libctf, ld: fix symtypetab and var section population under ld -r

The variable section in a CTF dict is meant to contain the types of
variables that do not appear in the symbol table (mostly file-scope
static declarations).  We implement this by having the compiler emit
all potential data symbols into both sections, then delete those
symbols from the variable section that correspond to data symbols the
linker has reported.

Unfortunately, the check for this in ctf_serialize is wrong: rather than
checking the set of linker-reported symbols, we check the set of names
in the data object symtypetab section: if the linker has reported no
symbols at all (usually if ld -r has been run, or if a non-linker
program that does not use symbol tables is calling ctf_link) this will
include every single symbol, emptying the variable section completely.

Worse, when ld -r is in use, we want to force writeout of every
symtypetab entry on the inputs, in an indexed section, whether or not
the linker has reported them, since this isn't a final link yet and the
symbol table is not finalized (and may grow more symbols than the linker
has yet reported).  But the check for this is flawed too: we were
relying on ctf_link_shuffle_syms not having been called if no symbols
exist, but that function is *always* called by ld even when ld -r is in
use: ctf_link_add_linker_symbol is the one that's not called when there
are no symbols.

We clearly need to rethink this.  Using the emptiness of the set of
reported symbols as a test for ld -r is just ugly: the linker already
knows if ld -r is underway and can just tell us.  So add a new linker
flag CTF_LINK_NO_FILTER_REPORTED_SYMS that is set to stop the linker
filtering the symbols in the symtypetab sections using the set that the
linker has reported: use the presence or absence of this flag to
determine whether to emit unindexed symtabs: we only remove entries from
the variable section when filtering symbols, and we only remove them if
they are in the reported symbol set, fixing the case where no symbols
are reported by the linker at all.

(The negative sense of the new CTF_LINK flag is intentional: the common
case, both for ld and for simple tools that want to do a ctf_link with
no ELF symbol table in sight, is probably to filter out symbols that no
linker has reported: i.e., for the simple tools, all of them.)

There's another wrinkle, though.  It is quite possible for a non-linker
to add symbols to a dict via ctf_add_*_sym and then write it out via the
ctf_write APIs: perhaps it's preparing a dict for a later linker
invocation.  Right now this would not lead to anything terribly
meaningful happening: ctf_serialize just assumes it was called via
ctf_link if symbols are present.  So add an (internal-to-libctf) flag
that indicates that a writeout is happening via ctf_link_write, and set
it there (propagating it to child dicts as needed).  ctf_serialize can
then spot when it is not being called by a linker, and arrange to always
write out an indexed, sorted symtypetab for fastest possible future
symbol lookup by name in that case.  (The writeouts done by ld -r are
unsorted, because the only thing likely to use those symtabs is the
linker, which doesn't benefit from symtypetab sorting.)

Tests added for all three linking cases (ld -r, ld -shared, ld), with a
bit of testsuite framework enhancement to stop it unconditionally
linking the CTF to be checked by the lookup program with -shared, so
tests can now examine CTF linked with -r or indeed with no flags at all,
though the output filename is still foo.so even in this case.

Another test added for the non-linker case that endeavours to determine
whether the symtypetab is sorted by examining the order of entries
returned from ctf_symbol_next: nobody outside libctf should rely on
this ordering, but this test is not outside libctf :)

include/ChangeLog
2021-01-26  Nick Alcock  <nick.alcock@oracle.com>

	* ctf-api.h (CTF_LINK_NO_FILTER_REPORTED_SYMS): New.

ld/ChangeLog
2021-01-26  Nick Alcock  <nick.alcock@oracle.com>

	* ldlang.c (lang_merge_ctf): Set CTF_LINK_NO_FILTER_REPORTED_SYMS
	when appropriate.

libctf/ChangeLog
2021-01-27  Nick Alcock  <nick.alcock@oracle.com>

	* ctf-impl.c (_libctf_nonnull_): Add parameters.
	(LCTF_LINKING): New flag.
	(ctf_dict_t) <ctf_link_flags>: Mention it.
	* ctf-link.c (ctf_link): Keep LCTF_LINKING set across call.
	(ctf_write): Likewise, including in child dictionaries.
	(ctf_link_shuffle_syms): Make sure ctf_dynsyms is NULL if there
	are no reported symbols.
	* ctf-create.c (symtypetab_delete_nonstatic_vars): Make sure
	the variable has been reported as a symbol by the linker.
	(symtypetab_skippable): Mention relationship between SYMFP and the
	flags.
	(symtypetab_density): Adjust nonnullity.  Exit early if no symbols
	were reported and force-indexing is off (i.e., we are doing a
	final link).
	(ctf_serialize): Handle the !LCTF_LINKING case by writing out an
	indexed, sorted symtypetab (and allow SYMFP to be NULL in this
	case).  Turn sorting off if this is a non-final link.  Only delete
	nonstatic vars if we are filtering symbols and the linker has
	reported some.
	* testsuite/libctf-regression/nonstatic-var-section-ld-r*:
	New test of variable and symtypetab section population when
	ld -r is used.
	* testsuite/libctf-regression/nonstatic-var-section-ld-executable.lk:
	Likewise, when ld of an executable is used.
	* testsuite/libctf-regression/nonstatic-var-section-ld.lk:
	Likewise, when ld -shared alone is used.
	* testsuite/libctf-regression/nonstatic-var-section-ld*.c:
	Lookup programs for the above.
	* testsuite/libctf-writable/symtypetab-nonlinker-writeout.*: New
	test, testing survival of symbols across ctf_write paths.
	* testsuite/lib/ctf-lib.exp (run_lookup_test): New option,
	nonshared, suppressing linking of the SOURCE with -shared.

