assemble.c

   1 /* assemble.c   code generation for the Netwide Assembler
   2  *
   3  * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
   4  * Julian Hall. All rights reserved. The software is
   5  * redistributable under the license given in the file "LICENSE"
   6  * distributed in the NASM archive.
   7  *
   8  * the actual codes (C syntax, i.e. octal):
   9  * \0            - terminates the code. (Unless it's a literal of course.)
  10  * \1, \2, \3    - that many literal bytes follow in the code stream
  11  * \4, \6        - the POP/PUSH (respectively) codes for CS, DS, ES, SS
  12  *                 (POP is never used for CS) depending on operand 0
  13  * \5, \7        - the second byte of POP/PUSH codes for FS, GS, depending
  14  *                 on operand 0
  15  * \10..\13      - a literal byte follows in the code stream, to be added
  16  *                 to the register value of operand 0..3
  17  * \14..\17      - a signed byte immediate operand, from operand 0..3
  18  * \20..\23      - a byte immediate operand, from operand 0..3
  19  * \24..\27      - an unsigned byte immediate operand, from operand 0..3
  20  * \30..\33      - a word immediate operand, from operand 0..3
  21  * \34..\37      - select between \3[0-3] and \4[0-3] depending on 16/32 bit
  22  *                 assembly mode or the operand-size override on the operand
  23  * \40..\43      - a long immediate operand, from operand 0..3
  24  * \44..\47      - select between \3[0-3], \4[0-3] and \5[4-7]
  25  *                 depending on the address size of the instruction.
  26  * \50..\53      - a byte relative operand, from operand 0..3
  27  * \54..\57      - a qword immediate operand, from operand 0..3
  28  * \60..\63      - a word relative operand, from operand 0..3
  29  * \64..\67      - select between \6[0-3] and \7[0-3] depending on 16/32 bit
  30  *                 assembly mode or the operand-size override on the operand
  31  * \70..\73      - a long relative operand, from operand 0..3
  32  * \74..\77       - a word constant, from the _segment_ part of operand 0..3
  33  * \1ab          - a ModRM, calculated on EA in operand a, with the spare
  34  *                 field the register value of operand b.
  35  * \140..\143    - an immediate word or signed byte for operand 0..3
  36  * \144..\147    - or 2 (s-field) into opcode byte if operand 0..3
  37  *                  is a signed byte rather than a word.  Opcode byte follows.
  38  * \150..\153     - an immediate dword or signed byte for operand 0..3
  39  * \154..\157    - or 2 (s-field) into opcode byte if operand 0..3
  40  *                  is a signed byte rather than a dword.  Opcode byte follows.
  41  * \160..\163    - this instruction uses DREX rather than REX, with the
  42  *                 OC0 field set to 0, and the dest field taken from
  43  *                 operand 0..3.
  44  * \164..\167    - this instruction uses DREX rather than REX, with the
  45  *                 OC0 field set to 1, and the dest field taken from
  46  *                 operand 0..3.
  47  * \171          - placement of DREX suffix in the absence of an EA
  48  * \172\ab       - the register number from operand a in bits 7..4, with
  49  *                 the 4-bit immediate from operand b in bits 3..0.
  50  * \173\xab      - the register number from operand a in bits 7..4, with
  51  *                 the value b in bits 3..0.
  52  * \174\a        - the register number from operand a in bits 7..4, and
  53  *                 an arbitrary value in bits 3..0 (assembled as zero.)
  54  * \2ab          - a ModRM, calculated on EA in operand a, with the spare
  55  *                 field equal to digit b.
  56  * \250..\253    - same as \150..\153, except warn if the 64-bit operand
  57  *                 is not equal to the truncated and sign-extended 32-bit
  58  *                 operand; used for 32-bit immediates in 64-bit mode.
  59  * \260..\263    - this instruction uses VEX rather than REX, with the
  60  *                 V field taken from operand 0..3.
  61  * \270          - this instruction uses VEX rather than REX, with the
  62  *                 V field set to 1111b.
  63  *
  64  * VEX prefixes are followed by the sequence:
  65  * \mm\wlp         where mm is the M field; and wlp is:
  66  *                 00 0ww lpp
  67  *                 [w0] ww = 0 for W = 0
  68  *                 [w1] ww = 1 for W = 1
  69  *                 [wx] ww = 2 for W don't care (always assembled as 0)
  70  *                 [ww] ww = 3 for W used as REX.W
  71  *
  72  *
  73  * \310          - indicates fixed 16-bit address size, i.e. optional 0x67.
  74  * \311          - indicates fixed 32-bit address size, i.e. optional 0x67.
  75  * \312          - (disassembler only) marker on LOOP, LOOPxx instructions.
  76  * \313          - indicates fixed 64-bit address size, 0x67 invalid.
  77  * \314          - (disassembler only) invalid with REX.B
  78  * \315          - (disassembler only) invalid with REX.X
  79  * \316          - (disassembler only) invalid with REX.R
  80  * \317          - (disassembler only) invalid with REX.W
  81  * \320          - indicates fixed 16-bit operand size, i.e. optional 0x66.
  82  * \321          - indicates fixed 32-bit operand size, i.e. optional 0x66.
  83  * \322          - indicates that this instruction is only valid when the
  84  *                 operand size is the default (instruction to disassembler,
  85  *                 generates no code in the assembler)
  86  * \323          - indicates fixed 64-bit operand size, REX on extensions only.
  87  * \324          - indicates 64-bit operand size requiring REX prefix.
  88  * \330          - a literal byte follows in the code stream, to be added
  89  *                 to the condition code value of the instruction.
  90  * \331          - instruction not valid with REP prefix.  Hint for
  91  *                 disassembler only; for SSE instructions.
  92  * \332          - REP prefix (0xF2 byte) used as opcode extension.
  93  * \333          - REP prefix (0xF3 byte) used as opcode extension.
  94  * \334          - LOCK prefix used instead of REX.R
  95  * \335          - disassemble a rep (0xF3 byte) prefix as repe not rep.
  96  * \336          - force a REP(E) prefix (0xF2) even if not specified.
  97  * \337          - force a REPNE prefix (0xF3) even if not specified.
  98  *                 \336-\337 are still listed as prefixes in the disassembler.
  99  * \340          - reserve <operand 0> bytes of uninitialized storage.
 100  *                 Operand 0 had better be a segmentless constant.
 101  * \360          - no SSE prefix (== \364\331)
 102  * \361          - 66 SSE prefix (== \366\331)
 103  * \362          - F2 SSE prefix (== \364\332)
 104  * \363          - F3 SSE prefix (== \364\333)
 105  * \364          - operand-size prefix (0x66) not permitted
 106  * \365          - address-size prefix (0x67) not permitted
 107  * \366          - operand-size prefix (0x66) used as opcode extension
 108  * \367          - address-size prefix (0x67) used as opcode extension
 109  * \370,\371,\372 - match only if operand 0 meets byte jump criteria.
 110  *                 370 is used for Jcc, 371 is used for JMP.
