clang 12.0.0 (or later) and libstdc++ 10 or libc++ 7 (or later).
+10.2 or Clang 16.0.0 (or later) and libstdc++ 10 or libc++ 7 (or later).

 ### Install Dependencies

@@ -1,40 +1,45 @@
 #!/bin/bash
 #
-# This script creates a mold binary distribution. The output is written in
-# `dist` directory as `mold-$version-$arch-linux.tar.gz` (e.g.,
-# `mold-1.0.3-x86_64-linux.tar.gz`).
+# This script creates a mold binary distribution. The output is written to
+# the `dist` directory as `mold-$version-$arch-linux.tar.gz` (e.g.
+# `mold-2.40.0-x86_64-linux.tar.gz`).
 #
-# The mold executable created by this script is statically linked to
-# libstdc++ but dynamically linked to libc, libm, libz, and librt, as
-# these libraries almost always exist on any Linux system. We can't
-# statically link libc because doing so would disable dlopen(), which is
-# necessary to open the LTO linker plugin.
-#
-# This script aims to produce reproducible outputs. That means if you run
-# the script twice on the same git commit, it should produce bit-by-bit
-# identical binary files. This property is crucial as a countermeasure
-# against supply chain attacks. With this, you can verify that the binary
-# files distributed on the GitHub release pages are created from the
-# commit with release tags by rebuilding the binaries yourself.
+# This script aims to produce reproducible outputs. That means each time
+# it's run on the same git commit, it generates a bit-for-bit identical
+# binary file regardless of when or where it's executed. This property
+# serves as a strong safeguard against supply chain attacks. With a
+# reproducible build, anyone can independently verify that the binary
+# files published on our GitHub release page were built from the git
+# commit tagged for release by rebuilding the binaries themselves.
 #
 # Debian provides snapshot.debian.org to host all historical binary
-# packages. We use it to construct Podman images pinned to a
-# particular timestamp.
+# packages. We use it to construct a container image pinned to a
+# particular timestamp. snapshot.debian.org is known to be very slow,
+# but that shouldn't be a big problem for us because we only need that
+# site the first time.
 #
-# We aim to use a reasonably old Debian version because we'll dynamically
-# link glibc to mold, and a binary linked against a newer version of glibc
-# won't work on a system with an older version of glibc.
+# The mold executable created by this script is statically linked to
+# libstdc++, but dynamically linked to glibc, libm and a few other
+# libraries, as these libraries are almost always available on any Linux
+# system. We can't statically link glibc because doing so would disable
+# dlopen(), which is required to load the LTO linker plugin.
 #
-# We want to build mold with Clang rather than GCC because mold's
+# We use a reasonably old Debian version for the build environment because
+# a binary dynamically linked against a newer version of glibc won't work
+# on a system with an older version of glibc.
+#
+# We prefer to build mold with Clang rather than GCC because mold's
 # Identical Code Folding works best with the LLVM address significance
-# table (.llvm_addrsig). Building a release binary with GCC yields a
-# slightly larger binary than Clang's.
+# table (.llvm_addrsig). Building a release binary with GCC produces a
+# slightly larger binary than with Clang.
 #
 # We need a recent version of Clang to build mold. If it's not available
 # via apt-get, we'll build it ourselves.
 #
-# You may need to install qemu-user-static package to build non-native
-# binaries.
+# This script can be used to create non-native binaries (e.g., building
+# aarch64 binary on x86-64) because Podman automatically runs everything
+# under QEMU if the container image is not native. To use this script for
+# non-native builds, you may need to install the qemu-user-static package.

 set -e -x
 cd "$(dirname $0)"
@@ -74,21 +79,29 @@ fi
 case $arch in
 x86_64)
  # Debian 9 (Stretch) released in June 2017.
-  # We use a Google-provided mirror (gcr.io) of the official Docker hub
-  # (docker.io) because docker.io has a strict rate limit policy.
+  #
+  # We use a Google-provided mirror (gcr.io) instead of the official Docker
+  # Hub (docker.io) because docker.io has a strict rate limit policy.
+  #
+  # The toolchain in Debian 9 is too old to build mold, so we rebuild it
+  # from source. We download source archives from official sites and build
+  # them locally, rather than downloading pre-built binaries from somewhere
+  # else, to avoid relying on unverifiable third-party binary blobs. Podman
+  # caches the result of each RUN command, so rebuilding is done only once
+  # per host.
  cat <<EOF | $image_build
 FROM mirror.gcr.io/library/debian:stretch@sha256:c5c5200ff1e9c73ffbf188b4a67eb1c91531b644856b4aefe86a58d2f0cb05be
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN sed -i -e '/^deb/d' -e 's/^# deb /deb [trusted=yes] /g' /etc/apt/sources.list && \
+RUN sed -i -e '/^deb/d' -e 's/^# deb /deb /g' /etc/apt/sources.list && \
  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
  apt-get update && \
-  apt-get install -y --no-install-recommends wget file make gcc g++ zlib1g-dev libssl-dev && \
+  apt-get install -y --no-install-recommends wget file make gcc g++ zlib1g-dev libssl-dev ca-certificates && \
  rm -rf /var/lib/apt/lists

 # Build CMake 3.27
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://cmake.org/files/v3.27/cmake-3.27.7.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://cmake.org/files/v3.27/cmake-3.27.7.tar.gz | tar xzf - --strip-components=1 && \
  ./bootstrap --parallel=\$(nproc) && \
  make -j\$(nproc) && \
  make install && \
@@ -97,11 +110,11 @@ RUN mkdir /build && \
 # Build GCC 14
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/gcc/gcc-14.2.0/gcc-14.2.0.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/gcc/gcc-14.2.0/gcc-14.2.0.tar.gz | tar xzf - --strip-components=1 && \
  mkdir gmp mpc mpfr && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.gz | tar xzf - --strip-components=1 -C gmp && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz | tar xzf - --strip-components=1 -C mpc && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.gz | tar xzf - --strip-components=1 -C mpfr && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.gz | tar xzf - --strip-components=1 -C gmp && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz | tar xzf - --strip-components=1 -C mpc && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.gz | tar xzf - --strip-components=1 -C mpfr && \
  ./configure --prefix=/usr --enable-languages=c,c++ --disable-bootstrap --disable-multilib && \
  make -j\$(nproc) && \
  make install && \
@@ -111,7 +124,7 @@ RUN mkdir /build && \
 # Build GNU binutils 2.43
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://ftpmirror.gnu.org/binutils/binutils-2.43.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://ftpmirror.gnu.org/binutils/binutils-2.43.tar.gz | tar xzf - --strip-components=1 && \
  ./configure --prefix=/usr && \
  make -j\$(nproc) && \
  make install && \
@@ -120,7 +133,7 @@ RUN mkdir /build && \
 # Build Python 3.12.7
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://www.python.org/ftp/python/3.12.7/Python-3.12.7.tgz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://www.python.org/ftp/python/3.12.7/Python-3.12.7.tgz | tar xzf - --strip-components=1 && \
  ./configure && \
  make -j\$(nproc) && \
  make install && \
@@ -129,7 +142,7 @@ RUN mkdir /build && \
 # Build LLVM 20
 RUN mkdir /build && \
  cd /build && \
-  wget -O- --no-check-certificate --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.3.tar.gz | tar xzf - --strip-components=1 && \
+  wget -O- --progress=dot:mega https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.3.tar.gz | tar xzf - --strip-components=1 && \
  mkdir b && \
  cd b && \
  cmake -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_PROJECTS=clang ../llvm && \
@@ -141,13 +154,13 @@ EOF
 aarch64 | arm | ppc64le | s390x)
  # Debian 11 (Bullseye) released in August 2021
  #
-  # We don't want to build Clang for these targets with Qemu becuase
-  # that'd take extremely long time. Also I believe old build machines
-  # are usually x86-64.
+  # We don't want to build Clang for these targets on QEMU becuase it
+  # would take an extremely long time. Also, I believe old Linux boxes
+  # are typically x86-64.
  cat <<EOF | $image_build
 FROM mirror.gcr.io/library/debian:bullseye-20240904@sha256:8ccc486c29a3ad02ad5af7f1156e2152dff3ba5634eec9be375269ef123457d8
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN sed -i -e '/^deb/d' -e 's/^# deb /deb [trusted=yes] /g' /etc/apt/sources.list && \
+RUN sed -i -e '/^deb/d' -e 's/^# deb /deb /g' /etc/apt/sources.list && \
  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
  apt-get update && \
  apt-get install -y --no-install-recommends build-essential gcc-10 g++-10 clang-16 cmake && \
@@ -170,11 +183,12 @@ RUN sed -i -e '/^URIs/d' -e 's/^# http/URIs: http/' /etc/apt/sources.list.d/debi
 EOF
  ;;
 loongarch64)
-  # LoongArch build is not reproducible yet
  cat <<EOF | $image_build
-FROM mirror.gcr.io/loongarch64/debian:sid
+FROM mirror.gcr.io/loongarch64/debian:sid@sha256:0356df4e494bbb86bb469377a00789a5b42bbf67d5ff649a3f9721b745cbef77
 ENV DEBIAN_FRONTEND=noninteractive TZ=UTC
-RUN apt-get update && \
+RUN sed -i -e 's!http[^ ]*!http://snapshot.debian.org/archive/debian-ports/20250620T014755Z!g' /etc/apt/sources.list && \
+  echo 'Acquire::Retries "10"; Acquire::http::timeout "10"; Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/80-retries && \
+  apt-get update && \
  apt-get install -y --no-install-recommends build-essential gcc-14 g++-14 clang-19 cmake && \
  ln -sf /usr/bin/clang-19 /usr/bin/clang && \
  ln -sf /usr/bin/clang++-19 /usr/bin/clang++ && \
@@ -189,7 +203,7 @@ esac
 version=$(sed -n 's/^project(mold VERSION \(.*\))/\1/p' CMakeLists.txt)
 dest=mold-$version-$arch-linux

-# Source tarballs available on GitHub don't contain .git history.
+# Source tarballs available on GitHub don't contain .git directory.
 # Clone the repo if missing.
 [ -d .git ] || git clone --branch v$version --depth 1 --bare https://github.com/rui314/mold .git

@@ -197,15 +211,21 @@ dest=mold-$version-$arch-linux
 # for build artifacts.
 timestamp=$(git log -1 --format=%ct)

-# Build mold in a container.
-mkdir -p dist
-
-# If the host is ARM64, `uname -m` in an ARM32 container running on it
-# reports it not as ARM32 but as ARM64, which confuses BLAKE3's cmake script
-# and erroneously enables NEON SIMD instructions. `setarch` can be used
-# to change the output of `uname -m`.
+# `uname -m` in an ARM32 container running on an ARM64 host reports it
+# not as ARM32 but as ARM64. That confuses BLAKE3's cmake script and
+# erroneously enables NEON SIMD instructions. `setarch` can be used to
+# change the output of `uname -m`.
+setarch=
 [ $arch = arm ] && setarch='setarch linux32'

+mkdir -p dist
+
+# Build mold in a container.
+#
+# SOURCE_DATE_EPOCH is a standardized environment variable that allows
+# build artifacts to appear as if they were built at a specific time.
+# We use it to control how the compiler expands the C/C++ __DATE__ and
+# __TIME__ macros.
 podman run --arch $arch -it --rm --userns=host --pids-limit=-1 --network=none \
  --pull=never -v "$(pwd):/mold:ro" -v "$(pwd)/dist:/dist" $image \
   $setarch bash -c "
@@ -0,0 +1,179 @@
+# Instrumenting mold with MemorySanitizer
+
+## Introduction
+
+Per <https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo>:
+
+> If you want MemorySanitizer to work properly and not produce any false
+> positives, you must ensure that all the code in your program and in
+> libraries it uses is instrumented (i.e. built with `-fsanitize=memory`).
+> In particular, you would need to link against an MSan-instrumented C++
+> standard library. We recommend to use [libc++](https://libcxx.llvm.org/)
+> for that purpose.
+
+## Building instrumented libc++
+
+Build an MSan-instrumented libc++ from source:
+
+```sh
+cd ~
+git clone https://github.com/llvm/llvm-project
+cd llvm-project
+cmake -S ./runtimes -B build-libcxx -G Ninja  \
+    -DCMAKE_BUILD_TYPE=Release                \
+    -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
+    -DCMAKE_C_COMPILER=clang                  \
+    -DCMAKE_CXX_COMPILER=clang++              \
+    -DLLVM_USE_SANITIZER=MemoryWithOrigins
+cmake --build build-libcxx -- cxx cxxabi
+export LIBCXX="$HOME/llvm-project/build-libcxx" # for subsequent build steps
+```
+
+Upon success, `./build-libcxx/{include,lib}` will contain the resulting
+headers and shared libraries.
+
+## Linking mold against instrumented libc++
+
+Use the `MOLD_USE_MSAN` and `MOLD_STDLIB_PREFIX` cmake variables to link
+mold against the instrumented build of libc++:
+
+```sh
+cd ~
+git clone https://github.com/rui314/mold.git
+cd mold
+cmake -B build -G Ninja            \
+    -DCMAKE_BUILD_TYPE=Debug       \
+    -DCMAKE_C_COMPILER=clang       \
+    -DCMAKE_CXX_COMPILER=clang++   \
+    -DMOLD_USE_MSAN=ON             \
+    -DMOLD_STDLIB_PREFIX="$LIBCXX" \
+    -DMOLD_USE_MIMALLOC=OFF        \
+    -DMOLD_USE_SYSTEM_TBB=ON
+cmake --build build
+```
+
+Most of mold's tests (except those for `-flto`) should work at this
+point. Run them like normal:
+
+```sh
+ctest --test-dir build
+```
+
+Any resulting MemorySanitizer errors should be visible in
+`./build/Temporary/Testing/LastTest.log`.
+
+## Building instrumented LTO plugin (experimental)
+
+Exercising `-flto` with MemorySanitizer (and without false positives)
+requires instrumenting the transitive dependencies of `lto-unix.cc`:
+
+- `libiberty.a`
+- `liblto_plugin.so`
+- `LLVMgold.so`
+
+> [!NOTE]
+> This is more involved and time-consuming than building only libc++ from
+> source. The cost-benefit ratio of this additional instrumentation and
+> test coverage may be unfavorable in many cases.
+
+> [!IMPORTANT]
+> The following steps are experimental and unlikely to work exactly as-is
+> under CI runners and individual developer environments. Consider the
+> following a starting point rather than a complete HOWTO.
+
+Build an MSan-instrumented GNU libiberty:
+
+```sh
+cd ~
+git clone [email protected]:gcc-mirror/gcc.git
+cd gcc/libiberty
+export CC=clang
+export CFLAGS="-g -Og -fsanitize=memory -fsanitize-memory-track-origins"
+export LDFLAGS="-fsanitize=memory"
+./configure
+make -j$(nproc)
+unset CC CFLAGS LDFLAGS
+```
+
+Install the resulting `./libiberty.a` into the build toolchain being
+tested with mold. If the system image is ephemeral or disposable (e.g. a
+short-lived VM or container), a quick-and-dirty install could look like:
+
+```sh
+sudo cp /usr/lib/libiberty.a{,.bak}
+sudo cp ./libiberty.a /usr/lib/
+```
+
+Build an MSan-instrumented GCC LTO plugin library:
+
+```sh
+cd ~/gcc/lto-plugin # use already-cloned repo from earlier step
+export CC=clang
+export CFLAGS="-g -Og -fsanitize=memory -fsanitize-memory-track-origins"
+export LDFLAGS="-fsanitize=memory"
+./configure --with-libiberty=/usr/lib
+make -j$(nproc)
+unset CC CFLAGS LDFLAGS
+```
+
+Install the resulting `liblto_plugin.so`. With the same caveats discussed
+above, a simple install into an ephemeral environment could look like:
+
+```sh
+export GCC_VERSION="$(gcc -dumpversion)"
+sudo cp /usr/lib/gcc/x86_64-pc-linux-gnu/$GCC_VERSION/liblto_plugin.so{,.bak}
+sudo cp .libs/liblto_plugin.so /usr/lib/gcc/x86_64-pc-linux-gnu/$GCC_VERSION/
+```
+
+Build an MSan-instrumented LLVM LTO plugin library:
+
+```sh
+cd ~/llvm-project # use already-cloned repo from earlier step
+
+CF="-nostdinc++ -isystem $LIBCXX/include/c++/v1"
+INCDIR="$(find /usr -name plugin-api.h -type f | head -1 | xargs dirname)"
+
+function configure
+{
+    cmake -S ./llvm -B build-plugin -G Ninja   \
+        -DLLVM_ENABLE_PROJECTS=clang           \
+        -DLLVM_TARGETS_TO_BUILD=X86            \
+        -DCMAKE_BUILD_TYPE=Release             \
+        -DCMAKE_C_COMPILER=clang               \
+        -DCMAKE_CXX_COMPILER=clang++           \
+        -DCMAKE_C_FLAGS="$CF"                  \
+        -DCMAKE_CXX_FLAGS="$CF"                \
+        -DCMAKE_EXE_LINKER_FLAGS="$1"          \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON   \
+        -DLLVM_BINUTILS_INCDIR="$INCDIR"       \
+        -DLLVM_USE_SANITIZER=MemoryWithOrigins
+}
+
+# workaround for linker issues: configure twice with different LDFLAGS
+configure "-nostdlib++ -L $LIBCXX/lib -Wl,--rpath=$LIBCXX/lib"
+configure "-nostdlib++ -L $LIBCXX/lib -lc++ -Wl,--rpath=$LIBCXX/lib"
+
+cmake --build build-plugin -- LLVMgold.so
+```
+
+Install the resulting `LLVMgold.so`. With the same caveats discussed
+above, a simple install into an ephemeral environment could look like:
+
+```sh
+sudo cp /usr/lib/LLVMgold.so{,.bak}
+sudo cp ./build-plugin/lib/LLVMgold.so /usr/lib/
+```
+
+mold's tests for `-flto` should now (mostly) work, though there do seem
+to be issues around `gcc` inferring `-flto` when not explicitly specified.
+One workaround is to use `clang` as `TEST_CC`:
+
+```sh
+cd ~/mold # use already-cloned and built repo from earlier step
+TEST_CC=clang TEST_CXX=clang++ ctest --test-dir build
+```
+
+## References
+
+- <https://github.com/google/sanitizers/wiki/MemorySanitizerBootstrappingClang>
+- <https://llvm.org/docs/GoldPlugin.html#lto-how-to-build>
@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.9.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.9.1
-.TH "MOLD" "1" "June 2025" ""
+.TH "MOLD" "1" "May 2026" ""
 .SH "NAME"
 \fBmold\fR \- a modern linker
 .SH "SYNOPSIS"
@@ -132,6 +132,17 @@ Use multiple threads\. By default, \fBmold\fR uses as many threads as the number
 \fB\-\-quick\-exit\fR, \fB\-\-no\-quick\-exit\fR
 Use or do not use \fBquick_exit\fR to exit\.
 .TP
+\fB\-\-zero\-to\-bss\fR
+Convert all\-zero data sections into BSS\.
+.IP
+When this option is enabled, \fBmold\fR scans input data sections that are not of type \fBSHT_NOBITS\fR and checks whether their contents consist solely of zero bytes\. Such sections are then converted into BSS (\fBSHT_NOBITS\fR) sections\. This reduces the size of the output file, since BSS sections occupy no space in the file image\.
+.IP
+This behavior is especially useful for user\-defined sections created with \fB__attribute__((section("\.sectname")))\fR that contain uninitialized global variables\. GCC and Clang do not automatically mark such sections as BSS even if their contents are entirely zero, and instead emit them as regular data sections\.
+.IP
+For example, consider \fB__attribute__((section("\.sectname"))) int vec[256];\fR\.
+.IP
+By default, this results in a \fB\.sectname\fR section of type \fBSHT_PROGBITS\fR filled with zeros\. With \fB\-\-zero\-to\-bss\fR, the linker will recognize it as empty data and convert it to a \fBSHT_NOBITS\fR section, reducing the output file size without changing runtime semantics\.
+.TP
 \fB\-z rewrite\-endbr\fR, \fB\-z norewrite\-endbr\fR
 As a security measure, some CPU instruction sets have recently gained a feature to protect control flow integrity by disallowing indirect branches by default\. If the feature is enabled, the instruction that is executed immediately after an indirect branch must be an branch target marker instruction, or a CPU\-level fault will raise\. The marker instruction is also known as "landing pad" instruction, to which indirect branches can land\. This feature makes ROP attacks harder to conduct\.
 .IP
@@ -271,8 +282,8 @@ Synonym for \fB\-\-build\-id=sha256\fR\.
 \fB\-\-no\-build\-id\fR
 Synonym for \fB\-\-build\-id=none\fR\.
 .TP
-\fB\-\-compress\-debug\-sections\fR=[ \fBzlib\fR | \fBzlib\-gabi\fR | \fBzstd\fR | \fBnone\fR ]
-Compress DWARF debug info (\fB\.debug_*\fR sections) using the zlib or zstd compression algorithm\. \fBzlib\-gabi\fR is an alias for \fBzlib\fR\.
+\fB\-\-compress\-debug\-sections\fR=[ \fBzlib\fR | \fBzlib\-gabi\fR | \fBzlib:\fR\fIN\fR | \fBzstd\fR | \fBzstd:\fR\fIN\fR | \fBnone\fR ]
+Compress DWARF debug info (\fB\.debug_*\fR sections) using the zlib or zstd compression algorithm\. \fBzlib\-gabi\fR is an alias for \fBzlib\fR\. \fBzlib:\fR\fIN\fR selects the zlib compression level, where \fIN\fR is between 0 and 9 (0 means no compression), and \fBzstd:\fR\fIN\fR selects the zstd compression level, where \fIN\fR is between 1 and 22\. Higher levels achieve better compression ratios but are slower\. \fBzlib\fR is equivalent to \fBzlib:1\fR and \fBzstd\fR is equivalent to \fBzstd:3\fR\.
 .TP
 \fB\-\-defsym\fR=\fIsymbol\fR=\fIvalue\fR
 Define \fIsymbol\fR as an alias for \fIvalue\fR\.
@@ -360,10 +371,16 @@ Embed a specified string into the \fB\.note\.package\fR section\. This option is
 .IP
 An argument to this option is treated as percent\-encoded and decoded before being inserted into the section, allowing you to avoid the use of the comma (\fB,\fR) character in the argument\. This is useful because the compiler replaces all occurrences of commas in \fB\-Wl,\fR with spaces before forwarding them to the linker\. Note that \fBmold\fR always interprets the argument as percent\-encoded, so you also need to escape all occurrences of \fB%\fR as \fB%25\fR\.
 .TP
-\fB\-\-pack\-dyn\-relocs\fR=[ \fBrelr\fR | \fBnone\fR ]
+\fB\-\-pack\-dyn\-relocs\fR=[ \fBrelr\fR | \fBandroid\fR | \fBandroid+relr\fR | \fBnone\fR ]
+Compress dynamic relocations in the output file\.
+.IP
 If \fBrelr\fR is specified, all \fBR_*_RELATIVE\fR relocations are put into \fB\.relr\.dyn\fR section instead of \fB\.rel\.dyn\fR or \fB\.rela\.dyn\fR section\. Since \fB\.relr\.dyn\fR section uses a space\-efficient encoding scheme, specifying this flag can reduce the size of the output\. This is typically most effective for position\-independent executable\.
 .IP
-Note that a runtime loader has to support \fB\.relr\.dyn\fR to run executables or shared libraries linked with \fB\-\-pack\-dyn\-relocs=relr\fR\. As of 2022, only ChromeOS, Android and Fuchsia support it\.
+If \fBandroid\fR is specified, all dynamic relocations are encoded in Android's packed relocation format (APS2) and stored in the \fB\.rel\.dyn\fR or \fB\.rela\.dyn\fR section, whose section type is changed to \fBSHT_ANDROID_REL\fR or \fBSHT_ANDROID_RELA\fR\. The dynamic table is updated to use \fBDT_ANDROID_REL\fR / \fBDT_ANDROID_RELA\fR and their \fBSZ\fR variants in place of the standard tags\.
+.IP
+\fBandroid+relr\fR combines both: \fBR_*_RELATIVE\fR relocations go to \fB\.relr\.dyn\fR and the rest are APS2\-encoded\. This is the configuration used by most Android system binaries\.
+.IP
+Note that a runtime loader has to support \fB\.relr\.dyn\fR to run executables or shared libraries linked with \fB\-\-pack\-dyn\-relocs=relr\fR\. As of 2026, glibc (since 2\.36), musl (since 1\.2\.4), Android, ChromeOS, and Fuchsia all support it\. The APS2 format, on the other hand, is only handled by Android's bionic loader; the encoder itself is target\-agnostic, but the produced binary can only be loaded on platforms where bionic (or a compatible loader) handles \fBDT_ANDROID_REL(A)\fR\.
 .TP
 \fB\-\-pie\fR, \fB\-\-pic\-executable\fR, \fB\-\-no\-pie\fR, \fB\-\-no\-pic\-executable\fR
 Create a position\-independent executable\.
@@ -429,6 +446,9 @@ How to handle undefined symbols\.
 \fB\-\-version\-script\fR=\fIfile\fR
 Read version script from \fIfile\fR\. If \fIfile\fR does not exist in the current directory, it is searched from library search paths for the sake of compatibility with GNU ld\.
 .TP
+\fB\-w\fR, \fB\-\-no\-warnings\fR
+Suppress warnings and cancel \fB\-\-fatal\-warnings\fR\.
+.TP
 \fB\-\-warn\-common\fR, \fB\-\-no\-warn\-common\fR
 Warn about common symbols\.
 .TP
@@ -485,9 +505,9 @@ By default, \fBmold\fR generates a relro segment\. \fB\-z norelro\fR disables th
 \fB\-z separate\-loadable\-segments\fR, \fB\-z separate\-code\fR, \fB\-z noseparate\-code\fR
 If one memory page contains multiple segments, the page protection bits are set in such a way that the needed attributes (writable or executable) are satisfied for all segments\. This usually happens at a boundary of two segments with two different attributes\.
 .IP
-\fBseparate\-loadable\-segments\fR adds paddings between segments with different attributes so that they do not share the same page\. This is the default\.
+\fBseparate\-loadable\-segments\fR adds paddings between segments with different attributes so that they do not share the same page\.
 .IP
-\fBseparate\-code\fR adds paddings only between executable and non\-executable segments\.
+\fBseparate\-code\fR adds paddings only between executable and non\-executable segments\. This is the default\.
 .IP
 \fBnoseparate\-code\fR does not add any paddings between segments\.
 .TP
@@ -271,6 +271,28 @@ but as `-o magic`.
 * `--quick-exit`, `--no-quick-exit`:
  Use or do not use `quick_exit` to exit.

+* `--zero-to-bss`:
+  Convert all-zero data sections into BSS.
+
+  When this option is enabled, `mold` scans input data sections that are not
+  of type `SHT_NOBITS` and checks whether their contents consist solely of
+  zero bytes. Such sections are then converted into BSS (`SHT_NOBITS`)
+  sections. This reduces the size of the output file, since BSS sections
+  occupy no space in the file image.
+
+  This behavior is especially useful for user-defined sections created with
+  `__attribute__((section(".sectname")))` that contain uninitialized global
+  variables. GCC and Clang do not automatically mark such sections as BSS
+  even if their contents are entirely zero, and instead emit them as regular
+  data sections.
+
+  For example, consider `__attribute__((section(".sectname"))) int vec[256];`.
+
+  By default, this results in a `.sectname` section of type `SHT_PROGBITS`
+  filled with zeros. With `--zero-to-bss`, the linker will recognize it as
+  empty data and convert it to a `SHT_NOBITS` section, reducing the output
+  file size without changing runtime semantics.
+
 * `-z rewrite-endbr`, `-z norewrite-endbr`:
  As a security measure, some CPU instruction sets have recently gained a
  feature to protect control flow integrity by disallowing indirect branches
@@ -484,9 +506,14 @@ but as `-o magic`.
 * `--no-build-id`:
  Synonym for `--build-id=none`.

-* `--compress-debug-sections`=[ `zlib` | `zlib-gabi` | `zstd` | `none` ]:
+* `--compress-debug-sections`=[ `zlib` | `zlib-gabi` | `zlib:`_N_ | `zstd` | `zstd:`_N_ | `none` ]:
  Compress DWARF debug info (`.debug_*` sections) using the zlib or zstd
-  compression algorithm. `zlib-gabi` is an alias for `zlib`.
+  compression algorithm. `zlib-gabi` is an alias for `zlib`. `zlib:`_N_
+  selects the zlib compression level, where _N_ is between 0 and 9 (0
+  means no compression), and `zstd:`_N_ selects the zstd compression
+  level, where _N_ is between 1 and 22. Higher levels achieve better
+  compression ratios but are slower. `zlib` is equivalent to `zlib:1`
+  and `zstd` is equivalent to `zstd:3`.

 * `--defsym`=_symbol_=_value_:
  Define _symbol_ as an alias for _value_.
@@ -636,16 +663,32 @@ but as `-o magic`.
  argument as percent-encoded, so you also need to escape all occurrences
  of `%` as `%25`.

-* `--pack-dyn-relocs`=[ `relr` | `none` ]:
+* `--pack-dyn-relocs`=[ `relr` | `android` | `android+relr` | `none` ]:
+  Compress dynamic relocations in the output file.
+
  If `relr` is specified, all `R_*_RELATIVE` relocations are put into
  `.relr.dyn` section instead of `.rel.dyn` or `.rela.dyn` section. Since
  `.relr.dyn` section uses a space-efficient encoding scheme, specifying this
  flag can reduce the size of the output. This is typically most effective for
  position-independent executable.

+  If `android` is specified, all dynamic relocations are encoded in Android's
+  packed relocation format (APS2) and stored in the `.rel.dyn` or `.rela.dyn`
+  section, whose section type is changed to `SHT_ANDROID_REL` or
+  `SHT_ANDROID_RELA`. The dynamic table is updated to use `DT_ANDROID_REL`
+  / `DT_ANDROID_RELA` and their `SZ` variants in place of the standard tags.
+
+  `android+relr` combines both: `R_*_RELATIVE` relocations go to `.relr.dyn`
+  and the rest are APS2-encoded. This is the configuration used by most
+  Android system binaries.
+
  Note that a runtime loader has to support `.relr.dyn` to run executables or
-  shared libraries linked with `--pack-dyn-relocs=relr`. As of 2022, only
-  ChromeOS, Android and Fuchsia support it.
+  shared libraries linked with `--pack-dyn-relocs=relr`. As of 2026, glibc
+  (since 2.36), musl (since 1.2.4), Android, ChromeOS, and Fuchsia all
+  support it. The APS2 format, on the other hand, is only handled by
+  Android's bionic loader; the encoder itself is target-agnostic, but the
+  produced binary can only be loaded on platforms where bionic (or a
+  compatible loader) handles `DT_ANDROID_REL(A)`.

 * `--pie`, `--pic-executable`, `--no-pie`, `--no-pic-executable`:
  Create a position-independent executable.
@@ -735,6 +778,9 @@ but as `-o magic`.
  directory, it is searched from library search paths for the sake of
  compatibility with GNU ld.

+* `-w`, `--no-warnings`:
+  Suppress warnings and cancel `--fatal-warnings`.
+
 * `--warn-common`, `--no-warn-common`:
  Warn about common symbols.

@@ -832,10 +878,10 @@ but as `-o magic`.
  segments with two different attributes.

  `separate-loadable-segments` adds paddings between segments with different
-  attributes so that they do not share the same page. This is the default.
+  attributes so that they do not share the same page.

  `separate-code` adds paddings only between executable and non-executable
-  segments.
+  segments. This is the default.

  `noseparate-code` does not add any paddings between segments.

