// os — process and filesystem facade. The body of each call lands
// either in libwwrt.a (rt_syscall trampoline) or libc bindings,
// depending on how the program was linked.

@symbol("rt_syscall") fn syscall0(num: i64) i64;
@symbol("rt_syscall") fn syscall1(num: i64, a: i64) i64;
@symbol("rt_syscall") fn syscall2(num: i64, a: i64, b: i64) i64;
@symbol("rt_syscall") fn syscall3(num: i64, a: i64, b: i64, c: i64) i64;
@symbol("rt_syscall") fn syscall4(num: i64, a: i64, b: i64, c: i64, d: i64) i64;

@symbol("rt_alloc") fn alloc(n: u64) *void;
@symbol("rt_free")  fn free(p: *void, n: u64) void;
@symbol("rt_abort") fn abort(msg: str) void;

// Hare-style runtime check. Caller passes a message that's printed
// to stderr before exit(1).
export fn assert(cond: bool, msg: str) void = {
	if (!cond) { abort(msg); };
};

def SYS_READ:   i64 = 0;
def SYS_WRITE:  i64 = 1;
def SYS_OPEN:   i64 = 2;
def SYS_CLOSE:  i64 = 3;
def SYS_LSEEK:  i64 = 8;
def SYS_ACCESS: i64 = 21;
def SYS_DUP2:   i64 = 33;
def SYS_GETPID: i64 = 39;
def SYS_FORK:   i64 = 57;
def SYS_EXECVE: i64 = 59;
def SYS_EXIT:   i64 = 60;
def SYS_WAIT4:  i64 = 61;
def SYS_UNLINK: i64 = 87;

// open(2) flags. Linux values, matching <fcntl.h>.
def O_RDONLY: i32 = 0;
def O_WRONLY: i32 = 1;
def O_RDWR:   i32 = 2;
def O_CREAT:  i32 = 64;		// 0x40
def O_TRUNC:  i32 = 512;	// 0x200

// lseek(2) whence.
def SEEK_SET: i32 = 0;
def SEEK_CUR: i32 = 1;
def SEEK_END: i32 = 2;

export fn exit(code: i32) void = {
	syscall1(SYS_EXIT, code: i64);
};

// Raw, non-fallible primitives. These return Linux's int conventions
// (negative = -errno, non-negative = bytes/fd/etc). Callers wanting a
// Hare-style fallible API use the wrappers below.
export fn write(fd: i32, buf: *u8, n: u64) i64 = {
	return syscall3(SYS_WRITE, fd: i64, buf: i64, n: i64);
};

export fn read(fd: i32, buf: *u8, n: u64) i64 = {
	return syscall3(SYS_READ, fd: i64, buf: i64, n: i64);
};

export fn close(fd: i32) i32 = {
	return syscall1(SYS_CLOSE, fd: i64): i32;
};

// dup2(2): make `newfd` refer to the same description as `oldfd`,
// closing `newfd` first if open. Returns `newfd` on success or a
// negative errno. Used by 6c_ww to redirect stdout into an output
// file without changing the cgen emit path.
export fn dup2(oldfd: i32, newfd: i32) i32 = {
	return syscall2(SYS_DUP2, oldfd: i64, newfd: i64): i32;
};

// Fallible wrappers. The error variant is a plain str (Plan 9 errstr
// model, see lib/errors); the sum type makes success/failure explicit
// without overloading length-zero.
export fn tryread(fd: i32, buf: *u8, n: u64) (i64 | str) = {
	let r: i64 = read(fd, buf, n);
	if (r < 0) { return "read failed"; };
	return r;
};

export fn trywrite(fd: i32, buf: *u8, n: u64) (i64 | str) = {
	let r: i64 = write(fd, buf, n);
	if (r < 0) { return "write failed"; };
	return r;
};

// open — Linux open(2). Path must be NUL-terminated; callers using ww
// `str` must ensure the bytes are followed by a 0 byte (literals are,
// arena-copied paths usually are by construction). Returns -errno on
// failure, fd otherwise. Higher-level callers prefer `tryopen`.
export fn open(path: *u8, flags: i32, mode: i32) i32 = {
	return syscall3(SYS_OPEN, path: i64, flags: i64, mode: i64): i32;
};

export fn tryopen(path: *u8, flags: i32, mode: i32) (i32 | str) = {
	let fd: i32 = open(path, flags, mode);
	if (fd < 0) { return "open failed"; };
	return fd;
};

// lseek — set/inspect the fd's position. Returns the new offset or
// a negative errno. We use this for fstat-free file-size discovery
// (open ⇒ lseek to end ⇒ lseek back).
export fn lseek(fd: i32, off: i64, whence: i32) i64 = {
	return syscall3(SYS_LSEEK, fd: i64, off, whence: i64);
};

// filesize — convenience: returns the byte length of an open fd by
// seeking to the end and back. -1 on error.
export fn filesize(fd: i32) i64 = {
	let end: i64 = lseek(fd, 0i64, SEEK_END);
	if (end < 0) { return -1i64; };
	let r: i64 = lseek(fd, 0i64, SEEK_SET);
	if (r < 0) { return -1i64; };
	return end;
};

// readfull — keep reading until `n` bytes have arrived or the fd
// closes early. Returns bytes read (0..=n) or -1 on read error.
export fn readfull(fd: i32, buf: *u8, n: u64) i64 = {
	let got: u64 = 0u64;
	for (got < n) {
		let r: i64 = read(fd, buf + got, n - got);
		if (r < 0) { return -1i64; };
		if (r == 0) { return got: i64; };	// short read: caller decides
		got += r: u64;
	};
	return got: i64;
};

// writefull — keep writing until `n` bytes have been accepted or the
// fd refuses progress. Returns bytes written or -1.
export fn writefull(fd: i32, buf: *u8, n: u64) i64 = {
	let sent: u64 = 0u64;
	for (sent < n) {
		let r: i64 = write(fd, buf + sent, n - sent);
		if (r < 0) { return -1i64; };
		if (r == 0) { return sent: i64; };
		sent += r: u64;
	};
	return sent: i64;
};

// ---- process and filesystem helpers used by the `ww` driver ----------

// access(2): returns 0 if the file is reachable, negative errno
// otherwise. mode is the bitset described in <unistd.h> (F_OK=0).
export fn access(path: *u8, mode: i32) i32 = {
	return syscall2(SYS_ACCESS, path: i64, mode: i64): i32;
};

// unlink(2).
export fn unlink(path: *u8) i32 = {
	return syscall1(SYS_UNLINK, path: i64): i32;
};

// getpid(2). Used by the driver to mint unique scratch paths.
export fn getpid() i32 = {
	return syscall0(SYS_GETPID): i32;
};

// fork(2): 0 in the child, child pid in the parent, negative errno
// on failure.
export fn fork() i32 = {
	return syscall0(SYS_FORK): i32;
};

// execve(2): on success, does not return.
export fn execve(path: *u8, argv: **u8, envp: **u8) i32 = {
	return syscall3(SYS_EXECVE, path: i64, argv: i64, envp: i64): i32;
};

// wait4(2): wait for `pid` (or any child if -1), store status in
// `*status_out`, return the pid that ended (or negative errno).
export fn wait4(pid: i32, status_out: *i32, options: i32, rusage: *void) i32 = {
	return syscall4(SYS_WAIT4, pid: i64, status_out: i64,
	    options: i64, rusage: i64): i32;
};

// selfhost/cmd/wwc/mem.ww — port of cmd/wwc/mem.c.
//
// Bump arena allocator. Backed by the runtime page allocator
// (rt_alloc / rt_free), no libc. Each chunk is mmap'd; when the
// current chunk runs out we link a fresh one. Freeing the arena
// unmaps the chain.
//
// Memory handed out is 16-byte aligned. The C version under
// cmd/wwc/ is retained until the three-stage bootstrap diffs clean.

use os;

def ALIGN: u64       = 16u64;
def INIT_CHUNK: u64  = 65536u64;
def MAX_CHUNK: u64   = 4194304u64;
def ARENA_SZ: u64    = 48u64;	// sizeof(arena), kept in sync below

type arena = struct {
	buf:   *u8,
	off:   u64,
	cap:   u64,
	next:  *arena,
	total: u64,
};

fn roundup(n: u64, a: u64) u64 = {
	return (n + a - 1u64) & ~(a - 1u64);
};

export fn newarena() *arena = {
	let a: *arena = os.alloc(ARENA_SZ): *arena;
	a.buf = os.alloc(INIT_CHUNK): *u8;
	a.off = 0u64;
	a.cap = INIT_CHUNK;
	a.next = nil;
	a.total = 0u64;
	return a;
};

// Grow: link a fresh chunk in front of the head. We push the old
// chunk into `next` so the head always describes the current bump
// region. Chunk size doubles up to MAX_CHUNK.
fn grow(a: *arena, need: u64) bool = {
	let want: u64 = a.cap * 2u64;
	if (want < need) { want = need; };
	if (want > MAX_CHUNK) { want = MAX_CHUNK; };
	if (want < need) { return false; };	// single allocation too big

	let old: *arena = os.alloc(ARENA_SZ): *arena;
	old.buf = a.buf;
	old.off = a.off;
	old.cap = a.cap;
	old.next = a.next;
	old.total = 0u64;

	a.buf = os.alloc(want): *u8;
	a.off = 0u64;
	a.cap = want;
	a.next = old;
	return true;
};

export fn amalloc(a: *arena, n: u64) *void = {
	let need: u64 = roundup(n, ALIGN);
	if (need > a.cap - a.off) {
		if (!grow(a, need)) { return nil; };
	};
	let p: *u8 = a.buf + a.off;
	a.off += need;
	a.total += need;
	// Zero the region. Plan 9 amalloc zeroes; we mirror that here so
	// the checker can assume freshly allocated nodes start at 0.
	let i: u64 = 0u64;
	for (i < need) {
		p[i] = 0u8;
		i += 1u64;
	};
	return p: *void;
};

// astrndup — copy `n` bytes into the arena and produce a NUL-terminated
// view. Returns a `str` whose ptr is arena-owned and whose len is `n`
// (the trailing NUL is past `len`, so callers reading exactly n bytes
// see no padding). Used by the lexer to capture token text.
export fn astrndup(a: *arena, src: *u8, n: u64) str = {
	let p: *u8 = amalloc(a, n + 1u64): *u8;
	let i: u64 = 0u64;
	for (i < n) {
		p[i] = src[i];
		i += 1u64;
	};
	p[n] = 0u8;
	let r: str;
	r.ptr = p;
	r.len = n: i32;
	return r;
};

export fn freearena(a: *arena) void = {
	for (a != nil) {
		let next: *arena = a.next;
		os.free(a.buf: *void, a.cap);
		os.free(a: *void, ARENA_SZ);
		a = next;
	};
};

// selfhost/cmd/6l/sym.ww — port of cmd/6l/sym.c.
//
// Linker symbol table. Singly-linked list, usually a few hundred
// entries; hashing isn't worth it yet.

use mem;

type lsym = struct {
	name:         str,
	val:          u64,	// offset within combined .text once linked
	defined:      i32,	// 1 if some lobj defines this symbol
	owner:        *lobj,
	idx_in_owner: i32,
	// Dynamic-linking fields. Set by l_resolve when an undefined sym
	// is provided by some loaded lso. plt_idx and dynsym_idx default
	// to -1 (set explicitly by l_resolve, not by amalloc-zeroing).
	is_dyn:       i32,
	dyn_lib:      *lso,
	dyn_version:  str,	// matched export's version; len 0 if none
	plt_idx:      i32,
	dynsym_idx:   i32,
	snext:        *lsym,
};

type lrel = struct {
	off:    u64,	// offset within combined .text
	kind:   i32,	// R_X86_64_*
	sym:    *lsym,
	addend: i64,
	rnext:  *lrel,
};

type lobj = struct {
	path:      str,
	buf:       *u8,	// object bytes
	len:       u64,
	text_off:  u64,	// offset of .text in combined output
	text_size: u64,
	onext:     *lobj,
};

// lexport — one entry per GLOBAL/WEAK symbol exported by a loaded .so.
// Stored as a chain in the order the .so's dynsym presents them, so
// l_so_provides_v's first-match semantics agree with the C version.
type lexport = struct {
	name:    str,
	version: str,	// len 0 for unversioned globals
	enext:   *lexport,
};

type lso = struct {
	path:    str,	// full filesystem path used to load
	soname:  str,	// DT_SONAME, or basename if missing
	exports: *lexport,	// dynsym-order chain of exported names
	sonext:  *lso,
};

type lnk = struct {
	a:       *arena,
	objs:    *lobj,
	sos:     *lso,
	syms:    *lsym,
	rels:    *lrel,
	text:    *u8,	// combined .text
	textcap: u64,
	textlen: u64,
	errs:    i32,
	dyn_n:   i32,	// number of syms routed through PLT
};

fn streq(a: str, b: str) bool = {
	if (a.len != b.len) { return false; };
	let i: i32 = 0;
	for (i < a.len) {
		if (a[i] != b[i]) { return false; };
		i += 1;
	};
	return true;
};

export fn l_intern(l: *lnk, name: str) *lsym = {
	let s: *lsym = l.syms;
	for (s != nil) {
		if (streq(s.name, name)) { return s; };
		s = s.snext;
	};
	let n: *lsym = amalloc(l.a, 96u64): *lsym;
	n.name = name;
	n.snext = l.syms;
	l.syms = n;
	return n;
};

export fn l_lookup(l: *lnk, name: str) *lsym = {
	let s: *lsym = l.syms;
	for (s != nil) {
		if (streq(s.name, name)) { return s; };
		s = s.snext;
	};
	return nil;
};