 111  * \373          - assemble 0x03 if bits==16, 0x05 if bits==32;
 112  *                 used for conditional jump over longer jump
 113  */
 114
 115 #include "compiler.h"
 116
 117 #include <stdio.h>
 118 #include <string.h>
 119 #include <inttypes.h>
 120
 121 #include "nasm.h"
 122 #include "nasmlib.h"
 123 #include "assemble.h"
 124 #include "insns.h"
 125 #include "tables.h"
 126
 127 /* Initialized to zero by the C standard */
 128 static const uint8_t const_zero_buf[256];
 129
 130 typedef struct {
 131     int sib_present;                 /* is a SIB byte necessary? */
 132     int bytes;                       /* # of bytes of offset needed */
 133     int size;                        /* lazy - this is sib+bytes+1 */
 134     uint8_t modrm, sib, rex, rip;    /* the bytes themselves */
 135 } ea;
 136
 137 static uint32_t cpu;            /* cpu level received from nasm.c */
 138 static efunc errfunc;
 139 static struct ofmt *outfmt;
 140 static ListGen *list;
 141
 142 static int64_t calcsize(int32_t, int64_t, int, insn *, const uint8_t *);
 143 static void gencode(int32_t, int64_t, int, insn *, const uint8_t *, int64_t);
 144 static int matches(const struct itemplate *, insn *, int bits);
 145 static int32_t regflag(const operand *);
 146 static int32_t regval(const operand *);
 147 static int rexflags(int, int32_t, int);
 148 static int op_rexflags(const operand *, int);
 149 static ea *process_ea(operand *, ea *, int, int, int, int32_t);
 150 static void add_asp(insn *, int);
 151
 152 static int has_prefix(insn * ins, enum prefix_pos pos, enum prefixes prefix)
 153 {
 154     return ins->prefixes[pos] == prefix;
 155 }
 156
 157 static void assert_no_prefix(insn * ins, enum prefix_pos pos)
 158 {
 159     if (ins->prefixes[pos])
 160         errfunc(ERR_NONFATAL, "invalid %s prefix",
 161                 prefix_name(ins->prefixes[pos]));
 162 }
 163
 164 static const char *size_name(int size)
 165 {
 166     switch (size) {
 167     case 1:
 168         return "byte";
 169     case 2:
 170         return "word";
 171     case 4:
 172         return "dword";
 173     case 8:
 174         return "qword";
 175     case 10:
 176         return "tword";
 177     case 16:
 178         return "oword";
 179     case 32:
 180         return "yword";
 181     default:
 182         return "???";
 183     }
 184 }
 185
 186 static void warn_overflow(int size, int64_t data)
 187 {
 188     if (size < 8) {
 189         int64_t lim = ((int64_t)1 << (size*8))-1;
 190
 191         if (data < ~lim || data > lim)
 192             errfunc(ERR_WARNING | ERR_WARN_NOV,
 193                     "%s data exceeds bounds", size_name(size));
 194     }
 195 }
 196 /*
 197  * This routine wrappers the real output format's output routine,
 198  * in order to pass a copy of the data off to the listing file
 199  * generator at the same time.
 200  */
 201 static void out(int64_t offset, int32_t segto, const void *data,
 202                 enum out_type type, uint64_t size,
 203                 int32_t segment, int32_t wrt)
 204 {
 205     static int32_t lineno = 0;     /* static!!! */
 206     static char *lnfname = NULL;
 207     uint8_t p[8];
 208
 209     if (type == OUT_ADDRESS && segment == NO_SEG && wrt == NO_SEG) {
 210         /*
 211          * This is a non-relocated address, and we're going to
 212          * convert it into RAWDATA format.
 213          */
 214         uint8_t *q = p;
 215
 216         if (size > 8) {
 217             errfunc(ERR_PANIC, "OUT_ADDRESS with size > 8");
 218             return;
 219         }
 220
 221         WRITEADDR(q, *(int64_t *)data, size);
 222         data = p;
 223         type = OUT_RAWDATA;
 224     }
 225
 226     list->output(offset, data, type, size);
 227
 228     /*
 229      * this call to src_get determines when we call the
 230      * debug-format-specific "linenum" function
 231      * it updates lineno and lnfname to the current values
 232      * returning 0 if "same as last time", -2 if lnfname
 233      * changed, and the amount by which lineno changed,
 234      * if it did. thus, these variables must be static
 235      */
 236
 237     if (src_get(&lineno, &lnfname)) {
 238         outfmt->current_dfmt->linenum(lnfname, lineno, segto);
 239     }
 240
 241     outfmt->output(segto, data, type, size, segment, wrt);
 242 }
 243
 244 static int jmp_match(int32_t segment, int64_t offset, int bits,
 245                      insn * ins, const uint8_t *code)
 246 {
 247     int64_t isize;
 248     uint8_t c = code[0];
 249
 250     if (c != 0370 && c != 0371)
 251         return 0;
 252     if (ins->oprs[0].opflags & OPFLAG_FORWARD) {
 253         if ((optimizing < 0 || (ins->oprs[0].type & STRICT))
 254             && c == 0370)
 255             return 1;
 256         else
 257             return (pass0 == 0);        /* match a forward reference */
 258     }
 259     isize = calcsize(segment, offset, bits, ins, code);
 260     if (ins->oprs[0].segment != segment)
 261         return 0;
 262     isize = ins->oprs[0].offset - offset - isize;       /* isize is now the delta */
 263     if (isize >= -128L && isize <= 127L)
 264         return 1;               /* it is byte size */
 265
 266     return 0;
 267 }
 268
 269 int64_t assemble(int32_t segment, int64_t offset, int bits, uint32_t cp,
 270               insn * instruction, struct ofmt *output, efunc error,
 271               ListGen * listgen)
 272 {
 273     const struct itemplate *temp;
 274     int j;
 275     int size_prob;
 276     int64_t insn_end;
 277     int32_t itimes;
 278     int64_t start = offset;
 279     int64_t wsize = 0;             /* size for DB etc. */
 280
 281     errfunc = error;            /* to pass to other functions */
 282     cpu = cp;
 283     outfmt = output;            /* likewise */
 284     list = listgen;             /* and again */
 285
 286     switch (instruction->opcode) {
 287     case -1:
 288         return 0;
 289     case I_DB:
 290         wsize = 1;
 291         break;
 292     case I_DW:
 293         wsize = 2;
 294         break;
 295     case I_DD:
 296         wsize = 4;
 297         break;
 298     case I_DQ:
 299         wsize = 8;
 300         break;
 301     case I_DT:
 302         wsize = 10;
 303         break;
 304     case I_DO:
 305         wsize = 16;
 306         break;
 307     case I_DY:
 308         wsize = 32;
 309         break;
 310     default:
 311         break;
 312     }
 313
 314     if (wsize) {
 315         extop *e;
 316         int32_t t = instruction->times;
 317         if (t < 0)
 318             errfunc(ERR_PANIC,
 319                     "instruction->times < 0 (%ld) in assemble()", t);
 320
 321         while (t--) {           /* repeat TIMES times */
 322             for (e = instruction->eops; e; e = e->next) {
 323                 if (e->type == EOT_DB_NUMBER) {
 324                     if (wsize == 1) {
 325                         if (e->segment != NO_SEG)
 326                             errfunc(ERR_NONFATAL,
 327                                     "one-byte relocation attempted");
 328                         else {
 329                             uint8_t out_byte = e->offset;
 330                             out(offset, segment, &out_byte,
 331                                 OUT_RAWDATA, 1, NO_SEG, NO_SEG);
 332                         }
 333                     } else if (wsize > 8) {
 334                         errfunc(ERR_NONFATAL,
 335                                 "integer supplied to a DT, DO or DY"
 336                                 " instruction");
 337                     } else
 338                         out(offset, segment, &e->offset,
 339                             OUT_ADDRESS, wsize, e->segment, e->wrt);
 340                     offset += wsize;
 341                 } else if (e->type == EOT_DB_STRING ||
 342                            e->type == EOT_DB_STRING_FREE) {
 343                     int align;
 344
 345                     out(offset, segment, e->stringval,
 346                         OUT_RAWDATA, e->stringlen, NO_SEG, NO_SEG);
 347                     align = e->stringlen % wsize;
 348
 349                     if (align) {
 350                         align = wsize - align;
 351                         out(offset, segment, const_zero_buf,
 352                             OUT_RAWDATA, align, NO_SEG, NO_SEG);
 353                     }
 354                     offset += e->stringlen + align;
 355                 }
 356             }
 357             if (t > 0 && t == instruction->times - 1) {
 358                 /*
 359                  * Dummy call to list->output to give the offset to the
 360                  * listing module.
