w6l: route writable globals into a second PT_LOAD

Second step toward top-level mutable `let`. The static path now loads
.data PROGBITS sections from input .o files, page-aligns them after
.text, and emits a second PT_LOAD (R+W) covering them. Relocations
targeting data symbols compute against the data VA; text→text
displacements still cancel the absolute VAs and stay correct.

Inputs without any .data keep the original single-PT_LOAD layout
byte-for-byte — 992 (selfhost w6l .o diff) and 995 (self-rebuild)
depend on that invariant.

Dynamic-link path (-l/-L) rejects .data for now with a clear error;
folding writable globals into the existing R+W segment alongside
.got.plt/.dynamic is a follow-up.

Makefile

@@ -211,6 +211,7 @@ $(BIN) $(LIB) $(OBJ)/wcc $(OBJ)/ww $(OBJ)/wwdump $(OBJ)/w6c $(OBJ)/w6a $(OBJ)/w6
 # Each phase adds a $(BIN)/test_<name> target; the runner walks them.
 TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_w6c $(BIN)/test_w6a $(BIN)/test_dataw $(BIN)/test_w6l \
+	  $(BIN)/test_data_link \
 	  $(BIN)/test_arch \
 	  $(BIN)/test_e2e $(BIN)/test_ffi $(BIN)/test_dyn $(BIN)/test_stdlib \
 	  $(BIN)/test_at_test \
@@ -242,6 +243,9 @@ $(BIN)/test_dataw: test/wcc/510_dataw.c $(BIN)/w6a | $(BIN)
 $(BIN)/test_w6l: test/wcc/600_w6l.c $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_data_link: test/wcc/620_data_link.c $(BIN)/w6a $(BIN)/w6l | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_arch: test/wcc/610_arch.c $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(OBJ)/rt/start.o | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

cmd/w6l/dynout.c

@@ -142,6 +142,18 @@ poke32(u8 *buf, u64 off, u32 v)
 int
 l_emit_dyn_elf(Lnk *l, FILE *f, u64 base, u64 entry)
 {
+	/* Writable globals on the dynamic-link path need their own R+W
+	 * segment, and the existing R+W segment (gotplt + dynamic) has a
+	 * fixed layout that l_relocate's data_va guess wouldn't match.
+	 * Rather than ship a silently-miscompiled binary, refuse and
+	 * leave the feature for a follow-up. */
+	if (l->datalen > 0) {
+		fprintf(stderr, "w6l: top-level mutable globals (.data) are "
+		    "not yet supported with -l/-L; link without shared "
+		    "libraries to use them.\n");
+		return 1;
+	}
+
 	const int N = l->dyn_n;
 
 	/* ---- Pass 1: collect dynamic symbol names + .dynstr layout ---- */

cmd/w6l/l.h

@@ -28,8 +28,12 @@ typedef struct Lnk   Lnk;
 
 struct Lsym {
 	const char *name;
-	u64	val;		/* offset within combined .text once linked */
+	u64	val;		/* offset within combined .text (or .data when
+				 * in_data=1) once linked */
 	int	defined;	/* 1 if a Lobj defines this symbol */
+	int	in_data;	/* 1 if defined in .data (writable globals);
+				 * 0 means .text (the default). Mutually
+				 * exclusive with is_dyn. */
 	Lobj	*owner;
 	int	idx_in_owner;
 	/* Dynamic-linking fields. Set by l_resolve when an undefined sym
@@ -57,6 +61,8 @@ struct Lobj {
 	u64	len;
 	u64	text_off;	/* offset of .text in combined output */
 	u64	text_size;
+	u64	data_off;	/* offset of .data in combined output */
+	u64	data_size;	/* bytes contributed to combined .data (0 if none) */
 	Lobj	*next;
 };
 
@@ -76,6 +82,9 @@ struct Lnk {
 	Lrel	*rels;
 	u8	*text;		/* combined .text */
 	u64	textcap, textlen;
+	u8	*data;		/* combined .data (writable). Empty unless any
+				 * input .o has a .data PROGBITS section. */
+	u64	datacap, datalen;
 	int	errs;
 	int	dyn_n;		/* number of symbols routed through PLT */
 };
@@ -94,7 +103,11 @@ Lsym	*l_intern(Lnk*, const char *name);
 Lsym	*l_lookup(Lnk*, const char *name);
 /* pass.c */
 int	l_resolve(Lnk*);
-int	l_relocate(Lnk*, u64 base);
+/* Patch relocations in l->text. text_va is the VA where .text will be
+ * mapped; data_va is the VA where .data will be mapped (pass 0 if no
+ * data symbols). PC32/PLT32 displacements between text symbols cancel
+ * the absolute VA, but data targets need the real data_va. */
+int	l_relocate(Lnk*, u64 text_va, u64 data_va);
 /* out.c */
 int	l_emit_elf(Lnk*, FILE *out, u64 base, u64 entry);
 /* dynout.c — emit a dynamic-linked ELF executable. Called by