// selfhost/cmd/6l/obj.ww — port of cmd/6l/obj.c.
//
// Loads relocatable ELF64 .o files emitted by 6a, appends .text to
// the combined image, and pulls in symbols + relocations with
// offsets adjusted to the combined section.
//
// Also handles SysV `ar` archives (libwwrt.a). The two-pass loader
// indexes members on the first pass and iteratively pulls members
// that define currently-undefined symbols on subsequent passes.

use os;
use mem;
use sym;

def ET_REL:        i32 = 1;
def EM_X86_64:     i32 = 62;
def SHT_PROGBITS:  i32 = 1;
def SHT_SYMTAB:    i32 = 2;
def SHT_STRTAB:    i32 = 3;
def SHT_RELA:      i32 = 4;

// ---- little-endian byte readers ----------------------------------------
// 6a/6l use straight LE on amd64. Reading via byte offsets keeps us off
// the cgen's u16 field-load story for now (MOVZBQ exists; MOVZWQ doesn't).

fn rd_u16(p: *u8, off: u64) u16 = {
	let b0: u16 = p[off]: u16;
	let b1: u16 = p[off + 1u64]: u16;
	return b0 | (b1 << 8u16);
};

fn rd_u32(p: *u8, off: u64) u32 = {
	let b0: u32 = p[off]: u32;
	let b1: u32 = p[off + 1u64]: u32;
	let b2: u32 = p[off + 2u64]: u32;
	let b3: u32 = p[off + 3u64]: u32;
	return b0 | (b1 << 8u32) | (b2 << 16u32) | (b3 << 24u32);
};

fn rd_u64(p: *u8, off: u64) u64 = {
	let lo: u64 = rd_u32(p, off): u64;
	let hi: u64 = rd_u32(p, off + 4u64): u64;
	return lo | (hi << 32u64);
};

// ---- ELF64 section header offsets (40 bytes total) --------------------
def SHDR_SIZE:     u64 = 64u64;	// sizeof(Shdr) per ELF64 spec
def SHDR_NAME:     u64 = 0u64;
def SHDR_TYPE:     u64 = 4u64;
def SHDR_OFFSET:   u64 = 24u64;
def SHDR_SIZE_F:   u64 = 32u64;
def SHDR_LINK:     u64 = 40u64;

// ELF64 ehdr field offsets
def EHDR_SIZE:     u64 = 64u64;
def EHDR_TYPE:     u64 = 16u64;
def EHDR_MACHINE:  u64 = 18u64;
def EHDR_SHOFF:    u64 = 40u64;
def EHDR_SHENTSIZE: u64 = 58u64;
def EHDR_SHNUM:    u64 = 60u64;
def EHDR_SHSTRNDX: u64 = 62u64;

// ELF64 sym entry: 24 bytes
def SYM_SIZE:      u64 = 24u64;
def SYM_NAME:      u64 = 0u64;
def SYM_INFO:      u64 = 4u64;
def SYM_SHNDX:     u64 = 6u64;
def SYM_VALUE:     u64 = 8u64;

// ELF64 RELA entry: 24 bytes
def RELA_SIZE:     u64 = 24u64;
def RELA_OFFSET:   u64 = 0u64;
def RELA_INFO:     u64 = 8u64;
def RELA_ADDEND:   u64 = 16u64;

// ---- file slurp --------------------------------------------------------

fn read_all(path_cs: *u8) (*u8, u64) = {
	let fd: i32 = os.open(path_cs, os.O_RDONLY, 0i32);
	if (fd < 0) { return nil, 0u64; };
	let n: i64 = os.filesize(fd);
	if (n < 0i64) { os.close(fd); return nil, 0u64; };
	let buf: *u8 = os.alloc(n: u64): *u8;
	let got: i64 = os.readfull(fd, buf, n: u64);
	os.close(fd);
	if (got != n) { return nil, 0u64; };
	return buf, n: u64;
};

// ---- text buffer growth ------------------------------------------------

fn emit_text(l: *lnk, src: *u8, n: u64) void = {
	if (l.textlen + n > l.textcap) {
		let nc: u64 = l.textcap;
		if (nc == 0u64) { nc = 4096u64; };
		for (nc < l.textlen + n) { nc = nc * 2u64; };
		// Grow by mmap'ing a fresh region and copying. The old buffer
		// is leaked into the page allocator; for a linker run this is
		// trivial waste.
		let nb: *u8 = os.alloc(nc): *u8;
		let i: u64 = 0u64;
		for (i < l.textlen) {
			nb[i] = l.text[i];
			i += 1u64;
		};
		l.text = nb;
		l.textcap = nc;
	};
	let i: u64 = 0u64;
	for (i < n) {
		l.text[l.textlen + i] = src[i];
		i += 1u64;
	};
	l.textlen += n;
};

// ---- C-string helpers --------------------------------------------------

fn cstrlen(p: *u8) u64 = {
	let n: u64 = 0u64;
	for (p[n] != 0u8) { n += 1u64; };
	return n;
};

fn cstr_eq(p: *u8, lit: str) bool = {
	let n: u64 = lit.len: u64;
	let i: u64 = 0u64;
	for (i < n) {
		let li: i32 = i: i32;
		if (p[i] != lit[li]) { return false; };
		i += 1u64;
	};
	if (p[i] != 0u8) { return false; };
	return true;
};

// Build a ww str from a NUL-terminated *u8 (for passing to l_intern).
fn cstr_to_str(a: *arena, p: *u8) str = {
	let n: u64 = cstrlen(p);
	return astrndup(a, p, n);
};

// ---- archive (SysV ar) types and helpers -------------------------------
//
// Each archive member starts with a 60-byte ar_hdr. The fields we care
// about are the first byte (member type) and the size at offset 48 (a
// 10-byte, space-padded decimal). Member bodies are 2-byte aligned.

type defent = struct {
	name:  str,
	dnext: *defent,
};

type armember = struct {
	data:   *u8,		// arena copy of the member's ELF bytes
	size:   u64,
	defs:   *defent,	// linked list of defined globals
	loaded: i32,
	mnext:  *armember,
};

fn is_archive(p: *u8, len: u64) bool = {
	if (len < 8u64) { return false; };
	if (p[0u64] != 33u8)  { return false; };	// '!'
	if (p[1u64] != 60u8)  { return false; };	// '<'
	if (p[2u64] != 97u8)  { return false; };	// 'a'
	if (p[3u64] != 114u8) { return false; };	// 'r'
	if (p[4u64] != 99u8)  { return false; };	// 'c'
	if (p[5u64] != 104u8) { return false; };	// 'h'
	if (p[6u64] != 62u8)  { return false; };	// '>'
	if (p[7u64] != 10u8)  { return false; };	// '\n'
	return true;
};

// ar_field — parse a space-padded decimal integer of width n.
fn ar_field(p: *u8, n: u64) u64 = {
	let v: u64 = 0u64;
	let i: u64 = 0u64;
	for (i < n) {
		let c: u8 = p[i];
		if (c < 48u8) { return v; };	// space, NUL, etc.
		if (c > 57u8) { return v; };
		v = v * 10u64 + ((c - 48u8): u64);
		i += 1u64;
	};
	return v;
};

// elf_globals — return a linked list of names of globally-defined
// (STB_GLOBAL) symbols whose section is `.text`. Names are arena
// copies, so the source ELF buffer can be freed afterward.
fn elf_globals(a: *arena, buf: *u8, len: u64) *defent = {
	if (len < EHDR_SIZE) { return nil; };
	if (buf[0u64] != 127u8) { return nil; };
	if (buf[1u64] != 69u8)  { return nil; };
	if (buf[2u64] != 76u8)  { return nil; };
	if (buf[3u64] != 70u8)  { return nil; };

	let shoff:    u64 = rd_u64(buf, EHDR_SHOFF);
	let shnum:    u32 = rd_u16(buf, EHDR_SHNUM): u32;
	let shstrndx: u32 = rd_u16(buf, EHDR_SHSTRNDX): u32;

	let shstr_sh_off: u64 = rd_u64(buf, shoff + (shstrndx: u64) * SHDR_SIZE + SHDR_OFFSET);
	let shstr: *u8 = buf + shstr_sh_off;

	let idx_text:   i32 = -1;
	let idx_symtab: i32 = -1;
	let i: u32 = 0u32;
	for (i < shnum) {
		let sh_off: u64 = shoff + (i: u64) * SHDR_SIZE;
		let sh_type: u32 = rd_u32(buf, sh_off + SHDR_TYPE);
		let sh_name: u32 = rd_u32(buf, sh_off + SHDR_NAME);
		let nm: *u8 = shstr + (sh_name: u64);
		if (sh_type == SHT_PROGBITS: u32) {
			if (cstr_eq(nm, ".text")) { idx_text = i: i32; };
		};
		if (sh_type == SHT_SYMTAB: u32)  { idx_symtab = i: i32; };
		i += 1u32;
	};
	if (idx_text < 0) { return nil; };
	if (idx_symtab < 0) { return nil; };

	let sym_sh:   u64 = shoff + (idx_symtab: u64) * SHDR_SIZE;
	let sym_off:  u64 = rd_u64(buf, sym_sh + SHDR_OFFSET);
	let sym_size: u64 = rd_u64(buf, sym_sh + SHDR_SIZE_F);
	let sym_link: u32 = rd_u32(buf, sym_sh + SHDR_LINK);
	let nsyms:    u64 = sym_size / SYM_SIZE;

	let str_sh:  u64 = shoff + (sym_link: u64) * SHDR_SIZE;
	let str_off: u64 = rd_u64(buf, str_sh + SHDR_OFFSET);
	let strtab:  *u8 = buf + str_off;

	let head: *defent = nil;
	let si: u64 = 1u64;
	for (si < nsyms) {
		let sym_p: u64 = sym_off + si * SYM_SIZE;
		let st_name:  u32 = rd_u32(buf, sym_p + SYM_NAME);
		let st_info:  u8  = buf[sym_p + SYM_INFO];
		let st_shndx: u16 = rd_u16(buf, sym_p + SYM_SHNDX);
		let bind:     u32 = (st_info: u32) >> 4u32;
		// STB_GLOBAL = 1; defined in .text.
		if (bind == 1u32) {
			if (st_shndx != 0u16) {
				if ((st_shndx: i32) == idx_text) {
					let nm_p: *u8 = strtab + (st_name: u64);
					if (nm_p[0u64] != 0u8) {
						let nm: str = cstr_to_str(a, nm_p);
						let de: *defent = amalloc(a, 32u64): *defent;
						de.name = nm;
						de.dnext = head;
						head = de;
					};
				};
			};
		};
		si += 1u64;
	};
	return head;
};

// member_defines_undef — true if any of m's defined globals matches a
// currently-undefined symbol in the linker's symbol table. Names not
// already interned are uninteresting (the link doesn't need them yet).
fn member_defines_undef(l: *lnk, m: *armember) bool = {
	let de: *defent = m.defs;
	for (de != nil) {
		let s: *lsym = l_lookup(l, de.name);
		if (s != nil) {
			if (s.defined == 0) { return true; };
		};
		de = de.dnext;
	};
	return false;
};

// load_archive — port of cmd/6l/obj.c:load_archive.
//
// Pass 1 indexes every regular member. Pass 2 iteratively pulls in any
// member that supplies a currently-undefined symbol; each pull may
// introduce fresh undefs, so we loop until quiescent.
fn load_archive(l: *lnk, path_cs: *u8, buf: *u8, len: u64) i32 = {
	let head: *armember = nil;
	let tail: *armember = nil;
	let pos:  u64 = 8u64;	// past "!<arch>\n"
	for (pos + 60u64 <= len) {
		let hdr_size: u64 = ar_field(buf + pos + 48u64, 10u64);
		let hdr_end:  u64 = pos + 60u64;
		if (hdr_end + hdr_size > len) { break; };
		let first: u8 = buf[pos];
		// Skip the symbol table ('/'), long-name table ('//'), and
		// any padding entries (NUL or space leading byte).
		if (first != 47u8) { if (first != 0u8) { if (first != 32u8) {
			let m: *armember = amalloc(l.a, 48u64): *armember;
			m.size = hdr_size;
			let mb: *u8 = amalloc(l.a, hdr_size): *u8;
			let i: u64 = 0u64;
			for (i < hdr_size) {
				mb[i] = buf[hdr_end + i];
				i += 1u64;
			};
			m.data = mb;
			m.defs = elf_globals(l.a, mb, hdr_size);
			m.loaded = 0;
			m.mnext = nil;
			if (head == nil) { head = m; }
			else { tail.mnext = m; };
			tail = m;
		}; }; };
		pos = hdr_end + hdr_size;
		if ((hdr_size & 1u64) != 0u64) { pos = pos + 1u64; };
	};

	let changed: i32 = 1;
	for (changed != 0) {
		changed = 0;
		let m: *armember = head;
		for (m != nil) {
			if (m.loaded == 0) {
				if (member_defines_undef(l, m)) {
					if (load_image(l, path_cs, m.data, m.size) == 0) {
						m.loaded = 1;
						changed = 1;
					};
				};
			};
			m = m.mnext;
		};
	};
	return 0;
};