13 files changed, 592 insertions, 57 deletions

diff --git a/libctf/ChangeLog b/libctf/ChangeLog
index 3a7f6ab..eaecb17 100644
--- a/libctf/ChangeLog
+++ b/libctf/ChangeLog
@@ -1,3 +1,38 @@
+2021-01-27  Nick Alcock  <nick.alcock@oracle.com>
+
+	* ctf-impl.c (_libctf_nonnull_): Add parameters.
+	(LCTF_LINKING): New flag.
+	(ctf_dict_t) <ctf_link_flags>: Mention it.
+	* ctf-link.c (ctf_link): Keep LCTF_LINKING set across call.
+	(ctf_write): Likewise, including in child dictionaries.
+	(ctf_link_shuffle_syms): Make sure ctf_dynsyms is NULL if there
+	are no reported symbols.
+	* ctf-create.c (symtypetab_delete_nonstatic_vars): Make sure
+	the variable has been reported as a symbol by the linker.
+	(symtypetab_skippable): Mention relationship between SYMFP and the
+	flags.
+	(symtypetab_density): Adjust nonnullity.  Exit early if no symbols
+	were reported and force-indexing is off (i.e., we are doing a
+	final link).
+	(ctf_serialize): Handle the !LCTF_LINKING case by writing out an
+	indexed, sorted symtypetab (and allow SYMFP to be NULL in this
+	case).  Turn sorting off if this is a non-final link.  Only delete
+	nonstatic vars if we are filtering symbols and the linker has
+	reported some.
+	* testsuite/libctf-regression/nonstatic-var-section-ld-r*:
+	New test of variable and symtypetab section population when
+	ld -r is used.
+	* testsuite/libctf-regression/nonstatic-var-section-ld-executable.lk:
+	Likewise, when ld of an executable is used.
+	* testsuite/libctf-regression/nonstatic-var-section-ld.lk:
+	Likewise, when ld -shared alone is used.
+	* testsuite/libctf-regression/nonstatic-var-section-ld*.c:
+	Lookup programs for the above.
+	* testsuite/libctf-writable/symtypetab-nonlinker-writeout.*: New
+	test, testing survival of symbols across ctf_write paths.
+	* testsuite/lib/ctf-lib.exp (run_lookup_test): New option,
+	nonshared, suppressing linking of the SOURCE with -shared.
+
 2021-01-19  Nick Alcock  <nick.alcock@oracle.com>
 
 	* ctf-create.c (membadd): Transform ""-named members into
diff --git a/libctf/ctf-create.c b/libctf/ctf-create.c
index 50f48eb..c5f79d1 100644
--- a/libctf/ctf-create.c
+++ b/libctf/ctf-create.c
@@ -172,7 +172,7 @@ ctf_create (int *errp)
    you can safely delete variables without messing up ctf_rollback.  */
 
 static int
-symtypetab_delete_nonstatic_vars (ctf_dict_t *fp)
+symtypetab_delete_nonstatic_vars (ctf_dict_t *fp, ctf_dict_t *symfp)
 {
   ctf_dvdef_t *dvd, *nvd;
   ctf_id_t type;
@@ -183,6 +183,7 @@ symtypetab_delete_nonstatic_vars (ctf_dict_t *fp)
 
       if (((type = (ctf_id_t) (uintptr_t)
 	    ctf_dynhash_lookup (fp->ctf_objthash, dvd->dvd_name)) > 0)
+	  && ctf_dynhash_lookup (symfp->ctf_dynsyms, dvd->dvd_name) != NULL
 	  && type == dvd->dvd_type)
 	ctf_dvd_delete (fp, dvd);
     }
@@ -217,12 +218,14 @@ ctf_symtab_skippable (ctf_link_sym_t *sym)
 /* Get the number of symbols in a symbol hash, the count of symbols, the maximum
    seen, the eventual size, without any padding elements, of the func/data and
    (if generated) index sections, and the size of accumulated padding elements.
-   The linker-reported set of symbols is found in SYMFP.
+   The linker-reported set of symbols is found in SYMFP: it may be NULL if
+   symbol filtering is not desired, in which case CTF_SYMTYPETAB_FORCE_INDEXED
+   will always be set in the flags.
 
    Also figure out if any symbols need to be moved to the variable section, and
    add them (if not already present).  */
 
-_libctf_nonnull_
+_libctf_nonnull_ ((1,3,4,5,6,7,8))
 static int
 symtypetab_density (ctf_dict_t *fp, ctf_dict_t *symfp, ctf_dynhash_t *symhash,
 		    size_t *count, size_t *max, size_t *unpadsize,
@@ -248,7 +251,12 @@ symtypetab_density (ctf_dict_t *fp, ctf_dict_t *symfp, ctf_dynhash_t *symhash,
 	 of, removing them from linker_known as we go.  Once this is done, the
 	 only symbols remaining in linker_known are symbols we don't know the
 	 types of: we must emit pads for those symbols that are below the
-	 maximum symbol we will emit (any beyond that are simply skipped).  */
+	 maximum symbol we will emit (any beyond that are simply skipped).
+
+	 If there are none, this symtypetab will be empty: just report that.  */
+
+      if (!symfp->ctf_dynsyms)
+	return 0;
 
       if ((linker_known = ctf_dynhash_create (ctf_hash_string, ctf_hash_eq_string,
 					      NULL, NULL)) == NULL)
@@ -676,20 +684,25 @@ ctf_serialize (ctf_dict_t *fp)
   ctf_dvdef_t *dvd;
   ctf_varent_t *dvarents;
   ctf_strs_writable_t strtab;
-  ctf_dict_t *symfp = fp;
 
   unsigned char *t;
   unsigned long i;
-  int symflags = 0;
   size_t buf_size, type_size, objt_size, func_size;
   size_t objt_unpadsize, func_unpadsize, objt_padsize, func_padsize;
   size_t funcidx_size, objtidx_size;
   size_t nvars, nfuncs, nobjts, maxobjt, maxfunc;
-  size_t ndynsyms = 0;
+  size_t nsymtypes = 0;
   const char **sym_name_order = NULL;
   unsigned char *buf = NULL, *newbuf;
   int err;
 
+  /* Symtab filtering. If filter_syms is true, symfp is set: otherwise,
+     CTF_SYMTYPETAB_FORCE_INDEXED is set in symflags.  */
+  int filter_syms = 0;
+  int sort_syms = 1;
+  int symflags = 0;
+  ctf_dict_t *symfp = NULL;
+
   if (!(fp->ctf_flags & LCTF_RDWR))
     return (ctf_set_errno (fp, ECTF_RDONLY));
 