@@ -8,18 +8,18 @@ set -e
 set -x

 case "$ID" in
-ubuntu | pop | linuxmint | debian | raspbian | neon)
+ubuntu | pop | linuxmint | debian | raspbian | neon | zorin)
  apt-get update
  apt-get install -y cmake gcc g++ clang gdb
  ;;
-fedora | amzn | rhel | centos)
-  dnf install -y gcc-g++ cmake glibc-static libstdc++-static diffutils util-linux tar
+fedora | fedora-* | amzn | rhel | centos)
+  dnf install -y gcc-c++ cmake glibc-static libstdc++-static diffutils util-linux tar
  ;;
-rocky)
-  dnf install -y gcc-g++ cmake diffutils util-linux
+rocky | ol)
+  dnf install -y gcc-c++ cmake diffutils util-linux
  ;;
 opensuse-*)
-  zypper install -y make cmake gcc-c++ glibc-devel-static tar diffutils util-linux
+  zypper install -y make cmake gcc-c++ glibc-devel-static tar diffutils util-linux gawk
  ;;
 gentoo)
  emerge-webrsync
@@ -42,6 +42,10 @@ clear-linux-os)
 almalinux)
  dnf install -y gcc-toolset-13-gcc-c++ gcc-toolset-13-libstdc++-devel cmake diffutils
  ;;
+altlinux)
+  apt-get update
+  apt-get install -y gcc-c++ make cmake ctest diffutils util-linux
+  ;;
 freebsd)
  pkg update
  pkg install -y cmake bash binutils gcc
@@ -0,0 +1,174 @@
+// This file implements a multi-threaded zlib and zstd compression
+// routine.
+//
+// zlib-compressed data can be merged just by concatenation as long as
+// each piece of data is flushed with Z_SYNC_FLUSH. In this file, we
+// split input data into multiple shards, compress them individually
+// and concatenate them. We then append a header, a trailer and a
+// checksum so that the concatenated data is valid zlib-format data.
+//
+// zstd-compressed data can be merged in the same way.
+//
+// Using threads to compress data has a downside. Since the dictionary
+// is reset on boundaries of shards, compression ratio is sacrificed
+// a little bit. However, if a shard size is large enough, that loss
+// is negligible in practice.
+
+#include "lib.h"
+
+#include <tbb/parallel_for_each.h>
+#include <zlib.h>
+#include <zstd.h>
+
+#define CHECK(fn)                               \
+  do {                                          \
+    [[maybe_unused]] int r = (fn);              \
+    assert(r == Z_OK);                          \
+  } while (0)
+
+namespace mold {
+
+static constexpr i64 SHARD_SIZE = 1024 * 1024;
+
+Compressor::~Compressor() {
+  for (std::span<u8> shard : shards)
+    delete[] shard.data();
+}
+
+static std::vector<std::span<u8>> split(std::span<u8> input) {
+  std::vector<std::span<u8>> vec;
+  while (!input.empty()) {
+    i64 sz = std::min<i64>(SHARD_SIZE, input.size());
+    vec.push_back(input.subspan(0, sz));
+    input = input.subspan(sz);
+  }
+  return vec;
+}
+
+static std::span<u8> zlib_compress(std::span<u8> input, int level) {
+  // Initialize zlib stream. Since debug info is generally compressed
+  // pretty well with lower compression levels, the default level is 1.
+  z_stream strm = {};
+  CHECK(deflateInit2(&strm, level, Z_DEFLATED, -15, 8, Z_DEFAULT_STRATEGY));
+
+  // Set an input buffer
+  strm.avail_in = input.size();
+  strm.next_in = input.data();
+
+  // Set an output buffer. deflateBound() returns an upper bound
+  // on the compression size. +16 for Z_SYNC_FLUSH.
+  i64 bufsize = deflateBound(&strm, strm.avail_in) + 16;
+  u8 *buf = new u8[bufsize];
+
+  // Compress data. It writes all compressed bytes except the last
+  // partial byte, so up to 7 bits can be held to be written to the
+  // buffer.
+  strm.avail_out = bufsize;
+  strm.next_out = buf;
+  CHECK(deflate(&strm, Z_BLOCK));
+
+  // This is a workaround for libbacktrace before 2022-04-06.
+  //
+  // Zlib is a bit stream, and what Z_SYNC_FLUSH does is to write a
+  // three bit value indicating the start of an uncompressed data
+  // block followed by four byte data 00 00 ff ff which indicates that
+  // the length of the block is zero. libbacktrace uses its own zlib
+  // inflate routine, and it had a bug that if that particular three
+  // bit value happens to end at a byte boundary, it accidentally
+  // skipped the next byte.
+  //
+  // In order to avoid triggering that bug, we should avoid calling
+  // deflate() with Z_SYNC_FLUSH if the current bit position is 5.
+  // If it's 5, we insert an empty block consisting of 10 bits so
+  // that the bit position is 7 in the next byte.
+  //
+  // https://github.com/ianlancetaylor/libbacktrace/pull/87
+  int nbits = 0;
+  deflatePending(&strm, Z_NULL, &nbits);
+  if (nbits == 5)
+    CHECK(deflatePrime(&strm, 10, 2));
+  CHECK(deflate(&strm, Z_SYNC_FLUSH));
+
+  deflateEnd(&strm);
+  return {buf, (size_t)(bufsize - strm.avail_out)};
+}
+
+ZlibCompressor::ZlibCompressor(u8 *buf, i64 size, i64 level) {
+  std::vector<std::span<u8>> inputs = split(std::span(buf, size));
+  std::vector<u32> adlers(inputs.size());
+  shards.resize(inputs.size());
+
+  // Compress each shard
+  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
+    std::span<u8> in = inputs[i];
+    adlers[i] = adler32(1, in.data(), in.size());
+    shards[i] = zlib_compress(in, level);
+  });
+
+  // Combine checksums
+  checksum = adlers[0];
+  for (i64 i = 1; i < inputs.size(); i++)
+    checksum = adler32_combine(checksum, adlers[i], inputs[i].size());
+
+  // Comput the total size
+  compressed_size = 8; // the header and the trailer
+  for (std::span<u8> &shard : shards)
+    compressed_size += shard.size();
+}
+
+void ZlibCompressor::write_to(u8 *buf) {
+  // Write a zlib-format header
+  buf[0] = 0x78;
+  buf[1] = 0x9c;
+
+  // Copy compressed data
+  std::vector<i64> offsets(shards.size());
+  offsets[0] = 2; // +2 for the header
+  for (i64 i = 1; i < shards.size(); i++)
+    offsets[i] = offsets[i - 1] + shards[i - 1].size();
+
+  tbb::parallel_for((i64)0, (i64)shards.size(), [&](i64 i) {
+    memcpy(buf + offsets[i], shards[i].data(), shards[i].size());
+  });
+
+  // Write a trailer
+  u8 *end = buf + compressed_size;
+  end[-6] = 3;
+  end[-5] = 0;
+  *(ub32 *)(end - 4) = checksum;
+}
+
+static std::span<u8> zstd_compress(std::span<u8> input, int level) {
+  i64 bufsize = ZSTD_COMPRESSBOUND(input.size());
+  u8 *buf = new u8[bufsize];
+  size_t sz = ZSTD_compress(buf, bufsize, input.data(), input.size(), level);
+  assert(!ZSTD_isError(sz));
+  return {buf, sz};
+}
+
+ZstdCompressor::ZstdCompressor(u8 *buf, i64 size, i64 level) {
+  std::vector<std::span<u8>> inputs = split(std::span(buf, size));
+  shards.resize(inputs.size());
+
+  // Compress each shard
+  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
+    shards[i] = zstd_compress(inputs[i], level);
+  });
+
+  compressed_size = 0;
+  for (std::span<u8> &shard : shards)
+    compressed_size += shard.size();
+}
+
+void ZstdCompressor::write_to(u8 *buf) {
+  // Copy compressed data
+  std::vector<i64> offsets(shards.size());
+  for (i64 i = 1; i < shards.size(); i++)
+    offsets[i] = offsets[i - 1] + shards[i - 1].size();
+
+  tbb::parallel_for((i64)0, (i64)shards.size(), [&](i64 i) {
+    memcpy(buf + offsets[i], shards[i].data(), shards[i].size());
+  });
+}
+
+} // namespace mold
@@ -1,7 +1,29 @@
 #define MOLD_VERSION "@mold_VERSION@"
 #define MOLD_LIBDIR "@CMAKE_INSTALL_FULL_LIBDIR@"
+#define MOLD_FIRST_TARGET @MOLD_FIRST_TARGET@

-#cmakedefine HAVE_MADVISE 1
-#cmakedefine HAVE_UNAME 1
-#cmakedefine MOLD_USE_MIMALLOC 1
-#cmakedefine MOLD_USE_SYSTEM_MIMALLOC 1
+#cmakedefine01 HAVE_MADVISE
+#cmakedefine01 HAVE_UNAME
+#cmakedefine01 MOLD_USE_MIMALLOC
+#cmakedefine01 MOLD_USE_SYSTEM_MIMALLOC
+
+#cmakedefine01 HAVE_TARGET_X86_64
+#cmakedefine01 HAVE_TARGET_I386
+#cmakedefine01 HAVE_TARGET_ARM64LE
+#cmakedefine01 HAVE_TARGET_ARM64BE
+#cmakedefine01 HAVE_TARGET_ARM32LE
+#cmakedefine01 HAVE_TARGET_ARM32BE
+#cmakedefine01 HAVE_TARGET_RV32LE
+#cmakedefine01 HAVE_TARGET_RV32BE
+#cmakedefine01 HAVE_TARGET_RV64LE
+#cmakedefine01 HAVE_TARGET_RV64BE
+#cmakedefine01 HAVE_TARGET_PPC32
+#cmakedefine01 HAVE_TARGET_PPC64V1
+#cmakedefine01 HAVE_TARGET_PPC64V2
+#cmakedefine01 HAVE_TARGET_S390X
+#cmakedefine01 HAVE_TARGET_SPARC64
+#cmakedefine01 HAVE_TARGET_M68K
+#cmakedefine01 HAVE_TARGET_SH4LE
+#cmakedefine01 HAVE_TARGET_SH4BE
+#cmakedefine01 HAVE_TARGET_LOONGARCH64
+#cmakedefine01 HAVE_TARGET_LOONGARCH32
@@ -95,11 +95,15 @@ static std::vector<MultiGlob::State> parse_glob(std::string_view pat) {
      // [abc]: a, b or c
      // [$\]!]: $, ] or !
      // [a-czg-i]: a, b, c, z, g, h, or i
-      // [^a-z]: Any character except lowercase letters
+      // [!a-z]: Any character except lowercase letters
+      //
+      // Both `!` and `^` are accepted as negation markers. `!` is the
+      // POSIX/shell convention used by other linkers. `^` was mold's
+      // original syntax and is kept for backward compatibility.
      bool negate = false;
      bool closed = false;

-      if (!pat.empty() && pat[0] == '^') {
+      if (!pat.empty() && (pat[0] == '!' || pat[0] == '^')) {
        negate = true;
        pat = pat.substr(1);
      }
@@ -5,24 +5,30 @@
 //
 // 1. mold is always a cross linker and should not depend on what host it
 //    is running on. For example, users should be able to run mold on a
-//    big-endian SPARC machine to create a little-endian RV64 binary.
+//    little-endian x86 machine to create a big-endian s390x binary.
 //
 // 2. Even though data members in all ELF data strucutres are naturally
 //    aligned, they are not guaranteed to be aligned on memory because of
-//    archive files. Archive files (.a files) align each member only to a
+//    archive files. Archive files (.a files) align each file only to a
 //    2 byte boundary, so anything larger than 2 bytes may be misaligned
 //    in an mmap'ed memory. Misaligned access is an undefined behavior in
 //    C/C++, so we shouldn't cast an arbitrary pointer to a uint32_t, for
 //    example, to read a 32 bit value.
 //
-// The data types defined in this file don't depend on host byte order and
-// don't do unaligned access. Note that modern compilers are smart enough
-// to recognize shift and bitwise OR patterns and compile them into a
-// single load instruction.
+// The data types defined in this file are independent of the host byte
+// order and are designed to avoid unaligned access.
+//
+// Note that in C/C++, memcpy is a portable and efficient way to access
+// unaligned data, as it is typically treated as an intrinsic. Compilers
+// can easily optimize memcpy calls in this file into a single load or
+// store instruction.

 #pragma once

+#include <bit>
 #include <cstdint>
+#include <cstring>
+#include <type_traits>

 #if !defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__)
 # if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
@@ -36,93 +42,70 @@

 namespace mold {

-typedef uint8_t u8;
-typedef uint16_t u16;
-typedef uint32_t u32;
-typedef uint64_t u64;
-
-typedef int8_t i8;
-typedef int16_t i16;
-typedef int32_t i32;
-typedef int64_t i64;
-
 template <typename T, bool is_le, int size = sizeof(T)>
 class Integer {
 public:
  constexpr Integer() = default;

-  constexpr Integer(T x) requires (is_le && size == 2)
-    : buf{(u8)x, (u8)(x >> 8)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 3)
-    : buf{(u8)x, (u8)(x >> 8), (u8)(x >> 16)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 4)
-    : buf{(u8)x, (u8)(x >> 8), (u8)(x >> 16), (u8)(x >> 24)} {}
-
-  constexpr Integer(T x) requires (is_le && size == 8)
-    : buf{(u8)x,         (u8)(x >> 8),  (u8)(x >> 16), (u8)(x >> 24),
-          (u8)(x >> 32), (u8)(x >> 40), (u8)(x >> 48), (u8)(x >> 56)} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 2)
-    : buf{(u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 3)
-    : buf{(u8)(x >> 16), (u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 4)
-    : buf{(u8)(x >> 24), (u8)(x >> 16), (u8)(x >> 8), (u8)x} {}
-
-  constexpr Integer(T x) requires (!is_le && size == 8)
-    : buf{(u8)(x >> 56), (u8)(x >> 48), (u8)(x >> 40), (u8)(x >> 32),
-          (u8)(x >> 24), (u8)(x >> 16), (u8)(x >> 8),  (u8)x} {}
-
-  operator T() const {
-    if constexpr (is_le) {
-      if constexpr (size == 2)
-        return buf[1] << 8 | buf[0];
-      else if constexpr (size == 3)
-        return buf[2] << 16 | buf[1] << 8 | buf[0];
-      else if constexpr (size == 4)
-        return buf[3] << 24 | buf[2] << 16 | buf[1] << 8 | buf[0];
-      else
-        return (u64)buf[7] << 56 | (u64)buf[6] << 48 |
-               (u64)buf[5] << 40 | (u64)buf[4] << 32 |
-               (u64)buf[3] << 24 | (u64)buf[2] << 16 |
-               (u64)buf[1] << 8  | (u64)buf[0];
+  constexpr Integer(T v) {
+    if (std::is_constant_evaluated() || size == 3) {
+      for (int i = 0; i < size; i++)
+        buf[is_le ? i : (size - i - 1)] = v >> (i * 8);
    } else {
-      if constexpr (size == 2)
-        return buf[0] << 8 | buf[1];
-      else if constexpr (size == 3)
-        return buf[0] << 16 | buf[1] << 8 | buf[2];
-      else if constexpr (size == 4)
-        return buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
-      else
-        return (u64)buf[0] << 56 | (u64)buf[1] << 48 |
-               (u64)buf[2] << 40 | (u64)buf[3] << 32 |
-               (u64)buf[4] << 24 | (u64)buf[5] << 16 |
-               (u64)buf[6] << 8  | (u64)buf[7];
+      if (!is_native)
+        v = bswap(v);
+      memcpy(buf, &v, size);
    }
  }

-  Integer &operator=(T x) {
-    new (this) Integer(x);
-    return *this;
+  operator T() const {
+    if (size == 3) {
+      if (is_le)
+        return buf[2] << 16 | buf[1] << 8 | buf[0];
+      return buf[0] << 16 | buf[1] << 8 | buf[2];
+    }
+
+    T v;
+    memcpy(&v, buf, size);
+    return is_native ? v : bswap(v);
  }

+  Integer &operator=(T v)  { new (this) Integer(v); return *this; }
  Integer &operator++()    { return *this = *this + 1; }
-  Integer operator++(int)  { return ++*this - 1; }
+  Integer operator++(int)  { auto x = *this; ++*this; return x; }
  Integer &operator--()    { return *this = *this - 1; }
-  Integer operator--(int)  { return --*this + 1; }
-  Integer &operator+=(T x) { return *this = *this + x; }
-  Integer &operator-=(T x) { return *this = *this - x; }
-  Integer &operator&=(T x) { return *this = *this & x; }
-  Integer &operator|=(T x) { return *this = *this | x; }
+  Integer operator--(int)  { auto x = *this; --*this; return x; }
+  Integer &operator+=(T v) { return *this = *this + v; }
+  Integer &operator-=(T v) { return *this = *this - v; }
+  Integer &operator&=(T v) { return *this = *this & v; }
+  Integer &operator|=(T v) { return *this = *this | v; }

 private:
-  u8 buf[size];
+  static constexpr bool is_native =
+    (std::endian::native == (is_le ? std::endian::little : std::endian::big));
+
+  static T bswap(T v) {
+    switch (size) {
+    case 2: return __builtin_bswap16(v);
+    case 4: return __builtin_bswap32(v);
+    case 8: return __builtin_bswap64(v);
+    default: __builtin_unreachable();
+    }
+  }
+
+  uint8_t buf[size];
 };

+using i8 = int8_t;
+using i16 = int16_t;
+using i32 = int32_t;
+using i64 = int64_t;
+
+using u8 = uint8_t;
+using u16 = uint16_t;
+using u32 = uint32_t;
+using u64 = uint64_t;
+
 using il16 = Integer<i16, true>;
 using il32 = Integer<i32, true>;
 using il64 = Integer<i64, true>;
@@ -395,11 +395,15 @@ public:
    this->nbuckets = std::max<i64>(MIN_NBUCKETS, bit_ceil(nbuckets));
    i64 bufsize = sizeof(Entry) * this->nbuckets;

-    // Allocate a zero-initialized buffer. We use mmap() if available
-    // because it's faster than malloc() and memset().
+    // Allocate a zero-initialized buffer. mmap() is faster than
+    // malloc()+memset(), and MAP_POPULATE pre-faults pages here to
+    // avoid CoW faults and TLB shootdowns under concurrent inserts.
 #ifdef _WIN32
    entries = (Entry *)_aligned_malloc(bufsize, alignof(Entry));
    memset((void *)entries, 0, bufsize);
+#elif MAP_POPULATE
+    entries = (Entry *)mmap(nullptr, bufsize, PROT_READ | PROT_WRITE,
+                            MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0);
 #else
    entries = (Entry *)mmap(nullptr, bufsize, PROT_READ | PROT_WRITE,
                            MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
@@ -649,6 +653,35 @@ std::optional<std::string_view> demangle_rust(std::string_view name);
 u32 compute_crc32(u32 crc, u8 *buf, i64 len);
 std::vector<u8> crc32_solve(u32 current, u32 desired);

+//
+// compress.cc
+//
+
+class Compressor {
+public:
+  virtual void write_to(u8 *buf) = 0;
+  virtual ~Compressor();
+  i64 compressed_size = 0;
+
+protected:
+  std::vector<std::span<u8>> shards;
+};
+
+class ZlibCompressor : public Compressor {
+public:
+  ZlibCompressor(u8 *buf, i64 size, i64 level);
+  void write_to(u8 *buf) override;
+
+private:
+  u32 checksum = 0;
+};
+
+class ZstdCompressor : public Compressor {
+public:
+  ZstdCompressor(u8 *buf, i64 size, i64 level);
+  void write_to(u8 *buf) override;
+};
+
 //
 // tar.cc
 //
@@ -5,7 +5,9 @@
 #include <ios>
 #include <tbb/concurrent_vector.h>

-#ifndef _WIN32
+#ifdef _WIN32
+#include <windows.h>
+#else
 #include <sys/resource.h>
 #include <sys/time.h>
 #endif
@@ -86,6 +86,9 @@ void TarWriter::append(std::string path, std::string_view data) {
  UstarHeader pax = {};

  std::string attr = encode_path(basedir, path);
+
+  if (attr.size() >= 0100'000'000'000)
+    unreachable();
  snprintf(pax.size, sizeof(pax.size), "%011zo", attr.size());
  pax.name[0] = '/';
  pax.typeflag[0] = 'x';
@@ -99,6 +102,8 @@ void TarWriter::append(std::string path, std::string_view data) {
  // Write Ustar header
  UstarHeader ustar = {};
  memcpy(ustar.mode, "0000664", 8);
+  if (data.size() >= 0100'000'000'000)
+    unreachable();
  snprintf(ustar.size, sizeof(ustar.size), "%011zo", data.size());
  finalize(ustar);
  fwrite(&ustar, sizeof(ustar), 1, out);
@@ -694,18 +694,15 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_hdr_size == sizeof(hdr));
  static_assert(E::thunk_size == sizeof(entry));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  memcpy(buf, hdr, sizeof(hdr));
-  buf += sizeof(hdr);
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
+  memcpy(base, hdr, sizeof(hdr));

-  u64 P = output_section.shdr.sh_addr + offset + sizeof(hdr);
-
-  for (Symbol<E> *sym : symbols) {
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];
    memcpy(buf, entry, sizeof(entry));
-    *(U32<E> *)(buf + 12) = sym->get_addr(ctx) - P - 16;
-
-    buf += sizeof(entry);
-    P += sizeof(entry);
+    *(U32<E> *)(buf + 12) = S - P - 16;
  }
 }

@@ -848,7 +845,6 @@ void Arm32ExidxSection<E>::copy_buf(Context<E> &ctx) {
  write_vector(ctx.buf + this->shdr.sh_offset, contents);
 }

-#if MOLD_ARM32BE
 // Even though using ARM32 in big-endian mode is very rare, the processor
 // technically supports both little- and big-endian modes. There are two
 // variants of big-endian mode: BE32 and BE8. In BE32, instructions and
@@ -871,6 +867,7 @@ void Arm32ExidxSection<E>::copy_buf(Context<E> &ctx) {
 //
 // This function is called after we copy the input section contents to the
 // output file. We rewrite instructions in the output buffer in place.
+#if MOLD_ARM32BE
 void arm32be_swap_bytes(Context<E> &ctx) {
  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
    // Collect mapping symbols
@@ -899,8 +896,8 @@ void arm32be_swap_bytes(Context<E> &ctx) {
      InputSection<E> &isec = *sym.get_input_section();
      u8 *base = ctx.buf + isec.output_section->shdr.sh_offset + isec.offset;
      u8 *start = base + sym.value;
-
      u8 *end;
+
      if (i + 1 < syms.size() && syms[i + 1]->get_input_section() == &isec)
        end = base + syms[i + 1]->value;
      else
@@ -208,6 +208,30 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_AARCH64_MOVW_UABS_G3:
      *(ul32 *)loc |= bits(S + A, 63, 48) << 5;
      break;
+    case R_AARCH64_MOVW_PREL_G0:
+      check(S + A - P, -(1 << 15), 1 << 15);
+      write_movn_movz(loc, S + A - P);
+      break;
+    case R_AARCH64_MOVW_PREL_G0_NC:
+      *(ul32 *)loc |= bits(S + A - P, 15, 0) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G1:
+      check(S + A - P, -(1LL << 31), 1LL << 31);
+      write_movn_movz(loc, (i64)(S + A - P) >> 16);
+      break;
+    case R_AARCH64_MOVW_PREL_G1_NC:
+      *(ul32 *)loc |= bits(S + A - P, 31, 16) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G2:
+      check(S + A - P, -(1LL << 47), 1LL << 47);
+      write_movn_movz(loc, (i64)(S + A - P) >> 32);
+      break;
+    case R_AARCH64_MOVW_PREL_G2_NC:
+      *(ul32 *)loc |= bits(S + A - P, 47, 32) << 5;
+      break;
+    case R_AARCH64_MOVW_PREL_G3:
+      *(ul32 *)loc |= bits(S + A - P, 63, 48) << 5;
+      break;
    case R_AARCH64_ADR_GOT_PAGE:
      if (sym.has_got(ctx)) {
        i64 val = page(G + GOT + A) - page(P);
@@ -283,6 +307,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check(S + A - P, -(1LL << 31), 1LL << 31);
      *(U32<E> *)loc = S + A - P;
      break;
+    case R_AARCH64_GOTPCREL32:
+      check(G + GOT + A - P, -(1LL << 31), 1LL << 31);
+      *(U32<E> *)loc = G + GOT + A - P;
+      break;
    case R_AARCH64_CONDBR19:
    case R_AARCH64_LD_PREL_LO19:
      check(S + A - P, -(1LL << 20), 1LL << 20);
@@ -525,6 +553,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      break;
    case R_AARCH64_LD64_GOT_LO12_NC:
    case R_AARCH64_LD64_GOTPAGE_LO15:
+    case R_AARCH64_GOTPCREL32:
      sym.flags |= NEEDS_GOT;
      break;
    case R_AARCH64_CALL26:
@@ -568,6 +597,13 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_AARCH64_MOVW_UABS_G1_NC:
    case R_AARCH64_MOVW_UABS_G2:
    case R_AARCH64_MOVW_UABS_G2_NC:
+    case R_AARCH64_MOVW_PREL_G0:
+    case R_AARCH64_MOVW_PREL_G0_NC:
+    case R_AARCH64_MOVW_PREL_G1:
+    case R_AARCH64_MOVW_PREL_G1_NC:
+    case R_AARCH64_MOVW_PREL_G2:
+    case R_AARCH64_MOVW_PREL_G2_NC:
+    case R_AARCH64_MOVW_PREL_G3:
    case R_AARCH64_PREL16:
    case R_AARCH64_PREL32:
    case R_AARCH64_PREL64:
@@ -587,31 +623,81 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
  }
 }

+// The size of a thunk entry varies on ARM64 depending on the distance to
+// the branch target. This function computes the size of each thunk entry.
+template <>
+void Thunk<E>::shrink_size(Context<E> &ctx) {
+  offsets.clear();
+  offsets.push_back(0);
+  i64 off = 0;
+
+  // The distance between S and P is only reduced by shrink_size(), but
+  // page(S) – page(P) may still increase by one page due to address
+  // changes, so we add a safety margin.
+  //
+  // For example, page(0x1200) – page(0x1000) is 0, whereas
+  // page(0x1100) – page(0xfff) is 0x1000, even though the latter
+  // distance is shorter than the former.
+  auto is_small = [](i64 prel) {
+    return is_int(prel + 0x1000, 33) && is_int(prel - 0x1000, 33);
+  };
+
+  for (Symbol<E> *sym : symbols) {
+    u64 S = sym->get_addr(ctx);
+    u64 P = get_addr() + off;
+    i64 prel = page(S) - page(P);
+    off += is_small(prel) ? 16 : 32;
+    offsets.push_back(off);
+  }
+}
+
 template <>
 void Thunk<E>::copy_buf(Context<E> &ctx) {
-  constexpr ul32 insn[] = {
-    0x9000'0010, // adrp x16, 0   # R_AARCH64_ADR_PREL_PG_HI21
-    0x9100'0210, // add  x16, x16 # R_AARCH64_ADD_ABS_LO12_NC
+  // Short thunk with a 33 bit displacement
+  constexpr ul32 insn1[] = {
+    0x9000'0010, // adrp x16, 0
+    0x9100'0210, // add  x16, x16
    0xd61f'0200, // br   x16
    0xd420'7d00, // brk
  };

-  static_assert(E::thunk_size == sizeof(insn));
+  // Long thunk with a 64 bit displacement
+  constexpr ul32 insn2[] = {
+    0x1000'0010, // adr  x16, 0
+    0xd2a0'0011, // movz x17, 0, lsl #16
+    0xf2c0'0011, // movk x17, 0, lsl #32
+    0xf2e0'0011, // movk x17, 0, lsl #48
+    0x8b11'0210, // add  x16, x16, x17
+    0xd61f'0200, // br   x16
+    0xd420'7d00, // brk
+    0xd420'7d00, // brk
+  };

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;

-  for (Symbol<E> *sym : symbols) {
-    u64 S = sym->get_addr(ctx);
-    memcpy(buf, insn, E::thunk_size);
-    write_adrp(buf, page(S) - page(P));
-    *(ul32 *)(buf + 4) |= bits(S, 11, 0) << 10;
+  for (i64 i = 0; i < symbols.size(); i++) {
+    u64 S = symbols[i]->get_addr(ctx);
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];

-    buf += E::thunk_size;
-    P += E::thunk_size;
+    if (offsets[i + 1] - offsets[i] == 16) {
+      i64 prel = page(S) - page(P);
+      assert(is_int(prel, 33));
+      memcpy(buf, insn1, sizeof(insn1));
+      write_adrp(buf, prel);
+      *(ul32 *)(buf + 4) |= bits(S, 11, 0) << 10;
+    } else {
+      memcpy(buf, insn2, sizeof(insn2));
+      write_adr(buf, bits(S - P, 15, 0));
+      *(ul32 *)(buf + 4) |= bits(S - P, 31, 16) << 5;
+      *(ul32 *)(buf + 8) |= bits(S - P, 47, 32) << 5;
+      *(ul32 *)(buf + 12) |= bits(S - P, 63, 48) << 5;
+    }
  }
 }

+template class Thunk<E>;
+
 } // namespace mold

 #endif
@@ -33,6 +33,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/i386.pdf

+#if MOLD_I386
+
 #include "mold.h"

 namespace mold {
@@ -44,10 +46,10 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
  switch (rel.r_type) {
  case R_386_8:
  case R_386_PC8:
-    return *loc;
+    return *(i8 *)loc;
  case R_386_16:
  case R_386_PC16:
-    return *(ul16 *)loc;
+    return *(il16 *)loc;
  case R_386_32:
  case R_386_PC32:
  case R_386_GOT32:
@@ -63,7 +65,7 @@ i64 get_addend(u8 *loc, const ElfRel<E> &rel) {
  case R_386_TLS_LDO_32:
  case R_386_SIZE32:
  case R_386_TLS_GOTDESC:
-    return *(ul32 *)loc;
+    return *(il32 *)loc;
  default:
    return 0;
  }
@@ -596,3 +598,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -518,6 +518,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ul64 *)loc -= S + A;
      break;
    case R_LARCH_32_PCREL:
+      check(S + A - P, -(1LL << 31), 1LL << 31);
      *(ul32 *)loc = S + A - P;
      break;
    case R_LARCH_64_PCREL:
@@ -980,7 +981,7 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
      //   pcaddi    $t0, <offset>
      if (is_relaxable_got_load(ctx, isec, i))
        if (i64 dist = compute_distance(ctx, sym, isec, r);
-            is_int(dist, 22))
+            is_int(dist, 22) && (dist & 3) == 0)
          remove(4);
      break;
    case R_LARCH_TLS_DESC_PC_HI20:
@@ -1009,6 +1010,87 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
  isec.sh_size -= r_delta;
 }

+// With --emit-relocs, rewrite the emitted relocations to match the
+// instructions that relaxation produced. The logic parallels apply_reloc_alloc.
+template <>
+void rewrite_reloc_types(Context<E> &ctx, InputSection<E> &isec, ElfRel<E> *buf) {
+  std::span<const ElfRel<E>> rels = isec.get_rels(ctx);
+  std::span<RelocDelta> deltas = isec.extra.r_deltas;
+  i64 k = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+
+    i64 removed_bytes = 0;
+    if (!deltas.empty()) {
+      while (k < deltas.size() && deltas[k].offset < rel.r_offset)
+        k++;
+      if (k < deltas.size() && deltas[k].offset == rel.r_offset)
+        removed_bytes = get_removed_bytes(deltas, k);
+    }
+
+    switch (rel.r_type) {
+    case R_LARCH_TLS_LE_HI20_R:
+    case R_LARCH_TLS_LE_ADD_R:
+      // lu12i.w + add.d + addi.d => addi.d
+      if (removed_bytes)
+        buf[i].r_type = R_LARCH_NONE;
+      break;
+    case R_LARCH_PCALA_HI20:
+    case R_LARCH_GOT_PC_HI20:
+      // pcalau12i + addi.d/ld.d => pcaddi. The high part vanishes and the low
+      // part becomes the pcaddi's PC-relative relocation.
+      if (removed_bytes) {
+        buf[i].r_type = R_LARCH_NONE;
+        buf[i + 2].r_type = R_LARCH_PCREL20_S2;
+        i += 3;
+      }
+      break;
+    case R_LARCH_CALL36:
+      // pcaddu18i + jirl => b or bl
+      if (removed_bytes)
+        buf[i].r_type = R_LARCH_B26;
+      break;
+    case R_LARCH_TLS_DESC_PC_HI20:
+      // pcalau12i + addi.d => pcaddi when TLSDESC is kept; both deleted when it
+      // is relaxed to IE/LE.
+      if (!sym.has_tlsdesc(ctx)) {
+        buf[i].r_type = R_LARCH_NONE;
+      } else if (removed_bytes) {
+        buf[i].r_type = R_LARCH_NONE;
+        buf[i + 2].r_type = R_LARCH_TLS_DESC_PCREL20_S2;
+      }
+      break;
+    case R_LARCH_TLS_DESC_PC_LO12:
+      if (!sym.has_tlsdesc(ctx))
+        buf[i].r_type = R_LARCH_NONE;
+      break;
+    case R_LARCH_TLS_DESC_LD:
+      // TLSDESC is relaxed to IE or LE. The ld.d slot holds the first
+      // instruction of the resulting sequence.
+      if (sym.has_tlsdesc(ctx))
+        break;
+      if (sym.has_gottp(ctx))
+        buf[i].r_type = R_LARCH_TLS_IE_PC_HI20;   // pcalau12i
+      else if (removed_bytes)
+        buf[i].r_type = R_LARCH_NONE;             // small TP offset (deleted)
+      else
+        buf[i].r_type = R_LARCH_TLS_LE_HI20;      // large TP offset (lu12i.w)
+      break;
+    case R_LARCH_TLS_DESC_CALL:
+      // The jirl slot holds the second instruction of the IE or LE sequence.
+      if (sym.has_tlsdesc(ctx))
+        break;
+      if (sym.has_gottp(ctx))
+        buf[i].r_type = R_LARCH_TLS_IE_PC_LO12;   // ld.d
+      else
+        buf[i].r_type = R_LARCH_TLS_LE_LO12;      // ori or addi.w
+      break;
+    }
+  }
+}
+
 } // namespace mold

