@amritk/nish-x86_64-linux 0.18.0 → 0.20.0

package/runtime/runtime-simd.c

@@ -2,10 +2,10 @@
  * bytes at a time (WP38 S1, docs/wp38-simd.md §3.1).
  *
  * A translation unit of its own for the reason runtime-host.c is one: each file
- * carries its own measured `.text*` ceiling in tests/run.js, and runtime.c had
- * no room left when this arrived. Section GC means a program that never calls a
- * kernel links none of this file, and scripts/build.sh pairs it with runtime.c
- * like the other halves, so a link line still names one runtime.
+ * carries its own measured `.text*` ceiling in tests/runtime-budgets.js, and
+ * runtime.c had no room left when this arrived. Section GC means a program that
+ * never calls a kernel links none of this file, and scripts/build.sh pairs it
+ * with runtime.c like the other halves, so a link line still names one runtime.
  *
  * Every kernel has up to three paths. The scalar one runs anywhere. The base
  * one uses the vectors every machine of the target has -- SSE2 on x86-64, NEON

package/runtime/runtime-wasm.c

@@ -133,7 +133,9 @@ void nish_panic_div(_Bool by_zero) { (void)by_zero; __builtin_trap(); }
 void nish_panic_overflow(uint32_t op) { (void)op; __builtin_trap(); }
 void nish_exit(int32_t code) { (void)code; __builtin_trap(); }
 /* A panic's message (`panic`, `expect`, a failed range entry) has no stderr to
- * go to here; the `nish_exit` that follows it is the trap. An exported function
- * with a ranged parameter checks it on entry (WP31 §9), so this is what lets
- * such a module link; the loader throws a RangeError before the call reaches it. */
+ * go to here, so `nish_panic` is the trap. An exported function with a ranged
+ * parameter checks it on entry (WP31 §9), so this is what lets such a module
+ * link; the loader throws a RangeError before the call reaches it. */
+void nish_panic(const void *s) { (void)s; __builtin_trap(); }
+/* Output has nowhere to go either. */
 void nish_write(const void *s, int32_t fd, _Bool newline) { (void)s; (void)fd; (void)newline; }

package/runtime/runtime.c

@@ -18,6 +18,7 @@
  * both use `-flto`, and the cold paths that lost the inlining are cold.
  */
 #define _POSIX_C_SOURCE 200809L
+#include <errno.h>
 #include <inttypes.h>
 #include <math.h>
 #include <stddef.h>
@@ -69,6 +70,11 @@ int __main_argc_argv(int argc, char **argv) { return nish_c_main(argc, argv); }
    allocates from compiled code. The asserts below are the contract, checked
    wherever this file is compiled. */
 typedef struct nish_chunk { struct nish_chunk *next; uint64_t cap; } nish_chunk;
+/* runtime-cross.c walks the chunks through a copy of this definition, which
+   asserts the same three facts. */
+_Static_assert(sizeof(nish_chunk) == 16, "runtime-cross.c's nish_xchunk: { next, cap }, the bytes after it");
+_Static_assert(offsetof(nish_chunk, next) == 0, "runtime-cross.c's nish_xchunk: next first");
+_Static_assert(offsetof(nish_chunk, cap) == 8, "runtime-cross.c's nish_xchunk: cap second");
 struct nish_arena { char *buf; uint64_t off; uint64_t cap; nish_chunk *chunks; };
 /* One per thread under -DNISH_THREADS, one per process otherwise; the layout is
    the same either way, which is why nothing else in this file has to know. */
@@ -79,12 +85,45 @@ _Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bum
 _Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
 _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
 