// ---- main loader -------------------------------------------------------

export fn l_load(l: *lnk, path_cs: *u8) i32 = {
	let bufp: *u8;
	let buflen: u64;
	bufp, buflen = read_all(path_cs);
	if (bufp == nil) {
		os.write(2, "6l: cannot read object\n".ptr, 23u64);
		return -1;
	};
	if (is_archive(bufp, buflen)) {
		return load_archive(l, path_cs, bufp, buflen);
	};
	return load_image(l, path_cs, bufp, buflen);
};

fn load_image(l: *lnk, path_cs: *u8, buf: *u8, len: u64) i32 = {
	if (len < EHDR_SIZE) { return -1; };
	// magic: 0x7f, 'E', 'L', 'F'
	if (buf[0u64] != 127u8) { return -1; };
	if (buf[1u64] != 69u8)  { return -1; };
	if (buf[2u64] != 76u8)  { return -1; };
	if (buf[3u64] != 70u8)  { return -1; };
	if (buf[4u64] != 2u8)   { return -1; };	// ELFCLASS64
	if (rd_u16(buf, EHDR_TYPE)    != ET_REL: u16)    { return -1; };
	if (rd_u16(buf, EHDR_MACHINE) != EM_X86_64: u16) { return -1; };

	let shoff:    u64 = rd_u64(buf, EHDR_SHOFF);
	let shnum:    u32 = rd_u16(buf, EHDR_SHNUM): u32;
	let shstrndx: u32 = rd_u16(buf, EHDR_SHSTRNDX): u32;

	let shstr_sh_off: u64 = rd_u64(buf, shoff + (shstrndx: u64) * SHDR_SIZE + SHDR_OFFSET);
	let shstr: *u8 = buf + shstr_sh_off;

	// find .text, .symtab, .rela.text
	let idx_text:   i32 = -1;
	let idx_symtab: i32 = -1;
	let idx_rela:   i32 = -1;
	let i: u32 = 0u32;
	for (i < shnum) {
		let sh_off: u64 = shoff + (i: u64) * SHDR_SIZE;
		let sh_type: u32 = rd_u32(buf, sh_off + SHDR_TYPE);
		let sh_name: u32 = rd_u32(buf, sh_off + SHDR_NAME);
		let nm: *u8 = shstr + (sh_name: u64);
		if (sh_type == SHT_PROGBITS: u32) {
			if (cstr_eq(nm, ".text")) { idx_text = i: i32; };
		};
		if (sh_type == SHT_SYMTAB: u32)  { idx_symtab = i: i32; };
		if (sh_type == SHT_RELA: u32) {
			if (cstr_eq(nm, ".rela.text")) { idx_rela = i: i32; };
		};
		i += 1u32;
	};
	if (idx_text < 0) {
		os.write(2, "6l: missing .text\n".ptr, 18u64);
		return -1;
	};
	if (idx_symtab < 0) {
		os.write(2, "6l: missing .symtab\n".ptr, 20u64);
		return -1;
	};

	let text_sh:   u64 = shoff + (idx_text: u64) * SHDR_SIZE;
	let text_off:  u64 = rd_u64(buf, text_sh + SHDR_OFFSET);
	let text_size: u64 = rd_u64(buf, text_sh + SHDR_SIZE_F);

	let sym_sh:   u64 = shoff + (idx_symtab: u64) * SHDR_SIZE;
	let sym_off:  u64 = rd_u64(buf, sym_sh + SHDR_OFFSET);
	let sym_size: u64 = rd_u64(buf, sym_sh + SHDR_SIZE_F);
	let sym_link: u32 = rd_u32(buf, sym_sh + SHDR_LINK);
	let nsyms:    u64 = sym_size / SYM_SIZE;

	let str_sh:  u64 = shoff + (sym_link: u64) * SHDR_SIZE;
	let str_off: u64 = rd_u64(buf, str_sh + SHDR_OFFSET);
	let strtab:  *u8 = buf + str_off;

	// Track this object.
	let ob: *lobj = amalloc(l.a, 64u64): *lobj;
	ob.path = cstr_to_str(l.a, path_cs);
	ob.buf = buf;
	ob.len = len;
	ob.text_off = l.textlen;
	ob.text_size = text_size;
	ob.onext = l.objs;
	l.objs = ob;

	// Append .text bytes to the combined image.
	emit_text(l, buf + text_off, text_size);

	// Walk symbols. We don't keep a per-object map[] of *lsym. Instead
	// the reloc loop re-walks symtab and re-interns by name. Simpler
	// than dancing around the cgen's u64-shift gaps.
	let si: u64 = 1u64;	// skip index 0 (always undef sentinel)
	for (si < nsyms) {
		let sym_p: u64 = sym_off + si * SYM_SIZE;
		let st_name:  u32 = rd_u32(buf, sym_p + SYM_NAME);
		let st_shndx: u16 = rd_u16(buf, sym_p + SYM_SHNDX);
		let st_value: u64 = rd_u64(buf, sym_p + SYM_VALUE);
		let nm_p: *u8 = strtab + (st_name: u64);
		if (nm_p[0u64] != 0u8) {
			let nm: str = cstr_to_str(l.a, nm_p);
			let gs: *lsym = l_intern(l, nm);
			if (st_shndx != 0u16) {
				if ((st_shndx: i32) == idx_text) {
					if (gs.defined != 0) {
						os.write(2, "6l: duplicate symbol\n".ptr, 21u64);
						l.errs += 1;
					} else {
						gs.defined = 1;
						gs.owner = ob;
						gs.idx_in_owner = si: i32;
						gs.val = ob.text_off + st_value;
					};
				};
			};
		};
		si += 1u64;
	};

	// Per-object relocation collection.
	if (idx_rela >= 0) {
		let rela_sh:   u64 = shoff + (idx_rela: u64) * SHDR_SIZE;
		let rela_off:  u64 = rd_u64(buf, rela_sh + SHDR_OFFSET);
		let rela_size: u64 = rd_u64(buf, rela_sh + SHDR_SIZE_F);
		let nrel:      u64 = rela_size / RELA_SIZE;
		let ri: u64 = 0u64;
		for (ri < nrel) {
			let rp: u64 = rela_off + ri * RELA_SIZE;
			let r_off:    u64 = rd_u64(buf, rp + RELA_OFFSET);
			let r_info:   u64 = rd_u64(buf, rp + RELA_INFO);
			let r_addend: u64 = rd_u64(buf, rp + RELA_ADDEND);
			let r_sym_idx: u32 = (r_info >> 32u64): u32;
			let r_kind:    i32 = ((r_info & 4294967295u64): u32): i32;
			let nr: *lrel = amalloc(l.a, 48u64): *lrel;
			nr.off = ob.text_off + r_off;
			nr.kind = r_kind;
			nr.addend = r_addend: i64;
			// Look up the referenced sym by name (re-walk symtab).
			if ((r_sym_idx: u64) < nsyms) {
				let s_p: u64 = sym_off + (r_sym_idx: u64) * SYM_SIZE;
				let s_name: u32 = rd_u32(buf, s_p + SYM_NAME);
				let s_nm: *u8 = strtab + (s_name: u64);
				if (s_nm[0u64] != 0u8) {
					let nm: str = cstr_to_str(l.a, s_nm);
					nr.sym = l_intern(l, nm);
				};
			};
			nr.rnext = l.rels;
			l.rels = nr;
			ri += 1u64;
		};
	};

	return 0;
};

// selfhost/cmd/6l/dyn.ww — port of cmd/6l/dyn.c.
//
// Load a shared object (ET_DYN) so the linker knows which symbols it
// exports and which DT_NEEDED entry to record. We do not pull bytes
// from the .so; the dynamic loader maps it at runtime.
//
// Each call appends one lso to lnk->sos. l_so_provides_v answers
// "does this .so export the named symbol, and at which version?" —
// l_resolve uses that to promote unresolved references to dynamic.

use os;
use mem;
use sym;

def ET_DYN_SO:     u16 = 3u16;
def EM_X86_64_SO:  u16 = 62u16;

def SHT_DYNAMIC:        u32 = 6u32;
def SHT_DYNSYM:         u32 = 11u32;
// GNU extensions, sh_type values.
def SHT_GNU_VERDEF:     u32 = 1879048189u32;	// 0x6ffffffd
def SHT_GNU_VERNEED:    u32 = 1879048190u32;	// 0x6ffffffe
def SHT_GNU_VERSYM:     u32 = 1879048191u32;	// 0x6fffffff

def DT_NULL_TAG:        i64 = 0i64;
def DT_SONAME_TAG:      i64 = 14i64;

// Versym special values.
def VER_NDX_LOCAL_C:    u16 = 0u16;
def VER_NDX_GLOBAL_C:   u16 = 1u16;
def VERSYM_HIDDEN_C:    u16 = 32768u16;	// 0x8000
def VERSYM_VERSION_C:   u16 = 32767u16;	// 0x7fff

// ELF64 ehdr field offsets (subset)
def EH_SHOFF:      u64 = 40u64;
def EH_ETYPE:      u64 = 16u64;
def EH_EMACHINE:   u64 = 18u64;
def EH_SHENTSIZE:  u64 = 58u64;
def EH_SHNUM:      u64 = 60u64;
def EH_SHSTRNDX:   u64 = 62u64;

// ELF64 Shdr (64 bytes)
def SH_SIZE:       u64 = 64u64;
def SH_TYPE:       u64 = 4u64;
def SH_OFFSET:     u64 = 24u64;
def SH_SIZE_F:     u64 = 32u64;
def SH_LINK:       u64 = 40u64;
def SH_ENTSIZE:    u64 = 56u64;

// ELF64 Sym (24 bytes)
def SY_SIZE:       u64 = 24u64;
def SY_NAME:       u64 = 0u64;
def SY_INFO:       u64 = 4u64;
def SY_SHNDX:      u64 = 6u64;

// ELF64 Dyn (16 bytes)
def DY_SIZE:       u64 = 16u64;
def DY_TAG:        u64 = 0u64;
def DY_VAL:        u64 = 8u64;

// Verdef (20 bytes)
def VD_SIZE:       u64 = 20u64;
def VD_NDX:        u64 = 4u64;
def VD_CNT:        u64 = 6u64;
def VD_AUX:        u64 = 12u64;
def VD_NEXT:       u64 = 16u64;

// Verdaux (8 bytes)
def VA_NAME:       u64 = 0u64;
def VA_NEXT:       u64 = 4u64;

// ---- little-endian byte readers ---------------------------------------

fn d_u16(p: *u8, off: u64) u16 = {
	let b0: u16 = p[off]: u16;
	let b1: u16 = p[off + 1u64]: u16;
	return b0 | (b1 << 8u16);
};

fn d_u32(p: *u8, off: u64) u32 = {
	let b0: u32 = p[off]: u32;
	let b1: u32 = p[off + 1u64]: u32;
	let b2: u32 = p[off + 2u64]: u32;
	let b3: u32 = p[off + 3u64]: u32;
	return b0 | (b1 << 8u32) | (b2 << 16u32) | (b3 << 24u32);
};

fn d_u64(p: *u8, off: u64) u64 = {
	let lo: u64 = d_u32(p, off): u64;
	let hi: u64 = d_u32(p, off + 4u64): u64;
	return lo | (hi << 32u64);
};

fn d_i64(p: *u8, off: u64) i64 = {
	return d_u64(p, off): i64;
};

// ---- C-string helpers --------------------------------------------------

fn d_cstrlen(p: *u8) u64 = {
	let n: u64 = 0u64;
	for (p[n] != 0u8) { n += 1u64; };
	return n;
};

fn d_cstr_to_str(a: *arena, p: *u8) str = {
	let n: u64 = d_cstrlen(p);
	return astrndup(a, p, n);
};

// basename: scan for last '/' and return pointer past it.
fn d_basename(p: *u8) *u8 = {
	let n: u64 = d_cstrlen(p);
	let i: u64 = n;
	for (i > 0u64) {
		i -= 1u64;
		if (p[i] == 47u8) {	// '/'
			return p + i + 1u64;
		};
	};
	return p;
};

// ---- file slurp --------------------------------------------------------

fn read_all_so(path_cs: *u8) (*u8, u64) = {
	let fd: i32 = os.open(path_cs, os.O_RDONLY, 0i32);
	if (fd < 0) { return nil, 0u64; };
	let n: i64 = os.filesize(fd);
	if (n < 0i64) { os.close(fd); return nil, 0u64; };
	let buf: *u8 = os.alloc(n: u64): *u8;
	let got: i64 = os.readfull(fd, buf, n: u64);
	os.close(fd);
	if (got != n) { return nil, 0u64; };
	return buf, n: u64;
};

