kit

link_dyn.c (53975B)

---

 /* Phase 4 of dynamic linking: synthesize the dyn-link tables and
  * sections an ET_DYN ELF exe needs to be loadable by a real runtime
  * loader (musl ld-musl-aarch64.so.1).
  *
  * Inputs (computed by earlier passes):
  *   - LinkSymbol entries with `imported = 1` (set by resolve_undefs's
  *     DSO-search path; their dso_input_id names the providing DSO).
  *   - LinkInputs of kind LINK_INPUT_DSO_BYTES carrying SONAMEs.
  *
  * Outputs (deposited on LinkImage.dyn):
  *   - .interp                    PT_INTERP target string
  *   - .dynsym + .dynstr          symbol table + name pool
  *   - .gnu.hash                  GNU-style hash for the loader
  *   - .rela.dyn                  GLOB_DAT (data imports) + space for
  *                                R_AARCH64_RELATIVE records that
  *                                Phase 6 emit fills in
  *   - .rela.plt                  JUMP_SLOT records (one per imported func)
  *   - .plt                       allocated, body NOT emitted (Phase 5)
  *   - .got.plt                   3 reserved slots + 1 per PLT slot,
  *                                allocated, body NOT emitted
  *   - .dynamic                   PT_DYNAMIC body, populated
  *
  * The .plt body / GOT-slot fill / CALL26 reloc rewriting are Phase 5;
  * they're called out at the relevant allocation site so the missing
  * pieces are obvious to anyone reading the output. The static-exe path
  * is unaffected — layout_dyn early-outs when emit_pie is 0.
  *
  * Allocator pattern follows layout_iplt (link_layout.c): grow segments
  * + sections via realloc, then page-align each new segment after the
  * existing image span. Synthetic sections carry input_id == LINK_INPUT_NONE
  * so downstream passes (emit_reloc_records, GC) leave them alone.
  */
 
 #include "obj/elf/link_dyn.h"
 
 #include <string.h>
 
 #include "core/bytes.h"
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/util.h"
 #include "core/vec.h"
 #include "link/link.h"
 #include "link/link_arch.h"
 #include "link/link_internal.h"
 #include "link/link_reloc_desc.h"
 #include "obj/bytebuf.h"
 #include "obj/elf/elf.h"
 #include "obj/format.h"
 
 /* ---- small allocators (mirror layout_iplt's helpers) ---- */
 
 static u32 dyn_alloc_segments(LinkImage* img, u32 nseg) {
   Heap* h = img->heap;
   u32 base = img->nsegments;
   u32 new_nseg = base + nseg;
   LinkSegment* nsegs = (LinkSegment*)h->realloc(
       h, img->segments, sizeof(*img->segments) * img->nsegments,
       sizeof(*img->segments) * new_nseg, _Alignof(LinkSegment));
   u8** nsbufs = (u8**)h->realloc(
       h, img->segment_bytes, sizeof(*img->segment_bytes) * img->nsegments,
       sizeof(*img->segment_bytes) * new_nseg, _Alignof(u8*));
   size_t* nscaps = (size_t*)h->realloc(
       h, img->segment_bytes_cap,
       sizeof(*img->segment_bytes_cap) * img->nsegments,
       sizeof(*img->segment_bytes_cap) * new_nseg, _Alignof(size_t));
   if (!nsegs || !nsbufs || !nscaps)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on dyn segments");
   img->segments = nsegs;
   img->segment_bytes = nsbufs;
   img->segment_bytes_cap = nscaps;
   return base;
 }
 
 static u32 dyn_alloc_sections(LinkImage* img, u32 nsec) {
   Heap* h = img->heap;
   u32 base = img->nsections;
   u32 new_nsec = base + nsec;
   LinkSection* nsections = (LinkSection*)h->realloc(
       h, img->sections, sizeof(*img->sections) * img->nsections,
       sizeof(*img->sections) * new_nsec, _Alignof(LinkSection));
   if (!nsections)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on dyn sections");
   img->sections = nsections;
   return base;
 }
 
 /* The .dynstr / .gnu.hash byte-builder is the shared ObjByteBuf (objbb_*). */
 
 /* ---- GNU-hash computation (psABI v1 hash) ----
  * Body layout:
  *   u32 nbuckets
  *   u32 symoffset              (first hashed dynsym index)
  *   u32 bloom_size              (in 64-bit words)
  *   u32 bloom_shift
  *   u64 bloom[bloom_size]
  *   u32 buckets[nbuckets]
  *   u32 chains[ndynsym - symoffset]
  *
  * For Phase 4 we keep this very small: nbuckets = max(1, n/2),
  * bloom_size = 1, bloom_shift = 6 (64-bit ELFCLASS64). All hashed
  * symbols (sym_offset..ndynsym-1) participate in bloom + buckets +
  * chains. Slot 0..symoffset-1 are STN_UNDEF + locals, which the
  * loader doesn't hash. */
 
 static u32 gnu_hash_name(const char* s, u32 n) {
   /* h = 5381; for c in s: h = h * 33 + c */
   u32 h = 5381u;
   u32 i;
   for (i = 0; i < n; ++i) h = (h * 33u) + (u8)s[i];
   return h;
 }
 
 /* ---- partition: enumerate imports ----
  *
  * Walks LinkSyms and collects each `imported` symbol that's the
  * canonical entry in img->globals (resolve_undefs may stamp `imported`
  * onto multiple shadow slots of the same name; only the canonical one
  * lands in dynsym). The two output arrays are LinkSymIds: funcs first
  * (PLT-bound), then data (GOT-bound via GLOB_DAT). */
 
 typedef struct ImportLists {
   LinkSymId* exports;
   LinkSymId* funcs;
   u32 nfuncs;
   LinkSymId* datas;
   u32 ndatas;
   u32 nexports;
 } ImportLists;
 
 static int sym_is_func_import(const LinkSymbol* s) {
   /* Most undef shadows have kind = SK_UNDEF (the obj reader keys kind
    * off shndx, not STT_*).  Only useful when the canonical entry
    * carried a real type — fall through to the DSO lookup otherwise. */
   return s->kind == SK_FUNC || s->kind == SK_IFUNC;
 }
 
 /* Resolve an import's classifier kind by consulting its providing
  * DSO's dynsym.  read_elf_dso preserves STT_FUNC / STT_OBJECT / etc.
  * on each defined export; the consumer's undef may have arrived as
  * SK_UNDEF (clang emits external refs as SHN_UNDEF, which the reader
  * collapses to SK_UNDEF regardless of STT_*).  Returns 1 for func /
  * ifunc, 0 for everything else (or if the DSO export is missing). */
 static int dso_export_is_func(Linker* l, const LinkSymbol* s) {
   if (s->dso_input_id == LINK_INPUT_NONE) return 0;
   if (s->dso_input_id - 1u >= LinkInputs_count(&l->inputs)) return 0;
   LinkInput* in = LinkInputs_at(&l->inputs, s->dso_input_id - 1u);
   if (!in->obj) return 0;
   ObjSymIter* it = obj_symiter_new(in->obj);
   ObjSymEntry e;
   int is_func = 0;
   while (obj_symiter_next(it, &e)) {
     const ObjSym* es = e.sym;
     if (!es || es->name != s->name) continue;
     if (es->kind == SK_UNDEF) continue;
     is_func = (es->kind == SK_FUNC || es->kind == SK_IFUNC);
     break;
   }
   obj_symiter_free(it);
   return is_func;
 }
 
 static int import_has_branch_reloc(Linker* l, LinkImage* img,
                                    const LinkSymbol* s) {
   u32 i;
   if (!l || !img || !s || s->name == 0) return 0;
   for (i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     const LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     const LinkSymbol* tgt;
     if (!reloc_kind_is_branch(l->c, r->kind)) continue;
     if (r->target == LINK_SYM_NONE) continue;
     tgt = LinkSyms_at(&img->syms, r->target - 1);
     if (!tgt || !tgt->imported || tgt->name != s->name) continue;
     return 1;
   }
   return 0;
 }
 