 #endif
@@ -14,6 +14,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/m68k.pdf

+#if MOLD_M68K
+
 #include "mold.h"

 namespace mold {
@@ -310,3 +312,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -40,6 +40,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc32.pdf

+#if MOLD_PPC32
+
 #include "mold.h"

 namespace mold {
@@ -306,6 +308,12 @@ void InputSection<E>::apply_reloc_nonalloc(Context<E> &ctx, u8 *base) {
      else
        *(ub32 *)loc = S + A;
      break;
+    case R_PPC_DTPREL32:
+      if (std::optional<u64> val = get_tombstone(sym, frag))
+        *(ub32 *)loc = *val;
+      else
+        *(ub32 *)loc = S + A - ctx.dtp_addr;
+      break;
    default:
      Fatal(ctx) << *this << ": invalid relocation for non-allocated sections: "
                 << rel;
@@ -416,27 +424,28 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(plt_entry));
  static_assert(E::thunk_size == sizeof(local_thunk));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_plt(ctx)) {
-      u64 got =
-        sym->has_got(ctx) ? sym->get_got_addr(ctx) : sym->get_gotplt_addr(ctx);
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];
+
+    if (sym.has_plt(ctx)) {
+      u64 got = sym.has_got(ctx) ? sym.get_got_addr(ctx) : sym.get_gotplt_addr(ctx);
      i64 val = got - P - 8;
      memcpy(buf, plt_entry, sizeof(plt_entry));
      *(ub32 *)(buf + 16) |= higha(val);
      *(ub32 *)(buf + 20) |= lo(val);
    } else {
-      i64 val = sym->get_addr(ctx) - P - 8;
+      i64 val = sym.get_addr(ctx) - P - 8;
      memcpy(buf, local_thunk, sizeof(local_thunk));
      *(ub32 *)(buf + 16) |= higha(val);
      *(ub32 *)(buf + 20) |= lo(val);
    }
-
-    buf += E::thunk_size;
-    P += E::thunk_size;
  }
 }

 } // namespace mold
+
+#endif
@@ -45,6 +45,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc64v1.pdf

+#if MOLD_PPC64V1
+
 #include "mold.h"

 #include <algorithm>
@@ -217,6 +219,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_PPC64_REL16_LO:
      *(ub16 *)loc = lo(S + A - P);
      break;
+    case R_PPC64_GOT16:
+      *(ub16 *)loc = G - TOC;
+      break;
    case R_PPC64_PLT16_HA:
      *(ub16 *)loc = ha(G + GOT - TOC);
      break;
@@ -351,6 +356,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      if (sym.is_imported)
        sym.flags |= NEEDS_PLT;
      break;
+    case R_PPC64_GOT16:
    case R_PPC64_PLT16_HA:
      sym.flags |= NEEDS_GOT;
      break;
@@ -452,33 +458,35 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(plt_thunk));
  static_assert(E::thunk_size == sizeof(local_thunk));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
+  u64 TOC = ctx.extra.TOC->value;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_got(ctx)) {
-      i64 val = sym->get_got_addr(ctx) - ctx.extra.TOC->value;
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u8 *buf = base + offsets[i];
+
+    if (sym.has_got(ctx)) {
      memcpy(buf, pltgot_thunk, sizeof(pltgot_thunk));
+      i64 val = sym.get_got_addr(ctx) - TOC;
      *(ub32 *)(buf + 4) |= higha(val);
      *(ub32 *)(buf + 8) |= lo(val);
-    } else if(sym->has_plt(ctx)) {
-      i64 val = sym->get_gotplt_addr(ctx) - ctx.extra.TOC->value;
+    } else if(sym.has_plt(ctx)) {
      memcpy(buf, plt_thunk, sizeof(plt_thunk));
+      i64 val = sym.get_gotplt_addr(ctx) - TOC;
      *(ub32 *)(buf + 4) |= higha(val);
      *(ub32 *)(buf + 8) |= lo(val);
    } else {
-      i64 val = sym->get_addr(ctx, NO_OPD) - ctx.extra.TOC->value;
      memcpy(buf, local_thunk, sizeof(local_thunk));
+      i64 val = sym.get_addr(ctx, NO_OPD) - TOC;
      *(ub32 *)buf |= higha(val);
      *(ub32 *)(buf + 4) |= lo(val);
    }
-
-    buf += E::thunk_size;
  }
 }

 static InputSection<E> *get_opd_section(ObjectFile<E> &file) {
  for (std::unique_ptr<InputSection<E>> &isec : file.sections)
-    if (isec && isec->name() == ".opd")
+    if (isec && isec->name == ".opd")
      return isec.get();
  return nullptr;
 }
@@ -635,31 +643,31 @@ void PPC64OpdSection::add_symbol(Context<E> &ctx, Symbol<E> *sym) {
  this->shdr.sh_size += ENTRY_SIZE;
 }

-i64 PPC64OpdSection::get_reldyn_size(Context<E> &ctx) const {
-  if (ctx.arg.pic)
-    return symbols.size() * 2;
-  return 0;
+std::vector<ElfRel<E>> PPC64OpdSection::collect_dynrels(Context<E> &ctx) const {
+  if (!ctx.arg.pic)
+    return {};
+
+  std::vector<ElfRel<E>> rels;
+
+  for (Symbol<E> *sym : symbols) {
+    u64 loc = sym->get_opd_addr(ctx);
+    rels.emplace_back(loc, E::R_RELATIVE, 0, sym->get_addr(ctx, NO_PLT | NO_OPD));
+    rels.emplace_back(loc + 8, E::R_RELATIVE, 0, ctx.extra.TOC->value);
+  }
+  return rels;
 }

 void PPC64OpdSection::copy_buf(Context<E> &ctx) {
  ub64 *buf = (ub64 *)(ctx.buf + this->shdr.sh_offset);

-  ElfRel<E> *rel = nullptr;
-  if (ctx.arg.pic)
-    rel = (ElfRel<E> *)(ctx.buf + ctx.reldyn->shdr.sh_offset + reldyn_offset);
-
  for (Symbol<E> *sym : symbols) {
    u64 addr = sym->get_addr(ctx, NO_PLT | NO_OPD);
    *buf++ = addr;
    *buf++ = ctx.extra.TOC->value;
    *buf++ = 0;
-
-    if (ctx.arg.pic) {
-      u64 loc = sym->get_opd_addr(ctx);
-      *rel++ = ElfRel<E>(loc, E::R_RELATIVE, 0, addr);
-      *rel++ = ElfRel<E>(loc + 8, E::R_RELATIVE, 0, ctx.extra.TOC->value);
-    }
  }
 }

 } // namespace mold
+
+#endif
@@ -80,6 +80,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/ppc64v2.pdf

+#if MOLD_PPC64V2
+
 #include "mold.h"

 namespace mold {
@@ -243,6 +245,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ul32 *)loc |= bits(val, 25, 2) << 2;
      }
      break;
+    case R_PPC64_REL14:
+      *(ul32 *)loc |= bits(S + A - P, 15, 2) << 2;
+      break;
    case R_PPC64_REL32:
      *(ul32 *)loc = S + A - P;
      break;
@@ -255,6 +260,18 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_PPC64_REL16_LO:
      *(ul16 *)loc = lo(S + A - P);
      break;
+    case R_PPC64_GOT16:
+      *(ul16 *)loc = G - TOC;
+      break;
+    case R_PPC64_GOT16_LO:
+      *(ul16 *)loc = lo(G - TOC);
+      break;
+    case R_PPC64_GOT16_HI:
+      *(ul16 *)loc = hi(G - TOC);
+      break;
+    case R_PPC64_GOT16_HA:
+      *(ul16 *)loc = ha(G - TOC);
+      break;
    case R_PPC64_PLT16_HA:
      *(ul16 *)loc = ha(G + GOT - TOC);
      break;
@@ -416,6 +433,10 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_PLT;
      ctx.extra.is_power10 = true;
      break;
+    case R_PPC64_GOT16:
+    case R_PPC64_GOT16_LO:
+    case R_PPC64_GOT16_HI:
+    case R_PPC64_GOT16_HA:
    case R_PPC64_PLT16_HA:
    case R_PPC64_PLT_PCREL34:
    case R_PPC64_PLT_PCREL34_NOTOC:
@@ -431,12 +452,11 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      ctx.needs_tlsld = true;
      break;
    case R_PPC64_TPREL16_HA:
-    case R_PPC64_TPREL16_LO:
-    case R_PPC64_TPREL16_LO_DS:
    case R_PPC64_TPREL34:
      check_tlsle(ctx, sym, rel);
      break;
    case R_PPC64_ADDR64:
+    case R_PPC64_REL14:
    case R_PPC64_REL32:
    case R_PPC64_REL64:
    case R_PPC64_TOC16_HA:
@@ -456,6 +476,8 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_PPC64_GOT_TPREL16_LO_DS:
    case R_PPC64_GOT_TLSGD16_LO:
    case R_PPC64_GOT_TLSLD16_LO:
+    case R_PPC64_TPREL16_LO:
+    case R_PPC64_TPREL16_LO_DS:
    case R_PPC64_TLS:
    case R_PPC64_TLSGD:
    case R_PPC64_TLSLD:
@@ -518,15 +540,16 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
  static_assert(E::thunk_size == sizeof(local_thunk));
  static_assert(E::thunk_size == sizeof(local_thunk_power10));

-  u8 *buf = ctx.buf + output_section.shdr.sh_offset + offset;
-  u64 P = output_section.shdr.sh_addr + offset;
+  u8 *base = ctx.buf + output_section.shdr.sh_offset + offset;
  u64 TOC = ctx.extra.TOC->value;

-  for (Symbol<E> *sym : symbols) {
-    if (sym->has_plt(ctx)) {
-      u64 got =
-        sym->has_got(ctx) ? sym->get_got_addr(ctx) : sym->get_gotplt_addr(ctx);
+  for (i64 i = 0; i < symbols.size(); i++) {
+    Symbol<E> &sym = *symbols[i];
+    u64 P = get_addr() + offsets[i];
+    u8 *buf = base + offsets[i];

+    if (sym.has_plt(ctx)) {
+      u64 got = sym.has_got(ctx) ? sym.get_got_addr(ctx) : sym.get_gotplt_addr(ctx);
      if (ctx.extra.is_power10) {
        memcpy(buf, plt_thunk_power10, E::thunk_size);
        write34(buf + 8, got - P - 8);
@@ -536,7 +559,7 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
        *(ul32 *)(buf + 12) |= lo(got - TOC);
      }
    } else {
-      u64 S = sym->get_addr(ctx);
+      u64 S = sym.get_addr(ctx);
      if (ctx.extra.is_power10) {
        memcpy(buf, local_thunk_power10, E::thunk_size);
        write34(buf + 8, S - P - 8);
@@ -546,9 +569,6 @@ void Thunk<E>::copy_buf(Context<E> &ctx) {
        *(ul32 *)(buf + 12) |= lo(S - TOC);
      }
    }
-
-    buf += E::thunk_size;
-    P += E::thunk_size;
  }
 }

@@ -658,3 +678,5 @@ u64 get_eflags(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -301,6 +301,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check_range(ctx, i, val, lo, hi);
    };

+    auto utype = [&](i64 val) {
+      check(val, -(1LL << 31) - 0x800, (1LL << 31) - 0x800);
+      write_utype(loc, val);
+    };
+
    switch (rel.r_type) {
    case R_RISCV_32:
      if (E::is_64)
@@ -336,8 +341,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        write_cjtype(loc, val);
      } else {
        assert(removed_bytes == 0);
-        check(val, -(1LL << 31), 1LL << 31);
-        write_utype(loc, val);
+        utype(val);
        write_itype(loc + 4, val);
      }
      break;
@@ -366,26 +370,26 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        if (ctx.arg.relax && sym.is_pcrel_linktime_const(ctx) &&
            is_got_load_pair(ctx, *this, rels, i) && is_int(val, 32)) {
          // auipc <rd>, %hi20(val)
-          write_utype(loc, val);
+          utype(val);

          // addi <rd>, <rd>, %lo12(val)
          *(ul32 *)(loc + 4) = 0b0010011 | (rd << 15) | (rd << 7);
          write_itype(loc + 4, val);
          i += 3;
        } else {
-          write_utype(loc, G + GOT + A - P);
+          utype(G + GOT + A - P);
        }
      }
      break;
    }
    case R_RISCV_TLS_GOT_HI20:
-      write_utype(loc, sym.get_gottp_addr(ctx) + A - P);
+      utype(sym.get_gottp_addr(ctx) + A - P);
      break;
    case R_RISCV_TLS_GD_HI20:
-      write_utype(loc, sym.get_tlsgd_addr(ctx) + A - P);
+      utype(sym.get_tlsgd_addr(ctx) + A - P);
      break;
    case R_RISCV_PCREL_HI20:
-      write_utype(loc, S + A - P);
+      utype(S + A - P);
      break;
    case R_RISCV_PCREL_LO12_I:
    case R_RISCV_PCREL_LO12_S: {
@@ -423,8 +427,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ul16 *)loc = 0b011'0'00000'00000'01 | (rd << 7);
        write_citype(loc, (S + A + 0x800) >> 12);
      } else if (removed_bytes == 0) {
-        check(S + A, -(1LL << 31), 1LL << 31);
-        write_utype(loc, S + A);
+        utype(S + A);
      }
      break;
    case R_RISCV_LO12_I:
@@ -443,7 +446,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_RISCV_TPREL_HI20:
      assert(removed_bytes == 0 || removed_bytes == 4);
      if (removed_bytes == 0)
-        write_utype(loc, S + A - ctx.tp_addr);
+        utype(S + A - ctx.tp_addr);
      break;
    case R_RISCV_TPREL_ADD:
      // This relocation just annotates an ADD instruction that can be
@@ -505,7 +508,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      // original useless instructions instead of deleting them, but we
      // accept that because relaxations are enabled by default.
      if (sym.has_tlsdesc(ctx) && removed_bytes == 0)
-        write_utype(loc, sym.get_tlsdesc_addr(ctx) + A - P);
+        utype(sym.get_tlsdesc_addr(ctx) + A - P);
      break;
    case R_RISCV_TLSDESC_LOAD_LO12:
    case R_RISCV_TLSDESC_ADD_LO12:
@@ -532,10 +535,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
          write_itype(loc, sym2.get_tlsdesc_addr(ctx) + A - P);
        } else if (sym2.has_gottp(ctx)) {
          *(ul32 *)loc = 0x517; // auipc a0,<hi20>
-          write_utype(loc, sym2.get_gottp_addr(ctx) + A - P);
+          utype(sym2.get_gottp_addr(ctx) + A - P);
        } else {
          *(ul32 *)loc = 0x537; // lui a0,<hi20>
-          write_utype(loc, S + A - ctx.tp_addr);
+          utype(S + A - ctx.tp_addr);
        }
        break;
      case R_RISCV_TLSDESC_CALL:
@@ -626,6 +629,9 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
    case R_RISCV_32_PCREL:
      *(U32<E> *)loc = S + A - P;
      break;
+    case R_RISCV_GOT32_PCREL:
+      *(U32<E> *)loc = G + GOT + A - P;
+      break;
    case R_RISCV_SET_ULEB128:
      overwrite_uleb(loc, S + A);
      break;
@@ -751,6 +757,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_PLT;
      break;
    case R_RISCV_GOT_HI20:
+    case R_RISCV_GOT32_PCREL:
      sym.flags |= NEEDS_GOT;
      break;
    case R_RISCV_TLS_GOT_HI20:
@@ -993,6 +1000,72 @@ void shrink_section(Context<E> &ctx, InputSection<E> &isec) {
  isec.sh_size -= r_delta;
 }

+// With --emit-relocs, rewrite the emitted relocations to match the
+// instructions that relaxation produced. The logic parallels apply_reloc_alloc.
+template <>
+void rewrite_reloc_types(Context<E> &ctx, InputSection<E> &isec, ElfRel<E> *buf) {
+  std::span<const ElfRel<E>> rels = isec.get_rels(ctx);
+  std::span<RelocDelta> deltas = isec.extra.r_deltas;
+  i64 k = 0;
+
+  for (i64 i = 0; i < rels.size(); i++) {
+    const ElfRel<E> &rel = rels[i];
+    Symbol<E> &sym = *isec.file.symbols[rel.r_sym];
+
+    i64 removed_bytes = 0;
+    if (!deltas.empty()) {
+      while (k < deltas.size() && deltas[k].offset < rel.r_offset)
+        k++;
+      if (k < deltas.size() && deltas[k].offset == rel.r_offset)
+        removed_bytes = get_removed_bytes(deltas, k);
+    }
+
+    switch (rel.r_type) {
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT:
+      // auipc + jalr => jal, or c.j/c.jal
+      if (removed_bytes == 4)
+        buf[i].r_type = R_RISCV_JAL;
+      else if (removed_bytes == 6)
+        buf[i].r_type = R_RISCV_RVC_JUMP;
+      break;
+    case R_RISCV_GOT_HI20:
+      // auipc + l[dw] GOT load => the value is materialized directly, so both
+      // this and the paired PCREL_LO12 (the load) no longer need a relocation.
+      if (removed_bytes) {
+        buf[i].r_type = R_RISCV_NONE;
+        buf[i + 2].r_type = R_RISCV_NONE;
+        i += 3;
+      }
+      break;
+    case R_RISCV_HI20:
+      // lui (+ addi) => an instruction holding a link-time constant.
+      if (removed_bytes)
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TPREL_HI20:
+    case R_RISCV_TPREL_ADD:
+      // lui + add => deleted; the variable is accessed relative to tp directly.
+      if (removed_bytes)
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TLSDESC_HI20:
+      if (!sym.has_tlsdesc(ctx))
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    case R_RISCV_TLSDESC_LOAD_LO12:
+    case R_RISCV_TLSDESC_ADD_LO12:
+    case R_RISCV_TLSDESC_CALL: {
+      Symbol<E> &sym2 =
+        *isec.file.symbols[find_paired_reloc(ctx, isec, rels, sym, i).r_sym];
+      if (!sym2.has_tlsdesc(ctx))
+        buf[i].r_type = R_RISCV_NONE;
+      break;
+    }
+    }
+  }
+}
+
 // ISA name handlers
 //
 // An example of ISA name is "rv64i2p1_m2p0_a2p1_f2p2_d2p2_c2p0_zicsr2p0".
@@ -35,6 +35,8 @@
 //
 // https://github.com/IBM/s390x-abi/releases/download/v1.6.1/lzsabi_s390x.pdf

+#if MOLD_S390X
+
 #include "mold.h"

 namespace mold {
@@ -48,18 +50,24 @@ static void write_mid20(u8 *loc, u64 val) {
 template <>
 void write_plt_header(Context<E> &ctx, u8 *buf) {
  static u8 insn[] = {
-    // Compute PLT_INDEX
+    // Compute the offset into .rela.plt. This is equivalent to
+    // (%r0 - %r1 - 48 - 14) * 3/2 where %r0 is the PLT entry address
+    // plus 14, %r1 is the start address of .plt, and 48 is the size
+    // of this PLT header. We multiply by 3/2 because each PLT entry
+    // is 16 bytes, whereas each .rela.plt entry is 24 bytes.
    0xb9, 0x09, 0x00, 0x01,             // sgr   %r0, %r1
    0xa7, 0x0b, 0xff, 0xc2,             // aghi  %r0, -62
    0xeb, 0x10, 0x00, 0x01, 0x00, 0x0c, // srlg  %r1, %r0, 1
    0xb9, 0x08, 0x00, 0x01,             // agr   %r0, %r1
+    // Store the computed value to 56(%r15) and .got.plt[1] to 48(%15)
+    // where %r15 is the stack pointer.
    0xe3, 0x00, 0xf0, 0x38, 0x00, 0x24, // stg   %r0, 56(%r15)
-    // Branch to _dl_runtime_resolve
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_OFFSET
    0xd2, 0x07, 0xf0, 0x30, 0x10, 0x08, // mvc   48(8, %r15), 8(%r1)
+    // Branch to _dl_runtime_resolve
    0xe3, 0x10, 0x10, 0x10, 0x00, 0x04, // lg    %r1, 16(%r1)
    0x07, 0xf1,                         // br    %r1
-    0x07, 0x00, 0x07, 0x00,             // nopr; nopr
+    0x00, 0x00, 0x00, 0x00,             // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -73,7 +81,7 @@ void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOTPLT_ENTRY_OFFSET
    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
    0x0d, 0x01,                         // basr  %r0, %r1
-    0x07, 0x00,                         // nopr
+    0x00, 0x00,                         // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -86,7 +94,7 @@ void write_pltgot_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
    0xc0, 0x10, 0, 0, 0, 0,             // larl  %r1, GOT_ENTRY_OFFSET
    0xe3, 0x10, 0x10, 0x00, 0x00, 0x04, // lg    %r1, (%r1)
    0x07, 0xf1,                         // br    %r1
-    0x07, 0x00,                         // nopr
+    0x00, 0x00,                         // (filler)
  };

  memcpy(buf, insn, sizeof(insn));
@@ -483,3 +491,5 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -137,7 +137,7 @@ void write_plt_header(Context<E> &ctx, u8 *buf) {
      0x5221, //    mov.l   @(4, r2), r2
      0x402b, //    jmp     @r0
      0xe000, //    mov     #0, r0
-      0x0009, //    nop
+      0xfffd, //    (illegal)
      0, 0,   // 1: .long GOTPLT
    };

@@ -53,6 +53,8 @@
 //
 // https://github.com/rui314/psabi/blob/main/sparc.pdf

+#if MOLD_SPARC64
+
 #include "mold.h"

 namespace mold {
@@ -76,26 +78,77 @@ void write_plt_header(Context<E> &ctx, u8 *buf) {
  memset(buf, 0, E::plt_hdr_size);
 }

+// Returns the byte offset within .plt of the data pointer for a large SPARC
+// PLT entry. See write_plt_entry below for the block layout this assumes.
+i64 sparc_plt_ptr_offset(Context<E> &ctx, i64 pltidx) {
+  i64 i = pltidx - sparc_num_small_plt;
+  i64 block = i / 160;
+  i64 nlarge = (i64)ctx.plt->symbols.size() - sparc_num_small_plt;
+  i64 nstub = std::min<i64>(160, nlarge - block * 160);
+  return 0x100000 + block * 5120 + nstub * 24 + (i % 160) * 8;
+}
+
 template <>
 void write_plt_entry(Context<E> &ctx, u8 *buf, Symbol<E> &sym) {
-  static ub32 insn[] = {
-    0x0300'0000, // sethi (. - .PLT0), %g1
-    0x3068'0000, // ba,a  %xcc, .PLT1
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-    0x0100'0000, // nop
-  };
+  // SPARC uses two PLT entry formats. A "small" entry branches directly to
+  // the resolver stub (.PLT1) with a BPcc instruction whose reach is only
+  // ±1 MiB. Once the PLT grows past that (0x100000 bytes), we switch to a
+  // "large" format: rather than branching to the resolver, a large entry
+  // loads a 64-bit value from a nearby data pointer and jumps to (that value
+  // + its own address).
+  //
+  // Large entries are grouped into blocks of 160: each block is 160 code
+  // stubs followed by 160 8-byte data pointers, one per stub. The stubs must
+  // sit on a fixed grid, 24 bytes apart, because that is how the loader finds
+  // them: on a lazy bind the stub jumps to the resolver (.PLT0) with only its
+  // own address, and the loader derives which symbol to resolve from that
+  // address. Nothing may sit between two stubs, so each stub's pointer lives
+  // in the block's pointer region, which it reaches with a signed 13-bit ldx
+  // offset (see to_plt_offset). This layout is dictated by the loader; we
+  // cannot rearrange or simplify it.
+  i64 idx = sym.get_plt_idx(ctx);

-  u64 plt0 = ctx.plt->shdr.sh_addr;
-  u64 plt1 = ctx.plt->shdr.sh_addr + E::plt_size;
-  u64 entry = sym.get_plt_addr(ctx);
+  if (idx < sparc_num_small_plt) {
+    static ub32 insn[] = {
+      0x0300'0000, // sethi (. - .PLT0), %g1
+      0x3068'0000, // ba,a  %xcc, .PLT1
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+      0x0100'0000, // nop
+    };

-  memcpy(buf, insn, sizeof(insn));
-  *(ub32 *)buf |= bits(entry - plt0, 21, 0);
-  *(ub32 *)(buf + 4) |= bits(plt1 - entry - 4, 20, 2);
+    u64 plt0 = ctx.plt->shdr.sh_addr;
+    u64 plt1 = ctx.plt->shdr.sh_addr + E::plt_size;
+    u64 entry = sym.get_plt_addr(ctx);
+
+    memcpy(buf, insn, sizeof(insn));
+    *(ub32 *)buf |= bits(entry - plt0, 21, 0);
+    *(ub32 *)(buf + 4) |= bits(plt1 - entry - 4, 20, 2);
+  } else {
+    static ub32 insn[] = {
+      0x8a10'000f, // mov  %o7, %g5
+      0x4000'0002, // call . + 8
+      0x0100'0000, // nop
+      0xc25b'e000, // ldx  [ %o7 + .ptr ], %g1
+      0x83c3'c001, // jmpl %o7 + %g1, %g1
+      0x9e10'0005, // mov  %g5, %o7
+    };
+
+    u64 plt = ctx.plt->shdr.sh_addr;
+    u64 call = sym.get_plt_addr(ctx) + 4;
+    i64 ptroff = sparc_plt_ptr_offset(ctx, idx);
+
+    memcpy(buf, insn, sizeof(insn));
+    *(ub32 *)(buf + 12) |= bits(plt + ptroff - call, 12, 0);
+
+    // The data pointer initially holds (.PLT0 - call) so that the first call
+    // jumps to .PLT0, where the loader's lazy resolver lives. The resolver
+    // later overwrites it with (target - call).
+    *(ub64 *)(ctx.buf + ctx.plt->shdr.sh_offset + ptroff) = plt - call;
+  }
 }

 template <>
@@ -139,7 +192,9 @@ template <>
 void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
  std::span<const ElfRel<E>> rels = get_rels(ctx);

-  for (i64 i = 0; i < rels.size(); i++) {
+  // We iterate over relocations in reverse order so that it is easy
+  // to swap instructions for R_SPARC_TLS_GD_CALL.
+  for (i64 i = (i64)rels.size() - 1; i >= 0; i--) {
    const ElfRel<E> &rel = rels[i];
    if (rel.r_type == R_NONE)
      continue;
@@ -157,6 +212,10 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      check_range(ctx, i, val, lo, hi);
    };

+    auto rs1 = [&] { return *(ub32 *)loc & (0b11111 << 14); };
+    auto rs2 = [&] { return *(ub32 *)loc & 0b11111; };
+    auto rd  = [&] { return *(ub32 *)loc & (0b11111 << 25); };
+
    switch (rel.r_type) {
    case R_SPARC_5:
      check(S + A, 0, 1 << 5);
@@ -172,7 +231,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_SPARC_8:
      check(S + A, 0, 1 << 8);
-      *(u8 *)loc = S + A;
+      *loc = S + A;
      break;
    case R_SPARC_10:
      check(S + A, 0, 1 << 10);
@@ -206,13 +265,12 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ub32 *)loc = S + A;
      break;
    case R_SPARC_PLT64:
-    case R_SPARC_UA64:
    case R_SPARC_REGISTER:
      *(ub64 *)loc = S + A;
      break;
    case R_SPARC_DISP8:
      check(S + A - P, -(1 << 7), 1 << 7);
-      *(u8 *)loc = S + A - P;
+      *loc = S + A - P;
      break;
    case R_SPARC_DISP16:
      check(S + A - P, -(1 << 15), 1 << 15);
@@ -297,12 +355,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      break;
    case R_SPARC_GOTDATA_OP:
      if (sym.is_absolute()) {
-        // ldx [ %g2 + %g1 ], %g1  →  nop
-        *(ub32 *)loc = 0x0100'0000;
+        // ldx [ %rs1 + %rs2 ], %rd  →  mov %rs2, %rd
+        *(ub32 *)loc = 0x8010'0000 | rs2() | rd();
      } else if (sym.is_pcrel_linktime_const(ctx)) {
-        // ldx [ %g2 + %g1 ], %g1  →  add %g2, %g1, %g1
-        *(ub32 *)loc &= 0b00'11111'000000'11111'1'11111111'11111;
-        *(ub32 *)loc |= 0b10'00000'000000'00000'0'00000000'00000;
+        // ldx [ %rs1 + %rs2 ], %rd  →  add %rs1, %rs2, %rd
+        *(ub32 *)loc = 0x8000'0000 | rs1() | rs2() | rd();
      }
      break;
    case R_SPARC_PC10:
@@ -357,12 +414,12 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      if (sym.has_tlsgd(ctx)) {
        *(ub32 *)loc |= bits(sym.get_tlsgd_addr(ctx) + A - GOT, 9, 0);
      } else if (sym.has_gottp(ctx)) {
-        u32 rd = bits(*(ub32 *)loc, 29, 25);
-        *(ub32 *)loc = 0x8010'2000 | (rd << 25) | (rd << 14); // or  %reg, $0, %reg
+        // add %rs1, %rs2, %rd → or  %rs1, $imm, %rd
+        *(ub32 *)loc = 0x8010'2000 | rs1() | rd();
        *(ub32 *)loc |= bits(sym.get_gottp_addr(ctx) + A - GOT, 9, 0);
      } else {
-        u32 rd = bits(*(ub32 *)loc, 29, 25);
-        *(ub32 *)loc = 0x8018'2000 | (rd << 25) | (rd << 14); // xor %reg, $0, %reg
+        // add %rs1, %rs2, %rd → xor %rs1, $imm, %rd
+        *(ub32 *)loc = 0x8018'2000 | rs1() | rd();
        *(ub32 *)loc |= bits(S + A - ctx.tp_addr, 9, 0) | 0b1'1100'0000'0000;
      }
      break;
@@ -370,11 +427,11 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      if (sym.has_tlsgd(ctx)) {
        // do nothing
      } else if (sym.has_gottp(ctx)) {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0xd05d'c000 | rs2; // ldx [ %l7 + %reg ], %o0
+        // add %rs1, %rs2, %rd → ldx [ %rs1 + %rs2 ], %rd
+        *(ub32 *)loc = 0xc058'0000 | rs1() | rs2() | rd();
      } else {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0x9001'c000 | rs2; // add %g7, %reg, %o0
+        // add %rs1, %rs2, %rd → add %g7, %rs2, %rd
+        *(ub32 *)loc = 0x8001'c000 | rs2() | rd();
      }
      break;
    case R_SPARC_TLS_GD_CALL:
@@ -382,9 +439,17 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        u64 addr = ctx.extra.tls_get_addr->get_addr(ctx);
        *(ub32 *)loc |= bits(addr + A - P, 31, 2);
      } else if (sym.has_gottp(ctx)) {
-        *(ub32 *)loc = 0x9001'c008; // add %g7, %o0, %o0
+        // When we rewrite a branch instruction with a non-branch one,
+        // we need to swap the instruction and the following one so that
+        // the original execution order, which is inverted due to the
+        // branch delay slot, is preserved.
+        //
+        // Since we apply relocations from the end to the beginning,
+        // the instruction at loc + 4 is already complete.
+        memcpy(loc, loc + 4, 4);
+        *(ub32 *)(loc + 4) = 0x9001'c008; // add %g7, %o0, %o0
      } else {
-        *(ub32 *)loc = 0x0100'0000; // nop
+        *(ub32 *)loc = 0x0100'0000; // call → nop
      }
      break;
    case R_SPARC_TLS_LDM_HI22:
@@ -400,12 +465,8 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
        *(ub32 *)loc |= bits(ctx.tp_addr - ctx.tls_begin, 9, 0);
      break;
    case R_SPARC_TLS_LDM_ADD:
-      if (ctx.got->has_tlsld(ctx)) {
-        // do nothing
-      } else {
-        u32 rs2 = bits(*(ub32 *)loc, 4, 0);
-        *(ub32 *)loc = 0x9021'c000 | rs2; // sub %g7, %reg, %o0
-      }
+      if (!ctx.got->has_tlsld(ctx))
+        *(ub32 *)loc = 0x8021'c000 | rs2() | rd(); // sub %g7, %rs2, %rd
      break;
    case R_SPARC_TLS_LDM_CALL:
      if (ctx.got->has_tlsld(ctx)) {
@@ -437,6 +498,7 @@ void InputSection<E>::apply_reloc_alloc(Context<E> &ctx, u8 *base) {
      *(ub32 *)loc = sym.esym().st_size + A;
      break;
    case R_SPARC_64:
+    case R_SPARC_UA64:
    case R_SPARC_TLS_LDO_ADD:
    case R_SPARC_TLS_IE_LD:
    case R_SPARC_TLS_IE_LDX:
@@ -500,6 +562,7 @@ template <>
 void InputSection<E>::scan_relocations(Context<E> &ctx) {
  assert(shdr().sh_flags & SHF_ALLOC);
  std::span<const ElfRel<E>> rels = get_rels(ctx);
+  bool needs_tlsgd = false;

