Skip to content

AArch64 ADRP, ADD, and LDR: Address Loading on Raspberry Pi

An AArch64 instruction cannot contain an arbitrary 64-bit address. Compilers and assemblers therefore build addresses from PC-relative pages, small offsets, literal pools, or Global Offset Table entries. On Raspberry Pi, the recurring sequences are ADRP plus ADD, ADRP plus LDR, and literal LDR.

This guide shows what each sequence calculates, which relocation the linker applies, and how to verify the result rather than guessing from disassembly.

Quick comparison

Sequence Result Typical use
adr x0, label Address of a nearby label Local code or data within about ±1 MiB
adrp + add Address of a symbol Position-independent address within about ±4 GiB
adrp + ldr Value stored at a symbol Global data in the same linkage unit
literal ldr x0, label Value at a nearby PC-relative location Constants and literal pools within about ±1 MiB
adrp :got: + ldr :got_lo12: Address loaded through the GOT Preemptible or external symbols in PIC/PIE code

The ranges are architectural addressing ranges, not promises that a final link will always place sections within them. The assembler emits relocations when a symbol's final address is not yet known, and the linker either resolves the pair or reports an overflow.

The page-and-offset model

ADRP computes a 4 KiB-aligned page address relative to the page containing the instruction. Its immediate represents a signed page delta. The following ADD supplies the symbol's low 12 address bits:

1
2
adrp    x0, object
add     x0, x0, #:lo12:object

Conceptually:

1
2
x0 = page(PC) + page_delta(object)
x0 = x0 + offset_within_page(object)

After both instructions, x0 contains &object, not the value stored in object.

The GNU assembler documents :pg_hi21: for the ADRP relocation and #:lo12: for the following ADD, LDR, or STR. The :pg_hi21: prefix is optional in common GNU syntax, so adrp x0, object is sufficient.

Load an address with ADRP and ADD

Create addressing.s on a 64-bit Raspberry Pi OS system:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
.section .data
.balign 8
counter:
    .quad 42

.section .text
.global counter_address
.type counter_address, %function
counter_address:
    adrp    x0, counter
    add     x0, x0, #:lo12:counter
    ret
.size counter_address, .-counter_address

Assemble it without linking:

1
2
3
sudo apt update
sudo apt install --no-install-recommends build-essential binutils gdb
gcc -c addressing.s -o addressing.o

Inspect both instructions and unresolved relocations:

1
2
objdump -dr addressing.o
readelf -rW addressing.o

The exact formatting depends on the installed binutils version. Look for an ADRP page relocation such as R_AARCH64_ADR_PREL_PG_HI21 and an ADD low-12 relocation such as R_AARCH64_ADD_ABS_LO12_NC. The pair tells the linker that both instructions refer to the same symbol.

Load the value with ADRP and LDR

If you need the 64-bit value 42, not its address, combine the page address with an unsigned load offset:

1
2
3
4
5
6
7
.global read_counter
.type read_counter, %function
read_counter:
    adrp    x0, counter
    ldr     x0, [x0, #:lo12:counter]
    ret
.size read_counter, .-read_counter

Here the first instruction produces the page base. The second instruction reads memory at the symbol's scaled low-12 offset. For a 64-bit LDR, the object must have suitable alignment; .balign 8 makes that requirement explicit.

These forms answer different questions:

1
2
3
4
5
6
7
// x0 = &counter
adrp    x0, counter
add     x0, x0, #:lo12:counter

// x0 = counter
adrp    x0, counter
ldr     x0, [x0, #:lo12:counter]

Literal LDR is different

In this instruction, label identifies the nearby memory containing the value:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
.section .rodata
.balign 8
constant_value:
    .quad 0x1122334455667788

.section .text
.global read_literal
.type read_literal, %function
read_literal:
    ldr     x0, constant_value
    ret
.size read_literal, .-read_literal

This is a literal load with a signed PC-relative offset. It does not use a base register and does not mean “load the address of constant_value.”

Do not confuse the real instruction with the assembler pseudo-instruction:

1
ldr     x0, =0x1122334455667788

The =expression form asks the assembler to choose an implementation. It may use a literal pool or synthesize the value with other instructions. Check the object code when the exact sequence matters.

ADR versus ADRP

ADR adds a signed byte displacement to the current PC and can directly produce the address of a nearby label. ADRP uses page granularity and normally needs a second instruction:

1
2
3
4
adr     x0, local_label

adrp    x0, distant_object
add     x0, x0, #:lo12:distant_object

Use the relocation chosen by the compiler or the ABI-compatible sequence required by your linkage model. Replacing a pair manually because the current test binary happens to place a label nearby can create a range failure in a later build.

