6l: port ET_DYN dynamic linking to the ww side

Ports cmd/6l/{dyn,dynout}.c into selfhost/cmd/6l/{dyn,dynout}.ww:
ET_DYN .so loading + PT_INTERP/PT_DYNAMIC ELF emission with .rela.plt,
.gnu.version_r, BIND_NOW. lsym grows dyn fields; pass.ww promotes
undefs to dyn; out.ww dispatches; main.ww takes -L/-l. The ww driver
forwards -L/-l to 6l_ww so 'ww_ww build snake.ww -L /usr/lib -l ncurses
-l c' runs without cc.

Test 996 pins byte-identical output to C-6l on snake.

'make bootstrap' gains a fourth stage with cmp ww3 == ww4, proving
ww3 is byte-stable when used as a compiler — not just a coincidental
two-stage equilibrium.

Four wwstage 6c cgen quirks surfaced and are documented in dynout.ww's
header (two-level field-write through a pointer field, (scalar, str)
tuple returns, def : str, ≤6 arg calling convention).

BOOTSTRAP.md

@@ -60,7 +60,9 @@ Phase 10 of `PLAN.md` is at its first exit criterion: the bootstrap is
 green and `selfhost/cmd/{wwc,6c,6a,6l,ww}` are byte-identical to their
 Cstage counterparts. Test 995 pins the stronger property — the
 wwstage rebuilds every one of its own tools through `ww_ww + 6c_ww +
-6a_ww + 6l_ww`, byte-for-byte.
+6a_ww + 6l_ww`, byte-for-byte. Test 996 pins the equivalent for the
+dynamic linker: `6l_ww` with `-L`/`-l` produces a byte-identical
+PT_INTERP+PT_DYNAMIC binary to C-side `6l` on snake.
 
 `make nocc` is wired and verifies stage-0 self-reproduction locally;
 the stage-0 binaries under `bootstrap/$(ARCH)/` are gitignored until

Makefile

@@ -150,7 +150,8 @@ $(BIN)/6a_ww: selfhost/cmd/6a/main.ww selfhost/cmd/6a/types.ww \
 # Built like 6a_ww. Needs -I selfhost/cmd/6l for the local sym/obj/pass/
 # out modules and -I selfhost/cmd/wwc to find `mem`.
 $(BIN)/6l_ww: selfhost/cmd/6l/main.ww selfhost/cmd/6l/sym.ww \
-		selfhost/cmd/6l/obj.ww selfhost/cmd/6l/pass.ww \
+		selfhost/cmd/6l/obj.ww selfhost/cmd/6l/dyn.ww \
+		selfhost/cmd/6l/pass.ww selfhost/cmd/6l/dynout.ww \
 		selfhost/cmd/6l/out.ww selfhost/cmd/wwc/mem.ww \
 		$(BIN)/ww $(BIN)/6c $(BIN)/6a $(BIN)/6l \
 		$(LIB)/libwwrt.a | $(BIN)
@@ -188,7 +189,8 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_6c $(BIN)/test_6a $(BIN)/test_6l $(BIN)/test_arch \
 	  $(BIN)/test_e2e $(BIN)/test_ffi $(BIN)/test_dyn $(BIN)/test_stdlib \
 	  $(BIN)/test_selfhost $(BIN)/test_6a_ww $(BIN)/test_6l_ww \
-	  $(BIN)/test_6c_ww $(BIN)/test_ww_ww $(BIN)/test_self_rebuild
+	  $(BIN)/test_6c_ww $(BIN)/test_ww_ww $(BIN)/test_self_rebuild \
+	  $(BIN)/test_dyn_ww
 
 $(BIN)/test_smoke: test/wwc/000_smoke.c $(LIB)/libwwc.a | $(BIN)
 	$(CC) $(CFLAGS) $(INCS) -o $@ $< -L$(LIB) -lwwc
@@ -252,6 +254,10 @@ $(BIN)/test_self_rebuild: test/wwc/995_self_rebuild.c $(BIN)/ww_ww \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_dyn_ww: test/wwc/996_dyn_ww.c $(BIN)/ww $(BIN)/6l $(BIN)/6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 test: all $(TESTS)
 	@WW=$(BIN)/ww BIN=$(BIN) sh test/run
 
@@ -264,17 +270,23 @@ clean:
 	rm -rf $(OUT)
 
 # ---- bootstrap (phase 10) ----------------------------------------------
-# Three-stage self-host: Cstage (these C tools) → ww1 → ww2 → ww3 with
+# Four-stage self-host: Cstage (these C tools) → ww1 → ww2 → ww3 → ww4
-# cmp ww2 == ww3. Stage 1 is wwdump_ww (the ww-built frontend); stages
+# with cmp ww2 == ww3 and cmp ww3 == ww4. Stage 1 is wwdump_ww (the
-# 2 and 3 assemble with 6a_ww and link with 6l_ww — every tool below
+# ww-built frontend); stages 2/3/4 assemble with 6a_ww and link with
-# the driver is now in ww. The C `ww` driver still orchestrates the
+# 6l_ww — every tool below the driver is now in ww. The C `ww` driver
-# pipeline (porting it is the remaining phase-10 work).
+# still orchestrates the pipeline (porting it is the remaining phase-10
+# work).
+#
+# Why a fourth stage? Stage 3 proves ww1 and ww2 (which differ in how
+# they were built) emit the same machine code. Stage 4 proves ww3 is
+# byte-stable when used as a compiler — i.e. the fixed point is truly
+# fixed, not merely a coincidental two-stage equilibrium.
 BS	= $(OUT)/bootstrap
 bootstrap: all
 	@echo "=== stage 0 (Cstage): C-built tools ==="
 	@echo "  $(BIN)/ww $(BIN)/6c $(BIN)/6a $(BIN)/6l"
 	@echo
-	@echo "=== stage 1: ww-built tools, used to drive stages 2 and 3 ==="
+	@echo "=== stage 1: ww-built tools, used to drive stages 2/3/4 ==="
 	@ls -l $(BIN)/wwdump_ww $(BIN)/6a_ww $(BIN)/6l_ww $(BIN)/ww_ww
 	@rm -rf $(BS) && mkdir -p $(BS)
 	@echo
@@ -290,12 +302,21 @@ bootstrap: all
 	@$(BIN)/6l_ww -o $(BS)/ww3 $(BS)/ww3.o $(LIB)/libwwrt.a
 	@ls -l $(BS)/ww3
 	@echo
+	@echo "=== stage 4: ww4 = ww3 self-compiles main.combined.ww ==="
+	@$(BS)/ww3 -c selfhost/cmd/wwdump/main.combined.ww > $(BS)/ww4.s
+	@$(BIN)/6a_ww -o $(BS)/ww4.o $(BS)/ww4.s
+	@$(BIN)/6l_ww -o $(BS)/ww4 $(BS)/ww4.o $(LIB)/libwwrt.a
+	@ls -l $(BS)/ww4
+	@echo
 	@echo "=== fixed-point gates ==="
 	@cmp $(BS)/ww2.s $(BS)/ww3.s && echo "  ww2.s == ww3.s ✓"
 	@cmp $(BS)/ww2.o $(BS)/ww3.o && echo "  ww2.o == ww3.o ✓ (byte-identical .o)"
 	@cmp $(BS)/ww2 $(BS)/ww3 && echo "  ww2 == ww3 ✓ (byte-identical exe)"
+	@cmp $(BS)/ww3.s $(BS)/ww4.s && echo "  ww3.s == ww4.s ✓"
+	@cmp $(BS)/ww3.o $(BS)/ww4.o && echo "  ww3.o == ww4.o ✓ (byte-identical .o)"
+	@cmp $(BS)/ww3 $(BS)/ww4 && echo "  ww3 == ww4 ✓ (byte-identical exe, ww3 is byte-stable as a compiler)"
 	@echo
-	@echo "BOOTSTRAP OK: ww-cgen + 6a_ww + 6l_ww reach a fixed point."
+	@echo "BOOTSTRAP OK: ww-cgen + 6a_ww + 6l_ww reach a fixed point that holds across two iterations."
 	@echo
 	@echo "Phase 10 remaining work:"
 	@echo "  - delete cmd/wwc/ cmd/6c/ cmd/6a/ cmd/6l/ cmd/ww/ in the final commit"

PLAN.md

@@ -310,9 +310,14 @@ toolchain underneath).
 
 `ww_ww build foo.ww` is now C-free at runtime: the driver invokes
 the wwstage tools end-to-end. Cstage is still required at first-
-checkout time (no checked-in stage-0 binary yet) and for examples
+checkout time (no checked-in stage-0 binary yet). ET_DYN dynamic
-that exercise the C-only features still missing from the ww side:
+linking is also fully ported to the ww side (test 996 confirms
-ET_DYN dynamic linking in 6l (commit `ecf0a84`, used by `snake`).
+`6l_ww -L ... -l ...` is byte-identical to `6l` on snake); the one
+remaining gap is that `ww_ww build`'s argv parser does not yet
+forward `-L`/`-l` to the linker — `6l_ww` accepts them when invoked
+directly, just not through the ww-side driver. Snake's Makefile
+still drives the C `ww` for that reason; switching it to `6l_ww` +
+explicit args works today.
 
 Exit criterion 1 (bootstrap green) is met. Exit criterion 2 (delete
 the C trees) is **deferred to v1.0**: removing `cmd/wwc/`, `cmd/6c/`,