  // Scan relocations
  for (i64 i = 0; i < rels.size(); i++) {
@@ -526,7 +589,6 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_SPARC_REGISTER:
    case R_SPARC_UA16:
    case R_SPARC_UA32:
-    case R_SPARC_UA64:
    case R_SPARC_PC_HM10:
    case R_SPARC_OLO10:
    case R_SPARC_LOX10:
@@ -584,6 +646,7 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
        sym.flags |= NEEDS_GOTTP;
      } else {
        sym.flags |= NEEDS_TLSGD;
+        needs_tlsgd = true;
      }
      break;
    case R_SPARC_TLS_LDM_HI22:
@@ -597,23 +660,21 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
    case R_SPARC_TLS_IE_HI22:
      sym.flags |= NEEDS_GOTTP;
      break;
-    case R_SPARC_TLS_GD_CALL:
-    case R_SPARC_TLS_LDM_CALL:
-      if (Symbol<E> *sym = ctx.extra.tls_get_addr; sym->is_imported)
-        sym->flags |= NEEDS_PLT;
-      break;
    case R_SPARC_TLS_LE_HIX22:
    case R_SPARC_TLS_LE_LOX10:
      check_tlsle(ctx, sym, rel);
      break;
    case R_SPARC_64:
+    case R_SPARC_UA64:
    case R_SPARC_GOTDATA_OP_LOX10:
    case R_SPARC_GOTDATA_OP:
    case R_SPARC_GOTDATA_LOX10:
    case R_SPARC_TLS_GD_LO10:
    case R_SPARC_TLS_GD_ADD:
+    case R_SPARC_TLS_GD_CALL:
    case R_SPARC_TLS_LDM_LO10:
    case R_SPARC_TLS_LDM_ADD:
+    case R_SPARC_TLS_LDM_CALL:
    case R_SPARC_TLS_LDO_HIX22:
    case R_SPARC_TLS_LDO_LOX10:
    case R_SPARC_TLS_LDO_ADD:
@@ -627,6 +688,14 @@ void InputSection<E>::scan_relocations(Context<E> &ctx) {
      Error(ctx) << *this << ": unknown relocation: " << rel;
    }
  }
+
+  // TLS_GD_CALL and TLS_LDM_CALL relocations implicitly refer to
+  // __tls_get_addr, which may be dynamically linked from libc.so.
+  Symbol<E> &sym = *ctx.extra.tls_get_addr;
+  if (sym.is_imported && (needs_tlsgd || ctx.needs_tlsld))
+    sym.flags |= NEEDS_PLT;
 }

 } // namespace mold
+
+#endif
@@ -25,8 +25,9 @@
 //
 // https://gitlab.com/x86-psABIs/x86-64-ABI

-#include "mold.h"
+#if MOLD_X86_64

+#include "mold.h"
 #include <tbb/parallel_for_each.h>

 namespace mold {
@@ -950,3 +951,5 @@ void rewrite_endbr(Context<E> &ctx) {
 }

 } // namespace mold
+
+#endif
@@ -16,6 +16,7 @@
 #if __has_include(<unistd.h>)
 # include <unistd.h>
 #else
+# include <direct.h>
 # define isatty _isatty
 # define STDERR_FILENO (_fileno(stderr))
 #endif
@@ -60,6 +61,7 @@ Options:
  -s, --strip-all             Strip .symtab section
  -u SYMBOL, --undefined SYMBOL
                              Force to resolve SYMBOL
+  -w, --no-warnings           Suppress warnings
  -y SYMBOL, --trace-symbol SYMBOL
                              Trace references to SYMBOL
  --Bdynamic, --dy            Link against shared libraries (default)
@@ -87,7 +89,7 @@ Options:
  --color-diagnostics=[auto,always,never]
                              Use colors in diagnostics
  --color-diagnostics         Alias for --color-diagnostics=always
-  --compress-debug-sections [none,zlib,zlib-gabi,zstd]
+  --compress-debug-sections=[none,zlib,zlib:0,...,zlib:9,zstd,zstd:1,...,zstd:22]
                              Compress .debug_* sections
  --dc                        Ignored
  --dependency-file=FILE      Write Makefile-style dependency rules to FILE
@@ -129,7 +131,7 @@ Options:
  --no-undefined              Report undefined symbols (even with --shared)
  --noinhibit-exec            Create an output file even if errors occur
  --oformat=binary            Omit ELF, section, and program headers
-  --pack-dyn-relocs=[relr,none]
+  --pack-dyn-relocs=[relr,android,android+relr,none]
                              Pack dynamic relocations
  --package-metadata=PERCENT_ENCODED_STRING
                              Set a given string to .note.package
@@ -137,9 +139,9 @@ Options:
  --pie, --pic-executable     Create a position-independent executable
    --no-pie, --no-pic-executable
  --pop-state                 Restore the state of flags governing input file handling
-  --print-gc-sections         Print removed unreferenced sections
+  --print-gc-sections[=FILE]  Print, or save in FILE, removed unreferenced sections
    --no-print-gc-sections
-  --print-icf-sections        Print folded identical sections
+  --print-icf-sections[=FILE] Print, or save in FILE, folded identical sections
    --no-print-icf-sections
  --push-state                Save the state of flags governing input file handling
  --quick-exit                Use quick_exit to exit (default)
@@ -192,6 +194,7 @@ Options:
  --whole-archive             Include all objects from static archives
    --no-whole-archive
  --wrap SYMBOL               Use a wrapper function for a given symbol
+  --zero-to-bss               Convert all-zero data sections into BSS
  -z defs                     Report undefined symbols (even with --shared)
    -z nodefs
  -z common-page-size=VALUE   Ignored
@@ -234,75 +237,112 @@ Options:
 mold: supported targets: elf32-i386 elf64-x86-64 elf32-littlearm elf64-littleaarch64 elf64-bigaarch64 elf32-littleriscv elf32-bigriscv elf64-littleriscv elf64-bigriscv elf32-powerpc elf64-powerpc elf64-powerpc elf64-powerpcle elf64-s390 elf64-sparc elf32-m68k elf32-sh-linux elf64-loongarch elf32-loongarch
 mold: supported emulations: elf_i386 elf_x86_64 armelf_linux_eabi aarch64elf aarch64linux aarch64elfb aarch64linuxb elf32lriscv elf32briscv elf64lriscv elf64briscv elf32ppc elf32ppclinux elf64ppc elf64lppc elf64_s390 elf64_sparc m68kelf shlelf_linux shelf_linux elf64loongarch elf32loongarch)";

+// If a command line argument is in the form of `@path/to/some/file` (i.e.
+// it starts with an atsign), the linker reads the given file and
+// interprets its contents as a list of command line arguments. A file
+// containing command line arguments is called a "response file".
+//
+// A response file is often used to pass a very large number of arguments
+// to the linker without exceeding the kernel's command line length limit.
+//
+// This function opens a given file, tokenizes its contents, and returns a
+// list of tokens.
 template <typename E>
 static std::vector<std::string_view>
 read_response_file(Context<E> &ctx, std::string_view path, i64 depth) {
  if (depth > 10)
    Fatal(ctx) << path << ": response file nesting too deep";

-  std::vector<std::string_view> vec;
  MappedFile *mf = must_open_file(ctx, std::string(path));
-  std::string_view data((char *)mf->data, mf->size);
-
  mf->is_dependency = false;

-  while (!data.empty()) {
-    if (isspace(data[0])) {
-      data = data.substr(1);
-      continue;
-    }
+  std::vector<std::string> vec;
+  std::ostringstream os;
+  char quote = 0;

-    auto read_quoted = [&]() {
-      char quote = data[0];
-      data = data.substr(1);
+  // Each state represents the type of characters currently being read.
+  // SPACE indicates blank characters between tokens, BARE indicates an
+  // unquoted token, and QUOTED indicates a quoted token.
+  enum { SPACE, BARE, QUOTED } state = SPACE;

-      std::string buf;
-      while (!data.empty() && data[0] != quote) {
-        if (data[0] == '\\' && data.size() >= 1) {
-          buf.append(1, data[1]);
-          data = data.substr(2);
-        } else {
-          buf.append(1, data[0]);
-          data = data.substr(1);
-        }
-      }
-      if (data.empty())
-        Fatal(ctx) << path << ": premature end of input";
-      data = data.substr(1);
-      return save_string(ctx, buf);
-    };
+  for (i64 i = 0; i <= mf->size; i++) {
+    char c = (i < mf->size) ? mf->data[i] : 0;
+    char c2 = (i + 1 < mf->size) ? mf->data[i + 1] : 0;

-    auto read_unquoted = [&] {
-      std::string buf;
-      while (!data.empty()) {
-        if (data[0] == '\\' && data.size() >= 1) {
-          buf.append(1, data[1]);
-          data = data.substr(2);
-          continue;
-        }
+    if (c == '\\' && c2 == 0)
+      Fatal(ctx) << path << ": premature end of input";

-        if (!isspace(data[0])) {
-          buf.append(1, data[0]);
-          data = data.substr(1);
-          continue;
-        }
+    switch (state) {
+    case SPACE:
+      if (c == 0 || isspace(c))
+        break;
+
+      if (c == '\\') {
+        os << c2;
+        state = BARE;
+        i++;
        break;
      }
-      return save_string(ctx, buf);
-    };

-    std::string_view tok;
-    if (data[0] == '\'' || data[0] == '\"')
-      tok = read_quoted();
-    else
-      tok = read_unquoted();
+      if (c == '\'' || c == '"') {
+        quote = c;
+        state = QUOTED;
+        break;
+      }

-    if (tok.starts_with('@'))
-      append(vec, read_response_file(ctx, tok.substr(1), depth + 1));
-    else
-      vec.push_back(tok);
+      os << c;
+      state = BARE;
+      break;
+    case BARE:
+      if (c == 0 || isspace(c)) {
+        vec.push_back(os.str());
+        os = {};
+        state = SPACE;
+        break;
+      }
+
+      if (c == '\\') {
+        os << c2;
+        i++;
+        break;
+      }
+
+      if (c == '\'' || c == '"') {
+        quote = c;
+        state = QUOTED;
+        break;
+      }
+
+      os << c;
+      break;
+    case QUOTED:
+      if (c == 0)
+        Fatal(ctx) << path << ": premature end of input";
+
+      if (c == '\\') {
+        os << c2;
+        i++;
+        break;
+      }
+
+      if (c == quote) {
+        state = BARE;
+        break;
+      }
+
+      os << c;
+      break;
+    }
  }
-  return vec;
+
+  std::vector<std::string_view> vec2;
+  for (std::string &tok : vec) {
+    if (tok.starts_with('@'))
+      append(vec2, read_response_file(ctx, tok.substr(1), depth + 1));
+    else
+      vec2.push_back(save_string(ctx, tok));
+  }
+  return vec2;
 }

 // Replace "@path/to/some/text/file" with its file contents.
@@ -319,13 +359,6 @@ expand_response_files(Context<E> &ctx, char **argv) {
  return vec;
 }

-static i64 get_default_thread_count() {
-  // mold doesn't scale well above 32 threads.
-  int n = tbb::global_control::active_value(
-    tbb::global_control::max_allowed_parallelism);
-  return std::min(n, 32);
-}
-
 static std::string_view string_trim(std::string_view str) {
  size_t pos = str.find_first_not_of(" \t");
  if (pos == str.npos)
@@ -428,11 +461,11 @@ parse_package_metadata(Context<E> &ctx, std::string_view arg) {
 }

 static std::vector<std::string_view>
-split_by_comma_or_colon(std::string_view str) {
+split_string(std::string_view str, std::string_view sep) {
  std::vector<std::string_view> vec;

  for (;;) {
-    i64 pos = str.find_first_of(",:");
+    i64 pos = str.find_first_of(sep);
    if (pos == str.npos) {
      vec.push_back(str);
      break;
@@ -474,63 +507,6 @@ static bool is_file(const std::filesystem::path& path) {
  return !std::filesystem::is_directory(path, error) && !error;
 }

-template <typename E>
-static std::vector<SectionOrder>
-parse_section_order(Context<E> &ctx, std::string_view arg) {
-  auto flags = std::regex_constants::ECMAScript | std::regex_constants::icase |
-               std::regex_constants::optimize;
-  static std::regex re1(R"(^\s*(TEXT|DATA|RODATA|BSS)(?:\s|$))", flags);
-  static std::regex re2(R"(^\s*([a-zA-Z0-9_.][^\s]*|EHDR|PHDR)(?:\s|$))", flags);
-  static std::regex re3(R"(^\s*=(0x[0-9a-f]+|\d+)(?:\s|$))", flags);
-  static std::regex re4(R"(^\s*%(0x[0-9a-f]+|\d*)(?:\s|$))", flags);
-  static std::regex re5(R"(^\s*!(\S+)(?:\s|$))", flags);
-
-  std::vector<SectionOrder> vec;
-  arg = string_trim(arg);
-
-  while (!arg.empty()) {
-    SectionOrder ord;
-    std::cmatch m;
-
-    if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re1)) {
-      ord.type = SectionOrder::GROUP;
-      ord.name = m[1].str();
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re2)) {
-      ord.type = SectionOrder::SECTION;
-      ord.name = m[1].str();
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re3)) {
-      ord.type = SectionOrder::ADDR;
-      std::string s = m[1];
-      ord.value = std::stoull(s, nullptr, s.starts_with("0x") ? 16 : 10);
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re4)) {
-      ord.type = SectionOrder::ALIGN;
-      std::string s = m[1];
-      ord.value = std::stoull(s, nullptr, s.starts_with("0x") ? 16 : 10);
-    } else if (std::regex_search(arg.data(), arg.data() + arg.size(), m, re5)) {
-      ord.type = SectionOrder::SYMBOL;
-      ord.name = m[1].str();
-    } else {
-      Fatal(ctx) << "--section-order: parse error: " << arg;
-    }
-
-    vec.push_back(ord);
-    arg = arg.substr(m[0].length());
-  }
-
-  bool is_first = true;
-  for (SectionOrder &ord : vec) {
-    if (ord.type == SectionOrder::SECTION) {
-      if (is_first) {
-        is_first = false;
-      } else if (ord.name == "EHDR")
-        Fatal(ctx) << "--section-order: EHDR must be the first "
-                   << "section specifier: " << arg;
-    }
-  }
-
-  return vec;
-}
-
 template <typename E>
 static std::variant<Symbol<E> *, u64>
 parse_defsym_value(Context<E> &ctx, std::string_view s) {
@@ -725,45 +701,71 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_arg("mllvm")) {
      ctx.arg.plugin_opt.emplace_back(arg);
    } else if (read_arg("m")) {
+      auto check = [&](bool supported, std::string_view name) {
+        if (!supported)
+          Fatal(ctx) << "'-m " << arg << "' is not supported; you may want to"
+                     << " rebuild mold with " << name << " support";
+      };
+
      if (arg == "elf_x86_64") {
+        check(HAVE_TARGET_X86_64, X86_64::name);
        ctx.arg.emulation = X86_64::name;
      } else if (arg == "elf_i386") {
+        check(HAVE_TARGET_I386, I386::name);
        ctx.arg.emulation = I386::name;
      } else if (arg == "aarch64elf" || arg == "aarch64linux") {
+        check(HAVE_TARGET_ARM64LE, ARM64LE::name);
        ctx.arg.emulation = ARM64LE::name;
      } else if (arg == "aarch64elfb" || arg == "aarch64linuxb") {
+        check(HAVE_TARGET_ARM64BE, ARM64BE::name);
        ctx.arg.emulation = ARM64BE::name;
      } else if (arg == "armelf_linux_eabi") {
+        check(HAVE_TARGET_ARM32LE, ARM32LE::name);
        ctx.arg.emulation = ARM32LE::name;
      } else if (arg == "armelfb_linux_eabi") {
+        check(HAVE_TARGET_ARM32BE, ARM32BE::name);
        ctx.arg.emulation = ARM32BE::name;
      } else if (arg == "elf64lriscv") {
+        check(HAVE_TARGET_RV64LE, RV64LE::name);
        ctx.arg.emulation = RV64LE::name;
      } else if (arg == "elf64briscv") {
+        check(HAVE_TARGET_RV64BE, RV64BE::name);
        ctx.arg.emulation = RV64BE::name;
      } else if (arg == "elf32lriscv") {
+        check(HAVE_TARGET_RV32LE, RV32LE::name);
        ctx.arg.emulation = RV32LE::name;
      } else if (arg == "elf32briscv") {
+        check(HAVE_TARGET_RV32BE, RV32BE::name);
        ctx.arg.emulation = RV32BE::name;
      } else if (arg == "elf32ppc" || arg == "elf32ppclinux") {
+        check(HAVE_TARGET_PPC32, PPC32::name);
        ctx.arg.emulation = PPC32::name;
      } else if (arg == "elf64ppc") {
+        check(HAVE_TARGET_PPC64V1, PPC64V1::name);
        ctx.arg.emulation = PPC64V1::name;
      } else if (arg == "elf64lppc") {
+        check(HAVE_TARGET_PPC64V2, PPC64V2::name);
        ctx.arg.emulation = PPC64V2::name;
      } else if (arg == "elf64_s390") {
+        check(HAVE_TARGET_S390X, S390X::name);
        ctx.arg.emulation = S390X::name;
      } else if (arg == "elf64_sparc") {
+        check(HAVE_TARGET_SPARC64, SPARC64::name);
        ctx.arg.emulation = SPARC64::name;
      } else if (arg == "m68kelf") {
+        check(HAVE_TARGET_M68K, M68K::name);
        ctx.arg.emulation = M68K::name;
      } else if (arg == "shlelf" || arg == "shlelf_linux") {
+        check(HAVE_TARGET_SH4LE, SH4LE::name);
        ctx.arg.emulation = SH4LE::name;
      } else if (arg == "shelf" || arg == "shelf_linux") {
+        check(HAVE_TARGET_SH4BE, SH4BE::name);
        ctx.arg.emulation = SH4BE::name;
      } else if (arg == "elf64loongarch") {
+        check(HAVE_TARGET_LOONGARCH64, LOONGARCH64::name);
        ctx.arg.emulation = LOONGARCH64::name;
      } else if (arg == "elf32loongarch") {
+        check(HAVE_TARGET_LOONGARCH32, LOONGARCH32::name);
        ctx.arg.emulation = LOONGARCH32::name;
      } else {
        Fatal(ctx) << "unknown -m argument: " << arg;
@@ -785,7 +787,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("Bno-symbolic")) {
      ctx.arg.Bsymbolic = BSYMBOLIC_NONE;
    } else if (read_arg("exclude-libs")) {
-      append(ctx.arg.exclude_libs, split_by_comma_or_colon(arg));
+      for (std::string_view lib : split_string(arg, ",:"))
+        ctx.arg.exclude_libs.insert(lib);
    } else if (read_flag("q") || read_flag("emit-relocs")) {
      ctx.arg.emit_relocs = true;
      ctx.arg.discard_locals = false;
@@ -799,10 +802,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("print-map") || read_flag("M")) {
      ctx.arg.print_map = true;
    } else if (read_flag("Bstatic") || read_flag("dn") || read_flag("static")) {
-      ctx.arg.static_ = true;
      remaining.emplace_back("--Bstatic");
    } else if (read_flag("Bdynamic") || read_flag("dy")) {
-      ctx.arg.static_ = false;
      remaining.emplace_back("--Bdynamic");
    } else if (read_flag("shared") || read_flag("Bshareable")) {
      ctx.arg.shared = true;
@@ -835,6 +836,13 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.detach = true;
    } else if (read_flag("no-detach")) {
      ctx.arg.detach = false;
+    } else if (read_arg("orphan-handling")) {
+      if (arg != "place" && arg != "warn" && arg != "error")
+        Fatal(ctx) << "--orphan-handling: unsupported mode: " << arg;
+      ctx.arg.orphan_handling = arg;
+    } else if (read_flag("warn-rwx-segments") ||
+               read_flag("no-warn-rwx-segments")) {
+      // mold doesn't warn about RWX segments
    } else if (read_flag("default-symver")) {
      ctx.arg.default_symver = true;
    } else if (read_flag("noinhibit-exec")) {
@@ -943,9 +951,21 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("pack-dyn-relocs=relr") ||
               read_z_flag("pack-relative-relocs")) {
      ctx.arg.pack_dyn_relocs_relr = true;
+      ctx.arg.pack_dyn_relocs_android = false;
+    } else if (read_flag("pack-dyn-relocs=android")) {
+      ctx.arg.pack_dyn_relocs_android = true;
+      ctx.arg.pack_dyn_relocs_relr = false;
+    } else if (read_flag("pack-dyn-relocs=android+relr")) {
+      ctx.arg.pack_dyn_relocs_android = true;
+      ctx.arg.pack_dyn_relocs_relr = true;
    } else if (read_flag("pack-dyn-relocs=none") ||
               read_z_flag("nopack-relative-relocs")) {
      ctx.arg.pack_dyn_relocs_relr = false;
+      ctx.arg.pack_dyn_relocs_android = false;
+    } else if (read_flag("use-android-relr-tags")) {
+      ctx.arg.use_android_relr_tags = true;
+    } else if (read_flag("no-use-android-relr-tags")) {
+      ctx.arg.use_android_relr_tags = false;
    } else if (read_arg("package-metadata")) {
      ctx.arg.package_metadata = parse_package_metadata(ctx, arg);
    } else if (read_flag("stats")) {
@@ -978,20 +998,39 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.enable_new_dtags = false;
    } else if (read_flag("execute-only")) {
      ctx.arg.execute_only = true;
+    } else if (read_flag("zero-to-bss")) {
+      ctx.arg.zero_to_bss = true;
    } else if (read_arg("compress-debug-sections")) {
-      if (arg == "zlib" || arg == "zlib-gabi")
+      if (arg == "zlib" || arg == "zlib-gabi") {
        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZLIB;
-      else if (arg == "zstd")
+        ctx.arg.compress_debug_sections_level = 1;
+      } else if (arg.starts_with("zlib:")) {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZLIB;
+        i64 level = parse_number(ctx, "compress-debug-sections", arg.substr(5));
+        if (level < 0 || 9 < level)
+          Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg
+                     << " (zlib level must be between 0 and 9)";
+        ctx.arg.compress_debug_sections_level = level;
+      } else if (arg == "zstd") {
        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZSTD;
-      else if (arg == "none")
+        ctx.arg.compress_debug_sections_level = 3;
+      } else if (arg.starts_with("zstd:")) {
+        ctx.arg.compress_debug_sections = ELFCOMPRESS_ZSTD;
+        i64 level = parse_number(ctx, "compress-debug-sections", arg.substr(5));
+        if (level < 1 || 22 < level)
+          Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg
+                     << " (zstd level must be between 1 and 22)";
+        ctx.arg.compress_debug_sections_level = level;
+      } else if (arg == "none") {
        ctx.arg.compress_debug_sections = ELFCOMPRESS_NONE;
-      else
+      } else {
        Fatal(ctx) << "invalid --compress-debug-sections argument: " << arg;
+      }
    } else if (read_arg("wrap")) {
      ctx.arg.wrap.insert(arg);
    } else if (read_flag("omagic") || read_flag("N")) {
      ctx.arg.omagic = true;
-      ctx.arg.static_ = true;
+      remaining.emplace_back("--Bstatic");
    } else if (read_flag("no-omagic")) {
      ctx.arg.omagic = false;
    } else if (read_arg("oformat")) {
@@ -1014,8 +1053,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
        Fatal(ctx) << "--section-start: syntax error: " << arg;
      ctx.arg.section_start[arg.substr(0, pos)] =
        parse_hex(ctx, "section-start", arg.substr(pos + 1));
-    } else if (read_arg("section-order")) {
-      ctx.arg.section_order = parse_section_order(ctx, arg);
    } else if (read_arg("Tbss")) {
      ctx.arg.section_start[".bss"] = parse_hex(ctx, "Tbss", arg);
    } else if (read_arg("Tdata")) {
@@ -1131,6 +1168,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.fatal_warnings = true;
    } else if (read_flag("no-fatal-warnings")) {
      ctx.arg.fatal_warnings = false;
+    } else if (read_flag("w") || read_flag("no-warnings")) {
+      ctx.arg.suppress_warnings = true;
    } else if (read_flag("fork")) {
      ctx.arg.fork = true;
    } else if (read_flag("no-fork")) {
@@ -1140,9 +1179,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_flag("no-gc-sections")) {
      ctx.arg.gc_sections = false;
    } else if (read_flag("print-gc-sections")) {
-      ctx.arg.print_gc_sections = true;
+      ctx.arg.print_gc_sections = "-";
+    } else if (read_eq("print-gc-sections")) {
+      ctx.arg.print_gc_sections = arg;
    } else if (read_flag("no-print-gc-sections")) {
-      ctx.arg.print_gc_sections = false;
+      ctx.arg.print_gc_sections = "";
    } else if (read_arg("discard-section")) {
      ctx.arg.discard_section.insert(arg);
    } else if (read_arg("no-discard-section")) {
@@ -1164,12 +1205,12 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      ctx.arg.ignore_data_address_equality = true;
    } else if (read_arg("image-base")) {
      ctx.arg.image_base = parse_number(ctx, "image-base", arg);
-    } else if (read_arg("physical-image-base")) {
-      ctx.arg.physical_image_base = parse_number(ctx, "physical-image-base", arg);
    } else if (read_flag("print-icf-sections")) {
-      ctx.arg.print_icf_sections = true;
+      ctx.arg.print_icf_sections = "-";
+    } else if (read_eq("print-icf-sections")) {
+      ctx.arg.print_icf_sections = arg;
    } else if (read_flag("no-print-icf-sections")) {
-      ctx.arg.print_icf_sections = false;
+      ctx.arg.print_icf_sections = "";
    } else if (read_flag("quick-exit")) {
      ctx.arg.quick_exit = true;
    } else if (read_flag("no-quick-exit")) {
@@ -1240,7 +1281,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    } else if (read_arg("thread-count")) {
      ctx.arg.thread_count = parse_number(ctx, "thread-count", arg);
    } else if (read_flag("threads")) {
-      ctx.arg.thread_count = 0;
+      ctx.arg.thread_count.reset();
    } else if (read_flag("no-threads")) {
      ctx.arg.thread_count = 1;
    } else if (read_eq("threads")) {
@@ -1304,6 +1345,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
          << " binary file into an object file, use `objcopy -I binary -O"
          << " default <input-file> <output-file.o>` instead.";
      Fatal(ctx) << "unknown command line option: -b " << arg;
+    } else if (read_arg("fuse-ld")) {
    } else if (read_arg("auxiliary") || read_arg("f")) {
      ctx.arg.auxiliary.push_back(arg);
    } else if (read_arg("filter") || read_arg("F")) {
@@ -1398,6 +1440,22 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    }
  }

+  if (!ctx.arg.chroot.empty()) {
+    if (!ctx.arg.Map.empty())
+      ctx.arg.Map = ctx.arg.chroot + "/" + ctx.arg.Map;
+
+    if (!ctx.arg.dependency_file.empty())
+      ctx.arg.dependency_file = ctx.arg.chroot + "/" + ctx.arg.dependency_file;
+  }
+
+  if (!ctx.arg.directory.empty()) {
+    std::error_code ec;
+    std::filesystem::current_path(ctx.arg.directory, ec);
+    if (ec)
+      Fatal(ctx) << "chdir failed: " << ctx.arg.directory
+                 << ": " << ec.message();
+  }
+
  if (!ctx.arg.sysroot.empty()) {
    for (std::string &path : ctx.arg.library_paths) {
      if (std::string_view(path).starts_with('='))
@@ -1418,6 +1476,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  if (ctx.arg.pic)
    ctx.arg.image_base = 0;

+  // A shared library is loaded by the dynamic linker, so it doesn't need
+  // PT_INTERP. (-pie makes the output an executable even with -shared.)
+  if (ctx.arg.shared && !ctx.arg.pie)
+    ctx.arg.dynamic_linker = "";
+
  if (allow_shlib_undefined)
    ctx.arg.allow_shlib_undefined = *allow_shlib_undefined;
  else
@@ -1440,12 +1503,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    ctx.arg.discard_all = false;
  }

-  if (ctx.arg.relocatable)
-    ctx.arg.static_ = true;
-
-  if (ctx.arg.static_)
-    ctx.arg.dynamic_linker = "";
-
  if (ctx.arg.shuffle_sections == SHUFFLE_SECTIONS_SHUFFLE) {
    if (shuffle_sections_seed)
      ctx.arg.shuffle_sections_seed = *shuffle_sections_seed;
@@ -1454,11 +1511,8 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
        ((u64)std::random_device()() << 32) | std::random_device()();
  }

-  // --section-order implies `-z separate-loadable-segments`
  if (z_separate_code)
    ctx.arg.z_separate_code = *z_separate_code;
-  else if (!ctx.arg.section_order.empty())
-    ctx.arg.z_separate_code = SEPARATE_LOADABLE_SEGMENTS;

  // `-z dynamic-undefined-weak` is enabled by default for DSOs.
  if (z_dynamic_undefined_weak)
@@ -1466,13 +1520,10 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  else
    ctx.arg.z_dynamic_undefined_weak = ctx.arg.shared;

-  // --section-order implies `-z norelro`
  if (z_relro)
    ctx.arg.z_relro = *z_relro;
-  else if (!ctx.arg.section_order.empty())
-    ctx.arg.z_relro = false;

-  if (ctx.arg.nmagic)
+  if (ctx.arg.nmagic || ctx.arg.omagic)
    ctx.arg.z_relro = false;

  if (!ctx.arg.shared) {
@@ -1493,18 +1544,12 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
    if (ctx.arg.apply_dynamic_relocs)
      Fatal(ctx) << "--apply-dynamic-relocs may not be used on SPARC64";

-  if (!ctx.arg.section_start.empty() && !ctx.arg.section_order.empty())
-    Fatal(ctx) << "--section-start may not be used with --section-order";
-
  if (ctx.arg.image_base % ctx.page_size)
    Fatal(ctx) << "-image-base must be a multiple of -max-page-size";

  if (ctx.arg.emulation == ARM32BE::name && !ctx.arg.be8)
    Fatal(ctx) << "--be32 is not supported";

-  if (ctx.arg.thread_count == 0)
-    ctx.arg.thread_count = get_default_thread_count();
-
  if (char *env = getenv("MOLD_REPRO"); env && env[0])
    ctx.arg.repro = true;

@@ -1526,8 +1571,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
      Fatal(ctx) << "--version-script: file not found: " << path;
    };

-    ReaderContext rctx;
-    Script(ctx, rctx, open()).parse_version_script();
+    Script(ctx, open()).parse_version_script();
  }

  if (separate_debug_file) {
@@ -1544,8 +1588,6 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  if (ctx.arg.stats || ctx.arg.perf)
    ctx.arg.detach = false;

-  ctx.arg.undefined.push_back(ctx.arg.entry);
-
  for (i64 i = 0; i < ctx.arg.defsyms.size(); i++) {
    std::variant<Symbol<E> *, u64> &val = ctx.arg.defsyms[i].second;
    if (Symbol<E> **sym = std::get_if<Symbol<E> *>(&val))
@@ -1570,20 +1612,11 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
  // object file.
  ctx.overwrite_output_file = (!ctx.arg.shared && returns_etxtbsy());