 static void collect_imports(Linker* l, LinkImage* img, Heap* h,
                             ImportLists* il) {
   u32 i;
   u32 cap_e = 0, cap_f = 0, cap_d = 0;
   il->exports = NULL;
   il->funcs = NULL;
   il->datas = NULL;
   il->nexports = il->nfuncs = il->ndatas = 0;
   for (i = 0; i < LinkSyms_count(&img->syms); ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (s->name == 0) continue;
     /* Only the canonical (img->globals) entry per name. */
     LinkSymId canonical = symhash_get(&img->globals, s->name);
     if (canonical != LINK_SYM_NONE && canonical != s->id) continue;
     if (s->defined && !s->imported &&
         (s->bind == SB_GLOBAL || s->bind == SB_WEAK) && s->kind != SK_FILE &&
         s->kind != SK_SECTION && s->vis != SV_HIDDEN &&
         s->vis != SV_INTERNAL) {
       if (VEC_GROW(h, il->exports, cap_e, il->nexports + 1u))
         compiler_panic(img->c, SRCLOC_NONE, "link: oom on exports");
       il->exports[il->nexports++] = s->id;
       continue;
     }
     if (!s->imported) continue;
     int is_func = sym_is_func_import(s) || dso_export_is_func(l, s) ||
                   import_has_branch_reloc(l, img, s);
     if (is_func) {
       if (VEC_GROW(h, il->funcs, cap_f, il->nfuncs + 1u))
         compiler_panic(img->c, SRCLOC_NONE, "link: oom on import-funcs");
       il->funcs[il->nfuncs++] = s->id;
     } else {
       if (VEC_GROW(h, il->datas, cap_d, il->ndatas + 1u))
         compiler_panic(img->c, SRCLOC_NONE, "link: oom on import-datas");
       il->datas[il->ndatas++] = s->id;
     }
   }
 }
 
 static void free_imports(Heap* h, ImportLists* il) {
   if (il->exports) h->free(h, il->exports, sizeof(*il->exports) * il->nexports);
   if (il->funcs) h->free(h, il->funcs, sizeof(*il->funcs) * il->nfuncs);
   if (il->datas) h->free(h, il->datas, sizeof(*il->datas) * il->ndatas);
 }
 
 /* ---- DT_NEEDED set: each DSO input that contributed at least one
  * import. Order is input order so the loader sees deps in declaration
  * order. */
 static void collect_needed(Linker* l, LinkImage* img, LinkDynState* dyn) {
   Heap* h = img->heap;
   u8* used;
   u32 ninputs = LinkInputs_count(&l->inputs);
   u32 i, nused = 0;
 
   used = (u8*)h->alloc(h, ninputs ? ninputs : 1u, 1);
   if (!used) compiler_panic(img->c, SRCLOC_NONE, "link: oom on needed map");
   memset(used, 0, ninputs ? ninputs : 1u);
 
   /* Mark every DSO that ended up satisfying at least one import. */
   for (i = 0; i < LinkSyms_count(&img->syms); ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (!s->imported) continue;
     if (s->dso_input_id == LINK_INPUT_NONE) continue;
     if (s->dso_input_id - 1u >= ninputs) continue;
     used[s->dso_input_id - 1u] = 1;
   }
   /* Always pull every explicitly-supplied DSO into DT_NEEDED, even if
    * no import landed on it — matches GNU ld without --as-needed.
    * Phase 4 doesn't plumb --as-needed through to the resolver, so the
    * default "needed" behavior is the right baseline. */
   for (i = 0; i < ninputs; ++i) {
     LinkInput* in = LinkInputs_at(&l->inputs, i);
     if (in->kind == LINK_INPUT_DSO_BYTES && in->soname != 0) used[i] = 1;
   }
   for (i = 0; i < ninputs; ++i)
     if (used[i]) ++nused;
 
   dyn->needed =
       nused ? (Sym*)h->alloc(h, sizeof(Sym) * nused, _Alignof(Sym)) : NULL;
   if (nused && !dyn->needed)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on needed list");
   dyn->nneeded = 0;
   for (i = 0; i < ninputs; ++i) {
     LinkInput* in = LinkInputs_at(&l->inputs, i);
     if (!used[i]) continue;
     if (in->soname == 0) continue;
     dyn->needed[dyn->nneeded++] = in->soname;
   }
   h->free(h, used, ninputs ? ninputs : 1u);
 }
 
 /* ---- dynsym + dynstr build ----
  *
  * Slot 0: STN_UNDEF (zero entry). The loader ignores names with index
  * 0; we still emit a dynstr entry at offset 0 (the leading NUL).
  *
  * Slots 1..nexports: executable-defined globals exported for DSO lookup.
  * Slots after exports: imported symbols (functions first, then data).
  * st_shndx = SHN_UNDEF; the loader fills in the value at bind time.
  * st_value/size are zero — the static linker has no value for an
  * imported symbol.
  *
  * Defined executable globals must be present too: ELF DSOs can resolve
  * references back to the main executable, and FreeBSD libc depends on that
  * for Scrt1.o's `environ` and `__progname` definitions. */
 
 static void build_dynsym(LinkImage* img, LinkDynState* dyn,
                          const ImportLists* il, ObjByteBuf* dynstr) {
   Heap* h = img->heap;
   u32 nimports = il->nfuncs + il->ndatas;
   u32 ndynsym = 1u + il->nexports + nimports; /* +1 for null slot */
   u32 i;
 
   dyn->ndynsym = ndynsym;
   dyn->dynsym = (DynSymRec*)h->alloc(h, sizeof(*dyn->dynsym) * ndynsym,
                                      _Alignof(DynSymRec));
   if (!dyn->dynsym) compiler_panic(img->c, SRCLOC_NONE, "link: oom on dynsym");
   memset(dyn->dynsym, 0, sizeof(*dyn->dynsym) * ndynsym);
 
   /* Slot 0: STN_UNDEF. dynstr leads with a NUL so st_name=0 reads as
    * the empty string. */
   {
     u8 z = 0;
     objbb_append(dynstr, &z, 1);
   }
 
   /* Per-symbol: dedupe `sym_dynidx` lookup table. Sized to LinkSymId
    * upper bound. Clean (zero-filled) by alloc convention; we set
    * indices for imports below. */
   dyn->sym_dynidx_size = LinkSyms_count(&img->syms) + 1u;
   dyn->sym_dynidx = (u32*)h->alloc(
       h, sizeof(*dyn->sym_dynidx) * dyn->sym_dynidx_size, _Alignof(u32));
   if (!dyn->sym_dynidx)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on sym_dynidx");
   memset(dyn->sym_dynidx, 0, sizeof(*dyn->sym_dynidx) * dyn->sym_dynidx_size);
   /* sym_plt_vaddr is populated alongside the PLT body emit below; here
    * we only allocate the parallel array. */
   dyn->sym_plt_vaddr = (u64*)h->alloc(
       h, sizeof(*dyn->sym_plt_vaddr) * dyn->sym_dynidx_size, _Alignof(u64));
   if (!dyn->sym_plt_vaddr)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on sym_plt_vaddr");
   memset(dyn->sym_plt_vaddr, 0,
          sizeof(*dyn->sym_plt_vaddr) * dyn->sym_dynidx_size);
 
   /* All dynamic entries we emit today are non-local, so first_global is
    * right after the single STN_UNDEF slot. */
   dyn->first_global = 1u;
 
   u32 idx = 1u;
   for (i = 0; i < il->nexports; ++i) {
     LinkSymId lsid = il->exports[i];
     LinkSymbol* s = LinkSyms_at(&img->syms, lsid - 1);
     DynSymRec* r = &dyn->dynsym[idx];
     Slice nm_s = pool_slice(img->c->global, s->name);
     const char* nm = nm_s.s;
     size_t namelen = nm_s.len;
     u8 elf_type = elf_st_type(s->kind);
     u8 elf_bind = elf_st_bind(s->bind);
     r->st_name = objbb_append_str(dynstr, nm, (u32)namelen);
     r->st_info = ELF64_ST_INFO(elf_bind, elf_type);
     r->st_other = elf_st_other(s->vis);
     /* The emitter refreshes defined-symbol values after the final header
      * shift. Any nonzero, non-special section index is enough for rtld to
      * treat the symbol as defined; section headers are not part of runtime
      * loading. */
     r->st_shndx = 1;
     r->st_value = s->vaddr;
     r->st_size = s->size;
     dyn->sym_dynidx[lsid] = idx;
     ++idx;
   }
   for (i = 0; i < il->nfuncs; ++i) {
     LinkSymId lsid = il->funcs[i];
     LinkSymbol* s = LinkSyms_at(&img->syms, lsid - 1);
     DynSymRec* r = &dyn->dynsym[idx];
     Slice nm_s = pool_slice(img->c->global, s->name);
     const char* nm = nm_s.s;
     size_t namelen = nm_s.len;
     r->st_name = objbb_append_str(dynstr, nm, (u32)namelen);
     r->st_info = ELF64_ST_INFO(STB_GLOBAL, STT_FUNC);
     r->st_other = elf_st_other(s->vis);
     r->st_shndx = SHN_UNDEF;
     r->st_value = 0;
     r->st_size = 0;
     dyn->sym_dynidx[lsid] = idx;
     ++idx;
   }
   for (i = 0; i < il->ndatas; ++i) {
     LinkSymId lsid = il->datas[i];
     LinkSymbol* s = LinkSyms_at(&img->syms, lsid - 1);
     DynSymRec* r = &dyn->dynsym[idx];
     Slice nm_s = pool_slice(img->c->global, s->name);
     const char* nm = nm_s.s;
     size_t namelen = nm_s.len;
     u8 elf_type = STT_OBJECT;
     if (s->kind == SK_TLS)
       elf_type = STT_TLS;
     else if (s->kind == SK_NOTYPE)
       elf_type = STT_NOTYPE;
     r->st_name = objbb_append_str(dynstr, nm, (u32)namelen);
     r->st_info = ELF64_ST_INFO(STB_GLOBAL, elf_type);
     r->st_other = elf_st_other(s->vis);
     r->st_shndx = SHN_UNDEF;
     r->st_value = 0;
     r->st_size = 0;
     dyn->sym_dynidx[lsid] = idx;
     ++idx;
   }
 }
 