-/* `fputs` rather than one `write`: libc's own loop finishes a short write,
-   which a bare `write` would cut off (docs/security/runtime.md, RT-11), and
-   stderr is unbuffered, so the message leaves before `_exit`. A C host that
-   gives stderr a buffer of its own would lose it here. */
+/* ---- Panics: the first one wins.
+
+   Every way a program fails -- a failed check, `panic`, out of memory -- calls
+   `nish_panic_claim` before it prints. Two tasks of a scope, or two workers of
+   a parallel map, can fail at once, and without the claim both messages would
+   reach stderr interleaved and both threads would race to the exit. The first
+   to claim prints its whole message and exits; any later one parks until
+   that exit ends the process, so exactly one message is printed and the exit
+   code is the first panic's. How each path exits is unchanged by the claim:
+   `panic`, `expect` and a failed range entry (`nish_panic`) call `exit(1)`, as
+   they did through `nish_exit`, so atexit handlers run and stdio is flushed;
+   a failed check and out of memory call `_exit(1)`, as they always have. Only
+   one thread can reach either exit, because the claim comes first. Only a
+   threads build (`-DNISH_THREADS`) can have two threads panic, so only it
+   pays for the claim; everywhere else it is an empty inline function. Under wasi with threads, the trap is the
+   defensive answer: no host there gives a parked thread a way to wait. */
+#ifdef NISH_THREADS
+static int nish_panicked;
+void nish_panic_claim(void) {
+  if (__atomic_exchange_n(&nish_panicked, 1, __ATOMIC_ACQ_REL)) {
+#if defined(__wasi__)
+    __builtin_trap();
+#else
+    for (;;) pause();
+#endif
+  }
+}
+#else
+static inline void nish_panic_claim(void) {}
+#endif
+
+/* The message goes out through `nish_write_all`, below, which finishes a
+   short write and retries one a signal interrupts (docs/security/runtime.md,
+   RT-11); it is unbuffered, so the message leaves before `_exit`. It used
+   `fputs`, whose libc loop finishes a short write but gives up on `EINTR`. */
+static void nish_write_all(int fd, const char *p, uint64_t n);
 static NISH_COLD void nish_die(const char *msg) {
-  fputs(msg, stderr);
+  nish_panic_claim();
+  nish_write_all(2, msg, strlen(msg));
   _exit(1);
 }
 /* A function rather than a macro around `nish_die`: seven call sites each
@@ -283,19 +322,34 @@ int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) { return nish_
    does the same. So the bytes are written until all of them are out, or until
    a write fails (docs/security/runtime.md, RT-11). A failure still ends the
    output, `EAGAIN` on a non-blocking stdout included, since spinning on it
-   would burn a core. `EINTR` is not retried here: it needs a handler
-   installed without `SA_RESTART`, and the only one this runtime installs
-   (runtime-host.c) has it, so an interrupted write either restarts in the
-   kernel or comes back short. The newline needs no loop: one byte is never
-   written in part. */
-void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
+   would burn a core. `EINTR` is retried, the newline's included: the only
+   handler this runtime installs (runtime-host.c) has `SA_RESTART`, but a C
+   host may install one without it. `panic`'s message, `expect`'s, and the
+   arithmetic and out-of-memory panics (`nish_die`) are written here. The
+   index and slice panics and the file and entropy failures use `dprintf`, and
+   runtime-parallel.c's out of memory one `write`: neither retries `EINTR`. */
+static void nish_write_all(int fd, const char *p, uint64_t n) {
   uint64_t done = 0;
   ssize_t k;
-  while (done < s->len && (k = write(fd, s->data + done, s->len - done)) > 0) done += k;
-  if (newline) (void)!write(fd, "\n", 1);
+  while (done < n) {
+    k = write(fd, p + done, n - done);
+    if (k > 0) done += k;
+    else if (k == 0 || errno != EINTR) break;
+  }
+}
+void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
+  nish_write_all(fd, s->data, s->len);
+  if (newline) nish_write_all(fd, "\n", 1);
 }
 /* console.log(s) */
 void nish_print(const nish_str *s) { nish_write(s, 1, 1); }
+/* `panic(message)`, `r.expect(message)` and a failed range entry: the message
+   and a newline on stderr, then `exit(1)`, the first panic only. */
+__attribute__((noreturn)) void nish_panic(const nish_str *s) {
+  nish_panic_claim();
+  nish_write(s, 2, 1);
+  exit(1);
+}
 