-  if (!ctx.arg.chroot.empty()) {
-    if (!ctx.arg.Map.empty())
-      ctx.arg.Map = ctx.arg.chroot + "/" + ctx.arg.Map;
-
-    if (!ctx.arg.dependency_file.empty())
-      ctx.arg.dependency_file = ctx.arg.chroot + "/" + ctx.arg.dependency_file;
-  }
-
  // Mark GC root symbols
  for (Symbol<E> *sym : ctx.arg.undefined)
    sym->gc_root = true;
  for (Symbol<E> *sym : ctx.arg.require_defined)
    sym->gc_root = true;
-  ctx.arg.entry->gc_root = true;

  if (version_shown && remaining.empty())
    exit(0);
@@ -1,85 +0,0 @@
-// This file implements multi-threaded compression routines. We simply
-// create multiple compressed data blocks and concatenate them together.
-// Tools supporting compressed sections generally read compressed sections
-// until the section end to handle multiple concatenated streams.
-//
-// Using threads to compress data has a downside. Since the dictionary
-// is not shared between compressed streams, the compression ratio is
-// slightly sacrificed. However, if the stream size is large enough,
-// that loss is negligible in practice.
-
-#include "mold.h"
-
-#include <zlib.h>
-#include <zstd.h>
-
-namespace mold {
-
-Compressor::~Compressor() {
-  for (std::span<u8> shard : shards)
-    delete[] shard.data();
-}
-
-static std::vector<std::span<u8>> split(std::span<u8> input) {
-  constexpr int BLOCK_SIZE = 1024 * 1024;
-  std::vector<std::span<u8>> vec;
-  while (!input.empty()) {
-    i64 sz = std::min<i64>(BLOCK_SIZE, input.size());
-    vec.push_back(input.subspan(0, sz));
-    input = input.subspan(sz);
-  }
-  return vec;
-}
-
-static std::span<u8> zlib_compress(std::span<u8> input) {
-  // compression level; must be between 0 to 9
-  int level = Z_BEST_SPEED; // = 1
-
-  unsigned long bufsize = compressBound(input.size());
-  u8 *buf = new u8[bufsize];
-  [[maybe_unused]] int r = compress2(buf, &bufsize, input.data(),
-                                     input.size(), level);
-  assert(r == Z_OK);
-  return {buf, (size_t)bufsize};
-}
-
-static std::span<u8> zstd_compress(std::span<u8> input) {
-  // compression level; must be between 1 to 22
-  int level = ZSTD_CLEVEL_DEFAULT; // = 3
-
-  i64 bufsize = ZSTD_COMPRESSBOUND(input.size());
-  u8 *buf = new u8[bufsize];
-  size_t sz = ZSTD_compress(buf, bufsize, input.data(), input.size(), level);
-  assert(!ZSTD_isError(sz));
-  return {buf, sz};
-}
-
-Compressor::Compressor(i64 format, u8 *buf, i64 size) {
-  assert(format == ELFCOMPRESS_ZLIB || format == ELFCOMPRESS_ZSTD);
-  std::vector<std::span<u8>> inputs = split(std::span(buf, size));
-  shards.resize(inputs.size());
-
-  // Compress each shard
-  tbb::parallel_for((i64)0, (i64)inputs.size(), [&](i64 i) {
-    if (format == ELFCOMPRESS_ZLIB)
-      shards[i] = zlib_compress(inputs[i]);
-    else
-      shards[i] = zstd_compress(inputs[i]);
-  });
-
-  compressed_size = 0;
-  for (std::span<u8> &shard : shards)
-    compressed_size += shard.size();
-}
-
-void Compressor::write_to(u8 *buf) {
-  std::vector<i64> offsets(shards.size());
-  for (i64 i = 1; i < shards.size(); i++)
-    offsets[i] = offsets[i - 1] + shards[i - 1].size();
-
-  tbb::parallel_for((i64)0, (i64)shards.size(), [&](i64 i) {
-    memcpy(buf + offsets[i], shards[i].data(), shards[i].size());
-  });
-}
-
-} // namespace mold
@@ -161,6 +161,7 @@ std::string rel_to_string<ARM64LE>(u32 r_type) {
  CASE(R_AARCH64_LD64_GOT_LO12_NC);
  CASE(R_AARCH64_LD64_GOTPAGE_LO15);
  CASE(R_AARCH64_PLT32);
+  CASE(R_AARCH64_GOTPCREL32);
  CASE(R_AARCH64_TLSGD_ADR_PREL21);
  CASE(R_AARCH64_TLSGD_ADR_PAGE21);
  CASE(R_AARCH64_TLSGD_ADD_LO12_NC);
@@ -81,7 +81,11 @@ enum : u32 {
  SHT_RELR = 19,
  SHT_CREL = 0x40000014,
  SHT_LOOS = 0x60000000,
+  SHT_ANDROID_REL = 0x60000001,
+  SHT_ANDROID_RELA = 0x60000002,
  SHT_LLVM_ADDRSIG = 0x6fff4c03,
+  SHT_ANDROID_RELR = 0x6fffff00,
+  SHT_GNU_SFRAME = 0x6ffffff4,
  SHT_GNU_HASH = 0x6ffffff6,
  SHT_GNU_VERDEF = 0x6ffffffd,
  SHT_GNU_VERNEED = 0x6ffffffe,
@@ -191,6 +195,7 @@ enum : u32 {
  PT_GNU_STACK = 0x6474e551,
  PT_GNU_RELRO = 0x6474e552,
  PT_GNU_PROPERTY = 0x6474e553,
+  PT_GNU_SFRAME = 0x6474e554,
  PT_OPENBSD_RANDOMIZE = 0x65a3dbe6,
  PT_ARM_EXIDX = 0x70000001,
  PT_RISCV_ATTRIBUTES = 0x70000003,
@@ -285,6 +290,13 @@ enum : u32 {
  DT_RELRSZ = 35,
  DT_RELR = 36,
  DT_RELRENT = 37,
+  DT_ANDROID_REL = 0x6000000f,
+  DT_ANDROID_RELSZ = 0x60000010,
+  DT_ANDROID_RELA = 0x60000011,
+  DT_ANDROID_RELASZ = 0x60000012,
+  DT_ANDROID_RELR = 0x6fffe000,
+  DT_ANDROID_RELRSZ = 0x6fffe001,
+  DT_ANDROID_RELRENT = 0x6fffe003,
  DT_GNU_HASH = 0x6ffffef5,
  DT_DEPAUDIT = 0x6ffffefb,
  DT_AUDIT = 0x6ffffefc,
@@ -557,6 +569,7 @@ enum : u32 {
  R_AARCH64_LD64_GOT_LO12_NC = 0x138,
  R_AARCH64_LD64_GOTPAGE_LO15 = 0x139,
  R_AARCH64_PLT32 = 0x13a,
+  R_AARCH64_GOTPCREL32 = 0x13b,
  R_AARCH64_TLSGD_ADR_PREL21 = 0x200,
  R_AARCH64_TLSGD_ADR_PAGE21 = 0x201,
  R_AARCH64_TLSGD_ADD_LO12_NC = 0x202,
@@ -807,6 +820,7 @@ enum : u32 {
  R_RISCV_SET8 = 54,
  R_RISCV_SET16 = 55,
  R_RISCV_SET32 = 56,
+  R_RISCV_GOT32_PCREL = 41,
  R_RISCV_32_PCREL = 57,
  R_RISCV_IRELATIVE = 58,
  R_RISCV_PLT32 = 59,
@@ -1491,6 +1505,52 @@ template <typename E> using U64 = std::conditional_t<E::is_le, ul64, ub64>;
 template <typename E> using Word = std::conditional_t<E::is_64, U64<E>, U32<E>>;
 template <typename E> using SWord = std::conditional_t<E::is_64, I64<E>, I32<E>>;

+//
+// SFrame is a simple unwind information format used as a lightweight
+// alternative to .eh_frame. A .sframe section consists of a header, an
+// array of Function Descriptor Entries (FDEs) sorted by PC, and a blob
+// of Frame Row Entries (FREs). mold understands SFrame Version 3.
+//
+// https://sourceware.org/binutils/docs/sframe-spec.html
+//
+
+static constexpr u16 SFRAME_MAGIC = 0xdee2;
+
+static constexpr u8 SFRAME_F_FDE_SORTED = 0x1;
+static constexpr u8 SFRAME_F_FRAME_POINTER = 0x2;
+static constexpr u8 SFRAME_F_FDE_FUNC_START_PCREL = 0x4;
+
+static constexpr u8 SFRAME_ABI_AARCH64_ENDIAN_BIG = 1;
+static constexpr u8 SFRAME_ABI_AARCH64_ENDIAN_LITTLE = 2;
+static constexpr u8 SFRAME_ABI_AMD64_ENDIAN_LITTLE = 3;
+static constexpr u8 SFRAME_ABI_S390X_ENDIAN_BIG = 4;
+
+template <typename E>
+struct SFrameHeader {
+  U16<E> magic;
+  u8 version;
+  u8 flags;
+  u8 abi_arch;
+  i8 cfa_fixed_fp_offset;
+  i8 cfa_fixed_ra_offset;
+  u8 auxhdr_len;
+  U32<E> num_fdes;
+  U32<E> num_fres;
+  U32<E> fre_len;
+  U32<E> fdeoff;
+  U32<E> freoff;
+};
+
+// The index part of an SFrame Version 3 FDE. The func_start_offset field
+// is PC-relative (relative to its own address) when the section flag
+// SFRAME_F_FDE_FUNC_START_PCREL is set, which is how mold always emits it.
+template <typename E>
+struct SFrameFdeIdx {
+  I64<E> func_start_offset;
+  U32<E> func_size;
+  U32<E> func_start_fre_off;
+};
+
 template <typename E> requires E::is_64
 struct ElfSym<E> {
  bool is_undef() const { return st_shndx == SHN_UNDEF; }
@@ -1807,6 +1867,7 @@ struct ElfRel<SH4BE> {

 template <typename E> concept supports_ifunc = requires { E::R_IRELATIVE; };
 template <typename E> concept supports_tlsdesc = requires { E::R_TLSDESC; };
+template <typename E> concept supports_sframe = requires { E::sframe_abi; };
 template <typename E> concept needs_thunk = requires { E::thunk_size; };

 template <typename E> concept is_x86_64 = std::same_as<E, X86_64>;
@@ -1850,10 +1911,11 @@ struct X86_64 {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 4096;
  static constexpr u32 e_machine = EM_X86_64;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AMD64_ENDIAN_LITTLE;
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0xcc }; // int3
+  static constexpr u8 trap[] = { 0xcc }; // int3

  static constexpr u32 R_COPY = R_X86_64_COPY;
  static constexpr u32 R_GLOB_DAT = R_X86_64_GLOB_DAT;
@@ -1865,6 +1927,7 @@ struct X86_64 {
  static constexpr u32 R_TPOFF = R_X86_64_TPOFF64;
  static constexpr u32 R_DTPMOD = R_X86_64_DTPMOD64;
  static constexpr u32 R_TLSDESC = R_X86_64_TLSDESC;
+  static constexpr u32 R_SFRAME = R_X86_64_PC64;
  static constexpr u32 R_FUNCALL[] = { R_X86_64_PLT32, R_X86_64_PLTOFF64 };
 };

@@ -1878,7 +1941,7 @@ struct I386 {
  static constexpr u32 plt_hdr_size = 16;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0xcc }; // int3
+  static constexpr u8 trap[] = { 0xcc }; // int3

  static constexpr u32 R_COPY = R_386_COPY;
  static constexpr u32 R_GLOB_DAT = R_386_GLOB_DAT;
@@ -1900,12 +1963,13 @@ struct ARM64LE {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 65536;
  static constexpr u32 e_machine = EM_AARCH64;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AARCH64_ENDIAN_LITTLE;
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
  static constexpr u32 thunk_hdr_size = 0;
-  static constexpr u32 thunk_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x7d, 0x20, 0xd4 }; // brk
+  static constexpr u32 thunk_size = 32;
+  static constexpr u8 trap[] = { 0x00, 0x7d, 0x20, 0xd4 }; // brk

  static constexpr u32 R_COPY = R_AARCH64_COPY;
  static constexpr u32 R_GLOB_DAT = R_AARCH64_GLOB_DAT;
@@ -1917,12 +1981,14 @@ struct ARM64LE {
  static constexpr u32 R_TPOFF = R_AARCH64_TLS_TPREL64;
  static constexpr u32 R_DTPMOD = R_AARCH64_TLS_DTPMOD64;
  static constexpr u32 R_TLSDESC = R_AARCH64_TLSDESC;
+  static constexpr u32 R_SFRAME = R_AARCH64_PREL64;
  static constexpr u32 R_FUNCALL[] = { R_AARCH64_JUMP26, R_AARCH64_CALL26 };
 };

 struct ARM64BE : ARM64LE {
  static constexpr std::string_view name = "arm64be";
  static constexpr bool is_le = false;
+  static constexpr u8 sframe_abi = SFRAME_ABI_AARCH64_ENDIAN_BIG;
 };

 struct ARM32LE {
@@ -1937,7 +2003,7 @@ struct ARM32LE {
  static constexpr u32 pltgot_size = 16;
  static constexpr u32 thunk_hdr_size = 16;
  static constexpr u32 thunk_size = 16;
-  static constexpr u8 filler[] = { 0xff, 0xde }; // udf
+  static constexpr u8 trap[] = { 0xff, 0xde }; // udf

  static constexpr u32 R_COPY = R_ARM_COPY;
  static constexpr u32 R_GLOB_DAT = R_ARM_GLOB_DAT;
@@ -1970,7 +2036,7 @@ struct RV64LE {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x02, 0x90 }; // c.ebreak
+  static constexpr u8 trap[] = { 0x02, 0x90 }; // c.ebreak

  static constexpr u32 R_COPY = R_RISCV_COPY;
  static constexpr u32 R_GLOB_DAT = R_RISCV_64;
@@ -2000,7 +2066,7 @@ struct RV32LE {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x02, 0x90 }; // c.ebreak
+  static constexpr u8 trap[] = { 0x02, 0x90 }; // c.ebreak

  static constexpr u32 R_COPY = R_RISCV_COPY;
  static constexpr u32 R_GLOB_DAT = R_RISCV_32;
@@ -2032,7 +2098,7 @@ struct PPC32 {
  static constexpr u32 pltgot_size = 36;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 36;
-  static constexpr u8 filler[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
+  static constexpr u8 trap[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap

  static constexpr u32 R_COPY = R_PPC_COPY;
  static constexpr u32 R_GLOB_DAT = R_PPC_GLOB_DAT;
@@ -2074,7 +2140,7 @@ struct PPC64V1 : PPC64 {
  static constexpr u32 pltgot_size = 0;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 28;
-  static constexpr u8 filler[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
+  static constexpr u8 trap[] = { 0x7f, 0xe0, 0x00, 0x08 }; // trap
 };

 struct PPC64V2 : PPC64 {
@@ -2085,7 +2151,7 @@ struct PPC64V2 : PPC64 {
  static constexpr u32 pltgot_size = 0;
  static constexpr u32 thunk_hdr_size = 0;
  static constexpr u32 thunk_size = 24;
-  static constexpr u8 filler[] = { 0x08, 0x00, 0xe0, 0x7f }; // trap
+  static constexpr u8 trap[] = { 0x08, 0x00, 0xe0, 0x7f }; // trap
 };

 struct S390X {
@@ -2095,10 +2161,11 @@ struct S390X {
  static constexpr bool is_rela = true;
  static constexpr u32 page_size = 4096;
  static constexpr u32 e_machine = EM_S390X;
+  static constexpr u8 sframe_abi = SFRAME_ABI_S390X_ENDIAN_BIG;
  static constexpr u32 plt_hdr_size = 48;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x07, 0x00 }; // nop
+  static constexpr u8 trap[] = { 0x00, 0x00 }; // invalid

  static constexpr u32 R_COPY = R_390_COPY;
  static constexpr u32 R_GLOB_DAT = R_390_GLOB_DAT;
@@ -2109,6 +2176,7 @@ struct S390X {
  static constexpr u32 R_DTPOFF = R_390_TLS_DTPOFF;
  static constexpr u32 R_TPOFF = R_390_TLS_TPOFF;
  static constexpr u32 R_DTPMOD = R_390_TLS_DTPMOD;
+  static constexpr u32 R_SFRAME = R_390_PC64;
  static constexpr u32 R_FUNCALL[] = { R_390_PLT32DBL };
 };

@@ -2122,7 +2190,7 @@ struct SPARC64 {
  static constexpr u32 plt_hdr_size = 128;
  static constexpr u32 plt_size = 32;
  static constexpr u32 pltgot_size = 32;
-  static constexpr u8 filler[] = { 0x91, 0xd0, 0x20, 0x05 }; // ta 5
+  static constexpr u8 trap[] = { 0x91, 0xd0, 0x20, 0x05 }; // ta 5

  static constexpr u32 R_COPY = R_SPARC_COPY;
  static constexpr u32 R_GLOB_DAT = R_SPARC_GLOB_DAT;
@@ -2146,7 +2214,7 @@ struct M68K {
  static constexpr u32 plt_hdr_size = 18;
  static constexpr u32 plt_size = 14;
  static constexpr u32 pltgot_size = 8;
-  static constexpr u8 filler[] = { 0x4a, 0xfc }; // illegal
+  static constexpr u8 trap[] = { 0x4a, 0xfc }; // illegal

  static constexpr u32 R_COPY = R_68K_COPY;
  static constexpr u32 R_GLOB_DAT = R_68K_GLOB_DAT;
@@ -2169,7 +2237,7 @@ struct SH4LE {
  static constexpr u32 plt_hdr_size = 16;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 12;
-  static constexpr u8 filler[] = { 0x00, 0x90 }; // nop
+  static constexpr u8 trap[] = { 0xfd, 0xff }; // illegal

  static constexpr u32 R_COPY = R_SH_COPY;
  static constexpr u32 R_GLOB_DAT = R_SH_GLOB_DAT;
@@ -2185,7 +2253,7 @@ struct SH4LE {
 struct SH4BE : SH4LE {
  static constexpr std::string_view name = "sh4be";
  static constexpr bool is_le = false;
-  static constexpr u8 filler[] = { 0x90, 0x00 }; // nop
+  static constexpr u8 trap[] = { 0xff, 0xfd }; // illegal
 };

 struct LOONGARCH64 {
@@ -2198,7 +2266,7 @@ struct LOONGARCH64 {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0
+  static constexpr u8 trap[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0

  static constexpr u32 R_COPY = R_LARCH_COPY;
  static constexpr u32 R_GLOB_DAT = R_LARCH_64;
@@ -2223,7 +2291,7 @@ struct LOONGARCH32 {
  static constexpr u32 plt_hdr_size = 32;
  static constexpr u32 plt_size = 16;
  static constexpr u32 pltgot_size = 16;
-  static constexpr u8 filler[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0
+  static constexpr u8 trap[] = { 0x00, 0x00, 0x2a, 0x00 }; // break 0

  static constexpr u32 R_COPY = R_LARCH_COPY;
  static constexpr u32 R_GLOB_DAT = R_LARCH_32;
@@ -28,5 +28,5 @@ int main(int argc, char **argv) {
  mi_option_disable(mi_option_show_errors);
 #endif

-  return mold::mold_main<mold::X86_64>(argc, argv);
+  return mold::mold_main<mold::MOLD_FIRST_TARGET>(argc, argv);
 }
@@ -13,7 +13,7 @@ static bool is_text_file(MappedFile *mf) {
 }

 template <typename E>
-static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
+static bool is_gcc_lto_obj(MappedFile *mf, bool has_gcc_plugin) {
  const char *data = mf->get_contents().data();
  ElfEhdr<E> &ehdr = *(ElfEhdr<E> *)data;
  ElfShdr<E> *sh_begin = (ElfShdr<E> *)(data + ehdr.e_shoff);
@@ -30,7 +30,7 @@ static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
    // the LTO linker plugin is available and falls back as regular
    // objects otherwise. GCC FAT LTO object can be identified by the
    // presence of `.gcc.lto_.symtab` section.
-    if (has_plugin) {
+    if (has_gcc_plugin) {
      std::string_view name = data + shdrs[shstrtab_idx].sh_offset + sec.sh_name;
      if (name.starts_with(".gnu.lto_.symtab."))
        return true;
@@ -68,11 +68,15 @@ static bool is_gcc_lto_obj(MappedFile *mf, bool has_plugin) {
 template <typename E>
 FileType get_file_type(Context<E> &ctx, MappedFile *mf) {
  std::string_view data = mf->get_contents();
-  bool has_plugin = !ctx.arg.plugin.empty();
-
  if (data.empty())
    return FileType::EMPTY;

+  // GCC FAT LTO objects can be linked as regular ELF objects. If the active
+  // plugin is LLVM's, treat them as regular objects so that we can fall back
+  // to native code instead of routing them through GCC LTO handling.
+  bool has_gcc_plugin = !ctx.arg.plugin.empty() &&
+                        ctx.arg.plugin.find("LLVMgold.") == std::string_view::npos;
+
  if (data.starts_with("\177ELF")) {
    u8 byte_order = ((ElfEhdr<I386> *)data.data())->e_ident[EI_DATA];

@@ -81,10 +85,10 @@ FileType get_file_type(Context<E> &ctx, MappedFile *mf) {

      if (ehdr.e_type == ET_REL) {
        if (ehdr.e_ident[EI_CLASS] == ELFCLASS32) {
-          if (is_gcc_lto_obj<I386>(mf, has_plugin))
+          if (is_gcc_lto_obj<I386>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        } else {
-          if (is_gcc_lto_obj<X86_64>(mf, has_plugin))
+          if (is_gcc_lto_obj<X86_64>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        }
        return FileType::ELF_OBJ;
@@ -97,10 +101,10 @@ FileType get_file_type(Context<E> &ctx, MappedFile *mf) {

      if (ehdr.e_type == ET_REL) {
        if (ehdr.e_ident[EI_CLASS] == ELFCLASS32) {
-          if (is_gcc_lto_obj<M68K>(mf, has_plugin))
+          if (is_gcc_lto_obj<M68K>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        } else {
-          if (is_gcc_lto_obj<SPARC64>(mf, has_plugin))
+          if (is_gcc_lto_obj<SPARC64>(mf, has_gcc_plugin))
            return FileType::GCC_LTO_OBJ;
        }
        return FileType::ELF_OBJ;
@@ -187,7 +191,7 @@ get_machine_type(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
        return get_elf_type(child->data);
    return "";
  case FileType::TEXT:
-    return Script(ctx, rctx, mf).get_script_output_type();
+    return Script(ctx, mf, &rctx).get_script_output_type();
  default:
    return "";
  }
@@ -4,31 +4,58 @@

 #include "mold.h"

+#include <fstream>
+#include <tbb/concurrent_unordered_map.h>
 #include <tbb/concurrent_vector.h>
 #include <tbb/parallel_for_each.h>

 namespace mold {

 template <typename E>
-static bool should_keep(const InputSection<E> &isec) {
+static bool should_keep(Context<E> &ctx, const InputSection<E> &isec) {
  u32 type = isec.shdr().sh_type;
  u32 flags = isec.shdr().sh_flags;
-  std::string_view name = isec.name();
-
  if constexpr (is_ppc32<E>)
-    if (name == ".got2")
+    if (isec.name == ".got2")
      return true;

+  // KEEP'ed by a linker script
+  if (!isec.file.script_match.empty()) {
+    i32 rank = isec.file.script_match[isec.shndx];
+    if (rank != -1 && ctx.script_ranks[rank].keep)
+      return true;
+  }
+
  return (flags & SHF_GNU_RETAIN) ||
         type == SHT_NOTE ||
         type == SHT_INIT_ARRAY ||
         type == SHT_FINI_ARRAY ||
         type == SHT_PREINIT_ARRAY ||
-         name.starts_with(".ctors") ||
-         name.starts_with(".dtors") ||
-         name.starts_with(".init") ||
-         name.starts_with(".fini") ||
-         is_c_identifier(name);
+         isec.name.starts_with(".ctors") ||
+         isec.name.starts_with(".dtors") ||
+         isec.name.starts_with(".init") ||
+         isec.name.starts_with(".fini");
+}
+
+// Sections whose names are valid C identifiers can be referenced via
+// __start_<name>/__stop_<name> symbols, which the linker synthesizes.
+// Such sections must be kept alive only if such a marker symbol is
+// referenced from a live section. This map lets us find all sections
+// of a given name when we encounter such a reference during marking.
+template <typename E>
+using StartStopMap =
+  tbb::concurrent_unordered_multimap<std::string_view, InputSection<E> *>;
+
+template <typename E>
+static StartStopMap<E> build_start_stop_map(Context<E> &ctx) {
+  StartStopMap<E> map;
+  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
+    for (std::unique_ptr<InputSection<E>> &isec : file->sections)
+      if (isec && isec->is_alive && (isec->shdr().sh_flags & SHF_ALLOC) &&
+          is_c_identifier(isec->name))
+        map.insert({isec->name, isec.get()});
+  });
+  return map;
 }

 template <typename E>
@@ -66,11 +93,12 @@ collect_root_set(Context<E> &ctx) {
      // reduce the amount of non-memory-mapped segments, you should
      // use `strip` command, compile without debug info or use
      // --strip-all linker option.
-      u32 flags = isec->shdr().sh_flags;
-      if (!(flags & SHF_ALLOC))
+      if (!(isec->shdr().sh_flags & SHF_ALLOC)) {
        isec->is_visited = true;
+        continue;
+      }

-      if (should_keep(*isec))
+      if (should_keep(ctx, *isec))
        enqueue_section(isec.get());
    }
  });
@@ -94,9 +122,18 @@ collect_root_set(Context<E> &ctx) {
  return rootset;
 }

+static std::string_view start_stop_name(std::string_view sym) {
+  if (sym.starts_with("__start_"))
+    return sym.substr(8);
+  if (sym.starts_with("__stop_"))
+    return sym.substr(7);
+  return "";
+}
+
 template <typename E>
-static void visit(Context<E> &ctx, InputSection<E> *isec,
-                  tbb::feeder<InputSection<E> *> &feeder, i64 depth) {
+static void visit_section(Context<E> &ctx, InputSection<E> *isec,
+                          tbb::feeder<InputSection<E> *> &feeder, i64 depth,
+                          const StartStopMap<E> &start_stop_map) {
  assert(isec->is_visited);

  // Mark a section alive. For better performacne, we don't call
@@ -104,7 +141,7 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
  auto mark = [&](InputSection<E> *sec) {
    if (mark_section(sec)) {
      if (depth < 3)
-        visit(ctx, sec, feeder, depth + 1);
+        visit_section(ctx, sec, feeder, depth + 1, start_stop_map);
      else
        feeder.add(sec);
    }
@@ -121,10 +158,21 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
  for (const ElfRel<E> &rel : isec->get_rels(ctx)) {
    // Symbol can refer to either a section fragment or an input section.
    Symbol<E> &sym = *isec->file.symbols[rel.r_sym];
-    if (SectionFragment<E> *frag = sym.get_frag())
+    if (SectionFragment<E> *frag = sym.get_frag()) {
      frag->is_alive = true;
-    else
-      mark(sym.get_input_section());
+      continue;
+    }
+
+    mark(sym.get_input_section());
+
+    // A reference to __start_<name> or __stop_<name> keeps every section
+    // named <name> alive, mirroring how those symbols are defined.
+    if (std::string_view sec = start_stop_name(sym.name());
+        !sec.empty()) {
+      auto [i, end] = start_stop_map.equal_range(sec);
+      for (; i != end; ++i)
+        mark(i->second);
+    }
  }

  if constexpr (is_arm32<E>)
@@ -134,12 +182,13 @@ static void visit(Context<E> &ctx, InputSection<E> *isec,
 // Mark all reachable sections
 template <typename E>
 static void mark(Context<E> &ctx,
-                 tbb::concurrent_vector<InputSection<E> *> &rootset) {
+                 tbb::concurrent_vector<InputSection<E> *> &rootset,
+                 const StartStopMap<E> &start_stop_map) {
  Timer t(ctx, "mark");

  tbb::parallel_for_each(rootset, [&](InputSection<E> *isec,
                                      tbb::feeder<InputSection<E> *> &feeder) {
-    visit(ctx, isec, feeder, 0);
+    visit_section(ctx, isec, feeder, 0, start_stop_map);
  });
 }

@@ -147,25 +196,49 @@ static void mark(Context<E> &ctx,
 template <typename E>
 static void sweep(Context<E> &ctx) {
  Timer t(ctx, "sweep");
-  static Counter counter("garbage_sections");

-  tbb::parallel_for_each(ctx.objs, [&](ObjectFile<E> *file) {
-    for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+  std::vector<std::vector<InputSection<E> *>> sections(ctx.objs.size());
+
+  tbb::parallel_for((i64)0, (i64)ctx.objs.size(), [&](i64 i) {
+    ObjectFile<E> &file = *ctx.objs[i];
+
+    for (std::unique_ptr<InputSection<E>> &isec : file.sections) {
      if (isec && isec->is_alive && !isec->is_visited) {
-        if (ctx.arg.print_gc_sections)
-          Out(ctx) << "removing unused section " << *isec;
        isec->kill();
-        counter++;
+        sections[i].push_back(isec.get());
      }
    }
  });
+
+  std::string &path = ctx.arg.print_gc_sections;
+
+  if (!path.empty()) {
+    std::ostream *out = &std::cout;
+    std::ofstream file;
+
+    if (path != "-") {
+      file.open(path);
+      if (file.fail())
+        Fatal(ctx) << "--print-gc-sections: cannot open " << path << ": "
+                   << errno_string();
+      out = &file;
+    }
+
+    i64 saved_bytes = 0;
+    for (std::span<InputSection<E> *> vec : sections)
+      for (InputSection<E> *isec : vec)
+        *out << "removing unused section " << *isec << '\n';
+
+    *out << "GC saved " << saved_bytes << " bytes\n";
+  }
 }

 template <typename E>
 void gc_sections(Context<E> &ctx) {
  Timer t(ctx, "gc");
  tbb::concurrent_vector<InputSection<E> *> rootset = collect_root_set(ctx);
-  mark(ctx, rootset);
+  StartStopMap<E> start_stop_map = build_start_stop_map(ctx);
+  mark(ctx, rootset, start_stop_map);
  sweep(ctx);
 }

@@ -456,11 +456,8 @@ read_address_ranges(Context<E> &ctx, const Compunit &cu) {
        Fatal(ctx) << "--gdb-index: missing DW_AT_rnglists_base";

      u8 *base = buf + rnglists_base;
-      i64 num_offsets = *(U32<E> *)(base - 4);
      Offset *offsets = (Offset *)base;
-
-      for (i64 i = 0; i < num_offsets; i++)
-        read_rnglist_range<E>(vec, base + offsets[i], addrx, low_pc.value);
+      read_rnglist_range<E>(vec, base + offsets[ranges.value], addrx, low_pc.value);
    }
    return vec;
  }
@@ -715,9 +712,11 @@ void write_gdb_index(Context<E> &ctx) {

  i64 bufsize = hdr.const_pool_offset + offset;

-  // Allocate an output buffer
-  ctx.output_file->buf2.resize(bufsize);
-  u8 *buf = ctx.output_file->buf2.data();
+  // Allocate an output buffer. We use malloc instead of vector to
+  // avoid zero-initializing the entire buffer.
+  ctx.output_file->buf2 = (u8 *)malloc(bufsize);
+  ctx.output_file->buf2_size = bufsize;
+  u8 *buf = ctx.output_file->buf2;

  // Write a section header
  memcpy(buf, &hdr, sizeof(hdr));
@@ -732,18 +731,25 @@ void write_gdb_index(Context<E> &ctx) {
  }

  // Write address areas
-  for (i64 i = 0; i < cus.size(); i++) {
-    for (std::pair<u64, u64> range : cus[i].ranges) {
+  std::vector<i64> range_offsets(cus.size());
+  for (i64 i = 1; i < cus.size(); i++)
+    range_offsets[i] = range_offsets[i - 1] + cus[i - 1].ranges.size() * 20;
+
+  tbb::parallel_for_each(cus, [&](Compunit &cu) {
+    i64 i = &cu - cus.data();
+    u8 *p = buf + hdr.ranges_offset + range_offsets[i];
+    for (std::pair<u64, u64> range : cu.ranges) {
      *(ul64 *)p = range.first;
      *(ul64 *)(p + 8) = range.second;
      *(ul32 *)(p + 16) = i;
      p += 20;
    }
-  }
+  });

  // Write a symbol table
  u32 mask = ht_size - 1;
  ul32 *ht = (ul32 *)(buf + hdr.symtab_offset);
+  memset(ht, 0, ht_size * 8);

  for (Entry *ent : entries) {
    u32 hash = ent->value.gdb_hash;
@@ -757,22 +763,35 @@ void write_gdb_index(Context<E> &ctx) {
    ht[j * 2 + 1] = ent->value.type_offset;
  }

-  // Write types
-  for (i64 i = 0; i < cus.size(); i++) {
-    Compunit &cu = cus[i];
-    u8 *base = buf + hdr.const_pool_offset;
+  // Write types. Use MapValue::count as an atomic slot counter.
+  u8 *base = buf + hdr.const_pool_offset;

+  for (Entry *ent : entries)
+    ent->value.count = 0;
+
+  tbb::parallel_for_each(cus, [&](Compunit &cu) {
+    i64 i = &cu - cus.data();
    for (i64 j = 0; j < cu.nametypes.size(); j++) {
-      ul32 *p = (ul32 *)(base + cu.entries[j]->type_offset);
-      i64 idx = ++p[0];
+      MapValue *ent = cu.entries[j];
+      ul32 *p = (ul32 *)(base + ent->type_offset);
+      i64 idx = ++ent->count;
      p[idx] = (cu.nametypes[j].type << 24) | i;
    }
-  }
+  });
+
+  // Write the final counts into the buffer.
+  tbb::parallel_for_each(entries, [&](Entry *ent) {
+    ul32 *p = (ul32 *)(base + ent->value.type_offset);
+    p[0] = ent->value.count;
+    // Sort entries for deterministic output
+    std::sort(p + 1, p + 1 + ent->value.count);
+  });

  // Write names
  tbb::parallel_for_each(entries, [&](Entry *ent) {
-    memcpy(buf + hdr.const_pool_offset + ent->value.name_offset,
-           ent->key, ent->keylen);
+    u8 *dst = buf + hdr.const_pool_offset + ent->value.name_offset;
+    memcpy(dst, ent->key, ent->keylen);
+    dst[ent->keylen] = '\0';
  });

