[lld-macho] Use DO_BIND_ADD_ADDR_IMM_SCALED for bind opcodes

[thevinster]

Summary

Implement pass 3 of bind opcodes from ld64 (which supports both 32-bit and 64-bit).
Pass 3 implementation condenses BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB opcode
to BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED. This change is already behind an
O2 flag so it shouldn't impact current performance. I verified ld64's output with x86_64 LLD
and they were both emitting the same optimized bind opcodes (although in a slightly different
order). Tested with arm64_32 LLD and compared that with x86 LLD that the order of the bind
opcodes are the same (offset values are different which should be expected).

[int3]

lld/MachO/SyntheticSections.cpp

367–368

can we have a comment explaining how BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED works, and where the 15 and sizeof(uint64_t) is coming from?

[thevinster]

lld/MachO/SyntheticSections.cpp

367

I believe ld64 switches off the type based on whether it operates on a 32-bit or a 64-bit. I didn't get a chance to verify it because LLD doesn't seem to support i386 (https://github.com/llvm/llvm-project/blob/main/lld/MachO/Driver.cpp#L700-L711).

[thevinster]

lld/MachO/SyntheticSections.cpp

367–368

That was quick! Will add a comment about the 15. As far as the sizeof(uint64_t), I wrote a comment above describing that situation.

[int3]

lld/MachO/SyntheticSections.cpp

367

I'm confused as to why LLD not supporting i386 matters for testing ld64's behavior. llvm-mc can emit i386 object files that we can pass to ld64...

[thevinster]

lld/MachO/SyntheticSections.cpp

367

I get the following error when trying to pass an i386 object file to LLD using x86_64 arch. ld64.lld: error: /Users/leevince/local/llvm-project/build/Debug/tools/lld/test/MachO/Output/bind-opcodes.s.tmp/foo.o has architecture i386 which is incompatible with target architecture x86_64. I'm unsure how to go about this without having to support i386.

[thevinster]

Address comments, split logic by 32-bit or 64-bit, clang-format, tests

[thevinster]

lld/MachO/SyntheticSections.cpp

367

Spoken offline - tested 32-bit arch using arm64_32, and used that as comparison with x86_64.

367–368

I switched the use of 15 to BIND_IMMEDIATE_MASK which I think should be enough to cover adding the extra comment, but I'm happy to add it if it's still confusing to readers.

lld/test/MachO/bind-opcodes.s

1

This file is pretty messy and hard to read. So I'll try to condense what I did here.
1/ In order to run both 64-bit tests and 32-bit tests in one file, I had to separate the suffix the input and output with the arch.
2/ Nothing changed with llvm-objdump. It was merely a forklift from the bottom to the top. There isn't a corresponding one for the arm64_32. I'm not exactly familiar with what it does, but I'm happy to add it if it provides value.
3/ In order to satisfy the linker, I had to switch the use of quad to int otherwise I get relocation errors. The order of the bind opcodes between 32-bit and 64-bit are the same (with slightly offsets)
4/ CHECK are in its own separate files now in order to isolate between different arch.

[int3]

lld/MachO/SyntheticSections.cpp

365–366

the ternary is unnecessary, offsetWidth is just target->wordSize :)

also, I think offsetWidth is kind of a misleading name... pointerSize is probably more apt. Or we could just use target->wordSize directly.

I think I understand the motivation behind this opcode design: Since every binding is the size of one pointer, the next binding must be at least wordSize away. Most likely it's some multiple of wordSize away (if there are multiple intervening pointers). Hence the scaling by pointer size. (Might be worth to write something like this as a comment)

369

how about p->data / offsetWidth <= BIND_IMMEDIATE_MASK, to mirror the assignment below?

372

lld/test/MachO/bind-opcodes.s

1

I think we can make it less messy :)

1: yeah this makes sense
2: dumping the bind table is basically a sanity check: it decodes the bind opcodes into an easy-to-read form so we can verify that we encoded the right things. I think it's worth adding for 32-bit as well, but we can be clever and reuse the same code (see below)
3: I think we can reuse the same code. I haven't tested this but I think something like it should work:

.ifdef PTR64
.macro ptr val
  .quad val
.endm
.endif

.ifdef PTR32
.macro ptr val
  .int val
.endm
.endif

ptr _foo
ptr _bar
...

PTR64 and PTR32 will have to be defined as part of llvm-mc's invocation. See https://github.com/llvm/llvm-project/blob/main/llvm/test/DebugInfo/X86/dwarfdump-header-64.s for an example.
4: FileCheck takes a --check-prefix argument, so we can put the checks in the same file.