@@ -697,6 +710,22 @@ ctf_serialize (ctf_dict_t *fp)
   if (!(fp->ctf_flags & LCTF_DIRTY))
     return 0;
 
+  /* If doing a writeout as part of linking, and the link flags request it,
+     filter out reported symbols from the variable section, and filter out all
+     other symbols from the symtypetab sections.  (If we are not linking, the
+     symbols are sorted; if we are linking, don't bother sorting if we are not
+     filtering out reported symbols: this is almost certaily an ld -r and only
+     the linker is likely to consume these symtypetabs again.  The linker
+     doesn't care what order the symtypetab entries is in, since it only
+     iterates over symbols and does not use the ctf_lookup_by_symbol* API.)  */
+
+  if (fp->ctf_flags & LCTF_LINKING)
+    {
+      filter_syms = !(fp->ctf_link_flags & CTF_LINK_NO_FILTER_REPORTED_SYMS);
+      if (!filter_syms)
+	sort_syms = 0;
+    }
+
   /* Fill in an initial CTF header.  We will leave the label, object,
      and function sections empty and only output a header, type section,
      and string table.  The type section begins at a 4-byte aligned
@@ -754,22 +783,28 @@ ctf_serialize (ctf_dict_t *fp)
 	}
     }
 
-  /* Symbol table stuff is done only if the linker has told this dict about
-     potential symbols (usually the case for parent dicts only).  The linker
-     will report symbols to the parent dict in a parent/child link, as usual
-     with all linker-related matters.  */
+  /* Find the dict to which the linker has reported symbols, if any.  */
 
-  if (!fp->ctf_dynsyms && fp->ctf_parent && fp->ctf_parent->ctf_dynsyms)
-    symfp = fp->ctf_parent;
+  if (filter_syms)
+    {
+      if (!fp->ctf_dynsyms && fp->ctf_parent && fp->ctf_parent->ctf_dynsyms)
+	symfp = fp->ctf_parent;
+      else
+	symfp = fp;
+    }
 
-  /* No linker-reported symbols at all: ctf_link_shuffle_syms was never called.
-     This must be an unsorted, indexed dict.  Otherwise, this is a sorted
-     dict, and the header flags indicate as much.  */
-  if (!symfp->ctf_dynsyms)
+  /* If not filtering, keep all potential symbols in an unsorted, indexed
+     dict.  */
+  if (!filter_syms)
     symflags = CTF_SYMTYPETAB_FORCE_INDEXED;
   else
     hdr.cth_flags |= CTF_F_IDXSORTED;
 
+  if (!ctf_assert (fp, (filter_syms && symfp)
+		   || (!filter_syms && !symfp
+		       && ((symflags & CTF_SYMTYPETAB_FORCE_INDEXED) != 0))))
+    return -1;
+
   /* Work out the sizes of the object and function sections, and work out the
      number of pad (unassigned) symbols in each, and the overall size of the
      sections.  */
@@ -792,15 +827,15 @@ ctf_serialize (ctf_dict_t *fp)
 	       "%i bytes of pads, index size %i\n", (int) nfuncs, (int) maxfunc,
 	       (int) func_unpadsize, (int) func_padsize, (int) funcidx_size);
 
-  /* If the linker has reported any symbols at all, those symbols that the
-     linker has not reported are now removed from the ctf_objthash and
-     ctf_funchash.  Delete entries from the variable section that duplicate
-     newly-added data symbols.  There's no need to migrate new ones in, because
-     linker invocations (even ld -r) can only introduce new symbols, not remove
-     symbols that already exist, and the compiler always emits both a variable
-     and a data symbol simultaneously.  */
+  /* If we are filtering symbols out, those symbols that the linker has not
+     reported have now been removed from the ctf_objthash and ctf_funchash.
+     Delete entries from the variable section that duplicate newly-added data
+     symbols.  There's no need to migrate new ones in, because the compiler
+     always emits both a variable and a data symbol simultaneously, and
+     filtering only happens at final link time.  */
 
-  if (symtypetab_delete_nonstatic_vars (fp) < 0)
+  if (filter_syms && symfp->ctf_dynsyms &&
+      symtypetab_delete_nonstatic_vars (fp, symfp) < 0)
     return -1;
 
   /* It is worth indexing each section if it would save space to do so, due to
@@ -865,11 +900,7 @@ ctf_serialize (ctf_dict_t *fp)
   if (fp->ctf_cuname != NULL)
     ctf_str_add_ref (fp, fp->ctf_cuname, &hdrp->cth_cuname);
 
-  /* Sort the linker's symbols into name order if need be: if
-     ctf_link_shuffle_syms has not been called at all, just use all the symbols
-     that were added to this dict, and don't bother sorting them since this is
-     probably an ld -r and will likely just be consumed by ld again, with no
-     ctf_lookup_by_symbol()s ever done on it.  */
+  /* Sort the linker's symbols into name order if need be.  */
 
   if ((objtidx_size != 0) || (funcidx_size != 0))
     {
@@ -878,36 +909,52 @@ ctf_serialize (ctf_dict_t *fp)
       const char **walk;
       int err;
 
-      if (symfp->ctf_dynsyms)
-	ndynsyms = ctf_dynhash_elements (symfp->ctf_dynsyms);
+      if (filter_syms)
+	{
+	  if (symfp->ctf_dynsyms)
+	    nsymtypes = ctf_dynhash_elements (symfp->ctf_dynsyms);
+	  else
+	    nsymtypes = 0;
+	}
       else
-	ndynsyms = ctf_dynhash_elements (symfp->ctf_objthash)
-	  + ctf_dynhash_elements (symfp->ctf_funchash);
+	nsymtypes = ctf_dynhash_elements (fp->ctf_objthash)
+	  + ctf_dynhash_elements (fp->ctf_funchash);
 
-      if ((sym_name_order = calloc (ndynsyms, sizeof (const char *))) == NULL)
+      if ((sym_name_order = calloc (nsymtypes, sizeof (const char *))) == NULL)
 	goto oom;
 
       walk = sym_name_order;
 
-      if (symfp->ctf_dynsyms)
+      if (filter_syms)
 	{
-	  while ((err = ctf_dynhash_next_sorted (symfp->ctf_dynsyms, &i, &symname,
-						 NULL, ctf_dynhash_sort_by_name,
-						 NULL)) == 0)
-	    *walk++ = (const char *) symname;
-	  if (err != ECTF_NEXT_END)
-	    goto symerr;
+	  if (symfp->ctf_dynsyms)
+	    {
+	      while ((err = ctf_dynhash_next_sorted (symfp->ctf_dynsyms, &i,
+						     &symname, NULL,
+						     ctf_dynhash_sort_by_name,
+						     NULL)) == 0)
+		*walk++ = (const char *) symname;
+	      if (err != ECTF_NEXT_END)
+		goto symerr;
+	    }
 	}
       else
 	{
-	  while ((err = ctf_dynhash_next (symfp->ctf_objthash, &i, &symname,
-					  NULL)) == 0)
+	  ctf_hash_sort_f sort_fun = NULL;
+
+	  /* Since we partition the set of symbols back into objt and func,
+	     we can sort the two independently without harm.  */
+	  if (sort_syms)
+	    sort_fun = ctf_dynhash_sort_by_name;
+
+	  while ((err = ctf_dynhash_next_sorted (fp->ctf_objthash, &i, &symname,
+						 NULL, sort_fun, NULL)) == 0)
 	    *walk++ = (const char *) symname;
 	  if (err != ECTF_NEXT_END)
 	    goto symerr;
 
-	  while ((err = ctf_dynhash_next (symfp->ctf_funchash, &i, &symname,
-					  NULL)) == 0)
+	  while ((err = ctf_dynhash_next_sorted (fp->ctf_funchash, &i, &symname,
+						 NULL, sort_fun, NULL)) == 0)
 	    *walk++ = (const char *) symname;
 	  if (err != ECTF_NEXT_END)
 	    goto symerr;
@@ -918,7 +965,7 @@ ctf_serialize (ctf_dict_t *fp)
      Emission is done in symtab order if there is no index, and in index
      (name) order otherwise.  */
 
-  if ((objtidx_size == 0) && symfp->ctf_dynsymidx)
+  if ((objtidx_size == 0) && symfp && symfp->ctf_dynsymidx)
     {
       ctf_dprintf ("Emitting unindexed objt symtypetab\n");
       if (emit_symtypetab (fp, symfp, (uint32_t *) t, symfp->ctf_dynsymidx,
@@ -930,13 +977,13 @@ ctf_serialize (ctf_dict_t *fp)
     {
       ctf_dprintf ("Emitting indexed objt symtypetab\n");
       if (emit_symtypetab (fp, symfp, (uint32_t *) t, NULL, sym_name_order,
-			   ndynsyms, maxobjt, objt_size, symflags) < 0)
+			   nsymtypes, maxobjt, objt_size, symflags) < 0)
 	goto err;				/* errno is set for us.  */
     }
 
   t += objt_size;
 
-  if ((funcidx_size == 0) && symfp->ctf_dynsymidx)
+  if ((funcidx_size == 0) && symfp && symfp->ctf_dynsymidx)
     {
       ctf_dprintf ("Emitting unindexed func symtypetab\n");
       if (emit_symtypetab (fp, symfp, (uint32_t *) t, symfp->ctf_dynsymidx,
@@ -949,7 +996,7 @@ ctf_serialize (ctf_dict_t *fp)
     {
       ctf_dprintf ("Emitting indexed func symtypetab\n");
       if (emit_symtypetab (fp, symfp, (uint32_t *) t, NULL, sym_name_order,
-			   ndynsyms, maxfunc, func_size,
+			   nsymtypes, maxfunc, func_size,
 			   symflags | CTF_SYMTYPETAB_EMIT_FUNCTION) < 0)
 	goto err;				/* errno is set for us.  */
     }
@@ -958,14 +1005,14 @@ ctf_serialize (ctf_dict_t *fp)
 
   if (objtidx_size > 0)
     if (emit_symtypetab_index (fp, symfp, (uint32_t *) t, sym_name_order,
-			       ndynsyms, objtidx_size, symflags) < 0)
+			       nsymtypes, objtidx_size, symflags) < 0)
       goto err;
 
   t += objtidx_size;
 
   if (funcidx_size > 0)
     if (emit_symtypetab_index (fp, symfp, (uint32_t *) t, sym_name_order,
-			       ndynsyms, funcidx_size,
+			       nsymtypes, funcidx_size,
 			       symflags | CTF_SYMTYPETAB_EMIT_FUNCTION) < 0)
       goto err;
 
diff --git a/libctf/ctf-impl.h b/libctf/ctf-impl.h
index d9972e6..0a508eb 100644
--- a/libctf/ctf-impl.h
+++ b/libctf/ctf-impl.h
@@ -70,7 +70,7 @@ extern "C"
 #define _libctf_unlikely_(x) __builtin_expect ((x), 0)
 #define _libctf_unused_ __attribute__ ((__unused__))
 #define _libctf_malloc_ __attribute__((__malloc__))
-#define _libctf_nonnull_ __attribute__((__nonnull__))
+#define _libctf_nonnull_(params) __attribute__((__nonnull__ params))
 
 #else
 
@@ -78,7 +78,7 @@ extern "C"
 #define _libctf_unlikely_(x) (x)
 #define _libctf_unused_
 #define _libctf_malloc_
-#define _libctf_nonnull_
+#define _libctf_nonnull_(params)
 #define __extension__
 
 #endif
@@ -469,7 +469,8 @@ struct ctf_dict
      individual value members are shared with ctf_link_in_cu_mapping.  */
   ctf_dynhash_t *ctf_link_out_cu_mapping;
 
-  /* CTF linker flags.  */
+  /* CTF linker flags.  Set on the parent output dict (the one passed to
+     ctf_link).  Only respected when LCTF_LINKING set in ctf_flags.  */
   int ctf_link_flags;
 