  // Update the section size and rewrite the section header
@@ -69,6 +69,7 @@

 #include <array>
 #include <cstdio>
+#include <fstream>
 #include <tbb/concurrent_unordered_map.h>
 #include <tbb/concurrent_vector.h>
 #include <tbb/enumerable_thread_specific.h>
@@ -122,18 +123,24 @@ static void uniquify_cies(Context<E> &ctx) {
 template <typename E>
 static bool is_eligible(Context<E> &ctx, InputSection<E> &isec) {
  const ElfShdr<E> &shdr = isec.shdr();
-  std::string_view name = isec.name();

  if (shdr.sh_size == 0 || !(shdr.sh_flags & SHF_ALLOC) ||
-      shdr.sh_type == SHT_NOBITS || is_c_identifier(name))
+      shdr.sh_type == SHT_NOBITS || is_c_identifier(isec.name))
    return false;

  if (shdr.sh_flags & SHF_EXECINSTR)
    return (ctx.arg.icf_all || !isec.address_taken) &&
-           name != ".init" && name != ".fini";
+           isec.name != ".init" && isec.name != ".fini";
+
+  // .gcc_except_table contains a compiler-generated table. Pointer
+  // equality for the section is not significant because only the C++
+  // exception handling code will use the table at runtime.
+  if (isec.name == ".gcc_except_table" ||
+      isec.name.starts_with(".gcc_except_table."))
+    return true;

  bool is_readonly = !(shdr.sh_flags & SHF_WRITE);
-  bool is_relro = isec.name().starts_with(".data.rel.ro");
+  bool is_relro = isec.name.starts_with(".data.rel.ro");
  return (ctx.arg.ignore_data_address_equality || !isec.address_taken) &&
         (is_readonly || is_relro);
 }
@@ -248,7 +255,7 @@ static Digest compute_digest(Context<E> &ctx, InputSection<E> &isec) {
  auto hash_symbol = [&](Symbol<E> &sym) {
    InputSection<E> *isec = sym.get_input_section();

-    if (!sym.file) {
+    if (!sym.file || sym.is_imported) {
      hash('1');
      hash((u64)&sym);
    } else if (SectionFragment<E> *frag = sym.get_frag()) {
@@ -472,24 +479,32 @@ static void print_icf_sections(Context<E> &ctx) {
                       return a->get_priority() < b->get_priority();
                     });

+  std::ostream *out = &std::cout;
+  std::ofstream file;
+
+  std::string &path = ctx.arg.print_icf_sections;
+  if (path != "-") {
+    file.open(path);
+    if (file.fail())
+      Fatal(ctx) << "--print-icf-sections: cannot open " << path << ": "
+                 << errno_string();
+    out = &file;
+  }
+
  i64 saved_bytes = 0;

  for (InputSection<E> *leader : leaders) {
    auto [begin, end] = map.equal_range(leader);
-    if (begin == end)
-      continue;
-
-    Out(ctx) << "selected section " << *leader;
-
-    i64 n = 0;
-    for (auto it = begin; it != end; it++) {
-      Out(ctx) << "  removing identical section " << *it->second;
-      n++;
+    if (begin != end) {
+      *out << "selected section " << *leader << '\n';
+      for (auto it = begin; it != end; it++) {
+        *out << "  removing identical section " << *it->second << '\n';
+        saved_bytes += leader->contents.size();
+      }
    }
-    saved_bytes += leader->contents.size() * n;
  }

-  Out(ctx) << "ICF saved " << saved_bytes << " bytes";
+  *out << "ICF saved " << saved_bytes << " bytes\n";
 }

 template <typename E>
@@ -596,9 +611,21 @@ void icf_sections(Context<E> &ctx) {
    ctx.on_exit.push_back([=] { delete map; });
  }

-  if (ctx.arg.print_icf_sections)
+  if (!ctx.arg.print_icf_sections.empty())
    print_icf_sections(ctx);

+  // Update alignment of leaders.
+  {
+    Timer t(ctx, "update_alignment");
+    tbb::parallel_for_each(ctx.objs, [](ObjectFile<E> *file) {
+      for (std::unique_ptr<InputSection<E>> &isec : file->sections) {
+        if (isec && isec->is_alive && isec->leader && isec->leader != isec.get()) {
+          update_maximum(isec->leader->p2align, isec->p2align);
+        }
+      }
+    });
+  }
+
  // Eliminate duplicate sections.
  // Symbols pointing to eliminated sections will be redirected on the fly when
  // exporting to the symtab.
@@ -93,6 +93,15 @@ InputFile<E>::InputFile(Context<E> &ctx, MappedFile *mf)
  shstrtab = this->get_string(ctx, shstrtab_idx);
 }

+template <typename E>
+void InputFile<E>::populate_symbol_names() {
+  symbol_names.reserve(elf_syms.size());
+  for (const ElfSym<E> &esym : elf_syms) {
+    const char *p = symbol_strtab.data() + esym.st_name;
+    symbol_names.emplace_back(p, strlen(p));
+  }
+}
+
 template <typename E>
 ElfShdr<E> *InputFile<E>::find_section(i64 type) {
  for (ElfShdr<E> &sec : elf_sections)
@@ -329,7 +338,7 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
        signature = this->shstrtab.data() +
                    this->elf_sections[get_shndx(esym)].sh_name;
      } else {
-        signature = this->symbol_strtab.data() + esym.st_name;
+        signature = this->symbol_names[shdr.sh_info];
      }

      // Ignore a broken comdat group GCC emits for .debug_macros.
@@ -449,6 +458,10 @@ void ObjectFile<E>::initialize_sections(Context<E> &ctx) {
      if (name == ".eh_frame")
        eh_frame_sections.push_back(isec);

+      if constexpr (supports_sframe<E>)
+        if (name == ".sframe")
+          sframe_sections.push_back(isec);
+
      if (name == ".debug_info" && !(shdr.sh_flags & SHF_ALLOC))
        debug_info = isec;

@@ -624,6 +637,96 @@ void ObjectFile<E>::parse_ehframe(Context<E> &ctx) {
  }
 }

+// Returns the byte length of the SFrame FRE block at offset `offset`:
+// a 5-byte attribute header followed by a series of frame row
+// entries, each of which is a start address (whose width is given by
+// the attribute header), a one-byte info field and a number of
+// variable-width data words encoded in that info field.
+template <typename E>
+static i64 sframe_fre_block_size(std::string_view data, i64 offset) {
+  const u8 *attr = (const u8 *)data.data() + offset;
+  i64 num_fres = *(U16<E> *)attr;
+  i64 addr_size = 1 << bits(attr[2], 3, 0);
+
+  i64 p = offset + 5;
+  for (i64 i = 0; i < num_fres; i++) {
+    u8 info = data[p + addr_size];
+    i64 num_words = bits(info, 4, 1);
+    i64 word_size = 1 << bits(info, 6, 5);
+    p += addr_size + 1 + num_words * word_size;
+  }
+  return p - offset;
+}
+
+// .sframe is a compact stack-unwinding format. Just like .eh_frame, the
+// linker has to understand its contents: an output .sframe section is a
+// single header followed by a PC-sorted index of function descriptor
+// entries (FDEs) and a blob of frame row entries (FREs). This function
+// parses an input .sframe section into individual FDEs so that we can
+// later drop the dead ones, sort the survivors and rewrite the header.
+//
+// Unlike .eh_frame, the variable-length FRE data carries no relocations,
+// so we copy it to the output verbatim. The only relocated field is each
+// FDE's func_start, which points to the function the FDE describes; we
+// use it both to find the function (for garbage collection and to obtain
+// its output address) and to re-emit a PC-relative offset.
+template <typename E>
+void ObjectFile<E>::parse_sframe(Context<E> &ctx) requires supports_sframe<E> {
+  for (InputSection<E> *isec : sframe_sections) {
+    // The input section is consumed by the linker; it's not copied to the
+    // output as-is but reconstructed into ctx.sframe.
+    isec->is_alive = false;
+
+    std::string_view data = this->get_string(ctx, isec->shdr());
+    const SFrameHeader<E> &hdr = *(const SFrameHeader<E> *)data.data();
+
+    if (hdr.magic != SFRAME_MAGIC)
+      Fatal(ctx) << *isec << ": corrupted .sframe section";
+    if (hdr.abi_arch != E::sframe_abi)
+      Fatal(ctx) << *isec << ": .sframe is incompatible with " << E::name;
+
+    // We support only SFrame Version 3. A section written in an older
+    // version (e.g. by an old assembler) isn't an error; we just ignore
+    // it, so the functions it covers won't have SFrame info in the output.
+    if (hdr.version != 3)
+      continue;
+
+    i64 hdr_len = sizeof(SFrameHeader<E>) + hdr.auxhdr_len;
+    i64 num_fdes = hdr.num_fdes;
+    i64 fde_off = hdr_len + hdr.fdeoff;
+    i64 fre_off = hdr_len + hdr.freoff;
+
+    std::span<ElfRel<E>> rels = isec->get_rels(ctx);
+    i64 rel_idx = 0;
+
+    for (i64 i = 0; i < num_fdes; i++) {
+      i64 idx_off = fde_off + i * sizeof(SFrameFdeIdx<E>);
+      const SFrameFdeIdx<E> &ent =
+        *(const SFrameFdeIdx<E> *)(data.data() + idx_off);
+
+      // Find the relocation for this FDE's func_start field. An FDE without
+      // one isn't tied to any function (`ld -r` can emit such dead FDEs),
+      // so we drop it.
+      while (rel_idx < rels.size() && rels[rel_idx].r_offset < idx_off)
+        rel_idx++;
+      if (rel_idx == rels.size() || rels[rel_idx].r_offset != idx_off)
+        continue;
+
+      const ElfRel<E> &rel = rels[rel_idx];
+      i64 off = fre_off + ent.func_start_fre_off;
+
+      SFrameFde<E> fde;
+      fde.isec = get_section(this->elf_syms[rel.r_sym]);
+      fde.sym = this->symbols[rel.r_sym];
+      fde.addend = rel.r_addend;
+      fde.fre = data.substr(off, sframe_fre_block_size<E>(data, off));
+      fde.func_size = ent.func_size;
+      fde.num_fres = *(U16<E> *)(data.data() + off);
+      sframe_fdes.push_back(fde);
+    }
+  }
+}
+
 template <typename E>
 void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
  if (this->elf_syms.empty())
@@ -646,7 +749,7 @@ void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
    if (esym.st_type == STT_SECTION)
      name = this->shstrtab.data() + this->elf_sections[get_shndx(esym)].sh_name;
    else
-      name = this->symbol_strtab.data() + esym.st_name;
+      name = this->symbol_names[i];

    Symbol<E> &sym = this->local_syms[i];
    sym.set_name(name);
@@ -674,7 +777,7 @@ void ObjectFile<E>::initialize_symbols(Context<E> &ctx) {
      has_common_symbol = true;

    // Get a symbol name
-    std::string_view key = this->symbol_strtab.data() + esym.st_name;
+    std::string_view key = this->symbol_names[i];
    std::string_view name = key;

    // Parse symbol version after atsign
@@ -734,11 +837,21 @@ void ObjectFile<E>::convert_mergeable_sections(Context<E> &ctx) {
      continue;

    const ElfShdr<E> &shdr = isec->shdr();
-    if (!(shdr.sh_flags & SHF_MERGE))
+    if (!(shdr.sh_flags & SHF_MERGE) || !isec->is_alive)
      continue;

+    // Under a SECTIONS-driven layout, sections matched by different
+    // output section descriptions merge separately
+    i64 cmd = -1;
+    i32 rank = INT32_MAX;
+    if (!this->script_match.empty())
+      if (i32 r = this->script_match[i]; r != -1) {
+        cmd = ctx.script_ranks[r].cmd;
+        rank = r;
+      }
+
    MergedSection<E> *parent =
-      MergedSection<E>::get_instance(ctx, isec->name(), shdr);
+      MergedSection<E>::get_instance(ctx, isec->name, shdr, cmd, rank);

    if (parent) {
      this->mergeable_sections[i] =
@@ -889,6 +1002,7 @@ void ObjectFile<E>::parse(Context<E> &ctx) {
    this->first_global = symtab_sec->sh_info;
    this->elf_syms = this->template get_data<ElfSym<E>>(ctx, *symtab_sec);
    this->symbol_strtab = this->get_string(ctx, symtab_sec->sh_link);
+    this->populate_symbol_names();

    if (ElfShdr<E> *shdr = this->find_section(SHT_SYMTAB_SHNDX))
      symtab_shndx_sec = this->template get_data<U32<E>>(ctx, *shdr);
@@ -1260,7 +1374,7 @@ void SharedFile<E>::parse(Context<E> &ctx) {

  this->symbol_strtab = this->get_string(ctx, symtab_sec->sh_link);
  soname = get_soname(ctx);
-  version_strings = read_verdef(ctx);
+  version_strings = read_version_strings(ctx);

  // Read a symbol table.
  std::span<ElfSym<E>> esyms = this->template get_data<ElfSym<E>>(ctx, *symtab_sec);
@@ -1270,20 +1384,28 @@ void SharedFile<E>::parse(Context<E> &ctx) {
    vers = this->template get_data<U16<E>>(ctx, *sec);

  for (i64 i = symtab_sec->sh_info; i < esyms.size(); i++) {
-    u16 ver;
-    if (vers.empty() || esyms[i].is_undef())
-      ver = VER_NDX_GLOBAL;
-    else
-      ver = vers[i] & ~VERSYM_HIDDEN;
+    u16 ver = vers.empty() ? VER_NDX_GLOBAL : (vers[i] & ~VERSYM_HIDDEN);

-    if (ver == VER_NDX_LOCAL)
+    // A defined symbol with VER_NDX_LOCAL is bound locally and isn't
+    // really exposed for dynamic linking; skip it. We never skip
+    // undefined references — the dynamic loader doesn't distinguish
+    // local vs global on the undef side, and dropping them would hide
+    // the DSO's reference from us.
+    if (ver == VER_NDX_LOCAL && !esyms[i].is_undef())
      continue;

    this->elf_syms2.push_back(esyms[i]);
-    this->versyms.push_back(ver);
+
+    // resolve_symbols only consults versyms[] for defined symbols
+    // (see SharedFile::resolve_symbols), so VER_NDX_GLOBAL is fine
+    // for undefined entries.
+    this->versyms.push_back(esyms[i].is_undef() ? (u16)VER_NDX_GLOBAL : ver);

    std::string_view name = this->symbol_strtab.data() + esyms[i].st_name;

+    bool has_version = ver != VER_NDX_GLOBAL && ver < version_strings.size() &&
+                       !version_strings[ver].empty();
+
    auto get_versioned_sym = [&] {
      std::string_view key = save_string(
        ctx, std::string(name) + "@" + std::string(version_strings[ver]));
@@ -1304,12 +1426,13 @@ void SharedFile<E>::parse(Context<E> &ctx) {
    // and `foo@VERSION` as usual, but with information to forward
    // references to `foo@VERSION` to `foo`. After name resolution, we
    // visit all symbol references to redirect `foo@VERSION` to `foo`.
-    if (vers.empty() || ver == VER_NDX_GLOBAL) {
+    if (!has_version) {
      // Unversioned symbol
      this->symbols.push_back(get_symbol(ctx, name));
      this->symbols2.push_back(nullptr);
-    } else if (vers[i] & VERSYM_HIDDEN) {
-      // Versioned non-default symbol
+    } else if (esyms[i].is_undef() || (vers[i] & VERSYM_HIDDEN)) {
+      // Versioned non-default symbol, or undefined reference whose
+      // version comes from .gnu.version_r.
      this->symbols.push_back(get_versioned_sym());
      this->symbols2.push_back(nullptr);
    } else {
@@ -1375,32 +1498,61 @@ std::string_view SharedFile<E>::get_dt_audit(Context<E> &ctx) {
 // If an undefiend symbol `foo` is resolved to a symbol defined by the
 // shared object, it's marked so that it'll be resolved to (`foo`, the
 // default version of the library) at load-time.
+//
+// Reads .gnu.version_d and .gnu.version_r and returns a vector of
+// version names indexed by versym value. The versym index space is
+// shared between the two sections (vd_ndx for defined symbols and
+// vna_other for undefined ones), so a single vector covers both.
 template <typename E>
-std::vector<std::string_view> SharedFile<E>::read_verdef(Context<E> &ctx) {
-  ElfShdr<E> *verdef_sec = this->find_section(SHT_GNU_VERDEF);
-  if (!verdef_sec)
-    return {};
-
-  std::string_view verdef = this->get_string(ctx, *verdef_sec);
-  std::string_view strtab = this->get_string(ctx, verdef_sec->sh_link);
-
+std::vector<std::string_view>
+SharedFile<E>::read_version_strings(Context<E> &ctx) {
  std::vector<std::string_view> vec;
-  u8 *ptr = (u8 *)verdef.data();

-  for (;;) {
-    ElfVerdef<E> *ver = (ElfVerdef<E> *)ptr;
-    if (ver->vd_ndx == VER_NDX_UNSPECIFIED)
-      Fatal(ctx) << *this << ": symbol version too large";
+  if (ElfShdr<E> *sec = this->find_section(SHT_GNU_VERDEF)) {
+    std::string_view verdef = this->get_string(ctx, *sec);
+    std::string_view strtab = this->get_string(ctx, sec->sh_link);
+    u8 *ptr = (u8 *)verdef.data();

-    if (vec.size() <= ver->vd_ndx)
-      vec.resize(ver->vd_ndx + 1);
+    for (;;) {
+      ElfVerdef<E> *ver = (ElfVerdef<E> *)ptr;
+      if (ver->vd_ndx == VER_NDX_UNSPECIFIED)
+        Fatal(ctx) << *this << ": symbol version too large";

-    ElfVerdaux<E> *aux = (ElfVerdaux<E> *)(ptr + ver->vd_aux);
-    vec[ver->vd_ndx] = strtab.data() + aux->vda_name;
-    if (!ver->vd_next)
-      break;
-    ptr += ver->vd_next;
+      if (vec.size() <= ver->vd_ndx)
+        vec.resize(ver->vd_ndx + 1);
+
+      ElfVerdaux<E> *aux = (ElfVerdaux<E> *)(ptr + ver->vd_aux);
+      vec[ver->vd_ndx] = strtab.data() + aux->vda_name;
+      if (!ver->vd_next)
+        break;
+      ptr += ver->vd_next;
+    }
  }
+
+  if (ElfShdr<E> *sec = this->find_section(SHT_GNU_VERNEED)) {
+    std::string_view verneed = this->get_string(ctx, *sec);
+    std::string_view strtab = this->get_string(ctx, sec->sh_link);
+    u8 *ptr = (u8 *)verneed.data();
+
+    for (;;) {
+      ElfVerneed<E> *vn = (ElfVerneed<E> *)ptr;
+      u8 *aux_ptr = ptr + vn->vn_aux;
+      for (i64 i = 0; i < vn->vn_cnt; i++) {
+        ElfVernaux<E> *aux = (ElfVernaux<E> *)aux_ptr;
+        u16 idx = aux->vna_other & ~VERSYM_HIDDEN;
+        if (vec.size() <= idx)
+          vec.resize(idx + 1);
+        vec[idx] = strtab.data() + aux->vna_name;
+        if (!aux->vna_next)
+          break;
+        aux_ptr += aux->vna_next;
+      }
+      if (!vn->vn_next)
+        break;
+      ptr += vn->vn_next;
+    }
+  }
+
  return vec;
 }

@@ -33,8 +33,12 @@ bool cie_equals(const CieRecord<E> &a, const CieRecord<E> &b) {
 template <typename E>
 InputSection<E>::InputSection(Context<E> &ctx, ObjectFile<E> &file, i64 shndx)
  : file(file), shndx(shndx) {
-  if (shndx < file.elf_sections.size())
+  if (shndx < file.elf_sections.size()) {
+    name = file.shstrtab.data() + file.elf_sections[shndx].sh_name;
    contents = {(char *)file.mf->data + shdr().sh_offset, (size_t)shdr().sh_size};
+  } else {
+    name = (shdr().sh_flags & SHF_TLS) ? ".tls_common" : ".common";
+  }

  if (shdr().sh_flags & SHF_COMPRESSED) {
    ElfChdr<E> &chdr = *(ElfChdr<E> *)&contents[0];
@@ -96,6 +100,7 @@ void InputSection<E>::copy_contents_to(Context<E> &ctx, u8 *buf, i64 sz) {
    if (s.total_out < sz && r != Z_STREAM_END)
      Fatal(ctx) << *this << ": uncompress failed: " << s.msg;
    inflateEnd(&s);
+    msan_unpoison(buf, sz);
    break;
  }
  case ELFCOMPRESS_ZSTD: {
@@ -111,6 +116,7 @@ void InputSection<E>::copy_contents_to(Context<E> &ctx, u8 *buf, i64 sz) {
        Fatal(ctx) << *this << ": uncompress failed: premature end of input";
    }
    ZSTD_freeDCtx(dctx);
+    msan_unpoison(buf, sz);
    break;
  }
  default:
@@ -119,6 +125,9 @@ void InputSection<E>::copy_contents_to(Context<E> &ctx, u8 *buf, i64 sz) {
  }
 }

+// wingdi.h defines ERROR as a macro, so undefine it before use
+#undef ERROR
+
 typedef enum : u8 { NONE, ERROR, COPYREL, PLT, CPLT } Action;

 template <typename E>
@@ -279,17 +288,12 @@ void InputSection<E>::write_to(Context<E> &ctx, u8 *buf) {
 template <typename E>
 std::string_view
 InputSection<E>::get_func_name(Context<E> &ctx, i64 offset) const {
-  for (Symbol<E> *sym : file.symbols) {
-    if (sym->file == &file) {
-      const ElfSym<E> &esym = sym->esym();
-      if (esym.st_shndx == shndx && esym.st_type == STT_FUNC &&
-          esym.st_value <= offset && offset < esym.st_value + esym.st_size) {
-        if (ctx.arg.demangle)
-          return demangle(*sym);
-        return sym->name();
-      }
-    }
-  }
+  for (Symbol<E> *sym : file.symbols)
+    if (sym->file == &file)
+      if (const ElfSym<E> &esym = sym->esym();
+          esym.st_shndx == shndx && esym.st_type == STT_FUNC &&
+          esym.st_value <= offset && offset < esym.st_value + esym.st_size)
+        return ctx.arg.demangle ? demangle(*sym) : sym->name();
  return "";
 }

@@ -536,8 +536,6 @@ static ElfSym<E> to_elf_sym(PluginSymbol &psym) {
  }

  switch (psym.symbol_type) {
-  case LDST_UNKNOWN:
-    break;
  case LDST_FUNCTION:
    esym.st_type = STT_FUNC;
    break;
@@ -547,8 +545,6 @@ static ElfSym<E> to_elf_sym(PluginSymbol &psym) {
  };

  switch (psym.visibility) {
-  case LDPV_DEFAULT:
-    break;
  case LDPV_PROTECTED:
    esym.st_visibility = STV_PROTECTED;
    break;
@@ -633,17 +629,18 @@ ObjectFile<E> *read_lto_object(Context<E> &ctx, MappedFile *mf) {
  // claim_file_hook() calls add_symbols() which initializes `plugin_symbols`
  int claimed = false;
  claim_file_hook(&file, &claimed);
-  if (!claimed)
-    Fatal(ctx) << mf->name << ": not claimed by the LTO plugin;"
-               << " please make sure you are using the same compiler of the"
-               << " same version for all object files";

-  // It looks like GCC doesn't need fd after claim_file_hook() while
-  // LLVM needs it and takes the ownership of fd. To prevent "too many
-  // open files" issue, we close fd only for GCC. This is ugly, though.
-  if (!is_llvm(ctx)) {
-    MappedFile *mf2 = mf->parent ? mf->parent : mf;
-    mf2->close_fd();
+  if (mf->parent)
+    mf->parent->close_fd();
+  else
+    mf->close_fd();
+
+  if (!claimed) {
+    if (!mf->parent && !mf->thin_parent)
+      Fatal(ctx) << mf->name << ": not claimed by the LTO plugin;"
+                 << " please make sure you are using the same compiler of the"
+                 << " same version for all object files";
+    return nullptr;
  }

  // Create a symbol strtab
@@ -678,6 +675,7 @@ ObjectFile<E> *read_lto_object(Context<E> &ctx, MappedFile *mf) {

  obj->symbol_strtab = save_string(ctx, strtab);
  obj->elf_syms = obj->lto_elf_syms;
+  obj->populate_symbol_names();
  obj->initialize_symbols(ctx);
  plugin_symbols.clear();
  return obj;
@@ -1,18 +1,13 @@
 #include "mold.h"
+#include "config.h"

 #include <cstring>
+#include <filesystem>
 #include <functional>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unordered_set>

-#ifdef _WIN32
-# include <direct.h>
-# define chdir _chdir
-#else
-# include <unistd.h>
-#endif
-
 namespace mold {

 template <typename E>
@@ -38,6 +33,7 @@ static ObjectFile<E> *new_object_file(Context<E> &ctx, ReaderContext &rctx,
  file->as_needed =
    rctx.in_lib || (!archive_name.empty() && !rctx.whole_archive);

+  assert(rctx.tg);
  rctx.tg->run([file, &ctx] { file->parse(ctx); });
  if (ctx.arg.trace)
    Out(ctx) << "trace: " << *file;
@@ -54,6 +50,9 @@ static ObjectFile<E> *new_lto_obj(Context<E> &ctx, ReaderContext &rctx,
    return nullptr;

  ObjectFile<E> *file = read_lto_object(ctx, mf);
+  if (!file)
+    return nullptr;
+
  file->priority = ctx.file_priority++;
  file->archive_name = archive_name;
  file->as_needed =
@@ -74,6 +73,7 @@ new_shared_file(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
  file->priority = ctx.file_priority++;
  file->as_needed = rctx.as_needed;

+  assert(rctx.tg);
  rctx.tg->run([file, &ctx] { file->parse(ctx); });
  if (ctx.arg.trace)
    Out(ctx) << "trace: " << *file;
@@ -111,7 +111,7 @@ void read_file(Context<E> &ctx, ReaderContext &rctx, MappedFile *mf) {
    }
    return;
  case FileType::TEXT:
-    Script(ctx, rctx, mf).parse_linker_script();
+    Script(ctx, mf, &rctx).parse_linker_script();
    return;
  case FileType::GCC_LTO_OBJ:
  case FileType::LLVM_BITCODE:
@@ -149,7 +149,7 @@ detect_machine_type(Context<E> &ctx, std::vector<std::string> args) {
      if (MappedFile *mf = open_file(ctx, arg))
        if (get_file_type(ctx, mf) == FileType::TEXT)
          if (std::string_view target =
-              Script(ctx, rctx, mf).get_script_output_type();
+              Script(ctx, mf, &rctx).get_script_output_type();
              !target.empty())
            return target;
    }
@@ -247,9 +247,14 @@ static void read_input_files(Context<E> &ctx, std::span<std::string> args) {
    }
  }

-  if (ctx.objs.empty())
+  if (ctx.objs.empty() && ctx.dsos.empty())
    Fatal(ctx) << "no input files";

+  if (rctx.static_ || ctx.arg.relocatable) {
+    ctx.arg.static_ = true;
+    ctx.arg.dynamic_linker = "";
+  }
+
  tg.wait();
 }

@@ -261,6 +266,17 @@ static bool has_lto_obj(Context<E> &ctx) {
  return false;
 }

+template <typename E>
+static i64 get_thread_count(Context<E> &ctx) {
+  if (ctx.arg.thread_count.has_value())
+    return *ctx.arg.thread_count;
+
+  // mold doesn't scale well with too many threads, so limit it to 32.
+  int n = tbb::global_control::active_value(
+    tbb::global_control::max_allowed_parallelism);
+  return std::min(n, 32);
+}
+
 template <typename E>
 int mold_main(int argc, char **argv) {
  Context<E> ctx;
@@ -269,6 +285,12 @@ int mold_main(int argc, char **argv) {
  if (argc >= 2 && (argv[1] == "-run"sv || argv[1] == "--run"sv))
    process_run_subcommand(ctx, argc, argv);

+  // parse_nonpositional_args() may chdir(2) for -C. If we end up
+  // restarting in redo_main(), we need to re-enter from the original
+  // directory so relative paths (e.g. response files) still resolve.
+  std::error_code ec;
+  std::filesystem::path orig_cwd = std::filesystem::current_path(ec);
+
  // Parse non-positional command line options
  ctx.cmdline_args = expand_response_files(ctx, argv);
  std::vector<std::string> file_args = parse_nonpositional_args(ctx);
@@ -277,28 +299,25 @@ int mold_main(int argc, char **argv) {
  if (ctx.arg.emulation.empty())
    ctx.arg.emulation = detect_machine_type(ctx, file_args);

-  // Redo if -m is not x86-64.
-  if constexpr (is_x86_64<E>)
-    if (ctx.arg.emulation != X86_64::name)
-      return redo_main(ctx, argc, argv);
+  // Redo if -m does not match with our speculation.
+  if (ctx.arg.emulation != E::name) {
+    if (!ec)
+      std::filesystem::current_path(orig_cwd, ec);
+    return redo_main<E>(ctx.arg.emulation, argc, argv);
+  }

  Timer t_all(ctx, "all");

  install_signal_handler();

-  if (!ctx.arg.directory.empty())
-    if (chdir(ctx.arg.directory.c_str()) == -1)
-      Fatal(ctx) << "chdir failed: " << ctx.arg.directory
-                 << ": " << errno_string();
-
  // Fork a subprocess unless --no-fork is given.
  if (ctx.arg.fork)
-    fork_child();
+    fork_child<E>();

  acquire_global_lock();

  ctx.global_limit.emplace(tbb::global_control::max_allowed_parallelism,
-                           ctx.arg.thread_count);
+                           get_thread_count(ctx));

  // Handle --wrap options if any.
  for (std::string_view name : ctx.arg.wrap)
@@ -315,6 +334,13 @@ int mold_main(int argc, char **argv) {
  // Parse input files
  read_input_files(ctx, file_args);

+  // The entry point is given by -e, by an ENTRY command in a linker
+  // script, or defaults to _start
+  if (!ctx.arg.entry)
+    ctx.arg.entry = get_symbol(ctx, "_start");
+  ctx.arg.entry->gc_root = true;
+  ctx.arg.undefined.push_back(ctx.arg.entry);
+
  // Uniquify shared object files by soname
  {
    std::unordered_set<std::string_view> seen;
@@ -351,9 +377,19 @@ int mold_main(int argc, char **argv) {
  std::erase_if(ctx.objs, [](InputFile<E> *file) { return !file->is_reachable; });
  std::erase_if(ctx.dsos, [](InputFile<E> *file) { return !file->is_reachable; });

+  // Remove input sections that match a /DISCARD/ pattern and
+  // compute, for each input section, the output section description
+  // it matches. This runs before mergeable sections are split
+  // because the patterns match the original input sections.
+  apply_script_discards(ctx);
+  match_script_sections(ctx);
+
  // Parse .eh_frame section contents.
  parse_eh_frame_sections(ctx);

+  // Parse .sframe section contents.
+  parse_sframe_sections(ctx);
+
  // Split mergeable section contents into section pieces.
  create_merged_sections(ctx);

@@ -368,6 +404,9 @@ int mold_main(int argc, char **argv) {
  // Create .bss sections for common symbols.
  convert_common_symbols(ctx);

+  // Define symbols PROVIDE'd by linker scripts.
+  add_provided_symbols(ctx);
+
  // Apply version scripts.
  apply_version_script(ctx);

@@ -381,6 +420,11 @@ int mold_main(int argc, char **argv) {
  if (!ctx.arg.allow_multiple_definition)
    check_duplicate_symbols(ctx);

+  // Handle --zero-to-bss, which converts data sections containing only
+  // zeros into BSS.
+  if (ctx.arg.zero_to_bss)
+    convert_zero_to_bss(ctx);
+
  // Set "address-taken" bits for input sections.
  if (ctx.arg.icf)
    compute_address_significance(ctx);
@@ -495,12 +539,6 @@ int mold_main(int argc, char **argv) {
  // within an output section to input sections.
  compute_section_sizes(ctx);

-  // If --packed_dyn_relocs=relr was given, base relocations are stored
-  // to a .relr.dyn section in a compressed form. Construct a compressed
-  // relocations now so that we can fix section sizes and file layout.
-  if (ctx.arg.pack_dyn_relocs_relr)
-    construct_relr(ctx);
-
  // Reserve a space for dynamic symbol strings in .dynstr and sort
  // .dynsym contents if necessary. Beyond this point, no symbol will
  // be added to .dynsym.
@@ -527,6 +565,11 @@ int mold_main(int argc, char **argv) {
  // Here, we construct output .eh_frame contents.
  ctx.eh_frame->construct(ctx);

+  // .sframe is likewise parsed and reconstructed by the linker. Build
+  // the merged, PC-sorted output .sframe.
+  if constexpr (supports_sframe<E>)
+    ctx.sframe->construct(ctx);
+
  // If --emit-relocs is given, we'll copy relocation sections from input
  // files to an output file.
  if (ctx.arg.emit_relocs)
@@ -581,12 +624,20 @@ int mold_main(int argc, char **argv) {
    filesize = set_osec_offsets(ctx);
  }

-  // At this point, both memory and file layouts are fixed.
-
  // Gather thunk symbols and attach them to themselves.
  if constexpr (needs_thunk<E>)
    gather_thunk_addresses(ctx);

+  // Re-finalize layout. fix_synthetic_symbols above may have changed
+  // addends for dynamic relocations referencing synthetic symbols, which
+  // can shift the encoded size of .rela.dyn under --pack-dyn-relocs=android.
+  // For other modes this is a cheap no-op convergence.
+  filesize = set_osec_offsets(ctx);
+
+  // At this point, both memory and file layouts are fixed.
+
+  ctx.reldyn->update_shdr(ctx);
+
  t_before_copy.stop();

  // Create an output file
@@ -655,7 +706,7 @@ int mold_main(int argc, char **argv) {
  std::cout << std::flush;
  std::cerr << std::flush;

-  notify_parent();
+  notify_parent<E>();
  release_global_lock();

  if (ctx.arg.quick_exit)
@@ -46,10 +46,11 @@ void print_map(Context<E> &ctx) {
  std::ostream *out = &std::cout;
  std::ofstream file;

-  if (!ctx.arg.Map.empty()) {
+  if (!ctx.arg.Map.empty() && ctx.arg.Map != "-") {
    file.open(ctx.arg.Map);
-    if (!file.is_open())
-      Fatal(ctx) << "cannot open " << ctx.arg.Map << ": " << errno_string();
+    if (file.fail())
+      Fatal(ctx) << "--print-map: cannot open " << ctx.arg.Map << ": "
+                 << errno_string();
    out = &file;
  }

@@ -6,6 +6,11 @@
 #include <sys/mman.h>
 #include <system_error>

+#ifdef __linux__
+# include <sys/vfs.h>
+# include <linux/magic.h>
+#endif
+
 namespace mold {

 static u32 get_umask() {
@@ -54,7 +59,11 @@ public:
    output_tmpfile = (char *)save_string(ctx, tmpfile).data();

 #ifdef __linux__
-    fallocate(this->fd, 0, 0, filesize);
+    // Calling falllocate speeds up later linking passes on ext4,
+    // while it just takes time with not benefits on tmpfs.
+    if (struct statfs fs;
+        fstatfs(this->fd, &fs) || fs.f_type != TMPFS_MAGIC)
+      fallocate(this->fd, 0, 0, filesize);
 #endif

    this->buf = (u8 *)mmap(nullptr, filesize, PROT_READ | PROT_WRITE,
@@ -77,12 +86,12 @@ public:
    if (!this->is_unmapped)
      munmap(this->buf, this->filesize);

-    if (this->buf2.empty()) {
+    if (!this->buf2) {
      ::close(this->fd);
    } else {
      FILE *out = fdopen(this->fd, "w");
      fseek(out, 0, SEEK_END);
-      fwrite(&this->buf2[0], this->buf2.size(), 1, out);
+      fwrite(this->buf2, this->buf2_size, 1, out);
      fclose(out);
    }

@@ -176,10 +185,10 @@ void LockingOutputFile<E>::close(Context<E> &ctx) {
  if (!this->is_unmapped)
    munmap(this->buf, this->filesize);

-  if (!this->buf2.empty()) {
+  if (this->buf2) {
    FILE *out = fdopen(this->fd, "w");
    fseek(out, 0, SEEK_END);
-    fwrite(&this->buf2[0], this->buf2.size(), 1, out);
+    fwrite(this->buf2, this->buf2_size, 1, out);
    fclose(out);
  }

@@ -44,13 +44,13 @@ public:

    UnmapViewOfFile(this->buf);

-    if (!this->buf2.empty()) {
+    if (this->buf2) {
      if (SetFilePointer(handle, 0, nullptr, FILE_END) == INVALID_SET_FILE_POINTER)
        Fatal(ctx) << this->path << ": SetFilePointer failed: "
                   << GetLastError();

      DWORD written;
-      if (!WriteFile(handle, this->buf2.data(), this->buf2.size(), &written,
+      if (!WriteFile(handle, this->buf2, this->buf2_size, &written,
                     nullptr))
        Fatal(ctx) << this->path << ": WriteFile failed: " << GetLastError();
    }
@@ -50,6 +50,8 @@ static void r_create_synthetic_sections(Context<E> &ctx) {
  ctx.shdr = push(new OutputShdr<E>);
  ctx.eh_frame = push(new EhFrameSection<E>);
  ctx.eh_frame_reloc = push(new EhFrameRelocSection<E>);
+  ctx.sframe = push(new SFrameSection<E>);
+  ctx.sframe_reloc = push(new SFrameRelocSection<E>);
  ctx.strtab = push(new StrtabSection<E>);
  ctx.symtab = push(new SymtabSection<E>);
  ctx.shstrtab = push(new ShstrtabSection<E>);
@@ -161,6 +163,9 @@ void combine_objects(Context<E> &ctx) {

  ctx.eh_frame->construct(ctx);

+  if constexpr (supports_sframe<E>)
+    ctx.sframe->construct(ctx);
+
  create_reloc_sections(ctx);

  create_comdat_group_sections(ctx);
@@ -11,12 +11,12 @@

 namespace mold {

-#ifdef MOLD_X86_64
 static int pipe_write_fd = -1;

 // Exiting from a program with large memory usage is slow --
 // it may take a few hundred milliseconds. To hide the latency,
 // we fork a child and let it do the actual linking work.
+template <typename E>
 void fork_child() {
  int pipefd[2];
  if (pipe(pipefd) == -1) {
@@ -53,6 +53,7 @@ void fork_child() {
  pipe_write_fd = pipefd[1];
 }

+template <typename E>
 void notify_parent() {
  if (pipe_write_fd == -1)
    return;
@@ -62,7 +63,6 @@ void notify_parent() {
  assert(n == 1);
  pipe_write_fd = -1;
 }
-#endif

 template <typename E>
 static std::string find_dso(Context<E> &ctx, std::filesystem::path self) {
@@ -124,6 +124,8 @@ void process_run_subcommand(Context<E> &ctx, int argc, char **argv) {

 using E = MOLD_TARGET;

+template void fork_child<E>();
+template void notify_parent<E>();
 template void process_run_subcommand(Context<E> &, int, char **);

 } // namespace mold
@@ -2,10 +2,11 @@

 namespace mold {

-#ifdef MOLD_X86_64
+template <typename E>
 void fork_child() {}
+
+template <typename E>
 void notify_parent() {}
-#endif

 template <typename E>
 [[noreturn]]
@@ -15,6 +16,8 @@ void process_run_subcommand(Context<E> &ctx, int argc, char **argv) {

 using E = MOLD_TARGET;

+template void fork_child<E>();
+template void notify_parent<E>();
 template void process_run_subcommand(Context<E> &, int, char **);

 } // namespace mold
@@ -32,12 +32,14 @@ namespace mold {

 using E = MOLD_TARGET;

-// We create thunks for each 25.6/3.2/6.4 MiB code block for
+// We create thunks for each 32/8/16 MiB code block for
 // ARM64/ARM32/PPC, respectively.
-static constexpr i64 batch_size = branch_distance<E> / 5;
+static constexpr i64 batch_size =
+  (is_arm64<E> ? 32 : is_arm32<E> ? 8 : 16) * 1024 * 1024;

-// We assume that a single thunk group is smaller than 1 MiB.
-static constexpr i64 max_thunk_size = 1024 * 1024;
+// We assume that a single thunk group is smaller than 16/4/8 MiB
+// for ARM64/ARM32/PPC, respectively.
+static constexpr i64 max_thunk_size = batch_size / 2;

 // We align thunks to 16 byte boundaries because many processor vendors
 // recommend we align branch targets to 16 byte boundaries for performance
@@ -104,6 +106,13 @@ requires_thunk(Context<E> &ctx, InputSection<E> &isec, const ElfRel<E> &rel,
  return val < -branch_distance<E> || branch_distance<E> <= val;
 }

+template <>
+void Thunk<E>::compute_size() {
+  offsets.clear();
+  for (i64 i = 0; i <= symbols.size(); i++)
+    offsets.push_back(E::thunk_hdr_size + i * E::thunk_size);
+}
+
 template <>
 void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx) {
  std::span<InputSection<E> *> m = members;
@@ -206,6 +215,7 @@ void OutputSection<E>::create_range_extension_thunks(Context<E> &ctx) {

    // Now that we know the number of symbols in the thunk, we can compute
    // the thunk's size.
+    thunk.compute_size();
    assert(thunk.size() < max_thunk_size);
    offset += thunk.size();

@@ -256,19 +266,13 @@ void remove_redundant_thunks(Context<E> &ctx) {

  // Remove symbols from thunks if they don't actually need range
  // extension thunks
-  std::vector<Symbol<E> *> syms;
-
  for (OutputSection<E> *osec : sections) {
    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks) {
-      append(syms, thunk->symbols);
      std::erase_if(thunk->symbols, [&](Symbol<E> *sym) { return !sym->flags; });
+      thunk->shrink_size(ctx);
    }
  }

-  // Reset flags for future use
-  for (Symbol<E> *sym : syms)
-    sym->flags = 0;
-
  // Recompute section sizes
  tbb::parallel_for_each(sections, [&](OutputSection<E> *osec) {
    std::span<InputSection<E> *> m = osec->members;
@@ -290,6 +294,12 @@ void remove_redundant_thunks(Context<E> &ctx) {
    }
    osec->shdr.sh_size = offset;
  });
+
+  // Reset flags for future use
+  for (OutputSection<E> *osec : sections)
+    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks)
+      for (Symbol<E> *sym : thunk->symbols)
+        sym->flags = 0;
 }

 // When applying relocations, we want to know the address in a reachable
@@ -318,8 +328,8 @@ void gather_thunk_addresses(Context<E> &ctx) {
    for (std::unique_ptr<Thunk<E>> &thunk : osec->thunks) {
      for (i64 i = 0; i < thunk->symbols.size(); i++) {
        Symbol<E> &sym = *thunk->symbols[i];
-        sym.add_aux(ctx);
-        ctx.symbol_aux[sym.aux_idx].thunk_addrs.push_back(thunk->get_addr(i));
+        u64 addr = thunk->get_addr() + thunk->offsets[i];
+        sym.add_thunk_addr(ctx, addr);
      }
    }
  }
@@ -0,0 +1,51 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF > $t/a.c
+#include <stdio.h>
+
+void fn3();
+void fn4();
+
+__attribute__((section(".low"))) void fn1() { printf(" fn1"); fn3(); }
+__attribute__((section(".low"))) void fn2() { printf(" fn2"); fn4(); }
+
+int main() {
+  printf(" main");
+  fn1();
+  printf("\n");
+}
+EOF
+
+cat <<EOF > $t/b.c
+#include <stdio.h>
+
+void fn1();
+void fn2();
+
+__attribute__((section(".high"))) void fn3() { printf(" fn3"); fn2(); }
+__attribute__((section(".high"))) void fn4() { printf(" fn4"); }
+EOF
+
+$CC -c -o $t/c.o $t/a.c
+$CC -c -o $t/d.o $t/b.c
+
+$CC -B. -o $t/exe1 $t/c.o $t/d.o \
+  -Wl,--section-start=.low=0x10000000,--section-start=.high=0x100000000
+$QEMU $t/exe1 | grep 'main fn1 fn3 fn2 fn4'
+
+$CC -B. -o $t/exe2 $t/c.o $t/d.o \
+  -Wl,--section-start=.high=0x10000000,--section-start=.low=0x100000000
+$QEMU $t/exe2 | grep 'main fn1 fn3 fn2 fn4'
+
+
+$CC -c -o $t/e.o $t/a.c -fno-PIC -mcmodel=large
+$CC -c -o $t/f.o $t/b.c -fno-PIC -mcmodel=large
+
+$CC -B. -o $t/exe3 $t/e.o $t/f.o -pie \
+  -Wl,--section-start=.low=0x10000000,--section-start=.high=0x400000000
+$QEMU $t/exe3 | grep 'main fn1 fn3 fn2 fn4'
+
+$CC -B. -o $t/exe4 $t/e.o $t/f.o -pie \
+  -Wl,--section-start=.high=0x10000000,--section-start=.low=0x400000000
+$QEMU $t/exe4 | grep 'main fn1 fn3 fn2 fn4'
@@ -0,0 +1,36 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+[ $MACHINE = aarch64 ] || skip
+command -v timeout >/dev/null || skip
+
+cat <<EOF | $CC -c -o $t/a.o -fPIC -xassembler - 2> /dev/null || skip
+.section .custom_rodata_a, "a", %progbits
+.hidden A
+.global A
+A:
+  .space 8
+
+.section .custom_rodata_b_huge, "a", %progbits
+.balign 16384
+.hidden B
+.global B
+B:
+  .space 8
+
+.section .data, "aw", %progbits
+.rept 7439
+  .quad A
+.endr
+
+.global P_1
+P_1:
+  .quad A
+
+.global P_2
+P_2:
+  .quad B
+EOF
+
+timeout 5s ./mold -m aarch64elf -shared -o $t/b.so $t/a.o \
+  --pack-dyn-relocs=android -z max-page-size=16384
@@ -0,0 +1,51 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# In the REL relocation format, an addend is read from the relocated
+# place itself, and its value is signed. The Linux kernel's real-mode
+# setup code, for example, presets fields relocated with R_386_8 and
+# R_386_16 with negative values such as -1 and -512. Make sure we
+# sign-extend such in-place addends instead of zero-extending them.
+
+cat <<'EOF' | $CC -c -o $t/a.o -xassembler -
+.data
+.globl x8, x16, xpc8, xpc16
+x8:    .byte  abs8 - 1
+x16:   .short abs16 - 512
+xpc8:  .byte  target - . - 1
+xpc16: .short target - . - 512
+
+.section .nonalloc
+.byte  abs8 - 1
+.short abs16 - 512
+EOF
+
+cat <<'EOF' | $CC -c -o $t/b.o -xassembler -
+.globl abs8, abs16
+abs8 = 100
+abs16 = 1000
+
+.data
+.globl target
+target:
+.byte 0
+EOF
+
+cat <<'EOF' | $CC -c -o $t/c.o -xc -
+#include <stdio.h>
+
+extern char target;
+extern unsigned char x8, xpc8;
+extern unsigned short x16, xpc16;
+
+int main() {
+  printf("%d %d %d %d\n", x8, x16,
+         (signed char)xpc8 == (char *)&target - (char *)&xpc8 - 1,
+         (short)xpc16 == (char *)&target - (char *)&xpc16 - 512);
+}
+EOF
+
+$CC -B. -no-pie -o $t/exe $t/a.o $t/b.o $t/c.o
+$QEMU $t/exe | grep '^99 488 1 1$'
+
+$OBJDUMP -s -j .nonalloc $t/exe | grep -w 63e801
@@ -0,0 +1,80 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# When mold relaxes an instruction sequence, the relocations attached to the
+# original instructions no longer match the relaxed code. With --emit-relocs,
+# mold must rewrite them so that the emitted relocations describe the relaxed
+# instructions, both in type and in offset.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xassembler -
+.text
+.globl _start
+_start:
+  # pcaddu18i + jirl => bl  (R_LARCH_CALL36 => R_LARCH_B26)
+  .reloc ., R_LARCH_RELAX
+  pcaddu18i $ra, %call36(get_zero)
+  jirl $ra, $ra, 0
+
+  # pcalau12i + addi.d => pcaddi  (R_LARCH_PCALA_* => R_LARCH_PCREL20_S2)
+  .reloc ., R_LARCH_RELAX
+  pcalau12i $t0, %pc_hi20(v)
+  .reloc ., R_LARCH_RELAX
+  addi.d $t0, $t0, %pc_lo12(v)
+  ld.w $t0, $t0, 0
+  or $a0, $a0, $t0
+
+  # pcalau12i + ld.d => pcaddi  (R_LARCH_GOT_PC_* => R_LARCH_PCREL20_S2)
+  .reloc ., R_LARCH_RELAX
+  pcalau12i $t1, %got_pc_hi20(v)
+  .reloc ., R_LARCH_RELAX
+  ld.d $t1, $t1, %got_pc_lo12(v)
+  ld.w $t1, $t1, 0
+  or $a0, $a0, $t1
+
+  li.w $a7, 93           # __NR_exit
+  syscall 0
+
+get_zero:
+  li.w $a0, 0
+  ret
+
+.section .rodata,"a"
+.p2align 2
+.hidden v
+v:
+  .word 0
+EOF
+
+$CC -B. -o $t/exe $t/a.o --static -nostdlib -Wl,-e,_start,--emit-relocs,--relax
+$QEMU $t/exe
+
+$OBJDUMP -dr $t/exe > $t/exe.objdump
+
+# Relaxation took place.
+grep -Fw pcaddi $t/exe.objdump
+grep -Fw bl $t/exe.objdump
+
+# The relocations were rewritten to match the relaxed instructions. The dead
+# high-part relocations are turned into R_LARCH_NONE.
+grep -Fw R_LARCH_PCREL20_S2 $t/exe.objdump
+grep -Fw R_LARCH_B26 $t/exe.objdump
+grep -Fw R_LARCH_NONE $t/exe.objdump
+
+# The stale pre-relaxation relocations are gone.
+not grep -Fw R_LARCH_PCALA_HI20 $t/exe.objdump
+not grep -Fw R_LARCH_PCALA_LO12 $t/exe.objdump
+not grep -Fw R_LARCH_GOT_PC_HI20 $t/exe.objdump
+not grep -Fw R_LARCH_GOT_PC_LO12 $t/exe.objdump
+not grep -Fw R_LARCH_CALL36 $t/exe.objdump
+
+# Each rewritten relocation must sit at the address of the relaxed instruction
+# it describes, not at its original pre-relaxation offset. This checks that the
+# relocation offsets were adjusted: R_LARCH_PCREL20_S2 must land on a pcaddi
+# and R_LARCH_B26 on a b/bl.
+awk '
+  $3 == "pcaddi"             { insn[$1] = $3 }
+  $3 == "b" || $3 == "bl"    { insn[$1] = $3 }
+  $2 == "R_LARCH_PCREL20_S2" { if (insn[$1] != "pcaddi")       { bad=1; print "bad offset: " $0 } }
+  $2 == "R_LARCH_B26"        { if (insn[$1] !~ /^bl?$/)        { bad=1; print "bad offset: " $0 } }
+  END { exit bad+0 }
+' $t/exe.objdump
@@ -0,0 +1,90 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Depending on the symbol, mold relaxes a TLSDESC sequence into a local-exec
+# (LE) or initial-exec (IE) sequence, or keeps it as TLSDESC but folds its
+# first two instructions into a single pcaddi. With --emit-relocs, the emitted
+# relocations must be rewritten to match whichever relaxation was applied.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xc - -fPIC
+_Thread_local char foo[4] = "foo";
+_Thread_local char padding[100000] = "pad";
+_Thread_local char bar[4] = "bar";
+EOF
+
+cat <<'EOF' | $CC -o $t/b.o -c -xc - -fPIC -mtls-dialect=desc -O2
+extern _Thread_local char foo[4];
+extern _Thread_local char bar[4];
+char *get_foo() { return foo; }
+char *get_bar() { return bar; }
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc - -mtls-dialect=desc
+#include <stdio.h>
+char *get_foo();
+char *get_bar();
+int main() { printf("%s %s\n", get_foo(), get_bar()); }
+EOF
+
+#
+# Local TLS in an executable: TLSDESC => LE
+#
+$CC -B. -o $t/exe1 $t/a.o $t/b.o $t/c.o -Wl,--emit-relocs,--relax
+{ $QEMU $t/exe1; true; } |& grep -q 'unexpected reloc type' && skip
+$QEMU $t/exe1 | grep -F 'foo bar'
+
+$OBJDUMP -dr $t/exe1 > $t/exe1.objdump
+
+# foo has a small TP offset, so its sequence relaxes to a single instruction
+# with only a low-part relocation. bar has a large offset, so it keeps both
+# the high- and low-part relocations.
+grep -E $'R_LARCH_TLS_LE_LO12[ \t]+foo' $t/exe1.objdump
+not grep -E $'R_LARCH_TLS_LE_HI20[ \t]+foo' $t/exe1.objdump
+grep -E $'R_LARCH_TLS_LE_HI20[ \t]+bar' $t/exe1.objdump
+grep -E $'R_LARCH_TLS_LE_LO12[ \t]+bar' $t/exe1.objdump
+
+# No TLSDESC relocation survives.
+not grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_LD $t/exe1.objdump
+not grep -Fw R_LARCH_TLS_DESC_CALL $t/exe1.objdump
+
+#
+# TLS defined in a shared library: TLSDESC => IE
+#
+$CC -B. -shared -o $t/d.so $t/a.o -Wl,--relax
+$CC -B. -o $t/exe2 $t/b.o $t/c.o $t/d.so -Wl,--emit-relocs,--relax -Wl,-rpath=$t
+$QEMU $t/exe2 | grep -F 'foo bar'
+
+$OBJDUMP -dr $t/exe2 > $t/exe2.objdump
+grep -Fw R_LARCH_TLS_IE_PC_HI20 $t/exe2.objdump
+grep -Fw R_LARCH_TLS_IE_PC_LO12 $t/exe2.objdump
+not grep -Fw R_LARCH_TLS_DESC_LD $t/exe2.objdump
+not grep -Fw R_LARCH_TLS_DESC_CALL $t/exe2.objdump
+
+#
+# Shared library output: TLSDESC is kept, but pcalau12i+addi.d => pcaddi, so
+# the low-part relocation becomes the pcaddi's TLS_DESC_PCREL20_S2 while the
+# ld.d/jirl relocations are left unchanged.
+#
+$CC -B. -shared -o $t/e.so $t/a.o $t/b.o -Wl,--emit-relocs,--relax
+$OBJDUMP -dr $t/e.so > $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_PCREL20_S2 $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_LD $t/e.objdump
+grep -Fw R_LARCH_TLS_DESC_CALL $t/e.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/e.objdump
+not grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/e.objdump
+
+#
+# Relocatable output: no relaxation happens and TLSDESC is not downgraded, so
+# every relocation must be passed through unchanged rather than rewritten as
+# if it had been relaxed to LE/IE.
+#
+$CC -B. -o $t/reloc.o $t/b.o -r
+$OBJDUMP -r $t/reloc.o > $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_PC_HI20 $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_PC_LO12 $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_LD $t/reloc.objdump
+grep -Fw R_LARCH_TLS_DESC_CALL $t/reloc.objdump
+not grep -Fw R_LARCH_TLS_LE_HI20 $t/reloc.objdump
+not grep -Fw R_LARCH_TLS_LE_LO12 $t/reloc.objdump
@@ -0,0 +1,33 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# pcaddi takes a 20-bit immediate that is shifted left by 2 to form
+# a PC-relative offset. Therefore, relaxing a GOT load (pcalau12i +
+# ld.d) to pcaddi is valid only when the symbol's address is 4-byte
+# aligned. Here, `foo` is placed at an odd address, so the relaxation
+# must not happen.
+
+cat <<EOF | $CC -o $t/a.o -c -xassembler -
+.data
+.byte 0
+.globl foo
+.type foo, @object
+foo:
+.byte 0x42
+.size foo, 1
+EOF
+
+cat <<EOF | $CC -o $t/b.o -c -xc - -fPIC -O
+extern char foo;
+int get_foo() { return foo; }
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc -
+#include <stdio.h>
+int get_foo();
+int main() { printf("%d\n", get_foo()); }
+EOF
+
+$CC -B. -o $t/exe $t/a.o $t/b.o $t/c.o -pie -Wl,--relax
+$QEMU $t/exe | grep '^66$'
+$OBJDUMP -d $t/exe | grep -A2 '<get_foo>:' | grep -Fw pcalau12i
@@ -0,0 +1,98 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# When mold relaxes instructions, the relocations attached to the relaxed code
+# must be rewritten for --emit-relocs. A shortened call still references its
+# symbol, so R_RISCV_CALL_PLT becomes R_RISCV_JAL or R_RISCV_RVC_JUMP. A
+# relaxation that folds an address into the instruction as a link-time
+# constant (lui/addi or an AUIPC+LD GOT load) leaves the instruction without a
+# relocation, so we emit R_RISCV_NONE.
+
+cat <<'EOF' | $CC -o $t/a.o -c -xassembler -
+.text
+.globl _start
+_start:
+  # CALL_PLT => jal (near target)
+  .reloc ., R_RISCV_RELAX
+  call func
+
+  # lui + addi of a small absolute symbol => lui is deleted (HI20 => NONE),
+  # while the low-part relocation stays.
+  lui t0, %hi(small)
+  .reloc ., R_RISCV_RELAX
+  addi t0, t0, %lo(small)
+
+  # GOT load of an absolute symbol => the value is materialized directly
+  # (GOT_HI20 and its paired PCREL_LO12_I both => NONE).
+got_anchor:
+  .reloc ., R_RISCV_GOT_HI20, small
+  .reloc ., R_RISCV_RELAX
+  auipc t1, 0
+  .reloc ., R_RISCV_PCREL_LO12_I, got_anchor
+  .reloc ., R_RISCV_RELAX
+  ld t1, 0(t1)
+
+  # CALL with rd=zero (tail call) to a near target => c.j (=> RVC_JUMP)
+  .reloc ., R_RISCV_RELAX
+  tail do_exit
+
+func:
+  ret
+
+do_exit:
+  li a0, 0
+  li a7, 93           # __NR_exit
+  ecall
+EOF
+
+cat <<'EOF' | $CC -o $t/b.o -c -xassembler -
+.globl small
+small = 0xba
+EOF
+
+$CC -B. -o $t/exe $t/a.o $t/b.o --static -nostdlib -Wl,-e,_start,--emit-relocs,--relax
+$QEMU $t/exe
+
+$OBJDUMP -dr $t/exe > $t/exe.objdump
+
+# A shortened call keeps a relocation that names the symbol.
+grep -Fw R_RISCV_JAL $t/exe.objdump
+grep -Fw R_RISCV_RVC_JUMP $t/exe.objdump
+
+# Address-materializing relaxations drop their relocations.
+grep -Fw R_RISCV_NONE $t/exe.objdump
+
+# The stale pre-relaxation relocations are gone.
+not grep -Fw R_RISCV_CALL_PLT $t/exe.objdump
+not grep -Fw R_RISCV_GOT_HI20 $t/exe.objdump
+not grep -Fw R_RISCV_HI20 $t/exe.objdump
+
+# The low-part relocation of the lui/addi pair survives (the addi is kept).
+grep -Fw R_RISCV_LO12_I $t/exe.objdump
+
+# Each rewritten call relocation must sit on the relaxed instruction it
+# describes: R_RISCV_JAL on a jal and R_RISCV_RVC_JUMP on a c.j. This checks
+# that the relocation offsets were adjusted for the deleted bytes.
+awk '
+  $3 == "jal"              { insn[$1] = "jal" }
+  $3 == "j" || $3 == "c.j" { insn[$1] = "cj" }
+  $2 == "R_RISCV_JAL"      { if (insn[$1] != "jal") { bad=1; print "bad offset: " $0 } }
+  $2 == "R_RISCV_RVC_JUMP" { if (insn[$1] != "cj")  { bad=1; print "bad offset: " $0 } }
+  END { exit bad+0 }
+' $t/exe.objdump
+
+# TLS local-exec: `lui + add` that materializes TP + %tprel_hi are deleted for
+# a variable within 2 KiB of TP (TPREL_HI20 and TPREL_ADD => NONE), while the
+# access relative to TP keeps its low-part relocation.
+cat <<'EOF' | $CC -o $t/tls.o -c -xc - -O2 -fno-section-anchors
+__thread int tv;
+int main(void) { return tv; }     // tv is zero-initialized, so exits 0
+EOF
+
+$CC -B. -o $t/tls $t/tls.o -static -Wl,--emit-relocs,--relax
+$QEMU $t/tls
+
+$OBJDUMP -dr $t/tls > $t/tls.objdump
+grep -E $'R_RISCV_TPREL_LO12_[IS][ \t]+tv' $t/tls.objdump
+not grep -E $'R_RISCV_TPREL_HI20[ \t]+tv' $t/tls.objdump
+not grep -E $'R_RISCV_TPREL_ADD[ \t]+tv' $t/tls.objdump
@@ -0,0 +1,26 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -x assembler -
+.section .foo, "ax"
+foo:
+  call bar
+EOF
+
+cat <<EOF | $CC -o $t/b.o -c -x assembler -
+.globl bar
+.section .bar, "ax"
+bar:
+  ret
+EOF
+
+cat <<EOF | $CC -o $t/c.o -c -xc -
+int main() {}
+EOF
+
+$CC -B. -o $t/exe1 $t/a.o $t/b.o $t/c.o -Wl,--section-start=.foo=0x10000 \
+  -Wl,--section-start=.bar=0x8000f000
+
+not $CC -B. -o $t/exe2 $t/a.o $t/b.o $t/c.o -Wl,--section-start=.foo=0x10000 \
+  -Wl,--section-start=.bar=0x8000f800 |&
+  grep -F 'relocation R_RISCV_CALL_PLT against bar out of range'
@@ -1,4 +1,6 @@
 #!/bin/bash
 . $(dirname $0)/common.inc

+nm -D mold | grep __msan_init && skip
+
 not ./mold -m elf_x86_64 '' |& grep 'cannot open :'
@@ -0,0 +1,38 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+supports_ifunc || skip
+
+cat <<EOF | $CXX -c -fPIC -o $t/a.o -xc++ -
+__attribute__((target("default"))) void myfunc(int) {}
+__attribute__((target("avx512f"))) void myfunc(int) {}
+
+template <typename T>
+struct MyClass {
+  MyClass(T data) { myfunc(data); }
+};
+
+template struct MyClass<int>;
+EOF
+
+$CXX -shared -o $t/b.so $t/a.o
+
+cat <<EOF | $CXX -c -fPIC -o $t/c.o -xc++ -
+__attribute__((target("default"))) void myfunc(int);
+__attribute__((target("avx512f"))) void myfunc(int);
+
+template <typename T>
+struct MyClass {
+  MyClass(T data) { myfunc(data); }
+};
+
+extern template struct MyClass<int>;
+
+int main() {
+  MyClass<int> obj(3);
+}
+EOF
+
+$CXX -B. -o $t/exe $t/c.o $t/b.so -fno-PIE
+$QEMU $t/exe |& grep 'circular dependency' || skip
+$QEMU $t/exe
@@ -0,0 +1,39 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# This regression reproduces a mixed LTO + regular-object COMDAT case.
+# The regular object has a non-COMDAT section referring to a symbol in a
+# COMDAT group with signature "mix". An LTO object contributes the same
+# COMDAT key. If IR COMDAT ownership is allowed to override reachable regular
+# object ownership, the regular COMDAT member can be discarded incorrectly.
+
+[ $MACHINE = $(uname -m) ] || skip
+
+CLANG="${TEST_CLANG:-clang}"
+$CLANG --version >& /dev/null || skip
+echo 'int main() {}' | $CLANG -B. -flto -o /dev/null -xc - >& /dev/null || skip
+
+cat <<'EOF' > $t/a.ll
+$mix = comdat any
+@mix_lto = global i32 1, comdat($mix)
+EOF
+
+cat <<'EOF' > $t/b.s
+.globl keep_me
+.section .text.keep_me,"axG",@progbits,mix,comdat
+keep_me:
+  ret
+
+.text
+.globl main
+main:
+  call keep_me
+  xor %eax, %eax
+  ret
+EOF
+
+$CLANG -S -emit-llvm -flto -o $t/a.bc $t/a.ll
+$CC -o $t/b.o -c -x assembler $t/b.s
+$CLANG -B. -o $t/exe -flto $t/a.bc $t/b.o
+
+$QEMU $t/exe
@@ -44,7 +44,7 @@ str2:
  .ascii "mnopqr\n\0"
 EOF

-$CC -B. -static -o $t/exe $t/a.o
+$CC -B. -static -no-pie -o $t/exe $t/a.o

 $QEMU $t/exe | grep '^abcdef$'
 $QEMU $t/exe | grep '^bcdef$'
@@ -26,7 +26,7 @@ foo:
  .string "foo world\n"
 EOF