 /* Decimal digits of `u`, with a '-' in front when `neg`. 20 digits is the
    widest a uint64_t can be, plus the sign. */
@@ -1245,6 +1299,7 @@ __attribute__((noinline)) void nish_wipe(nish_array *bytes) {
 }
 
 void nish_panic_index(uint64_t idx, uint64_t len) {
+  nish_panic_claim();
   dprintf(2, "index out of range: %" PRIu64 " >= %" PRIu64 "\n", idx, len);
   _exit(1);
 }
@@ -1258,6 +1313,7 @@ void nish_panic_index(uint64_t idx, uint64_t len) {
    a reader who wrote `s.slice(i - 1)` wants to be told `-1` rather than
    18446744073709551615. The length cannot be negative either way. */
 void nish_panic_slice(int64_t start, int64_t end, int64_t len) {
+  nish_panic_claim();
   dprintf(2, "slice out of range: [%" PRId64 ", %" PRId64 ") of length %" PRId64 "\n", start, end, len);
   _exit(1);
 }

package/runtime/shim.mjs

@@ -22,7 +22,8 @@
  *     `indexOf` answers with one. `slice` cuts on byte offsets too and panics
  *     on a range the string does not contain, where JavaScript would clamp and
  *     read a negative offset from the end. `String.fromCharCode` builds a
- *     one-byte string from the low 8 bits.
+ *     one-byte string from the low 8 bits, and `String.fromBytes` one such
+ *     string per byte of its range.
  *   - `a[i]` is bounds-checked: out of range prints
  *     `index out of range: <i> >= <len>` to stderr and exits 1, and so is
  *     `a.pop()` on an empty array, which has no `undefined` to return.
@@ -347,6 +348,20 @@ export function fromCharCode(code) {
   return Buffer.from([toIndex(code) & 0xff]).toString("latin1");
 }
 
+/**
+ * `String.fromBytes(bytes, start, end)`: the bytes of `[start, end)`, one
+ * code unit each as `fromCharCode` builds them, checked as `s.slice`'s range
+ * is and failing with its panic.
+ */
+export function fromBytes(bytes, start, end) {
+  const from = toIndex(start);
+  const to = toIndex(end);
+  if (!(from >= 0 && from <= to && to <= bytes.length)) panicSlice(from, to, bytes.length);
+  const out = Buffer.allocUnsafe(to - from);
+  for (let i = from; i < to; i++) out[i - from] = bytes[i];
+  return out.toString("latin1");
+}
+
 /** `console.log(x)`: `String(x)` (no `n` suffix for i64) plus a newline, written synchronously. */
 export function log(x) {
   fs.writeSync(1, `${String(x)}\n`);
@@ -726,6 +741,61 @@ export function spawnSyncTo(argv, out, err) {
   return spawnImpl(argv, out, err);
 }
 
+/**
+ * `spawn(argv)` and `waitPid(pid, flags)` (WP34 N12) have no faithful reading
+ * under Node, for `signalFd`'s reason: Node reaps its children itself, on the
+ * event loop, and hands their status to an `exit` listener, so no synchronous
+ * function here can wait for one, and a child Node started is never there for
+ * a wait-less poll to find. Each throws, naming itself.
+ */
+function noProcessReading(name) {
+  throw new Error(
+    `\`${name}\` has no synchronous reading under Node: a child is reaped by the event loop, which a synchronous wait never returns to (docs/wp33-round-trip.md)`
+  );
+}
+
+export function spawn() {
+  return noProcessReading("spawn");
+}
+
+export function waitPid() {
+  return noProcessReading("waitPid");
+}
+
+/**
+ * `kill(pid, sig)`: 0, or a negative errno, as `runtime-os.c`'s `nish_kill`
+ * answers. Only 0, 2, 9 and 15 are sent and a pid of 0 or below is refused,
+ * both -22, before Node is asked; Node's error then names its errno, which
+ * `os.constants.errno` turns back into the number (-3 for no such process).
+ */
+export function kill(pid, sig) {
+  if (pid <= 0 || !(sig === 0 || sig === 2 || sig === 9 || sig === 15)) return -22;
+  try {
+    process.kill(pid, sig);
+    return 0;
+  } catch (e) {
+    return -(os.constants.errno[e.code] ?? 22);
+  }
+}
+
+/**
+ * `availableParallelism()`: Node's own count, which reads the affinity mask as
+ * the native one does, lowered by a positive `NISH_NUM_THREADS` the way the
+ * native count is. The native count also reads a cgroup v2 CPU quota, which
+ * Node does not, so inside a container with a quota the two may differ; both
+ * are at least 1.
+ */
+export function availableParallelism() {
+  const n = os.availableParallelism();
+  const want = /^[0-9]+$/.test(process.env.NISH_NUM_THREADS ?? "") ? Number(process.env.NISH_NUM_THREADS) : 0;
+  return want > 0 && want < n ? want : n;
+}
+
+/** `totalMemory()`: `os.totalmem()`, as a BigInt because an `i64` is held as one here. */
+export function totalMemory() {
+  return BigInt(os.totalmem());
+}
+
 /**
  * `monotonicNanos()`: `process.hrtime.bigint()`, a monotonic clock in
  * nanoseconds (`CLOCK_MONOTONIC` on every platform that has it, which is the