15–20

something like this should allow reusing the check across both archs

(see 'Numeric Substitutions' in the FileCheck manual for details)

29

you can just do %lld -arch arm64_32, the later arch will override the earlier one. no need to define another substitution

[thevinster]

lld/MachO/SyntheticSections.cpp

369

I changed it to p->data / target->wordSize < BIND_IMMEDIATE_MASK. I removed the equals comparison because when dyld uncompacts, it seems to add an extra sizeof(intptr_t).

See https://opensource.apple.com/source/dyld/dyld-852/src/ImageLoaderMachOCompressed.cpp.auto.html and search for address += immediate*sizeof(intptr_t) + sizeof(intptr_t);

lld/test/MachO/bind-opcodes.s

1

All of them make sense and have been fixed. The file looks a lot cleaner now :)

[thevinster]

Address more comments

[int3]

Thanks!

lld/MachO/SyntheticSections.cpp

369

I think the previous implementation was the right one. The DO_BIND opcode itself adds a sizeof(intptr_t), which is probably why dyld is doing that.

From http://www.m4b.io/reverse/engineering/mach/binaries/2015/03/29/mach-binaries.html 's description of DO_BIND:

Push the current record onto the "import stack", and then increment the current record's address offset by the size of the platform pointer (32 or 64 bit)

It would be good to have a test case that covers this edge case :)

[int3]

one nit about the commit title / description: there are lots of opcodes with immediates, I think it would be clearer to mention DO_BIND_ADD_ADDR_IMM_SCALED specifically in the title. Also "Implement pass 3 of bind opcodes from ld64" should be followed by a short description of what pass 3 does -- we shouldn't expect future readers to have to look it up :)

lld/test/MachO/bind-opcodes.s

1

almost forgot about this :) we need it now that we're building arm binaries

[thevinster]

In D106128#2888416, @int3 wrote:

one nit about the commit title / description: there are lots of opcodes with immediates, I think it would be clearer to mention DO_BIND_ADD_ADDR_IMM_SCALED specifically in the title. Also "Implement pass 3 of bind opcodes from ld64" should be followed by a short description of what pass 3 does -- we shouldn't expect future readers to have to look it up :)

Done.

lld/MachO/SyntheticSections.cpp

369

Re-capping offline convo. In ld64's implementation, it uses "<" instead of "<=". It makes more sense to keep the same behavior to prevent any unknown deviations from ld64. It may be a typo on ld64, but this will prevent unknown mysterious bugs down the road.

[thevinster]

Add comments for clarity and address minor comments

[MaskRay]

Reverted by 88e2268a344a0ab3df455af08f32c2c354ea55a4

for (BindIR *p = &opcodes[0]; p->opcode != BIND_OPCODE_DONE; ++p) { has a heap-buffer-overflow with test/MachO/bind-opcodes.s

-DLLVM_USE_SANITIZER=Address check-lld-macho to reproduce.

[thevinster]

Fixing ASAN

In D106128, buffer overflow was detected when incrementing BindIR pointers. This would
most likely not happen in an ideal world, but switching it to array indexing
is safer.

Ran with -DLLVM_USE_SANITIZER=Address and check-lld-macho.

[int3]

Fix looks good but can we figure out how it was happening in the first place? I would guess that we were running optimizeOpcodes on an empty vector, but I'm not sure how that would happen in the given test...

lld/MachO/SyntheticSections.cpp

369

I think this can be a for-range loop

[thevinster]

In D106128#2890061, @int3 wrote:

Fix looks good but can we figure out how it was happening in the first place? I would guess that we were running optimizeOpcodes on an empty vector, but I'm not sure how that would happen in the given test...

We assumed that the BIND_OPCODE_DONE would exist in the vector but it actually doesn't. It actually never gets stored in the vector and is just emitted after everything is optimized. Printing out the opcodes as well shows that BIND_OPCODE_DONE never existed. Now, why this wasn't caught in testing is that this pass happens on specific checks. Sooner or later, it will randomly encounter the an opcode of 0 (by random chance) and exit the loop. The size and contents of the vector are still unchanged so testing without ASAN continued to show correct results.

lld/MachO/SyntheticSections.cpp

369

Done. Re-tested with ASAN. Everything looks good :)

[thevinster]

use for range loop

[int3]

It actually never gets stored in the vector and is just emitted after everything is optimized.