// ---- verdef helpers ----------------------------------------------------

// vd_name_at — walk verdef records and return the name (as *u8 into
// the .so's verstr buffer) for the entry whose vd_ndx == ndx. The name
// is the first Verdaux's vda_name (subsequent auxes are predecessor
// names). Returns nil if no entry matches.
fn vd_name_at(buf: *u8, verdef_off: u64, verdef_size: u64,
		verstr: *u8, ndx: u16) *u8 = {
	let off: u64 = 0u64;
	for (off < verdef_size) {
		let vd_p: u64 = verdef_off + off;
		let vd_ndx: u16 = d_u16(buf, vd_p + VD_NDX);
		let vd_aux: u32 = d_u32(buf, vd_p + VD_AUX);
		let vd_next: u32 = d_u32(buf, vd_p + VD_NEXT);
		if (vd_ndx == ndx) {
			let aux_p: u64 = vd_p + (vd_aux: u64);
			let vda_name: u32 = d_u32(buf, aux_p + VA_NAME);
			return verstr + (vda_name: u64);
		};
		if (vd_next == 0u32) { return nil; };
		off += vd_next: u64;
	};
	return nil;
};

// ---- entry points ------------------------------------------------------

export fn l_load_so(l: *lnk, path_cs: *u8) i32 = {
	let buf: *u8;
	let blen: u64;
	buf, blen = read_all_so(path_cs);
	if (buf == nil) {
		os.write(2, "6l: cannot read .so\n".ptr, 20u64);
		return -1;
	};
	if (blen < 64u64) {
		os.write(2, "6l: short ELF\n".ptr, 14u64);
		return -1;
	};
	if (buf[0u64] != 127u8) { return so_err("not ELF"); };
	if (buf[1u64] != 69u8)  { return so_err("not ELF"); };
	if (buf[2u64] != 76u8)  { return so_err("not ELF"); };
	if (buf[3u64] != 70u8)  { return so_err("not ELF"); };
	if (buf[4u64] != 2u8)   { return so_err("not ELFCLASS64"); };
	if (d_u16(buf, EH_EMACHINE) != EM_X86_64_SO) {
		return so_err("not amd64");
	};
	if (d_u16(buf, EH_ETYPE) != ET_DYN_SO) {
		return so_err("not ET_DYN");
	};

	let shoff: u64 = d_u64(buf, EH_SHOFF);
	let shnum: u32 = d_u16(buf, EH_SHNUM): u32;
	if (shoff == 0u64) { return so_err("stripped .so unsupported"); };
	if (shnum == 0u32) { return so_err("stripped .so unsupported"); };

	// Locate the four sections we care about.
	let idx_dynsym:  i32 = -1;
	let idx_dynamic: i32 = -1;
	let idx_versym:  i32 = -1;
	let idx_verdef:  i32 = -1;
	let i: u32 = 0u32;
	for (i < shnum) {
		let sh_p: u64 = shoff + (i: u64) * SH_SIZE;
		let sh_type: u32 = d_u32(buf, sh_p + SH_TYPE);
		if (sh_type == SHT_DYNSYM)       { idx_dynsym = i: i32; };
		if (sh_type == SHT_DYNAMIC)      { idx_dynamic = i: i32; };
		if (sh_type == SHT_GNU_VERSYM)   { idx_versym = i: i32; };
		if (sh_type == SHT_GNU_VERDEF)   { idx_verdef = i: i32; };
		i += 1u32;
	};
	if (idx_dynsym < 0) {
		return so_err("no .dynsym");
	};

	let dynsym_sh: u64 = shoff + (idx_dynsym: u64) * SH_SIZE;
	let dynsym_off: u64 = d_u64(buf, dynsym_sh + SH_OFFSET);
	let dynsym_size: u64 = d_u64(buf, dynsym_sh + SH_SIZE_F);
	let dynsym_link: u32 = d_u32(buf, dynsym_sh + SH_LINK);
	let nsyms: u64 = dynsym_size / SY_SIZE;

	let dynstr_sh: u64 = shoff + (dynsym_link: u64) * SH_SIZE;
	let dynstr_off: u64 = d_u64(buf, dynstr_sh + SH_OFFSET);
	let dynstr: *u8 = buf + dynstr_off;

	// SONAME: .dynamic strings live in the section pointed at by its
	// sh_link (almost always .dynstr).
	let soname_cs: *u8 = nil;
	if (idx_dynamic >= 0) {
		let dyn_sh: u64 = shoff + (idx_dynamic: u64) * SH_SIZE;
		let dyn_off: u64 = d_u64(buf, dyn_sh + SH_OFFSET);
		let dyn_size: u64 = d_u64(buf, dyn_sh + SH_SIZE_F);
		let dyn_link: u32 = d_u32(buf, dyn_sh + SH_LINK);
		let dstr_sh: u64 = shoff + (dyn_link: u64) * SH_SIZE;
		let dstr_off: u64 = d_u64(buf, dstr_sh + SH_OFFSET);
		let dstr: *u8 = buf + dstr_off;
		let nd: u64 = dyn_size / DY_SIZE;
		let di: u64 = 0u64;
		for (di < nd) {
			let d_p: u64 = dyn_off + di * DY_SIZE;
			let d_tag: i64 = d_i64(buf, d_p + DY_TAG);
			if (d_tag == DT_NULL_TAG) {
				di = nd;	// break
			} else {
				if (d_tag == DT_SONAME_TAG) {
					let d_val: u64 = d_u64(buf, d_p + DY_VAL);
					soname_cs = dstr + d_val;
					di = nd;	// break
				} else {
					di += 1u64;
				};
			};
		};
	};
	if (soname_cs == nil) {
		soname_cs = d_basename(path_cs);
	};

	// Versym is one u16 per dynsym entry.
	let versym_off: u64 = 0u64;
	let has_versym: i32 = 0;
	if (idx_versym >= 0) {
		let vs_sh: u64 = shoff + (idx_versym: u64) * SH_SIZE;
		versym_off = d_u64(buf, vs_sh + SH_OFFSET);
		has_versym = 1;
	};

	// Verdef section bounds + the .dynstr-like string section it uses.
	let verdef_off: u64 = 0u64;
	let verdef_size: u64 = 0u64;
	let verstr: *u8 = nil;
	if (idx_verdef >= 0) {
		let vd_sh: u64 = shoff + (idx_verdef: u64) * SH_SIZE;
		verdef_off = d_u64(buf, vd_sh + SH_OFFSET);
		verdef_size = d_u64(buf, vd_sh + SH_SIZE_F);
		let vd_link: u32 = d_u32(buf, vd_sh + SH_LINK);
		let vstr_sh: u64 = shoff + (vd_link: u64) * SH_SIZE;
		let vstr_off: u64 = d_u64(buf, vstr_sh + SH_OFFSET);
		verstr = buf + vstr_off;
	};

	// Build the lso. Exports are appended in dynsym order so
	// l_so_provides_v's first-match semantics match the C version.
	let so: *lso = amalloc(l.a, 64u64): *lso;
	so.path = d_cstr_to_str(l.a, path_cs);
	so.soname = d_cstr_to_str(l.a, soname_cs);
	so.exports = nil;
	let tail: *lexport = nil;

	let si: u64 = 1u64;
	for (si < nsyms) {
		let s_p: u64 = dynsym_off + si * SY_SIZE;
		let st_shndx: u16 = d_u16(buf, s_p + SY_SHNDX);
		if (st_shndx == 0u16) { si += 1u64; } else {
			let st_info: u8 = buf[s_p + SY_INFO];
			let bind: u32 = (st_info: u32) >> 4u32;
			if (bind != 1u32) { if (bind != 2u32) {
				// not GLOBAL/WEAK
				si += 1u64;
				continue;
			}; };
			let st_name: u32 = d_u32(buf, s_p + SY_NAME);
			let nm_p: *u8 = dynstr + (st_name: u64);
			if (nm_p[0u64] == 0u8) {
				si += 1u64;
				continue;
			};

			// Determine version. Skip non-default (hidden) and
			// local entries.
			let vername_cs: *u8 = nil;
			let keep: i32 = 1;
			if (has_versym != 0) {
				let v: u16 = d_u16(buf, versym_off + si * 2u64);
				if ((v & VERSYM_HIDDEN_C) != 0u16) {
					keep = 0;	// non-default
				} else {
					let vidx: u16 = v & VERSYM_VERSION_C;
					if (vidx == VER_NDX_LOCAL_C) {
						keep = 0;	// not exported
					} else { if (vidx == VER_NDX_GLOBAL_C) {
						vername_cs = nil;
					} else { if (vidx == 1u16) {
						// glibc's BASE entry: treat as
						// unversioned. (The C version
						// notes that vidx==1 in Verdef
						// maps to the SONAME BASE.)
						vername_cs = nil;
					} else {
						if (verstr != nil) {
							let nm: *u8 = vd_name_at(buf, verdef_off, verdef_size, verstr, vidx);
							vername_cs = nm;
						};
					}; }; };
				};
			};

			if (keep != 0) {
				let e: *lexport = amalloc(l.a, 48u64): *lexport;
				e.name = d_cstr_to_str(l.a, nm_p);
				if (vername_cs == nil) {
					e.version.ptr = nil;
					e.version.len = 0i32;
				} else {
					e.version = d_cstr_to_str(l.a, vername_cs);
				};
				e.enext = nil;
				if (tail == nil) {
					so.exports = e;
				} else {
					tail.enext = e;
				};
				tail = e;
			};
			si += 1u64;
		};
	};

	so.sonext = l.sos;
	l.sos = so;
	return 0;
};

fn so_err(msg: str) i32 = {
	os.write(2, "6l: ".ptr, 4u64);
	os.write(2, msg.ptr, msg.len: u64);
	os.write(2, "\n".ptr, 1u64);
	return -1;
};

// l_so_provides — 1 if so exports name, 0 otherwise.
export fn l_so_provides(so: *lso, name: str) i32 = {
	if (so == nil) { return 0; };
	let e: *lexport = so.exports;
	for (e != nil) {
		if (s_eq(e.name, name)) { return 1; };
		e = e.enext;
	};
	return 0;
};

// l_so_version — the version of so's export named `name`, or an empty
// str (ptr=nil, len=0) if the export is unversioned or not present.
export fn l_so_version(so: *lso, name: str) str = {
	let result: str;
	result.ptr = nil;
	result.len = 0i32;
	if (so == nil) { return result; };
	let e: *lexport = so.exports;
	for (e != nil) {
		if (s_eq(e.name, name)) {
			result.ptr = e.version.ptr;
			result.len = e.version.len;
			return result;
		};
		e = e.enext;
	};
	return result;
};

fn s_eq(a: str, b: str) bool = {
	if (a.len != b.len) { return false; };
	let i: i32 = 0;
	for (i < a.len) {
		if (a[i] != b[i]) { return false; };
		i += 1;
	};
	return true;
};

// selfhost/cmd/6l/pass.ww — port of cmd/6l/pass.c.
//
// Resolution + relocation. l_resolve flags every undefined symbol
// referenced by a relocation, and promotes those provided by some
// loaded .so to "dynamic" with a freshly-assigned PLT slot.
// l_relocate walks the rel list and patches the .text bytes in place
// once the final virtual base is known. Dynamic refs are deferred:
// their site is patched later in dynout, once the PLT vaddr is known.
//
// Supported relocation kinds: PC32 (=2), PLT32 (=4); both are 32-bit
// PC-relative displacements (PLT32 == PC32 for static).

use os;
use sym;
use dyn;

def R_X86_64_PC32:  i32 = 2;
def R_X86_64_PLT32: i32 = 4;

export fn l_resolve(l: *lnk) i32 = {
	// Initialise dynamic-linking sentinels. amalloc zeroes, so
	// is_dyn/dyn_lib start clean — but plt_idx and dynsym_idx
	// must be -1, not 0.
	let si: *lsym = l.syms;
	for (si != nil) {
		si.plt_idx = -1;
		si.dynsym_idx = -1;
		si = si.snext;
	};

	// Promote each undefined sym that some lso exports to dynamic
	// and hand it a PLT slot. Iteration order over the relocation
	// list determines slot numbering and is stable across runs.
	let r: *lrel = l.rels;
	for (r != nil) {
		if (r.sym != nil) {
			if (r.sym.defined == 0) {
				let sym: *lsym = r.sym;
				if (sym.is_dyn == 0) {
					let so: *lso = l.sos;
					for (so != nil) {
						if (l_so_provides(so, sym.name) != 0) {
							sym.is_dyn = 1;
							sym.dyn_lib = so;
							sym.plt_idx = l.dyn_n;
							l.dyn_n += 1;
							so = nil;	// break
						} else {
							so = so.sonext;
						};
					};
				};
			};
		};
		r = r.rnext;
	};

	// What remains undefined truly is undefined.
	let r2: *lrel = l.rels;
	for (r2 != nil) {
		if (r2.sym != nil) {
			if (r2.sym.defined == 0) {
				if (r2.sym.is_dyn == 0) {
					os.write(2, "6l: undefined reference to '".ptr, 28u64);
					let nm: str = r2.sym.name;
					os.write(2, nm.ptr, nm.len: u64);
					os.write(2, "'\n".ptr, 2u64);
					l.errs += 1;
				};
			};
		};
		r2 = r2.rnext;
	};
	return l.errs;
};

fn patch_u32(p: *u8, v: u32) void = {
	p[0] = (v & 255u32): u8;
	p[1] = ((v >> 8u32) & 255u32): u8;
	p[2] = ((v >> 16u32) & 255u32): u8;
	p[3] = ((v >> 24u32) & 255u32): u8;
};

export fn l_relocate(l: *lnk, base: u64) i32 = {
	let r: *lrel = l.rels;
	for (r != nil) {
		if (r.sym != nil) {
			// Dynamic refs are patched later in dynout once the
			// PLT vaddr is known.
			if (r.sym.is_dyn != 0) {
				r = r.rnext;
				continue;
			};
			if (r.sym.defined != 0) {
				let k: i32 = r.kind;
				if (k == R_X86_64_PC32) {
					let site: u64 = base + r.off;
					let target: i64 = (base + r.sym.val): i64;
					let rel: i64 = (target - site: i64) + r.addend;
					patch_u32(l.text + r.off, rel: u32);
				} else { if (k == R_X86_64_PLT32) {
					let site: u64 = base + r.off;
					let target: i64 = (base + r.sym.val): i64;
					let rel: i64 = (target - site: i64) + r.addend;
					patch_u32(l.text + r.off, rel: u32);
				} else {
					os.write(2, "6l: unsupported reloc kind\n".ptr, 27u64);
					l.errs += 1;
				};};
			};
		};
		r = r.rnext;
	};
	return l.errs;
};