 361                  */
 362                 list->output(offset, NULL, OUT_RAWDATA, 0);
 363                 list->uplevel(LIST_TIMES);
 364             }
 365         }
 366         if (instruction->times > 1)
 367             list->downlevel(LIST_TIMES);
 368         return offset - start;
 369     }
 370
 371     if (instruction->opcode == I_INCBIN) {
 372         const char *fname = instruction->eops->stringval;
 373         FILE *fp;
 374
 375         fp = fopen(fname, "rb");
 376         if (!fp) {
 377             error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
 378                   fname);
 379         } else if (fseek(fp, 0L, SEEK_END) < 0) {
 380             error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
 381                   fname);
 382         } else {
 383             static char buf[4096];
 384             size_t t = instruction->times;
 385             size_t base = 0;
 386             size_t len;
 387
 388             len = ftell(fp);
 389             if (instruction->eops->next) {
 390                 base = instruction->eops->next->offset;
 391                 len -= base;
 392                 if (instruction->eops->next->next &&
 393                     len > (size_t)instruction->eops->next->next->offset)
 394                     len = (size_t)instruction->eops->next->next->offset;
 395             }
 396             /*
 397              * Dummy call to list->output to give the offset to the
 398              * listing module.
 399              */
 400             list->output(offset, NULL, OUT_RAWDATA, 0);
 401             list->uplevel(LIST_INCBIN);
 402             while (t--) {
 403                 size_t l;
 404
 405                 fseek(fp, base, SEEK_SET);
 406                 l = len;
 407                 while (l > 0) {
 408                     int32_t m =
 409                         fread(buf, 1, (l > (int32_t) sizeof(buf) ? (int32_t) sizeof(buf) : l),
 410                               fp);
 411                     if (!m) {
 412                         /*
 413                          * This shouldn't happen unless the file
 414                          * actually changes while we are reading
 415                          * it.
 416                          */
 417                         error(ERR_NONFATAL,
 418                               "`incbin': unexpected EOF while"
 419                               " reading file `%s'", fname);
 420                         t = 0;  /* Try to exit cleanly */
 421                         break;
 422                     }
 423                     out(offset, segment, buf, OUT_RAWDATA, m,
 424                         NO_SEG, NO_SEG);
 425                     l -= m;
 426                 }
 427             }
 428             list->downlevel(LIST_INCBIN);
 429             if (instruction->times > 1) {
 430                 /*
 431                  * Dummy call to list->output to give the offset to the
 432                  * listing module.
 433                  */
 434                 list->output(offset, NULL, OUT_RAWDATA, 0);
 435                 list->uplevel(LIST_TIMES);
 436                 list->downlevel(LIST_TIMES);
 437             }
 438             fclose(fp);
 439             return instruction->times * len;
 440         }
 441         return 0;               /* if we're here, there's an error */
 442     }
 443
 444     /* Check to see if we need an address-size prefix */
 445     add_asp(instruction, bits);
 446
 447     size_prob = false;
 448
 449     for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++){
 450         int m = matches(temp, instruction, bits);
 451
 452         if (m == 99)
 453             m += jmp_match(segment, offset, bits, instruction, temp->code);
 454
 455         if (m == 100) {         /* matches! */
 456             const uint8_t *codes = temp->code;
 457             int64_t insn_size = calcsize(segment, offset, bits,
 458                                       instruction, codes);
 459             itimes = instruction->times;
 460             if (insn_size < 0)  /* shouldn't be, on pass two */
 461                 error(ERR_PANIC, "errors made it through from pass one");
 462             else
 463                 while (itimes--) {
 464                     for (j = 0; j < MAXPREFIX; j++) {
 465                         uint8_t c = 0;
 466                         switch (instruction->prefixes[j]) {
 467                         case P_LOCK:
 468                             c = 0xF0;
 469                             break;
 470                         case P_REPNE:
 471                         case P_REPNZ:
 472                             c = 0xF2;
 473                             break;
 474                         case P_REPE:
 475                         case P_REPZ:
 476                         case P_REP:
 477                             c = 0xF3;
 478                             break;
 479                         case R_CS:
 480                             if (bits == 64) {
 481                                 error(ERR_WARNING,
 482                                       "cs segment base generated, but will be ignored in 64-bit mode");
 483                             }
 484                             c = 0x2E;
 485                             break;
 486                         case R_DS:
 487                             if (bits == 64) {
 488                                 error(ERR_WARNING,
 489                                       "ds segment base generated, but will be ignored in 64-bit mode");
 490                             }
 491                             c = 0x3E;
 492                             break;
 493                         case R_ES:
 494                            if (bits == 64) {
 495                                 error(ERR_WARNING,
 496                                       "es segment base generated, but will be ignored in 64-bit mode");
 497                            }
 498                             c = 0x26;
 499                             break;
 500                         case R_FS:
 501                             c = 0x64;
 502                             break;
 503                         case R_GS:
 504                             c = 0x65;
 505                             break;
 506                         case R_SS:
 507                             if (bits == 64) {
 508                                 error(ERR_WARNING,
 509                                       "ss segment base generated, but will be ignored in 64-bit mode");
 510                             }
 511                             c = 0x36;
 512                             break;
 513                         case R_SEGR6:
 514                         case R_SEGR7:
 515                             error(ERR_NONFATAL,
 516                                   "segr6 and segr7 cannot be used as prefixes");
 517                             break;
 518                         case P_A16:
 519                             if (bits == 64) {
 520                                 error(ERR_NONFATAL,
 521                                       "16-bit addressing is not supported "
 522                                       "in 64-bit mode");
 523                             } else if (bits != 16)
 524                                 c = 0x67;
 525                             break;
 526                         case P_A32:
 527                             if (bits != 32)
 528                                 c = 0x67;
 529                             break;
 530                         case P_A64:
 531                             if (bits != 64) {
 532                                 error(ERR_NONFATAL,
 533                                       "64-bit addressing is only supported "
 534                                       "in 64-bit mode");
 535                             }
 536                             break;
 537                         case P_ASP:
 538                             c = 0x67;
 539                             break;
 540                         case P_O16:
 541                             if (bits != 16)
 542                                 c = 0x66;
 543                             break;
 544                         case P_O32:
 545                             if (bits == 16)
 546                                 c = 0x66;
 547                             break;
 548                         case P_O64:
 549                             /* REX.W */
 550                             break;
 551                         case P_OSP:
 552                             c = 0x66;
 553                             break;
 554                         case P_none:
 555                             break;
 556                         default:
 557                             error(ERR_PANIC, "invalid instruction prefix");
 558                         }
 559                         if (c != 0) {
 560                             out(offset, segment, &c, OUT_RAWDATA, 1,
 561                                 NO_SEG, NO_SEG);
 562                             offset++;
 563                         }
 564                     }
 565                     insn_end = offset + insn_size;
 566                     gencode(segment, offset, bits, instruction, codes,
 567                             insn_end);
 568                     offset += insn_size;
 569                     if (itimes > 0 && itimes == instruction->times - 1) {
 570                         /*
 571                          * Dummy call to list->output to give the offset to the
 572                          * listing module.