   /* Allow the caller to change the name of link archive members.  */
@@ -595,6 +596,7 @@ struct ctf_next
 #define LCTF_CHILD	0x0001	/* CTF dict is a child.  */
 #define LCTF_RDWR	0x0002	/* CTF dict is writable.  */
 #define LCTF_DIRTY	0x0004	/* CTF dict has been modified.  */
+#define LCTF_LINKING	0x0008  /* CTF link is underway: respect ctf_link_flags.  */
 
 extern ctf_names_t *ctf_name_table (ctf_dict_t *, int);
 extern const ctf_type_t *ctf_lookup_by_id (ctf_dict_t **, ctf_id_t);
diff --git a/libctf/ctf-link.c b/libctf/ctf-link.c
index 5384b20..7c34216 100644
--- a/libctf/ctf-link.c
+++ b/libctf/ctf-link.c
@@ -1682,6 +1682,7 @@ ctf_link (ctf_dict_t *fp, int flags)
      links in succession with CTF_LINK_EMPTY_CU_MAPPINGS set in some calls and
      not set in others will do anything especially sensible.  */
 
+  fp->ctf_flags |= LCTF_LINKING;
   if (fp->ctf_link_out_cu_mapping && (flags & CTF_LINK_EMPTY_CU_MAPPINGS))
     {
       void *v;
@@ -1692,12 +1693,14 @@ ctf_link (ctf_dict_t *fp, int flags)
 	  const char *to = (const char *) v;
 	  if (ctf_create_per_cu (fp, to, to) == NULL)
 	    {
+	      fp->ctf_flags &= ~LCTF_LINKING;
 	      ctf_next_destroy (i);
 	      return -1;			/* Errno is set for us.  */
 	    }
 	}
       if (err != ECTF_NEXT_END)
 	{
+	  fp->ctf_flags &= ~LCTF_LINKING;
 	  ctf_err_warn (fp, 1, err, _("iteration error creating empty CUs"));
 	  ctf_set_errno (fp, err);
 	  return -1;
@@ -1715,6 +1718,7 @@ ctf_link (ctf_dict_t *fp, int flags)
     ctf_dynhash_empty (fp->ctf_link_type_mapping);
   ctf_dynhash_iter (fp->ctf_link_outputs, empty_link_type_mapping, NULL);
 
+  fp->ctf_flags &= ~LCTF_LINKING;
   if ((ctf_errno (fp) != 0) && (ctf_errno (fp) != ECTF_NOCTFDATA))
     return -1;
   return 0;
@@ -1888,6 +1892,17 @@ ctf_link_shuffle_syms (ctf_dict_t *fp)
       goto err;
     }
 
+  /* If no symbols are reported, unwind what we have done and return.  This
+     makes it a bit easier for the serializer to tell that no symbols have been
+     reported and that it should look elsewhere for reported symbols.  */
+  if (!ctf_dynhash_elements (fp->ctf_dynsyms))
+    {
+      ctf_dprintf ("No symbols: not a final link.\n");
+      free (fp->ctf_dynsyms);
+      fp->ctf_dynsyms = NULL;
+      return 0;
+    }
+
   /* Construct a mapping from shndx to the symbol info.  */
   free (fp->ctf_dynsymidx);
   if ((fp->ctf_dynsymidx = calloc (fp->ctf_dynsymmax + 1,
@@ -2043,6 +2058,7 @@ ctf_link_write (ctf_dict_t *fp, size_t *size, size_t threshold)
   char *transformed_name = NULL;
   ctf_dict_t **files;
   FILE *f = NULL;
+  size_t i;
   int err;
   long fsize;
   const char *errloc;
@@ -2050,6 +2066,7 @@ ctf_link_write (ctf_dict_t *fp, size_t *size, size_t threshold)
 
   memset (&arg, 0, sizeof (ctf_name_list_accum_cb_arg_t));
   arg.fp = fp;
+  fp->ctf_flags |= LCTF_LINKING;
 
   ctf_link_warn_outdated_inputs (fp);
 
@@ -2065,7 +2082,11 @@ ctf_link_write (ctf_dict_t *fp, size_t *size, size_t threshold)
 
   /* No extra outputs? Just write a simple ctf_dict_t.  */
   if (arg.i == 0)
-    return ctf_write_mem (fp, size, threshold);
+    {
+      unsigned char *ret = ctf_write_mem (fp, size, threshold);
+      fp->ctf_flags &= ~LCTF_LINKING;
+      return ret;
+    }
 
   /* Writing an archive.  Stick ourselves (the shared repository, parent of all
      other archives) on the front of it with the default name.  */
@@ -2093,6 +2114,13 @@ ctf_link_write (ctf_dict_t *fp, size_t *size, size_t threshold)
 	}
     }
 
+  /* Propagate the link flags to all the dicts in this link.  */
+  for (i = 0; i < arg.i; i++)
+    {
+      arg.files[i]->ctf_link_flags = fp->ctf_link_flags;
+      arg.files[i]->ctf_flags |= LCTF_LINKING;
+    }
+
   if ((files = realloc (arg.files,
 			sizeof (struct ctf_dict *) * (arg.i + 1))) == NULL)
     {
@@ -2165,6 +2193,10 @@ ctf_link_write (ctf_dict_t *fp, size_t *size, size_t threshold)
 
  err_no:
   ctf_set_errno (fp, errno);
+
+  /* Turn off the is-linking flag on all the dicts in this link.  */
+  for (i = 0; i < arg.i; i++)
+    arg.files[i]->ctf_flags &= ~LCTF_LINKING;
  err:
   free (buf);
   if (f)
diff --git a/libctf/testsuite/lib/ctf-lib.exp b/libctf/testsuite/lib/ctf-lib.exp
index fe02812..c2959ee 100644
--- a/libctf/testsuite/lib/ctf-lib.exp
+++ b/libctf/testsuite/lib/ctf-lib.exp
@@ -233,6 +233,9 @@ proc compile_one_cc { src output additional_flags } {
 #   source: SOURCE
 #	Assemble the file SOURCE.c and pass it to the LOOKUP program.
 #
+#   nonshared:
+#       If set, do not link with -shared.
+#
 #   link:
 #	If set, link the SOURCE together even if only one file is specified.
 #
@@ -270,8 +273,10 @@ proc run_lookup_test { name } {
 	return
     }
     set run_ld 0
+    set shared "-shared"
     set opts(link) {}
     set opts(link_flags) {}
+    set opts(nonshared) {}
     set opts(lookup) {}
     set opts(name) {}
     set opts(source) {}
@@ -308,6 +313,10 @@ proc run_lookup_test { name } {
 	set run_ld 1
     }
 