// selfhost/cmd/6l/dynout.ww — port of cmd/6l/dynout.c.
//
// Emit a dynamic-linked ELF executable. The shape is the simplest
// valid one: PT_INTERP + PT_DYNAMIC + DT_BIND_NOW so the loader
// resolves every PLT slot at startup (no lazy binding, no PLT0
// trampoline). SysV .hash, not .gnu.hash. Non-PIE, fixed base.
//
// Layout:
//   [0]            Ehdr
//   [64]           Phdrs (PT_LOAD R+X, PT_LOAD R+W, PT_INTERP, PT_DYNAMIC)
//   [interp_off]   "/lib64/ld-linux-x86-64.so.2\0"
//   [dynstr_off]   .dynstr
//   [dynsym_off]   .dynsym
//   [hash_off]     .hash
//   [versym_off]   .gnu.version
//   [verneed_off]  .gnu.version_r
//   [relaplt_off]  .rela.plt
//   [pad to 0x1000]
//   [text_off]     .text
//   [plt_off]      .plt
//   [pad to next page]
//   [gotplt_off]   .got.plt   (writable; mapped by PT_LOAD #2)
//   [dynamic_off]  .dynamic   (writable; covered by PT_DYNAMIC)
//
// cgen workaround notes:
// - Two-level field assignments through pointers (e.g. r.sym.is_dyn = 1)
//   silently fail in the current wwstage cgen. We bind the inner
//   pointer to a local first: `let sym = r.sym; sym.is_dyn = 1;`
// - Tuple returns of (i32, str) drop the str payload. l_so_version
//   returns a plain str instead.
// - `def NAME: str = "...";` produces a bogus str (len ends up adding
//   to an offset accumulator). We use a fn returning the literal.

use os;
use mem;
use sym;

// ELF constants
def ET_EXEC_D:     u16 = 2u16;
def EM_X86_64_D:   u16 = 62u16;
def EV_CURRENT_D:  u32 = 1u32;
def ELFCLASS64_D:  u8  = 2u8;
def ELFDATA2LSB_D: u8  = 1u8;

def PT_LOAD_D:     u32 = 1u32;
def PT_DYNAMIC_D:  u32 = 2u32;
def PT_INTERP_D:   u32 = 3u32;
def PF_X_D:        u32 = 1u32;
def PF_W_D:        u32 = 2u32;
def PF_R_D:        u32 = 4u32;

def DT_NULL:       i64 = 0i64;
def DT_NEEDED:     i64 = 1i64;
def DT_PLTRELSZ:   i64 = 2i64;
def DT_PLTGOT:     i64 = 3i64;
def DT_HASH:       i64 = 4i64;
def DT_STRTAB:     i64 = 5i64;
def DT_SYMTAB:     i64 = 6i64;
def DT_STRSZ:      i64 = 10i64;
def DT_SYMENT:     i64 = 11i64;
def DT_PLTREL:     i64 = 20i64;
def DT_RELA:       i64 = 7i64;
def DT_JMPREL:     i64 = 23i64;
def DT_BIND_NOW:   i64 = 24i64;
def DT_VERSYM:     i64 = 1879048176i64;	// 0x6ffffff0
def DT_VERNEED:    i64 = 1879048190i64;	// 0x6ffffffe
def DT_VERNEEDNUM: i64 = 1879048191i64;	// 0x6fffffff

def VER_NDX_LOCAL_D:  u16 = 0u16;
def VER_NDX_GLOBAL_D: u16 = 1u16;

def R_X86_64_PC32_D:        i32 = 2;
def R_X86_64_PLT32_D:       i32 = 4;
def R_X86_64_JUMP_SLOT_D:   u32 = 7u32;

def STB_GLOBAL_D: u8 = 1u8;
def STT_FUNC_D:   u8 = 2u8;

def PLT_STUB_BYTES_D: u64 = 8u64;
def PAGE: u64 = 4096u64;

// The PT_INTERP literal. Returned via a fn to dodge `def : str = "..."`
// breakage in the current cgen.
fn interp_str_v() str = {
	return "/lib64/ld-linux-x86-64.so.2";
};

// ---- byte writers ------------------------------------------------------

fn d_wr8(buf: *u8, off: u64, v: u8) void = {
	buf[off] = v;
};

fn d_wr16(buf: *u8, off: u64, v: u16) void = {
	buf[off]         = (v & 255u16): u8;
	buf[off + 1u64]  = ((v >> 8u16) & 255u16): u8;
};

fn d_wr32(buf: *u8, off: u64, v: u32) void = {
	buf[off]         = (v & 255u32): u8;
	buf[off + 1u64]  = ((v >> 8u32)  & 255u32): u8;
	buf[off + 2u64]  = ((v >> 16u32) & 255u32): u8;
	buf[off + 3u64]  = ((v >> 24u32) & 255u32): u8;
};

fn d_wr64(buf: *u8, off: u64, v: u64) void = {
	d_wr32(buf, off,        (v & 4294967295u64): u32);
	d_wr32(buf, off + 4u64, ((v >> 32u64) & 4294967295u64): u32);
};

fn d_wri64(buf: *u8, off: u64, v: i64) void = {
	d_wr64(buf, off, v: u64);
};

fn d_wri32(buf: *u8, off: u64, v: i32) void = {
	d_wr32(buf, off, v: u32);
};

// ---- byte readers ------------------------------------------------------

fn d_rd_u16(p: *u8, off: u64) u16 = {
	let b0: u16 = p[off]: u16;
	let b1: u16 = p[off + 1u64]: u16;
	return b0 | (b1 << 8u16);
};

fn d_rd_u32(p: *u8, off: u64) u32 = {
	let b0: u32 = p[off]: u32;
	let b1: u32 = p[off + 1u64]: u32;
	let b2: u32 = p[off + 2u64]: u32;
	let b3: u32 = p[off + 3u64]: u32;
	return b0 | (b1 << 8u32) | (b2 << 16u32) | (b3 << 24u32);
};

fn d_rd_i32(p: *u8, off: u64) i32 = {
	return d_rd_u32(p, off): i32;
};

fn d_bcopy(dst: *u8, off: u64, src: *u8, n: u64) void = {
	let i: u64 = 0u64;
	for (i < n) {
		dst[off + i] = src[i];
		i += 1u64;
	};
};

// elf_hash — SysV ELF hash. Used for .gnu.version_r's vna_hash.
fn elf_hash(name: str) u32 = {
	let h: u32 = 0u32;
	let i: i32 = 0;
	for (i < name.len) {
		let c: u32 = (name[i]: u8): u32;
		h = (h << 4u32) + c;
		let g: u32 = h & 4026531840u32;	// 0xf0000000
		if (g != 0u32) { h = h ^ (g >> 24u32); };
		h = h & ~g;
		i += 1;
	};
	return h;
};

fn align_up(off: u64, a: u64) u64 = {
	return (off + a - 1u64) & ~(a - 1u64);
};

fn str_eq_d(a: str, b: str) bool = {
	if (a.len != b.len) { return false; };
	let i: i32 = 0;
	for (i < a.len) {
		if (a[i] != b[i]) { return false; };
		i += 1;
	};
	return true;
};

// ---- main entry --------------------------------------------------------

export fn l_emit_dyn_elf(l: *lnk, fd: i32, base: u64, entry: u64) i32 = {
	let a: *arena = l.a;
	let n: i32 = l.dyn_n;
	let nu: u64 = n: u64;

	// ---- collect dyn syms into a plt_idx-indexed array ----
	let dynsyms: **lsym = amalloc(a, nu * 8u64): **lsym;
	let s: *lsym = l.syms;
	for (s != nil) {
		if (s.is_dyn != 0) {
			if (s.plt_idx >= 0) {
				if (s.plt_idx < n) {
					dynsyms[s.plt_idx] = s;
				};
			};
		};
		s = s.snext;
	};
	let i: i32 = 0;
	for (i < n) {
		if (dynsyms[i] == nil) {
			os.write(2, "6l: dynout: no sym for plt_idx\n".ptr, 31u64);
			return 1;
		};
		i += 1;
	};

	// ---- collect used .so's (in l.sos order) ----
	let max_sos: i32 = 0;
	let so: *lso = l.sos;
	for (so != nil) { max_sos += 1; so = so.sonext; };
	let sos_used: **lso = amalloc(a, (max_sos: u64) * 8u64): **lso;
	let nsos: i32 = 0;
	so = l.sos;
	for (so != nil) {
		let used: i32 = 0;
		let j: i32 = 0;
		for (j < n) {
			let dsm: *lsym = dynsyms[j];
			let dl: *lso = dsm.dyn_lib;
			if (dl == so) { used = 1; j = n; }
			else { j += 1; };
		};
		if (used != 0) {
			sos_used[nsos] = so;
			nsos += 1;
		};
		so = so.sonext;
	};

	// ---- build flat version table grouped by vlib ----
	// vlib_sos_idx[k] = sos_used index for vlib k.
	// vlib_first[k]   = ver index of first version under vlib k.
	// vlib_count[k]   = number of versions under vlib k.
	// ver_lib_idx[v]  = vlib index that version v belongs to.
	// ver_name_ptr_arr[v] = name's *u8 (interned in the .so's verdef strings).
	// ver_name_len_buf[v] = name length (i32).
	// ver_dynstr_off[v]   = offset within .dynstr (assigned after layout).
	// ver_vna_other[v]    = versym index (starting at 2).

	let vlib_sos_idx_buf: *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
	let vlib_first_buf:   *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
	let vlib_count_buf:   *u8 = amalloc(a, (max_sos: u64) * 4u64): *u8;
	let n_vlibs: i32 = 0;

	let ver_lib_idx_buf:  *u8 = amalloc(a, nu * 4u64): *u8;
	let ver_name_ptr_arr: **u8 = amalloc(a, nu * 8u64): **u8;
	let ver_name_len_buf: *u8 = amalloc(a, nu * 4u64): *u8;
	let ver_dynstr_off:   *u8 = amalloc(a, nu * 4u64): *u8;
	let ver_vna_other:    *u8 = amalloc(a, nu * 2u64): *u8;
	let n_vers: i32 = 0;

	let si: i32 = 0;
	for (si < nsos) {
		let cur_so: *lso = sos_used[si];
		let has: i32 = 0;
		let j: i32 = 0;
		for (j < n) {
			let dsm: *lsym = dynsyms[j];
			let dl: *lso = dsm.dyn_lib;
			if (dl == cur_so) {
				let nm0: str = dsm.name;
				let dv: str = l_so_version(cur_so, nm0);
				if (dv.len > 0) {
					has = 1; j = n;
				} else { j += 1; };
			} else { j += 1; };
		};
		if (has != 0) {
			d_wr32(vlib_sos_idx_buf, (n_vlibs: u64) * 4u64, si: u32);
			d_wr32(vlib_first_buf,   (n_vlibs: u64) * 4u64, n_vers: u32);
			let added: i32 = 0;
			let jj: i32 = 0;
			for (jj < n) {
				let dsm2: *lsym = dynsyms[jj];
				let dl2: *lso = dsm2.dyn_lib;
				if (dl2 == cur_so) {
					let nm2: str = dsm2.name;
					let vname: str = l_so_version(cur_so, nm2);
					if (vname.len > 0) {
						let seen: i32 = 0;
						let k: i32 = 0;
						for (k < added) {
							let kk: i32 = n_vers - added + k;
							let existing: str;
							existing.ptr = ver_name_ptr_arr[kk];
							existing.len = d_rd_i32(ver_name_len_buf, (kk: u64) * 4u64);
							if (str_eq_d(existing, vname)) {
								seen = 1; k = added;
							} else { k += 1; };
						};
						if (seen == 0) {
							d_wr32(ver_lib_idx_buf, (n_vers: u64) * 4u64, n_vlibs: u32);
							ver_name_ptr_arr[n_vers] = vname.ptr;
							d_wri32(ver_name_len_buf, (n_vers: u64) * 4u64, vname.len);
							n_vers += 1;
							added += 1;
						};
					};
				};
				jj += 1;
			};
			d_wr32(vlib_count_buf, (n_vlibs: u64) * 4u64, added: u32);
			n_vlibs += 1;
		};
		si += 1;
	};