 573                          */
 574                         list->output(offset, NULL, OUT_RAWDATA, 0);
 575                         list->uplevel(LIST_TIMES);
 576                     }
 577                 }
 578             if (instruction->times > 1)
 579                 list->downlevel(LIST_TIMES);
 580             return offset - start;
 581         } else if (m > 0 && m > size_prob) {
 582             size_prob = m;
 583         }
 584 //        temp++;
 585     }
 586
 587     if (temp->opcode == -1) {   /* didn't match any instruction */
 588         switch (size_prob) {
 589         case 1:
 590             error(ERR_NONFATAL, "operation size not specified");
 591             break;
 592         case 2:
 593             error(ERR_NONFATAL, "mismatch in operand sizes");
 594             break;
 595         case 3:
 596             error(ERR_NONFATAL, "no instruction for this cpu level");
 597             break;
 598         case 4:
 599             error(ERR_NONFATAL, "instruction not supported in 64-bit mode");
 600             break;
 601         default:
 602             error(ERR_NONFATAL,
 603                   "invalid combination of opcode and operands");
 604             break;
 605         }
 606     }
 607     return 0;
 608 }
 609
 610 int64_t insn_size(int32_t segment, int64_t offset, int bits, uint32_t cp,
 611                insn * instruction, efunc error)
 612 {
 613     const struct itemplate *temp;
 614
 615     errfunc = error;            /* to pass to other functions */
 616     cpu = cp;
 617
 618     if (instruction->opcode == -1)
 619         return 0;
 620
 621     if (instruction->opcode == I_DB || instruction->opcode == I_DW ||
 622         instruction->opcode == I_DD || instruction->opcode == I_DQ ||
 623         instruction->opcode == I_DT || instruction->opcode == I_DO ||
 624         instruction->opcode == I_DY) {
 625         extop *e;
 626         int32_t isize, osize, wsize = 0;   /* placate gcc */
 627
 628         isize = 0;
 629         switch (instruction->opcode) {
 630         case I_DB:
 631             wsize = 1;
 632             break;
 633         case I_DW:
 634             wsize = 2;
 635             break;
 636         case I_DD:
 637             wsize = 4;
 638             break;
 639         case I_DQ:
 640             wsize = 8;
 641             break;
 642         case I_DT:
 643             wsize = 10;
 644             break;
 645         case I_DO:
 646             wsize = 16;
 647             break;
 648         case I_DY:
 649             wsize = 32;
 650             break;
 651         default:
 652             break;
 653         }
 654
 655         for (e = instruction->eops; e; e = e->next) {
 656             int32_t align;
 657
 658             osize = 0;
 659             if (e->type == EOT_DB_NUMBER)
 660                 osize = 1;
 661             else if (e->type == EOT_DB_STRING ||
 662                      e->type == EOT_DB_STRING_FREE)
 663                 osize = e->stringlen;
 664
 665             align = (-osize) % wsize;
 666             if (align < 0)
 667                 align += wsize;
 668             isize += osize + align;
 669         }
 670         return isize * instruction->times;
 671     }
 672
 673     if (instruction->opcode == I_INCBIN) {
 674         const char *fname = instruction->eops->stringval;
 675         FILE *fp;
 676         size_t len;
 677
 678         fp = fopen(fname, "rb");
 679         if (!fp)
 680             error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
 681                   fname);
 682         else if (fseek(fp, 0L, SEEK_END) < 0)
 683             error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
 684                   fname);
 685         else {
 686             len = ftell(fp);
 687             fclose(fp);
 688             if (instruction->eops->next) {
 689                 len -= instruction->eops->next->offset;
 690                 if (instruction->eops->next->next &&
 691                     len > (size_t)instruction->eops->next->next->offset) {
 692                     len = (size_t)instruction->eops->next->next->offset;
 693                 }
 694             }
 695             return instruction->times * len;
 696         }
 697         return 0;               /* if we're here, there's an error */
 698     }
 699
 700     /* Check to see if we need an address-size prefix */
 701     add_asp(instruction, bits);
 702
 703     for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++) {
 704         int m = matches(temp, instruction, bits);
 705         if (m == 99)
 706             m += jmp_match(segment, offset, bits, instruction, temp->code);
 707
 708         if (m == 100) {
 709             /* we've matched an instruction. */
 710             int64_t isize;
 711             const uint8_t *codes = temp->code;
 712             int j;
 713
 714             isize = calcsize(segment, offset, bits, instruction, codes);
 715             if (isize < 0)
 716                 return -1;
 717             for (j = 0; j < MAXPREFIX; j++) {
 718                 switch (instruction->prefixes[j]) {
 719                 case P_A16:
 720                     if (bits != 16)
 721                         isize++;
 722                     break;
 723                 case P_A32:
 724                     if (bits != 32)
 725                         isize++;
 726                     break;
 727                 case P_O16:
 728                     if (bits != 16)
 729                         isize++;
 730                     break;
 731                 case P_O32:
 732                     if (bits == 16)
 733                         isize++;
 734                     break;
 735                 case P_A64:
 736                 case P_O64:
 737                 case P_none:
 738                     break;
 739                 default:
 740                     isize++;
 741                     break;
 742                 }
 743             }
 744             return isize * instruction->times;
 745         }
 746     }
 747     return -1;                  /* didn't match any instruction */
 748 }
 749
 750 static bool possible_sbyte(operand *o)
 751 {
 752     return !(o->opflags & OPFLAG_FORWARD) &&
 753         optimizing >= 0 && !(o->type & STRICT) &&
 754         o->wrt == NO_SEG && o->segment == NO_SEG;
 755 }
 756
 757 /* check that opn[op]  is a signed byte of size 16 or 32 */
 758 static bool is_sbyte16(operand *o)
 759 {
 760     int16_t v;
 761
 762     if (!possible_sbyte(o))
 763         return false;
 764
 765     v = o->offset;
 766     return v >= -128 && v <= 127;
 767 }
 768
 769 static bool is_sbyte32(operand *o)
 770 {
 771     int32_t v;
 772
 773     if (!possible_sbyte(o))
 774         return false;
 775
 776     v = o->offset;
 777     return v >= -128 && v <= 127;
 778 }
 779
 780 /* check that  opn[op]  is a signed byte of size 32; warn if this is not
 781    the original value when extended to 64 bits */
 782 static bool is_sbyte64(operand *o)
 783 {
 784     int64_t v64;
 785     int32_t v32;
 786
 787     /* dead in the water on forward reference or External */
 788     if (!possible_sbyte(o))
 789         return false;
 790
 791     v64 = o->offset;
 792     v32 = (int32_t)v64;
 793
 794     warn_overflow(32, v64);
 795
 796     return v32 >= -128 && v32 <= 127;
 797 }
 798 static int64_t calcsize(int32_t segment, int64_t offset, int bits,
 799                      insn * ins, const uint8_t *codes)
 800 {
 801     int64_t length = 0;
 802     uint8_t c;
 803     int rex_mask = ~0;
 804     struct operand *opx;
 805
 806     ins->rex = 0;               /* Ensure REX is reset */
 807
 808     if (ins->prefixes[PPS_OSIZE] == P_O64)
 809         ins->rex |= REX_W;
 810
 811     (void)segment;              /* Don't warn that this parameter is unused */
 812     (void)offset;               /* Don't warn that this parameter is unused */
 813
 814     while (*codes) {
 815         c = *codes++;
 816         opx = &ins->oprs[c & 3];
 817         switch (c) {
 818         case 01:
 819         case 02:
 820         case 03:
 821             codes += c, length += c;
 822             break;
 823         case 04:
 824         case 05:
 825         case 06:
 826         case 07:
 827             length++;
 828             break;
 829         case 010:
 830         case 011:
 831         case 012:
 832         case 013:
 833             ins->rex |=
 834                 op_rexflags(opx, REX_B|REX_H|REX_P|REX_W);
 835             codes++, length++;
 836             break;
 837         case 014:
 838         case 015:
 839         case 016:
 840         case 017:
 841             length++;
 842             break;
 843         case 020:
 844         case 021:
 845         case 022:
 846         case 023:
 847             length++;
 848             break;
 849         case 024:
 850         case 025:
 851         case 026:
 852         case 027:
 853             length++;
 854             break;
 855         case 030:
 856         case 031:
 857         case 032:
 858         case 033:
 859             length += 2;
 860             break;
 861         case 034:
 862         case 035:
 863         case 036:
 864         case 037:
 865             if (opx->type & (BITS16 | BITS32 | BITS64))
 866                 length += (opx->type & BITS16) ? 2 : 4;
 867             else
 868                 length += (bits == 16) ? 2 : 4;
 869             break;
 870         case 040:
 871         case 041:
 872         case 042:
 873         case 043:
 874             length += 4;
 875             break;
 876         case 044:
 877         case 045:
 878         case 046:
 879         case 047:
 880             length += ins->addr_size >> 3;
 881             break;
 882         case 050:
 883         case 051:
 884         case 052:
 885         case 053:
 886             length++;
 887             break;
 888         case 054:
 889         case 055:
 890         case 056:
 891         case 057:
 892             length += 8; /* MOV reg64/imm */
 893             break;
 894         case 060:
 895         case 061:
 896         case 062:
 897         case 063:
 898             length += 2;
 899             break;
 900         case 064:
 901         case 065:
 902         case 066:
 903         case 067:
 904             if (opx->type & (BITS16 | BITS32 | BITS64))
 905                 length += (opx->type & BITS16) ? 2 : 4;
 906             else
 907                 length += (bits == 16) ? 2 : 4;
 908             break;
 909         case 070:
 910         case 071:
 911         case 072:
 912         case 073:
 913             length += 4;
 914             break;
 915         case 074:
 916         case 075:
 917         case 076:
 918         case 077:
 919             length += 2;
 920             break;
 921         case 0140:
 922         case 0141:
 923         case 0142:
 924         case 0143:
 925             length += is_sbyte16(opx) ? 1 : 2;
 926             break;
 927         case 0144:
 928         case 0145:
 929         case 0146:
 930         case 0147:
 931             codes++;
 932             length++;
 933             break;
 934         case 0150:
 935         case 0151:
 936         case 0152:
 937         case 0153:
 938             length += is_sbyte32(opx) ? 1 : 4;
 939             break;
 940         case 0154:
 941         case 0155:
 942         case 0156:
 943         case 0157:
 944             codes++;
 945             length++;
 946             break;
 947         case 0160:
 948         case 0161:
 949         case 0162:
 950         case 0163:
 951             length++;
 952             ins->rex |= REX_D;
 953             ins->drexdst = regval(opx);
 954             break;
 955         case 0164:
 956         case 0165:
 957         case 0166:
 958         case 0167:
 959             length++;
 960             ins->rex |= REX_D|REX_OC;
 961             ins->drexdst = regval(opx);
 962             break;
 963         case 0171:
 964             break;
 965         case 0172:
 966         case 0173:
 967         case 0174:
 968             codes++;
 969             length++;
 970             break;
 971         case 0250:
 972         case 0251:
 973         case 0252:
 974         case 0253:
 975             length += is_sbyte64(opx) ? 1 : 4;
 976             break;
 977         case 0260:
 978         case 0261:
 979         case 0262:
 980         case 0263:
 981             ins->rex |= REX_V;
 982             ins->drexdst = regval(opx);
 983             ins->vex_m = *codes++;
 984             ins->vex_wlp = *codes++;
 985             break;
 986         case 0270:
 987             ins->rex |= REX_V;
 988             ins->drexdst = 0;
 989             ins->vex_m = *codes++;
 990             ins->vex_wlp = *codes++;
 991             break;
 992         case 0300:
 993         case 0301:
 994         case 0302:
 995         case 0303:
 996             break;
 997         case 0310:
 998             if (bits == 64)
 999                 return -1;
1000             length += (bits != 16) && !has_prefix(ins, PPS_ASIZE, P_A16);
1001             break;
1002         case 0311:
1003             length += (bits != 32) && !has_prefix(ins, PPS_ASIZE, P_A32);
1004             break;
1005         case 0312:
1006             break;
1007         case 0313:
1008             if (bits != 64 || has_prefix(ins, PPS_ASIZE, P_A16) ||
1009                 has_prefix(ins, PPS_ASIZE, P_A32))
1010                 return -1;
1011             break;
1012         case 0314:
1013         case 0315:
1014         case 0316:
1015         case 0317:
1016             break;
1017         case 0320:
1018             length += (bits != 16);
1019             break;
1020         case 0321:
1021             length += (bits == 16);
1022             break;
1023         case 0322:
1024             break;
1025         case 0323:
1026             rex_mask &= ~REX_W;
1027             break;
1028         case 0324:
1029             ins->rex |= REX_W;
1030             break;
1031         case 0330:
1032             codes++, length++;
1033             break;
1034         case 0331:
1035             break;
1036         case 0332:
1037         case 0333:
1038             length++;
1039             break;
1040         case 0334:
1041             ins->rex |= REX_L;
1042             break;
1043         case 0335:
1044             break;
1045         case 0336:
1046             if (!ins->prefixes[PPS_LREP])
1047                 ins->prefixes[PPS_LREP] = P_REP;
1048             break;
1049         case 0337:
1050             if (!ins->prefixes[PPS_LREP])
1051                 ins->prefixes[PPS_LREP] = P_REPNE;
1052             break;
1053         case 0340:
1054             if (ins->oprs[0].segment != NO_SEG)
1055                 errfunc(ERR_NONFATAL, "attempt to reserve non-constant"
1056                         " quantity of BSS space");
1057             else
1058                 length += ins->oprs[0].offset;
1059             break;
1060         case 0360:
1061             break;
1062         case 0361:
1063         case 0362:
1064         case 0363:
1065             length++;
1066             break;
1067         case 0364:
1068         case 0365:
1069             break;
1070         case 0366:
1071         case 0367:
1072             length++;
1073             break;
1074         case 0370:
1075         case 0371:
1076         case 0372:
1077             break;
1078         case 0373:
1079             length++;
1080             break;
1081         default:               /* can't do it by 'case' statements */
1082             if (c >= 0100 && c <= 0277) {       /* it's an EA */
1083                 ea ea_data;
1084                 int rfield;
1085                 int32_t rflags;
1086                 ea_data.rex = 0;           /* Ensure ea.REX is initially 0 */
1087
1088                 if (c <= 0177) {
1089                     /* pick rfield from operand b */
1090                     rflags = regflag(&ins->oprs[c & 7]);
1091                     rfield = nasm_regvals[ins->oprs[c & 7].basereg];
1092                 } else {
1093                     rflags = 0;
1094                     rfield = c & 7;
1095                 }
1096
1097                 if (!process_ea
1098                     (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1099                      ins->addr_size, rfield, rflags)) {
1100                     errfunc(ERR_NONFATAL, "invalid effective address");
1101                     return -1;
1102                 } else {
1103                     ins->rex |= ea_data.rex;
1104                     length += ea_data.size;
1105                 }
1106             } else {
1107                 errfunc(ERR_PANIC, "internal instruction table corrupt"
1108                         ": instruction code 0x%02X given", c);
1109             }
1110         }
1111     }
1112
1113     ins->rex &= rex_mask;
1114
1115     if (ins->rex & REX_V) {
1116         int bad32 = REX_R|REX_W|REX_X|REX_B;
1117
1118         if (ins->rex & REX_H) {
1119             errfunc(ERR_NONFATAL, "cannot use high register in vex instruction");
1120             return -1;
1121         }
1122         switch (ins->vex_wlp & 030) {
1123         case 000:
1124         case 020:
1125             ins->rex &= ~REX_W;
1126             break;
1127         case 010:
1128             ins->rex |= REX_W;
1129             bad32 &= ~REX_W;
1130             break;
1131         case 030:
1132             /* Follow REX_W */
1133             break;
1134         }
1135
1136         if (bits != 64 && ((ins->rex & bad32) || ins->drexdst > 7)) {
1137             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1138             return -1;
1139         }
1140         if (ins->vex_m != 1 || (ins->rex & (REX_W|REX_R|REX_B)))
1141             length += 3;
1142         else
1143             length += 2;
1144     } else if (ins->rex & REX_D) {
1145         if (ins->rex & REX_H) {
1146             errfunc(ERR_NONFATAL, "cannot use high register in drex instruction");
1147             return -1;
1148         }
1149         if (bits != 64 && ((ins->rex & (REX_R|REX_W|REX_X|REX_B)) ||
1150                            ins->drexdst > 7)) {
1151             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1152             return -1;
1153         }
1154         length++;
1155     } else if (ins->rex & REX_REAL) {
1156         if (ins->rex & REX_H) {
1157             errfunc(ERR_NONFATAL, "cannot use high register in rex instruction");
1158             return -1;
1159         } else if (bits == 64) {
1160             length++;
1161         } else if ((ins->rex & REX_L) &&
1162                    !(ins->rex & (REX_P|REX_W|REX_X|REX_B)) &&
1163                    cpu >= IF_X86_64) {
1164             /* LOCK-as-REX.R */
1165             assert_no_prefix(ins, PPS_LREP);
1166             length++;
1167         } else {
1168             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1169             return -1;
1170         }
1171     }
1172
1173     return length;
1174 }
1175
1176 #define EMIT_REX()                                                      \
1177     if (!(ins->rex & (REX_D|REX_V)) && (ins->rex & REX_REAL) && (bits == 64)) { \
1178         ins->rex = (ins->rex & REX_REAL)|REX_P;                         \
1179         out(offset, segment, &ins->rex, OUT_RAWDATA, 1, NO_SEG, NO_SEG); \
1180         ins->rex = 0;                                                   \
1181         offset += 1; \
1182     }
1183
1184 static void gencode(int32_t segment, int64_t offset, int bits,
1185                     insn * ins, const uint8_t *codes, int64_t insn_end)
1186 {
1187     static char condval[] = {   /* conditional opcodes */
1188         0x7, 0x3, 0x2, 0x6, 0x2, 0x4, 0xF, 0xD, 0xC, 0xE, 0x6, 0x2,
1189         0x3, 0x7, 0x3, 0x5, 0xE, 0xC, 0xD, 0xF, 0x1, 0xB, 0x9, 0x5,
1190         0x0, 0xA, 0xA, 0xB, 0x8, 0x4
1191     };
1192     uint8_t c;
1193     uint8_t bytes[4];
1194     int64_t size;
1195     int64_t data;
1196     struct operand *opx;
1197
1198     while (*codes) {
1199         c = *codes++;
1200         opx = &ins->oprs[c & 3];
1201         switch (c) {
1202         case 01:
1203         case 02:
1204         case 03:
1205             EMIT_REX();
1206             out(offset, segment, codes, OUT_RAWDATA, c, NO_SEG, NO_SEG);
1207             codes += c;
1208             offset += c;
1209             break;
1210
1211         case 04:
1212         case 06:
1213             switch (ins->oprs[0].basereg) {
1214             case R_CS:
1215                 bytes[0] = 0x0E + (c == 0x04 ? 1 : 0);
1216                 break;
1217             case R_DS:
1218                 bytes[0] = 0x1E + (c == 0x04 ? 1 : 0);
1219                 break;
1220             case R_ES:
1221                 bytes[0] = 0x06 + (c == 0x04 ? 1 : 0);
1222                 break;
1223             case R_SS:
1224                 bytes[0] = 0x16 + (c == 0x04 ? 1 : 0);
1225                 break;
1226             default:
1227                 errfunc(ERR_PANIC,
1228                         "bizarre 8086 segment register received");
1229             }
1230             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1231             offset++;
1232             break;
1233
1234         case 05:
1235         case 07:
1236             switch (ins->oprs[0].basereg) {
1237             case R_FS:
1238                 bytes[0] = 0xA0 + (c == 0x05 ? 1 : 0);
1239                 break;
1240             case R_GS:
1241                 bytes[0] = 0xA8 + (c == 0x05 ? 1 : 0);
1242                 break;
1243             default:
1244                 errfunc(ERR_PANIC,
1245                         "bizarre 386 segment register received");
1246             }
1247             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1248             offset++;
1249             break;
1250
1251         case 010:
1252         case 011:
1253         case 012:
1254         case 013:
1255             EMIT_REX();
1256             bytes[0] = *codes++ + ((regval(opx)) & 7);
1257             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1258             offset += 1;
1259             break;
1260
1261         case 014:
1262         case 015:
1263         case 016:
1264         case 017:
1265             /* XXX: warns for legitimate optimizer actions */
1266             if (opx->offset < -128 || opx->offset > 127) {
1267                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1268                         "signed byte value exceeds bounds");
1269             }
1270
1271             if (opx->segment != NO_SEG) {
1272                 data = opx->offset;
1273                 out(offset, segment, &data, OUT_ADDRESS, 1,
1274                     opx->segment, opx->wrt);
1275             } else {
1276                 bytes[0] = opx->offset;
1277                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1278                     NO_SEG);
1279             }
1280             offset += 1;
1281             break;
1282
1283         case 020:
1284         case 021:
1285         case 022:
1286         case 023:
1287             if (opx->offset < -256 || opx->offset > 255) {
1288                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1289                         "byte value exceeds bounds");
1290             }
1291             if (opx->segment != NO_SEG) {
1292                 data = opx->offset;
1293                 out(offset, segment, &data, OUT_ADDRESS, 1,
1294                     opx->segment, opx->wrt);
1295             } else {
1296                 bytes[0] = opx->offset;
1297                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1298                     NO_SEG);
1299             }
1300             offset += 1;
1301             break;
1302
1303         case 024:
1304         case 025:
1305         case 026:
1306         case 027:
1307             if (opx->offset < 0 || opx->offset > 255)
1308                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1309                         "unsigned byte value exceeds bounds");
1310             if (opx->segment != NO_SEG) {
1311                 data = opx->offset;
1312                 out(offset, segment, &data, OUT_ADDRESS, 1,
1313                     opx->segment, opx->wrt);
1314             } else {
1315                 bytes[0] = opx->offset;
1316                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1317                     NO_SEG);
1318             }
1319             offset += 1;
1320             break;
1321
1322         case 030:
1323         case 031:
1324         case 032:
1325         case 033:
1326             data = opx->offset;
1327             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1328                 warn_overflow(2, data);
1329             out(offset, segment, &data, OUT_ADDRESS, 2,
1330                 opx->segment, opx->wrt);
1331             offset += 2;
1332             break;
1333
1334         case 034:
1335         case 035:
1336         case 036:
1337         case 037:
1338             if (opx->type & (BITS16 | BITS32))
1339                 size = (opx->type & BITS16) ? 2 : 4;
1340             else
1341                 size = (bits == 16) ? 2 : 4;
1342             data = opx->offset;
1343             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1344                 warn_overflow(size, data);
1345             out(offset, segment, &data, OUT_ADDRESS, size,
1346                 opx->segment, opx->wrt);
1347             offset += size;
1348             break;
1349
1350         case 040:
1351         case 041:
1352         case 042:
1353         case 043:
1354             data = opx->offset;
1355             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1356                 warn_overflow(4, data);
1357             out(offset, segment, &data, OUT_ADDRESS, 4,
1358                 opx->segment, opx->wrt);
1359             offset += 4;
1360             break;
1361
1362         case 044:
1363         case 045:
1364         case 046:
1365         case 047:
1366             data = opx->offset;
1367             size = ins->addr_size >> 3;
1368             if (opx->segment == NO_SEG &&
1369                 opx->wrt == NO_SEG)
1370                 warn_overflow(size, data);
1371             out(offset, segment, &data, OUT_ADDRESS, size,
1372                 opx->segment, opx->wrt);
1373             offset += size;
1374             break;
1375
1376         case 050:
1377         case 051:
1378         case 052:
1379         case 053:
1380             if (opx->segment != segment)
1381                 errfunc(ERR_NONFATAL,
1382                         "short relative jump outside segment");
1383             data = opx->offset - insn_end;
1384             if (data > 127 || data < -128)
1385                 errfunc(ERR_NONFATAL, "short jump is out of range");
1386             bytes[0] = data;
1387             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1388             offset += 1;
1389             break;
1390
1391         case 054:
1392         case 055:
1393         case 056:
1394         case 057:
1395             data = (int64_t)opx->offset;
1396             out(offset, segment, &data, OUT_ADDRESS, 8,
1397                 opx->segment, opx->wrt);
1398             offset += 8;
1399             break;
1400
1401         case 060:
1402         case 061:
1403         case 062:
1404         case 063:
1405             if (opx->segment != segment) {
1406                 data = opx->offset;
1407                 out(offset, segment, &data,
1408                     OUT_REL2ADR, insn_end - offset,
1409                     opx->segment, opx->wrt);
1410             } else {
1411                 data = opx->offset - insn_end;
1412                 out(offset, segment, &data,
1413                     OUT_ADDRESS, 2, NO_SEG, NO_SEG);
1414             }
1415             offset += 2;
1416             break;
1417
1418         case 064:
1419         case 065:
1420         case 066:
1421         case 067:
1422             if (opx->type & (BITS16 | BITS32 | BITS64))
1423                 size = (opx->type & BITS16) ? 2 : 4;
1424             else
1425                 size = (bits == 16) ? 2 : 4;
1426             if (opx->segment != segment) {
1427                 data = opx->offset;
1428                 out(offset, segment, &data,
1429                     size == 2 ? OUT_REL2ADR : OUT_REL4ADR,
1430                     insn_end - offset, opx->segment, opx->wrt);
1431             } else {
1432                 data = opx->offset - insn_end;
1433                 out(offset, segment, &data,
1434                     OUT_ADDRESS, size, NO_SEG, NO_SEG);
1435             }
1436             offset += size;
1437             break;
1438
1439         case 070:
1440         case 071:
1441         case 072:
1442         case 073:
1443             if (opx->segment != segment) {
1444                 data = opx->offset;
1445                 out(offset, segment, &data,
1446                     OUT_REL4ADR, insn_end - offset,
1447                     opx->segment, opx->wrt);
1448             } else {
1449                 data = opx->offset - insn_end;
1450                 out(offset, segment, &data,
1451                     OUT_ADDRESS, 4, NO_SEG, NO_SEG);
1452             }
1453             offset += 4;
1454             break;
1455
1456         case 074:
1457         case 075:
1458         case 076:
1459         case 077:
1460             if (opx->segment == NO_SEG)
1461                 errfunc(ERR_NONFATAL, "value referenced by FAR is not"
1462                         " relocatable");
1463             data = 0;
1464             out(offset, segment, &data, OUT_ADDRESS, 2,
1465                 outfmt->segbase(1 + opx->segment),
1466                 opx->wrt);
1467             offset += 2;
1468             break;
1469
1470         case 0140:
1471         case 0141:
1472         case 0142:
1473         case 0143:
1474             data = opx->offset;
1475             if (is_sbyte16(opx)) {
1476                 bytes[0] = data;
1477                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1478                     NO_SEG);
1479                 offset++;
1480             } else {
1481                 if (opx->segment == NO_SEG &&
1482                     opx->wrt == NO_SEG)
1483                     warn_overflow(2, data);
1484                 out(offset, segment, &data, OUT_ADDRESS, 2,
1485                     opx->segment, opx->wrt);
1486                 offset += 2;
1487             }
1488             break;
1489
1490         case 0144:
1491         case 0145:
1492         case 0146:
1493         case 0147:
1494             EMIT_REX();
1495             bytes[0] = *codes++;
1496             if (is_sbyte16(opx))
1497                 bytes[0] |= 2;  /* s-bit */
1498             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1499             offset++;
1500             break;
1501
1502         case 0150:
1503         case 0151:
1504         case 0152:
1505         case 0153:
1506             data = opx->offset;
1507             if (is_sbyte32(opx)) {
1508                 bytes[0] = data;