+    if { [llength $opts(nonshared)] != 0 } {
+	set shared ""
+    }
+
     set testname $opts(name)
     if { $opts(name) == "" } {
 	set testname "$subdir/$name"
@@ -330,7 +339,7 @@ proc run_lookup_test { name } {
 	set lookup_flags ""
 	if { $run_ld } {
 	    set lookup_output "tmpdir/out.so"
-	    set lookup_flags "-gt -fPIC -shared $opts(link_flags)"
+	    set lookup_flags "-gt -fPIC $shared $opts(link_flags)"
 	} else {
 	    set lookup_output "tmpdir/out.o"
 	    set lookup_flags "-gt -fPIC -c"
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-executable.lk b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-executable.lk
new file mode 100644
index 0000000..370a90c
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-executable.lk
@@ -0,0 +1,9 @@
+# lookup: nonstatic-var-section-ld.c
+# source: nonstatic-var-section-ld-r-ctf.c
+# nonshared: on
+# link: on
+# link_flags: -Wl,--ctf-variables
+foo is of type [0-9a-f]*
+bar is of type [0-9a-f]*
+foo missing from the data object section
+bar missing from the data object section
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r-ctf.c b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r-ctf.c
new file mode 100644
index 0000000..4712b1c
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r-ctf.c
@@ -0,0 +1,9 @@
+static int foo __attribute__((__used__));
+int bar;
+
+/* This is sometimes linked as a main program, sometimes via ld -r, and
+   sometimes via ld -shared.  */
+int main (void)
+{
+  return 0;
+}
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.c b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.c
new file mode 100644
index 0000000..2fa761a
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.c
@@ -0,0 +1,73 @@
+#include <ctf-api.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int
+main (int argc, char *argv[])
+{
+  ctf_dict_t *fp;
+  ctf_archive_t *ctf;
+  ctf_id_t foo_type, bar_type, sym_type;
+  int found_foo = 0, found_bar = 0;
+  ctf_next_t *i = NULL;
+  const char *name;
+  int err;
+
+  if (argc != 2)
+    {
+      fprintf (stderr, "Syntax: %s PROGRAM\n", argv[0]);
+      exit(1);
+    }
+
+  if ((ctf = ctf_open (argv[1], NULL, &err)) == NULL)
+    goto open_err;
+
+  if ((fp = ctf_dict_open (ctf, NULL, &err)) == NULL)
+    goto open_err;
+
+  /* Make sure we can look up both 'foo' and 'bar' as variables, even though one
+     of them is nonstatic: in a full link this should be erased, but this is an
+     ld -r link.  */
+
+  if ((foo_type = ctf_lookup_variable (fp, "foo")) == CTF_ERR)
+    printf ("Cannot look up foo\n", ctf_errmsg (ctf_errno (fp)));
+  else
+    printf ("foo is of type %lx\n", foo_type);
+
+  if ((bar_type = ctf_lookup_variable (fp, "bar")) == CTF_ERR)
+    printf ("Cannot look up bar\n", ctf_errmsg (ctf_errno (fp)));
+  else
+    printf ("bar is of type %lx\n", bar_type);
+
+  /* Traverse the entire data object section and make sure it contains entries
+     for both foo and bar.  (This is pure laziness: the section is small and
+     ctf_lookup_by_symbol_name does not yet exist.)  */
+  while ((sym_type = ctf_symbol_next (fp, &i, &name, 0)) != CTF_ERR)
+    {
+      if (!name)
+	continue;
+
+      if (strcmp (name, "foo") == 0)
+	found_foo = 1;
+      if (strcmp (name, "bar") == 0)
+	found_bar = 1;
+    }
+  if (ctf_errno (fp) != ECTF_NEXT_END)
+    fprintf (stderr, "Unexpected error iterating over symbols: %s\n",
+	     ctf_errmsg (ctf_errno (fp)));
+
+  if (!found_foo)
+    printf ("foo missing from the data object section\n");
+  if (!found_bar)
+    printf ("bar missing from the data object section\n");
+
+  ctf_dict_close (fp);
+  ctf_close (ctf);
+
+  return 0;
+
+ open_err:
+  fprintf (stderr, "%s: cannot open: %s\n", argv[0], ctf_errmsg (err));
+  return 1;
+}
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.lk b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.lk
new file mode 100644
index 0000000..68c777f
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld-r.lk
@@ -0,0 +1,7 @@
+# source: nonstatic-var-section-ld-r-ctf.c
+# nonshared: on
+# link: on
+# link_flags: -Wl,--ctf-variables -r
+foo is of type [0-9a-f]*
+bar is of type [0-9a-f]*
+foo missing from the data object section
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.c b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.c
new file mode 100644
index 0000000..4e3a748
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.c
@@ -0,0 +1,76 @@
+#include <ctf-api.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int
+main (int argc, char *argv[])
+{
+  ctf_dict_t *fp;
+  ctf_archive_t *ctf;
+  ctf_id_t foo_type, bar_type, sym_type;
+  int found_foo = 0, found_bar = 0;
+  ctf_next_t *i = NULL;
+  const char *name;
+  int err;
+
+  if (argc != 2)
+    {
+      fprintf (stderr, "Syntax: %s PROGRAM\n", argv[0]);
+      exit(1);
+    }
+
+  if ((ctf = ctf_open (argv[1], NULL, &err)) == NULL)
+    goto open_err;
+
+  if ((fp = ctf_dict_open (ctf, NULL, &err)) == NULL)
+    goto open_err;
+