Position-independent access through the GOT

An external or preemptible symbol may be addressed through the Global Offset Table:

1
2
adrp    x16, :got:external_object
ldr     x16, [x16, :got_lo12:external_object]

After the load, x16 contains the address recorded in the GOT entry. A further load is required to read the object itself:

1
ldr     x0, [x16]

For a function call through a GOT-resolved address:

1
2
3
adrp    x16, :got:external_function
ldr     x16, [x16, :got_lo12:external_function]
blr     x16

Registers x16 and x17 are intra-procedure-call temporaries under AAPCS64 and are commonly used by linkers and veneers. Do not expect their values to survive a call.

See what C generates

Create inspect.c:

1
2
3
4
5
6
7
8
9
long global_counter = 42;

long *counter_address_c(void) {
    return &global_counter;
}

long read_counter_c(void) {
    return global_counter;
}

Build several variants:

1
2
3
4
5
gcc -O2 -c inspect.c -o inspect.o
gcc -O2 -fPIC -c inspect.c -o inspect-pic.o
objdump -dr inspect.o
objdump -dr inspect-pic.o
readelf -rW inspect-pic.o

Compare the relocation names as well as the mnemonics. PIC code may use the GOT because symbol interposition and shared-library linkage change how the final address is obtained.

Verify the final address in GDB

Link the assembly with a minimal C harness:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
#include <stdio.h>

extern long *counter_address(void);
extern long read_counter(void);

int main(void) {
    long *address = counter_address();
    printf("address=%p value=%ld read=%ld\n",
           (void *)address, *address, read_counter());
    return 0;
}

1
2
gcc -g -O0 harness.c addressing.o -o addressing-demo
gdb ./addressing-demo

Useful GDB commands are:

1
2
3
4
5
6
7
8
break counter_address
run
display/i $pc
stepi
info registers pc x0
stepi
info registers pc x0
x/gx $x0

Before the ADRP, record the PC. After it, x0 should be page-aligned. After the ADD, x0 should equal the symbol address shown by p &counter when the symbol is visible to GDB.

Common mistakes

Treating ADRP as a complete address

ADRP discards the symbol's offset within its 4 KiB page. Use the matching low-12 relocation in the next instruction.

Pairing relocations from different symbols

This is not a general way to combine arbitrary labels:

1
2
adrp    x0, object_a
add     x0, x0, #:lo12:object_b

It works only by accident when both symbols have a compatible page relationship. Keep the high and low relocations paired to the same expression.

Reading an address when you wanted a value

ADRP plus ADD returns an address. Add LDR or use the ADRP plus LDR form to read memory.

Ignoring scaled load offsets

Unsigned LDR/STR immediate offsets are scaled by access size. Use the assembler relocation and correct alignment instead of calculating an unverified encoded immediate by hand.

Looking only at a linked disassembly

The final executable may hide the relocation that explained the original intent. Inspect both the relocatable object (objdump -dr, readelf -rW) and the linked file.

Assuming every compiler emits the same sequence

Optimization, visibility, PIE/PIC flags, code model, linker relaxation, and symbol preemption all affect address formation. Describe the sequence you actually observed and include the build command.

Reproducible inspection checklist

Record these details when reporting an address-loading problem:

1
2
3
4
5
6
7
8
uname -m
gcc --version | head -1
as --version | head -1
ld --version | head -1
file addressing.o
readelf -h addressing.o
readelf -rW addressing.o
objdump -dr addressing.o

Include the compiler flags and whether the failing file is an object, PIE executable, static executable, or shared library. An instruction without its relocation and linkage context is often ambiguous.

FAQ

Does ADRP use the current instruction address?

It uses the 4 KiB page containing the instruction as the PC-relative base, then applies a signed page delta.

Why is the low offset 12 bits?

A 4 KiB page contains 4096 bytes, so bits 0–11 select a byte position within that page.

Does LDR x0, label load the label address?

No. The literal form loads the value stored at a PC-relative memory location. Use ADR or ADRP plus ADD when you need an address.

Why does PIC code use the GOT?

The GOT provides runtime-resolved addresses for symbols whose final location or interposition cannot be represented as a simple local link-time address.

Can I hard-code the address shown by GDB?

Do not do so in normal Linux user-space code. ASLR, PIE, shared libraries, and link layout can change addresses between builds or executions.

References and next steps