kit

asm_emit.c (46767B)

---

 #include <kit/asm_emit.h>
 #include <kit/disasm.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "arch/arch.h"
 #include "core/arena.h"
 #include "core/buf.h"
 #include "core/core.h"
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "obj/obj.h"
 
 #define ASM_BYTES_PER_LINE 16u
 
 static KitStatus w_str(Writer* w, const char* s) {
   return kit_writer_write(w, s, strlen(s));
 }
 
 static KitStatus w_newline(Writer* w) { return kit_writer_write(w, "\n", 1); }
 
 static KitStatus w_hex_byte(Writer* w, u8 v) {
   static const char H[] = "0123456789abcdef";
   char buf[2];
   buf[0] = H[(v >> 4) & 0xfu];
   buf[1] = H[v & 0xfu];
   return kit_writer_write(w, buf, 2);
 }
 
 static KitStatus w_dec(Writer* w, u64 v) {
   char buf[32];
   u32 i = sizeof(buf);
   if (v == 0) return kit_writer_write(w, "0", 1);
   buf[--i] = '\0';
   while (v) {
     buf[--i] = (char)('0' + (v % 10));
     v /= 10;
   }
   return kit_writer_write(w, buf + i, sizeof(buf) - i - 1);
 }
 
 static KitStatus w_sym(Writer* w, Compiler* c, Sym name) {
   Slice s;
   if (!name) return w_str(w, ".L0");
   s = pool_slice(c->global, name);
   return kit_writer_write(w, s.s, s.len);
 }
 
 typedef struct {
   u32 offset;
   Sym name;
   u16 bind;
   u16 kind;
   u64 size;
 } SymLabel;
 
 static int cmp_labels(const void* va, const void* vb) {
   const SymLabel* a = (const SymLabel*)va;
   const SymLabel* b = (const SymLabel*)vb;
   if (a->offset < b->offset) return -1;
   if (a->offset > b->offset) return 1;
   return 0;
 }
 
 static SymLabel* collect_labels(Compiler* c, ObjBuilder* ob, ObjSecId sec_id,
                                 u32* nlabels_out) {
   ObjSymIter* it = obj_symiter_new(ob);
   SymLabel* labels = NULL;
   u32 n = 0, cap = 0;
 
   *nlabels_out = 0;
   if (!it) return NULL;
 
   for (;;) {
     ObjSymEntry e;
     const ObjSym* sym;
     if (!obj_symiter_next(it, &e)) break;
     sym = e.sym;
     if (!sym || sym->removed) continue;
     if (sym->section_id != sec_id) continue;
     if (sym->kind == SK_SECTION || sym->kind == SK_FILE) continue;
     if (!sym->name) continue;
     /* RISC-V `.LpcrelHi` anchors are codegen-internal labels on AUIPC
      * instructions, used only as the target of a paired `%pcrel_lo`
      * relocation. Many share the one name (one per AUIPC), so emitting them
      * verbatim defines the same label repeatedly and breaks re-assembly. The
      * symbolizer replaces each with a unique synthesized anchor label
      * (emit_anchor / ref_anchor), so suppress the originals here. */
     {
       Slice nm = pool_slice(c->global, sym->name);
       if (slice_eq_cstr(nm, ".LpcrelHi")) continue;
     }
 
     if (n == cap) {
       u32 ncap = cap ? cap * 2 : 8;
       SymLabel* nl = arena_array(c->tu, SymLabel, ncap);
       if (!nl) break;
       if (labels) memcpy(nl, labels, cap * sizeof(SymLabel));
       labels = nl;
       cap = ncap;
     }
     labels[n].offset = (u32)sym->value;
     labels[n].name = sym->name;
     labels[n].bind = sym->bind;
     labels[n].kind = sym->kind;
     labels[n].size = sym->size;
     ++n;
   }
   obj_symiter_free(it);
 
   if (n > 0) qsort(labels, n, sizeof(SymLabel), cmp_labels);
   *nlabels_out = n;
   return labels;
 }
 
 /* ---- Object-format-specific directive syntax (AsmSyntax vtable) --------
  *
  * The directives whose spelling differs by object format hang off this tiny
  * vtable, selected by c->target.obj (asm_syntax_for, defined below). Selecting
  * by format — not arch — is correct: an x64-ELF and an aa64-ELF `.s` use the
  * same `.type`/`.size`/`.section` directives. Everything else (.globl, .comm,
  * labels, data directives, disassembled instructions) is format-neutral and
  * stays in the shared emit path. The Mach-O methods make cc -S output
  * clang/llvm-mc-acceptable; the ELF methods are the historical spelling. */
 typedef struct {
   Writer* w;
   Compiler* c;
 } AsmSynCtx;
 
 typedef struct AsmSyntax {
   KitObjFmt obj;
   const char* name;
   /* Section-switch directive for `sec`: returns 1 = emitted, 0 = skip it. */
   int (*section_header)(const AsmSynCtx* x, const Section* sec);
   /* Symbol type annotation at a definition (ELF `.type`; Mach-O none). */
   void (*sym_type)(const AsmSynCtx* x, Sym name, u16 sym_kind);
   /* Symbol size after a function body (ELF `.size`; Mach-O none). */
   void (*sym_size)(const AsmSynCtx* x, Sym name);
   /* Section alignment directive for a power-of-two byte alignment. */
   void (*align)(const AsmSynCtx* x, u32 byte_align);
 } AsmSyntax;
 
 static KitStatus emit_label(const AsmSynCtx* x, const AsmSyntax* syn,
                             const SymLabel* lbl) {
   Writer* w = x->w;
   if (lbl->bind == SB_GLOBAL || lbl->bind == SB_WEAK) {
     w_str(w, "        .globl  ");
     w_sym(w, x->c, lbl->name);
     w_newline(w);
   }
   syn->sym_type(x, lbl->name, lbl->kind);
   w_sym(w, x->c, lbl->name);
   w_str(w, ":");
   return w_newline(w);
 }
 