package/scripts/build.sh

@@ -3,14 +3,16 @@
 #
 #   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm|wasi|napi]
 #
-# The C runtime is six translation units and is named as one: an input
+# The C runtime is eight translation units and is named as one: an input
 # <dir>/runtime.c also compiles <dir>/runtime-os.c, the half that wraps the
 # system calls (files, directories, subprocesses, the environment, the clock),
 # <dir>/runtime-parallel.c, the half that divides a range of work across
-# threads, <dir>/runtime-host.c, the wall clock, entropy, file times and
-# signals, <dir>/runtime-net.c, the sockets of `nish:net`, and
-# <dir>/runtime-simd.c, the byte searches that read a vector at a time. Each of
-# those files says why they are compiled and measured apart.
+# threads, <dir>/runtime-cross.c, the copies that carry a string or an array
+# from one thread's arena to another's, <dir>/runtime-host.c, the wall clock, entropy, file times and
+# signals, <dir>/runtime-net.c, the sockets of `nish:net`,
+# <dir>/runtime-simd.c, the byte searches that read a vector at a time, and
+# <dir>/runtime-aes.c, AES-GCM on the CPU's AES instructions. Each of those
+# files says why they are compiled and measured apart.
 #
 # Profiles:
 #   debug  clang defaults: no optimisation, symbols kept. The "before" number.
@@ -57,6 +59,29 @@
 # put in the .ll (line table, variables) reaches the binary. `nish
 # --link -g` passes it through automatically.
 #
+# CPU level (WP38 S2): `--cpu x86-64-v3` compiles and links every input --
+# the module, the runtime and any other C -- with -march=x86-64-v3
+# -ffp-contract=off, so the code generator may use AVX2, BMI2 and the other
+# v3 instructions and still forms no fused multiply-add the IR did not write.
+# It is the one level taken; any other value is refused with exit 2, and so are
+# the wasm and wasi profiles, which are not x86-64. A binary built with it
+# stops with SIGILL on a CPU without AVX2. `nish --link --cpu x86-64-v3`
+# passes it through.
+#
+# The runtime compiled once (the debug, speed and size profiles only; `nish
+# --link` and `nish run` use these through their runtime cache, src/compile.ts):
+#   --runtime-objects <dir>  compile the runtime.c input and its seven siblings,
+#                            one $CC -c each and all at once, into
+#                            <dir>/<unit>.o with the profile's compile flags,
+#                            and link nothing. speed and size store LTO bitcode,
+#                            so the link can still inline the runtime into the
+#                            program. No -o; prints nothing on success.
+#   --runtime-from <dir>     link against <dir>/<unit>.o in place of a
+#                            runtime.c input, after compiling every other input
+#                            with its own $CC -c, all at once. The link line is
+#                            the one the profile always uses.
+# Both refuse the wasm, wasi and napi profiles and --pgo-*, with exit 2.
+#
 # Works on Linux (clang + lld preferred, GNU ld tolerated) and macOS (Apple ld64
 # or Homebrew llvm). Set CC to pick a compiler (default: clang on PATH).
 set -euo pipefail
@@ -67,28 +92,74 @@ inputs=()
 pgo=()                                 # -fprofile-generate / -fprofile-use=<file>
 debug=0                                # -g: keep DWARF (nish -g emits it in the IR; runtime.c gets it here)
 threads=0                              # --threads: -DNISH_THREADS, the thread-local arena (WP20 T0)
+objects_to=""                          # --runtime-objects <dir>: compile the runtime alone, into <dir>
+objects_from=""                        # --runtime-from <dir>: link against the runtime compiled there
+cpu=""                                 # --cpu x86-64-v3: the one CPU level above the baseline (WP38 S2)
 while [ $# -gt 0 ]; do
   case "$1" in
     -o) out="$2"; shift 2 ;;
     --profile) profile="$2"; shift 2 ;;
     -g) debug=1; shift ;;
     --threads) threads=1; shift ;;
+    --cpu)
+      [ -n "${2-}" ] || { echo "error: --cpu needs a level; the one taken is x86-64-v3" >&2; exit 2; }
+      cpu="$2"; shift 2 ;;
+    --runtime-objects) objects_to="$2"; shift 2 ;;
+    --runtime-from) objects_from="$2"; shift 2 ;;
     --pgo-generate) pgo=(-fprofile-generate); shift ;;
     --pgo-use)
       [ -f "$2" ] || { echo "error: --pgo-use: profile '$2' not found (run the instrumented binary, then llvm-profdata merge)" >&2; exit 2; }
       pgo=("-fprofile-use=$2"); shift 2 ;;
-    -h|--help) sed -n '2,42p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,85p' "$0"; exit 0 ;;
     *) inputs+=("$1"); shift ;;
   esac
 done
 [ ${#inputs[@]} -gt 0 ] || { echo "error: no input files" >&2; exit 2; }
-[ -n "$out" ] || { echo "error: -o <out> is required" >&2; exit 2; }
+if [ -n "$cpu" ]; then
+  [ "$cpu" = x86-64-v3 ] || { echo "error: --cpu takes x86-64-v3, not '$cpu'" >&2; exit 2; }
+  case "$profile" in
+    wasm|wasi) echo "error: --cpu x86-64-v3 is an x86-64 level, so the $profile profile does not take it" >&2; exit 2 ;;
+  esac
+fi
+# wasm-ld exports a wasm module's linear memory as `memory`, so under the wasm
+# profile's `--export-all` a function of that name makes a module Node refuses
+# to compile ("Duplicate export name 'memory'", #643). The wasi module exports
+# only `memory` and `_start`, but the name is reserved there too, so a program
+# that links for wasi also links for wasm. The compiler refuses one (NL3038)
+# when it knows the build is wasm, but IR compiled for the host with `-o` alone
+# reaches these profiles without telling it, so the IR is read here too.
+case "$profile" in
+  wasm|wasi)
+    for i in ${inputs[@]+"${inputs[@]}"}; do
+      case "$i" in
+        *.ll)
+          # An `internal` or `private` definition is not exported, so it is left alone.
+          if grep -E '^define [^@]*@memory\(' "$i" | grep -Evq '^define (internal|private) '; then
+            echo "error: $i defines a function named \`memory\`, the name the $profile profile's module exports its linear memory under; rename the function" >&2
+            exit 2
+          fi ;;
+      esac
+    done ;;
+esac
+if [ -n "$objects_to" ] || [ -n "$objects_from" ]; then
+  # A cached runtime is the profile's ordinary compile, so it exists only for
+  # the profiles that compile the runtime with nothing but these flags.
+  case "$profile" in
+    debug|speed|size) ;;
+    *) echo "error: --runtime-objects and --runtime-from take the debug, speed and size profiles, not '$profile'" >&2; exit 2 ;;
+  esac
+  [ ${#pgo[@]} -eq 0 ] || { echo "error: --runtime-objects and --runtime-from do not take --pgo-*" >&2; exit 2; }
+  [ -z "$objects_to" ] || [ -z "$objects_from" ] || { echo "error: --runtime-objects and --runtime-from are two different builds" >&2; exit 2; }
+fi
+[ -n "$out" ] || [ -n "$objects_to" ] || { echo "error: -o <out> is required" >&2; exit 2; }
 