 /* ---- GNU symbol versioning (.gnu.version + .gnu.version_r) ----
  *
  * For each imported symbol that binds to a versioned DSO export, require that
  * export's *default* version (read into ObjImageSym.version at input time) so
  * the runtime binds the right one. On FreeBSD this is mandatory: the INO64
  * transition left `stat`/`fstat`/... as two incompatible struct-stat ABIs, the
  * compat behind a hidden FBSD_1.0 and the modern one as the default FBSD_1.5;
  * an unversioned reference binds the compat and reads st_size at the wrong
  * offset. We emit:
  *   .gnu.version   — one u16 per .dynsym entry: 0 (null/unversioned import),
  *                    1 (defined export), or >=2 (a version requirement index).
  *   .gnu.version_r — Verneed per DT_NEEDED soname + Vernaux per required
  *                    version, numbered 2.. in first-seen order.
  * Both reference only .dynstr offsets and indices (no vaddrs), so the bytes are
  * final at layout time. Nothing is emitted when no import is versioned, leaving
  * musl/glibc-without-version and static links byte-for-byte unchanged. */
 
 static u32 elf_sysv_hash(const char* s, u32 n) {
   u32 h = 0, g, i;
   for (i = 0; i < n; ++i) {
     h = (h << 4) + (u8)s[i];
     g = h & 0xf0000000u;
     if (g) h ^= g >> 24;
     h &= ~g;
   }
   return h;
 }
 
 /* Default version name the DSO `in` exports for `name`, or 0 if `in` carries no
  * versioning / doesn't export `name` with a default version. */
 static Sym dso_default_version(LinkInput* in, Sym name) {
   const ObjImage* im = in->obj ? obj_image(in->obj) : NULL;
   u32 i, n;
   if (!im) return 0;
   n = obj_image_ndynsyms(im);
   for (i = 0; i < n; ++i) {
     const ObjImageSym* s = obj_image_dynsym(im, i);
     if (s->name == name && s->version != 0 && !s->version_hidden)
       return s->version;
   }
   return 0;
 }
 
 typedef struct VerReq {
   Sym soname;
   Sym version;
   u16 index;
 } VerReq;
 
 typedef struct VerBuild {
   Heap* h;
   Linker* l;
   LinkImage* img;
   LinkDynState* dyn;
   u8* vs; /* versym bytes being filled */
   VerReq* reqs;
   u32 nreq;
   u32 capreq;
 } VerBuild;
 
 /* Resolve one imported symbol's version requirement: explicit name@VERSION
  * imports keep that requested version on LinkSymbol; plain imports use the
  * providing DSO's default version for the name. The chosen (soname, version)
  * pair is interned as a requirement and stamped into the symbol's versym slot. */
 static void ver_process_import(VerBuild* vb, LinkSymId lsid) {
   LinkSymbol* s = LinkSyms_at(&vb->img->syms, lsid - 1);
   u32 di = vb->dyn->sym_dynidx[lsid];
   LinkInput* in;
   Sym ver;
   u16 vidx = 0;
   u32 r;
   if (!di || s->dso_input_id == LINK_INPUT_NONE) return;
   if (s->dso_input_id - 1u >= LinkInputs_count(&vb->l->inputs)) return;
   in = LinkInputs_at(&vb->l->inputs, s->dso_input_id - 1u);
   if (in->soname == 0) return;
   ver = s->elf_version ? s->elf_version : dso_default_version(in, s->name);
   if (ver == 0) return;
   for (r = 0; r < vb->nreq; ++r)
     if (vb->reqs[r].soname == in->soname && vb->reqs[r].version == ver) {
       vidx = vb->reqs[r].index;
       break;
     }
   if (!vidx) {
     if (VEC_GROW(vb->h, vb->reqs, vb->capreq, vb->nreq + 1u))
       compiler_panic(vb->img->c, SRCLOC_NONE, "link: oom on version reqs");
     vidx = (u16)(2u + vb->nreq);
     vb->reqs[vb->nreq].soname = in->soname;
     vb->reqs[vb->nreq].version = ver;
     vb->reqs[vb->nreq].index = vidx;
     vb->nreq++;
   }
   wr_u16_le(vb->vs + (u64)di * 2u, vidx);
 }
 
 static void build_versions(Linker* l, LinkImage* img, LinkDynState* dyn,
                            const ImportLists* il, ObjByteBuf* dynstr) {
   Heap* h = img->heap;
   VerBuild vb;
   u32 i;
 
   dyn->versym = NULL;
   dyn->versym_len = 0;
   dyn->verneed = NULL;
   dyn->verneed_len = 0;
   dyn->nverneed = 0;
   if (dyn->ndynsym == 0) return;
 
   /* versym: default 0 (local/unversioned); defined exports -> GLOBAL. */
   vb.h = h;
   vb.l = l;
   vb.img = img;
   vb.dyn = dyn;
   vb.reqs = NULL;
   vb.nreq = 0;
   vb.capreq = 0;
   vb.vs = (u8*)h->alloc(h, (size_t)dyn->ndynsym * 2u, 2);
   if (!vb.vs) compiler_panic(img->c, SRCLOC_NONE, "link: oom on versym");
   memset(vb.vs, 0, (size_t)dyn->ndynsym * 2u);
   for (i = 0; i < il->nexports; ++i) {
     u32 di = dyn->sym_dynidx[il->exports[i]];
     if (di) wr_u16_le(vb.vs + (u64)di * 2u, (u16)VER_NDX_GLOBAL);
   }
   for (i = 0; i < il->nfuncs; ++i) ver_process_import(&vb, il->funcs[i]);
   for (i = 0; i < il->ndatas; ++i) ver_process_import(&vb, il->datas[i]);
 
   if (vb.nreq == 0) {
     /* No versioned imports: emit nothing, keep the link unchanged. */
     h->free(h, vb.vs, (size_t)dyn->ndynsym * 2u);
     if (vb.reqs) h->free(h, vb.reqs, sizeof(*vb.reqs) * vb.capreq);
     return;
   }
   dyn->versym = vb.vs;
   dyn->versym_len = dyn->ndynsym * 2u;
 