 /* Emit `.comm`/`.lcomm` for tentative (common) symbols. These live in no output
  * section — the linker allocates .bss space at link time — so the section walk
  * never sees them; without this a `cc -S` that references a tentative global
  * (`int x;` at file scope) re-assembles to an undefined reference. Global
  * commons use `.comm name, size, align`; local ones `.lcomm`. */
 static KitStatus emit_common_symbols(Writer* w, Compiler* c, ObjBuilder* ob) {
   ObjSymIter* it = obj_symiter_new(ob);
   KitStatus st = KIT_OK;
   if (!it) return KIT_NOMEM;
   for (;;) {
     ObjSymEntry e;
     const ObjSym* sym;
     if (!obj_symiter_next(it, &e)) break;
     sym = e.sym;
     if (!sym || sym->removed || sym->kind != SK_COMMON || !sym->name) continue;
     st = w_str(w,
                sym->bind == SB_LOCAL ? "        .lcomm  " : "        .comm   ");
     if (st != KIT_OK) break;
     st = w_sym(w, c, sym->name);
     if (st != KIT_OK) break;
     st = w_str(w, ", ");
     if (st != KIT_OK) break;
     st = w_dec(w, sym->size);
     if (st != KIT_OK) break;
     if (sym->common_align > 1) {
       st = w_str(w, ", ");
       if (st != KIT_OK) break;
       st = w_dec(w, sym->common_align);
       if (st != KIT_OK) break;
     }
     st = w_newline(w);
     if (st != KIT_OK) break;
   }
   obj_symiter_free(it);
   return st;
 }
 
 static KitStatus emit_size_directives(const AsmSynCtx* x, const AsmSyntax* syn,
                                       ObjBuilder* ob, ObjSecId sec_id) {
   ObjSymIter* it = obj_symiter_new(ob);
   if (!it) return KIT_NOMEM;
 
   for (;;) {
     ObjSymEntry e;
     const ObjSym* sym;
     if (!obj_symiter_next(it, &e)) break;
     sym = e.sym;
     if (!sym || sym->removed) continue;
     if (sym->section_id != sec_id) continue;
     if (sym->kind != SK_FUNC) continue;
     if (sym->size == 0) continue;
     syn->sym_size(x, sym->name);
   }
   obj_symiter_free(it);
   return kit_writer_status((KitWriter*)x->w);
 }
 
 /* GNU-as flag letters for a named (SEC_OTHER) section's `, "flags"` operand.
  * The assembler's .section parser (src/asm/asm.c) is the inverse mapping. */
 static void w_secflags(Writer* w, u16 flags) {
   if (flags & SF_ALLOC) w_str(w, "a");
   if (flags & SF_WRITE) w_str(w, "w");
   if (flags & SF_EXEC) w_str(w, "x");
   if (flags & SF_MERGE) w_str(w, "M");
   if (flags & SF_STRINGS) w_str(w, "S");
   if (flags & SF_TLS) w_str(w, "T");
   if (flags & SF_RETAIN) w_str(w, "R");
 }
 
 /* log2 of a power-of-two byte alignment (>=1 → 0). */
 static u32 align_log2(u32 a) {
   u32 n = 0;
   if (a < 2) return 0;
   while ((a & 1u) == 0u && n < 31u) {
     a >>= 1;
     ++n;
   }
   return n;
 }
 
 /* ---- ELF directive syntax: the historical spelling (unchanged) ----------
  *
  * Returns 0 to skip a section cc -S does not round-trip (TLS variants,
  * SEC_DEBUG). SEC_OTHER (a global in a named section, e.g.
  * __attribute__((section(...)))) emits the real name plus its flags/type/
  * entsize in GNU-as syntax so the label and bytes survive re-assembly. */
 /* Emit `.section name, "flags", @type[, entsize]` (the GNU-as named-section
  * form). Used for SEC_OTHER and for any canonical-kind section whose name or
  * flags can't be reproduced by the bare `.text`/`.section .rodata` builtins. */
 static int elf_named_section(const AsmSynCtx* x, const Section* sec) {
   Writer* w = x->w;
   Slice nm = pool_slice(x->c->global, sec->name);
   if (nm.len == 0) return 0;
   w_str(w, "        .section\t");
   kit_writer_write(w, nm.s, nm.len);
   w_str(w, ", \"");
   w_secflags(w, sec->flags);
   w_str(w, "\", ");
   w_str(w, sec->sem == SSEM_NOBITS ? "@nobits" : "@progbits");
   if ((sec->flags & SF_MERGE) || sec->entsize) {
     w_str(w, ", ");
     w_dec(w, (u64)(sec->entsize ? sec->entsize : 1));
   }
   w_newline(w);
   return 1;
 }
 
 /* Does this canonical-kind section round-trip through its bare builtin
  * directive? Only if its name is exactly the canonical spelling and it carries
  * no flags that the builtin can't express (MERGE/STRINGS/RETAIN/entsize). A
  * `.rodata.foo.merge` mergeable-string section, for instance, must be spelled
  * in full or the linker won't merge/GC it the way the direct object does. */
 static int sec_is_canonical(const AsmSynCtx* x, const Section* sec,
                             const char* canon) {
   Slice nm = pool_slice(x->c->global, sec->name);
   if (sec->flags & (SF_MERGE | SF_STRINGS | SF_RETAIN)) return 0;
   if (sec->entsize) return 0;
   return slice_eq_cstr(nm, canon);
 }
 
 static int elf_section_header(const AsmSynCtx* x, const Section* sec) {
   Writer* w = x->w;
   if (sec->flags & SF_TLS) return 0;
   switch (sec->kind) {
     case SEC_TEXT:
       if (!sec_is_canonical(x, sec, ".text")) return elf_named_section(x, sec);
       w_str(w, "        .text");
       w_newline(w);
       return 1;
     case SEC_RODATA:
       if (!sec_is_canonical(x, sec, ".rodata"))
         return elf_named_section(x, sec);
       w_str(w, "        .section\t.rodata");
       w_newline(w);
       return 1;
     case SEC_DATA:
       if (!sec_is_canonical(x, sec, ".data")) return elf_named_section(x, sec);
       w_str(w, "        .section\t.data");
       w_newline(w);
       return 1;
     case SEC_BSS:
       if (!sec_is_canonical(x, sec, ".bss")) return elf_named_section(x, sec);
       w_str(w, "        .section\t.bss");
       w_newline(w);
       return 1;
     case SEC_OTHER:
       return elf_named_section(x, sec);
     default:
       return 0;
   }
 }
 
 static void elf_sym_type(const AsmSynCtx* x, Sym name, u16 kind) {
   const char* t = NULL;
   if (kind == SK_FUNC)
     t = ", @function";
   else if (kind == SK_OBJ || kind == SK_COMMON || kind == SK_TLS)
     t = ", @object";
   if (!t) return;
   w_str(x->w, "        .type   ");
   w_sym(x->w, x->c, name);
   w_str(x->w, t);
   w_newline(x->w);
 }
 
 static void elf_sym_size(const AsmSynCtx* x, Sym name) {
   w_str(x->w, "        .size   ");
   w_sym(x->w, x->c, name);
   w_str(x->w, ", .-");
   w_sym(x->w, x->c, name);
   w_newline(x->w);
 }
 
 static void elf_align(const AsmSynCtx* x, u32 byte_align) {
   w_str(x->w, "        .align  ");
   w_dec(x->w, (u64)byte_align);
   w_newline(x->w);
 }
 