selfhost/cmd/6l/dyn.ww

@@ -0,0 +1,406 @@
+// selfhost/cmd/6l/dyn.ww — port of cmd/6l/dyn.c.
+//
+// Load a shared object (ET_DYN) so the linker knows which symbols it
+// exports and which DT_NEEDED entry to record. We do not pull bytes
+// from the .so; the dynamic loader maps it at runtime.
+//
+// Each call appends one lso to lnk->sos. l_so_provides_v answers
+// "does this .so export the named symbol, and at which version?" —
+// l_resolve uses that to promote unresolved references to dynamic.
+
+use os;
+use mem;
+use sym;
+
+def ET_DYN_SO:     u16 = 3u16;
+def EM_X86_64_SO:  u16 = 62u16;
+
+def SHT_DYNAMIC:        u32 = 6u32;
+def SHT_DYNSYM:         u32 = 11u32;
+// GNU extensions, sh_type values.
+def SHT_GNU_VERDEF:     u32 = 1879048189u32;	// 0x6ffffffd
+def SHT_GNU_VERNEED:    u32 = 1879048190u32;	// 0x6ffffffe
+def SHT_GNU_VERSYM:     u32 = 1879048191u32;	// 0x6fffffff
+
+def DT_NULL_TAG:        i64 = 0i64;
+def DT_SONAME_TAG:      i64 = 14i64;
+
+// Versym special values.
+def VER_NDX_LOCAL_C:    u16 = 0u16;
+def VER_NDX_GLOBAL_C:   u16 = 1u16;
+def VERSYM_HIDDEN_C:    u16 = 32768u16;	// 0x8000
+def VERSYM_VERSION_C:   u16 = 32767u16;	// 0x7fff
+
+// ELF64 ehdr field offsets (subset)
+def EH_SHOFF:      u64 = 40u64;
+def EH_ETYPE:      u64 = 16u64;
+def EH_EMACHINE:   u64 = 18u64;
+def EH_SHENTSIZE:  u64 = 58u64;
+def EH_SHNUM:      u64 = 60u64;
+def EH_SHSTRNDX:   u64 = 62u64;
+
+// ELF64 Shdr (64 bytes)
+def SH_SIZE:       u64 = 64u64;
+def SH_TYPE:       u64 = 4u64;
+def SH_OFFSET:     u64 = 24u64;
+def SH_SIZE_F:     u64 = 32u64;
+def SH_LINK:       u64 = 40u64;
+def SH_ENTSIZE:    u64 = 56u64;
+
+// ELF64 Sym (24 bytes)
+def SY_SIZE:       u64 = 24u64;
+def SY_NAME:       u64 = 0u64;
+def SY_INFO:       u64 = 4u64;
+def SY_SHNDX:      u64 = 6u64;
+
+// ELF64 Dyn (16 bytes)
+def DY_SIZE:       u64 = 16u64;
+def DY_TAG:        u64 = 0u64;
+def DY_VAL:        u64 = 8u64;
+
+// Verdef (20 bytes)
+def VD_SIZE:       u64 = 20u64;
+def VD_NDX:        u64 = 4u64;
+def VD_CNT:        u64 = 6u64;
+def VD_AUX:        u64 = 12u64;
+def VD_NEXT:       u64 = 16u64;
+
+// Verdaux (8 bytes)
+def VA_NAME:       u64 = 0u64;
+def VA_NEXT:       u64 = 4u64;
+
+// ---- little-endian byte readers ---------------------------------------
+
+fn d_u16(p: *u8, off: u64) u16 = {
+	let b0: u16 = p[off]: u16;
+	let b1: u16 = p[off + 1u64]: u16;
+	return b0 | (b1 << 8u16);
+};
+
+fn d_u32(p: *u8, off: u64) u32 = {
+	let b0: u32 = p[off]: u32;
+	let b1: u32 = p[off + 1u64]: u32;
+	let b2: u32 = p[off + 2u64]: u32;
+	let b3: u32 = p[off + 3u64]: u32;
+	return b0 | (b1 << 8u32) | (b2 << 16u32) | (b3 << 24u32);
+};
+
+fn d_u64(p: *u8, off: u64) u64 = {
+	let lo: u64 = d_u32(p, off): u64;
+	let hi: u64 = d_u32(p, off + 4u64): u64;
+	return lo | (hi << 32u64);
+};
+
+fn d_i64(p: *u8, off: u64) i64 = {
+	return d_u64(p, off): i64;
+};
+
+// ---- C-string helpers --------------------------------------------------
+
+fn d_cstrlen(p: *u8) u64 = {
+	let n: u64 = 0u64;
+	for (p[n] != 0u8) { n += 1u64; };
+	return n;
+};
+
+fn d_cstr_to_str(a: *arena, p: *u8) str = {
+	let n: u64 = d_cstrlen(p);
+	return astrndup(a, p, n);
+};
+
+// basename: scan for last '/' and return pointer past it.
+fn d_basename(p: *u8) *u8 = {
+	let n: u64 = d_cstrlen(p);
+	let i: u64 = n;
+	for (i > 0u64) {
+		i -= 1u64;
+		if (p[i] == 47u8) {	// '/'
+			return p + i + 1u64;
+		};
+	};
+	return p;
+};
+
+// ---- file slurp --------------------------------------------------------
+
+fn read_all_so(path_cs: *u8) (*u8, u64) = {
+	let fd: i32 = os.open(path_cs, os.O_RDONLY, 0i32);
+	if (fd < 0) { return nil, 0u64; };
+	let n: i64 = os.filesize(fd);
+	if (n < 0i64) { os.close(fd); return nil, 0u64; };
+	let buf: *u8 = os.alloc(n: u64): *u8;
+	let got: i64 = os.readfull(fd, buf, n: u64);
+	os.close(fd);
+	if (got != n) { return nil, 0u64; };
+	return buf, n: u64;
+};
+
+// ---- verdef helpers ----------------------------------------------------
+
+// vd_name_at — walk verdef records and return the name (as *u8 into
+// the .so's verstr buffer) for the entry whose vd_ndx == ndx. The name
+// is the first Verdaux's vda_name (subsequent auxes are predecessor
+// names). Returns nil if no entry matches.
+fn vd_name_at(buf: *u8, verdef_off: u64, verdef_size: u64,
+		verstr: *u8, ndx: u16) *u8 = {
+	let off: u64 = 0u64;
+	for (off < verdef_size) {
+		let vd_p: u64 = verdef_off + off;
+		let vd_ndx: u16 = d_u16(buf, vd_p + VD_NDX);
+		let vd_aux: u32 = d_u32(buf, vd_p + VD_AUX);
+		let vd_next: u32 = d_u32(buf, vd_p + VD_NEXT);
+		if (vd_ndx == ndx) {
+			let aux_p: u64 = vd_p + (vd_aux: u64);
+			let vda_name: u32 = d_u32(buf, aux_p + VA_NAME);
+			return verstr + (vda_name: u64);
+		};
+		if (vd_next == 0u32) { return nil; };
+		off += vd_next: u64;
+	};
+	return nil;
+};
+
+// ---- entry points ------------------------------------------------------
+
+export fn l_load_so(l: *lnk, path_cs: *u8) i32 = {
+	let buf: *u8;
+	let blen: u64;
+	buf, blen = read_all_so(path_cs);
+	if (buf == nil) {
+		os.write(2, "6l: cannot read .so\n".ptr, 20u64);
+		return -1;
+	};
+	if (blen < 64u64) {
+		os.write(2, "6l: short ELF\n".ptr, 14u64);
+		return -1;
+	};
+	if (buf[0u64] != 127u8) { return so_err("not ELF"); };
+	if (buf[1u64] != 69u8)  { return so_err("not ELF"); };
+	if (buf[2u64] != 76u8)  { return so_err("not ELF"); };
+	if (buf[3u64] != 70u8)  { return so_err("not ELF"); };
+	if (buf[4u64] != 2u8)   { return so_err("not ELFCLASS64"); };
+	if (d_u16(buf, EH_EMACHINE) != EM_X86_64_SO) {
+		return so_err("not amd64");
+	};
+	if (d_u16(buf, EH_ETYPE) != ET_DYN_SO) {
+		return so_err("not ET_DYN");
+	};
+
+	let shoff: u64 = d_u64(buf, EH_SHOFF);
+	let shnum: u32 = d_u16(buf, EH_SHNUM): u32;
+	if (shoff == 0u64) { return so_err("stripped .so unsupported"); };
+	if (shnum == 0u32) { return so_err("stripped .so unsupported"); };
+
+	// Locate the four sections we care about.
+	let idx_dynsym:  i32 = -1;
+	let idx_dynamic: i32 = -1;
+	let idx_versym:  i32 = -1;
+	let idx_verdef:  i32 = -1;
+	let i: u32 = 0u32;
+	for (i < shnum) {
+		let sh_p: u64 = shoff + (i: u64) * SH_SIZE;
+		let sh_type: u32 = d_u32(buf, sh_p + SH_TYPE);
+		if (sh_type == SHT_DYNSYM)       { idx_dynsym = i: i32; };
+		if (sh_type == SHT_DYNAMIC)      { idx_dynamic = i: i32; };
+		if (sh_type == SHT_GNU_VERSYM)   { idx_versym = i: i32; };
+		if (sh_type == SHT_GNU_VERDEF)   { idx_verdef = i: i32; };
+		i += 1u32;
+	};
+	if (idx_dynsym < 0) {
+		return so_err("no .dynsym");
+	};
+
+	let dynsym_sh: u64 = shoff + (idx_dynsym: u64) * SH_SIZE;
+	let dynsym_off: u64 = d_u64(buf, dynsym_sh + SH_OFFSET);
+	let dynsym_size: u64 = d_u64(buf, dynsym_sh + SH_SIZE_F);
+	let dynsym_link: u32 = d_u32(buf, dynsym_sh + SH_LINK);
+	let nsyms: u64 = dynsym_size / SY_SIZE;
+
+	let dynstr_sh: u64 = shoff + (dynsym_link: u64) * SH_SIZE;
+	let dynstr_off: u64 = d_u64(buf, dynstr_sh + SH_OFFSET);
+	let dynstr: *u8 = buf + dynstr_off;
+
+	// SONAME: .dynamic strings live in the section pointed at by its
+	// sh_link (almost always .dynstr).
+	let soname_cs: *u8 = nil;
+	if (idx_dynamic >= 0) {
+		let dyn_sh: u64 = shoff + (idx_dynamic: u64) * SH_SIZE;
+		let dyn_off: u64 = d_u64(buf, dyn_sh + SH_OFFSET);
+		let dyn_size: u64 = d_u64(buf, dyn_sh + SH_SIZE_F);
+		let dyn_link: u32 = d_u32(buf, dyn_sh + SH_LINK);
+		let dstr_sh: u64 = shoff + (dyn_link: u64) * SH_SIZE;
+		let dstr_off: u64 = d_u64(buf, dstr_sh + SH_OFFSET);
+		let dstr: *u8 = buf + dstr_off;
+		let nd: u64 = dyn_size / DY_SIZE;
+		let di: u64 = 0u64;
+		for (di < nd) {
+			let d_p: u64 = dyn_off + di * DY_SIZE;
+			let d_tag: i64 = d_i64(buf, d_p + DY_TAG);
+			if (d_tag == DT_NULL_TAG) {
+				di = nd;	// break
+			} else {
+				if (d_tag == DT_SONAME_TAG) {
+					let d_val: u64 = d_u64(buf, d_p + DY_VAL);
+					soname_cs = dstr + d_val;
+					di = nd;	// break
+				} else {
+					di += 1u64;
+				};
+			};
+		};
+	};
+	if (soname_cs == nil) {
+		soname_cs = d_basename(path_cs);
+	};
+
+	// Versym is one u16 per dynsym entry.
+	let versym_off: u64 = 0u64;
+	let has_versym: i32 = 0;
+	if (idx_versym >= 0) {
+		let vs_sh: u64 = shoff + (idx_versym: u64) * SH_SIZE;
+		versym_off = d_u64(buf, vs_sh + SH_OFFSET);
+		has_versym = 1;
+	};
+
+	// Verdef section bounds + the .dynstr-like string section it uses.
+	let verdef_off: u64 = 0u64;
+	let verdef_size: u64 = 0u64;
+	let verstr: *u8 = nil;
+	if (idx_verdef >= 0) {
+		let vd_sh: u64 = shoff + (idx_verdef: u64) * SH_SIZE;
+		verdef_off = d_u64(buf, vd_sh + SH_OFFSET);
+		verdef_size = d_u64(buf, vd_sh + SH_SIZE_F);
+		let vd_link: u32 = d_u32(buf, vd_sh + SH_LINK);
+		let vstr_sh: u64 = shoff + (vd_link: u64) * SH_SIZE;
+		let vstr_off: u64 = d_u64(buf, vstr_sh + SH_OFFSET);
+		verstr = buf + vstr_off;
+	};
+
+	// Build the lso. Exports are appended in dynsym order so
+	// l_so_provides_v's first-match semantics match the C version.
+	let so: *lso = amalloc(l.a, 64u64): *lso;
+	so.path = d_cstr_to_str(l.a, path_cs);
+	so.soname = d_cstr_to_str(l.a, soname_cs);
+	so.exports = nil;
+	let tail: *lexport = nil;
+
+	let si: u64 = 1u64;
+	for (si < nsyms) {
+		let s_p: u64 = dynsym_off + si * SY_SIZE;
+		let st_shndx: u16 = d_u16(buf, s_p + SY_SHNDX);
+		if (st_shndx == 0u16) { si += 1u64; } else {
+			let st_info: u8 = buf[s_p + SY_INFO];
+			let bind: u32 = (st_info: u32) >> 4u32;
+			if (bind != 1u32) { if (bind != 2u32) {
+				// not GLOBAL/WEAK
+				si += 1u64;
+				continue;
+			}; };
+			let st_name: u32 = d_u32(buf, s_p + SY_NAME);
+			let nm_p: *u8 = dynstr + (st_name: u64);
+			if (nm_p[0u64] == 0u8) {
+				si += 1u64;
+				continue;
+			};
+
+			// Determine version. Skip non-default (hidden) and
+			// local entries.
+			let vername_cs: *u8 = nil;
+			let keep: i32 = 1;
+			if (has_versym != 0) {
+				let v: u16 = d_u16(buf, versym_off + si * 2u64);
+				if ((v & VERSYM_HIDDEN_C) != 0u16) {
+					keep = 0;	// non-default
+				} else {
+					let vidx: u16 = v & VERSYM_VERSION_C;
+					if (vidx == VER_NDX_LOCAL_C) {
+						keep = 0;	// not exported
+					} else { if (vidx == VER_NDX_GLOBAL_C) {
+						vername_cs = nil;
+					} else { if (vidx == 1u16) {
+						// glibc's BASE entry: treat as
+						// unversioned. (The C version
+						// notes that vidx==1 in Verdef
+						// maps to the SONAME BASE.)
+						vername_cs = nil;
+					} else {
+						if (verstr != nil) {
+							let nm: *u8 = vd_name_at(buf, verdef_off, verdef_size, verstr, vidx);
+							vername_cs = nm;
+						};
+					}; }; };
+				};
+			};
+
+			if (keep != 0) {
+				let e: *lexport = amalloc(l.a, 48u64): *lexport;
+				e.name = d_cstr_to_str(l.a, nm_p);
+				if (vername_cs == nil) {
+					e.version.ptr = nil;
+					e.version.len = 0i32;
+				} else {
+					e.version = d_cstr_to_str(l.a, vername_cs);
+				};
+				e.enext = nil;
+				if (tail == nil) {
+					so.exports = e;
+				} else {
+					tail.enext = e;
+				};
+				tail = e;
+			};
+			si += 1u64;
+		};
+	};
+
+	so.sonext = l.sos;
+	l.sos = so;
+	return 0;
+};
+
+fn so_err(msg: str) i32 = {
+	os.write(2, "6l: ".ptr, 4u64);
+	os.write(2, msg.ptr, msg.len: u64);
+	os.write(2, "\n".ptr, 1u64);
+	return -1;
+};
+
+// l_so_provides — 1 if so exports name, 0 otherwise.
+export fn l_so_provides(so: *lso, name: str) i32 = {
+	if (so == nil) { return 0; };
+	let e: *lexport = so.exports;
+	for (e != nil) {
+		if (s_eq(e.name, name)) { return 1; };
+		e = e.enext;
+	};
+	return 0;
+};
+
+// l_so_version — the version of so's export named `name`, or an empty
+// str (ptr=nil, len=0) if the export is unversioned or not present.
+export fn l_so_version(so: *lso, name: str) str = {
+	let result: str;
+	result.ptr = nil;
+	result.len = 0i32;
+	if (so == nil) { return result; };
+	let e: *lexport = so.exports;
+	for (e != nil) {
+		if (s_eq(e.name, name)) {
+			result.ptr = e.version.ptr;
+			result.len = e.version.len;
+			return result;
+		};
+		e = e.enext;
+	};
+	return result;
+};
+
+fn s_eq(a: str, b: str) bool = {
+	if (a.len != b.len) { return false; };
+	let i: i32 = 0;
+	for (i < a.len) {
+		if (a[i] != b[i]) { return false; };
+		i += 1;
+	};
+	return true;
+};

selfhost/cmd/6l/dynout.ww

@@ -0,0 +1,743 @@
+// selfhost/cmd/6l/dynout.ww — port of cmd/6l/dynout.c.
+//
+// Emit a dynamic-linked ELF executable. The shape is the simplest
+// valid one: PT_INTERP + PT_DYNAMIC + DT_BIND_NOW so the loader
+// resolves every PLT slot at startup (no lazy binding, no PLT0
+// trampoline). SysV .hash, not .gnu.hash. Non-PIE, fixed base.
+//
+// Layout:
+//   [0]            Ehdr
+//   [64]           Phdrs (PT_LOAD R+X, PT_LOAD R+W, PT_INTERP, PT_DYNAMIC)
+//   [interp_off]   "/lib64/ld-linux-x86-64.so.2\0"
+//   [dynstr_off]   .dynstr
+//   [dynsym_off]   .dynsym
+//   [hash_off]     .hash
+//   [versym_off]   .gnu.version
+//   [verneed_off]  .gnu.version_r
+//   [relaplt_off]  .rela.plt
+//   [pad to 0x1000]
+//   [text_off]     .text
+//   [plt_off]      .plt
+//   [pad to next page]
+//   [gotplt_off]   .got.plt   (writable; mapped by PT_LOAD #2)
+//   [dynamic_off]  .dynamic   (writable; covered by PT_DYNAMIC)
+//
+// cgen workaround notes:
+// - Two-level field assignments through pointers (e.g. r.sym.is_dyn = 1)
+//   silently fail in the current wwstage cgen. We bind the inner
+//   pointer to a local first: `let sym = r.sym; sym.is_dyn = 1;`
+// - Tuple returns of (i32, str) drop the str payload. l_so_version
+//   returns a plain str instead.
+// - `def NAME: str = "...";` produces a bogus str (len ends up adding
+//   to an offset accumulator). We use a fn returning the literal.
+
+use os;
+use mem;
+use sym;
+
+// ELF constants
+def ET_EXEC_D:     u16 = 2u16;
+def EM_X86_64_D:   u16 = 62u16;
+def EV_CURRENT_D:  u32 = 1u32;
+def ELFCLASS64_D:  u8  = 2u8;
+def ELFDATA2LSB_D: u8  = 1u8;
+
+def PT_LOAD_D:     u32 = 1u32;
+def PT_DYNAMIC_D:  u32 = 2u32;
+def PT_INTERP_D:   u32 = 3u32;
+def PF_X_D:        u32 = 1u32;
+def PF_W_D:        u32 = 2u32;
+def PF_R_D:        u32 = 4u32;
+
+def DT_NULL:       i64 = 0i64;
+def DT_NEEDED:     i64 = 1i64;
+def DT_PLTRELSZ:   i64 = 2i64;
+def DT_PLTGOT:     i64 = 3i64;
+def DT_HASH:       i64 = 4i64;
+def DT_STRTAB:     i64 = 5i64;
+def DT_SYMTAB:     i64 = 6i64;
+def DT_STRSZ:      i64 = 10i64;
+def DT_SYMENT:     i64 = 11i64;
+def DT_PLTREL:     i64 = 20i64;
+def DT_RELA:       i64 = 7i64;
+def DT_JMPREL:     i64 = 23i64;
+def DT_BIND_NOW:   i64 = 24i64;
+def DT_VERSYM:     i64 = 1879048176i64;	// 0x6ffffff0
+def DT_VERNEED:    i64 = 1879048190i64;	// 0x6ffffffe
+def DT_VERNEEDNUM: i64 = 1879048191i64;	// 0x6fffffff
+
+def VER_NDX_LOCAL_D:  u16 = 0u16;
+def VER_NDX_GLOBAL_D: u16 = 1u16;
+
+def R_X86_64_PC32_D:        i32 = 2;
+def R_X86_64_PLT32_D:       i32 = 4;
+def R_X86_64_JUMP_SLOT_D:   u32 = 7u32;
+
+def STB_GLOBAL_D: u8 = 1u8;
+def STT_FUNC_D:   u8 = 2u8;
+
+def PLT_STUB_BYTES_D: u64 = 8u64;
+def PAGE: u64 = 4096u64;
+
+// The PT_INTERP literal. Returned via a fn to dodge `def : str = "..."`
+// breakage in the current cgen.
+fn interp_str_v() str = {
+	return "/lib64/ld-linux-x86-64.so.2";
+};
+
+// ---- byte writers ------------------------------------------------------
+
+fn d_wr8(buf: *u8, off: u64, v: u8) void = {
+	buf[off] = v;
+};
+
+fn d_wr16(buf: *u8, off: u64, v: u16) void = {
+	buf[off]         = (v & 255u16): u8;
+	buf[off + 1u64]  = ((v >> 8u16) & 255u16): u8;
+};
+
+fn d_wr32(buf: *u8, off: u64, v: u32) void = {
+	buf[off]         = (v & 255u32): u8;
+	buf[off + 1u64]  = ((v >> 8u32)  & 255u32): u8;
+	buf[off + 2u64]  = ((v >> 16u32) & 255u32): u8;
+	buf[off + 3u64]  = ((v >> 24u32) & 255u32): u8;
+};
+
+fn d_wr64(buf: *u8, off: u64, v: u64) void = {
+	d_wr32(buf, off,        (v & 4294967295u64): u32);
+	d_wr32(buf, off + 4u64, ((v >> 32u64) & 4294967295u64): u32);
+};
+
+fn d_wri64(buf: *u8, off: u64, v: i64) void = {
+	d_wr64(buf, off, v: u64);
+};
+
+fn d_wri32(buf: *u8, off: u64, v: i32) void = {
+	d_wr32(buf, off, v: u32);
+};
+
+// ---- byte readers ------------------------------------------------------
+
+fn d_rd_u16(p: *u8, off: u64) u16 = {
+	let b0: u16 = p[off]: u16;
+	let b1: u16 = p[off + 1u64]: u16;
+	return b0 | (b1 << 8u16);
+};
+
+fn d_rd_u32(p: *u8, off: u64) u32 = {
+	let b0: u32 = p[off]: u32;
+	let b1: u32 = p[off + 1u64]: u32;
+	let b2: u32 = p[off + 2u64]: u32;
+	let b3: u32 = p[off + 3u64]: u32;
+	return b0 | (b1 << 8u32) | (b2 << 16u32) | (b3 << 24u32);
+};
+
+fn d_rd_i32(p: *u8, off: u64) i32 = {
+	return d_rd_u32(p, off): i32;
+};
+
+fn d_bcopy(dst: *u8, off: u64, src: *u8, n: u64) void = {
+	let i: u64 = 0u64;
+	for (i < n) {
+		dst[off + i] = src[i];
+		i += 1u64;
+	};
+};
+
+// elf_hash — SysV ELF hash. Used for .gnu.version_r's vna_hash.
+fn elf_hash(name: str) u32 = {
+	let h: u32 = 0u32;
+	let i: i32 = 0;
+	for (i < name.len) {
+		let c: u32 = (name[i]: u8): u32;
+		h = (h << 4u32) + c;
+		let g: u32 = h & 4026531840u32;	// 0xf0000000
+		if (g != 0u32) { h = h ^ (g >> 24u32); };
+		h = h & ~g;
+		i += 1;
+	};
+	return h;
+};
+
+fn align_up(off: u64, a: u64) u64 = {
+	return (off + a - 1u64) & ~(a - 1u64);
+};
+
+fn str_eq_d(a: str, b: str) bool = {
+	if (a.len != b.len) { return false; };
+	let i: i32 = 0;
+	for (i < a.len) {
+		if (a[i] != b[i]) { return false; };
+		i += 1;
+	};
+	return true;
+};
+
+// ---- main entry --------------------------------------------------------
+
+export fn l_emit_dyn_elf(l: *lnk, fd: i32, base: u64, entry: u64) i32 = {
+	let a: *arena = l.a;
+	let n: i32 = l.dyn_n;
+	let nu: u64 = n: u64;
+
+	// ---- collect dyn syms into a plt_idx-indexed array ----
+	let dynsyms: **lsym = amalloc(a, nu * 8u64): **lsym;
+	let s: *lsym = l.syms;
+	for (s != nil) {
+		if (s.is_dyn != 0) {
+			if (s.plt_idx >= 0) {
+				if (s.plt_idx < n) {
+					dynsyms[s.plt_idx] = s;
+				};
+			};
+		};
+		s = s.snext;
+	};
+	let i: i32 = 0;
+	for (i < n) {
+		if (dynsyms[i] == nil) {
+			os.write(2, "6l: dynout: no sym for plt_idx\n".ptr, 31u64);
+			return 1;
+		};
+		i += 1;
+	};
+
+	// ---- collect used .so's (in l.sos order) ----
+	let max_sos: i32 = 0;
+	let so: *lso = l.sos;
+	for (so != nil) { max_sos += 1; so = so.sonext; };
+	let sos_used: **lso = amalloc(a, (max_sos: u64) * 8u64): **lso;
+	let nsos: i32 = 0;
+	so = l.sos;
+	for (so != nil) {
+		let used: i32 = 0;
+		let j: i32 = 0;
+		for (j < n) {
+			let dsm: *lsym = dynsyms[j];
+			let dl: *lso = dsm.dyn_lib;
+			if (dl == so) { used = 1; j = n; }
+			else { j += 1; };
+		};
+		if (used != 0) {
+			sos_used[nsos] = so;
+			nsos += 1;
+		};
+		so = so.sonext;
+	};
+
+	// ---- build flat version table grouped by vlib ----
+	// vlib_sos_idx[k] = sos_used index for vlib k.
+	// vlib_first[k]   = ver index of first version under vlib k.
+	// vlib_count[k]   = number of versions under vlib k.
+	// ver_lib_idx[v]  = vlib index that version v belongs to.
+	// ver_name_ptr_arr[v] = name's *u8 (interned in the .so's verdef strings).
+	// ver_name_len_buf[v] = name length (i32).
+	// ver_dynstr_off[v]   = offset within .dynstr (assigned after layout).
+	// ver_vna_other[v]    = versym index (starting at 2).
+
+	let vlib_sos_idx_buf: *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
+	let vlib_first_buf:   *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
+	let vlib_count_buf:   *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
+	let n_vlibs: i32 = 0;
+
+	let ver_lib_idx_buf:  *u8 = amalloc(a, nu * 4u64): *u8;
+	let ver_name_ptr_arr: **u8 = amalloc(a, nu * 8u64): **u8;
+	let ver_name_len_buf: *u8 = amalloc(a, nu * 4u64): *u8;
+	let ver_dynstr_off:   *u8 = amalloc(a, nu * 4u64): *u8;
+	let ver_vna_other:    *u8 = amalloc(a, nu * 2u64): *u8;
+	let n_vers: i32 = 0;
+
+	let si: i32 = 0;
+	for (si < nsos) {
+		let cur_so: *lso = sos_used[si];
+		let has: i32 = 0;
+		let j: i32 = 0;
+		for (j < n) {
+			let dsm: *lsym = dynsyms[j];
+			let dl: *lso = dsm.dyn_lib;
+			if (dl == cur_so) {
+				let nm0: str = dsm.name;
+				let dv: str = l_so_version(cur_so, nm0);
+				if (dv.len > 0) {
+					has = 1; j = n;
+				} else { j += 1; };
+			} else { j += 1; };
+		};
+		if (has != 0) {
+			d_wr32(vlib_sos_idx_buf, (n_vlibs: u64) * 4u64, si: u32);
+			d_wr32(vlib_first_buf,   (n_vlibs: u64) * 4u64, n_vers: u32);
+			let added: i32 = 0;
+			let jj: i32 = 0;
+			for (jj < n) {
+				let dsm2: *lsym = dynsyms[jj];
+				let dl2: *lso = dsm2.dyn_lib;
+				if (dl2 == cur_so) {
+					let nm2: str = dsm2.name;
+					let vname: str = l_so_version(cur_so, nm2);
+					if (vname.len > 0) {
+						let seen: i32 = 0;
+						let k: i32 = 0;
+						for (k < added) {
+							let kk: i32 = n_vers - added + k;
+							let existing: str;
+							existing.ptr = ver_name_ptr_arr[kk];
+							existing.len = d_rd_i32(ver_name_len_buf, (kk: u64) * 4u64);
+							if (str_eq_d(existing, vname)) {
+								seen = 1; k = added;
+							} else { k += 1; };
+						};
+						if (seen == 0) {
+							d_wr32(ver_lib_idx_buf, (n_vers: u64) * 4u64, n_vlibs: u32);
+							ver_name_ptr_arr[n_vers] = vname.ptr;
+							d_wri32(ver_name_len_buf, (n_vers: u64) * 4u64, vname.len);
+							n_vers += 1;
+							added += 1;
+						};
+					};
+				};
+				jj += 1;
+			};
+			d_wr32(vlib_count_buf, (n_vlibs: u64) * 4u64, added: u32);
+			n_vlibs += 1;
+		};
+		si += 1;
+	};
+
+	// Assign vna_other indices starting at 2, walking vlib then per-version.
+	let next_vna: u16 = 2u16;
+	let vi: i32 = 0;
+	for (vi < n_vlibs) {
+		let first: i32 = d_rd_i32(vlib_first_buf, (vi: u64) * 4u64);
+		let cnt:   i32 = d_rd_i32(vlib_count_buf, (vi: u64) * 4u64);
+		let k: i32 = 0;
+		for (k < cnt) {
+			d_wr16(ver_vna_other, ((first + k): u64) * 2u64, next_vna);
+			next_vna += 1u16;
+			k += 1;
+		};
+		vi += 1;
+	};
+
+	// ---- compute dynstr size ----
+	let dynstr_sz: u64 = 1u64;	// leading NUL
+	let pi: i32 = 0;
+	for (pi < nsos) {
+		let so4: *lso = sos_used[pi];
+		dynstr_sz += so4.soname.len: u64;
+		dynstr_sz += 1u64;
+		pi += 1;
+	};
+	pi = 0;
+	for (pi < n) {
+		let dsm4: *lsym = dynsyms[pi];
+		dynstr_sz += dsm4.name.len: u64;
+		dynstr_sz += 1u64;
+		pi += 1;
+	};
+	pi = 0;
+	for (pi < n_vers) {
+		let nm_len: i32 = d_rd_i32(ver_name_len_buf, (pi: u64) * 4u64);
+		dynstr_sz += nm_len: u64;
+		dynstr_sz += 1u64;
+		pi += 1;
+	};
+
+	// ---- fill dynstr ----
+	let dynstr: *u8 = amalloc(a, dynstr_sz): *u8;
+	let dynstr_pos: u64 = 1u64;	// past leading NUL
+
+	let soname_str: *u8 = amalloc(a, (nsos: u64) * 4u64): *u8;
+	pi = 0;
+	for (pi < nsos) {
+		d_wr32(soname_str, (pi: u64) * 4u64, dynstr_pos: u32);
+		let so2: *lso = sos_used[pi];
+		let snm: str = so2.soname;
+		d_bcopy(dynstr, dynstr_pos, snm.ptr, snm.len: u64);
+		dynstr_pos += snm.len: u64;
+		dynstr[dynstr_pos] = 0u8;
+		dynstr_pos += 1u64;
+		pi += 1;
+	};
+	let symname_str: *u8 = amalloc(a, nu * 4u64): *u8;
+	pi = 0;
+	for (pi < n) {
+		d_wr32(symname_str, (pi: u64) * 4u64, dynstr_pos: u32);
+		let dsm: *lsym = dynsyms[pi];
+		let snm: str = dsm.name;
+		d_bcopy(dynstr, dynstr_pos, snm.ptr, snm.len: u64);
+		dynstr_pos += snm.len: u64;
+		dynstr[dynstr_pos] = 0u8;
+		dynstr_pos += 1u64;
+		pi += 1;
+	};
+	pi = 0;
+	for (pi < n_vers) {
+		d_wr32(ver_dynstr_off, (pi: u64) * 4u64, dynstr_pos: u32);
+		let nm_p: *u8 = ver_name_ptr_arr[pi];
+		let nm_len: i32 = d_rd_i32(ver_name_len_buf, (pi: u64) * 4u64);
+		d_bcopy(dynstr, dynstr_pos, nm_p, nm_len: u64);
+		dynstr_pos += nm_len: u64;
+		dynstr[dynstr_pos] = 0u8;
+		dynstr_pos += 1u64;
+		pi += 1;
+	};
+
+	// ---- per-dyn-sym versym index ----
+	let versym_for: *u8 = amalloc(a, nu * 2u64): *u8;
+	pi = 0;
+	for (pi < n) {
+		let dsm3: *lsym = dynsyms[pi];
+		let dl3: *lso = dsm3.dyn_lib;
+		let nm3: str = dsm3.name;
+		let vname: str = l_so_version(dl3, nm3);
+		if (vname.len == 0) {
+			d_wr16(versym_for, (pi: u64) * 2u64, VER_NDX_GLOBAL_D);
+		} else {
+			let matched: i32 = 0;
+			let vk: i32 = 0;
+			for (vk < n_vers) {
+				let vlx:  i32 = d_rd_i32(ver_lib_idx_buf, (vk: u64) * 4u64);
+				let sosx: i32 = d_rd_i32(vlib_sos_idx_buf, (vlx: u64) * 4u64);
+				if (sos_used[sosx] == dl3) {
+					let exi: str;
+					exi.ptr = ver_name_ptr_arr[vk];
+					exi.len = d_rd_i32(ver_name_len_buf, (vk: u64) * 4u64);
+					if (str_eq_d(exi, vname)) {
+						let other: u16 = d_rd_u16(ver_vna_other, (vk: u64) * 2u64);
+						d_wr16(versym_for, (pi: u64) * 2u64, other);
+						matched = 1;
+						vk = n_vers;
+					} else { vk += 1; };
+				} else { vk += 1; };
+			};
+			if (matched == 0) {
+				d_wr16(versym_for, (pi: u64) * 2u64, VER_NDX_GLOBAL_D);
+			};
+		};
+		pi += 1;
+	};
+
+	// ---- compute byte sizes ----
+	let ehdr_sz: u64 = 64u64;
+	let n_phdrs: u64 = 4u64;
+	let phdr_sz: u64 = n_phdrs * 56u64;
+	let is_local: str = interp_str_v();
+	let interp_sz: u64 = (is_local.len: u64) + 1u64;
+
+	let nsyms_total: u64 = 1u64 + nu;
+	let dynsym_sz: u64 = nsyms_total * 24u64;
+
+	let nbuckets: u32 = 1u32;
+	let nchain: u32 = nsyms_total: u32;
+	let hash_sz: u64 = (2u64 + (nbuckets: u64) + (nchain: u64)) * 4u64;
+
+	let relaplt_sz: u64 = nu * 24u64;
+	let plt_sz: u64 = nu * PLT_STUB_BYTES_D;
+	let gotplt_sz: u64 = (3u64 + nu) * 8u64;
+	let versym_sz: u64 = nsyms_total * 2u64;
+
+	let verneed_sz: u64 = 0u64;
+	let vli: i32 = 0;
+	for (vli < n_vlibs) {
+		let cnt: i32 = d_rd_i32(vlib_count_buf, (vli: u64) * 4u64);
+		verneed_sz += 16u64 + 16u64 * (cnt: u64);
+		vli += 1;
+	};
+
+	let with_ver: i32 = 0;
+	if (n_vlibs > 0) { with_ver = 1; };
+	let extra: u64 = 0u64;
+	if (with_ver != 0) { extra = 3u64; };
+	let ndyn: u64 = (nsos: u64) + 11u64 + extra;
+	let dynamic_sz: u64 = ndyn * 16u64;
+
+	// ---- compute file offsets ----
+	let off: u64 = ehdr_sz + phdr_sz;
+	let interp_off: u64 = off;       off += interp_sz;
+	off = align_up(off, 8u64);
+	let dynstr_off: u64 = off;       off += dynstr_sz;
+	off = align_up(off, 8u64);
+	let dynsym_off: u64 = off;       off += dynsym_sz;
+	let hash_off: u64 = off;         off += hash_sz;
+	off = align_up(off, 2u64);
+	let versym_off: u64 = off;       off += versym_sz;
+	off = align_up(off, 4u64);
+	let verneed_off: u64 = off;      off += verneed_sz;
+	off = align_up(off, 8u64);
+	let relaplt_off: u64 = off;      off += relaplt_sz;
+
+	let text_off: u64 = align_up(off, PAGE);
+	let plt_off: u64 = text_off + l.textlen;
+	let rx_end: u64 = plt_off + plt_sz;
+
+	let gotplt_off: u64 = align_up(rx_end, PAGE);
+	let dynamic_off: u64 = gotplt_off + gotplt_sz;
+	let file_end: u64 = dynamic_off + dynamic_sz;
+
+	let interp_va: u64 = base + interp_off;
+	let dynstr_va: u64 = base + dynstr_off;
+	let dynsym_va: u64 = base + dynsym_off;
+	let hash_va: u64 = base + hash_off;
+	let versym_va: u64 = base + versym_off;
+	let verneed_va: u64 = base + verneed_off;
+	let relaplt_va: u64 = base + relaplt_off;
+	let text_va: u64 = base + text_off;
+	let plt_va: u64 = base + plt_off;
+	let gotplt_va: u64 = base + gotplt_off;
+	let dynamic_va: u64 = base + dynamic_off;
+
+	// ---- build .dynsym ----
+	let dynsym_buf: *u8 = amalloc(a, dynsym_sz): *u8;
+	pi = 0;
+	for (pi < n) {
+		let eoff: u64 = (1u64 + (pi: u64)) * 24u64;
+		d_wr32(dynsym_buf, eoff + 0u64, d_rd_u32(symname_str, (pi: u64) * 4u64));
+		d_wr8(dynsym_buf, eoff + 4u64, (STB_GLOBAL_D << 4u8) | (STT_FUNC_D & 15u8));
+		d_wr8(dynsym_buf, eoff + 5u64, 0u8);
+		d_wr16(dynsym_buf, eoff + 6u64, 0u16);
+		d_wr64(dynsym_buf, eoff + 8u64, 0u64);
+		d_wr64(dynsym_buf, eoff + 16u64, 0u64);
+		pi += 1;
+	};
+
+	// ---- build .hash (SysV, 1 bucket) ----
+	let hash_buf: *u8 = amalloc(a, hash_sz): *u8;
+	d_wr32(hash_buf, 0u64, nbuckets);
+	d_wr32(hash_buf, 4u64, nchain);
+	let bucket0: u32 = 0u32;
+	if (nsyms_total > 1u64) { bucket0 = 1u32; };
+	d_wr32(hash_buf, 8u64, bucket0);
+	let ci: u64 = 1u64;
+	for (ci < nsyms_total) {
+		let nxt: u32 = 0u32;
+		if (ci + 1u64 < nsyms_total) { nxt = (ci + 1u64): u32; };
+		d_wr32(hash_buf, 8u64 + (nbuckets: u64) * 4u64 + ci * 4u64, nxt);
+		ci += 1u64;
+	};
+
+	// ---- build .rela.plt ----
+	let relaplt_buf: *u8 = amalloc(a, relaplt_sz): *u8;
+	pi = 0;
+	for (pi < n) {
+		let roff: u64 = (pi: u64) * 24u64;
+		d_wr64(relaplt_buf, roff + 0u64, gotplt_va + (3u64 + (pi: u64)) * 8u64);
+		let info: u64 = ((1u64 + (pi: u64)) << 32u64) | (R_X86_64_JUMP_SLOT_D: u64);
+		d_wr64(relaplt_buf, roff + 8u64, info);
+		d_wri64(relaplt_buf, roff + 16u64, 0i64);
+		pi += 1;
+	};
+
+	// ---- build .gnu.version (u16 per dynsym entry) ----
+	let versym_buf: *u8 = amalloc(a, versym_sz): *u8;
+	d_wr16(versym_buf, 0u64, VER_NDX_LOCAL_D);
+	pi = 0;
+	for (pi < n) {
+		d_wr16(versym_buf, 2u64 + (pi: u64) * 2u64, d_rd_u16(versym_for, (pi: u64) * 2u64));
+		pi += 1;
+	};
+
+	// ---- build .gnu.version_r ----