   /* Group requirements by soname (first-seen order) into Verneed/Vernaux. */
   {
     Sym* sonames = NULL;
     u32 nson = 0, capson = 0;
     u32 r;
     for (r = 0; r < vb.nreq; ++r) {
       u32 k;
       int seen = 0;
       for (k = 0; k < nson; ++k)
         if (sonames[k] == vb.reqs[r].soname) {
           seen = 1;
           break;
         }
       if (!seen) {
         if (VEC_GROW(h, sonames, capson, nson + 1u))
           compiler_panic(img->c, SRCLOC_NONE, "link: oom on verneed sonames");
         sonames[nson++] = vb.reqs[r].soname;
       }
     }
     {
       u32 total =
           nson * (u32)ELF_VERNEED_SIZE + vb.nreq * (u32)ELF_VERNAUX_SIZE;
       u8* vn = (u8*)h->alloc(h, total, 4);
       u8* p;
       u32 si;
       if (!vn) compiler_panic(img->c, SRCLOC_NONE, "link: oom on verneed");
       memset(vn, 0, total);
       p = vn;
       for (si = 0; si < nson; ++si) {
         Slice so_s = pool_slice(l->c->global, sonames[si]);
         u32 file_off = objbb_append_str(dynstr, so_s.s, (u32)so_s.len);
         u8* vn_rec = p;
         u32 cnt = 0;
         u8* aux;
         p += ELF_VERNEED_SIZE;
         aux = p;
         for (r = 0; r < vb.nreq; ++r) {
           Slice ver_s;
           u32 name_off;
           if (vb.reqs[r].soname != sonames[si]) continue;
           ver_s = pool_slice(l->c->global, vb.reqs[r].version);
           name_off = objbb_append_str(dynstr, ver_s.s, (u32)ver_s.len);
           wr_u32_le(p + 0,
                     elf_sysv_hash(ver_s.s, (u32)ver_s.len)); /* vna_hash */
           wr_u16_le(p + 4, 0);                               /* vna_flags */
           wr_u16_le(p + 6, vb.reqs[r].index);                /* vna_other */
           wr_u32_le(p + 8, name_off);                        /* vna_name */
           /* vna_next: filled after we know if another aux follows. */
           p += ELF_VERNAUX_SIZE;
           ++cnt;
         }
         /* Verneed header. vn_aux is the byte offset to the first Vernaux. */
         wr_u16_le(vn_rec + 0, 1);                   /* vn_version */
         wr_u16_le(vn_rec + 2, (u16)cnt);            /* vn_cnt */
         wr_u32_le(vn_rec + 4, file_off);            /* vn_file */
         wr_u32_le(vn_rec + 8, (u32)(aux - vn_rec)); /* vn_aux */
         wr_u32_le(vn_rec + 12,
                   si + 1u < nson ? (u32)(p - vn_rec) : 0u); /* vn_next */
         /* Link the Vernaux chain (each entry -> next, last -> 0). */
         {
           u8* a = aux;
           u32 j;
           for (j = 0; j < cnt; ++j) {
             wr_u32_le(a + 12, j + 1u < cnt ? (u32)ELF_VERNAUX_SIZE : 0u);
             a += ELF_VERNAUX_SIZE;
           }
         }
       }
       dyn->verneed = vn;
       dyn->verneed_len = total;
       dyn->nverneed = nson;
     }
     if (sonames) h->free(h, sonames, sizeof(*sonames) * capson);
   }
   if (vb.reqs) h->free(h, vb.reqs, sizeof(*vb.reqs) * vb.capreq);
 }
 
 /* ---- .gnu.hash builder ----
  *
  * Hashed range is [first_global, ndynsym) — slot 0 (STN_UNDEF) is
  * unhashed. Layout matches loader expectations (musl, glibc, FreeBSD).
  *
  * Bucket count: one. That keeps the required chain ordering trivial even as
  * we mix executable exports and imports without sorting the dynsym table by
  * hash bucket. Bloom is 1 word for Phase 4 — a real implementation would
  * scale with hashed_count, but 1 word with shift=6 still satisfies the
  * loader's correctness check (false positives only cost a chain scan). */
 
 static void build_gnu_hash(Heap* h, LinkImage* img, LinkDynState* dyn,
                            const ObjByteBuf* dynstr) {
   u32 hashed = (dyn->ndynsym > dyn->first_global)
                    ? (dyn->ndynsym - dyn->first_global)
                    : 0u;
   u32 nbuckets = 1u;
   u32 bloom_size = 1u; /* 64-bit word */
   u32 bloom_shift = 6u;
   u32 sym_offset = dyn->first_global;
   u32 hdr_bytes = 16u; /* nbuckets/symoff/bloomsz/bloomshift */
   u32 bloom_bytes = bloom_size * 8u;
   u32 buckets_bytes = nbuckets * 4u;
   u32 chains_bytes = hashed * 4u;
   u32 total = hdr_bytes + bloom_bytes + buckets_bytes + chains_bytes;
 
   u8* buf = (u8*)h->alloc(h, total ? total : 1u, 4);
   if (!buf) compiler_panic(img->c, SRCLOC_NONE, "link: oom on .gnu.hash");
   memset(buf, 0, total);
 
   wr_u32_le(buf + 0, nbuckets);
   wr_u32_le(buf + 4, sym_offset);
   wr_u32_le(buf + 8, bloom_size);
   wr_u32_le(buf + 12, bloom_shift);
 
   /* Bloom + buckets + chains. We need each hashed symbol's hash. */
   if (hashed) {
     u32 i;
     u32* hashes = (u32*)h->alloc(h, sizeof(u32) * hashed, _Alignof(u32));
     if (!hashes)
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on .gnu.hash hashes");
     for (i = 0; i < hashed; ++i) {
       const DynSymRec* r = &dyn->dynsym[sym_offset + i];
       const char* name = (const char*)dynstr->data + r->st_name;
       size_t n = name ? slice_from_cstr(name).len : 0;
       hashes[i] = gnu_hash_name(name, (u32)n);
     }
 
     /* Bloom filter: H[i] / H[i] >> shift */
     u64 bloom = 0;
     for (i = 0; i < hashed; ++i) {
       u32 h1 = hashes[i] % 64u;
       u32 h2 = (hashes[i] >> bloom_shift) % 64u;
       bloom |= ((u64)1 << h1) | ((u64)1 << h2);
     }
     wr_u64_le(buf + hdr_bytes, bloom);
 
     /* Buckets/chains: for each hashed sym, append to its bucket's
      * chain. The chain encodes (hash & ~1) per entry; the LSB is set
      * on the LAST entry in a bucket to terminate. Buckets are filled
      * with the first chain index that hashes there (1-based into the
      * dynsym, i.e. `sym_offset + i`). */
     u32* buckets = (u32*)(buf + hdr_bytes + bloom_bytes);
     u32* chains = (u32*)(buf + hdr_bytes + bloom_bytes + buckets_bytes);
     /* First pass: bucket = first sym index that hashes there. */
     for (i = 0; i < hashed; ++i) {
       u32 b = hashes[i] % nbuckets;
       if (buckets[b] == 0) buckets[b] = sym_offset + i;
     }
     /* Second pass: chain[i] = hash with LSB cleared; LSB set if next
      * sym is in a different bucket. Walk symbols in order; LSB on
      * chain[i] when sym i+1 is in a different bucket OR is the end. */
     for (i = 0; i < hashed; ++i) {
       u32 v = hashes[i] & ~1u;
       int last = (i + 1 == hashed) ||
                  ((hashes[i + 1] % nbuckets) != (hashes[i] % nbuckets));
       if (last) v |= 1u;
       chains[i] = v;
     }
     h->free(h, hashes, sizeof(u32) * hashed);
   }
 
   dyn->gnu_hash = buf;
   dyn->gnu_hash_len = total;
 }
 
 /* ---- .dynamic body builder ----
  *
  * Computed at layout time so the size is known before segments are
  * placed. Each entry is two u64s (d_tag, d_un.d_val|d_un.d_ptr).
  * Final entry is DT_NULL. The d_ptr fields that point at other
  * synthetic sections are filled with image-relative vaddrs; the emit
  * pass adds load-base / IMAGE_BASE only when ET_EXEC. */
 
 typedef struct DynEntry {
   u64 tag;
   u64 val; /* either d_val or d_ptr; emit just writes 8 bytes */
 } DynEntry;
 
 static u32 count_dynamic_entries(const LinkDynState* dyn) {
   /* Required: DT_STRTAB DT_STRSZ DT_SYMTAB DT_SYMENT DT_GNU_HASH
    *           DT_FLAGS_1 (DF_1_NOW for eager binding)
    *           DT_NULL terminator
    * Optional (only when there are .rela.dyn records):
    *           DT_RELA DT_RELASZ DT_RELAENT
    * Optional (only when there are imported functions / a PLT):
    *           DT_PLTGOT DT_PLTRELSZ DT_PLTREL DT_JMPREL
    * Plus DT_NEEDED per dependency. */
   u32 n = dyn->nneeded;
   n += 7;                        /* 5 fixed + DT_FLAGS_1 + DT_NULL */
   if (dyn->soname) n += 1;
   n += dyn->nrpaths + dyn->nrunpaths;
   if (dyn->cap_rela_dyn) n += 3; /* DT_RELA + DT_RELASZ + DT_RELAENT */
   if (dyn->nrela_plt) n += 4;    /* PLT-only entries */
   if (dyn->nverneed) n += 3;     /* DT_VERSYM + DT_VERNEED + DT_VERNEEDNUM */
   return n;
 }
 