 /* ---- Mach-O directive syntax: clang/llvm-mc-acceptable spelling ---------- */
 
 static int macho_section_header(const AsmSynCtx* x, const Section* sec) {
   Writer* w = x->w;
   if (sec->flags & SF_TLS) return 0; /* TLS not round-tripped today */
   switch (sec->kind) {
     case SEC_TEXT:
       w_str(w, "        .text"); /* Mach-O builtin */
       w_newline(w);
       return 1;
     case SEC_RODATA:
       w_str(w, "        .section\t");
       w_str(w, obj_macho_canon_secname(SEC_RODATA)); /* __TEXT,__const */
       w_newline(w);
       return 1;
     case SEC_DATA:
       w_str(w, "        .section\t");
       w_str(w, obj_macho_canon_secname(SEC_DATA)); /* __DATA,__data */
       w_newline(w);
       return 1;
     case SEC_BSS:
       /* clang accepts the `.bss` builtin; the shared zero-range path fills it
        * (avoids `.zerofill`'s per-symbol operand syntax). */
       w_str(w, "        .bss");
       w_newline(w);
       return 1;
     case SEC_OTHER: {
       Slice nm = pool_slice(x->c->global, sec->name);
       if (nm.len == 0) return 0;
       w_str(w, "        .section\t");
       if (memchr(nm.s, ',', nm.len)) {
         /* Already "__SEG,__sect" (codegen interns eh_frame this way on
          * Mach-O). Emit bare — no ELF `, "flags", @progbits` suffix. */
         kit_writer_write(w, nm.s, nm.len);
       } else {
         /* Defensive: a non-comma name on a Mach-O target. Spell it the way
          * the writer's name_to_seg_sect would (canonical kind, else
          * __DATA,<name-without-dot>) so text and binary agree. */
         const char* canon = obj_macho_canon_secname(sec->kind);
         if (canon) {
           w_str(w, canon);
         } else {
           w_str(w, "__DATA,");
           if (nm.s[0] == '.')
             kit_writer_write(w, nm.s + 1, nm.len - 1);
           else
             kit_writer_write(w, nm.s, nm.len);
         }
       }
       w_newline(w);
       return 1;
     }
     default:
       return 0;
   }
 }
 
 static void macho_sym_type(const AsmSynCtx* x, Sym name, u16 kind) {
   (void)x;
   (void)name;
   (void)kind; /* Mach-O derives symbol kind from the symbol table */
 }
 
 static void macho_sym_size(const AsmSynCtx* x, Sym name) {
   (void)x;
   (void)name; /* Mach-O has no `.size` */
 }
 
 static void macho_align(const AsmSynCtx* x, u32 byte_align) {
   /* Mach-O `.align`/`.p2align` are log2; cc -S emits `.p2align` so clang and
    * kit-as read it identically. */
   w_str(x->w, "        .p2align ");
   w_dec(x->w, (u64)align_log2(byte_align));
   w_newline(x->w);
 }
 
 static const AsmSyntax g_asm_syntax_elf = {
     KIT_OBJ_ELF,  "elf",        elf_section_header,
     elf_sym_type, elf_sym_size, elf_align,
 };
 static const AsmSyntax g_asm_syntax_macho = {
     KIT_OBJ_MACHO,  "macho",        macho_section_header,
     macho_sym_type, macho_sym_size, macho_align,
 };
 /* COFF text emission is not yet exercised by the cc -S lanes; alias the ELF
  * directive spelling for now (TODO COFF: .def/.scl/.type/.endef; COFF
  * `.section name, "flags"` has its own form). The seam exists so COFF is
  * pluggable without touching the printer. */
 static const AsmSyntax g_asm_syntax_coff = {
     KIT_OBJ_COFF, "coff",       elf_section_header,
     elf_sym_type, elf_sym_size, elf_align,
 };
 
 static const AsmSyntax* asm_syntax_for(KitObjFmt fmt) {
   switch (fmt) {
     case KIT_OBJ_MACHO:
       return &g_asm_syntax_macho;
     case KIT_OBJ_COFF:
       return &g_asm_syntax_coff;
     case KIT_OBJ_ELF:
     default:
       return &g_asm_syntax_elf; /* WASM has no textual-asm path */
   }
 }
 
 /* Emit a run of raw `.byte` lines for [start, end). */
 static KitStatus emit_raw_bytes(Writer* w, const u8* data, u32 start, u32 end) {
   u32 off;
   for (off = start; off < end; off += ASM_BYTES_PER_LINE) {
     u32 rem = end - off;
     u32 n = rem < ASM_BYTES_PER_LINE ? rem : ASM_BYTES_PER_LINE;
     u32 j;
     KitStatus st;
     st = w_str(w, "        .byte   0x");
     if (st != KIT_OK) return st;
     st = w_hex_byte(w, data[off]);
     if (st != KIT_OK) return st;
     for (j = 1; j < n; ++j) {
       st = w_str(w, ", 0x");
       if (st != KIT_OK) return st;
       st = w_hex_byte(w, data[off + j]);
       if (st != KIT_OK) return st;
     }
     st = w_newline(w);
     if (st != KIT_OK) return st;
   }
   return KIT_OK;
 }
 
 /* A reloc kind whose data field carries a symbol value reproducible by an
  * integer directive: maps to (directive, byte width, PC-relative?). The
  * assembler emits the matching R_ABS{32,64} for `.word`/`.quad SYM+addend` and
  * R_PC{32,64} for `.long`/`.quad SYM - .` (emit_int_directive), so the
  * round-tripped relocation matches codegen's. `*pcrel` selects the `SYM - .`
  * spelling (built by build_data_symref). Returns 0 for kinds with no
  * integer-directive spelling (caller keeps the raw bytes). */
 static int data_reloc_directive(u16 kind, const char** dir, u32* width,
                                 int* pcrel) {
   *pcrel = 0;
   switch (kind) {
     case R_ABS64:
       *dir = "        .quad   ";
       *width = 8;
       return 1;
     case R_PC64:
       *dir = "        .quad   ";
       *width = 8;
       *pcrel = 1;
       return 1;
     case R_ABS32:
       *dir = "        .word   ";
       *width = 4;
       return 1;
     case R_PC32:
       *dir = "        .long   ";
       *width = 4;
       *pcrel = 1;
       return 1;
     default:
       return 0;
   }
 }
 
 static KitStatus emit_zero_range(Writer* w, u32 size) {
   KitStatus st;
   if (size == 0) return KIT_OK;
   st = w_str(w, "        .zero   ");
   if (st != KIT_OK) return st;
   st = w_dec(w, (u64)size);
   if (st != KIT_OK) return st;
   return w_newline(w);
 }
 
 /* ---- Phase 2 symbolization: reloc-driven operand substitution ----------
  *
  * `cc -S` must be re-assemblable. The disassembler renders relocated operands
  * numerically (e.g. `bl 0x10`, `adrp x16, 0x0`, `ldr w8, [x16]`), which would
  * branch to the wrong place or load from address 0 on re-assembly. Here we
  * consult the section's relocation table and rewrite the covered operand into
  * the relocation-operator syntax the assembler parses (the inverse of
  * src/arch/aa64/asm.c's parse_reloc_mod). See doc/TESTING.md.
  *
  * Operand text is rewritten in place rather than re-rendered from decoded
  * fields, so the register names the disassembler produced are preserved and
  * this layer stays free of per-arch register-naming knowledge. The reloc
  * kind alone selects the modifier and the operand shape to patch. */
 
 typedef struct {
   u32 offset;
   u16 kind;
   Sym sym;
   i64 addend;
 } SecReloc;
 
 static int cmp_secreloc(const void* va, const void* vb) {
   const SecReloc* a = (const SecReloc*)va;
   const SecReloc* b = (const SecReloc*)vb;
   if (a->offset < b->offset) return -1;
   if (a->offset > b->offset) return 1;
   return 0;
 }
 
 static SecReloc* collect_relocs(Compiler* c, ObjBuilder* ob, ObjSecId sec_id,
                                 u32* n_out) {
   u32 total = obj_reloc_total(ob);
   u32 n = 0, cap = 0, i;
   SecReloc* arr = NULL;
 