cmd/w6l/main.c

@@ -115,7 +115,20 @@ main(int argc, char **argv)
 		if (l_load(&l, inputs[i]) != 0) return 1;
 	}
 	if (l_resolve(&l) != 0) return 1;
-	if (l_relocate(&l, base + 0x1000) != 0) return 1;
+	/* Layout for relocation purposes. The static path (out.c) uses
+	 * text_va = base + 0x1000 and places .data at the next page after
+	 * .text — these must agree with the layout in out.c. PC-relative
+	 * displacements between .text symbols cancel the absolute VAs, so
+	 * a dyn-path link whose data_va is "wrong" still relocates text→
+	 * text correctly; text→data is currently rejected in dynout.c. */
+	u64 text_va = base + 0x1000;
+	u64 data_va = 0;
+	if (l.datalen > 0) {
+		u64 page = 0x1000;
+		u64 data_off = (0x1000 + l.textlen + page - 1) & ~(page - 1);
+		data_va = base + data_off;
+	}
+	if (l_relocate(&l, text_va, data_va) != 0) return 1;
 
 	Lsym *entry = l_lookup(&l, "_start");
 	if (entry == NULL || !entry->defined) entry = l_lookup(&l, "main");

cmd/w6l/obj.c

@@ -84,6 +84,19 @@ emit_text(Lnk *l, const u8 *src, u64 n)
 	l->textlen += n;
 }
 
+static void
+emit_data(Lnk *l, const u8 *src, u64 n)
+{
+	if (l->datalen + n > l->datacap) {
+		u64 nc = l->datacap ? l->datacap * 2 : 256;
+		while (nc < l->datalen + n) nc *= 2;
+		l->data = realloc(l->data, nc);
+		l->datacap = nc;
+	}
+	memcpy(l->data + l->datalen, src, n);
+	l->datalen += n;
+}
+
 /* Internal: load a single ELF .o image already in memory. The caller
  * gives us the bytes (we own them) and a path tag for diagnostics.
  * If the bytes look like an archive (magic "!<arch>\n") we recurse
@@ -116,12 +129,15 @@ elf_globals(const u8 *buf, u64 len)
 	Ehdr *eh = (Ehdr *)buf;
 	if (memcmp(eh->e_ident, "\x7f""ELF", 4) != 0) return NULL;
 	Shdr *sh = (Shdr *)(buf + eh->e_shoff);
-	int idx_text = -1, idx_symtab = -1;
+	int idx_text = -1, idx_data = -1, idx_symtab = -1;
 	const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
 	for (u16 i = 0; i < eh->e_shnum; i++) {
 		if (sh[i].sh_type == SHT_PROGBITS &&
 		    strcmp(shstr + sh[i].sh_name, ".text") == 0)
 			idx_text = i;
+		else if (sh[i].sh_type == SHT_PROGBITS &&
+		    strcmp(shstr + sh[i].sh_name, ".data") == 0)
+			idx_data = i;
 		else if (sh[i].sh_type == SHT_SYMTAB)
 			idx_symtab = i;
 	}
@@ -131,12 +147,15 @@ elf_globals(const u8 *buf, u64 len)
 	u64 nsyms = sh[idx_symtab].sh_size / sizeof(Sym64);
 	const char *str = (const char *)(buf + sh[idx_strtab].sh_offset);
 
+	/* Include both .text and .data globals so archive members that
+	 * define a data global get pulled in when something references it. */
 	char **out = calloc(nsyms + 1, sizeof *out);
 	int n = 0;
 	for (u64 i = 1; i < nsyms; i++) {
 		if (symtab[i].st_shndx == 0) continue;
 		if ((symtab[i].st_info >> 4) != 1) continue; /* STB_GLOBAL */
-		if ((int)symtab[i].st_shndx != idx_text) continue;
+		int sx = (int)symtab[i].st_shndx;
+		if (sx != idx_text && sx != idx_data) continue;
 		out[n++] = strdup(str + symtab[i].st_name);
 	}
 	out[n] = NULL;
@@ -259,12 +278,15 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 	if (eh->e_shstrndx >= eh->e_shnum) { free(buf); return -1; }
 	const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
 
-	/* find .text, .symtab, .strtab, .rela.text */
+	/* find .text, .data (optional), .symtab, .strtab, .rela.text */
-	int idx_text = -1, idx_symtab = -1, idx_strtab = -1, idx_rela = -1;
+	int idx_text = -1, idx_data = -1, idx_symtab = -1, idx_strtab = -1;
+	int idx_rela = -1;
 	for (u16 i = 0; i < eh->e_shnum; i++) {
 		const char *nm = shstr + sh[i].sh_name;
 		if (sh[i].sh_type == SHT_PROGBITS && strcmp(nm, ".text") == 0)
 			idx_text = i;
+		else if (sh[i].sh_type == SHT_PROGBITS && strcmp(nm, ".data") == 0)
+			idx_data = i;
 		else if (sh[i].sh_type == SHT_SYMTAB)
 			idx_symtab = i;
 		else if (sh[i].sh_type == SHT_RELA && strcmp(nm, ".rela.text") == 0)
@@ -283,11 +305,15 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 	ob->len = len;
 	ob->text_off = l->textlen;
 	ob->text_size = sh[idx_text].sh_size;
+	ob->data_off = l->datalen;
+	ob->data_size = (idx_data >= 0) ? sh[idx_data].sh_size : 0;
 	ob->next = l->objs;
 	l->objs = ob;
 
-	/* append .text */
+	/* append .text and (if present) .data */
 	emit_text(l, buf + sh[idx_text].sh_offset, sh[idx_text].sh_size);
+	if (idx_data >= 0 && sh[idx_data].sh_size > 0)
+		emit_data(l, buf + sh[idx_data].sh_offset, sh[idx_data].sh_size);
 
 	/* per-object: load symbols */
 	Sym64 *symtab = (Sym64 *)(buf + sh[idx_symtab].sh_offset);
@@ -300,8 +326,10 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 		const char *nm = str + symtab[i].st_name;
 		if (nm[0] == '\0') continue;
 		Lsym *gs = l_intern(l, nm);
-		if (symtab[i].st_shndx != 0 /* SHN_UNDEF */
+		int sx = (int)symtab[i].st_shndx;
-		    && symtab[i].st_shndx == idx_text) {
+		int in_text = (symtab[i].st_shndx != 0 && sx == idx_text);
+		int in_data = (idx_data >= 0 && sx == idx_data);
+		if (in_text || in_data) {
 			if (gs->defined) {
 				fprintf(stderr, "w6l: %s: duplicate symbol %s\n",
 				    path, nm);
@@ -310,7 +338,12 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 				gs->defined = 1;
 				gs->owner = ob;
 				gs->idx_in_owner = (int)i;
-				gs->val = ob->text_off + symtab[i].st_value;
+				if (in_data) {
+					gs->in_data = 1;
+					gs->val = ob->data_off + symtab[i].st_value;
+				} else {
+					gs->val = ob->text_off + symtab[i].st_value;
+				}
 			}
 		}
 		map[i] = gs;

cmd/w6l/out.c

@@ -1,15 +1,21 @@
 /*
  * out.c — emit a static ELF64 executable.
  *
- * Layout (file order):
+ * Layout (file order) without .data:
  *   [0..64)       ELF header
- *   [64..120)     program header (one PT_LOAD)
+ *   [64..120)     one program header (PT_LOAD R+X)
  *   [120..0x1000) zero pad
  *   [0x1000..)    .text bytes
  *
- * The single PT_LOAD covers the whole file, R+X. No interpreter,
+ * With .data (any input .o has writable globals):
- * no dynamic, no .bss yet. Entry point is the address of the
+ *   [0..64)        ELF header
- * symbol named "_start" (or whatever main supplies via -e).
+ *   [64..176)      two program headers (PT_LOAD R+X, PT_LOAD R+W)
+ *   [176..0x1000)  zero pad
+ *   [0x1000..)     .text bytes
+ *   [data_off..)   .data bytes (file offset and vaddr page-aligned)
+ *
+ * No interpreter, no dynamic, no .bss yet. Entry point is the address
+ * of the symbol named "_start" (or whatever main supplies via -e).
  */
 #include "l.h"
 #include <stdio.h>
@@ -52,9 +58,17 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
 	if (l->sos != NULL && l->dyn_n > 0)
 		return l_emit_dyn_elf(l, f, base, entry);
 
+	const u64 page     = 0x1000;
 	const u64 text_off = 0x1000;
-	const u64 text_va  = base + text_off;
+	const u64 rx_end   = text_off + l->textlen;
-	const u64 filesz   = text_off + l->textlen;
+	const int has_data = (l->datalen > 0);
+
+	/* data goes at the next page boundary so the loader can grant a
+	 * fresh page of R+W permissions without overlapping the R+X mapping. */
+	const u64 data_off = has_data ? ((rx_end + page - 1) & ~(page - 1)) : 0;
+	const u64 data_va  = has_data ? (base + data_off) : 0;
+	const u64 file_end = has_data ? (data_off + l->datalen) : rx_end;
+	(void)data_va;
 
 	Ehdr eh = {0};
 	memcpy(eh.e_ident, "\x7f""ELF", 4);
@@ -68,21 +82,36 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
 	eh.e_phoff = sizeof(Ehdr);
 	eh.e_ehsize = sizeof(Ehdr);
 	eh.e_phentsize = sizeof(Phdr);
-	eh.e_phnum = 1;
+	eh.e_phnum = has_data ? 2 : 1;
-	(void)text_va;
 
-	Phdr ph = {0};
+	/* R+X load covering [0, rx_end). When .data is present we still
-	ph.p_type = PT_LOAD;
+	 * round up to a page in memsz so the loader doesn't try to give
-	ph.p_flags = PF_R | PF_X;
+	 * the same page both R+X and R+W permissions. */
-	ph.p_offset = 0;
+	Phdr phx = {0};
-	ph.p_vaddr = base;
+	phx.p_type = PT_LOAD;
-	ph.p_paddr = base;
+	phx.p_flags = PF_R | PF_X;
-	ph.p_filesz = filesz;
+	phx.p_offset = 0;
-	ph.p_memsz = filesz;
+	phx.p_vaddr = base;
-	ph.p_align = 0x1000;
+	phx.p_paddr = base;
+	phx.p_filesz = rx_end;
+	phx.p_memsz = rx_end;
+	phx.p_align = page;
+
+	Phdr phw = {0};
+	if (has_data) {
+		phw.p_type = PT_LOAD;
+		phw.p_flags = PF_R | PF_W;
+		phw.p_offset = data_off;
+		phw.p_vaddr = base + data_off;
+		phw.p_paddr = base + data_off;
+		phw.p_filesz = l->datalen;
+		phw.p_memsz = l->datalen;
+		phw.p_align = page;
+	}
 
 	fwrite(&eh, 1, sizeof eh, f);
-	fwrite(&ph, 1, sizeof ph, f);
+	fwrite(&phx, 1, sizeof phx, f);
+	if (has_data) fwrite(&phw, 1, sizeof phw, f);
 
 	/* pad to text_off */
 	long here = ftell(f);
@@ -90,5 +119,13 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
 
 	if (l->textlen) fwrite(l->text, 1, l->textlen, f);
 
+	if (has_data) {
+		/* pad to data_off */
+		here = ftell(f);
+		for (long i = here; i < (long)data_off; i++) fputc(0, f);
+		fwrite(l->data, 1, l->datalen, f);
+	}
+	(void)file_end;
+
 	return 0;
 }

cmd/w6l/pass.c

@@ -68,7 +68,7 @@ patch_u32(u8 *p, u32 v)
 }
 
 int
-l_relocate(Lnk *l, u64 base)
+l_relocate(Lnk *l, u64 text_va, u64 data_va)
 {
 	for (Lrel *r = l->rels; r; r = r->next) {
 		if (r->sym == NULL) continue;
@@ -79,9 +79,11 @@ l_relocate(Lnk *l, u64 base)
 		switch (r->kind) {
 		case R_X86_64_PC32:
 		case R_X86_64_PLT32: {
-			u64 site = base + r->off;
+			u64 site = text_va + r->off;
-			i64 target = (i64)(base + r->sym->val);
+			u64 sym_va = r->sym->in_data
-			i64 rel = target - (i64)site + r->addend;
+			    ? data_va + r->sym->val
+			    : text_va + r->sym->val;
+			i64 rel = (i64)sym_va - (i64)site + r->addend;
 			patch_u32(l->text + r->off, (u32)(i32)rel);
 			break;
 		}