 /* ---- main entry ---- */
 
 void layout_dyn(Linker* l, LinkImage* img) {
   Heap* h = img->heap;
   LinkDynState* dyn;
   LinkDynState dyn_probe;
   ImportLists imports;
   ObjByteBuf dynstr;
   u64 page;
   const LinkArchDesc* arch;
   const ObjElfArchOps* elf_arch;
 
   if (!l->emit_pie && !l->emit_shared) return;
 
   /* The dynamic-section layout below is ELF64-only (Elf64_Sym/Dyn/Rela wire
    * sizes, 8-byte GOT slots). rv32 is a static-only v1 target, so a dynamic /
    * PIE rv32 link is unsupported — fail with a clear diagnostic instead of
    * crashing on the ELF64 assumptions. Link rv32 images statically (kit ld
    * -no-pie, or a -T script for bare-metal section placement). */
   if (img->c->target.ptr_size == 4u) {
     compiler_panic(img->c, SRCLOC_NONE,
                    "link: dynamic/PIE linking is not supported for 32-bit "
                    "RISC-V (ELFCLASS32); link statically (kit ld -no-pie)");
   }
 
   arch = link_arch_desc_for(l->c);
   if (!arch)
     compiler_panic(img->c, SRCLOC_NONE, "link: layout_dyn: no arch descriptor");
   {
     const ObjFormatImpl* fmt = obj_format_lookup(KIT_OBJ_ELF);
     elf_arch = fmt && fmt->elf_arch ? fmt->elf_arch(l->c->target.arch) : NULL;
     if (!elf_arch)
       compiler_panic(img->c, SRCLOC_NONE,
                      "link: layout_dyn: no ELF arch descriptor");
   }
 
   /* Step 1: enumerate imports + DT_NEEDED. A PIE with no imports and no
    * DSO inputs is effectively static; keep ET_DYN output but do not stamp
    * PT_INTERP/PT_DYNAMIC or an empty .dynamic section. */
   memset(&dyn_probe, 0, sizeof dyn_probe);
   collect_imports(l, img, h, &imports);
   collect_needed(l, img, &dyn_probe);
   if (!l->emit_shared && l->emit_static_exe && imports.nfuncs == 0 &&
       imports.ndatas == 0 &&
       dyn_probe.nneeded == 0) {
     img->pie = 1;
     free_imports(h, &imports);
     return;
   }
 
   dyn = (LinkDynState*)h->alloc(h, sizeof(*dyn), _Alignof(LinkDynState));
   if (!dyn) compiler_panic(img->c, SRCLOC_NONE, "link: oom on dyn state");
   *dyn = dyn_probe;
   img->dyn = dyn;
   img->pie = l->emit_pie ? 1 : 0;
   img->shared = l->emit_shared ? 1 : 0;
 
   /* PT_INTERP path. Default to the canonical musl loader matching the
    * target arch (per-arch table in src/arch/<arch>/link.c) when the caller
    * didn't set one. Drivers like kit-cc always override via
    * link_set_interp_path; this default is correctness for direct
    * libkit consumers.  glibc users have to set their interp
    * explicitly — we don't pick a default for them. */
   if (!l->emit_shared) {
     dyn->interp_path =
         l->interp_path
             ? l->interp_path
             : pool_intern_slice(l->c->global,
                                 slice_from_cstr(elf_arch->default_musl_interp));
   }
   if (l->soname.s && l->soname.len)
     dyn->soname = pool_intern_slice(l->c->global, l->soname);
   if (l->nrpaths) {
     u32 ri;
     dyn->rpaths =
         (Sym*)h->alloc(h, sizeof(*dyn->rpaths) * l->nrpaths, _Alignof(Sym));
     if (!dyn->rpaths) compiler_panic(img->c, SRCLOC_NONE, "link: oom on rpaths");
     dyn->nrpaths = l->nrpaths;
     for (ri = 0; ri < l->nrpaths; ++ri)
       dyn->rpaths[ri] = pool_intern_slice(l->c->global, l->rpaths[ri]);
   }
   if (l->nrunpaths) {
     u32 ri;
     dyn->runpaths = (Sym*)h->alloc(h, sizeof(*dyn->runpaths) * l->nrunpaths,
                                    _Alignof(Sym));
     if (!dyn->runpaths)
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on runpaths");
     dyn->nrunpaths = l->nrunpaths;
     for (ri = 0; ri < l->nrunpaths; ++ri)
       dyn->runpaths[ri] = pool_intern_slice(l->c->global, l->runpaths[ri]);
   }
 
   /* Step 2: build .dynstr + .dynsym. .dynstr must also carry the
    * DT_NEEDED soname strings the .dynamic body references; intern
    * them after the import names so build_dynsym's de-dup also covers
    * any name that happens to collide with a soname. */
   objbb_init(&dynstr, h);
   build_dynsym(img, dyn, &imports, &dynstr);
   {
     u32 ni;
     for (ni = 0; ni < dyn->nneeded; ++ni) {
       Slice s_s = pool_slice(l->c->global, dyn->needed[ni]);
       const char* s = s_s.s;
       size_t slen = s_s.len;
       if (s && slen) (void)objbb_append_str(&dynstr, s, (u32)slen);
     }
     if (dyn->soname) {
       Slice s_s = pool_slice(l->c->global, dyn->soname);
       if (s_s.s && s_s.len)
         (void)objbb_append_str(&dynstr, s_s.s, (u32)s_s.len);
     }
     for (ni = 0; ni < dyn->nrpaths; ++ni) {
       Slice s_s = pool_slice(l->c->global, dyn->rpaths[ni]);
       if (s_s.s && s_s.len)
         (void)objbb_append_str(&dynstr, s_s.s, (u32)s_s.len);
     }
     for (ni = 0; ni < dyn->nrunpaths; ++ni) {
       Slice s_s = pool_slice(l->c->global, dyn->runpaths[ni]);
       if (s_s.s && s_s.len)
         (void)objbb_append_str(&dynstr, s_s.s, (u32)s_s.len);
     }
   }
   /* Symbol versioning: assign per-import version requirements and append the
    * version strings ("FBSD_1.5", ...) to .dynstr. Must run before .dynstr is
    * finalized below; emits nothing when no import is versioned. */
   build_versions(l, img, dyn, &imports, &dynstr);
   dyn->dynstr = dynstr.data;
   dyn->dynstr_len = dynstr.len;
 
   /* Step 3: .gnu.hash. */
   build_gnu_hash(h, img, dyn, &dynstr);
 
   /* Step 4: pre-size all the synthetic sections.
    * .interp:      strlen + 1
    * .dynsym:      24 * ndynsym
    * .dynstr:      dynstr_len
    * .gnu.hash:    gnu_hash_len
    * .rela.dyn:    24 * (runtime GLOB_DAT + RELATIVE records)
    * .rela.plt:    24 * nfuncs
    * .plt:         32 + 16 * nfuncs   (PLT0 + per-slot)
    * .got.plt:     8 * (3 + nfuncs)
    * .dynamic:     16 * count_dynamic_entries
    */
   dyn->nplt = imports.nfuncs;
   dyn->nrela_plt = imports.nfuncs;
   dyn->rela_plt = imports.nfuncs
                       ? (DynRela*)h->alloc(h, sizeof(DynRela) * imports.nfuncs,
                                            _Alignof(DynRela))
                       : NULL;
   if (imports.nfuncs && !dyn->rela_plt)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on rela_plt");
 
   /* RELA dyn: GLOB_DAT (one per imported abs-relocated symbol) +
    * RELATIVE (one per PIE internal abs reloc against a defined sym).
    * Phase 5 emits these dynamically during reloc-apply; pre-count the
    * exact total here (img->relocs and the resolve-time `imported` flags
    * are already settled by the time layout_dyn runs) so the section
    * isn't padded with hundreds of trailing R_*_NONE records. */
   u32 cap_rel = 0;
   {
     u32 ri;
     for (ri = 0; ri < LinkRelocs_count(&img->relocs); ++ri) {
       const LinkRelocApply* r = LinkRelocs_at(&img->relocs, ri);
       const LinkSymbol* tgt = LinkSyms_at(&img->syms, r->target - 1);
       const LinkSection* sec;
       if (r->kind != R_ABS32 && r->kind != R_ABS64) continue;
       if (r->link_section_id == LINK_SEC_NONE ||
           r->link_section_id > img->nsections)
         continue;
       sec = &img->sections[r->link_section_id - 1];
       if (sec->segment_id == LINK_SEG_NONE || sec->file_only) continue;
       if (tgt->imported) {
         cap_rel++; /* GLOB_DAT */
       } else if (tgt->defined && tgt->kind != SK_ABS) {
         cap_rel++; /* RELATIVE */
       }
     }
   }
   dyn->cap_rela_dyn = cap_rel;
   dyn->rela_dyn =
       dyn->cap_rela_dyn
           ? (DynRela*)h->alloc(h, sizeof(DynRela) * dyn->cap_rela_dyn,
                                _Alignof(DynRela))
           : NULL;
   if (dyn->cap_rela_dyn && !dyn->rela_dyn)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on rela_dyn");
   dyn->nrela_dyn = 0;
 