-# The runtime is six translation units, and a caller names one: whoever passes
+# The runtime is eight translation units, and a caller names one: whoever passes
 # <dir>/runtime.c gets <dir>/runtime-os.c, <dir>/runtime-parallel.c,
-# <dir>/runtime-host.c, <dir>/runtime-net.c and <dir>/runtime-simd.c compiled
-# beside it, on every profile, wasi included: runtime-simd.c takes its scalar
-# path there unless the build adds -msimd128. They were one file until the
+# <dir>/runtime-cross.c, <dir>/runtime-host.c, <dir>/runtime-net.c, <dir>/runtime-simd.c and
+# <dir>/runtime-aes.c compiled beside it, on every profile, wasi included:
+# runtime-simd.c takes its scalar path there unless the build adds -msimd128,
+# and runtime-aes.c compiles to an answer of 0 and stubs that nothing calls,
+# because the compiler emits no call to its kernels for wasm32. They were one file until the
 # operating-system half was split out for its own size budget, and the parallel
 # half followed for the same reason (each file's header comment says why), and
 # a link line is where those splits
@@ -98,10 +169,11 @@ done
 # here keeps every one of those correct, and keeps "the runtime" one thing to
 # name from the outside. A caller that names one itself is left alone, because
 # naming one object twice is a duplicate-symbol error.
+halves="runtime-os.c runtime-parallel.c runtime-cross.c runtime-host.c runtime-net.c runtime-simd.c runtime-aes.c"
 for i in ${inputs[@]+"${inputs[@]}"}; do
   case "$i" in
     */runtime.c|runtime.c)
-      for half in runtime-os.c runtime-parallel.c runtime-host.c runtime-net.c runtime-simd.c; do
+      for half in $halves; do
         side="${i%runtime.c}$half"
         have=0
         for j in "${inputs[@]}"; do
@@ -177,12 +249,130 @@ if [ "$debug" = 1 ]; then common+=(-g); strip_flag=(); fi
 # command lines, which have no threads to link against, and where
 # runtime-parallel.c compiles to its sequential fallback because it tests
 # __wasi__ and __wasm__ as well as the macro.
+# --cpu: every unit at the one level, so the module, the runtime and the link
+# (LTO generates code there) agree. -ffp-contract=off keeps the meaning fixed:
+# v3 has FMA, and contracting a*b+c into one rounding would print a different
+# float than the baseline build (docs/LANGUAGE.md, "The CPU level").
+if [ -n "$cpu" ]; then common+=(-march=x86-64-v3 -ffp-contract=off); fi
+
 tls=()
 if [ "$threads" = 1 ]; then
   common+=(-DNISH_THREADS=1 -ftls-model=initial-exec -pthread)
   tls=(-DNISH_THREADS=1 -ftls-model=initial-exec)
 fi
 