D'oh, that makes sense :)

[MaskRay]

Some patterns may not exist in the real world but it'd be good to think of such scenarios and don't crash the linker.
buffer overrun is worse, because it makes the linker vulnerable.

lld/MachO/SyntheticSections.cpp

if ((opcodes[i].opcode == BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB) &&
       }
     } else {
       opcodes[pWrite] = opcodes[i - 1];
     }
   }
   if (i == opcodes.size())
     opcodes[pWrite] = opcodes[i - 1];
   opcodes.resize(pWrite + 1);
+
+  // Pass 3: Use immediate encodings
+  // Every binding is the size of one pointer. If the next binding is a
+  // multiple of wordSize away that is within BIND_IMMEDIATE_MASK, the
+  // opcode can be scaled by wordSize into a single byte and dyld will
+  // expand it to the correct address.
+  for (auto &p : opcodes) {
+    // It's unclear why the check needs to be less than BIND_IMMEDIATE_MASK,
+    // but ld64 currently does this. This could be a potential bug, but
+    // for now, perform the same behavior to prevent mysterious bugs.
+    if ((p.opcode == BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB) &&
+        ((p.data / target->wordSize) < BIND_IMMEDIATE_MASK) &&
+        ((p.data % target->wordSize) == 0)) {
+      p.opcode = BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED;
+      p.data /= target->wordSize;
+    }
+  }
 }
 
 static void flushOpcodes(const BindIR &op, raw_svector_ostream &os) {
   uint8_t opcode = op.opcode & BIND_OPCODE_MASK;
   switch (opcode) {
   case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
   case BIND_OPCODE_ADD_ADDR_ULEB:
   case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
     os << op.opcode;
     encodeULEB128(op.data, os);
     break;
   case BIND_OPCODE_SET_ADDEND_SLEB:
     os << op.opcode;
     encodeSLEB128(static_cast<int64_t>(op.data), os);
     break;
   case BIND_OPCODE_DO_BIND:
     os << op.opcode;
     break;
   case BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB:
     os << op.opcode;
     encodeULEB128(op.consecutiveCount, os);
     encodeULEB128(op.data, os);
     break;
+  case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
+    os << static_cast<uint8_t>(op.opcode | op.data);
+    break;
   default:
     llvm_unreachable("cannot bind to an unrecognized symbol");
   }
 }
 
 // Non-weak bindings need to have their dylib ordinal encoded as well.
 static int16_t ordinalForDylibSymbol(const DylibSymbol &dysym) {
   if (config->namespaceKind == NamespaceKind::flat || dysym.isDynamicLookup())

lld/test/MachO/bind-opcodes.s

-# REQUIRES: x86
+# REQUIRES: x86, arm
 # RUN: rm -rf %t; split-file %s %t
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/foo.s -o %t/foo.o
-# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/test.s -o %t/test.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin --defsym PTR64=0 %t/test.s -o %t/test.o
 # RUN: %lld -O2 -dylib %t/foo.o -o %t/libfoo.dylib
-# RUN: %lld -O2 -lSystem %t/test.o %t/libfoo.dylib -o %t/test
+# RUN: %lld -O2 -lSystem %t/test.o %t/libfoo.dylib -o %t/test-x86_64
 
-## Test:
+## Test (64-bit):
 ## 1/ We emit exactly one BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM per symbol.
 ## 2/ Combine BIND_OPCODE_DO_BIND and BIND_OPCODE_ADD_ADDR_ULEB pairs.
 ## 3/ Compact BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
-# RUN: obj2yaml %t/test | FileCheck %s
+## 4/ Use BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED if possible.
+# RUN: obj2yaml %t/test-x86_64 | FileCheck %s
 
 # CHECK:      BindOpcodes:
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   Symbol:          _foo
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_TYPE_IMM
 # CHECK-NEXT:   Imm:             1
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_DYLIB_ORDINAL_IMM
 # CHECK-NEXT:   Imm:             2
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB
 # CHECK-NEXT:   Imm:             2
 # CHECK-NEXT:   ULEBExtraData:   [ 0x0 ]
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   ULEBExtraData:   [ 0x2, 0x8 ]
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_ADDEND_SLEB
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   SLEBExtraData:   [ 1 ]
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB

 # CHECK-NEXT:   Symbol:          _bar
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_SET_TYPE_IMM
 # CHECK-NEXT:   Imm:             1
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_ADD_ADDR_ULEB
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   ULEBExtraData:   [ 0xFFFFFFFFFFFFEFD0 ]
 # CHECK-NEXT:   Symbol:          ''
-# CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
-# CHECK-NEXT:   Imm:             0
-# CHECK-NEXT:   ULEBExtraData:   [ 0x8 ]
+# CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED
+# CHECK-NEXT:   Imm:             1
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   ULEBExtraData:   [ 0x1008 ]
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_DO_BIND
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   Symbol:          ''
 # CHECK-NEXT:   Opcode:          BIND_OPCODE_DONE
 # CHECK-NEXT:   Imm:             0
 # CHECK-NEXT:   Symbol:          ''
 