+	let verneed_buf: *u8 = amalloc(a, verneed_sz): *u8;
+	if (verneed_sz > 0u64) {
+		let vnoff: u64 = 0u64;
+		vli = 0;
+		for (vli < n_vlibs) {
+			let sos_idx: i32 = d_rd_i32(vlib_sos_idx_buf, (vli: u64) * 4u64);
+			let first:   i32 = d_rd_i32(vlib_first_buf,   (vli: u64) * 4u64);
+			let cnt:     i32 = d_rd_i32(vlib_count_buf,   (vli: u64) * 4u64);
+			let vn_start: u64 = vnoff;
+			d_wr16(verneed_buf, vnoff + 0u64, 1u16);
+			d_wr16(verneed_buf, vnoff + 2u64, cnt: u16);
+			d_wr32(verneed_buf, vnoff + 4u64, d_rd_u32(soname_str, (sos_idx: u64) * 4u64));
+			d_wr32(verneed_buf, vnoff + 8u64, 16u32);
+			vnoff += 16u64;
+			let k: i32 = 0;
+			for (k < cnt) {
+				let vk: i32 = first + k;
+				let nm: str;
+				nm.ptr = ver_name_ptr_arr[vk];
+				nm.len = d_rd_i32(ver_name_len_buf, (vk: u64) * 4u64);
+				let h: u32 = elf_hash(nm);
+				d_wr32(verneed_buf, vnoff + 0u64, h);
+				d_wr16(verneed_buf, vnoff + 4u64, 0u16);
+				d_wr16(verneed_buf, vnoff + 6u64, d_rd_u16(ver_vna_other, (vk: u64) * 2u64));
+				d_wr32(verneed_buf, vnoff + 8u64, d_rd_u32(ver_dynstr_off, (vk: u64) * 4u64));
+				let nxt: u32 = 0u32;
+				if (k + 1 < cnt) { nxt = 16u32; };
+				d_wr32(verneed_buf, vnoff + 12u64, nxt);
+				vnoff += 16u64;
+				k += 1;
+			};
+			let vn_nxt: u32 = 0u32;
+			if (vli + 1 < n_vlibs) { vn_nxt = (vnoff - vn_start): u32; };
+			d_wr32(verneed_buf, vn_start + 12u64, vn_nxt);
+			vli += 1;
+		};
+	};
+
+	// ---- build .plt ----
+	let plt_buf: *u8 = amalloc(a, plt_sz): *u8;
+	pi = 0;
+	for (pi < n) {
+		let p_off: u64 = (pi: u64) * PLT_STUB_BYTES_D;
+		let stub_va: u64 = plt_va + p_off;
+		let next_ip: u64 = stub_va + 6u64;
+		let slot_va: u64 = gotplt_va + (3u64 + (pi: u64)) * 8u64;
+		let disp: i64 = (slot_va: i64) - (next_ip: i64);
+		d_wr8(plt_buf, p_off + 0u64, 255u8);
+		d_wr8(plt_buf, p_off + 1u64, 37u8);
+		d_wr32(plt_buf, p_off + 2u64, (disp: i32): u32);
+		pi += 1;
+	};
+
+	// ---- build .got.plt ----
+	let gotplt_buf: *u8 = amalloc(a, gotplt_sz): *u8;
+	d_wr64(gotplt_buf, 0u64, dynamic_va);
+
+	// ---- build .dynamic ----
+	let dynamic_buf: *u8 = amalloc(a, dynamic_sz): *u8;
+	let dk: u64 = 0u64;
+	pi = 0;
+	for (pi < nsos) {
+		d_wri64(dynamic_buf, dk * 16u64 + 0u64, DT_NEEDED);
+		d_wr64(dynamic_buf, dk * 16u64 + 8u64, d_rd_u32(soname_str, (pi: u64) * 4u64): u64);
+		dk += 1u64;
+		pi += 1;
+	};
+	d_wri64(dynamic_buf, dk * 16u64, DT_HASH);     d_wr64(dynamic_buf, dk * 16u64 + 8u64, hash_va);     dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_STRTAB);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynstr_va);   dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_SYMTAB);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynsym_va);   dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_STRSZ);    d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynstr_sz);   dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_SYMENT);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, 24u64);       dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_PLTGOT);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, gotplt_va);   dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_PLTRELSZ); d_wr64(dynamic_buf, dk * 16u64 + 8u64, relaplt_sz);  dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_PLTREL);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, DT_RELA: u64);dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_JMPREL);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, relaplt_va);  dk += 1u64;
+	d_wri64(dynamic_buf, dk * 16u64, DT_BIND_NOW); d_wr64(dynamic_buf, dk * 16u64 + 8u64, 0u64);        dk += 1u64;
+	if (with_ver != 0) {
+		d_wri64(dynamic_buf, dk * 16u64, DT_VERSYM);     d_wr64(dynamic_buf, dk * 16u64 + 8u64, versym_va);   dk += 1u64;
+		d_wri64(dynamic_buf, dk * 16u64, DT_VERNEED);    d_wr64(dynamic_buf, dk * 16u64 + 8u64, verneed_va);  dk += 1u64;
+		d_wri64(dynamic_buf, dk * 16u64, DT_VERNEEDNUM); d_wr64(dynamic_buf, dk * 16u64 + 8u64, n_vlibs: u64);dk += 1u64;
+	};
+	d_wri64(dynamic_buf, dk * 16u64, DT_NULL); d_wr64(dynamic_buf, dk * 16u64 + 8u64, 0u64); dk += 1u64;
+	if (dk != ndyn) {
+		os.write(2, "6l: dynamic entry count mismatch\n".ptr, 33u64);
+		return 1;
+	};
+
+	// ---- patch .text relocs targeting dynamic syms ----
+	let r: *lrel = l.rels;
+	for (r != nil) {
+		if (r.sym != nil) {
+			let rsym: *lsym = r.sym;
+			if (rsym.is_dyn != 0) {
+				if (r.kind != R_X86_64_PC32_D) {
+					if (r.kind != R_X86_64_PLT32_D) {
+						os.write(2, "6l: dynamic reloc kind unsupported\n".ptr, 35u64);
+						return 1;
+					};
+				};
+				let site: u64 = text_va + r.off;
+				let stub: u64 = plt_va + (rsym.plt_idx: u64) * PLT_STUB_BYTES_D;
+				let disp: i64 = (stub: i64) - (site: i64) + r.addend;
+				d_wr32(l.text, r.off, (disp: i32): u32);
+			};
+		};
+		r = r.rnext;
+	};
+
+	// ---- assemble file buffer ----
+	let file_buf: *u8 = os.alloc(file_end): *u8;
+	if (file_buf == nil) {
+		os.write(2, "6l: out of memory\n".ptr, 18u64);
+		return 1;
+	};
+
+	// Ehdr
+	d_wr8(file_buf, 0u64, 127u8);
+	d_wr8(file_buf, 1u64, 69u8);
+	d_wr8(file_buf, 2u64, 76u8);
+	d_wr8(file_buf, 3u64, 70u8);
+	d_wr8(file_buf, 4u64, ELFCLASS64_D);
+	d_wr8(file_buf, 5u64, ELFDATA2LSB_D);
+	d_wr8(file_buf, 6u64, EV_CURRENT_D: u8);
+	d_wr16(file_buf, 16u64, ET_EXEC_D);
+	d_wr16(file_buf, 18u64, EM_X86_64_D);
+	d_wr32(file_buf, 20u64, EV_CURRENT_D);
+	d_wr64(file_buf, 24u64, entry);
+	d_wr64(file_buf, 32u64, ehdr_sz);
+	d_wr64(file_buf, 40u64, 0u64);
+	d_wr32(file_buf, 48u64, 0u32);
+	d_wr16(file_buf, 52u64, ehdr_sz: u16);
+	d_wr16(file_buf, 54u64, 56u16);
+	d_wr16(file_buf, 56u64, n_phdrs: u16);
+	d_wr16(file_buf, 58u64, 0u16);
+	d_wr16(file_buf, 60u64, 0u16);
+	d_wr16(file_buf, 62u64, 0u16);
+
+	// Phdrs at offset 64.
+	let p0: u64 = 64u64;
+	d_wr32(file_buf, p0 + 0u64,  PT_LOAD_D);
+	d_wr32(file_buf, p0 + 4u64,  PF_R_D | PF_X_D);
+	d_wr64(file_buf, p0 + 8u64,  0u64);
+	d_wr64(file_buf, p0 + 16u64, base);
+	d_wr64(file_buf, p0 + 24u64, base);
+	d_wr64(file_buf, p0 + 32u64, rx_end);
+	d_wr64(file_buf, p0 + 40u64, rx_end);
+	d_wr64(file_buf, p0 + 48u64, PAGE);
+
+	let p1: u64 = 64u64 + 56u64;
+	d_wr32(file_buf, p1 + 0u64,  PT_LOAD_D);
+	d_wr32(file_buf, p1 + 4u64,  PF_R_D | PF_W_D);
+	d_wr64(file_buf, p1 + 8u64,  gotplt_off);
+	d_wr64(file_buf, p1 + 16u64, gotplt_va);
+	d_wr64(file_buf, p1 + 24u64, gotplt_va);
+	d_wr64(file_buf, p1 + 32u64, file_end - gotplt_off);
+	d_wr64(file_buf, p1 + 40u64, file_end - gotplt_off);
+	d_wr64(file_buf, p1 + 48u64, PAGE);
+
+	let p2: u64 = 64u64 + 112u64;
+	d_wr32(file_buf, p2 + 0u64,  PT_INTERP_D);
+	d_wr32(file_buf, p2 + 4u64,  PF_R_D);
+	d_wr64(file_buf, p2 + 8u64,  interp_off);
+	d_wr64(file_buf, p2 + 16u64, interp_va);
+	d_wr64(file_buf, p2 + 24u64, interp_va);
+	d_wr64(file_buf, p2 + 32u64, interp_sz);
+	d_wr64(file_buf, p2 + 40u64, interp_sz);
+	d_wr64(file_buf, p2 + 48u64, 1u64);
+
+	let p3: u64 = 64u64 + 168u64;
+	d_wr32(file_buf, p3 + 0u64,  PT_DYNAMIC_D);
+	d_wr32(file_buf, p3 + 4u64,  PF_R_D | PF_W_D);
+	d_wr64(file_buf, p3 + 8u64,  dynamic_off);
+	d_wr64(file_buf, p3 + 16u64, dynamic_va);
+	d_wr64(file_buf, p3 + 24u64, dynamic_va);
+	d_wr64(file_buf, p3 + 32u64, dynamic_sz);
+	d_wr64(file_buf, p3 + 40u64, dynamic_sz);
+	d_wr64(file_buf, p3 + 48u64, 8u64);
+
+	// Sections.
+	let interp_local: str = interp_str_v();
+	d_bcopy(file_buf, interp_off, interp_local.ptr, interp_local.len: u64);
+	d_wr8(file_buf, interp_off + (interp_local.len: u64), 0u8);
+	d_bcopy(file_buf, dynstr_off, dynstr, dynstr_sz);
+	d_bcopy(file_buf, dynsym_off, dynsym_buf, dynsym_sz);
+	d_bcopy(file_buf, hash_off, hash_buf, hash_sz);
+	d_bcopy(file_buf, versym_off, versym_buf, versym_sz);
+	if (verneed_sz > 0u64) {
+		d_bcopy(file_buf, verneed_off, verneed_buf, verneed_sz);
+	};
+	d_bcopy(file_buf, relaplt_off, relaplt_buf, relaplt_sz);
+	if (l.textlen > 0u64) {
+		d_bcopy(file_buf, text_off, l.text, l.textlen);
+	};
+	d_bcopy(file_buf, plt_off, plt_buf, plt_sz);
+	d_bcopy(file_buf, gotplt_off, gotplt_buf, gotplt_sz);
+	d_bcopy(file_buf, dynamic_off, dynamic_buf, dynamic_sz);
+
+	let wrote: i64 = os.writefull(fd, file_buf, file_end);
+	if (wrote != file_end: i64) {
+		return 1;
+	};
+	return 0;
+};

selfhost/cmd/6l/main.ww

@@ -1,24 +1,24 @@
 // selfhost/cmd/6l/main.ww — port of cmd/6l/main.c.
 //
-// 6l = amd64 static linker. Reads relocatable ELF .o files and
+// 6l = amd64 linker. Reads relocatable ELF .o files, SysV `ar`
-// SysV `ar` archives, resolves symbols, applies relocations, writes
+// archives, and shared objects (ET_DYN). Resolves symbols, applies
-// a static ELF executable.
+// relocations, writes a static or dynamic-linked ELF executable.
 //
-//   6l_ww -o out file1.o file2.o libwwrt.a ...
+//   6l_ww -o out [-L<dir>...] [-l<name>...] file1.o file2.o ...
 
 use os;
 use mem;
 use sym;
 use obj;
+use dyn;
 use pass;
 use out;
 
 def BASE: u64 = 4194304u64;	// 0x400000
 def CODE_VA_OFF: u64 = 4096u64;	// .text starts at base + 0x1000
 
-// Linker context lives in main's frame; arena gets passed in.
 fn make_lnk(a: *arena) *lnk = {
-	let l: *lnk = amalloc(a, 96u64): *lnk;
+	let l: *lnk = amalloc(a, 112u64): *lnk;
 	l.a = a;
 	return l;
 };
@@ -35,13 +35,190 @@ fn streq_cs(a: *u8, lit: str) bool = {
 	return true;
 };
 
-export fn main(argc: i32, argv: **u8) i32 = {
+fn cstrlen_l(p: *u8) u64 = {
+	let n: u64 = 0u64;
+	for (p[n] != 0u8) { n += 1u64; };
+	return n;
+};
 
+// strncmp(a, lit, n): true iff a's first n bytes == lit's first n bytes.
+fn strn_eq(a: *u8, lit: str, n: u64) bool = {
+	if ((lit.len: u64) < n) { return false; };
+	let i: u64 = 0u64;
+	for (i < n) {
+		let li: i32 = i: i32;
+		if (a[i] != lit[li]) { return false; };
+		i += 1u64;
+	};
+	return true;
+};
+
+// Build "<dir>/lib<name>.<ext>" into dst (NUL-terminated). Returns total
+// length excluding NUL. dst must be large enough.
+fn build_path(dst: *u8, dir: *u8, name: *u8, ext: str) u64 = {
+	let i: u64 = 0u64;
+	let dn: u64 = cstrlen_l(dir);
+	let nn: u64 = cstrlen_l(name);
+	let k: u64 = 0u64;
+	for (k < dn) { dst[i] = dir[k]; i += 1u64; k += 1u64; };
+	dst[i] = 47u8;	// '/'
+	i += 1u64;
+	dst[i] = 108u8;	// 'l'
+	i += 1u64;
+	dst[i] = 105u8;	// 'i'
+	i += 1u64;
+	dst[i] = 98u8;	// 'b'
+	i += 1u64;
+	k = 0u64;
+	for (k < nn) { dst[i] = name[k]; i += 1u64; k += 1u64; };
+	k = 0u64;
+	for (k < ext.len: u64) {
+		let li: i32 = k: i32;
+		dst[i] = ext[li];
+		i += 1u64;
+		k += 1u64;
+	};
+	dst[i] = 0u8;
+	return i;
+};
+
+// Append decimal n to dst at offset i. Returns new offset.
+fn append_dec(dst: *u8, i: u64, n: u64) u64 = {
+	if (n == 0u64) {
+		dst[i] = 48u8;
+		return i + 1u64;
+	};
+	let buf: *u8 = os.alloc(16u64): *u8;
+	let k: u64 = 0u64;
+	let v: u64 = n;
+	for (v > 0u64) {
+		buf[k] = (v % 10u64): u8 + 48u8;
+		v = v / 10u64;
+		k += 1u64;
+	};
+	let oi: u64 = i;
+	for (k > 0u64) {
+		k -= 1u64;
+		dst[oi] = buf[k];
+		oi += 1u64;
+	};
+	return oi;
+};
+
+fn build_path_v(dst: *u8, dir: *u8, name: *u8, v: u64) u64 = {
+	let i: u64 = 0u64;
+	let dn: u64 = cstrlen_l(dir);
+	let nn: u64 = cstrlen_l(name);
+	let k: u64 = 0u64;
+	for (k < dn) { dst[i] = dir[k]; i += 1u64; k += 1u64; };
+	dst[i] = 47u8; i += 1u64;
+	dst[i] = 108u8; i += 1u64;
+	dst[i] = 105u8; i += 1u64;
+	dst[i] = 98u8; i += 1u64;
+	k = 0u64;
+	for (k < nn) { dst[i] = name[k]; i += 1u64; k += 1u64; };
+	dst[i] = 46u8; i += 1u64; dst[i] = 115u8; i += 1u64; dst[i] = 111u8; i += 1u64; dst[i] = 46u8; i += 1u64;
+	i = append_dec(dst, i, v);
+	dst[i] = 0u8;
+	return i;
+};
+
+// is_linkable: read first 8 bytes; require !<arch>\n or \x7fELF.
+fn is_linkable(path: *u8) bool = {
+	let fd: i32 = os.open(path, os.O_RDONLY, 0i32);
+	if (fd < 0) { return false; };
+	let mp: *u8 = os.alloc(8u64): *u8;
+	let n: i64 = os.read(fd, mp, 8u64);
+	os.close(fd);
+	if (n < 4i64) { return false; };
+	// archive: "!<arch>\n"
+	if (n >= 8i64) {
+		if (mp[0u64] == 33u8) { if (mp[1u64] == 60u8) {
+		if (mp[2u64] == 97u8) { if (mp[3u64] == 114u8) {
+		if (mp[4u64] == 99u8) { if (mp[5u64] == 104u8) {
+		if (mp[6u64] == 62u8) { if (mp[7u64] == 10u8) {
+			return true;
+		}; }; }; }; }; }; }; };
+	};
+	// ELF: "\x7fELF"
+	if (mp[0u64] == 127u8) {
+		if (mp[1u64] == 69u8) {
+			if (mp[2u64] == 76u8) {
+				if (mp[3u64] == 70u8) { return true; };
+			};
+		};
+	};
+	return false;
+};
+
+// Walk libdirs[0..n) trying lib<name>.so, then lib<name>.so.{0..8},
+// then lib<name>.a. Return arena-owned NUL-terminated path on success,
+// nil on miss.
+fn resolve_lib(a: *arena, name: *u8, libdirs: **u8, n_libdirs: i32) *u8 = {
+	let bufp: *u8 = os.alloc(1024u64): *u8;
+	let i: i32 = 0;
+	for (i < n_libdirs) {
+		let dir: *u8 = libdirs[i];
+		let _l1: u64 = build_path(bufp, dir, name, ".so");
+		if (is_linkable(bufp)) {
+			let pl: u64 = cstrlen_l(bufp);
+			let p: *u8 = amalloc(a, pl + 1u64): *u8;
+			let k: u64 = 0u64;
+			for (k <= pl) { p[k] = bufp[k]; k += 1u64; };
+			return p;
+		};
+		let v: u64 = 0u64;
+		for (v <= 8u64) {
+			let _l2: u64 = build_path_v(bufp, dir, name, v);
+			if (is_linkable(bufp)) {
+				let pl2: u64 = cstrlen_l(bufp);
+				let p2: *u8 = amalloc(a, pl2 + 1u64): *u8;
+				let k2: u64 = 0u64;
+				for (k2 <= pl2) { p2[k2] = bufp[k2]; k2 += 1u64; };
+				return p2;
+			};
+			v += 1u64;
+		};
+		let _l3: u64 = build_path(bufp, dir, name, ".a");
+		if (is_linkable(bufp)) {
+			let pl3: u64 = cstrlen_l(bufp);
+			let p3: *u8 = amalloc(a, pl3 + 1u64): *u8;
+			let k3: u64 = 0u64;
+			for (k3 <= pl3) { p3[k3] = bufp[k3]; k3 += 1u64; };
+			return p3;
+		};
+		i += 1;
+	};
+	return nil;
+};
+
+// Read first 20 bytes; return 1 for ET_DYN .so, 0 for ar/.o.
+fn is_so(path: *u8) i32 = {
+	let fd: i32 = os.open(path, os.O_RDONLY, 0i32);
+	if (fd < 0) { return 0; };
+	let mp: *u8 = os.alloc(20u64): *u8;
+	let n: i64 = os.read(fd, mp, 20u64);
+	os.close(fd);
+	if (n < 20i64) { return 0; };
+	if (mp[0u64] != 127u8) { return 0; };
+	if (mp[1u64] != 69u8) { return 0; };
+	if (mp[2u64] != 76u8) { return 0; };
+	if (mp[3u64] != 70u8) { return 0; };
+	// e_type at offset 16, u16 little-endian
+	let t: u16 = (mp[16u64]: u16) | ((mp[17u64]: u16) << 8u16);
+	if (t == 3u16) { return 1; };
+	return 0;
+};
+
+export fn main(argc: i32, argv: **u8) i32 = {
 	let out_path: *u8 = nil;
-	// Inputs: store as **u8 (heap'd from a fixed-size buffer).
 	let max_inputs: i32 = 64;
 	let inputs:  **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
 	let ninputs: i32 = 0;
+	let libdirs: **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
+	let n_libdirs: i32 = 0;
+	let lflags:  **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
+	let n_lflags: i32 = 0;
 
 	let i: i32 = 1;
 	for (i < argc) {
@@ -53,9 +230,44 @@ export fn main(argc: i32, argv: **u8) i32 = {
 				return 2;
 			};
 			out_path = argv[i];
+		} else { if (streq_cs(a, "-L")) {
+			i += 1;
+			if (i >= argc) {
+				os.write(2, "6l: -L requires argument\n".ptr, 25u64);
+				return 2;
+			};
+			libdirs[n_libdirs] = argv[i];
+			n_libdirs += 1;
+		} else { if (streq_cs(a, "-l")) {
+			i += 1;
+			if (i >= argc) {
+				os.write(2, "6l: -l requires argument\n".ptr, 25u64);
+				return 2;
+			};
+			lflags[n_lflags] = argv[i];
+			n_lflags += 1;
 		} else { if (a[0u64] == 45u8) {
+			// -L<dir> joined form.
+			if (a[1u64] == 76u8) {
+				if (a[2u64] != 0u8) {
+					libdirs[n_libdirs] = a + 2u64;
+					n_libdirs += 1;
+				} else {
+					os.write(2, "6l: bare -L\n".ptr, 12u64);
+					return 2;
+				};
+			} else { if (a[1u64] == 108u8) {
+				if (a[2u64] != 0u8) {
+					lflags[n_lflags] = a + 2u64;
+					n_lflags += 1;
+				} else {
+					os.write(2, "6l: bare -l\n".ptr, 12u64);
+					return 2;
+				};
+			} else {
 				os.write(2, "6l: unknown flag\n".ptr, 17u64);
 				return 2;
+			};};
 		} else {
 			if (ninputs >= max_inputs) {
 				os.write(2, "6l: too many inputs\n".ptr, 20u64);
@@ -63,12 +275,12 @@ export fn main(argc: i32, argv: **u8) i32 = {
 			};
 			inputs[ninputs] = a;
 			ninputs += 1;
-		}; };
+		};};};};
 		i += 1;
 	};
 
 	if (out_path == nil) {
-		os.write(2, "usage: 6l_ww -o exe file1.o [file2.o...]\n".ptr, 41u64);
+		os.write(2, "usage: 6l_ww -o exe [-L<dir>...] [-l<name>...] file1.o [file2.o...]\n".ptr, 68u64);
 		return 2;
 	};
 	if (ninputs == 0) {
@@ -79,9 +291,10 @@ export fn main(argc: i32, argv: **u8) i32 = {
 	let a: *arena = newarena();
 	let l: *lnk = make_lnk(a);
 
-	// Seed _start so a libwwrt-style start.o is recognised as wanted.
+	// Seed _start so libwwrt-style start.o is recognised as wanted.
 	l_intern(l, "_start");
 
+	// Load positional inputs first (preserving order).
 	let k: i32 = 0;
 	for (k < ninputs) {
 		if (l_load(l, inputs[k]) != 0) {
@@ -90,6 +303,26 @@ export fn main(argc: i32, argv: **u8) i32 = {
 		k += 1;
 	};
 
+	// Then resolve -l flags and load each. Archives append; shared
+	// objects register their exports.
+	let lf: i32 = 0;
+	for (lf < n_lflags) {
+		let p: *u8 = resolve_lib(a, lflags[lf], libdirs, n_libdirs);
+		if (p == nil) {
+			os.write(2, "6l: cannot find -l".ptr, 18u64);
+			let nm: *u8 = lflags[lf];
+			os.write(2, nm, cstrlen_l(nm));
+			os.write(2, "\n".ptr, 1u64);
+			return 1;
+		};
+		if (is_so(p) != 0) {
+			if (l_load_so(l, p) != 0) { return 1; };
+		} else {
+			if (l_load(l, p) != 0) { return 1; };
+		};
+		lf += 1;
+	};
+
 	if (l_resolve(l) != 0) { return 1; };
 	if (l_relocate(l, BASE + CODE_VA_OFF) != 0) { return 1; };
 
@@ -105,7 +338,6 @@ export fn main(argc: i32, argv: **u8) i32 = {
 		return 1;
 	};
 
-	// Open output: O_WRONLY|O_CREAT|O_TRUNC, mode 0755.
 	let flags: i32 = os.O_WRONLY | os.O_CREAT | os.O_TRUNC;
 	let fd: i32 = os.open(out_path, flags, 493i32);	// 0o755
 	if (fd < 0) {

selfhost/cmd/6l/out.ww

@@ -9,6 +9,7 @@
 
 use os;
 use sym;
+use dynout;
 
 def ET_EXEC:    u16 = 2u16;
 def EM_X86_64_W: u16 = 62u16;
@@ -43,6 +44,14 @@ fn wr_u64(buf: *u8, off: u64, v: u64) void = {
 // ---- emit ---------------------------------------------------------------
 
 export fn l_emit_elf(l: *lnk, fd: i32, base: u64, entry: u64) i32 = {
+	// Dispatch: any loaded shared object plus any dynamic ref means
+	// we owe the loader a real PT_INTERP/PT_DYNAMIC binary.
+	if (l.sos != nil) {
+		if (l.dyn_n > 0) {
+			return l_emit_dyn_elf(l, fd, base, entry);
+		};
+	};
+
 	let filesz: u64 = TEXT_OFF + l.textlen;
 
 	// One contiguous header buffer covering [0..0x1000), then .text.

selfhost/cmd/6l/pass.ww

@@ -1,30 +1,75 @@
 // selfhost/cmd/6l/pass.ww — port of cmd/6l/pass.c.
 //
 // Resolution + relocation. l_resolve flags every undefined symbol
-// referenced by a relocation. l_relocate walks the rel list and
+// referenced by a relocation, and promotes those provided by some
-// patches the .text bytes in place once the final virtual base is
+// loaded .so to "dynamic" with a freshly-assigned PLT slot.
-// known. Supported relocation kinds: PC32 (=2), PLT32 (=4); both
+// l_relocate walks the rel list and patches the .text bytes in place
-// are 32-bit PC-relative displacements (PLT32 == PC32 for static).
+// once the final virtual base is known. Dynamic refs are deferred:
+// their site is patched later in dynout, once the PLT vaddr is known.
+//
+// Supported relocation kinds: PC32 (=2), PLT32 (=4); both are 32-bit
+// PC-relative displacements (PLT32 == PC32 for static).
 
 use os;
 use sym;
+use dyn;
 
 def R_X86_64_PC32:  i32 = 2;
 def R_X86_64_PLT32: i32 = 4;
 
 export fn l_resolve(l: *lnk) i32 = {
+	// Initialise dynamic-linking sentinels. amalloc zeroes, so
+	// is_dyn/dyn_lib start clean — but plt_idx and dynsym_idx
+	// must be -1, not 0.
+	let si: *lsym = l.syms;
+	for (si != nil) {
+		si.plt_idx = -1;
+		si.dynsym_idx = -1;
+		si = si.snext;
+	};
+
+	// Promote each undefined sym that some lso exports to dynamic
+	// and hand it a PLT slot. Iteration order over the relocation
+	// list determines slot numbering and is stable across runs.
 	let r: *lrel = l.rels;
 	for (r != nil) {
 		if (r.sym != nil) {
 			if (r.sym.defined == 0) {
+				let sym: *lsym = r.sym;
+				if (sym.is_dyn == 0) {
+					let so: *lso = l.sos;
+					for (so != nil) {
+						if (l_so_provides(so, sym.name) != 0) {
+							sym.is_dyn = 1;
+							sym.dyn_lib = so;
+							sym.plt_idx = l.dyn_n;
+							l.dyn_n += 1;
+							so = nil;	// break
+						} else {
+							so = so.sonext;
+						};
+					};
+				};
+			};
+		};
+		r = r.rnext;
+	};
+
+	// What remains undefined truly is undefined.
+	let r2: *lrel = l.rels;
+	for (r2 != nil) {
+		if (r2.sym != nil) {
+			if (r2.sym.defined == 0) {
+				if (r2.sym.is_dyn == 0) {
 					os.write(2, "6l: undefined reference to '".ptr, 28u64);
-				let nm: str = r.sym.name;
+					let nm: str = r2.sym.name;
 					os.write(2, nm.ptr, nm.len: u64);
 					os.write(2, "'\n".ptr, 2u64);
 					l.errs += 1;
 				};
 			};
-		r = r.rnext;
+		};
+		r2 = r2.rnext;
 	};
 	return l.errs;
 };
@@ -40,6 +85,12 @@ export fn l_relocate(l: *lnk, base: u64) i32 = {
 	let r: *lrel = l.rels;
 	for (r != nil) {
 		if (r.sym != nil) {
+			// Dynamic refs are patched later in dynout once the
+			// PLT vaddr is known.
+			if (r.sym.is_dyn != 0) {
+				r = r.rnext;
+				continue;
+			};
 			if (r.sym.defined != 0) {
 				let k: i32 = r.kind;
 				if (k == R_X86_64_PC32) {

selfhost/cmd/6l/sym.ww

@@ -11,6 +11,14 @@ type lsym = struct {
 	defined:      i32,	// 1 if some lobj defines this symbol
 	owner:        *lobj,
 	idx_in_owner: i32,
+	// Dynamic-linking fields. Set by l_resolve when an undefined sym
+	// is provided by some loaded lso. plt_idx and dynsym_idx default
+	// to -1 (set explicitly by l_resolve, not by amalloc-zeroing).
+	is_dyn:       i32,
+	dyn_lib:      *lso,
+	dyn_version:  str,	// matched export's version; len 0 if none
+	plt_idx:      i32,
+	dynsym_idx:   i32,
 	snext:        *lsym,
 };
 
@@ -31,15 +39,33 @@ type lobj = struct {
 	onext:     *lobj,
 };
 
+// lexport — one entry per GLOBAL/WEAK symbol exported by a loaded .so.
+// Stored as a chain in the order the .so's dynsym presents them, so
+// l_so_provides_v's first-match semantics agree with the C version.
+type lexport = struct {
+	name:    str,
+	version: str,	// len 0 for unversioned globals
+	enext:   *lexport,
+};
+
+type lso = struct {
+	path:    str,	// full filesystem path used to load
+	soname:  str,	// DT_SONAME, or basename if missing
+	exports: *lexport,	// dynsym-order chain of exported names
+	sonext:  *lso,
+};
+
 type lnk = struct {
 	a:       *arena,
 	objs:    *lobj,
+	sos:     *lso,
 	syms:    *lsym,
 	rels:    *lrel,
 	text:    *u8,	// combined .text
 	textcap: u64,
 	textlen: u64,
 	errs:    i32,
+	dyn_n:   i32,	// number of syms routed through PLT
 };
 
 fn streq(a: str, b: str) bool = {
@@ -58,7 +84,7 @@ export fn l_intern(l: *lnk, name: str) *lsym = {
 		if (streq(s.name, name)) { return s; };
 		s = s.snext;
 	};
-	let n: *lsym = amalloc(l.a, 64u64): *lsym;
+	let n: *lsym = amalloc(l.a, 96u64): *lsym;
 	n.name = name;
 	n.snext = l.syms;
 	l.syms = n;

selfhost/cmd/ww/main.combined.ww

@@ -695,18 +695,28 @@ fn append_lit(stem: *u8, suffix: str) *u8 = {
 	return buf;
 };
 
+// linker flags bundled as a struct so build_one stays at the wwstage
+// 6c's 6-argument calling-convention limit.
+type lflags = struct {
+	libdirs:   **u8,
+	n_libdirs: i32,
+	libs:      **u8,
+	n_libs:    i32,
+};
+
 // build_one — compile `src` into the executable named `out`.
 //   self_dir:  NUL-terminated dir containing this driver and the
 //              wwstage tools (6c_ww/6a_ww/6l_ww)
 //   src:       NUL-terminated path to the .ww file
 //   out:       NUL-terminated desired output path
 //   incs:      NUL-terminated colon-list of -I dirs (may be empty)
+//   lf:        extra linker flags (-L<dir>, -l<name>); may be nil
 //
 // The ww-side driver shells to the ww-side tools so a `ww_ww build`
 // touches no C-built code at runtime. The C `ww` driver in cmd/ww/
 // still drives the C-built 6c/6a/6l. Test 993 pins the two
 // pipelines to byte-identical output on a corpus.
-fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8) i32 = {
+fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8, lf: *lflags) i32 = {
 	let a: *arena = newarena();
 
 	let c6: *u8 = join_path_lit(self_dir, "6c_ww");
@@ -792,15 +802,45 @@ fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8) i32 = {
 		};
 	};
 
-	// Step 4: 6l -o <out> <stem>.o libwwrt.a
+	// Step 4: 6l -o <out> <stem>.o libwwrt.a [-L<dir>...] [-l<name>...]
 	{
-		let argv: **u8 = os.alloc(48u64): **u8;
+		let nl_dirs: i32 = 0;
+		let nl_libs: i32 = 0;
+		let l_dirs: **u8 = nil;
+		let l_libs: **u8 = nil;
+		if (lf != nil) {
+			nl_dirs = lf.n_libdirs;
+			nl_libs = lf.n_libs;
+			l_dirs  = lf.libdirs;
+			l_libs  = lf.libs;
+		};
+		// argv slots: 5 fixed (6l, -o, out, objf, libwwrt)
+		//           + 2 * n_libdirs (-L, dir)
+		//           + 2 * n_libs    (-l, name)
+		//           + 1 nil terminator.
+		let total: i32 = 5 + 2 * nl_dirs + 2 * nl_libs + 1;
+		let argv: **u8 = os.alloc((total: u64) * 8u64): **u8;
 		argv[0] = "6l\0".ptr;
 		argv[1] = "-o\0".ptr;
 		argv[2] = out;
 		argv[3] = objf;
 		argv[4] = libwwrt;
-		argv[5] = nil;
+		let pos: i32 = 5;
+		let k: i32 = 0;
+		for (k < nl_dirs) {
+			argv[pos] = "-L\0".ptr;
+			argv[pos + 1] = l_dirs[k];
+			pos += 2;
+			k += 1;
+		};
+		k = 0;
+		for (k < nl_libs) {
+			argv[pos] = "-l\0".ptr;
+			argv[pos + 1] = l_libs[k];
+			pos += 2;
+			k += 1;
+		};
+		argv[pos] = nil;
 		if (proc_run(l6, argv) != 0) {
 			os.write(2, "ww: 6l failed\n".ptr, 14u64);
 			return 1;
@@ -859,11 +899,16 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 	let inc_off: u64 = 0u64;
 	cstr_seal(incs, 0u64);
 
+	let max_lflags: i32 = 32;
+	let libdirs: **u8 = os.alloc((max_lflags: u64) * 8u64): **u8;
+	let n_libdirs: i32 = 0;
+	let libs:    **u8 = os.alloc((max_lflags: u64) * 8u64): **u8;
+	let n_libs:   i32 = 0;
+
 	let i: i32 = start;
 	for (i < argc) {
 		let p: *u8 = argv[i];
-		// -I <dir>
+		if (p[0u64] == 45u8) {	// '-'
-		if (p[0u64] == 45u8) {
 			if (p[1u64] == 73u8) {	// '-I'
 				let dir: *u8 = nil;
 				if (p[2u64] != 0u8) {
@@ -882,14 +927,46 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 				};
 				inc_off = cstr_into(incs, inc_off, dir);
 				cstr_seal(incs, inc_off);
+			} else { if (p[1u64] == 76u8) {	// '-L'
+				let dir: *u8 = nil;
+				if (p[2u64] != 0u8) {
+					dir = p + 2u64;
 				} else {
-				// -lLIB silently ignored for now (driver doesn't yet
+					if (i + 1 >= argc) {
-				// pass extra archives to 6l).
+						os.write(2, "ww build: -L needs an argument\n".ptr, 31u64);
-				if (p[1u64] != 108u8) {
-					os.write(2, "ww build: unknown flag\n".ptr, 23u64);
 						return 2;
 					};
+					i += 1;
+					dir = argv[i];
 				};
+				if (n_libdirs >= max_lflags) {
+					os.write(2, "ww build: too many -L\n".ptr, 22u64);
+					return 2;
+				};
+				libdirs[n_libdirs] = dir;
+				n_libdirs += 1;
+			} else { if (p[1u64] == 108u8) {	// '-l'
+				let nm: *u8 = nil;
+				if (p[2u64] != 0u8) {
+					nm = p + 2u64;
+				} else {
+					if (i + 1 >= argc) {
+						os.write(2, "ww build: -l needs an argument\n".ptr, 31u64);
+						return 2;
+					};
+					i += 1;
+					nm = argv[i];
+				};
+				if (n_libs >= max_lflags) {
+					os.write(2, "ww build: too many -l\n".ptr, 22u64);
+					return 2;
+				};
+				libs[n_libs] = nm;
+				n_libs += 1;
+			} else {
+				os.write(2, "ww build: unknown flag\n".ptr, 23u64);
+				return 2;
+			}; }; };
 		} else {
 			if (src == nil) { src = p; };
 		};
@@ -901,7 +978,12 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 		return 2;
 	};
 	let out: *u8 = default_out_path(src);
-	return build_one(self_dir, src, out, incs);
+	let lf: lflags;
+	lf.libdirs = libdirs;
+	lf.n_libdirs = n_libdirs;
+	lf.libs = libs;
+	lf.n_libs = n_libs;
+	return build_one(self_dir, src, out, incs, &lf);
 };
 
 // Format the scratch path /tmp/ww_run_<pid> into buf. Returns NUL-
@@ -941,7 +1023,7 @@ fn do_run(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 	};
 	let tmp: *u8 = os.alloc(PATH_MAX): *u8;
 	make_run_tmp(tmp);
-	if (build_one(self_dir, argv[start], tmp, "\0".ptr) != 0) { return 1; };
+	if (build_one(self_dir, argv[start], tmp, "\0".ptr, nil) != 0) { return 1; };
 	let exec_argv: **u8 = os.alloc(16u64): **u8;
 	exec_argv[0] = tmp;
 	exec_argv[1] = nil;

selfhost/cmd/ww/main.ww

@@ -407,18 +407,28 @@ fn append_lit(stem: *u8, suffix: str) *u8 = {
 	return buf;
 };
 
+// linker flags bundled as a struct so build_one stays at the wwstage
+// 6c's 6-argument calling-convention limit.
+type lflags = struct {
+	libdirs:   **u8,
+	n_libdirs: i32,
+	libs:      **u8,
+	n_libs:    i32,
+};
+
 // build_one — compile `src` into the executable named `out`.
 //   self_dir:  NUL-terminated dir containing this driver and the
 //              wwstage tools (6c_ww/6a_ww/6l_ww)
 //   src:       NUL-terminated path to the .ww file
 //   out:       NUL-terminated desired output path
 //   incs:      NUL-terminated colon-list of -I dirs (may be empty)
+//   lf:        extra linker flags (-L<dir>, -l<name>); may be nil
 //
 // The ww-side driver shells to the ww-side tools so a `ww_ww build`
 // touches no C-built code at runtime. The C `ww` driver in cmd/ww/
 // still drives the C-built 6c/6a/6l. Test 993 pins the two
 // pipelines to byte-identical output on a corpus.
-fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8) i32 = {
+fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8, lf: *lflags) i32 = {
 	let a: *arena = newarena();
 
 	let c6: *u8 = join_path_lit(self_dir, "6c_ww");
@@ -504,15 +514,45 @@ fn build_one(self_dir: *u8, src: *u8, out: *u8, incs: *u8) i32 = {
 		};
 	};
 
-	// Step 4: 6l -o <out> <stem>.o libwwrt.a
+	// Step 4: 6l -o <out> <stem>.o libwwrt.a [-L<dir>...] [-l<name>...]
 	{
-		let argv: **u8 = os.alloc(48u64): **u8;
+		let nl_dirs: i32 = 0;
+		let nl_libs: i32 = 0;
+		let l_dirs: **u8 = nil;
+		let l_libs: **u8 = nil;
+		if (lf != nil) {
+			nl_dirs = lf.n_libdirs;
+			nl_libs = lf.n_libs;
+			l_dirs  = lf.libdirs;
+			l_libs  = lf.libs;
+		};
+		// argv slots: 5 fixed (6l, -o, out, objf, libwwrt)
+		//           + 2 * n_libdirs (-L, dir)
+		//           + 2 * n_libs    (-l, name)
+		//           + 1 nil terminator.
+		let total: i32 = 5 + 2 * nl_dirs + 2 * nl_libs + 1;
+		let argv: **u8 = os.alloc((total: u64) * 8u64): **u8;
 		argv[0] = "6l\0".ptr;
 		argv[1] = "-o\0".ptr;
 		argv[2] = out;
 		argv[3] = objf;
 		argv[4] = libwwrt;
-		argv[5] = nil;
+		let pos: i32 = 5;
+		let k: i32 = 0;
+		for (k < nl_dirs) {
+			argv[pos] = "-L\0".ptr;
+			argv[pos + 1] = l_dirs[k];
+			pos += 2;
+			k += 1;
+		};
+		k = 0;
+		for (k < nl_libs) {
+			argv[pos] = "-l\0".ptr;
+			argv[pos + 1] = l_libs[k];
+			pos += 2;
+			k += 1;
+		};
+		argv[pos] = nil;
 		if (proc_run(l6, argv) != 0) {
 			os.write(2, "ww: 6l failed\n".ptr, 14u64);
 			return 1;
@@ -571,11 +611,16 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 	let inc_off: u64 = 0u64;
 	cstr_seal(incs, 0u64);
 
+	let max_lflags: i32 = 32;
+	let libdirs: **u8 = os.alloc((max_lflags: u64) * 8u64): **u8;
+	let n_libdirs: i32 = 0;
+	let libs:    **u8 = os.alloc((max_lflags: u64) * 8u64): **u8;
+	let n_libs:   i32 = 0;
+
 	let i: i32 = start;
 	for (i < argc) {
 		let p: *u8 = argv[i];
-		// -I <dir>
+		if (p[0u64] == 45u8) {	// '-'
-		if (p[0u64] == 45u8) {
 			if (p[1u64] == 73u8) {	// '-I'
 				let dir: *u8 = nil;
 				if (p[2u64] != 0u8) {
@@ -594,14 +639,46 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 				};
 				inc_off = cstr_into(incs, inc_off, dir);
 				cstr_seal(incs, inc_off);
+			} else { if (p[1u64] == 76u8) {	// '-L'
+				let dir: *u8 = nil;
+				if (p[2u64] != 0u8) {
+					dir = p + 2u64;
 				} else {
-				// -lLIB silently ignored for now (driver doesn't yet
+					if (i + 1 >= argc) {
-				// pass extra archives to 6l).
+						os.write(2, "ww build: -L needs an argument\n".ptr, 31u64);
-				if (p[1u64] != 108u8) {
-					os.write(2, "ww build: unknown flag\n".ptr, 23u64);
 						return 2;
 					};
+					i += 1;
+					dir = argv[i];
 				};
+				if (n_libdirs >= max_lflags) {
+					os.write(2, "ww build: too many -L\n".ptr, 22u64);
+					return 2;
+				};
+				libdirs[n_libdirs] = dir;
+				n_libdirs += 1;
+			} else { if (p[1u64] == 108u8) {	// '-l'
+				let nm: *u8 = nil;
+				if (p[2u64] != 0u8) {
+					nm = p + 2u64;
+				} else {
+					if (i + 1 >= argc) {
+						os.write(2, "ww build: -l needs an argument\n".ptr, 31u64);
+						return 2;
+					};
+					i += 1;
+					nm = argv[i];
+				};
+				if (n_libs >= max_lflags) {
+					os.write(2, "ww build: too many -l\n".ptr, 22u64);
+					return 2;
+				};
+				libs[n_libs] = nm;
+				n_libs += 1;
+			} else {
+				os.write(2, "ww build: unknown flag\n".ptr, 23u64);
+				return 2;
+			}; }; };
 		} else {
 			if (src == nil) { src = p; };
 		};
@@ -613,7 +690,12 @@ fn do_build(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 		return 2;
 	};
 	let out: *u8 = default_out_path(src);
-	return build_one(self_dir, src, out, incs);
+	let lf: lflags;
+	lf.libdirs = libdirs;
+	lf.n_libdirs = n_libdirs;
+	lf.libs = libs;
+	lf.n_libs = n_libs;
+	return build_one(self_dir, src, out, incs, &lf);
 };
 
 // Format the scratch path /tmp/ww_run_<pid> into buf. Returns NUL-
@@ -653,7 +735,7 @@ fn do_run(self_dir: *u8, argv: **u8, argc: i32, start: i32) i32 = {
 	};
 	let tmp: *u8 = os.alloc(PATH_MAX): *u8;
 	make_run_tmp(tmp);
-	if (build_one(self_dir, argv[start], tmp, "\0".ptr) != 0) { return 1; };
+	if (build_one(self_dir, argv[start], tmp, "\0".ptr, nil) != 0) { return 1; };
 	let exec_argv: **u8 = os.alloc(16u64): **u8;
 	exec_argv[0] = tmp;
 	exec_argv[1] = nil;

test/wwc/996_dyn_ww.c

@@ -0,0 +1,122 @@
+/*
+ * 996_dyn_ww — phase-8 marker for ET_DYN linking on the ww side.
+ *
+ * Drives 6l_ww with -L/-l flags over examples/snake/snake.o and diffs
+ * the result against the C-built 6l on the same inputs. A green run
+ * means the ww-side linker emits PT_INTERP/PT_DYNAMIC binaries byte-
+ * for-byte identical to the C linker — i.e. the dynamic linking story
+ * is fully ported and snake no longer depends on Cstage.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return 1;
+}
+
+static const char *
+absbin(void)
+{
+	const char *b = getenv("BIN");
+	if (!b) b = "out/bin";
+	if (b[0] == '/') return b;
+	static char buf[2048];
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return NULL;
+	snprintf(buf, sizeof buf, "%s/%s", cwd, b);
+	return buf;
+}
+
+static int
+slurp(const char *path, char **outbuf, size_t *outlen)
+{
+	FILE *f = fopen(path, "rb");
+	if (!f) return -1;
+	fseek(f, 0, SEEK_END);
+	long n = ftell(f);
+	fseek(f, 0, SEEK_SET);
+	if (n < 0) { fclose(f); return -1; }
+	char *b = malloc((size_t)n + 1);
+	if (!b) { fclose(f); return -1; }
+	if (fread(b, 1, (size_t)n, f) != (size_t)n) { free(b); fclose(f); return -1; }
+	b[n] = '\0';
+	fclose(f);
+	*outbuf = b;
+	*outlen = (size_t)n;
+	return 0;
+}
+
+int
+main(void)
+{
+	const char *bin = absbin();
+	if (!bin) return 1;
+
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+
+	/* Ensure snake.o exists. The example's Makefile produces it via
+	 * the C-side `ww build`. Re-run that so the test is self-contained. */
+	char cmd[4096];
+	snprintf(cmd, sizeof cmd,
+	    "cd %s/examples/snake && %s/ww build snake.ww -L /usr/lib "
+	    "-l ncurses -l c >/dev/null 2>&1",
+	    cwd, bin);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: cannot build snake.o via C driver\n");
+		return 1;
+	}
+
+	char co[64], wo[64];
+	snprintf(co, sizeof co, "/tmp/wwld_%d_c", getpid());
+	snprintf(wo, sizeof wo, "/tmp/wwld_%d_w", getpid());
+
+	/* C-side 6l with the dynamic flags. */
+	snprintf(cmd, sizeof cmd,
+	    "%s/6l -o %s %s/examples/snake/snake.o -L /usr/lib "
+	    "-l ncurses -l c %s/out/lib/libwwrt.a 2>/dev/null",
+	    bin, co, cwd, cwd);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: C 6l errored\n");
+		unlink(co);
+		return 1;
+	}
+
+	/* ww-side 6l with the same flags. */
+	snprintf(cmd, sizeof cmd,
+	    "%s/6l_ww -o %s %s/examples/snake/snake.o -L /usr/lib "
+	    "-l ncurses -l c %s/out/lib/libwwrt.a 2>/dev/null",
+	    bin, wo, cwd, cwd);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: ww 6l errored\n");
+		unlink(co); unlink(wo);
+		return 1;
+	}
+
+	char *bc = NULL, *bw = NULL;
+	size_t nc = 0, nw = 0;
+	int rc = 0;
+	if (slurp(co, &bc, &nc) < 0 || slurp(wo, &bw, &nw) < 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: cannot read outputs\n");
+		rc = 1;
+	} else if (nc != nw || memcmp(bc, bw, nc) != 0) {
+		fprintf(stderr, "6l_ww-dyn FAIL: C %zu vs ww %zu bytes\n",
+		    nc, nw);
+		rc = 1;
+	} else {
+		printf("6l_ww-dyn: byte-identical to C 6l on snake "
+		    "(PT_INTERP + PT_DYNAMIC + .rela.plt + .gnu.version_r, "
+		    "%zu bytes)\n", nc);
+	}
+	free(bc); free(bw);
+	unlink(co); unlink(wo);
+	return rc;
+}