   Slice interp_s = l->emit_shared ? SLICE_NULL
                                   : pool_slice(l->c->global, dyn->interp_path);
   const char* interp_str = interp_s.s;
   size_t namelen = interp_s.len;
   u64 interp_bytes = l->emit_shared ? 0u : (u64)namelen + 1u;
   u64 dynsym_bytes = (u64)dyn->ndynsym * ELF64_SYM_SIZE;
   u64 dynstr_bytes = (u64)dyn->dynstr_len;
   u64 gnuhash_bytes = (u64)dyn->gnu_hash_len;
   int has_ver = dyn->nverneed > 0;
   u64 versym_bytes = (u64)dyn->versym_len;
   u64 verneed_bytes = (u64)dyn->verneed_len;
   /* rela.dyn is pre-counted exactly; rela.plt is one record per PLT slot. */
   u64 rela_dyn_bytes = (u64)dyn->cap_rela_dyn * ELF64_RELA_SIZE;
   u64 rela_plt_bytes = (u64)dyn->nrela_plt * ELF64_RELA_SIZE;
   u64 plt_bytes =
       (u64)(imports.nfuncs
                 ? arch->plt0_size + arch->plt_entry_size * imports.nfuncs
                 : 0u);
   u64 gotplt_bytes = (u64)(imports.nfuncs ? 8u * (3u + imports.nfuncs) : 0u);
   dyn->ndyn_entries = count_dynamic_entries(dyn);
   u64 dynamic_bytes = (u64)dyn->ndyn_entries * ELF64_DYN_SIZE;
 
   /* Step 5: place segments, page-aligned after the existing image
    * span. New segments:
    *   ro_seg   (PF_R)  — .interp + .dynsym + .dynstr + .gnu.hash +
    *                       .rela.dyn + .rela.plt
    *   rx_seg   (PF_R+X)— .plt              (only when imports.nfuncs > 0)
    *   rw_seg   (PF_R+W)— .got.plt + .dynamic
    *
    * .dynamic lives in rw_seg because glibc's loader patches DT_*
    * d_un.d_ptr fields in-place at startup (elf_get_dynamic_info
    * adjusts STRTAB/SYMTAB/etc. by l_addr); a PF_R-only segment
    * causes SEGV_ACCERR. musl's loader doesn't do this rewrite, but
    * the RW placement is conventional and works for both.
    */
   page = 0x4000u; /* keep aligned with layout_page_size default */
   {
     /* Read the page size from layout_page_size by re-using the
      * configured execmem if present — duplicates the helper rather
      * than expose it; the value is only used for alignment. */
     const KitExecMem* m = (l && l->jit_host) ? l->jit_host->execmem : NULL;
     if (m && m->page_size) page = (u64)m->page_size;
   }
 
   u64 base_vaddr = 0;
   u32 i;
   for (i = 0; i < img->nsegments; ++i) {
     u64 end = img->segments[i].vaddr + img->segments[i].mem_size;
     if (end > base_vaddr) base_vaddr = end;
   }
   base_vaddr = ALIGN_UP(base_vaddr, page);
 
   /* Pack ro section offsets (relative to ro_seg.vaddr). 8-byte
    * alignment for tables; 4-byte for .interp string. */
   u64 off = 0;
   u64 interp_off = off;
   off = ALIGN_UP(off + interp_bytes, 8u);
   u64 dynsym_off = off;
   off = ALIGN_UP(off + dynsym_bytes, 8u);
   u64 dynstr_off = off;
   off = ALIGN_UP(off + dynstr_bytes, 8u);
   u64 gnuhash_off = off;
   off = ALIGN_UP(off + gnuhash_bytes, 8u);
   u64 rela_dyn_off = off;
   off = ALIGN_UP(off + rela_dyn_bytes, 8u);
   u64 rela_plt_off = off;
   off = ALIGN_UP(off + rela_plt_bytes, 8u);
   /* .gnu.version + .gnu.version_r (zero-sized and skipped when no import is
    * versioned, so the ro segment is unchanged for unversioned links). */
   u64 versym_off = off;
   off = ALIGN_UP(off + versym_bytes, 8u);
   u64 verneed_off = off;
   off = ALIGN_UP(off + verneed_bytes, 8u);
   u64 ro_seg_size = off;
 
   /* When no PLT is needed, suppress the RX/.plt segment entirely. */
   int has_plt = imports.nfuncs > 0;
 
   /* Pack rw_seg offsets: .got.plt (when has_plt) followed by .dynamic. */
   u64 rw_off = 0;
   u64 gotplt_off = rw_off;
   if (has_plt) rw_off = ALIGN_UP(rw_off + gotplt_bytes, 8u);
   u64 dynamic_off = rw_off;
   rw_off = ALIGN_UP(rw_off + dynamic_bytes, 8u);
   u64 rw_seg_size = rw_off;
 
   u64 ro_vaddr = base_vaddr;
   u64 rx_vaddr = ALIGN_UP(ro_vaddr + ro_seg_size, page);
   u64 rw_vaddr = ALIGN_UP(rx_vaddr + (has_plt ? plt_bytes : 0u), page);
 
   /* rw_seg always exists (it carries .dynamic). */
   u32 nseg = 2u + (has_plt ? 1u : 0u);
   u32 seg_base = dyn_alloc_segments(img, nseg);
   u32 ro_seg_idx = seg_base + 0u;
   u32 rx_seg_idx = has_plt ? seg_base + 1u : 0u;
   u32 rw_seg_idx = seg_base + (has_plt ? 2u : 1u);
 
   LinkSegment* ro_seg = &img->segments[ro_seg_idx];
   memset(ro_seg, 0, sizeof(*ro_seg));
   ro_seg->id = (LinkSegmentId)(ro_seg_idx + 1u);
   ro_seg->flags = SF_ALLOC; /* PF_R */
   ro_seg->file_offset = ro_vaddr;
   ro_seg->vaddr = ro_vaddr;
   ro_seg->paddr = ro_vaddr;
   ro_seg->file_size = ro_seg_size;
   ro_seg->mem_size = ro_seg_size;
   ro_seg->align = (u32)page;
   ro_seg->nsections = (l->emit_shared ? 5u : 6u) + (has_ver ? 2u : 0u);
   img->segment_bytes[ro_seg_idx] =
       ro_seg_size ? (u8*)h->alloc(h, (size_t)ro_seg_size, 16) : NULL;
   img->segment_bytes_cap[ro_seg_idx] = (size_t)ro_seg_size;
   if (ro_seg_size && !img->segment_bytes[ro_seg_idx])
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on ro dyn segment");
   if (ro_seg_size)
     memset(img->segment_bytes[ro_seg_idx], 0, (size_t)ro_seg_size);
 