test/wcc/620_data_link.c

@@ -0,0 +1,258 @@
+/*
+ * 620_data_link — end-to-end w6l support for writable globals.
+ * Assemble a small .s using DATAW, link it with w6l, run the binary,
+ * and verify both that the read returns the global's value and that
+ * a store updates it. Also confirms the binary has two PT_LOADs with
+ * the right R+X / R+W flags.
+ *
+ * Inputs without DATAW must still produce the single-PT_LOAD layout
+ * — 992 (selfhost w6l .o diff) depends on that invariant.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+#define PT_LOAD	1
+#define PF_X	1
+#define PF_W	2
+#define PF_R	4
+
+#pragma pack(push, 1)
+typedef struct {
+	uint8_t  e_ident[16];
+	uint16_t e_type, e_machine;
+	uint32_t e_version;
+	uint64_t e_entry, e_phoff, e_shoff;
+	uint32_t e_flags;
+	uint16_t e_ehsize, e_phentsize, e_phnum, e_shentsize, e_shnum, e_shstrndx;
+} Ehdr;
+
+typedef struct {
+	uint32_t p_type, p_flags;
+	uint64_t p_offset, p_vaddr, p_paddr;
+	uint64_t p_filesz, p_memsz, p_align;
+} Phdr;
+#pragma pack(pop)
+
+static int
+write_file(const char *path, const char *body)
+{
+	FILE *f = fopen(path, "wb");
+	if (!f) return -1;
+	fputs(body, f);
+	fclose(f);
+	return 0;
+}
+
+static int
+slurp(const char *path, uint8_t **out, size_t *outn)
+{
+	FILE *f = fopen(path, "rb");
+	if (!f) return -1;
+	fseek(f, 0, SEEK_END);
+	long n = ftell(f);
+	fseek(f, 0, SEEK_SET);
+	uint8_t *b = malloc((size_t)n);
+	if (fread(b, 1, (size_t)n, f) != (size_t)n) {
+		free(b);
+		fclose(f);
+		return -1;
+	}
+	fclose(f);
+	*out = b;
+	*outn = (size_t)n;
+	return 0;
+}
+
+static int
+build(const char *bin, const char *body, const char *exe)
+{
+	char src[64], obj[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/wwt_dl_%d.s", getpid());
+	snprintf(obj, sizeof obj, "/tmp/wwt_dl_%d.o", getpid());
+	if (write_file(src, body) < 0) return -1;
+
+	snprintf(cmd, sizeof cmd, "%s/w6a -o %s %s", bin, obj, src);
+	if (system(cmd) != 0) { unlink(src); return -1; }
+	snprintf(cmd, sizeof cmd, "%s/w6l -o %s %s", bin, exe, obj);
+	int rc = system(cmd);
+	unlink(src); unlink(obj);
+	return rc;
+}
+
+static int
+run_exit(const char *exe)
+{
+	int rc = system(exe);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+/* Test 1: read a writable global. _start exits with the value stored
+ * in `counter` (0x2a == 42). */
+static int
+test_read(const char *bin)
+{
+	char exe[64];
+	snprintf(exe, sizeof exe, "/tmp/wwt_dl_%d.x1", getpid());
+	const char *body =
+	    "TEXT _start,$0\n"
+	    "\tMOVQ\tcounter(SB), DI\n"
+	    "\tMOVQ\t$60, AX\n"
+	    "\tSYSCALL\n"
+	    "DATAW counter(SB),\"\\x2a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n";
+	if (build(bin, body, exe) != 0) {
+		fprintf(stderr, "test_read: build failed\n");
+		return -1;
+	}
+	int rc = run_exit(exe);
+	unlink(exe);
+	if (rc != 42) {
+		fprintf(stderr, "test_read: exit=%d, want 42\n", rc);
+		return -1;
+	}
+	return 0;
+}
+
+/* Test 2: store to a writable global, read it back, exit with the new
+ * value. Verifies the R+W mapping really is writable. */
+static int
+test_write(const char *bin)
+{
+	char exe[64];
+	snprintf(exe, sizeof exe, "/tmp/wwt_dl_%d.x2", getpid());
+	const char *body =
+	    "TEXT _start,$0\n"
+	    "\tMOVQ\t$99, AX\n"
+	    "\tMOVQ\tAX, counter(SB)\n"
+	    "\tMOVQ\tcounter(SB), DI\n"
+	    "\tMOVQ\t$60, AX\n"
+	    "\tSYSCALL\n"
+	    "DATAW counter(SB),\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n";
+	if (build(bin, body, exe) != 0) {
+		fprintf(stderr, "test_write: build failed\n");
+		return -1;
+	}
+	int rc = run_exit(exe);
+	unlink(exe);
+	if (rc != 99) {
+		fprintf(stderr, "test_write: exit=%d, want 99\n", rc);
+		return -1;
+	}
+	return 0;
+}
+
+/* Test 3: structurally inspect the linked ELF — two PT_LOADs, the
+ * first R+X and the second R+W. Catches regressions where the layout
+ * is right but the flags or count are off. */
+static int
+test_two_loads(const char *bin)
+{
+	char exe[64];
+	snprintf(exe, sizeof exe, "/tmp/wwt_dl_%d.x3", getpid());
+	const char *body =
+	    "TEXT _start,$0\n"
+	    "\tMOVQ\tcounter(SB), AX\n"
+	    "\tMOVQ\t$60, AX\n"
+	    "\tMOVQ\t$0, DI\n"
+	    "\tSYSCALL\n"
+	    "DATAW counter(SB),\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n";
+	if (build(bin, body, exe) != 0) {
+		fprintf(stderr, "test_two_loads: build failed\n");
+		return -1;
+	}
+	uint8_t *buf = NULL;
+	size_t n = 0;
+	if (slurp(exe, &buf, &n) < 0) {
+		fprintf(stderr, "test_two_loads: cannot read exe\n");
+		unlink(exe);
+		return -1;
+	}
+	unlink(exe);
+
+	const Ehdr *eh = (const Ehdr *)buf;
+	int rc = 0;
+	if (eh->e_phnum != 2) {
+		fprintf(stderr, "test_two_loads: e_phnum=%u, want 2\n", eh->e_phnum);
+		rc = -1;
+		goto out;
+	}
+	const Phdr *ph = (const Phdr *)(buf + eh->e_phoff);
+	int saw_rx = 0, saw_rw = 0;
+	for (int i = 0; i < 2; i++) {
+		if (ph[i].p_type != PT_LOAD) {
+			fprintf(stderr, "test_two_loads: ph[%d] not PT_LOAD\n", i);
+			rc = -1;
+			continue;
+		}
+		if (ph[i].p_flags == (PF_R | PF_X)) saw_rx = 1;
+		else if (ph[i].p_flags == (PF_R | PF_W)) saw_rw = 1;
+		else {
+			fprintf(stderr, "test_two_loads: ph[%d] flags=0x%x\n",
+			    i, ph[i].p_flags);
+			rc = -1;
+		}
+	}
+	if (!saw_rx) { fprintf(stderr, "test_two_loads: missing R+X\n"); rc = -1; }
+	if (!saw_rw) { fprintf(stderr, "test_two_loads: missing R+W\n"); rc = -1; }
+out:
+	free(buf);
+	return rc;
+}
+
+/* Test 4: an input without DATAW still produces a single PT_LOAD.
+ * 992 (selfhost w6l .o diff) depends on this byte-level invariant. */
+static int
+test_no_data_single_load(const char *bin)
+{
+	char exe[64];
+	snprintf(exe, sizeof exe, "/tmp/wwt_dl_%d.x4", getpid());
+	const char *body =
+	    "TEXT _start,$0\n"
+	    "\tMOVQ\t$60, AX\n"
+	    "\tMOVQ\t$0, DI\n"
+	    "\tSYSCALL\n";
+	if (build(bin, body, exe) != 0) {
+		fprintf(stderr, "test_no_data_single_load: build failed\n");
+		return -1;
+	}
+	uint8_t *buf = NULL;
+	size_t n = 0;
+	if (slurp(exe, &buf, &n) < 0) {
+		fprintf(stderr, "test_no_data_single_load: cannot read exe\n");
+		unlink(exe);
+		return -1;
+	}
+	unlink(exe);
+	int rc = 0;
+	const Ehdr *eh = (const Ehdr *)buf;
+	if (eh->e_phnum != 1) {
+		fprintf(stderr, "test_no_data_single_load: e_phnum=%u, want 1\n",
+		    eh->e_phnum);
+		rc = -1;
+	}
+	free(buf);
+	return rc;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	int fail = 0;
+	if (test_read(bin)                != 0) fail++;
+	if (test_write(bin)               != 0) fail++;
+	if (test_two_loads(bin)           != 0) fail++;
+	if (test_no_data_single_load(bin) != 0) fail++;
+	if (fail) {
+		fprintf(stderr, "data_link: %d/4 subtests failed\n", fail);
+		return 1;
+	}
+	printf("data_link: 4/4 ok\n");
+	return 0;
+}