   *n_out = 0;
   for (i = 0; i < total; ++i) {
     const Reloc* r = obj_reloc_at(ob, i);
     const ObjSym* s;
     if (!r || r->removed) continue;
     if (r->section_id != sec_id) continue;
     if (n == cap) {
       u32 ncap = cap ? cap * 2 : 8;
       SecReloc* na = arena_array(c->tu, SecReloc, ncap);
       if (!na) break;
       if (arr) memcpy(na, arr, cap * sizeof(SecReloc));
       arr = na;
       cap = ncap;
     }
     s = obj_symbol_get(ob, r->sym);
     arr[n].offset = r->offset;
     arr[n].kind = r->kind;
     arr[n].sym = s ? s->name : (Sym)0;
     arr[n].addend = r->addend;
     ++n;
   }
   if (n > 1) qsort(arr, n, sizeof(SecReloc), cmp_secreloc);
   *n_out = n;
   return arr;
 }
 
 /* First relocation whose offset lies within instruction [off, off+len). */
 static const SecReloc* reloc_in_range(const SecReloc* r, u32 n, u32 off,
                                       u32 len) {
   u32 i;
   for (i = 0; i < n; ++i)
     if (r[i].offset >= off && r[i].offset < off + len) return &r[i];
   return NULL;
 }
 
 /* The reloc-kind → operand-syntax mapping now lives in the arch backend
  * (ArchAsmOps.reloc_operand, src/arch/<arch>/asm.c), reached via
  * arch_reloc_operand(). This keeps the printer arch-agnostic and format-aware:
  * aarch64 ELF spells `:lo12:sym`, Mach-O spells `sym@PAGEOFF`. */
 
 /* A `.L`-prefixed name is an assembler-local label (e.g. `.Lkit_ro.0`,
  * `.Lkit_jt.0`): the assembler's lexer accepts it as an identifier. Other
  * `.`-prefixed names (section symbols like `.text`, `.rodata`) are not yet
  * re-assemblable as operands, so the symbolizer keeps the numeric form. */
 static int sym_is_assemblable(Slice s) {
   if (s.len == 0) return 0;
   if (s.s[0] != '.') return 1;
   return s.len >= 2 && s.s[1] == 'L';
 }
 
 /* Build "<prefix><sym>[+/-addend]<suffix>" into buf. Returns length, or -1 if
  * the symbol has no usable name (anonymous, or a `.`-prefixed section symbol
  * the assembler's expression parser does not accept). The modifier is a prefix
  * (ELF `:lo12:sym`) or a suffix (Mach-O `sym@PAGEOFF`), per the arch/format;
  * an addend lands before the suffix (`sym+8@PAGEOFF`), which both clang and
  * kit-as parse. */
 static int build_symref(char* buf, u32 cap, Compiler* c,
                         const ArchRelocOperand* ro, Sym name, i64 addend) {
   Slice s;
   u32 p = 0, i;
   if (!name) return -1;
   s = pool_slice(c->global, name);
   if (!sym_is_assemblable(s)) return -1;
   /* Undo any instruction-encoding addend bias so the printed offset is the
    * symbol offset (x86-64 rel32 relocs store addend-4; the assembler re-applies
    * the -4, so emit `sym` for a stored -4). */
   addend += ro->addend_bias;
   for (i = 0; ro->prefix[i] && p + 1 < cap; ++i) buf[p++] = ro->prefix[i];
   for (i = 0; i < s.len && p + 1 < cap; ++i) buf[p++] = s.s[i];
   if (addend != 0) {
     char num[24];
     u32 nl = 0;
     u64 mag = addend < 0 ? (u64)(-(addend)) : (u64)addend;
     if (p + 1 < cap) buf[p++] = addend < 0 ? '-' : '+';
     do {
       num[nl++] = (char)('0' + (u32)(mag % 10));
       mag /= 10;
     } while (mag && nl < sizeof(num));
     while (nl && p + 1 < cap) buf[p++] = num[--nl];
   }
   for (i = 0; ro->suffix[i] && p + 1 < cap; ++i) buf[p++] = ro->suffix[i];
   buf[p] = '\0';
   return (int)p;
 }
 
 /* Position of the "(%rip)" substring in [ops, ops+olen), or -1. */
 static i32 find_rip(const char* ops, u32 olen) {
   u32 i;
   if (olen < 6) return -1;
   for (i = 0; i + 6 <= olen; ++i)
     if (memcmp(ops + i, "(%rip)", 6) == 0) return (i32)i;
   return -1;
 }
 