+  /* Make sure we can look up only 'foo' as a variable: bar, being nonstatic,
+     should have been erased.  */
+
+  if ((foo_type = ctf_lookup_variable (fp, "foo")) == CTF_ERR)
+    printf ("Cannot look up foo\n", ctf_errmsg (ctf_errno (fp)));
+  else
+    printf ("foo is of type %lx\n", foo_type);
+
+  if ((bar_type = ctf_lookup_variable (fp, "bar")) == CTF_ERR)
+    printf ("Cannot look up bar\n", ctf_errmsg (ctf_errno (fp)));
+  else
+    printf ("bar is of type %lx\n", bar_type);
+
+  /* Traverse the entire data object section and make sure it contains an entry
+     for bar alone.  (This is pure laziness: the section is small and
+     ctf_lookup_by_symbol_name does not yet exist.)  */
+  while ((sym_type = ctf_symbol_next (fp, &i, &name, 0)) != CTF_ERR)
+    {
+      if (!name)
+	continue;
+
+      if (strcmp (name, "foo") == 0)
+	{
+	  found_foo = 1;
+	  printf ("Found foo in data object section with type %lx, "
+		  "but it is static\n", sym_type);
+	}
+      if (strcmp (name, "bar") == 0)
+	found_bar = 1;
+    }
+  if (ctf_errno (fp) != ECTF_NEXT_END)
+    fprintf (stderr, "Unexpected error iterating over symbols: %s\n",
+	     ctf_errmsg (ctf_errno (fp)));
+
+  if (!found_foo)
+    printf ("foo missing from the data object section\n");
+  if (!found_bar)
+    printf ("bar missing from the data object section\n");
+
+  ctf_dict_close (fp);
+  ctf_close (ctf);
+
+  return 0;
+
+ open_err:
+  fprintf (stderr, "%s: cannot open: %s\n", argv[0], ctf_errmsg (err));
+  return 1;
+}
diff --git a/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.lk b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.lk
new file mode 100644
index 0000000..edb397a
--- /dev/null
+++ b/libctf/testsuite/libctf-regression/nonstatic-var-section-ld.lk
@@ -0,0 +1,6 @@
+# source: nonstatic-var-section-ld-r-ctf.c
+# link: on
+# link_flags: -Wl,--ctf-variables
+foo is of type [0-9a-f]*
+Cannot look up bar
+foo missing from the data object section
diff --git a/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.c b/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.c
new file mode 100644
index 0000000..d339963
--- /dev/null
+++ b/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.c
@@ -0,0 +1,218 @@
+/* Make sure that writing out a dict with a symtypetab without going via
+   ctf_link_write (as a compiler might do to generate input destined for a
+   linker) always writes out a complete indexed, sorted symtypetab, ignoring the
+   set of symbols reported (if any).  Also a test of dynamic dict sym
+   iteration.  */
+
+#include <ctf-api.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static int
+report_sym (ctf_dict_t *fp, ctf_link_sym_t *sym, const char *name,
+	    uint32_t idx, uint32_t st_type)
+{
+  sym->st_name = name;
+  sym->st_symidx = idx;
+  sym->st_type = st_type;
+  return ctf_link_add_linker_symbol (fp, sym);
+}
+
+static void
+try_maybe_reporting (int report)
+{
+  ctf_dict_t *fp;
+  ctf_id_t func, func2, func3, base, base2, base3;
+  ctf_encoding_t e = { CTF_INT_SIGNED, 0, sizeof (long) };
+  ctf_id_t dummy;
+  ctf_funcinfo_t fi;
+  ctf_next_t *i = NULL;
+  ctf_id_t symtype;
+  const char *symname;
+  unsigned char *buf;
+  size_t bufsiz;
+  int err;
+
+  if ((fp = ctf_create (&err)) == NULL)
+    goto create_err;
+
+  /* Add a couple of sets of types to hang symbols off.  We use multiple
+     identical types so we can distinguish between distinct func / data symbols
+     later on.  */
+
+  if (((base = ctf_add_integer (fp, CTF_ADD_ROOT, "long int", &e)) == CTF_ERR) ||
+      ((base2 = ctf_add_integer (fp, CTF_ADD_ROOT, "long int", &e)) == CTF_ERR) ||
+      ((base3 = ctf_add_integer (fp, CTF_ADD_ROOT, "long int", &e)) == CTF_ERR))
+      goto create_types_err;
+
+  fi.ctc_return = base;
+  fi.ctc_argc = 0;
+  fi.ctc_flags = 0;
+  if (((func = ctf_add_function (fp, CTF_ADD_ROOT, &fi, &dummy)) == CTF_ERR) ||
+      ((func2 = ctf_add_function (fp, CTF_ADD_ROOT, &fi, &dummy)) == CTF_ERR) ||
+      ((func3 = ctf_add_function (fp, CTF_ADD_ROOT, &fi, &dummy)) == CTF_ERR))
+    goto create_types_err;
+
+  /* Add some function and data symbols.  We intentionally add the symbols in
+     near-inverse order by symbol name, so that we can tell whether the
+     (necessarily indexed) section was sorted (since the sort is always in
+     lexicographical sort ordef by name).  */
+  if ((ctf_add_objt_sym (fp, "data_c", base) < 0) ||
+      (ctf_add_objt_sym (fp, "data_a", base2) < 0) ||
+      (ctf_add_objt_sym (fp, "data_b", base3) < 0))
+    goto create_syms_err;
+
+  if ((ctf_add_func_sym (fp, "func_c", func) < 0) ||
+      (ctf_add_func_sym (fp, "func_a", func2) < 0) ||
+      (ctf_add_func_sym (fp, "func_b", func3) < 0))
+    goto create_syms_err;
+
+  /* Make sure we can iterate over them in a dynamic dict and that they have the
+     right types.  We don't care about their order at this stage, which makes
+     the validation here a bit more verbose than it is below.  */
+