   if (has_plt) {
     LinkSegment* rx_seg = &img->segments[rx_seg_idx];
     memset(rx_seg, 0, sizeof(*rx_seg));
     rx_seg->id = (LinkSegmentId)(rx_seg_idx + 1u);
     rx_seg->flags = SF_ALLOC | SF_EXEC;
     rx_seg->file_offset = rx_vaddr;
     rx_seg->vaddr = rx_vaddr;
     rx_seg->paddr = rx_vaddr;
     rx_seg->file_size = plt_bytes;
     rx_seg->mem_size = plt_bytes;
     rx_seg->align = (u32)page;
     rx_seg->nsections = 1;
     img->segment_bytes[rx_seg_idx] = (u8*)h->alloc(h, (size_t)plt_bytes, 16);
     img->segment_bytes_cap[rx_seg_idx] = (size_t)plt_bytes;
     if (!img->segment_bytes[rx_seg_idx])
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on .plt segment");
     memset(img->segment_bytes[rx_seg_idx], 0, (size_t)plt_bytes);
     /* Stash plt / got.plt vaddrs now — the PLT body emit just below
      * reads them, and the post-shift fixup in shift_image_addresses
      * (link_elf.c) keys on these fields too. */
     dyn->plt_vaddr = rx_vaddr;
     dyn->plt_size = plt_bytes;
     dyn->got_plt_vaddr = rw_vaddr;
     dyn->got_plt_size = gotplt_bytes;
     /* PLT body emit: the descriptor owns the psABI-specific bytes. */
     if (!arch->emit_plt0 || !arch->emit_plt_entry)
       compiler_panic(l->c, SRCLOC_NONE, "link: PLT emit not configured");
     {
       u8* plt_b = img->segment_bytes[rx_seg_idx];
       u32 ki;
       arch->emit_plt0(plt_b, dyn->plt_vaddr, dyn->got_plt_vaddr);
       for (ki = 0; ki < imports.nfuncs; ++ki) {
         u64 entry_vaddr = dyn->plt_vaddr + arch->plt0_size +
                           (u64)arch->plt_entry_size * (u64)ki;
         u64 slot_vaddr = dyn->got_plt_vaddr + 8u * (3u + ki);
         u8* p =
             plt_b + arch->plt0_size + (size_t)arch->plt_entry_size * (size_t)ki;
         arch->emit_plt_entry(p, entry_vaddr, slot_vaddr);
       }
     }
   }
   /* rw_seg always exists — it carries .dynamic, plus .got.plt when
    * imports are present. */
   {
     LinkSegment* rw_seg = &img->segments[rw_seg_idx];
     memset(rw_seg, 0, sizeof(*rw_seg));
     rw_seg->id = (LinkSegmentId)(rw_seg_idx + 1u);
     rw_seg->flags = SF_ALLOC | SF_WRITE;
     rw_seg->file_offset = rw_vaddr;
     rw_seg->vaddr = rw_vaddr;
     rw_seg->paddr = rw_vaddr;
     rw_seg->file_size = rw_seg_size;
     rw_seg->mem_size = rw_seg_size;
     rw_seg->align = (u32)page;
     rw_seg->nsections = has_plt ? 2u : 1u;
     img->segment_bytes[rw_seg_idx] = (u8*)h->alloc(h, (size_t)rw_seg_size, 16);
     img->segment_bytes_cap[rw_seg_idx] = (size_t)rw_seg_size;
     if (!img->segment_bytes[rw_seg_idx])
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on rw dyn segment");
     /* Zero-initialize. .got.plt[0] (&.dynamic) is filled later, after
      * shift_image_addresses has bumped dyn->dynamic_vaddr. .dynamic
      * body is built post-shift in link_emit_elf. Loader
      * patches all .got.plt slots from .rela.plt before user code
      * under DF_1_NOW. */
     memset(img->segment_bytes[rw_seg_idx], 0, (size_t)rw_seg_size);
   }
   img->nsegments += nseg;
 
   /* Step 6: synthetic LinkSection entries. Order in img->sections
    * matches the loader-friendly file order and feeds emit's
    * outshdr-merge pass. */
   u32 nsec = (l->emit_shared ? 6u : 7u) + (has_plt ? 2u : 0u) +
              (has_ver ? 2u : 0u);
   u32 sec_base = dyn_alloc_sections(img, nsec);
 
   /* helper: populate a fresh LinkSection for a segment-internal range */
   /* Inline because the args differ enough (sem, name) per slot. */
   Sym name_interp = pool_intern_slice(l->c->global, SLICE_LIT(".interp"));
   Sym name_dynsym = pool_intern_slice(l->c->global, SLICE_LIT(".dynsym"));
   Sym name_dynstr = pool_intern_slice(l->c->global, SLICE_LIT(".dynstr"));
   Sym name_gnu_hash = pool_intern_slice(l->c->global, SLICE_LIT(".gnu.hash"));
   Sym name_rela_dyn = pool_intern_slice(l->c->global, SLICE_LIT(".rela.dyn"));
   Sym name_rela_plt = pool_intern_slice(l->c->global, SLICE_LIT(".rela.plt"));
   Sym name_dynamic = pool_intern_slice(l->c->global, SLICE_LIT(".dynamic"));
   Sym name_plt = pool_intern_slice(l->c->global, SLICE_LIT(".plt"));
   Sym name_got_plt = pool_intern_slice(l->c->global, SLICE_LIT(".got.plt"));
   Sym name_gnu_version =
       pool_intern_slice(l->c->global, SLICE_LIT(".gnu.version"));
   Sym name_gnu_version_r =
       pool_intern_slice(l->c->global, SLICE_LIT(".gnu.version_r"));
 
 #define INIT_SEC(IDX, NAME, SEG_IDX, OFF_IN_SEG, SIZE, ALIGN, FLAGS, SEM)  \
   do {                                                                     \
     LinkSection* ls = &img->sections[sec_base + (IDX)];                    \
     memset(ls, 0, sizeof(*ls));                                            \
     ls->id = (LinkSectionId)(sec_base + (IDX) + 1u);                       \
     ls->input_id = LINK_INPUT_NONE;                                        \
     ls->obj_section_id = OBJ_SEC_NONE;                                     \
     ls->segment_id = img->segments[(SEG_IDX)].id;                          \
     ls->input_offset = (OFF_IN_SEG);                                       \
     ls->file_offset = img->segments[(SEG_IDX)].file_offset + (OFF_IN_SEG); \
     ls->vaddr = img->segments[(SEG_IDX)].vaddr + (OFF_IN_SEG);             \
     ls->size = (SIZE);                                                     \
     ls->flags = (FLAGS);                                                   \
     ls->align = (ALIGN);                                                   \
     ls->name = (NAME);                                                     \
     ls->sem = (SEM);                                                       \
   } while (0)
 
   u32 si_base = 0;
   if (!l->emit_shared) {
     INIT_SEC(0, name_interp, ro_seg_idx, interp_off, interp_bytes, 1, SF_ALLOC,
              SSEM_PROGBITS);
     dyn->sec_interp = (LinkSectionId)(sec_base + 0 + 1u);
     si_base = 1u;
   }
   INIT_SEC(si_base + 0u, name_dynsym, ro_seg_idx, dynsym_off, dynsym_bytes, 8, SF_ALLOC,
            SSEM_PROGBITS);
   INIT_SEC(si_base + 1u, name_dynstr, ro_seg_idx, dynstr_off, dynstr_bytes, 1, SF_ALLOC,
            SSEM_PROGBITS);
   INIT_SEC(si_base + 2u, name_gnu_hash, ro_seg_idx, gnuhash_off, gnuhash_bytes, 8,
            SF_ALLOC, SSEM_PROGBITS);
   INIT_SEC(si_base + 3u, name_rela_dyn, ro_seg_idx, rela_dyn_off, rela_dyn_bytes, 8,
            SF_ALLOC, SSEM_PROGBITS);
   INIT_SEC(si_base + 4u, name_rela_plt, ro_seg_idx, rela_plt_off, rela_plt_bytes, 8,
            SF_ALLOC, SSEM_PROGBITS);
   INIT_SEC(si_base + 5u, name_dynamic, rw_seg_idx, dynamic_off, dynamic_bytes, 8,
            SF_ALLOC | SF_WRITE, SSEM_PROGBITS);
 
   dyn->sec_dynsym = (LinkSectionId)(sec_base + si_base + 0u + 1u);
   dyn->sec_dynstr = (LinkSectionId)(sec_base + si_base + 1u + 1u);
   dyn->sec_gnu_hash = (LinkSectionId)(sec_base + si_base + 2u + 1u);
   dyn->sec_rela_dyn = (LinkSectionId)(sec_base + si_base + 3u + 1u);
   dyn->sec_rela_plt = (LinkSectionId)(sec_base + si_base + 4u + 1u);
   dyn->sec_dynamic = (LinkSectionId)(sec_base + si_base + 5u + 1u);
   dyn->dynamic_vaddr = img->segments[rw_seg_idx].vaddr + dynamic_off;
   dyn->dynamic_size = dynamic_bytes;
 
   if (has_plt) {
     u32 plt0 = si_base + 6u;
     INIT_SEC(plt0, name_plt, rx_seg_idx, 0, plt_bytes, 16, SF_ALLOC | SF_EXEC,
              SSEM_PROGBITS);
     INIT_SEC(plt0 + 1u, name_got_plt, rw_seg_idx, gotplt_off, gotplt_bytes, 8,
              SF_ALLOC | SF_WRITE, SSEM_PROGBITS);
     dyn->sec_plt = (LinkSectionId)(sec_base + plt0 + 1u);
     dyn->sec_got_plt = (LinkSectionId)(sec_base + plt0 + 1u + 1u);
   }
   if (has_ver) {
     /* Appended after the optional PLT slots; emit sorts the section-header
      * table by (segment, vaddr), so array order here is not load-bearing. The
      * SSEM_PROGBITS sem just parks the bytes in the ro segment — the runtime
      * reads them via DT_VERSYM/DT_VERNEED, not the section headers. */
     u32 vb0 = si_base + 6u + (has_plt ? 2u : 0u);
     INIT_SEC(vb0, name_gnu_version, ro_seg_idx, versym_off, versym_bytes, 2,
              SF_ALLOC, SSEM_PROGBITS);
     INIT_SEC(vb0 + 1u, name_gnu_version_r, ro_seg_idx, verneed_off,
              verneed_bytes, 4, SF_ALLOC, SSEM_PROGBITS);
     dyn->sec_gnu_version = (LinkSectionId)(sec_base + vb0 + 1u);
     dyn->sec_gnu_version_r = (LinkSectionId)(sec_base + vb0 + 1u + 1u);
   }
 #undef INIT_SEC
 
   img->nsections += nsec;
 