 /* Write `ops` with the relocated operand rewritten to `symref`. The surgery
  * site is chosen from the operand text first: an x86-64 `disp(%rip)` operand
  * always takes RIP surgery (insert sym before the displacement), regardless of
  * `surg`. Otherwise `surg` selects: TAIL replaces the last comma-separated
  * component (or the whole operand if there is no comma — branch targets); MEM
  * rewrites the offset inside [...] (aarch64 ldst). */
 static KitStatus w_symbolized(Writer* w, const char* ops, u32 olen,
                               const char* symref, ArchRelocSurg surg) {
   i32 rip = find_rip(ops, olen);
   if (rip >= 0) surg = ARCH_RELOC_SURG_RIP;
   if (surg == ARCH_RELOC_SURG_RIP) {
     /* `[disp](%rip)[, ...]` -> `symref(%rip)[, ...]`: replace any numeric
      * displacement immediately before `(%rip)` with symref. */
     i32 ds = rip; /* start of the displacement run before the '(' */
     KitStatus st;
     while (ds > 0) {
       char ch = ops[ds - 1];
       if ((ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'f') ||
           (ch >= 'A' && ch <= 'F') || ch == 'x' || ch == '-' || ch == '+')
         --ds;
       else
         break;
     }
     st = kit_writer_write(w, ops, (u32)ds); /* text before the displacement */
     if (st != KIT_OK) return st;
     st = w_str(w, symref);
     if (st != KIT_OK) return st;
     return kit_writer_write(w, ops + rip, olen - (u32)rip); /* "(%rip)..." */
   }
   if (surg == ARCH_RELOC_SURG_TAIL) {
     i32 last_comma = -1;
     u32 i;
     for (i = 0; i < olen; ++i)
       if (ops[i] == ',') last_comma = (i32)i;
     if (last_comma < 0) return w_str(w, symref);
     {
       KitStatus st = kit_writer_write(w, ops, (u32)last_comma);
       if (st != KIT_OK) return st;
       st = w_str(w, ", ");
       if (st != KIT_OK) return st;
       return w_str(w, symref);
     }
   }
   if (surg == ARCH_RELOC_SURG_RV_LO12) {
     /* RISC-V low-half: a `disp(base)` memory form rewrites the displacement;
      * a register-immediate form appends the modifier as a new operand. The
      * memory form is recognized by a trailing `(...)` group. */
     i32 lp = -1, rp = -1;
     u32 i;
     for (i = 0; i < olen; ++i) {
       if (ops[i] == '(')
         lp = (i32)i;
       else if (ops[i] == ')')
         rp = (i32)i;
     }
     if (lp >= 0 && rp > lp && (u32)(rp + 1) == olen) {
       /* `..., <disp>(base)` -> `..., symref(base)`: replace the displacement
        * run that ends immediately before the '('. */
       i32 ds = lp; /* start of the displacement run */
       KitStatus st;
       while (ds > 0) {
         char ch = ops[ds - 1];
         if ((ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'f') ||
             (ch >= 'A' && ch <= 'F') || ch == 'x' || ch == '-' || ch == '+')
           --ds;
         else
           break;
       }
       st = kit_writer_write(w, ops, (u32)ds); /* "..., " before the disp */
       if (st != KIT_OK) return st;
       st = w_str(w, symref);
       if (st != KIT_OK) return st;
       return kit_writer_write(w, ops + lp, olen - (u32)lp); /* "(base)" */
     }
     /* Register-immediate (e.g. `mv rd, rs`): append symref as a new operand. */
     {
       KitStatus st = kit_writer_write(w, ops, olen);
       if (st != KIT_OK) return st;
       st = w_str(w, ", ");
       if (st != KIT_OK) return st;
       return w_str(w, symref);
     }
   }
   /* SURG_MEM: keep the base register, set the offset to symref. */
   {
     i32 lb = -1, rb = -1, base_end;
     u32 i;
     KitStatus st;
     for (i = 0; i < olen; ++i) {
       if (ops[i] == '[')
         lb = (i32)i;
       else if (ops[i] == ']')
         rb = (i32)i;
     }
     if (lb < 0 || rb < 0 || rb < lb) /* unexpected shape; emit verbatim */
       return kit_writer_write(w, ops, olen);
     base_end = lb + 1;
     while (base_end < rb && ops[base_end] != ',') ++base_end;
     st = kit_writer_write(w, ops, (u32)(base_end)); /* "...[Rn" */
     if (st != KIT_OK) return st;
     st = w_str(w, ", ");
     if (st != KIT_OK) return st;
     st = w_str(w, symref);
     if (st != KIT_OK) return st;
     st = w_str(w, "]");
     if (st != KIT_OK) return st;
     /* trailing text after the close bracket (e.g. nothing for reloc'd ldst) */
     if ((u32)(rb + 1) < olen)
       return kit_writer_write(w, ops + rb + 1, olen - (u32)(rb + 1));
     return KIT_OK;
   }
 }
 
 /* ---- Phase 2 symbolization: intra-function branch labels ---------------
  *
  * Branches that stay within the section carry no relocation — the
  * disassembler renders the resolved target numerically (`b 0x60`). The
  * assembler rejects a numeric branch target, so re-assembly needs a label.
  * We pre-scan the section for such branch targets, synthesize a local label
  * at each, and rewrite the branch operand to reference it.
  *
  * Synthesized names are `Lcf_<secidx>_<hexoff>` — deliberately not `.L`
  * prefixed, since the assembler's expression parser does not currently accept
  * `.`-led identifiers as operands. The names are unique within the file. */
 
 static int cmp_u32(const void* va, const void* vb) {
   u32 a = *(const u32*)va, b = *(const u32*)vb;
   if (a < b) return -1;
   if (a > b) return 1;
   return 0;
 }
 
 /* Which mnemonics are intra-section local branches (target codegen resolved in
  * place, no relocation) is arch-specific: routed through arch_is_local_branch
  * (ArchAsmOps.is_local_branch). The disassembler renders such a target
  * numerically; we synthesize a label at it so the operand re-assembles. */
 
 /* Parse the trailing `0x<hex>` branch-target operand (the last comma-separated
  * component). Returns 1 and the value on success. */
 static int parse_hex_tail(KitSlice ops, u64* out) {
   i32 start = 0, p;
   u64 v = 0;
   u32 i;
   int any = 0;
   for (i = 0; i < ops.len; ++i)
     if (ops.s[i] == ',') start = (i32)i + 1;
   while (start < (i32)ops.len && (ops.s[start] == ' ' || ops.s[start] == '\t'))
     ++start;
   if (start + 2 > (i32)ops.len || ops.s[start] != '0' ||
       (ops.s[start + 1] | 32) != 'x')
     return 0;
   for (p = start + 2; p < (i32)ops.len; ++p) {
     char c = ops.s[p];
     u32 d;
     if (c >= '0' && c <= '9')
       d = (u32)(c - '0');
     else if ((c | 32) >= 'a' && (c | 32) <= 'f')
       d = (u32)((c | 32) - 'a' + 10);
     else
       break;
     v = v * 16 + d;
     any = 1;
   }
   while (p < (i32)ops.len && ops.s[p] == ' ') ++p;
   if (!any || p != (i32)ops.len) return 0;
   *out = v;
   return 1;
 }
 
 /* Parse a local-branch target from the operand tail into an absolute,
  * section-relative offset. Two render forms occur:
  *   "0x<hex>" — an absolute target (the printer had the instruction's address)
  *   "#<dec>"  — a PC-relative displacement, emitted when the printer had no
  *               address context, i.e. the instruction sits at section offset 0
  *               (a branch as the first instruction of .text, which -O1 leaf
  *               functions can produce). The absolute target is inst_off + disp.
  * Returns 1 and sets *out to the absolute target. */
 static int parse_branch_tail(KitSlice ops, u32 inst_off, u64* out) {
   i32 start = 0, p;
   i64 v = 0;
   int neg = 0, any = 0;
   u32 i;
   if (parse_hex_tail(ops, out)) return 1;
   for (i = 0; i < ops.len; ++i)
     if (ops.s[i] == ',') start = (i32)i + 1;
   while (start < (i32)ops.len && (ops.s[start] == ' ' || ops.s[start] == '\t'))
     ++start;
   if (start >= (i32)ops.len || ops.s[start] != '#') return 0;
   p = start + 1;
   if (p < (i32)ops.len && (ops.s[p] == '-' || ops.s[p] == '+'))
     neg = (ops.s[p++] == '-');
   for (; p < (i32)ops.len; ++p) {
     char c = ops.s[p];
     if (c < '0' || c > '9') break;
     v = v * 10 + (c - '0');
     any = 1;
   }
   while (p < (i32)ops.len && ops.s[p] == ' ') ++p;
   if (!any || p != (i32)ops.len) return 0;
   if (neg) v = -v;
   *out = (u64)((i64)inst_off + v);
   return 1;
 }
 
 typedef struct {
   Compiler* c;
   u32 secidx;
   const SecReloc* relocs;
   u32 nrelocs;
   const SymLabel* labels;
   u32 nlabels;
   const u32* btargets;
   u32 nbt;
 } EmitCtx;
 
 static u32 fmt_u64(char* buf, u32 p, u32 cap, u64 v, u32 base) {
   char tmp[24];
   u32 n = 0;
   do {
     u32 d = (u32)(v % base);
     tmp[n++] = (char)(d < 10 ? '0' + d : 'a' + d - 10);
     v /= base;
   } while (v && n < sizeof tmp);
   while (n && p + 1 < cap) buf[p++] = tmp[--n];
   return p;
 }
 