+  while ((symtype = ctf_symbol_next (fp, &i, &symname, 0)) != CTF_ERR)
+    {
+      if (symtype == base && strcmp (symname, "data_c") == 0)
+	continue;
+      if (symtype == base2 && strcmp (symname, "data_a") == 0)
+	continue;
+      if (symtype == base3 && strcmp (symname, "data_b") == 0)
+	continue;
+      goto iter_compar_err;
+    }
+  if (ctf_errno (fp) != ECTF_NEXT_END)
+    goto iter_err;
+
+  while ((symtype = ctf_symbol_next (fp, &i, &symname, 1)) != CTF_ERR)
+    {
+      if (symtype == func && strcmp (symname, "func_c") == 0)
+	continue;
+      if (symtype == func2 && strcmp (symname, "func_a") == 0)
+	continue;
+      if (symtype == func3 && strcmp (symname, "func_b") == 0)
+	continue;
+      goto iter_compar_err;
+    }
+  if (ctf_errno (fp) != ECTF_NEXT_END)
+    goto iter_err;
+
+  /* Possibly report some but not all of the symbols, as if we are a linker (no
+     real program would do this without using the ctf_link APIs, but it's not
+     *prohibited*, just useless, and if they do we don't want things to
+     break.  In particular we want all the symbols written out, reported or no,
+     ignoring the reported symbol set entirely.)  */
+  if (report)
+    {
+      ctf_link_sym_t sym;
+      sym.st_nameidx_set = 0;
+      sym.st_nameidx = 0;
+      sym.st_shndx = 404; /* Arbitrary, not SHN_UNDEF or SHN_EXTABS.  */
+      sym.st_value = 404; /* Arbitrary, nonzero.  */
+
+      /* STT_OBJECT: 1.  Don't rely on the #define being visible: this may be a
+	 non-ELF platform!  */
+      if (report_sym (fp, &sym, "data_c", 2, 1) < 0 ||
+	  report_sym (fp, &sym, "data_a", 3, 1) < 0)
+	goto report_err;
+
+      /* STT_FUNC: 2.  */
+      if (report_sym (fp, &sym, "func_c", 4, 2) < 0 ||
+	  report_sym (fp, &sym, "func_a", 5, 2) < 0)
+	goto report_err;
+    }
+
+  /* Write out, to memory.  */
+
+  if ((buf = ctf_write_mem (fp, &bufsiz, 4096)) == NULL)
+    goto write_err;
+  ctf_file_close (fp);
+
+  /* Read back in.  */
+  if ((fp = ctf_simple_open ((const char *) buf, bufsiz, NULL, 0, 0, NULL,
+			     0, &err)) == NULL)
+    goto open_err;
+
+  /* Verify symbol order against the order we expect if this dict is sorted and
+     indexed.  */
+
+  struct ctf_symtype_expected
+  {
+    const char *name;
+    ctf_id_t id;
+  } *expected;
+  struct ctf_symtype_expected expected_obj[] = { { "data_a", base2 },
+						 { "data_b", base3 },
+						 { "data_c", base }, NULL };
+  struct ctf_symtype_expected expected_func[] = { { "func_a", func2 },
+						  { "func_b", func3 },
+						  { "func_c", func }, NULL };
+  expected = expected_obj;
+
+  while ((symtype = ctf_symbol_next (fp, &i, &symname, 0)) != CTF_ERR)
+    {
+      if (expected == NULL)
+	goto expected_overshoot_err;
+      if (symtype != expected->id || strcmp (symname, expected->name) != 0)
+	goto expected_compar_err;
+      printf ("Seen: %s\n", symname);
+      expected++;
+    }
+
+  expected = expected_func;
+  while ((symtype = ctf_symbol_next (fp, &i, &symname, 1)) != CTF_ERR)
+    {
+      if (expected == NULL)
+	goto expected_overshoot_err;
+      if (symtype != expected->id || strcmp (symname, expected->name) != 0)
+	goto expected_compar_err;
+      printf ("Seen: %s\n", symname);
+      expected++;
+    }
+
+  ctf_file_close (fp);
+
+  return;
+
+ create_err:
+  fprintf (stderr, "Creation failed: %s\n", ctf_errmsg (err));
+  exit (1);
+ open_err:
+  fprintf (stderr, "Reopen failed: %s\n", ctf_errmsg (err));
+  exit (1);
+ create_types_err:
+  fprintf (stderr, "Cannot create types: %s\n", ctf_errmsg (ctf_errno (fp)));
+  exit (1);
+ create_syms_err:
+  fprintf (stderr, "Cannot create syms: %s\n", ctf_errmsg (ctf_errno (fp)));
+  exit (1);
+ iter_compar_err:
+  fprintf (stderr, "Dynamic iteration comparison failure: %s "
+	   "(reported type: %lx)\n", symname, symtype);
+  exit (1);
+ iter_err:
+  fprintf (stderr, "Cannot iterate: %s\n", ctf_errmsg (ctf_errno (fp)));
+  exit (1);
+ report_err:
+  fprintf (stderr, "Cannot report symbol: %s\n", ctf_errmsg (ctf_errno (fp)));
+  exit (1);
+ write_err:
+  fprintf (stderr, "Cannot write out: %s\n", ctf_errmsg (ctf_errno (fp)));
+  exit (1);
+ expected_overshoot_err:
+  fprintf (stderr, "Too many symbols in post-writeout comparison\n");
+  exit (1);
+ expected_compar_err:
+  fprintf (stderr, "Non-dynamic iteration comparison failure: %s "
+	   "(type %lx): expected %s (type %lx)\n", symname, symtype,
+	   expected->name, expected->id);
+  exit (1);
+}
+
+int
+main (int argc, char *argv[])
+{
+  try_maybe_reporting (0);
+  try_maybe_reporting (1);
+}
diff --git a/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.lk b/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.lk
new file mode 100644
index 0000000..3f9d900
--- /dev/null
+++ b/libctf/testsuite/libctf-writable/symtypetab-nonlinker-writeout.lk
@@ -0,0 +1,12 @@
+Seen: data_a
+Seen: data_b
+Seen: data_c
+Seen: func_a
+Seen: func_b
+Seen: func_c
+Seen: data_a
+Seen: data_b
+Seen: data_c
+Seen: func_a
+Seen: func_b
+Seen: func_c