	// Assign vna_other indices starting at 2, walking vlib then per-version.
	let next_vna: u16 = 2u16;
	let vi: i32 = 0;
	for (vi < n_vlibs) {
		let first: i32 = d_rd_i32(vlib_first_buf, (vi: u64) * 4u64);
		let cnt:   i32 = d_rd_i32(vlib_count_buf, (vi: u64) * 4u64);
		let k: i32 = 0;
		for (k < cnt) {
			d_wr16(ver_vna_other, ((first + k): u64) * 2u64, next_vna);
			next_vna += 1u16;
			k += 1;
		};
		vi += 1;
	};

	// ---- compute dynstr size ----
	let dynstr_sz: u64 = 1u64;	// leading NUL
	let pi: i32 = 0;
	for (pi < nsos) {
		let so4: *lso = sos_used[pi];
		dynstr_sz += so4.soname.len: u64;
		dynstr_sz += 1u64;
		pi += 1;
	};
	pi = 0;
	for (pi < n) {
		let dsm4: *lsym = dynsyms[pi];
		dynstr_sz += dsm4.name.len: u64;
		dynstr_sz += 1u64;
		pi += 1;
	};
	pi = 0;
	for (pi < n_vers) {
		let nm_len: i32 = d_rd_i32(ver_name_len_buf, (pi: u64) * 4u64);
		dynstr_sz += nm_len: u64;
		dynstr_sz += 1u64;
		pi += 1;
	};

	// ---- fill dynstr ----
	let dynstr: *u8 = amalloc(a, dynstr_sz): *u8;
	let dynstr_pos: u64 = 1u64;	// past leading NUL

	let soname_str: *u8 = amalloc(a, (nsos: u64) * 4u64): *u8;
	pi = 0;
	for (pi < nsos) {
		d_wr32(soname_str, (pi: u64) * 4u64, dynstr_pos: u32);
		let so2: *lso = sos_used[pi];
		let snm: str = so2.soname;
		d_bcopy(dynstr, dynstr_pos, snm.ptr, snm.len: u64);
		dynstr_pos += snm.len: u64;
		dynstr[dynstr_pos] = 0u8;
		dynstr_pos += 1u64;
		pi += 1;
	};
	let symname_str: *u8 = amalloc(a, nu * 4u64): *u8;
	pi = 0;
	for (pi < n) {
		d_wr32(symname_str, (pi: u64) * 4u64, dynstr_pos: u32);
		let dsm: *lsym = dynsyms[pi];
		let snm: str = dsm.name;
		d_bcopy(dynstr, dynstr_pos, snm.ptr, snm.len: u64);
		dynstr_pos += snm.len: u64;
		dynstr[dynstr_pos] = 0u8;
		dynstr_pos += 1u64;
		pi += 1;
	};
	pi = 0;
	for (pi < n_vers) {
		d_wr32(ver_dynstr_off, (pi: u64) * 4u64, dynstr_pos: u32);
		let nm_p: *u8 = ver_name_ptr_arr[pi];
		let nm_len: i32 = d_rd_i32(ver_name_len_buf, (pi: u64) * 4u64);
		d_bcopy(dynstr, dynstr_pos, nm_p, nm_len: u64);
		dynstr_pos += nm_len: u64;
		dynstr[dynstr_pos] = 0u8;
		dynstr_pos += 1u64;
		pi += 1;
	};

	// ---- per-dyn-sym versym index ----
	let versym_for: *u8 = amalloc(a, nu * 2u64): *u8;
	pi = 0;
	for (pi < n) {
		let dsm3: *lsym = dynsyms[pi];
		let dl3: *lso = dsm3.dyn_lib;
		let nm3: str = dsm3.name;
		let vname: str = l_so_version(dl3, nm3);
		if (vname.len == 0) {
			d_wr16(versym_for, (pi: u64) * 2u64, VER_NDX_GLOBAL_D);
		} else {
			let matched: i32 = 0;
			let vk: i32 = 0;
			for (vk < n_vers) {
				let vlx:  i32 = d_rd_i32(ver_lib_idx_buf, (vk: u64) * 4u64);
				let sosx: i32 = d_rd_i32(vlib_sos_idx_buf, (vlx: u64) * 4u64);
				if (sos_used[sosx] == dl3) {
					let exi: str;
					exi.ptr = ver_name_ptr_arr[vk];
					exi.len = d_rd_i32(ver_name_len_buf, (vk: u64) * 4u64);
					if (str_eq_d(exi, vname)) {
						let other: u16 = d_rd_u16(ver_vna_other, (vk: u64) * 2u64);
						d_wr16(versym_for, (pi: u64) * 2u64, other);
						matched = 1;
						vk = n_vers;
					} else { vk += 1; };
				} else { vk += 1; };
			};
			if (matched == 0) {
				d_wr16(versym_for, (pi: u64) * 2u64, VER_NDX_GLOBAL_D);
			};
		};
		pi += 1;
	};

	// ---- compute byte sizes ----
	let ehdr_sz: u64 = 64u64;
	let n_phdrs: u64 = 4u64;
	let phdr_sz: u64 = n_phdrs * 56u64;
	let is_local: str = interp_str_v();
	let interp_sz: u64 = (is_local.len: u64) + 1u64;

	let nsyms_total: u64 = 1u64 + nu;
	let dynsym_sz: u64 = nsyms_total * 24u64;

	let nbuckets: u32 = 1u32;
	let nchain: u32 = nsyms_total: u32;
	let hash_sz: u64 = (2u64 + (nbuckets: u64) + (nchain: u64)) * 4u64;

	let relaplt_sz: u64 = nu * 24u64;
	let plt_sz: u64 = nu * PLT_STUB_BYTES_D;
	let gotplt_sz: u64 = (3u64 + nu) * 8u64;
	let versym_sz: u64 = nsyms_total * 2u64;

	let verneed_sz: u64 = 0u64;
	let vli: i32 = 0;
	for (vli < n_vlibs) {
		let cnt: i32 = d_rd_i32(vlib_count_buf, (vli: u64) * 4u64);
		verneed_sz += 16u64 + 16u64 * (cnt: u64);
		vli += 1;
	};

	let with_ver: i32 = 0;
	if (n_vlibs > 0) { with_ver = 1; };
	let extra: u64 = 0u64;
	if (with_ver != 0) { extra = 3u64; };
	let ndyn: u64 = (nsos: u64) + 11u64 + extra;
	let dynamic_sz: u64 = ndyn * 16u64;

	// ---- compute file offsets ----
	let off: u64 = ehdr_sz + phdr_sz;
	let interp_off: u64 = off;       off += interp_sz;
	off = align_up(off, 8u64);
	let dynstr_off: u64 = off;       off += dynstr_sz;
	off = align_up(off, 8u64);
	let dynsym_off: u64 = off;       off += dynsym_sz;
	let hash_off: u64 = off;         off += hash_sz;
	off = align_up(off, 2u64);
	let versym_off: u64 = off;       off += versym_sz;
	off = align_up(off, 4u64);
	let verneed_off: u64 = off;      off += verneed_sz;
	off = align_up(off, 8u64);
	let relaplt_off: u64 = off;      off += relaplt_sz;

	let text_off: u64 = align_up(off, PAGE);
	let plt_off: u64 = text_off + l.textlen;
	let rx_end: u64 = plt_off + plt_sz;

	let gotplt_off: u64 = align_up(rx_end, PAGE);
	let dynamic_off: u64 = gotplt_off + gotplt_sz;
	let file_end: u64 = dynamic_off + dynamic_sz;

	let interp_va: u64 = base + interp_off;
	let dynstr_va: u64 = base + dynstr_off;
	let dynsym_va: u64 = base + dynsym_off;
	let hash_va: u64 = base + hash_off;
	let versym_va: u64 = base + versym_off;
	let verneed_va: u64 = base + verneed_off;
	let relaplt_va: u64 = base + relaplt_off;
	let text_va: u64 = base + text_off;
	let plt_va: u64 = base + plt_off;
	let gotplt_va: u64 = base + gotplt_off;
	let dynamic_va: u64 = base + dynamic_off;

	// ---- build .dynsym ----
	let dynsym_buf: *u8 = amalloc(a, dynsym_sz): *u8;
	pi = 0;
	for (pi < n) {
		let eoff: u64 = (1u64 + (pi: u64)) * 24u64;
		d_wr32(dynsym_buf, eoff + 0u64, d_rd_u32(symname_str, (pi: u64) * 4u64));
		d_wr8(dynsym_buf, eoff + 4u64, (STB_GLOBAL_D << 4u8) | (STT_FUNC_D & 15u8));
		d_wr8(dynsym_buf, eoff + 5u64, 0u8);
		d_wr16(dynsym_buf, eoff + 6u64, 0u16);
		d_wr64(dynsym_buf, eoff + 8u64, 0u64);
		d_wr64(dynsym_buf, eoff + 16u64, 0u64);
		pi += 1;
	};

	// ---- build .hash (SysV, 1 bucket) ----
	let hash_buf: *u8 = amalloc(a, hash_sz): *u8;
	d_wr32(hash_buf, 0u64, nbuckets);
	d_wr32(hash_buf, 4u64, nchain);
	let bucket0: u32 = 0u32;
	if (nsyms_total > 1u64) { bucket0 = 1u32; };
	d_wr32(hash_buf, 8u64, bucket0);
	let ci: u64 = 1u64;
	for (ci < nsyms_total) {
		let nxt: u32 = 0u32;
		if (ci + 1u64 < nsyms_total) { nxt = (ci + 1u64): u32; };
		d_wr32(hash_buf, 8u64 + (nbuckets: u64) * 4u64 + ci * 4u64, nxt);
		ci += 1u64;
	};

	// ---- build .rela.plt ----
	let relaplt_buf: *u8 = amalloc(a, relaplt_sz): *u8;
	pi = 0;
	for (pi < n) {
		let roff: u64 = (pi: u64) * 24u64;
		d_wr64(relaplt_buf, roff + 0u64, gotplt_va + (3u64 + (pi: u64)) * 8u64);
		let info: u64 = ((1u64 + (pi: u64)) << 32u64) | (R_X86_64_JUMP_SLOT_D: u64);
		d_wr64(relaplt_buf, roff + 8u64, info);
		d_wri64(relaplt_buf, roff + 16u64, 0i64);
		pi += 1;
	};

	// ---- build .gnu.version (u16 per dynsym entry) ----
	let versym_buf: *u8 = amalloc(a, versym_sz): *u8;
	d_wr16(versym_buf, 0u64, VER_NDX_LOCAL_D);
	pi = 0;
	for (pi < n) {
		d_wr16(versym_buf, 2u64 + (pi: u64) * 2u64, d_rd_u16(versym_for, (pi: u64) * 2u64));
		pi += 1;
	};

	// ---- build .gnu.version_r ----
	let verneed_buf: *u8 = amalloc(a, verneed_sz): *u8;
	if (verneed_sz > 0u64) {
		let vnoff: u64 = 0u64;
		vli = 0;
		for (vli < n_vlibs) {
			let sos_idx: i32 = d_rd_i32(vlib_sos_idx_buf, (vli: u64) * 4u64);
			let first:   i32 = d_rd_i32(vlib_first_buf,   (vli: u64) * 4u64);
			let cnt:     i32 = d_rd_i32(vlib_count_buf,   (vli: u64) * 4u64);
			let vn_start: u64 = vnoff;
			d_wr16(verneed_buf, vnoff + 0u64, 1u16);
			d_wr16(verneed_buf, vnoff + 2u64, cnt: u16);
			d_wr32(verneed_buf, vnoff + 4u64, d_rd_u32(soname_str, (sos_idx: u64) * 4u64));
			d_wr32(verneed_buf, vnoff + 8u64, 16u32);
			vnoff += 16u64;
			let k: i32 = 0;
			for (k < cnt) {
				let vk: i32 = first + k;
				let nm: str;
				nm.ptr = ver_name_ptr_arr[vk];
				nm.len = d_rd_i32(ver_name_len_buf, (vk: u64) * 4u64);
				let h: u32 = elf_hash(nm);
				d_wr32(verneed_buf, vnoff + 0u64, h);
				d_wr16(verneed_buf, vnoff + 4u64, 0u16);
				d_wr16(verneed_buf, vnoff + 6u64, d_rd_u16(ver_vna_other, (vk: u64) * 2u64));
				d_wr32(verneed_buf, vnoff + 8u64, d_rd_u32(ver_dynstr_off, (vk: u64) * 4u64));
				let nxt: u32 = 0u32;
				if (k + 1 < cnt) { nxt = 16u32; };
				d_wr32(verneed_buf, vnoff + 12u64, nxt);
				vnoff += 16u64;
				k += 1;
			};
			let vn_nxt: u32 = 0u32;
			if (vli + 1 < n_vlibs) { vn_nxt = (vnoff - vn_start): u32; };
			d_wr32(verneed_buf, vn_start + 12u64, vn_nxt);
			vli += 1;
		};
	};

	// ---- build .plt ----
	let plt_buf: *u8 = amalloc(a, plt_sz): *u8;
	pi = 0;
	for (pi < n) {
		let p_off: u64 = (pi: u64) * PLT_STUB_BYTES_D;
		let stub_va: u64 = plt_va + p_off;
		let next_ip: u64 = stub_va + 6u64;
		let slot_va: u64 = gotplt_va + (3u64 + (pi: u64)) * 8u64;
		let disp: i64 = (slot_va: i64) - (next_ip: i64);
		d_wr8(plt_buf, p_off + 0u64, 255u8);
		d_wr8(plt_buf, p_off + 1u64, 37u8);
		d_wr32(plt_buf, p_off + 2u64, (disp: i32): u32);
		pi += 1;
	};