 /* Synthesized label spelling, shared by definition and reference sites. */
 static u32 fmt_synth_label(char* buf, u32 cap, u32 secidx, u32 off) {
   u32 p = 0;
   const char* pre = "Lcf_";
   u32 i;
   for (i = 0; pre[i] && p + 1 < cap; ++i) buf[p++] = pre[i];
   p = fmt_u64(buf, p, cap, secidx, 10);
   if (p + 1 < cap) buf[p++] = '_';
   p = fmt_u64(buf, p, cap, off, 16);
   buf[p] = '\0';
   return p;
 }
 
 /* Synthesized hi/lo anchor label spelling (RISC-V `%pcrel_hi`/`%pcrel_lo`
  * pairing). The high-half reloc defines `.Lpcrel_hi_<secidx>_<off>` at its
  * AUIPC; the paired low-half reloc references it. `.L`-prefixed so the
  * assembler's lexer accepts it and the linker treats it as local. */
 static u32 fmt_anchor_label(char* buf, u32 cap, u32 secidx, u32 off) {
   u32 p = 0;
   const char* pre = ".Lpcrel_hi_";
   u32 i;
   for (i = 0; pre[i] && p + 1 < cap; ++i) buf[p++] = pre[i];
   p = fmt_u64(buf, p, cap, secidx, 10);
   if (p + 1 < cap) buf[p++] = '_';
   p = fmt_u64(buf, p, cap, off, 16);
   buf[p] = '\0';
   return p;
 }
 
 /* The offset of the high-half (anchor-emitting) relocation paired with a
  * low-half reloc at `lo_off`: the nearest preceding reloc whose
  * ArchRelocOperand sets emit_anchor. kit's codegen always emits the AUIPC
  * immediately before its paired ADDI/load, so the nearest preceding anchor is
  * the correct one. Returns 1 and *hi_off on success. */
 static int find_anchor_for_lo12(const EmitCtx* x, u32 lo_off, u32* hi_off) {
   u32 i;
   int found = 0;
   u32 best = 0;
   for (i = 0; i < x->nrelocs; ++i) {
     ArchRelocOperand ro = {0}; /* zero emit_anchor/ref_anchor: arches that
                                 * don't set them must read as 0 (rv64-only) */
     if (x->relocs[i].offset >= lo_off) break;
     if (arch_reloc_operand(x->c, x->relocs[i].kind, &ro) && ro.emit_anchor) {
       best = x->relocs[i].offset;
       found = 1;
     }
   }
   if (found && hi_off) *hi_off = best;
   return found;
 }
 
 /* Non-dot symbol name defined at `off`, or NULL. Such a symbol is used as the
  * branch label directly (no synthesized label needed). */
 static Sym symbol_at(const EmitCtx* x, u32 off) {
   u32 i;
   for (i = 0; i < x->nlabels; ++i) {
     if (x->labels[i].offset == off && x->labels[i].name) {
       Slice s = pool_slice(x->c->global, x->labels[i].name);
       if (sym_is_assemblable(s)) return x->labels[i].name;
     }
   }
   return (Sym)0;
 }
 
 /* Label name for a branch target offset: an existing symbol if one is defined
  * there, else the synthesized `Lcf_...` name. */
 static u32 build_label_name(char* buf, u32 cap, const EmitCtx* x, u32 off) {
   Sym sym = symbol_at(x, off);
   if (sym) {
     Slice s = pool_slice(x->c->global, sym);
     u32 p = 0, i;
     for (i = 0; i < s.len && p + 1 < cap; ++i) buf[p++] = s.s[i];
     buf[p] = '\0';
     return p;
   }
   return fmt_synth_label(buf, cap, x->secidx, off);
 }
 
 static int is_btarget(const EmitCtx* x, u32 off) {
   u32 i;
   for (i = 0; i < x->nbt; ++i)
     if (x->btargets[i] == off) return 1;
   return 0;
 }
 
 /* Append `off` to a dynamic, deduplicated anchor array (arena-grown). */
 static void anchor_add(Compiler* c, u32** arr, u32* n, u32* cap, u32 off) {
   u32 j;
   for (j = 0; j < *n; ++j)
     if ((*arr)[j] == off) return;
   if (*n == *cap) {
     u32 nc = *cap ? *cap * 2 : 8;
     u32* na = arena_array(c->tu, u32, nc);
     if (!na) return;
     if (*arr) memcpy(na, *arr, *cap * sizeof(u32));
     *arr = na;
     *cap = nc;
   }
   (*arr)[(*n)++] = off;
 }
 
 /* Pre-scan: collect in-section branch targets of un-relocated local branches,
  * so cc -S synthesizes a label there and the branch re-assembles. Code-location
  * references that must survive a re-encoding assembler (switch jump-table
  * entries, `&&label` address-takes) are NOT handled here — codegen emits them
  * as relocations against per-block local symbols (mc_label_symbol), so the
  * normal reloc-operand path symbolizes them and the target label is a real
  * symbol. */
 static u32* collect_branch_targets(Compiler* c, ArchDisasm* dasm,
                                    const SecReloc* relocs, u32 nrelocs,
                                    const u8* data, u32 total, u32* n_out) {
   u32* arr = NULL;
   u32 n = 0, cap = 0, off = 0;
 