+# What the speed and size profiles compile every input with, beside `common`.
+# One list per profile, because the runtime cache below compiles with exactly
+# what the one-command link does, and two copies of a flag set drift.
+optimise=()
+case "$profile" in
+  speed)
+    optimise=(-O3 -flto -DNDEBUG ${pgo[@]+"${pgo[@]}"}
+      -ffunction-sections -fdata-sections -fomit-frame-pointer
+      -fno-asynchronous-unwind-tables -fno-unwind-tables ${elf[@]+"${elf[@]}"}) ;;
+  size)
+    optimise=(-Oz -flto -DNDEBUG ${pgo[@]+"${pgo[@]}"}
+      -ffunction-sections -fdata-sections -fomit-frame-pointer
+      -fno-asynchronous-unwind-tables -fno-unwind-tables ${elf[@]+"${elf[@]}"}
+      -fno-stack-protector -fvisibility=hidden) ;;
+esac
+
+# --runtime-objects and --runtime-from: the one-command link split in two, with
+# every compile it held run at once. A `$CC -c` takes `common` and `optimise`,
+# which is what the one command compiles each input with -- less
+# -fuse-ld=lld, which only names the linker -- so a runtime unit compiles to the
+# same object either way: native code for debug, -flto bitcode for speed and
+# size, which the link still optimises together with the program. The link
+# takes the same line the profile always uses, with objects for sources.
+if [ -n "$objects_to" ] || [ -n "$objects_from" ]; then
+  compile=()
+  for flag in "${common[@]}"; do
+    case "$flag" in -fuse-ld=*) ;; *) compile+=("$flag") ;; esac
+  done
+  compile+=(${optimise[@]+"${optimise[@]}"})
+  # Waits for every job, not just the last, and fails when any of them did.
+  # bash 3.2 has no `wait -n`, so the jobs are waited for in order.
+  pids=()
+  join_jobs() {
+    local failed=0 pid
+    for pid in ${pids[@]+"${pids[@]}"}; do
+      wait "$pid" || failed=1
+    done
+    pids=()
+    return "$failed"
+  }
+  # The compiles are this script's children, so a signal that stops it stops
+  # them too, before anything they write into is removed. A finished script
+  # has waited for every one of them, so there is nothing left to stop.
+  stop_jobs() {
+    if [ ${#pids[@]} -gt 0 ]; then
+      kill "${pids[@]}" 2>/dev/null || true
+      wait "${pids[@]}" 2>/dev/null || true
+      pids=()
+    fi
+  }
+  work=""
+  trap 'stop_jobs; [ -z "$work" ] || rm -rf -- "$work"' EXIT
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+fi
+
+if [ -n "$objects_to" ]; then
+  runtime=""
+  for i in "${inputs[@]}"; do
+    case "$i" in
+      */runtime.c|runtime.c) runtime="$i" ;;
+      */runtime-*.c|runtime-*.c) ;;     # its siblings, added above
+      *) echo "error: --runtime-objects compiles the runtime alone, not $i" >&2; exit 2 ;;
+    esac
+  done
+  [ -n "$runtime" ] || { echo "error: --runtime-objects needs runtime/runtime.c" >&2; exit 2; }
+  mkdir -p -- "$objects_to"
+  objects_to=$(cd -- "$objects_to" && pwd)
+  # Each unit is compiled from inside its own directory, by its bare name, so
+  # an object holds no trace of where the compile was started: -g's DWARF names
+  # the file `runtime.c` in the runtime's own directory, whichever directory
+  # the first link that compiled it was run in.
+  runtime_dir=$(dirname -- "$runtime")
+  # A CC named by a relative path is named from here, not from there.
+  case "$CC" in /*) ;; */*) CC="$(pwd)/$CC" ;; esac
+  for unit in runtime.c $halves; do
+    (cd -- "$runtime_dir" && exec "$CC" "${compile[@]}" -c "$unit" -o "$objects_to/${unit%.c}.o") &
+    pids+=("$!")
+  done
+  join_jobs || { echo "error: the runtime did not compile" >&2; exit 1; }
+  exit 0
+fi
+
+if [ -n "$objects_from" ]; then
+  for unit in runtime.c $halves; do
+    [ -f "$objects_from/${unit%.c}.o" ] || { echo "error: --runtime-from: $objects_from/${unit%.c}.o is missing" >&2; exit 2; }
+  done
+  # The program's own objects are this link's alone, so they go in a private