	// ---- build .got.plt ----
	let gotplt_buf: *u8 = amalloc(a, gotplt_sz): *u8;
	d_wr64(gotplt_buf, 0u64, dynamic_va);

	// ---- build .dynamic ----
	let dynamic_buf: *u8 = amalloc(a, dynamic_sz): *u8;
	let dk: u64 = 0u64;
	pi = 0;
	for (pi < nsos) {
		d_wri64(dynamic_buf, dk * 16u64 + 0u64, DT_NEEDED);
		d_wr64(dynamic_buf, dk * 16u64 + 8u64, d_rd_u32(soname_str, (pi: u64) * 4u64): u64);
		dk += 1u64;
		pi += 1;
	};
	d_wri64(dynamic_buf, dk * 16u64, DT_HASH);     d_wr64(dynamic_buf, dk * 16u64 + 8u64, hash_va);     dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_STRTAB);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynstr_va);   dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_SYMTAB);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynsym_va);   dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_STRSZ);    d_wr64(dynamic_buf, dk * 16u64 + 8u64, dynstr_sz);   dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_SYMENT);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, 24u64);       dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_PLTGOT);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, gotplt_va);   dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_PLTRELSZ); d_wr64(dynamic_buf, dk * 16u64 + 8u64, relaplt_sz);  dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_PLTREL);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, DT_RELA: u64);dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_JMPREL);   d_wr64(dynamic_buf, dk * 16u64 + 8u64, relaplt_va);  dk += 1u64;
	d_wri64(dynamic_buf, dk * 16u64, DT_BIND_NOW); d_wr64(dynamic_buf, dk * 16u64 + 8u64, 0u64);        dk += 1u64;
	if (with_ver != 0) {
		d_wri64(dynamic_buf, dk * 16u64, DT_VERSYM);     d_wr64(dynamic_buf, dk * 16u64 + 8u64, versym_va);   dk += 1u64;
		d_wri64(dynamic_buf, dk * 16u64, DT_VERNEED);    d_wr64(dynamic_buf, dk * 16u64 + 8u64, verneed_va);  dk += 1u64;
		d_wri64(dynamic_buf, dk * 16u64, DT_VERNEEDNUM); d_wr64(dynamic_buf, dk * 16u64 + 8u64, n_vlibs: u64);dk += 1u64;
	};
	d_wri64(dynamic_buf, dk * 16u64, DT_NULL); d_wr64(dynamic_buf, dk * 16u64 + 8u64, 0u64); dk += 1u64;
	if (dk != ndyn) {
		os.write(2, "6l: dynamic entry count mismatch\n".ptr, 33u64);
		return 1;
	};

	// ---- patch .text relocs targeting dynamic syms ----
	let r: *lrel = l.rels;
	for (r != nil) {
		if (r.sym != nil) {
			let rsym: *lsym = r.sym;
			if (rsym.is_dyn != 0) {
				if (r.kind != R_X86_64_PC32_D) {
					if (r.kind != R_X86_64_PLT32_D) {
						os.write(2, "6l: dynamic reloc kind unsupported\n".ptr, 35u64);
						return 1;
					};
				};
				let site: u64 = text_va + r.off;
				let stub: u64 = plt_va + (rsym.plt_idx: u64) * PLT_STUB_BYTES_D;
				let disp: i64 = (stub: i64) - (site: i64) + r.addend;
				d_wr32(l.text, r.off, (disp: i32): u32);
			};
		};
		r = r.rnext;
	};

	// ---- assemble file buffer ----
	let file_buf: *u8 = os.alloc(file_end): *u8;
	if (file_buf == nil) {
		os.write(2, "6l: out of memory\n".ptr, 18u64);
		return 1;
	};

	// Ehdr
	d_wr8(file_buf, 0u64, 127u8);
	d_wr8(file_buf, 1u64, 69u8);
	d_wr8(file_buf, 2u64, 76u8);
	d_wr8(file_buf, 3u64, 70u8);
	d_wr8(file_buf, 4u64, ELFCLASS64_D);
	d_wr8(file_buf, 5u64, ELFDATA2LSB_D);
	d_wr8(file_buf, 6u64, EV_CURRENT_D: u8);
	d_wr16(file_buf, 16u64, ET_EXEC_D);
	d_wr16(file_buf, 18u64, EM_X86_64_D);
	d_wr32(file_buf, 20u64, EV_CURRENT_D);
	d_wr64(file_buf, 24u64, entry);
	d_wr64(file_buf, 32u64, ehdr_sz);
	d_wr64(file_buf, 40u64, 0u64);
	d_wr32(file_buf, 48u64, 0u32);
	d_wr16(file_buf, 52u64, ehdr_sz: u16);
	d_wr16(file_buf, 54u64, 56u16);
	d_wr16(file_buf, 56u64, n_phdrs: u16);
	d_wr16(file_buf, 58u64, 0u16);
	d_wr16(file_buf, 60u64, 0u16);
	d_wr16(file_buf, 62u64, 0u16);

	// Phdrs at offset 64.
	let p0: u64 = 64u64;
	d_wr32(file_buf, p0 + 0u64,  PT_LOAD_D);
	d_wr32(file_buf, p0 + 4u64,  PF_R_D | PF_X_D);
	d_wr64(file_buf, p0 + 8u64,  0u64);
	d_wr64(file_buf, p0 + 16u64, base);
	d_wr64(file_buf, p0 + 24u64, base);
	d_wr64(file_buf, p0 + 32u64, rx_end);
	d_wr64(file_buf, p0 + 40u64, rx_end);
	d_wr64(file_buf, p0 + 48u64, PAGE);

	let p1: u64 = 64u64 + 56u64;
	d_wr32(file_buf, p1 + 0u64,  PT_LOAD_D);
	d_wr32(file_buf, p1 + 4u64,  PF_R_D | PF_W_D);
	d_wr64(file_buf, p1 + 8u64,  gotplt_off);
	d_wr64(file_buf, p1 + 16u64, gotplt_va);
	d_wr64(file_buf, p1 + 24u64, gotplt_va);
	d_wr64(file_buf, p1 + 32u64, file_end - gotplt_off);
	d_wr64(file_buf, p1 + 40u64, file_end - gotplt_off);
	d_wr64(file_buf, p1 + 48u64, PAGE);

	let p2: u64 = 64u64 + 112u64;
	d_wr32(file_buf, p2 + 0u64,  PT_INTERP_D);
	d_wr32(file_buf, p2 + 4u64,  PF_R_D);
	d_wr64(file_buf, p2 + 8u64,  interp_off);
	d_wr64(file_buf, p2 + 16u64, interp_va);
	d_wr64(file_buf, p2 + 24u64, interp_va);
	d_wr64(file_buf, p2 + 32u64, interp_sz);
	d_wr64(file_buf, p2 + 40u64, interp_sz);
	d_wr64(file_buf, p2 + 48u64, 1u64);

	let p3: u64 = 64u64 + 168u64;
	d_wr32(file_buf, p3 + 0u64,  PT_DYNAMIC_D);
	d_wr32(file_buf, p3 + 4u64,  PF_R_D | PF_W_D);
	d_wr64(file_buf, p3 + 8u64,  dynamic_off);
	d_wr64(file_buf, p3 + 16u64, dynamic_va);
	d_wr64(file_buf, p3 + 24u64, dynamic_va);
	d_wr64(file_buf, p3 + 32u64, dynamic_sz);
	d_wr64(file_buf, p3 + 40u64, dynamic_sz);
	d_wr64(file_buf, p3 + 48u64, 8u64);

	// Sections.
	let interp_local: str = interp_str_v();
	d_bcopy(file_buf, interp_off, interp_local.ptr, interp_local.len: u64);
	d_wr8(file_buf, interp_off + (interp_local.len: u64), 0u8);
	d_bcopy(file_buf, dynstr_off, dynstr, dynstr_sz);
	d_bcopy(file_buf, dynsym_off, dynsym_buf, dynsym_sz);
	d_bcopy(file_buf, hash_off, hash_buf, hash_sz);
	d_bcopy(file_buf, versym_off, versym_buf, versym_sz);
	if (verneed_sz > 0u64) {
		d_bcopy(file_buf, verneed_off, verneed_buf, verneed_sz);
	};
	d_bcopy(file_buf, relaplt_off, relaplt_buf, relaplt_sz);
	if (l.textlen > 0u64) {
		d_bcopy(file_buf, text_off, l.text, l.textlen);
	};
	d_bcopy(file_buf, plt_off, plt_buf, plt_sz);
	d_bcopy(file_buf, gotplt_off, gotplt_buf, gotplt_sz);
	d_bcopy(file_buf, dynamic_off, dynamic_buf, dynamic_sz);

	let wrote: i64 = os.writefull(fd, file_buf, file_end);
	if (wrote != file_end: i64) {
		return 1;
	};
	return 0;
};

// selfhost/cmd/6l/out.ww — port of cmd/6l/out.c.
//
// Emit a static ELF64 executable. File layout (per the C original):
//   [0..64)       Ehdr
//   [64..120)     Phdr (one PT_LOAD)
//   [120..0x1000) zero pad
//   [0x1000..)    .text bytes
// Single PT_LOAD covers the whole file, R+X. No interpreter, no .bss.

use os;
use sym;
use dynout;

def ET_EXEC:    u16 = 2u16;
def EM_X86_64_W: u16 = 62u16;
def EV_CURRENT: u32 = 1u32;
def ELFCLASS64: u8 = 2u8;
def ELFDATA2LSB: u8 = 1u8;
def PT_LOAD:    u32 = 1u32;
def PF_X:       u32 = 1u32;
def PF_R:       u32 = 4u32;

def TEXT_OFF: u64 = 4096u64;	// 0x1000

// ---- little-endian byte writers ----------------------------------------

fn wr_u16(buf: *u8, off: u64, v: u16) void = {
	buf[off]         = (v & 255u16): u8;
	buf[off + 1u64]  = ((v >> 8u16) & 255u16): u8;
};

fn wr_u32(buf: *u8, off: u64, v: u32) void = {
	buf[off]         = (v & 255u32): u8;
	buf[off + 1u64]  = ((v >> 8u32)  & 255u32): u8;
	buf[off + 2u64]  = ((v >> 16u32) & 255u32): u8;
	buf[off + 3u64]  = ((v >> 24u32) & 255u32): u8;
};

fn wr_u64(buf: *u8, off: u64, v: u64) void = {
	wr_u32(buf, off,        (v & 4294967295u64): u32);
	wr_u32(buf, off + 4u64, ((v >> 32u64) & 4294967295u64): u32);
};

// ---- emit ---------------------------------------------------------------

export fn l_emit_elf(l: *lnk, fd: i32, base: u64, entry: u64) i32 = {
	// Dispatch: any loaded shared object plus any dynamic ref means
	// we owe the loader a real PT_INTERP/PT_DYNAMIC binary.
	if (l.sos != nil) {
		if (l.dyn_n > 0) {
			return l_emit_dyn_elf(l, fd, base, entry);
		};
	};

	let filesz: u64 = TEXT_OFF + l.textlen;

	// One contiguous header buffer covering [0..0x1000), then .text.
	let hdr: *u8 = os.alloc(TEXT_OFF): *u8;	// zero-initialised by mmap

	// --- Ehdr (64 bytes) ---
	hdr[0u64] = 127u8;	// 0x7f
	hdr[1u64] = 69u8;	// 'E'
	hdr[2u64] = 76u8;	// 'L'
	hdr[3u64] = 70u8;	// 'F'
	hdr[4u64] = ELFCLASS64;
	hdr[5u64] = ELFDATA2LSB;
	hdr[6u64] = EV_CURRENT: u8;
	wr_u16(hdr, 16u64, ET_EXEC);		// e_type
	wr_u16(hdr, 18u64, EM_X86_64_W);	// e_machine
	wr_u32(hdr, 20u64, EV_CURRENT);		// e_version
	wr_u64(hdr, 24u64, entry);		// e_entry
	wr_u64(hdr, 32u64, 64u64);		// e_phoff = sizeof(Ehdr)
	wr_u64(hdr, 40u64, 0u64);		// e_shoff
	wr_u32(hdr, 48u64, 0u32);		// e_flags
	wr_u16(hdr, 52u64, 64u16);		// e_ehsize
	wr_u16(hdr, 54u64, 56u16);		// e_phentsize
	wr_u16(hdr, 56u64, 1u16);		// e_phnum
	wr_u16(hdr, 58u64, 0u16);		// e_shentsize
	wr_u16(hdr, 60u64, 0u16);		// e_shnum
	wr_u16(hdr, 62u64, 0u16);		// e_shstrndx

	// --- Phdr (56 bytes) at offset 64 ---
	wr_u32(hdr, 64u64, PT_LOAD);		// p_type
	wr_u32(hdr, 68u64, PF_R | PF_X);	// p_flags
	wr_u64(hdr, 72u64, 0u64);		// p_offset
	wr_u64(hdr, 80u64, base);		// p_vaddr
	wr_u64(hdr, 88u64, base);		// p_paddr
	wr_u64(hdr, 96u64, filesz);		// p_filesz
	wr_u64(hdr, 104u64, filesz);		// p_memsz
	wr_u64(hdr, 112u64, TEXT_OFF);		// p_align

	// Write [0..0x1000) then .text.
	let n1: i64 = os.writefull(fd, hdr, TEXT_OFF);
	if (n1 != TEXT_OFF: i64) { return -1; };
	if (l.textlen > 0u64) {
		let n2: i64 = os.writefull(fd, l.text, l.textlen);
		if (n2 != l.textlen: i64) { return -1; };
	};
	return 0;
};

// selfhost/cmd/6l/main.ww — port of cmd/6l/main.c.
//
// 6l = amd64 linker. Reads relocatable ELF .o files, SysV `ar`
// archives, and shared objects (ET_DYN). Resolves symbols, applies
// relocations, writes a static or dynamic-linked ELF executable.
//
//   6l_ww -o out [-L<dir>...] [-l<name>...] file1.o file2.o ...

use os;
use mem;
use sym;
use obj;
use dyn;
use pass;
use out;

def BASE: u64 = 4194304u64;	// 0x400000
def CODE_VA_OFF: u64 = 4096u64;	// .text starts at base + 0x1000

fn make_lnk(a: *arena) *lnk = {
	let l: *lnk = amalloc(a, 112u64): *lnk;
	l.a = a;
	return l;
};

fn streq_cs(a: *u8, lit: str) bool = {
	let n: u64 = lit.len: u64;
	let i: u64 = 0u64;
	for (i < n) {
		let li: i32 = i: i32;
		if (a[i] != lit[li]) { return false; };
		i += 1u64;
	};
	if (a[i] != 0u8) { return false; };
	return true;
};

fn cstrlen_l(p: *u8) u64 = {
	let n: u64 = 0u64;
	for (p[n] != 0u8) { n += 1u64; };
	return n;
};

// strncmp(a, lit, n): true iff a's first n bytes == lit's first n bytes.
fn strn_eq(a: *u8, lit: str, n: u64) bool = {
	if ((lit.len: u64) < n) { return false; };
	let i: u64 = 0u64;
	for (i < n) {
		let li: i32 = i: i32;
		if (a[i] != lit[li]) { return false; };
		i += 1u64;
	};
	return true;
};

// Build "<dir>/lib<name>.<ext>" into dst (NUL-terminated). Returns total
// length excluding NUL. dst must be large enough.
fn build_path(dst: *u8, dir: *u8, name: *u8, ext: str) u64 = {
	let i: u64 = 0u64;
	let dn: u64 = cstrlen_l(dir);
	let nn: u64 = cstrlen_l(name);
	let k: u64 = 0u64;
	for (k < dn) { dst[i] = dir[k]; i += 1u64; k += 1u64; };
	dst[i] = 47u8;	// '/'
	i += 1u64;
	dst[i] = 108u8;	// 'l'
	i += 1u64;
	dst[i] = 105u8;	// 'i'
	i += 1u64;
	dst[i] = 98u8;	// 'b'
	i += 1u64;
	k = 0u64;
	for (k < nn) { dst[i] = name[k]; i += 1u64; k += 1u64; };
	k = 0u64;
	for (k < ext.len: u64) {
		let li: i32 = k: i32;
		dst[i] = ext[li];
		i += 1u64;
		k += 1u64;
	};
	dst[i] = 0u8;
	return i;
};

// Append decimal n to dst at offset i. Returns new offset.
fn append_dec(dst: *u8, i: u64, n: u64) u64 = {
	if (n == 0u64) {
		dst[i] = 48u8;
		return i + 1u64;
	};
	let buf: *u8 = os.alloc(16u64): *u8;
	let k: u64 = 0u64;
	let v: u64 = n;
	for (v > 0u64) {
		buf[k] = (v % 10u64): u8 + 48u8;
		v = v / 10u64;
		k += 1u64;
	};
	let oi: u64 = i;
	for (k > 0u64) {
		k -= 1u64;
		dst[oi] = buf[k];
		oi += 1u64;
	};
	return oi;
};

fn build_path_v(dst: *u8, dir: *u8, name: *u8, v: u64) u64 = {
	let i: u64 = 0u64;
	let dn: u64 = cstrlen_l(dir);
	let nn: u64 = cstrlen_l(name);
	let k: u64 = 0u64;
	for (k < dn) { dst[i] = dir[k]; i += 1u64; k += 1u64; };
	dst[i] = 47u8; i += 1u64;
	dst[i] = 108u8; i += 1u64;
	dst[i] = 105u8; i += 1u64;
	dst[i] = 98u8; i += 1u64;
	k = 0u64;
	for (k < nn) { dst[i] = name[k]; i += 1u64; k += 1u64; };
	dst[i] = 46u8; i += 1u64; dst[i] = 115u8; i += 1u64; dst[i] = 111u8; i += 1u64; dst[i] = 46u8; i += 1u64;
	i = append_dec(dst, i, v);
	dst[i] = 0u8;
	return i;
};

// is_linkable: read first 8 bytes; require !<arch>\n or \x7fELF.
fn is_linkable(path: *u8) bool = {
	let fd: i32 = os.open(path, os.O_RDONLY, 0i32);
	if (fd < 0) { return false; };
	let mp: *u8 = os.alloc(8u64): *u8;
	let n: i64 = os.read(fd, mp, 8u64);
	os.close(fd);
	if (n < 4i64) { return false; };
	// archive: "!<arch>\n"
	if (n >= 8i64) {
		if (mp[0u64] == 33u8) { if (mp[1u64] == 60u8) {
		if (mp[2u64] == 97u8) { if (mp[3u64] == 114u8) {
		if (mp[4u64] == 99u8) { if (mp[5u64] == 104u8) {
		if (mp[6u64] == 62u8) { if (mp[7u64] == 10u8) {
			return true;
		}; }; }; }; }; }; }; };
	};
	// ELF: "\x7fELF"
	if (mp[0u64] == 127u8) {
		if (mp[1u64] == 69u8) {
			if (mp[2u64] == 76u8) {
				if (mp[3u64] == 70u8) { return true; };
			};
		};
	};
	return false;
};

// Walk libdirs[0..n) trying lib<name>.so, then lib<name>.so.{0..8},
// then lib<name>.a. Return arena-owned NUL-terminated path on success,
// nil on miss.
fn resolve_lib(a: *arena, name: *u8, libdirs: **u8, n_libdirs: i32) *u8 = {
	let bufp: *u8 = os.alloc(1024u64): *u8;
	let i: i32 = 0;
	for (i < n_libdirs) {
		let dir: *u8 = libdirs[i];
		let _l1: u64 = build_path(bufp, dir, name, ".so");
		if (is_linkable(bufp)) {
			let pl: u64 = cstrlen_l(bufp);
			let p: *u8 = amalloc(a, pl + 1u64): *u8;
			let k: u64 = 0u64;
			for (k <= pl) { p[k] = bufp[k]; k += 1u64; };
			return p;
		};
		let v: u64 = 0u64;
		for (v <= 8u64) {
			let _l2: u64 = build_path_v(bufp, dir, name, v);
			if (is_linkable(bufp)) {
				let pl2: u64 = cstrlen_l(bufp);
				let p2: *u8 = amalloc(a, pl2 + 1u64): *u8;
				let k2: u64 = 0u64;
				for (k2 <= pl2) { p2[k2] = bufp[k2]; k2 += 1u64; };
				return p2;
			};
			v += 1u64;
		};
		let _l3: u64 = build_path(bufp, dir, name, ".a");
		if (is_linkable(bufp)) {
			let pl3: u64 = cstrlen_l(bufp);
			let p3: *u8 = amalloc(a, pl3 + 1u64): *u8;
			let k3: u64 = 0u64;
			for (k3 <= pl3) { p3[k3] = bufp[k3]; k3 += 1u64; };
			return p3;
		};
		i += 1;
	};
	return nil;
};

// Read first 20 bytes; return 1 for ET_DYN .so, 0 for ar/.o.
fn is_so(path: *u8) i32 = {
	let fd: i32 = os.open(path, os.O_RDONLY, 0i32);
	if (fd < 0) { return 0; };
	let mp: *u8 = os.alloc(20u64): *u8;
	let n: i64 = os.read(fd, mp, 20u64);
	os.close(fd);
	if (n < 20i64) { return 0; };
	if (mp[0u64] != 127u8) { return 0; };
	if (mp[1u64] != 69u8) { return 0; };
	if (mp[2u64] != 76u8) { return 0; };
	if (mp[3u64] != 70u8) { return 0; };
	// e_type at offset 16, u16 little-endian
	let t: u16 = (mp[16u64]: u16) | ((mp[17u64]: u16) << 8u16);
	if (t == 3u16) { return 1; };
	return 0;
};

export fn main(argc: i32, argv: **u8) i32 = {
	let out_path: *u8 = nil;
	let max_inputs: i32 = 64;
	let inputs:  **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
	let ninputs: i32 = 0;
	let libdirs: **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
	let n_libdirs: i32 = 0;
	let lflags:  **u8 = os.alloc((max_inputs: u64) * 8u64): **u8;
	let n_lflags: i32 = 0;

	let i: i32 = 1;
	for (i < argc) {
		let a: *u8 = argv[i];
		if (streq_cs(a, "-o")) {
			i += 1;
			if (i >= argc) {
				os.write(2, "6l: -o requires argument\n".ptr, 25u64);
				return 2;
			};
			out_path = argv[i];
		} else { if (streq_cs(a, "-L")) {
			i += 1;
			if (i >= argc) {
				os.write(2, "6l: -L requires argument\n".ptr, 25u64);
				return 2;
			};
			libdirs[n_libdirs] = argv[i];
			n_libdirs += 1;
		} else { if (streq_cs(a, "-l")) {
			i += 1;
			if (i >= argc) {
				os.write(2, "6l: -l requires argument\n".ptr, 25u64);
				return 2;
			};
			lflags[n_lflags] = argv[i];
			n_lflags += 1;
		} else { if (a[0u64] == 45u8) {
			// -L<dir> joined form.
			if (a[1u64] == 76u8) {
				if (a[2u64] != 0u8) {
					libdirs[n_libdirs] = a + 2u64;
					n_libdirs += 1;
				} else {
					os.write(2, "6l: bare -L\n".ptr, 12u64);
					return 2;
				};
			} else { if (a[1u64] == 108u8) {
				if (a[2u64] != 0u8) {
					lflags[n_lflags] = a + 2u64;
					n_lflags += 1;
				} else {
					os.write(2, "6l: bare -l\n".ptr, 12u64);
					return 2;
				};
			} else {
				os.write(2, "6l: unknown flag\n".ptr, 17u64);
				return 2;
			};};
		} else {
			if (ninputs >= max_inputs) {
				os.write(2, "6l: too many inputs\n".ptr, 20u64);
				return 2;
			};
			inputs[ninputs] = a;
			ninputs += 1;
		};};};};
		i += 1;
	};

	if (out_path == nil) {
		os.write(2, "usage: 6l_ww -o exe [-L<dir>...] [-l<name>...] file1.o [file2.o...]\n".ptr, 68u64);
		return 2;
	};
	if (ninputs == 0) {
		os.write(2, "6l: no inputs\n".ptr, 14u64);
		return 2;
	};

	let a: *arena = newarena();
	let l: *lnk = make_lnk(a);

	// Seed _start so libwwrt-style start.o is recognised as wanted.
	l_intern(l, "_start");

	// Load positional inputs first (preserving order).
	let k: i32 = 0;
	for (k < ninputs) {
		if (l_load(l, inputs[k]) != 0) {
			return 1;
		};
		k += 1;
	};

	// Then resolve -l flags and load each. Archives append; shared
	// objects register their exports.
	let lf: i32 = 0;
	for (lf < n_lflags) {
		let p: *u8 = resolve_lib(a, lflags[lf], libdirs, n_libdirs);
		if (p == nil) {
			os.write(2, "6l: cannot find -l".ptr, 18u64);
			let nm: *u8 = lflags[lf];
			os.write(2, nm, cstrlen_l(nm));
			os.write(2, "\n".ptr, 1u64);
			return 1;
		};
		if (is_so(p) != 0) {
			if (l_load_so(l, p) != 0) { return 1; };
		} else {
			if (l_load(l, p) != 0) { return 1; };
		};
		lf += 1;
	};

	if (l_resolve(l) != 0) { return 1; };
	if (l_relocate(l, BASE + CODE_VA_OFF) != 0) { return 1; };

	let entry_sym: *lsym = l_lookup(l, "_start");
	if (entry_sym == nil) { entry_sym = l_lookup(l, "main"); }
	else { if (entry_sym.defined == 0) { entry_sym = l_lookup(l, "main"); }; };
	if (entry_sym == nil) {
		os.write(2, "6l: no _start or main symbol\n".ptr, 29u64);
		return 1;
	};
	if (entry_sym.defined == 0) {
		os.write(2, "6l: no _start or main symbol\n".ptr, 29u64);
		return 1;
	};

	let flags: i32 = os.O_WRONLY | os.O_CREAT | os.O_TRUNC;
	let fd: i32 = os.open(out_path, flags, 493i32);	// 0o755
	if (fd < 0) {
		os.write(2, "6l: cannot open output\n".ptr, 23u64);
		return 1;
	};

	let entry_va: u64 = BASE + CODE_VA_OFF + entry_sym.val;
	let rc: i32 = l_emit_elf(l, fd, BASE, entry_va);
	os.close(fd);
	return rc;
};