-# RUN: llvm-objdump --macho --bind %t/test | FileCheck %s --check-prefix=BIND
+# RUN: llvm-mc -filetype=obj -triple=arm64_32-apple-darwin %t/foo.s -o %t/foo.o
+# RUN: llvm-mc -filetype=obj -triple=arm64_32-apple-darwin --defsym PTR32=0 %t/test.s -o %t/test.o
+# RUN: %lld -arch arm64_32 -O2 -dylib %t/foo.o -o %t/libfoo.dylib
+# RUN: %lld -arch arm64_32 -O2 -dylib %t/test.o %t/libfoo.dylib -o %t/libtest-arm64_32.dylib
+
+## Test (32-bit):
+## 1/ We emit exactly one BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM per symbol.
+## 2/ Combine BIND_OPCODE_DO_BIND and BIND_OPCODE_ADD_ADDR_ULEB pairs.
+## 3/ Compact BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
+## 4/ Use BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED if possible.
+# RUN: obj2yaml %t/libtest-arm64_32.dylib | FileCheck %s --check-prefix=CHECK32
+
+# CHECK32:      BindOpcodes:
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   Symbol:          _foo
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_TYPE_IMM
+# CHECK32-NEXT:   Imm:             1
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_DYLIB_ORDINAL_IMM
+# CHECK32-NEXT:   Imm:             1
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB
+# CHECK32-NEXT:   Imm:             1
+# CHECK32-NEXT:   ULEBExtraData:   [ 0x0 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   ULEBExtraData:   [ 0x2, 0x4 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_ADDEND_SLEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   SLEBExtraData:   [ 1 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   ULEBExtraData:   [ 0x1004 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_ADDEND_SLEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   SLEBExtraData:   [ 0 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   Symbol:          _bar
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_SET_TYPE_IMM
+# CHECK32-NEXT:   Imm:             1
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_ADD_ADDR_ULEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   ULEBExtraData:   [ 0xFFFFFFFFFFFFEFE8 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED
+# CHECK32-NEXT:   Imm:             1
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   ULEBExtraData:   [ 0x1004 ]
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DO_BIND
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   Symbol:          ''
+# CHECK32-NEXT:   Opcode:          BIND_OPCODE_DONE
+# CHECK32-NEXT:   Imm:             0
+# CHECK32-NEXT:   Symbol:          ''
+
+# RUN: llvm-objdump --macho --bind %t/test-x86_64 | FileCheck %s -D#PTR=8 --check-prefix=BIND
+# RUN: llvm-objdump --macho --bind %t/libtest-arm64_32.dylib | FileCheck %s -D#PTR=4 --check-prefix=BIND
 # BIND:       Bind table:
-# BIND-NEXT:  segment  section   address      type       addend dylib     symbol
-# BIND-NEXT:  __DATA   __data    0x100001000  pointer         0 libfoo    _foo
-# BIND-NEXT:  __DATA   __data    0x100001010  pointer         0 libfoo    _foo
-# BIND-NEXT:  __DATA   __data    0x100001020  pointer         1 libfoo    _foo
-# BIND-NEXT:  __DATA   __data    0x100002030  pointer         0 libfoo    _foo
-# BIND-NEXT:  __DATA   __data    0x100001008  pointer         0 libfoo    _bar
-# BIND-NEXT:  __DATA   __data    0x100001018  pointer         0 libfoo    _bar
-# BIND-NEXT:  __DATA   __data    0x100002028  pointer         0 libfoo    _bar
+# BIND-NEXT:  segment  section   address                               type       addend dylib     symbol
+# BIND-NEXT:  __DATA   __data    0x[[#%X,DATA:]]                       pointer         0 libfoo    _foo
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + mul(PTR, 2)]]        pointer         0 libfoo    _foo
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + mul(PTR, 4)]]        pointer         1 libfoo    _foo
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + 4096 + mul(PTR, 6)]] pointer         0 libfoo    _foo
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + PTR]]                pointer         0 libfoo    _bar
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + mul(PTR, 3)]]        pointer         0 libfoo    _bar
+# BIND-NEXT:  __DATA   __data    0x[[#%.8X,DATA + 4096 + mul(PTR, 5)]] pointer         0 libfoo    _bar
 # BIND-EMPTY:
 
 #--- foo.s
 .globl _foo, _bar
 _foo:
   .space 4
 _bar:
   .space 4
 
 #--- test.s
+.ifdef PTR64
+.macro ptr val
+  .quad \val
+.endm
+.endif
+
+.ifdef PTR32
+.macro ptr val
+  .int \val
+.endm
+.endif
+
 .data
-.quad _foo
-.quad _bar
-.quad _foo
-.quad _bar
-.quad _foo+1
+ptr _foo
+ptr _bar
+ptr _foo
+ptr _bar
+ptr _foo+1
 .zero 0x1000
-.quad _bar
-.quad _foo
+ptr _bar
+ptr _foo
 
 .globl _main
 .text
 _main: