kit

emit.c (29236B)

---

 /* ELF ET_REL writer. Walks a finalized ObjBuilder and emits a 64-bit
  * little-endian relocatable object via the supplied Writer.
  *
  * Layout strategy:
  *   1. plan ELF section headers (one per obj section, plus synthesized
  *      .symtab / .strtab / .shstrtab and one .rela.<name> per obj section
  *      that carries relocations);
  *   2. build .symtab + .strtab content (locals first — STT_SECTION
  *      synthesized for every input section, then ordinary locals, then
  *      globals/weaks);
  *   3. build .rela.* content using the per-arch reloc map (selected
  *      by Compiler.target.arch);
  *   4. build .shstrtab;
  *   5. assign file offsets sequentially, respecting per-section
  *      addralign;
  *   6. write Ehdr, then each section's bytes (seeking to its sh_offset),
  *      then the section header table.
  *
  * 64-bit little-endian only. Per-arch reloc tables (elf_reloc_<arch>.c)
  * supply the RelocKind -> ELF type mapping; e_machine is selected from
  * Compiler.target.arch. Big-endian / 32-bit ELF panic at entry.
  *
  * See doc/DESIGN.md §5.5 for the round-trip invariant: read_elf of this
  * output must produce an ObjBuilder shape-equivalent to the input,
  * modulo (a) section ordering and (b) the synthesized STT_SECTION
  * symbols (which are visible to read_elf but were not in the input). */
 
 #include <string.h>
 
 #include "core/arena.h"
 #include "core/buf.h"
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/util.h"
 #include "obj/elf/elf.h"
 #include "obj/format.h"
 
 /* ---- per-ELF-section plan record ---- */
 
 /* Internal section descriptor used during planning. Mirrors Elf64_Shdr
  * but with an explicit pointer to the source bytes (either an obj
  * Section's chunked Buf or a synthesized linear buffer). NOBITS sections
  * have no source bytes and consume no file space. */
 typedef struct ElfSec {
   /* Final shdr fields (little-endian-encoded at write time). */
   u32 sh_name; /* offset into shstrtab */
   u32 sh_type;
   u64 sh_flags;
   u64 sh_addr; /* always 0 for ET_REL */
   u64 sh_offset;
   u64 sh_size;
   u32 sh_link;
   u32 sh_info;
   u64 sh_addralign;
   u64 sh_entsize;
 
   /* Section name. The name string lives in scratch (synthesized) or in
    * the global pool (obj-section names); buf-source is set for sections
    * carrying obj-section bytes, raw_bytes for synthesized. */
   const char* name;
   u32 name_len;
 
   const Buf* obj_bytes; /* one of these three is set: */
   const u8* raw_bytes;  /*                            */
   int is_nobits;        /*                            */
 } ElfSec;
 
 /* ---- emit ---- */
 
 static u32 sec_flags_to_elf(u16 flags) {
   u64 r = 0;
   if (flags & SF_ALLOC) r |= SHF_ALLOC;
   if (flags & SF_EXEC) r |= SHF_EXECINSTR;
   if (flags & SF_WRITE) r |= SHF_WRITE;
   if (flags & SF_TLS) r |= SHF_TLS;
   if (flags & SF_MERGE) r |= SHF_MERGE;
   if (flags & SF_STRINGS) r |= SHF_STRINGS;
   if (flags & SF_GROUP) r |= SHF_GROUP;
   if (flags & SF_LINK_ORDER) r |= SHF_LINK_ORDER;
   if (flags & SF_RETAIN) r |= SHF_GNU_RETAIN;
   return (u32)r;
 }
 
 static u32 sec_sem_to_elf(u16 sem) {
   switch (sem) {
     case SSEM_PROGBITS:
       return SHT_PROGBITS;
     case SSEM_NOBITS:
       return SHT_NOBITS;
     case SSEM_SYMTAB:
       return SHT_SYMTAB;
     case SSEM_STRTAB:
       return SHT_STRTAB;
     case SSEM_RELA:
       return SHT_RELA;
     case SSEM_REL:
       return SHT_REL;
     case SSEM_NOTE:
       return SHT_NOTE;
     case SSEM_INIT_ARRAY:
       return SHT_INIT_ARRAY;
     case SSEM_FINI_ARRAY:
       return SHT_FINI_ARRAY;
     case SSEM_PREINIT_ARRAY:
       return SHT_PREINIT_ARRAY;
     case SSEM_GROUP:
       return SHT_GROUP;
     default:
       return SHT_PROGBITS;
   }
 }
 
 static u8 sym_bind_to_elf(u16 bind) { return elf_st_bind((u8)bind); }
 
 /* SK_COMMON -> STT_OBJECT: real ELF emitters (clang, gcc, GNU as) write
  * tentative definitions as STT_OBJECT with shndx=SHN_COMMON. STT_COMMON
  * is a near-extinct convention that llvm-readelf renders as the literal
  * type name "COMMON" — emitting it breaks roundtrip against any
  * toolchain-produced .o. The shared elf.h table encodes this directly. */
 static u8 sym_kind_to_elf(u16 kind) { return elf_st_type((u8)kind); }
 
 static u8 sym_vis_to_elf(u8 vis) { return elf_st_other(vis); }
 
 static u16 sym_shndx(const ObjSym* s, const u32* obj_to_elf, u32 nsec) {
   if (s->kind == SK_COMMON) return (u16)SHN_COMMON;
   if (s->kind == SK_ABS) return (u16)SHN_ABS;
   /* STT_FILE conventionally carries SHN_ABS as its shndx — its value
    * field is not an address. Match clang/binutils. */
   if (s->kind == SK_FILE) return (u16)SHN_ABS;
   if (s->section_id == OBJ_SEC_NONE) return (u16)SHN_UNDEF;
   if (s->section_id >= nsec) return (u16)SHN_UNDEF;
   return (u16)obj_to_elf[s->section_id];
 }
 
 static const char* sym_to_str(Compiler* c, Sym n, u32* len_out) {
   Slice sl = pool_slice(c->global, n);
   const char* s = sl.s;
   if (!s) {
     *len_out = 0;
     return "";
   }
   *len_out = (u32)sl.len;
   return s;
 }
 
 /* Append `len` bytes of `s` followed by a single NUL to `b`, return
  * the offset at which `s` was placed.
  *
  * If `s` already exists at some offset (as a NUL-terminated substring
  * starting at any offset), reuse that offset — clang/binutils both
  * dedupe trivially identical strings, and matching the convention
  * keeps our strtab the same size as theirs. The dedupe is linear in
  * the strtab; section + symbol counts are small enough that this is
  * fine without a hash. */
 static u32 strtab_add(Buf* b, const char* s, u32 len) {
   /* Empty string: always at offset 0 (the leading NUL). */
   if (len == 0) return 0;
 
   /* Linear search for an existing copy. We must scan chunk-by-chunk
    * because Buf is segmented; flatten to a temp scratch buffer first
    * if non-empty and search there. For our tiny strtabs, the cost is
    * dominated by the writes anyway. */
   u32 total = buf_pos(b);
   if (total > len) {
     /* Flatten just to search — not optimal but the strtab here is
      * always small (low kilobytes at most). */
     u8 stack[256];
     u8* tmp =
         total <= sizeof stack ? stack : (u8*)b->heap->alloc(b->heap, total, 1);
     if (tmp) {
       buf_flatten(b, tmp);
       for (u32 i = 0; i + len < total; ++i) {
         if (tmp[i + len] == 0 && memcmp(tmp + i, s, len) == 0) {
           if (tmp != stack) b->heap->free(b->heap, tmp, total);
           return i;
         }
       }
       if (tmp != stack) b->heap->free(b->heap, tmp, total);
     }
   }
 
   u32 off = total;
   buf_write(b, s, len);
   {
     u8 z = 0;
     buf_write(b, &z, 1);
   }
   return off;
 }
 
 void emit_elf(Compiler* c, ObjBuilder* ob, Writer* w) {
   Heap* h = (Heap*)c->ctx->heap;
 
   /* Run the tombstone sweep before any iteration: cascades removed
    * sections into their defining symbols, drops dangling relocs,
    * compacts groups, and absorbs the historical UNDEF prune. After this
    * call every direct ID-based access below must skip entries whose
    * `removed` bit is set. */
   obj_sweep_dead(ob);
 
   /* ---- target validation ------------------------------------------ */
   const ObjFormatImpl* fmt = obj_format_lookup(KIT_OBJ_ELF);
   const ObjElfArchOps* elf =
       fmt && fmt->elf_arch ? fmt->elf_arch(c->target.arch) : NULL;
   u32 e_machine;
   u32 (*reloc_to)(u32);
   if (!elf || !elf->reloc_to) {
     compiler_panic(c, SRCLOC_NONE, "emit_elf: unsupported target arch %u",
                    (u32)c->target.arch);
   }
   e_machine = elf->e_machine;
   reloc_to = elf->reloc_to;
   if (c->target.big_endian) {
     compiler_panic(c, SRCLOC_NONE, "emit_elf: big-endian ELF not supported");
   }
   /* is32 selects ELFCLASS32 (RV32) record widths/layouts everywhere
    * below; ptr_size==8 is the established ELFCLASS64 path. */
   if (c->target.ptr_size != 8 && c->target.ptr_size != 4) {
     compiler_panic(c, SRCLOC_NONE, "emit_elf: ptr_size %u (expected 4 or 8)",
                    (u32)c->target.ptr_size);
   }
   int is32 = (c->target.ptr_size == 4);
   u32 sym_size = is32 ? ELF32_SYM_SIZE : ELF64_SYM_SIZE;
   u32 rela_size = is32 ? ELF32_RELA_SIZE : ELF64_RELA_SIZE;
   u32 ehdr_size = is32 ? ELF32_EHDR_SIZE : ELF64_EHDR_SIZE;
   u32 shdr_size = is32 ? ELF32_SHDR_SIZE : ELF64_SHDR_SIZE;
 
   /* ---- pass 1: plan ELF section list ------------------------------ */
 
   u32 nobjsec = obj_section_count(ob);
 
   u32 nobjgrp = obj_group_count(ob);
   /* Upper bound on ELF section count:
    *   1 (SHN_UNDEF)
    * + nobjsec - 1 (one ELF entry per real obj section)
    * + nobjsec - 1 (worst case: a .rela.<name> per obj section)
    * + nobjgrp - 1 (one synthesized SHT_GROUP per ObjGroup)
    * + 3 (.symtab, .strtab, .shstrtab)
    */
   u32 max_secs =
       1 + (nobjsec - 1) + (nobjsec - 1) + (nobjgrp ? nobjgrp - 1 : 0) + 3;
   if (max_secs < 4) max_secs = 4;
   ElfSec* secs = arena_array(c->scratch, ElfSec, max_secs);
   u32 nsecs = 0;
   memset(&secs[nsecs++], 0, sizeof secs[0]); /* index 0 = SHN_UNDEF */
 
   /* Map obj section id -> ELF section index. */
   u32* obj_to_elf = arena_zarray(c->scratch, u32, nobjsec);
 
   for (u32 i = 1; i < nobjsec; ++i) {
     const Section* s = obj_section_get(ob, i);
     if (s->removed) continue; /* tombstone — see obj_sweep_dead */
     ElfSec* es = &secs[nsecs];
     memset(es, 0, sizeof *es);
     u32 nlen;
     es->name = sym_to_str(c, s->name, &nlen);
     es->name_len = nlen;
     /* Honor format-specific overrides preserved by the reader for
      * sh_type/sh_flags bits the canonical SecSem/SecFlag enums
      * don't model (e.g. SHT_LLVM_ADDRSIG, SHF_EXCLUDE). */
     es->sh_type = (s->ext_kind == OBJ_EXT_ELF && s->ext_type)
                       ? s->ext_type
                       : sec_sem_to_elf(s->sem);
     es->sh_flags = sec_flags_to_elf(s->flags);
     if (s->ext_kind == OBJ_EXT_ELF) es->sh_flags |= s->ext_flags;
     es->sh_addr = 0;
     es->sh_addralign = s->align ? s->align : 1;
     es->sh_entsize = s->entsize;
     es->sh_link = 0;
     es->sh_info = 0;
     if (s->sem == SSEM_NOBITS) {
       es->is_nobits = 1;
       es->sh_size = s->bss_size;
     } else {
       es->obj_bytes = &s->bytes;
       es->sh_size = s->bytes.total;
     }
     obj_to_elf[i] = nsecs++;
   }
 
   /* ---- pass 2: build .symtab + .strtab content -------------------- */
 
   /* .strtab: leading NUL byte. Then a name per emitted symbol. */
   Buf strtab;
   buf_init(&strtab, h);
   {
     u8 z = 0;
     buf_write(&strtab, &z, 1);
   }
 
   /* The .symtab is built into a contiguous arena buffer of fixed-size
    * 24-byte records. We don't know the count up front; bound by
    * (nobjsec section symbols) + (obj symbol count). */
   u32 nobjsym = 0;
   {
     ObjSymIter* it = obj_symiter_new(ob);
     ObjSymEntry e;
     while (obj_symiter_next(it, &e)) ++nobjsym;
     obj_symiter_free(it);
   }
   u32 max_syms = 1 + (nobjsec - 1) + nobjsym;
   u8* symtab =
       (u8*)arena_alloc(c->scratch, (size_t)sym_size * max_syms, _Alignof(u64));
   u32 nsyms = 0;
   memset(&symtab[nsyms * sym_size], 0, sym_size);
   nsyms = 1; /* index 0: STN_UNDEF */
 
 /* Helper to emit one symbol record at index `idx` into symtab.
  * Elf64_Sym (24B) and Elf32_Sym (16B) REORDER fields: ELF32 places
  * st_value/st_size BEFORE st_info/st_other/st_shndx, so select the byte
  * layout by `is32` rather than just narrowing widths. */
 #define WRITE_SYM(idx, st_name, st_info, st_other, st_shndx, st_value, \
                   st_size)                                             \
   do {                                                                 \
     u8* slot = &symtab[(idx) * sym_size];                              \
     if (is32) {                                                        \
       slot[0] = (u8)((st_name));                                       \
       slot[1] = (u8)((st_name) >> 8);                                  \
       slot[2] = (u8)((st_name) >> 16);                                 \
       slot[3] = (u8)((st_name) >> 24);                                 \
       for (int _b = 0; _b < 4; ++_b)                                   \
         slot[4 + _b] = (u8)((u64)(st_value) >> (_b * 8));              \
       for (int _b = 0; _b < 4; ++_b)                                   \
         slot[8 + _b] = (u8)((u64)(st_size) >> (_b * 8));               \
       slot[12] = (u8)((st_info));                                      \
       slot[13] = (u8)((st_other));                                     \
       slot[14] = (u8)((st_shndx));                                     \
       slot[15] = (u8)((st_shndx) >> 8);                                \
     } else {                                                           \
       slot[0] = (u8)((st_name));                                       \
       slot[1] = (u8)((st_name) >> 8);                                  \
       slot[2] = (u8)((st_name) >> 16);                                 \
       slot[3] = (u8)((st_name) >> 24);                                 \
       slot[4] = (u8)((st_info));                                       \
       slot[5] = (u8)((st_other));                                      \
       slot[6] = (u8)((st_shndx));                                      \
       slot[7] = (u8)((st_shndx) >> 8);                                 \
       for (int _b = 0; _b < 8; ++_b)                                   \
         slot[8 + _b] = (u8)((u64)(st_value) >> (_b * 8));              \
       for (int _b = 0; _b < 8; ++_b)                                   \
         slot[16 + _b] = (u8)((u64)(st_size) >> (_b * 8));              \
     }                                                                  \
   } while (0)
 
   /* No automatic STT_SECTION synthesis. Section symbols are emitted
    * iff they are present in the input ObjBuilder (typically as
    * SK_SECTION ObjSyms preserved by read_elf, or added explicitly by
    * a hand-built caller that needs to reference a section by sym).
    * This matches clang's output: only sections referenced by section
    * symbols carry one. */
 
   /* Map obj symbol id -> elf symbol index. */
   u32* sym_to_elf = arena_zarray(c->scratch, u32, nobjsym + 2);
 
   /* Two passes over obj symbols: locals, then globals/weak. */
   for (int pass = 0; pass < 2; ++pass) {
     ObjSymIter* it = obj_symiter_new(ob);
     ObjSymEntry e;
     while (obj_symiter_next(it, &e)) {
       const ObjSym* s = e.sym;
       if (s->removed) continue; /* spurious-UNDEF prune + explicit removal */
       int is_local = (s->bind == SB_LOCAL);
       if ((pass == 0) != is_local) continue;
       u32 nlen;
       const char* nm = sym_to_str(c, s->name, &nlen);
       u32 nameoff = nlen ? strtab_add(&strtab, nm, nlen) : 0;
       u8 info =
           ELF64_ST_INFO(sym_bind_to_elf(s->bind), sym_kind_to_elf(s->kind));
       u8 other = sym_vis_to_elf(s->vis);
       u16 shndx = sym_shndx(s, obj_to_elf, nobjsec);
       u64 value = (s->kind == SK_COMMON) ? s->common_align : s->value;
       WRITE_SYM(nsyms, nameoff, info, other, shndx, value, s->size);
       sym_to_elf[e.id] = nsyms;
       nsyms++;
     }
     obj_symiter_free(it);
   }
 #undef WRITE_SYM
 
   /* sh_info on .symtab is the index of the first non-local symbol.
    * Locals = 1 (STN_UNDEF) + count of input-side LOCAL obj symbols. */
   u32 nlocals = 1;
   {
     ObjSymIter* it = obj_symiter_new(ob);
     ObjSymEntry e;
     while (obj_symiter_next(it, &e)) {
       if (e.sym->removed) continue;
       if (e.sym->bind == SB_LOCAL) ++nlocals;
     }
     obj_symiter_free(it);
   }
 
   /* Append .symtab + .strtab + .shstrtab planning records.
    * sh_link/sh_info for .symtab and .rela.* are filled in once we know
    * each section's elf index. */
   u32 idx_symtab = 0, idx_strtab = 0, idx_shstrtab = 0;
 
   /* ---- pass 2.5: synthesize SHT_GROUP sections from ObjGroups ----
    * Append one SHT_GROUP section per ObjGroup. The body is a 4-byte LE
    * flags word followed by the elf section index of each member.
    * Placed before relas so the file layout has data sections, then
    * groups, then relas/symtab/strtab — matching clang's ordering and
    * keeping data-section offsets independent of group presence. */
   u32* group_elf_idx =
       nobjgrp > 1 ? arena_array(c->scratch, u32, nobjgrp) : NULL;
   if (group_elf_idx) memset(group_elf_idx, 0, sizeof(u32) * nobjgrp);
   for (u32 gi = 1; gi < nobjgrp; ++gi) {
     const ObjGroup* g = obj_group_get(ob, gi);
     if (!g || g->removed) continue;
 
     u32 body_size = 4u + 4u * g->nsections;
     u8* body = (u8*)arena_alloc(c->scratch, body_size, _Alignof(u32));
     u32 gflags = g->flags ? g->flags : 1u; /* GRP_COMDAT default */
     body[0] = (u8)(gflags);
     body[1] = (u8)(gflags >> 8);
     body[2] = (u8)(gflags >> 16);
     body[3] = (u8)(gflags >> 24);
     for (u32 j = 0; j < g->nsections; ++j) {
       ObjSecId sid = g->sections[j];
       u32 eidx = (sid && sid < nobjsec) ? obj_to_elf[sid] : 0;
       u8* slot = body + 4 + j * 4;
       slot[0] = (u8)(eidx);
       slot[1] = (u8)(eidx >> 8);
       slot[2] = (u8)(eidx >> 16);
       slot[3] = (u8)(eidx >> 24);
     }
 
     u32 nlen;
     const char* gname = sym_to_str(c, g->name, &nlen);
     if (nlen == 0) {
       gname = ".group";
       nlen = 6;
     }
 
     ElfSec* es = &secs[nsecs];
     memset(es, 0, sizeof *es);
     es->name = gname;
     es->name_len = nlen;
     es->sh_type = SHT_GROUP;
     es->sh_flags = 0;
     es->sh_addralign = 4;
     es->sh_entsize = 4;
     es->sh_info = (g->signature && g->signature < nobjsym + 2)
                       ? sym_to_elf[g->signature]
                       : 0;
     /* sh_link patched below once idx_symtab is known. */
     es->raw_bytes = body;
     es->sh_size = body_size;
     group_elf_idx[gi] = nsecs;
     nsecs++;
   }
 
   /* ---- pass 3: build .rela.<name> contents ------------------------ */
 
   /* Allocate one .rela section per obj section that has any relocs. */
   u32 total_relocs = obj_reloc_total(ob);
 
   typedef struct RelaPlan {
     u32 obj_section; /* obj section the rela applies to */
     u8* bytes;       /* arena-allocated rela bytes */
     u32 size;        /* bytes count = nrelocs * rela_size (24 or 12) */
   } RelaPlan;
 
   RelaPlan* rela_plans = arena_zarray(c->scratch, RelaPlan, nobjsec);
   u32 nrela_plans = 0;
 
   for (u32 si = 1; si < nobjsec; ++si) {
     const Section* host = obj_section_get(ob, si);
     if (!host || host->removed) continue;
     u32 nr = obj_reloc_count(ob, si);
     if (!nr) continue;
     u8* buf =
         (u8*)arena_alloc(c->scratch, (size_t)rela_size * nr, _Alignof(u64));
     u32 j = 0;
     for (u32 i = 0; i < total_relocs; ++i) {
       const Reloc* r = obj_reloc_at(ob, i);
       if (r->removed) continue;
       if (r->section_id != si) continue;
       u32 etype = reloc_to(r->kind);
       if (etype == ELF_R_AARCH64_NONE /* == ELF_R_X86_64_NONE == 0 */ &&
           r->kind != R_NONE) {
         compiler_panic(c, SRCLOC_NONE,
                        "emit_elf: unsupported relocation kind %u for arch %u",
                        (u32)r->kind, (u32)c->target.arch);
       }
       u32 sym_elf_idx;
       if (r->sym == OBJ_SYM_NONE) {
         /* Reloc against a section: use the synthesized
          * STT_SECTION symbol if the obj reloc carries a
          * section_id-equivalent; otherwise 0. */
         sym_elf_idx = 0;
       } else {
         sym_elf_idx = sym_to_elf[r->sym];
       }
       /* Elf32_Rela (12B): r_offset@0, r_info@4 (ELF32_R_INFO, 8-bit
        * type), r_addend@8 — all 4-byte. Elf64_Rela (24B): all 8-byte. */
       u8* slot = &buf[j * rela_size];
       if (is32) {
         for (int b = 0; b < 4; ++b) slot[b] = (u8)((u32)r->offset >> (b * 8));
         u32 info = ELF32_R_INFO(sym_elf_idx, etype);
         for (int b = 0; b < 4; ++b) slot[4 + b] = (u8)(info >> (b * 8));
         for (int b = 0; b < 4; ++b)
           slot[8 + b] = (u8)((u32)r->addend >> (b * 8));
       } else {
         for (int b = 0; b < 8; ++b) slot[b] = (u8)((u64)r->offset >> (b * 8));
         u64 info = ELF64_R_INFO(sym_elf_idx, etype);
         for (int b = 0; b < 8; ++b) slot[8 + b] = (u8)(info >> (b * 8));
         for (int b = 0; b < 8; ++b)
           slot[16 + b] = (u8)((u64)r->addend >> (b * 8));
       }
       ++j;
     }
     rela_plans[nrela_plans].obj_section = si;
     rela_plans[nrela_plans].bytes = buf;
     rela_plans[nrela_plans].size = nr * rela_size;
     nrela_plans++;
   }
 
   /* Append ElfSec entries for each .rela.<name>. Names are ".rela" +
    * the obj section name; allocate in scratch. */
   u32* rela_elf_idx = arena_array(c->scratch, u32, nrela_plans + 1);
   for (u32 ri = 0; ri < nrela_plans; ++ri) {
     u32 si = rela_plans[ri].obj_section;
     const Section* s = obj_section_get(ob, si);
     u32 base_len;
     const char* base = sym_to_str(c, s->name, &base_len);
     u32 nlen = 5 + base_len; /* ".rela" + base */
     char* nm = (char*)arena_alloc(c->scratch, nlen + 1, 1);
     memcpy(nm, ".rela", 5);
     memcpy(nm + 5, base, base_len);
     nm[nlen] = 0;
 
     ElfSec* es = &secs[nsecs];
     memset(es, 0, sizeof *es);
     es->name = nm;
     es->name_len = nlen;
     es->sh_type = SHT_RELA;
     es->sh_flags = SHF_INFO_LINK;
     es->sh_addralign = is32 ? 4 : 8;
     es->sh_entsize = rela_size;
     es->sh_info = obj_to_elf[si]; /* section the relas apply to */
     /* sh_link filled below once we know symtab's elf index. */
     es->raw_bytes = rela_plans[ri].bytes;
     es->sh_size = rela_plans[ri].size;
     rela_elf_idx[ri] = nsecs;
     nsecs++;
   }
 
   /* Append .symtab. */
   {
     ElfSec* es = &secs[nsecs];
     memset(es, 0, sizeof *es);
     es->name = ".symtab";
     es->name_len = 7;
     es->sh_type = SHT_SYMTAB;
     es->sh_flags = 0;
     es->sh_addralign = is32 ? 4 : 8;
     es->sh_entsize = sym_size;
     es->raw_bytes = symtab;
     es->sh_size = (u64)nsyms * sym_size;
     es->sh_info = nlocals; /* first non-local symbol */
     idx_symtab = nsecs;
     nsecs++;
   }
 
   /* Patch sh_link on each .rela section now that we have idx_symtab. */
   for (u32 ri = 0; ri < nrela_plans; ++ri) {
     secs[rela_elf_idx[ri]].sh_link = idx_symtab;
   }
   /* SHT_GROUP also points its sh_link at .symtab (the symtab the
    * signature symbol's index in sh_info refers to). */
   for (u32 gi = 1; gi < nobjgrp; ++gi) {
     if (group_elf_idx && group_elf_idx[gi]) {
       secs[group_elf_idx[gi]].sh_link = idx_symtab;
     }
   }
 
   /* ---- pass 4: append section names to the same strtab and emit it.
    *
    * clang reuses .strtab for both symbol names and section names —
    * e_shstrndx and .symtab.sh_link both point at it. Match that
    * convention: continue appending into `strtab` (which already
    * contains the symbol names), then emit one STRTAB section. */
 
   /* secs[0] (SHN_UNDEF) carries name "" → offset 0. */
   secs[0].sh_name = 0;
   for (u32 i = 1; i < nsecs; ++i) {
     secs[i].sh_name = strtab_add(&strtab, secs[i].name, secs[i].name_len);
   }
 
   /* Append the .strtab section record itself; its own name lands in
    * the same buffer (so the strtab is self-describing). */
   {
     const char* nm = ".strtab";
     u32 nlen = 7;
     u32 nameoff = strtab_add(&strtab, nm, nlen);
     u32 sz = buf_pos(&strtab);
     u8* flat = (u8*)arena_alloc(c->scratch, sz, 1);
     buf_flatten(&strtab, flat);
     buf_fini(&strtab);
 
     ElfSec* es = &secs[nsecs];
     memset(es, 0, sizeof *es);
     es->name = nm;
     es->name_len = nlen;
     es->sh_name = nameoff;
     es->sh_type = SHT_STRTAB;
     es->sh_addralign = 1;
     es->raw_bytes = flat;
     es->sh_size = sz;
     idx_strtab = nsecs;
     idx_shstrtab = nsecs; /* same section serves both roles */
     nsecs++;
   }
   secs[idx_symtab].sh_link = idx_strtab;
 
   /* ---- pass 5: assign file offsets -------------------------------- */
 
   u64 cur = ehdr_size;
   for (u32 i = 1; i < nsecs; ++i) {
     ElfSec* es = &secs[i];
     if (es->is_nobits) {
       /* sh_offset for NOBITS is conventionally where the next
        * non-NOBITS section begins; we set it to cur without
        * advancing. */
       es->sh_offset = cur;
       continue;
     }
     u64 a = es->sh_addralign ? es->sh_addralign : 1;
     cur = ALIGN_UP(cur, a);
     es->sh_offset = cur;
     cur += es->sh_size;
   }
   /* ELF32 toolchains conventionally align the SHT to 4; ELF64 to 8. */
   cur = ALIGN_UP(cur, (u64)(is32 ? 4 : 8));
   u64 e_shoff = cur;
 
   /* ---- pass 6: write Ehdr ----------------------------------------- */
 
   u8 ident[EI_NIDENT] = {0};
   ident[EI_MAG0] = ELFMAG0;
   ident[EI_MAG1] = ELFMAG1;
   ident[EI_MAG2] = ELFMAG2;
   ident[EI_MAG3] = ELFMAG3;
   ident[EI_CLASS] = is32 ? ELFCLASS32 : ELFCLASS64;
   ident[EI_DATA] = ELFDATA2LSB;
   ident[EI_VERSION] = EV_CURRENT;
   /* SysV is the canonical OSABI for Linux relocatable .o files. Targets that
    * would otherwise be ambiguous after object detection get explicit badges:
    * freestanding uses kit's private STANDALONE byte, and FreeBSD uses the
    * standard FreeBSD OSABI so `kit ld` can select FreeBSD runtime/link policy
    * from a plain relocatable input.
    *
    * GNU extensions (STT_GNU_IFUNC, SHF_GNU_RETAIN, ...) upgrade Linux/SysV and
    * freestanding objects to ELFOSABI_GNU below. FreeBSD keeps its OSABI badge;
    * GNU-flavored symbol/section kinds do not make the target Linux. */
   {
     Compiler* osc = obj_compiler(ob);
     if (osc && osc->target.os == KIT_OS_FREESTANDING)
       ident[EI_OSABI] = ELFOSABI_STANDALONE;
     else if (osc && osc->target.os == KIT_OS_FREEBSD)
       ident[EI_OSABI] = ELFOSABI_FREEBSD;
     else
       ident[EI_OSABI] = ELFOSABI_NONE;
   }
   {
     ObjSymIter* it = obj_symiter_new(ob);
     ObjSymEntry e;
     u32 nsec = obj_section_count(ob), si;
     while (obj_symiter_next(it, &e)) {
       if (e.sym->removed) continue;
       if (e.sym->kind == SK_IFUNC) {
         if (ident[EI_OSABI] != ELFOSABI_FREEBSD) ident[EI_OSABI] = ELFOSABI_GNU;
         break;
       }
     }
     obj_symiter_free(it);
     if (ident[EI_OSABI] != ELFOSABI_GNU &&
         ident[EI_OSABI] != ELFOSABI_FREEBSD) {
       for (si = 1; si < nsec; ++si) {
         const Section* sec = obj_section_get(ob, si);
         if (sec && !sec->removed && (sec->flags & SF_RETAIN)) {
           ident[EI_OSABI] = ELFOSABI_GNU;
           break;
         }
       }
     }
   }
   /* e_flags: prefer the value preserved from a prior read (round-trip);
    * else synthesize a sensible per-arch default. RV64 kit targets the
    * Linux psABI's lp64d soft-relax convention (RVC + double-float ABI). */
   u32 e_flags;
   if (!obj_get_elf_e_flags(ob, &e_flags)) {
     e_flags = elf->e_flags;
     /* rv32 (ptr_size 4): ilp32 and ilp32f share KIT_ARCH_RV32, so the static
      * descriptor's float-ABI bits (a placeholder SINGLE) cannot be right for
      * both. Derive them from -mabi (float_abi); RVC and other descriptor bits
      * are kept. rv64 (ptr_size 8) is left untouched, preserving its e_flags. */
     if (e_machine == EM_RISCV) {
       Compiler* ec = obj_compiler(ob);
       if (ec && ec->target.ptr_size == 4u) {
         u32 fa = EF_RISCV_FLOAT_ABI_SOFT;
         if (ec->target.float_abi == KIT_FLOAT_ABI_SINGLE)
           fa = EF_RISCV_FLOAT_ABI_SINGLE;
         else if (ec->target.float_abi == KIT_FLOAT_ABI_DOUBLE)
           fa = EF_RISCV_FLOAT_ABI_DOUBLE;
         else if (ec->target.float_abi == KIT_FLOAT_ABI_DEFAULT)
           fa = EF_RISCV_FLOAT_ABI_SINGLE; /* rv32 default profile is ilp32f */
         e_flags = (e_flags & ~(u32)EF_RISCV_FLOAT_ABI_MASK) | fa;
       }
     }
   }
 
   kit_writer_seek(w, 0);
   kit_writer_write(w, ident, EI_NIDENT);
   elf_wr_u16(w, ET_REL);
   elf_wr_u16(w, (u16)e_machine);
   elf_wr_u32(w, EV_CURRENT);
   /* e_entry/e_phoff/e_shoff are native-width (4B on ELF32, 8B on ELF64);
    * the field ORDER is identical, only the widths shrink. */
   elf_wr_addr(w, is32, 0);          /* e_entry */
   elf_wr_addr(w, is32, 0);          /* e_phoff */
   elf_wr_addr(w, is32, e_shoff);    /* e_shoff */
   elf_wr_u32(w, e_flags);           /* e_flags */
   elf_wr_u16(w, (u16)ehdr_size);    /* e_ehsize */
   elf_wr_u16(w, 0);                 /* e_phentsize */
   elf_wr_u16(w, 0);                 /* e_phnum */
   elf_wr_u16(w, (u16)shdr_size);    /* e_shentsize */
   elf_wr_u16(w, (u16)nsecs);        /* e_shnum */
   elf_wr_u16(w, (u16)idx_shstrtab); /* e_shstrndx */
 
   /* ---- pass 7: write each section's bytes ------------------------- */
 
   for (u32 i = 1; i < nsecs; ++i) {
     ElfSec* es = &secs[i];
     if (es->is_nobits || es->sh_size == 0) continue;
     kit_writer_seek(w, es->sh_offset);
     if (es->obj_bytes) {
       u32 sz = es->obj_bytes->total;
       u8* tmp = (u8*)h->alloc(h, sz ? sz : 1, 1);
       if (sz) buf_flatten(es->obj_bytes, tmp);
       kit_writer_write(w, tmp, sz);
       h->free(h, tmp, sz ? sz : 1);
     } else if (es->raw_bytes) {
       kit_writer_write(w, es->raw_bytes, (size_t)es->sh_size);
     }
   }
 
   /* ---- pass 8: write section header table ------------------------- */
 
   kit_writer_seek(w, e_shoff);
   for (u32 i = 0; i < nsecs; ++i) {
     const ElfSec* es = &secs[i];
     /* Elf32_Shdr (40B) and Elf64_Shdr (64B) share field ORDER; only
      * sh_flags/sh_addr/sh_offset/sh_size/sh_addralign/sh_entsize narrow
      * from u64 to u32 under is32. */
     elf_wr_u32(w, es->sh_name);
     elf_wr_u32(w, es->sh_type);
     elf_wr_addr(w, is32, es->sh_flags);
     elf_wr_addr(w, is32, es->sh_addr);
     elf_wr_addr(w, is32, es->sh_offset);
     elf_wr_addr(w, is32, es->sh_size);
     elf_wr_u32(w, es->sh_link);
     elf_wr_u32(w, es->sh_info);
     elf_wr_addr(w, is32, es->sh_addralign);
     elf_wr_addr(w, is32, es->sh_entsize);
   }
 }