   /* Step 7: copy .interp / .dynsym / .dynstr / .gnu.hash bytes into
    * the ro segment. .dynamic body is built during emit (it embeds
    * runtime vaddrs that PIE keeps image-relative; emit just reads
    * the section ids' final vaddrs). */
   u8* ro_bytes = img->segment_bytes[ro_seg_idx];
 
   /* .interp */
   if (interp_bytes && ro_bytes)
     memcpy(ro_bytes + interp_off, interp_str, (size_t)interp_bytes);
 
   /* .dynsym: serialize DynSymRec to ELF64 wire layout. */
   {
     u32 si;
     for (si = 0; si < dyn->ndynsym; ++si) {
       u8* p = ro_bytes + dynsym_off + (u64)si * ELF64_SYM_SIZE;
       const DynSymRec* r = &dyn->dynsym[si];
       wr_u32_le(p + 0, r->st_name);
       p[4] = r->st_info;
       p[5] = r->st_other;
       wr_u16_le(p + 6, r->st_shndx);
       wr_u64_le(p + 8, r->st_value);
       wr_u64_le(p + 16, r->st_size);
     }
   }
 
   /* .dynstr */
   if (dynstr_bytes && ro_bytes && dyn->dynstr)
     memcpy(ro_bytes + dynstr_off, dyn->dynstr, dyn->dynstr_len);
 
   /* .gnu.hash */
   if (gnuhash_bytes && ro_bytes && dyn->gnu_hash)
     memcpy(ro_bytes + gnuhash_off, dyn->gnu_hash, dyn->gnu_hash_len);
 
   /* .gnu.version + .gnu.version_r (no vaddrs inside; copied verbatim). */
   if (has_ver && ro_bytes) {
     if (versym_bytes && dyn->versym)
       memcpy(ro_bytes + versym_off, dyn->versym, dyn->versym_len);
     if (verneed_bytes && dyn->verneed)
       memcpy(ro_bytes + verneed_off, dyn->verneed, dyn->verneed_len);
   }
 
   /* .rela.plt: emit JUMP_SLOT records, one per imported function, and
    * stash each import's PLT-entry vaddr in `sym_plt_vaddr` so the
    * apply pass can redirect CALL26/JUMP26 against the import.  The
    * record's r_offset addresses the .got.plt slot the PLT stub reads
    * through; the loader patches that slot to the resolved runtime
    * address before user code runs (DF_1_NOW, BIND_NOW).  Bytes are
    * written here at pre-shift vaddrs; link_emit re-serializes them
    * after shift_image_addresses bumps the dyn vaddrs by headers_load. */
   {
     u32 ki;
     for (ki = 0; ki < imports.nfuncs; ++ki) {
       LinkSymId lsid = imports.funcs[ki];
       u32 dynidx = dyn->sym_dynidx[lsid];
       u64 slot_vaddr = dyn->got_plt_vaddr + 8u * (3u + ki);
       u64 plt_entry_vaddr = dyn->plt_vaddr + arch->plt0_size +
                             (u64)arch->plt_entry_size * (u64)ki;
       DynRela* r = &dyn->rela_plt[ki];
       r->r_offset = slot_vaddr;
       r->r_info = ELF64_R_INFO((u64)dynidx, elf_arch->r_jump_slot);
       r->r_addend = 0;
       /* Serialize into segment bytes (will be re-serialized post-shift). */
       u8* p = ro_bytes + rela_plt_off + (u64)ki * ELF64_RELA_SIZE;
       wr_u64_le(p + 0, r->r_offset);
       wr_u64_le(p + 8, r->r_info);
       wr_u64_le(p + 16, (u64)r->r_addend);
       /* sym_plt_vaddr is consulted by apply_all_relocs. */
       dyn->sym_plt_vaddr[lsid] = plt_entry_vaddr;
     }
   }
 
   /* .rela.dyn entries (GLOB_DAT for imports referenced via .got, and
    * RELATIVE for PIE internal abs fixups) are emitted by
    * apply_all_relocs as it walks every relocation.  layout_dyn
    * leaves .rela.dyn empty here; the bytes are written post-shift in
    * link_emit_elf. */
 
   /* .got.plt prelude: for BIND_NOW we leave the body zero — the
    * loader patches every slot from .rela.plt before user code. Some
    * loaders still inspect slot 0 (&.dynamic) at startup; provide it
    * so glibc-style loaders don't fault. The loader writes the link_map
    * cookie into slot 1 at load time. */
   if (has_plt) {
     u8* gp_bytes = img->segment_bytes[rw_seg_idx];
     if (gp_bytes && gotplt_bytes >= 8u) {
       wr_u64_le(gp_bytes, dyn->dynamic_vaddr);
       /* Slots 1, 2, and per-PLT slots stay zero until the loader
        * fills them. Phase 5 would prefill the per-PLT slots with
        * the address of PLT0 to support lazy binding. */
     }
   }
 
   /* The .dynamic body is built later, after segment shifts are
    * applied during emit. link_emit_elf (src/obj/elf/link.c) takes the
    * post-shift vaddrs of every other dyn section and writes one
    * DT_* entry per index. */
 
   /* Synthesize linker-defined symbols that reference the .dynamic
    * vaddr.  Scrt1.o on Linux loads `_DYNAMIC` via ADRP+ADD, and
    * libc_nonshared.a's atexit shim takes `__dso_handle` as the
    * per-image identity (we use the .dynamic vaddr — any stable
    * per-image address satisfies the contract since the shim only
    * passes it through to __cxa_atexit, which the program-side glibc
    * just stashes). */
   link_define_boundary(l, img, "_DYNAMIC", dyn->dynamic_vaddr);
   link_define_boundary(l, img, "__dso_handle", dyn->dynamic_vaddr);
 
   free_imports(h, &imports);
 }
 
 /* ---- cleanup ---- */
 
 void link_dyn_state_free(LinkImage* img) {
   Heap* h = img->heap;
   LinkDynState* dyn = img->dyn;
   if (!dyn) return;
   if (dyn->dynsym) h->free(h, dyn->dynsym, sizeof(*dyn->dynsym) * dyn->ndynsym);
   if (dyn->dynstr) h->free(h, dyn->dynstr, dyn->dynstr_len);
   if (dyn->gnu_hash) h->free(h, dyn->gnu_hash, dyn->gnu_hash_len);
   if (dyn->versym) h->free(h, dyn->versym, dyn->versym_len);
   if (dyn->verneed) h->free(h, dyn->verneed, dyn->verneed_len);
   if (dyn->rela_dyn)
     h->free(h, dyn->rela_dyn, sizeof(*dyn->rela_dyn) * dyn->cap_rela_dyn);
   if (dyn->rela_plt)
     h->free(h, dyn->rela_plt, sizeof(*dyn->rela_plt) * dyn->nrela_plt);
   if (dyn->needed) h->free(h, dyn->needed, sizeof(*dyn->needed) * dyn->nneeded);
   if (dyn->rpaths) h->free(h, dyn->rpaths, sizeof(*dyn->rpaths) * dyn->nrpaths);
   if (dyn->runpaths)
     h->free(h, dyn->runpaths, sizeof(*dyn->runpaths) * dyn->nrunpaths);
   if (dyn->sym_dynidx)
     h->free(h, dyn->sym_dynidx,
             sizeof(*dyn->sym_dynidx) * dyn->sym_dynidx_size);
   if (dyn->sym_plt_vaddr)
     h->free(h, dyn->sym_plt_vaddr,
             sizeof(*dyn->sym_plt_vaddr) * dyn->sym_dynidx_size);
   h->free(h, dyn, sizeof(*dyn));
   img->dyn = NULL;
 }