   *n_out = 0;
   while (off < total) {
     KitInsn insn;
     u32 nb = arch_disasm_decode(dasm, data + off, total - off, (u64)off, &insn);
     u64 tgt;
     if (nb == 0) {
       off += 1;
       continue;
     }
     if (!reloc_in_range(relocs, nrelocs, off, nb) &&
         arch_is_local_branch(c, insn.mnemonic) &&
         parse_branch_tail(insn.operands, off, &tgt) && tgt < total) {
       anchor_add(c, &arr, &n, &cap, (u32)tgt);
     }
     off += nb;
   }
 
   if (n > 1) qsort(arr, n, sizeof(u32), cmp_u32);
   *n_out = n;
   return arr;
 }
 
 /* Emit an instruction's operands, symbolizing a covering relocation or an
  * intra-section branch target when present. */
 static KitStatus emit_operands(Writer* w, const EmitCtx* x, const KitInsn* insn,
                                u32 off) {
   const SecReloc* r;
   if (!insn->operands.len) return KIT_OK;
   r = reloc_in_range(x->relocs, x->nrelocs, off, insn->nbytes);
   if (r) {
     ArchRelocOperand ro = {0}; /* zero emit_anchor/ref_anchor: arches that
                                 * don't set them must read as 0 (rv64-only) */
     if (arch_reloc_operand(x->c, r->kind, &ro)) {
       char symref[256];
       /* A low-half reloc (RISC-V `%pcrel_lo`) names the paired high-half's
        * synthesized anchor label, not the reloc's own (`.LpcrelHi`) symbol. */
       if (ro.ref_anchor) {
         u32 hi_off;
         if (find_anchor_for_lo12(x, off, &hi_off)) {
           char name[256];
           u32 p = 0, i;
           for (i = 0; ro.prefix[i] && p + 1 < sizeof name; ++i)
             name[p++] = ro.prefix[i];
           p += fmt_anchor_label(name + p, (u32)sizeof name - p, x->secidx,
                                 hi_off);
           for (i = 0; ro.suffix[i] && p + 1 < sizeof name; ++i)
             name[p++] = ro.suffix[i];
           name[p] = '\0';
           return w_symbolized(w, insn->operands.s, insn->operands.len, name,
                               ro.surg);
         }
         /* No anchor found (unexpected): fall through to keep numeric. */
       } else if (build_symref(symref, sizeof symref, x->c, &ro, r->sym,
                               r->addend) >= 0) {
         return w_symbolized(w, insn->operands.s, insn->operands.len, symref,
                             ro.surg);
       }
     }
   } else if (arch_is_local_branch(x->c, insn->mnemonic)) {
     u64 tgt;
     if (parse_branch_tail(insn->operands, off, &tgt) &&
         is_btarget(x, (u32)tgt)) {
       char name[256];
       build_label_name(name, sizeof name, x, (u32)tgt);
       return w_symbolized(w, insn->operands.s, insn->operands.len, name,
                           ARCH_RELOC_SURG_TAIL);
     }
   }
   return kit_writer_write(w, insn->operands.s, insn->operands.len);
 }
 
 /* Emit a data range, rendering any covered relocation as a symbolic integer
  * directive (`.quad sym+addend`) so cc -S | as reproduces the data relocation
  * table — switch jump tables (`.quad .Lcfblk.*` against per-block local
  * symbols) and any other relocated rodata/data. A reloc kind with no
  * integer-directive form, or a target the assembler can't spell, falls back to
  * raw `.byte`; the dropped reloc then surfaces in the round-trip's reloc
  * comparison. `relocs` is the section's relocation list, sorted by offset. */
 static KitStatus emit_data_range(Writer* w, Compiler* c, const u8* data,
                                  u32 start, u32 end, const SecReloc* relocs,
                                  u32 nrelocs) {
   u32 off = start;
   while (off < end) {
     const SecReloc* r = NULL;
     u32 next = end;
     u32 i;
     /* Find a reloc starting at `off`, and the offset of the next reloc that
      * starts strictly after `off` (which bounds the raw-byte run). */
     for (i = 0; i < nrelocs; ++i) {
       if (relocs[i].offset == off) {
         r = &relocs[i];
       } else if (relocs[i].offset > off && relocs[i].offset < next) {
         next = relocs[i].offset;
       }
     }
     if (r) {
       const char* dir;
       u32 width;
       int pcrel;
       char symref[256];
       /* Data relocations spell the bare symbol (`.quad sym+addend`): no
        * page/lo12-style operand modifier on either format. A PC-relative
        * reloc adds a trailing ` - .` (location counter) so the assembler
        * re-derives R_PC{32,64} instead of an absolute reloc. */
       ArchRelocOperand bare = {ARCH_RELOC_SURG_NONE, "", "", 0, 0, 0};
       if (data_reloc_directive(r->kind, &dir, &width, &pcrel) &&
           off + width <= end &&
           build_symref(symref, sizeof symref, c, &bare, r->sym, r->addend) >=
               0) {
         KitStatus st = w_str(w, dir);
         if (st != KIT_OK) return st;
         st = w_str(w, symref);
         if (st != KIT_OK) return st;
         if (pcrel) {
           st = w_str(w, " - .");
           if (st != KIT_OK) return st;
         }
         st = w_newline(w);
         if (st != KIT_OK) return st;
         off += width;
         continue;
       }
       /* Unsupported kind / unspellable target: keep raw bytes for this slot
        * (advance to the next reloc boundary so we don't re-handle it). */
     }
     if (next <= off) next = end;
     {
       KitStatus st = emit_raw_bytes(w, data, off, next);
       if (st != KIT_OK) return st;
     }
     off = next;
   }
   return KIT_OK;
 }
 
 static KitStatus emit_disasm_range(Writer* w, const EmitCtx* x,
                                    ArchDisasm* dasm, const u8* data, u32 start,
                                    u32 end) {
   u32 off = start;
   KitStatus st;
 
   while (off < end) {
     KitInsn insn;
     u64 vaddr = (u64)off;
     u32 n = arch_disasm_decode(dasm, data + off, end - off, vaddr, &insn);
 
     if (n == 0) {
       st = w_str(w, "        .byte   0x");
       if (st != KIT_OK) return st;
       st = w_hex_byte(w, data[off]);
       if (st != KIT_OK) return st;
       st = w_newline(w);
       if (st != KIT_OK) return st;
       off += 1;
       continue;
     }
 
     /* Call-pair fusion (RISC-V R_RV_CALL): a reloc on this instruction whose
      * arch fuses it with the FOLLOWING instruction into a single `call`/`tail
      * sym` pseudo. Probe the partner for the call-vs-tail decision, emit one
      * line, and skip both. Decoding the partner reuses the disassembler's
      * buffers (clobbering `insn`), so build the symref first and re-decode
      * `insn` when the pair is not fused. */
     {
       const SecReloc* cr = reloc_in_range(x->relocs, x->nrelocs, off, n);
       char symref[256];
       ArchRelocOperand bare = {ARCH_RELOC_SURG_TAIL, "", "", 0, 0, 0};
       if (cr && off + n < end &&
           build_symref(symref, sizeof symref, x->c, &bare, cr->sym,
                        cr->addend) >= 0) {
         KitInsn partner;
         u32 pn = arch_disasm_decode(dasm, data + off + n, end - (off + n),
                                     (u64)(off + n), &partner);
         const char* mn = NULL;
         if (pn && arch_reloc_call_pair(x->c, cr->kind, partner.mnemonic,
                                        partner.operands, &mn)) {
           st = w_str(w, "\t");
           if (st != KIT_OK) return st;
           st = w_str(w, mn);
           if (st != KIT_OK) return st;
           st = w_str(w, "\t");
           if (st != KIT_OK) return st;
           st = w_str(w, symref);
           if (st != KIT_OK) return st;
           st = w_newline(w);
           if (st != KIT_OK) return st;
           off += n + pn;
           continue;
         }
         /* Not fused: the partner probe clobbered `insn`; re-decode it. */
         (void)arch_disasm_decode(dasm, data + off, end - off, vaddr, &insn);
       }
     }
 