-$CC -B. -static -o $t/exe $t/a.o
+$CC -B. -static -no-pie -o $t/exe $t/a.o
 $QEMU $t/exe | grep 'Hello world'

 readelf -sW $t/exe | grep -E '[0-9] foo$'
@@ -0,0 +1,167 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Verify that the .sframe section mold produces is not just well-formed but
+# actually usable for stack unwinding. We link a program that, using only
+# its own merged .sframe (read via libsframe), walks a known call chain and
+# checks that each recovered frame maps to the expected function.
+
+# Skip unless the assembler emits SFrame Version 3.
+cat <<EOF | $CC -Wa,--gsframe -o $t/probe.o -c -xc - 2>/dev/null || skip
+int main() { return 0; }
+EOF
+readelf --sframe=.sframe $t/probe.o 2>/dev/null | grep -q SFRAME_VERSION_3 || skip
+
+# Skip unless libsframe and its header are available.
+echo 'int main(){return 0;}' | \
+  $CC -o $t/probe -xc - -lsframe -include sframe-api.h 2>/dev/null || skip
+
+cat <<'EOF' | $CC -O0 -g -fno-omit-frame-pointer -Wa,--gsframe -B. -o $t/exe -xc - -lsframe
+#define _GNU_SOURCE
+#include <sframe-api.h>
+#include <link.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#ifndef PT_GNU_SFRAME
+#define PT_GNU_SFRAME 0x6474e554
+#endif
+
+static uintptr_t sec_addr;
+static size_t sec_size;
+
+static int find_cb(struct dl_phdr_info *info, size_t sz, void *u) {
+  (void)sz; (void)u;
+  for (int i = 0; i < info->dlpi_phnum; i++) {
+    const ElfW(Phdr) *p = &info->dlpi_phdr[i];
+    if (p->p_type == PT_GNU_SFRAME) {
+      sec_addr = info->dlpi_addr + p->p_vaddr;
+      sec_size = p->p_memsz;
+      return 1;
+    }
+  }
+  return 0;
+}
+
+static sframe_decoder_ctx *dctx;
+static int32_t fixed_ra;
+
+#define MAXF 4096
+static uintptr_t fstart[MAXF], fend[MAXF];
+static int nfde;
+
+static int find_fde(uintptr_t pc) {
+  for (int i = 0; i < nfde; i++)
+    if (fstart[i] <= pc && pc < fend[i])
+      return i;
+  return -1;
+}
+
+// One SFrame unwind step per loop iteration; records the start address of
+// the function each frame belongs to.
+static int unwind(uintptr_t pc, uintptr_t sp, uintptr_t fp,
+                  uintptr_t *out, int max) {
+  int n = 0;
+  while (n < max) {
+    int idx = find_fde(pc);
+    if (idx < 0)
+      break;
+    out[n++] = fstart[idx];
+
+    uint32_t num_fres, func_size;
+    int64_t spo;
+    unsigned char fi, fi2;
+    uint8_t rep;
+    if (sframe_decoder_get_funcdesc_v3(dctx, idx, &num_fres, &func_size,
+                                       &spo, &fi, &fi2, &rep))
+      break;
+    uint32_t fde_type = SFRAME_V3_FDE_TYPE(fi2);
+
+    int64_t off = pc - fstart[idx];
+    sframe_frame_row_entry fre, cur;
+    int have = 0;
+    for (uint32_t k = 0; k < num_fres; k++) {
+      if (sframe_decoder_get_fre(dctx, idx, k, &cur))
+        break;
+      if ((int64_t)cur.fre_start_addr <= off) { fre = cur; have = 1; }
+      else break;
+    }
+    if (!have)
+      break;
+
+    int e = 0;
+    int base = sframe_fre_get_base_reg_id(&fre, &e);
+    int32_t cfa_off = sframe_fre_get_cfa_offset(dctx, &fre, fde_type, &e);
+    uintptr_t cfa = (base == SFRAME_BASE_REG_SP ? sp : fp) + cfa_off;
+    uintptr_t ra = *(uintptr_t *)(cfa + fixed_ra);
+
+    e = 0;
+    int32_t fp_off = sframe_fre_get_fp_offset(dctx, &fre, fde_type, &e);
+    uintptr_t next_fp = (e == 0) ? *(uintptr_t *)(cfa + fp_off) : fp;
+
+    if (!ra)
+      break;
+    sp = cfa;
+    fp = next_fp;
+    pc = ra;
+  }
+  return n;
+}
+
+static uintptr_t chain[16];
+static int chain_n;
+
+__attribute__((noinline)) static int level3(int x) {
+  uintptr_t pc, sp, fp;
+  asm volatile("leaq 1f(%%rip), %0\n1:\n\t"
+               "movq %%rsp, %1\n\t"
+               "movq %%rbp, %2"
+               : "=r"(pc), "=r"(sp), "=r"(fp));
+  chain_n = unwind(pc, sp, fp, chain, 16);
+  return x + 1;
+}
+
+__attribute__((noinline)) static int level2(int x) { return level3(x) + x; }
+__attribute__((noinline)) static int level1(int x) { return level2(x) + x; }
+
+int main(void) {
+  if (!dl_iterate_phdr(find_cb, NULL) || !sec_addr)
+    return 1;
+
+  int err = 0;
+  dctx = sframe_decode((const char *)sec_addr, sec_size, &err);
+  if (!dctx)
+    return 1;
+  fixed_ra = sframe_decoder_get_fixed_ra_offset(dctx);
+
+  uint32_t num = sframe_decoder_get_num_fidx(dctx);
+  for (uint32_t i = 0; i < num && nfde < MAXF; i++) {
+    uint32_t num_fres, func_size;
+    int64_t spo;
+    unsigned char fi, fi2;
+    uint8_t rep;
+    if (sframe_decoder_get_funcdesc_v3(dctx, i, &num_fres, &func_size,
+                                       &spo, &fi, &fi2, &rep))
+      continue;
+    int e = 0;
+    uint32_t fo = sframe_decoder_get_offsetof_fde_start_addr(dctx, i, &e);
+    fstart[nfde] = sec_addr + fo + spo; // PCREL: relative to the field
+    fend[nfde] = fstart[nfde] + func_size;
+    nfde++;
+  }
+
+  level1(0);
+
+  uintptr_t want[] = { (uintptr_t)&level3, (uintptr_t)&level2,
+                       (uintptr_t)&level1, (uintptr_t)&main };
+  int n = sizeof(want) / sizeof(want[0]);
+  if (chain_n < n)
+    return 1;
+  for (int i = 0; i < n; i++)
+    if (chain[i] != want[i])
+      return 1;
+  return 0;
+}
+EOF
+
+$QEMU $t/exe
@@ -13,3 +13,8 @@ EOF
 readelf --dynamic $t/b.so > $t/log
 grep -F 'Auxiliary library: [foo]' $t/log
 grep -F 'Auxiliary library: [bar]' $t/log
+
+not ./mold -o exe $t/a.o -f bar |& grep 'auxiliary may not be used without -shared'
+
+# -fuse-ld is ignored
+./mold -o exe $t/a.o -fuse-ld=mold
@@ -0,0 +1,23 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -c -g -o $t/a.o -xc -
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+int main() { printf("Hello world\n"); }
+EOF
+
+# Level 0 stores data uncompressed; level 9 compresses hardest.
+# The level-0 executable must be larger than the level-9 one.
+$CC -B. -o $t/exe0 $t/a.o -Wl,--compress-debug-sections=zlib:0
+$CC -B. -o $t/exe9 $t/a.o -Wl,--compress-debug-sections=zlib:9
+readelf -WS $t/exe0 | grep '\.debug_info .* [Cx] '
+readelf -WS $t/exe9 | grep '\.debug_info .* [Cx] '
+[ $(wc -c < $t/exe0) -gt $(wc -c < $t/exe9) ]
+
+# Out-of-range level should fail with a descriptive error
+not $CC -B. -o $t/exe-1 $t/a.o -Wl,--compress-debug-sections=zlib:-1 |&
+  grep 'zlib level must be between 0 and 9'
+not $CC -B. -o $t/exe10 $t/a.o -Wl,--compress-debug-sections=zlib:10 |&
+  grep 'zlib level must be between 0 and 9'
@@ -0,0 +1,21 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -c -g -o $t/a.o -xc -
+#include <stdio.h>
+int main() { printf("Hello world\n"); }
+EOF
+
+# Test zstd:1 (lowest level)
+$CC -B. -o $t/exe1 $t/a.o -Wl,--compress-debug-sections=zstd:1
+readelf -WS $t/exe1 | grep '\.debug_info .* [Cx] '
+
+# Test zstd:22 (highest level)
+$CC -B. -o $t/exe22 $t/a.o -Wl,--compress-debug-sections=zstd:22
+readelf -WS $t/exe22 | grep '\.debug_info .* [Cx] '
+
+# Out-of-range level should fail with a descriptive error
+not $CC -B. -o $t/exe0 $t/a.o -Wl,--compress-debug-sections=zstd:0 |&
+  grep 'zstd level must be between 1 and 22'
+not $CC -B. -o $t/exe23 $t/a.o -Wl,--compress-debug-sections=zstd:23 |&
+  grep 'zstd level must be between 1 and 22'
@@ -24,4 +24,4 @@ int main() {
 EOF

 $CC -B. -o $t/exe $t/b.so $t/d.a $t/e.o
-readelf --dyn-syms $t/exe | grep ' foo$'
+readelf --dyn-syms $t/exe | grep -E ' foo(@@)?$'
@@ -0,0 +1,10 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc - -fPIC
+void foo() {}
+EOF
+
+$CC -B. -shared -o $t/b.so $t/a.o
+./mold -shared -o $t/c.so $t/b.so
+readelf -W --dynamic $t/c.so | grep -F /b.so
@@ -0,0 +1,25 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# A section whose name is a valid C identifier should be GC'd if
+# neither its contents nor its __start_/__stop_ marker symbols are
+# referenced from a live section.
+cat <<EOF | $CC -c -o $t/a.o -xc -
+__attribute__((section("foo"))) int dead_data = 42;
+__attribute__((section("bar"))) int live_data = 99;
+
+extern int __start_bar[];
+extern int __stop_bar[];
+
+int main() {
+  return __stop_bar - __start_bar + live_data;
+}
+EOF
+
+$CC -B. -o $t/exe $t/a.o -Wl,-gc-sections
+readelf --symbols $t/exe > $t/log
+
+not grep dead_data $t/log
+grep live_data $t/log
+grep __start_bar $t/log
+grep __stop_bar $t/log
@@ -0,0 +1,33 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+on_qemu && skip
+[ $MACHINE = riscv64 -o $MACHINE = riscv32 -o $MACHINE = sparc64 ] && skip
+test_cflags -gdwarf-5 -g || skip
+
+# Generate many translation units that all reference common types and
+# names so the per-name CU index list contains entries from multiple
+# threads. This stresses the parallel writer in --gdb-index that fills
+# in (type, cu) tuples for each name, which must produce a deterministic
+# output regardless of thread scheduling.
+objs=
+for i in $(seq 1 24); do
+  cat <<EOF > $t/u$i.c
+#include <stdio.h>
+struct s$i { int x; };
+int fn$i(struct s$i *p) { return printf("%d\n", p->x); }
+EOF
+  $CC -c -o $t/u$i.o $t/u$i.c -fPIC -g -ggnu-pubnames
+  objs="$objs $t/u$i.o"
+done
+
+$CC -B. -shared -o $t/out1.so -Wl,--gdb-index $objs
+$CC -B. -shared -o $t/out2.so -Wl,--gdb-index $objs
+$CC -B. -shared -o $t/out3.so -Wl,--gdb-index $objs
+$CC -B. -shared -o $t/out4.so -Wl,--gdb-index $objs
+$CC -B. -shared -o $t/out5.so -Wl,--gdb-index $objs
+
+cmp $t/out1.so $t/out2.so
+cmp $t/out1.so $t/out3.so
+cmp $t/out1.so $t/out4.so
+cmp $t/out1.so $t/out5.so
@@ -63,8 +63,8 @@ $CC -c -o $t/d.o $t/d.c -fPIC -g -ggnu-pubnames -gdwarf-5 -ffunction-sections

 $CC -B. -shared -o $t/e.so $t/a.o $t/b.o $t/c.o $t/d.o -Wl,--gdb-index
 readelf -WS $t/e.so 2> /dev/null | grep -F .gdb_index
-readelf --debug=gdb_index $t/e.so 2> /dev/null | grep 'fn1: .* \[global, function\]'
-readelf --debug=gdb_index $t/e.so 2> /dev/null | grep 'char: .* \[static, type\]'
+readelf --debug-dump=gdb_index $t/e.so 2> /dev/null | grep 'fn1: .* \[global, function\]'
+readelf --debug-dump=gdb_index $t/e.so 2> /dev/null | grep 'char: .* \[static, type\]'

 cat <<EOF | $CC -c -o $t/f.o -fPIC -g -ggnu-pubnames -gdwarf-5 -xc - -gz
 void fn1();
@@ -76,7 +76,7 @@ EOF

 $CC -B. -o $t/exe $t/e.so $t/f.o -Wl,--gdb-index
 readelf -WS $t/exe 2> /dev/null | grep -F .gdb_index
-readelf --debug=gdb_index $t/exe 2> /dev/null | grep 'main: .* \[global, function\]'
+readelf --debug-dump=gdb_index $t/exe 2> /dev/null | grep 'main: .* \[global, function\]'

 $QEMU $t/exe | grep 'Hello world'

@@ -0,0 +1,39 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Regression test for https://github.com/rui314/mold/issues/1578.
+# When DWARF 5 .debug_rnglists' offset table contains entries for both
+# the CU root and child DIEs, mold must read only the entry indexed by
+# the CU's DW_FORM_rnglistx. Otherwise child DIE ranges leak into the
+# .gdb_index address table, overlapping the CU's enclosing range.
+
+[ $MACHINE = $(uname -m) ] || skip
+echo 'int main() {}' | clang++ -gdwarf-5 -g -o /dev/null -xc++ - 2> /dev/null || skip
+
+cat <<EOF > $t/a.cc
+void may_throw(int x) {
+  if (x < 0)
+    throw x;
+}
+
+struct Guard {
+  int v;
+  ~Guard() { may_throw(v); }
+};
+
+int main() {
+  {
+    Guard g{1};
+    may_throw(2);
+  }
+}
+EOF
+
+clang++ -B. -O0 -ggdb3 -ggnu-pubnames -gdwarf-5 \
+  -Wl,--gdb-index $t/a.cc -o $t/exe
+
+readelf --debug-dump=gdb_index $t/exe |
+  sed -n '/^Address table:/,/^$/p' |
+  grep -E '^[0-9a-f]+ [0-9a-f]+' |
+  sort |
+  awk 'NR > 1 && $1 < prev { exit 1 } { prev = $2 }'
@@ -0,0 +1,25 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# Verify that mold can link object files compiled with Clang's HWASAN
+# instrumentation. On aarch64 such objects contain relocations like
+# R_AARCH64_MOVW_PREL_G3 that mold previously rejected
+# (https://github.com/rui314/mold/issues/1592).
+[ "$CC" = cc ] || skip
+
+# Disable HWASAN's global-variable tagging. It is orthogonal to the
+# relocations exercised here, and old Clang implements it by baking a tag
+# into the high bits of a 32-bit relocation's addend, producing objects
+# that no linker (mold, GNU ld or lld) can resolve.
+cat <<EOF | clang -fsanitize=hwaddress -mllvm -hwasan-globals=0 -c -o $t/a.o -xc - 2> /dev/null || skip
+#include <stdio.h>
+int main() { printf("Hello world\n"); }
+EOF
+
+# Skip unless this toolchain can produce a HWASAN executable at all (e.g.
+# the sanitizer runtime may not be installed). We probe with Clang's
+# default linker so that a mold-specific failure below is still reported
+# as a test failure rather than silently skipped.
+clang -fsanitize=hwaddress -o $t/exe $t/a.o 2> /dev/null || skip
+
+clang -fsanitize=hwaddress -B. -o $t/exe $t/a.o
@@ -0,0 +1,75 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# This test is only applicable to x86 and x86_64 because they use the lowest
+# bit of member function pointers for virtuality.
+case $MACHINE in
+  x86_64 | i686) ;;
+  *) skip ;;
+esac
+
+# We use assembly to define functions to have full control over alignment.
+# We swap the order so that regular_func (alignment 1) comes first and
+# is more likely to be chosen as the leader by ICF.
+# We make pre_func size 2 to try to make regular_func start at an odd address.
+cat <<EOF | $CC -c -o $t/fns.o -x assembler -
+  .text
+
+  .section .text.pre_func, "ax", @progbits
+  .globl pre_func
+  .p2align 0
+pre_func:
+  .byte 0x90, 0x90 # two nops (size 2)
+
+  .section .text.regular_func, "ax", @progbits
+  .globl regular_func
+  .p2align 0 # 1-byte alignment
+regular_func:
+  ret
+
+  .section .text.member_func, "ax", @progbits
+  .globl _ZN3Foo11member_funcEv
+  .p2align 2 # 4-byte alignment
+_ZN3Foo11member_funcEv:
+  ret
+EOF
+
+cat <<EOF | $CXX -c -o $t/main.o -xc++ -
+#include <iostream>
+#include <stdint.h>
+
+struct Foo {
+  void member_func();
+};
+
+extern "C" void regular_func();
+
+int main() {
+  void (Foo::*ptr)() = &Foo::member_func;
+  union {
+    void (Foo::*mem_ptr)();
+    struct {
+      void* ptr;
+      ptrdiff_t adj;
+    } parts;
+  } u;
+  u.mem_ptr = ptr;
+
+  std::cout << "member_func address:  " << u.parts.ptr << std::endl;
+  std::cout << "regular_func address: " << (void*)&regular_func << std::endl;
+
+  if (u.parts.ptr != (void*)&regular_func) {
+    std::cerr << "FAIL: functions were not folded!" << std::endl;
+    return 2;
+  }
+
+  if (reinterpret_cast<uintptr_t>(u.parts.ptr) & 1) {
+    std::cerr << "FAIL: member function pointer has odd address (treated as virtual)" << std::endl;
+    return 1;
+  }
+  return 0;
+}
+EOF
+
+$CXX -B. -o $t/exe $t/main.o $t/fns.o -Wl,--icf=all
+$QEMU $t/exe
@@ -0,0 +1,24 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+[ $MACHINE = arm ] && skip
+[ $MACHINE = armeb ] && skip
+[[ $MACHINE = riscv* ]] && skip
+[[ $MACHINE = loongarch* ]] && skip
+
+cat <<EOF | $CXX -c -o $t/a.o -ffunction-sections -fdata-sections -xc++ -
+#include <stdexcept>
+
+template <typename T>
+struct X {
+  static void raise() { throw std::logic_error("foo"); }
+};
+
+int main() {
+  X<int>().raise();
+  X<float>().raise();
+}
+EOF
+
+$CXX -B. -o $t/exe $t/a.o -Wl,-icf=safe,--print-icf-sections |&
+  grep -E 'removing .*/a.o:\(.gcc_except_table'
@@ -0,0 +1,34 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# On PPC64V1, function pointers refer function descriptors in .opd
+# instead of directly referring .text section.
+[ $MACHINE = ppc64 ] && skip
+
+cat <<EOF | $CC -c -o $t/a.o -ffunction-sections -fPIC -xc -
+void local_fn(void) {}
+__attribute__((visibility("hidden"))) void local_fn_hidden(void) {
+  local_fn();
+}
+
+void global_fn(void) {}
+
+void caller_local(void) {
+  local_fn_hidden();
+}
+
+void caller_global(void) {
+  global_fn();
+}
+EOF
+
+# Link as shared library with --icf=all
+$CC -B. -shared -o $t/libtest.so $t/a.o -Wl,--icf=all -Wl,--print-icf-sections > $t/out 2>&1
+
+# Verify that caller_local and caller_global were NOT folded.
+# If they were folded, one of them would be removed.
+not grep -q "removing identical section.*caller_local" $t/out
+not grep -q "removing identical section.*caller_global" $t/out
+
+# Also check with nm to be sure they have different addresses
+nm $t/libtest.so | grep -E 'caller_local|caller_global' | awk '{print $1}' | uniq | wc -l | grep -q 2
@@ -0,0 +1,12 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() {}
+EOF
+
+echo 'ASSERT(SIZEOF(.text) > 0, "text must not be empty")' > $t/good
+$CC -B. -o $t/exe $t/a.o -Wl,-T,$t/good
+
+echo 'ASSERT(SIZEOF(.text) == 0, "this should fail")' > $t/bad
+not $CC -B. -o $t/exe2 $t/a.o -Wl,-T,$t/bad |& grep 'this should fail'
@@ -0,0 +1,31 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() { return 0; }
+EOF
+
+# `. = ASSERT(expr, msg);` after SECTIONS is a common idiom for a
+# standalone assertion, e.g. the Linux kernel's KERNEL_IMAGE_SIZE
+# check
+cat <<'EOF' > $t/script
+SECTIONS {
+  . = 0x10000;
+  .text : { *(.text .text.*) }
+  _end = .;
+}
+. = ASSERT(_end - 0x10000 < 0x100000, "image too big");
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+
+cat <<'EOF' > $t/script2
+SECTIONS {
+  . = 0x10000;
+  .text : { *(.text .text.*) }
+  _end = .;
+}
+. = ASSERT(_end - 0x10000 > 0x100000, "this should fail");
+EOF
+
+not ./mold -o $t/exe2 $t/a.o -T $t/script2 |& grep 'this should fail'
@@ -0,0 +1,23 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() {}
+EOF
+
+cat <<'EOF' > $t/script
+text_end = ADDR(.text) + SIZEOF(.text);
+big = MAX(0x100, 0x200);
+aligned = ALIGN(0x1234, 0x1000);
+cond = DEFINED(no_such_symbol) ? no_such_symbol : 7;
+EOF
+
+$CC -B. -o $t/exe $t/a.o -Wl,-T,$t/script
+readelf -sW $t/exe > $t/log
+
+# text_end must be relative to the .text output section, not absolute
+text=$(readelf -SW $t/exe | grep -F ' .text' | head -1 | sed 's/.*\[ *\([0-9]*\)\].*/\1/')
+grep -E "text_end" $t/log | grep -vw ABS | grep -w $text
+grep -E '200 .* ABS big' $t/log
+grep -E '2000 .* ABS aligned' $t/log
+grep -E '7 .* ABS cond' $t/log
@@ -0,0 +1,30 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+__attribute__((section(".mydata"))) int d = 3;
+int main() { return 0; }
+EOF
+
+# .mydata runs at a high address but is stored (loaded) right after
+# .text, like a kernel or firmware image
+cat <<'EOF' > $t/script
+SECTIONS {
+  . = 0x100000;
+  .text : { *(.text .text.*) }
+  . = 0x800000;
+  .mydata : AT(ADDR(.mydata) - 0x600000) { *(.mydata) }
+  data_lma = LOADADDR(.mydata);
+  data_vma = ADDR(.mydata);
+}
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+readelf -lW $t/exe > $t/log
+
+# The load segment for .mydata must have PhysAddr = VirtAddr - 0x600000
+grep -E 'LOAD .*0x0*800000 0x0*200000' $t/log
+
+readelf -sW $t/exe > $t/log2
+grep -E '200000 .* data_lma' $t/log2
+grep -E '800000 .* data_vma' $t/log2
@@ -0,0 +1,25 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+__attribute__((section(".aa"))) int a = 1;
+__attribute__((section(".bb"))) int b = 2;
+int main() { return 0; }
+EOF
+
+# end_aa lies exactly on the boundary of .aa and .bb. It must be
+# associated with the preceding section, as in GNU ld; tools strip
+# sections (e.g. objcopy --remove-section) together with the symbols
+# they contain.
+cat <<'EOF' > $t/script
+SECTIONS {
+  .text : { *(.text .text.*) }
+  .aa : { *(.aa) }
+  end_aa = .;
+  .bb : { *(.bb) }
+}
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+idx=$(readelf -SW $t/exe | grep -F " .aa" | sed 's/.*\[ *\([0-9]*\)\].*/\1/')
+readelf -sW $t/exe | grep -w end_aa | grep -w $idx
@@ -0,0 +1,33 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() { return 0; }
+EOF
+
+# A section made only of data commands, padded with a fill pattern.
+# The script's own ASSERTs check the layout.
+cat <<'EOF' > $t/script
+SECTIONS {
+  . = 0x10000;
+  .text : { *(.text .text.*) }
+  .blob : ALIGN(16) {
+    blob_start = .;
+    BYTE(0x12)
+    SHORT(0x3456)
+    LONG(0x789abcde)
+    QUAD(0x1122334455667788)
+    . = ALIGN(16);
+    blob_end = .;
+  } =0xaaaaaaaa
+  ASSERT(blob_end - blob_start == 16, "bad blob size")
+}
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+
+off=$(readelf -SW $t/exe | grep -F .blob | awk '{print strtonum("0x" $6)}')
+test "$(dd if=$t/exe bs=1 skip=$off count=1 2>/dev/null | od -An -tx1 | tr -d ' ')" = 12
+# The padding byte at offset 15 comes from the fill pattern, which
+# starts anew at each gap
+test "$(dd if=$t/exe bs=1 skip=$((off + 15)) count=1 2>/dev/null | od -An -tx1 | tr -d ' ')" = aa
@@ -0,0 +1,17 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() {}
+EOF
+
+# A symbol assignment to an integer literal behaves like --defsym
+cat <<'EOF' > $t/script
+foo = 0x1234;
+bar = 256;
+EOF
+
+$CC -B. -o $t/exe $t/a.o -Wl,-T,$t/script
+readelf -sW $t/exe > $t/log
+grep -E '1234 .* ABS foo' $t/log
+grep -E '100 .* ABS bar' $t/log
@@ -0,0 +1,43 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+__attribute__((section(".foo"))) int foo_var = 1;
+__attribute__((section(".bar.x"))) int bar_var = 2;
+__attribute__((section(".keep"))) int keep_var = 3;
+int main() { return 0; }
+EOF
+
+cat <<'EOF' > $t/script
+SECTIONS {
+  /DISCARD/ : { *(.foo) *(.bar.*) }
+}
+EOF
+
+$CC -B. -o $t/exe1 $t/a.o -Wl,-T,$t/script
+readelf -SW $t/exe1 > $t/log1
+not grep -F .foo $t/log1
+not grep -F .bar $t/log1
+grep -F .keep $t/log1
+
+# EXCLUDE_FILE and per-file patterns restrict what is discarded
+cat <<'EOF' > $t/script2
+SECTIONS {
+  /DISCARD/ : { *(EXCLUDE_FILE(*a.o) .foo) no-such-file.o(.bar.*) }
+}
+EOF
+
+$CC -B. -o $t/exe2 $t/a.o -Wl,-T,$t/script2
+readelf -SW $t/exe2 > $t/log2
+grep -F .foo $t/log2
+grep -F .bar.x $t/log2
+
+# A /DISCARD/ with output section attributes is not a plain discard
+# and must be rejected
+cat <<'EOF' > $t/script3
+SECTIONS {
+  /DISCARD/ 0x1000 : { *(.foo) }
+}
+EOF
+
+not $CC -B. -o $t/exe3 $t/a.o -Wl,-T,$t/script3 |& grep 'cannot have output section attributes'
@@ -0,0 +1,38 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+__attribute__((section(".dat"), aligned(4))) int d = 7;
+int main() { return 0; }
+EOF
+
+# Location counter arithmetic in an output section body. The script's
+# own assertions verify the layout, including a symbol defined from an
+# earlier body symbol.
+cat <<'EOF' > $t/script
+SECTIONS {
+  . = 0x10000;
+  .text : { *(.text .text.*) }
+  .dat : ALIGN(32) {
+    dat_start = .;
+    . += 16;
+    reserved_end = .;
+    *(.dat)
+    . = dat_start + 64;
+    dat_end = .;
+  }
+  ASSERT(reserved_end - dat_start == 16, "bad reservation")
+  ASSERT(dat_end - dat_start == 64, "bad section size")
+  ASSERT(SIZEOF(.dat) == 64, "bad SIZEOF")
+  ASSERT(ADDR(.dat) % 32 == 0, "bad alignment")
+}
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+readelf -SW $t/exe | grep -E "\.dat .* 000040"
+
+# The input section was placed after the 16-byte reservation
+readelf -sW $t/exe > $t/log
+dat=$(grep -w dat_start $t/log | awk '{print strtonum("0x" $2)}')
+d=$(grep -E " d$" $t/log | grep OBJECT | awk '{print strtonum("0x" $2)}')
+test $((d - dat)) = 16
@@ -0,0 +1,39 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+# A vDSO-shaped link: a shared library whose script places the
+# linker-synthesized dynamic sections and defines the program headers
+cat <<EOF | $CC -o $t/a.o -c -xc -fPIC -
+int foo() { return 42; }
+EOF
+
+cat <<'EOF' > $t/script
+PHDRS {
+  text PT_LOAD FLAGS(5) FILEHDR PHDRS;
+  dyn PT_DYNAMIC FLAGS(4);
+}
+SECTIONS {
+  . = SIZEOF_HEADERS;
+  .dynsym : { *(.dynsym) } :text
+  .dynstr : { *(.dynstr) }
+  .text : { *(.text .text.*) }
+  .dynamic : { *(.dynamic) } :text :dyn
+}
+EOF
+
+./mold -o $t/b.so -shared $t/a.o -T $t/script
+readelf -lW $t/b.so > $t/log
+
+# The script's segments, with FILEHDR extending :text back to offset 0
+grep -E 'LOAD .*0x000000 .* R E' $t/log
+grep -E 'DYNAMIC ' $t/log
+grep -E '01 .*\.dynamic' $t/log
+
+# Synthesized sections are placed where the script says: .dynsym
+# before .text, .dynamic after
+readelf -SW $t/b.so > $t/log2
+dynsym=$(grep -F ' .dynsym' $t/log2 | sed 's/.*\[ *\([0-9]*\)\].*/\1/')
+text=$(grep -wF ' .text' $t/log2 | sed 's/.*\[ *\([0-9]*\)\].*/\1/')
+dynamic=$(grep -F ' .dynamic' $t/log2 | sed 's/.*\[ *\([0-9]*\)\].*/\1/')
+test "$dynsym" -lt "$text"
+test "$text" -lt "$dynamic"
@@ -0,0 +1,30 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int main() { return 0; }
+EOF
+
+# Sections that never materialize: their body symbols still get
+# addresses, the location counter still moves, and SIZEOF/ADDR of
+# such sections read as zero so assertions about them work.
+cat <<'EOF' > $t/script
+SECTIONS {
+  . = 0x10000;
+  .text : { *(.text .text.*) }
+  . = 0x20000;
+  .empty1 : { empty1_start = .; KEEP(*(.no_such_input)) empty1_end = .; }
+  .reserve : { . += 0x100; }
+  after_reserve = .;
+  ASSERT(SIZEOF(.empty1) == 0, "SIZEOF of an empty section must be 0")
+  ASSERT(after_reserve == 0x20100, "the reservation must move the dot")
+  .data : { *(.data .data.*) }
+  .bss : { *(.bss .bss.*) }
+}
+EOF
+
+./mold -o $t/exe $t/a.o -T $t/script
+readelf -sW $t/exe > $t/log
+grep -E '20000 .* empty1_start' $t/log
+grep -E '20000 .* empty1_end' $t/log
+grep -E '20100 .* after_reserve' $t/log
@@ -0,0 +1,19 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+void foo() {}
+int main() {}
+EOF
+
+echo 'ENTRY(foo)' > $t/script
+
+# ENTRY(foo) sets the entry point
+$CC -B. -o $t/exe1 $t/a.o -Wl,-T,$t/script
+sym=$(readelf -sW $t/exe1 | grep -w foo | awk '{print $2}' | sed 's/^0*//')
+readelf -h $t/exe1 | grep "Entry point address:.*0x$sym"
+
+# The -e option takes precedence over ENTRY()
+$CC -B. -o $t/exe2 $t/a.o -Wl,-T,$t/script -Wl,-e,main
+sym=$(readelf -sW $t/exe2 | grep -w main | awk '{print $2}' | sed 's/^0*//')
+readelf -h $t/exe2 | grep "Entry point address:.*0x$sym"
@@ -0,0 +1,22 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+int foo() { return 3; }
+EOF
+
+rm -f $t/libfoo.a
+ar rcs $t/libfoo.a $t/a.o
+
+cat <<EOF | $CC -o $t/b.o -c -xc -
+int main() {}
+EOF
+
+# Without EXTERN, the archive member is not pulled out
+$CC -B. -o $t/exe1 $t/b.o $t/libfoo.a
+not grep -qw foo <(readelf -sW $t/exe1)
+
+# EXTERN(foo) is equivalent to -u foo
+echo 'EXTERN(foo)' > $t/script
+$CC -B. -o $t/exe2 $t/b.o $t/libfoo.a -Wl,-T,$t/script
+readelf -sW $t/exe2 | grep -w foo
@@ -0,0 +1,28 @@
+#!/bin/bash
+. $(dirname $0)/common.inc
+
+cat <<EOF | $CC -o $t/a.o -c -xc -
+__attribute__((section(".dat"))) char a = 1;
+int main() { return 0; }
+EOF
+
+cat <<EOF | $CC -o $t/b.o -c -xc -
+__attribute__((section(".dat"))) char b = 2;
+EOF
+
+# Input sections can be selected by the file they come from
+cat <<'EOF' > $t/script
+SECTIONS {
+  .text : { *(.text .text.*) }
+  .first : { *b.o(.dat) }
+  .rest : { *(.dat) }
+}
+EOF
+
+./mold -o $t/exe $t/a.o $t/b.o -T $t/script
+readelf -SW $t/exe > $t/log
+grep -F .first $t/log
+grep -F .rest $t/log
+
+off=$(readelf -SW $t/exe | grep -F .first | awk '{print strtonum("0x" $6)}')
+test "$(dd if=$t/exe bs=1 skip=$off count=1 2>/dev/null | od -An -tx1 | tr -d ' ')" = 02