+  # directory of its own and go with it.
+  work=$(mktemp -d "${TMPDIR:-/tmp}/nish-link.XXXXXX")
+  objects=()
+  n=0
+  for i in "${inputs[@]}"; do
+    case "$i" in */runtime.c|runtime.c) echo "error: --runtime-from links the runtime in $objects_from, so $i is not an input" >&2; exit 2 ;; esac
+    n=$((n + 1))
+    "$CC" "${compile[@]}" -c "$i" -o "$work/$n.o" &
+    pids+=("$!")
+    objects+=("$work/$n.o")
+  done
+  join_jobs || { echo "error: a module did not compile" >&2; exit 1; }
+  # In the order the one-command link names them: the inputs, then runtime.c
+  # and its siblings.
+  for unit in runtime.c $halves; do
+    objects+=("$objects_from/${unit%.c}.o")
+  done
+  inputs=("${objects[@]}")
+  # clang runs dsymutil itself when one command compiles and links with -g on
+  # macOS; a link of objects does not, so it is run here, while the program's
+  # objects the debug map points at are still there.
+  if [ "$debug" = 1 ] && [ "$(uname -s)" = Darwin ]; then dsym=1; else dsym=0; fi
+fi
+
 # The ${arr[@]+"${arr[@]}"} spelling below is not a style tic: macOS ships bash
 # 3.2 (Apple will not ship GPLv3), where expanding an empty array as "${arr[@]}"
 # under `set -u` is a fatal "unbound variable" -- bash 4.4 made it legal, which is
@@ -191,16 +381,8 @@ fi
 case "$profile" in
   debug)
     "$CC" "${common[@]}" "${inputs[@]}" -lm -o "$out" ;;
-  speed)
-    "$CC" "${common[@]}" -O3 -flto -DNDEBUG ${pgo[@]+"${pgo[@]}"} \
-      -ffunction-sections -fdata-sections -fomit-frame-pointer \
-      -fno-asynchronous-unwind-tables -fno-unwind-tables ${elf[@]+"${elf[@]}"} \
-      "${gc[@]}" ${strip_flag[@]+"${strip_flag[@]}"} "${inputs[@]}" -lm -o "$out" ;;
-  size)
-    "$CC" "${common[@]}" -Oz -flto -DNDEBUG ${pgo[@]+"${pgo[@]}"} \
-      -ffunction-sections -fdata-sections -fomit-frame-pointer \
-      -fno-asynchronous-unwind-tables -fno-unwind-tables ${elf[@]+"${elf[@]}"} \
-      -fno-stack-protector -fvisibility=hidden \
+  speed|size)
+    "$CC" "${common[@]}" "${optimise[@]}" \
       "${gc[@]}" ${strip_flag[@]+"${strip_flag[@]}"} "${inputs[@]}" -lm -o "$out" ;;
   wasm)
     # clang resolves wasm-ld next to its own binary first, then on PATH; ask it
@@ -210,6 +392,23 @@ case "$profile" in
       echo "error: the wasm profile needs wasm-ld (install lld; on macOS: brew install llvm@18)" >&2
       exit 2
     fi
+    # IR compiled for the host rather than with `--target wasm32` calls std/crypto/aes.ts's
+    # AES kernels behind `nish_aes_hw` (src/kernels.ts). runtime-aes.c's wasm32 build
+    # answers 0 there, so the bitsliced code runs, and it is added only for such IR:
+    # every other module links the bytes it always did.
+    # A caller that names runtime-aes.c itself is left alone, as `halves` leaves it:
+    # one object named twice is a duplicate-symbol error.
+    aes_named=0
+    aes_wanted=0
+    for i in ${inputs[@]+"${inputs[@]}"}; do
+      case "$i" in
+        */runtime-aes.c|runtime-aes.c) aes_named=1 ;;
+        *.ll) if grep -q '@nish_aes_hw(' "$i"; then aes_wanted=1; fi ;;
+      esac
+    done
+    if [ "$aes_wanted" = 1 ] && [ "$aes_named" = 0 ]; then
+      inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-aes.c")
+    fi
     # -mbulk-memory lowers llvm.memset/memcpy (`new Array<T>(n)`, `push` growth) to the
     # memory.fill/memory.copy instructions instead of libc calls the freestanding link lacks.
     "$CC" -Wno-override-module --target=wasm32-unknown-unknown -Oz -nostdlib -mbulk-memory \
@@ -284,5 +483,7 @@ case "$profile" in
   *) echo "error: unknown profile '$profile'" >&2; exit 2 ;;
 esac
 
+if [ "${dsym:-0}" = 1 ]; then "$("$CC" -print-prog-name=dsymutil)" "$out"; fi
+
 # `wc -c` pads with spaces on macOS; strip them so the number is clean.
 printf '%s: %s bytes (%s)\n' "$out" "$(wc -c < "$out" | tr -d ' ')" "$profile"