     /* A high-half reloc (RISC-V AUIPC `%pcrel_hi`/`%got_pcrel_hi`) needs a
      * unique local anchor label here so the paired `%pcrel_lo` can name it. */
     {
       const SecReloc* hr = reloc_in_range(x->relocs, x->nrelocs, off, n);
       if (hr) {
         ArchRelocOperand ro = {
             0}; /* zero emit_anchor/ref_anchor: arches that
                  * don't set them must read as 0 (rv64-only) */
         if (arch_reloc_operand(x->c, hr->kind, &ro) && ro.emit_anchor) {
           char name[256];
           fmt_anchor_label(name, sizeof name, x->secidx, off);
           st = w_str(w, name);
           if (st != KIT_OK) return st;
           st = w_str(w, ":");
           if (st != KIT_OK) return st;
           st = w_newline(w);
           if (st != KIT_OK) return st;
         }
       }
     }
 
     st = w_str(w, "\t");
     if (st != KIT_OK) return st;
     {
       /* De-alias a relocated `mv rd, rs` — an ADDI whose %pcrel_lo/%lo
        * immediate the disassembler aliased to `mv` because the encoded imm is
        * 0 — to the canonical `addi rd, rs, %lo(...)`. The RV_LO12 surgery in
        * emit_operands appends the `%lo(...)` as the third operand, and a
        * 3-operand `mv` is non-standard (clang rejects it). */
       KitSlice mn = insn.mnemonic;
       if (mn.len == 2 && mn.s[0] == 'm' && mn.s[1] == 'v') {
         const SecReloc* lr = reloc_in_range(x->relocs, x->nrelocs, off, n);
         ArchRelocOperand ro = {0};
         if (lr && arch_reloc_operand(x->c, lr->kind, &ro) &&
             ro.surg == ARCH_RELOC_SURG_RV_LO12) {
           mn.s = "addi";
           mn.len = 4;
         }
       }
       st = kit_writer_write(w, mn.s, mn.len);
       if (st != KIT_OK) return st;
     }
     if (insn.operands.len) {
       st = w_str(w, "\t");
       if (st != KIT_OK) return st;
       st = emit_operands(w, x, &insn, off);
       if (st != KIT_OK) return st;
     }
     st = w_newline(w);
     if (st != KIT_OK) return st;
 
     off += n;
   }
   return KIT_OK;
 }
 
 KitStatus kit_obj_builder_emit_asm(KitObjBuilder* builder, KitWriter* out_w) {
   ObjBuilder* ob = (ObjBuilder*)builder;
   Compiler* c;
   Writer* w;
   const AsmSyntax* syn;
   AsmSynCtx sx;
   u32 nsec, i;
 
   if (!ob || !out_w) return KIT_INVALID;
 
   c = obj_compiler(ob);
   w = (Writer*)out_w;
   syn = asm_syntax_for(c->target.obj);
   sx.w = w;
   sx.c = c;
   nsec = obj_section_count(ob);
 
   for (i = 1; i < nsec; ++i) {
     const Section* sec = obj_section_get(ob, (ObjSecId)i);
     SymLabel* labels;
     u32 nlabels, total, off, li;
     ArchDisasm* dasm;
     const u8* flat_data;
     u8* heap_data;
     SecReloc* relocs;
     u32 nrelocs;
     u32* btargets;
     u32 nbt, bi;
     EmitCtx ctx;
 
     if (!sec || sec->removed) continue;
     if (!syn->section_header(&sx, sec)) continue;
 
     labels = collect_labels(c, ob, (ObjSecId)i, &nlabels);
 
     if (sec->align > 1) syn->align(&sx, sec->align);
 
     if (sec->kind == SEC_BSS) {
       total = sec->bss_size;
     } else {
       total = sec->bytes.total;
     }
 
     dasm = NULL;
     flat_data = NULL;
     heap_data = NULL;
     relocs = NULL;
     nrelocs = 0;
     btargets = NULL;
     nbt = 0;
     bi = 0;
 
     if (total > 0 && (sec->flags & SF_EXEC)) {
       Heap* heap;
       dasm = arch_disasm_new(c);
       relocs = collect_relocs(c, ob, (ObjSecId)i, &nrelocs);
       heap = c->ctx->heap;
       heap_data = (u8*)heap->alloc(heap, total, 1);
       if (heap_data) {
         buf_flatten(&sec->bytes, heap_data);
         flat_data = heap_data;
         if (dasm)
           btargets = collect_branch_targets(c, dasm, relocs, nrelocs, flat_data,
                                             total, &nbt);
       }
     } else if (total > 0 && sec->kind != SEC_BSS) {
       Heap* heap = c->ctx->heap;
       relocs = collect_relocs(c, ob, (ObjSecId)i, &nrelocs);
       heap_data = (u8*)heap->alloc(heap, total, 1);
       if (heap_data) {
         buf_flatten(&sec->bytes, heap_data);
         flat_data = heap_data;
       }
     }
 
     ctx.c = c;
     ctx.secidx = i;
     ctx.relocs = relocs;
     ctx.nrelocs = nrelocs;
     ctx.labels = labels;
     ctx.nlabels = nlabels;
     ctx.btargets = btargets;
     ctx.nbt = nbt;
 
     off = 0;
     li = 0;
 
     while (off < total || li < nlabels) {
       while (li < nlabels && labels[li].offset == off) {
         emit_label(&sx, syn, &labels[li]);
         ++li;
       }
       /* Synthesized branch-target label, unless a real symbol sits here. */
       if (nbt && is_btarget(&ctx, off) && !symbol_at(&ctx, off)) {
         char name[256];
         fmt_synth_label(name, sizeof name, i, off);
         w_str(w, name);
         w_str(w, ":");
         w_newline(w);
       }
 
       if (off >= total) break;
 
       {
         u32 next = total;
         if (li < nlabels && labels[li].offset > off &&
             labels[li].offset < total)
           next = labels[li].offset;
         while (bi < nbt && btargets[bi] <= off) ++bi;
         if (bi < nbt && btargets[bi] < next) next = btargets[bi];
 
         if (sec->kind == SEC_BSS) {
           emit_zero_range(w, next - off);
         } else if ((sec->flags & SF_EXEC) && dasm && flat_data) {
           emit_disasm_range(w, &ctx, dasm, flat_data, off, next);
         } else if (flat_data) {
           emit_data_range(w, c, flat_data, off, next, relocs, nrelocs);
         }
         off = next;
       }
     }
 
     emit_size_directives(&sx, syn, ob, (ObjSecId)i);
 
     if (dasm) arch_disasm_free(dasm);
     if (heap_data) c->ctx->heap->free(c->ctx->heap, heap_data, total);
 
     w_newline(w);
   }
 
   emit_common_symbols(w, c, ob);
 
   return kit_writer_status(out_w);
 }