1509                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1510                     NO_SEG);
1511                 offset++;
1512             } else {
1513                 out(offset, segment, &data, OUT_ADDRESS, 4,
1514                     opx->segment, opx->wrt);
1515                 offset += 4;
1516             }
1517             break;
1518
1519         case 0154:
1520         case 0155:
1521         case 0156:
1522         case 0157:
1523             EMIT_REX();
1524             bytes[0] = *codes++;
1525             if (is_sbyte32(opx))
1526                 bytes[0] |= 2;  /* s-bit */
1527             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1528             offset++;
1529             break;
1530
1531         case 0160:
1532         case 0161:
1533         case 0162:
1534         case 0163:
1535         case 0164:
1536         case 0165:
1537         case 0166:
1538         case 0167:
1539             break;
1540
1541         case 0171:
1542             bytes[0] =
1543                 (ins->drexdst << 4) |
1544                 (ins->rex & REX_OC ? 0x08 : 0) |
1545                 (ins->rex & (REX_R|REX_X|REX_B));
1546             ins->rex = 0;
1547             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1548             offset++;
1549             break;
1550
1551         case 0172:
1552             c = *codes++;
1553             opx = &ins->oprs[c >> 3];
1554             bytes[0] = nasm_regvals[opx->basereg] << 4;
1555             opx = &ins->oprs[c & 7];
1556             if (opx->segment != NO_SEG || opx->wrt != NO_SEG) {
1557                 errfunc(ERR_NONFATAL,
1558                         "non-absolute expression not permitted as argument %d",
1559                         c & 7);
1560             } else {
1561                 if (opx->offset & ~15) {
1562                     errfunc(ERR_WARNING | ERR_WARN_NOV,
1563                             "four-bit argument exceeds bounds");
1564                 }
1565                 bytes[0] |= opx->offset & 15;
1566             }
1567             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1568             offset++;
1569             break;
1570
1571         case 0173:
1572             c = *codes++;
1573             opx = &ins->oprs[c >> 4];
1574             bytes[0] = nasm_regvals[opx->basereg] << 4;
1575             bytes[0] |= c & 15;
1576             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1577             offset++;
1578             break;
1579
1580         case 0174:
1581             c = *codes++;
1582             opx = &ins->oprs[c];
1583             bytes[0] = nasm_regvals[opx->basereg] << 4;
1584             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1585             offset++;
1586             break;
1587
1588         case 0250:
1589         case 0251:
1590         case 0252:
1591         case 0253:
1592             data = opx->offset;
1593             /* is_sbyte32() is right here, we have already warned */
1594             if (is_sbyte32(opx)) {
1595                 bytes[0] = data;
1596                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1597                     NO_SEG);
1598                 offset++;
1599             } else {
1600                 out(offset, segment, &data, OUT_ADDRESS, 4,
1601                     opx->segment, opx->wrt);
1602                 offset += 4;
1603             }
1604             break;
1605
1606         case 0260:
1607         case 0261:
1608         case 0262:
1609         case 0263:
1610         case 0270:
1611             codes += 2;
1612             if (ins->vex_m != 1 || (ins->rex & (REX_W|REX_X|REX_B))) {
1613                 bytes[0] = 0xc4;
1614                 bytes[1] = ins->vex_m | ((~ins->rex & 7) << 5);
1615                 bytes[2] = ((ins->rex & REX_W) << (7-3)) |
1616                     ((~ins->drexdst & 15)<< 3) | (ins->vex_wlp & 07);
1617                 out(offset, segment, &bytes, OUT_RAWDATA, 3, NO_SEG, NO_SEG);
1618                 offset += 3;
1619             } else {
1620                 bytes[0] = 0xc5;
1621                 bytes[1] = ((~ins->rex & REX_R) << (7-2)) |
1622                     ((~ins->drexdst & 15) << 3) | (ins->vex_wlp & 07);
1623                 out(offset, segment, &bytes, OUT_RAWDATA, 2, NO_SEG, NO_SEG);
1624                 offset += 2;
1625             }
1626             break;
1627
1628         case 0300:
1629         case 0301:
1630         case 0302:
1631         case 0303:
1632             break;
1633
1634         case 0310:
1635             if (bits == 32 && !has_prefix(ins, PPS_ASIZE, P_A16)) {
1636                 *bytes = 0x67;
1637                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1638                 offset += 1;
1639             } else
1640                 offset += 0;
1641             break;
1642
1643         case 0311:
1644             if (bits != 32 && !has_prefix(ins, PPS_ASIZE, P_A32)) {
1645                 *bytes = 0x67;
1646                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1647                 offset += 1;
1648             } else
1649                 offset += 0;
1650             break;
1651
1652         case 0312:
1653             break;
1654
1655         case 0313:
1656             ins->rex = 0;
1657             break;
1658
1659         case 0314:
1660         case 0315:
1661         case 0316:
1662         case 0317:
1663             break;
1664
1665         case 0320:
1666             if (bits != 16) {
1667                 *bytes = 0x66;
1668                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1669                 offset += 1;
1670             } else
1671                 offset += 0;
1672             break;
1673
1674         case 0321:
1675             if (bits == 16) {
1676                 *bytes = 0x66;
1677                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1678                 offset += 1;
1679             } else
1680                 offset += 0;
1681             break;
1682
1683         case 0322:
1684         case 0323:
1685             break;
1686
1687         case 0324:
1688             ins->rex |= REX_W;
1689             break;
1690
1691         case 0330:
1692             *bytes = *codes++ ^ condval[ins->condition];
1693             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1694             offset += 1;
1695             break;
1696
1697         case 0331:
1698             break;
1699
1700         case 0332:
1701         case 0333:
1702             *bytes = c - 0332 + 0xF2;
1703             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1704             offset += 1;
1705             break;
1706
1707         case 0334:
1708             if (ins->rex & REX_R) {
1709                 *bytes = 0xF0;
1710                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1711                 offset += 1;
1712             }
1713             ins->rex &= ~(REX_L|REX_R);
1714             break;
1715
1716         case 0335:
1717             break;
1718
1719         case 0336:
1720         case 0337:
1721             break;
1722
1723         case 0340:
1724             if (ins->oprs[0].segment != NO_SEG)
1725                 errfunc(ERR_PANIC, "non-constant BSS size in pass two");
1726             else {
1727                 int64_t size = ins->oprs[0].offset;
1728                 if (size > 0)
1729                     out(offset, segment, NULL,
1730                         OUT_RESERVE, size, NO_SEG, NO_SEG);
1731                 offset += size;
1732             }
1733             break;
1734
1735         case 0360:
1736             break;
1737
1738         case 0361:
1739             bytes[0] = 0x66;
1740             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1741             offset += 1;
1742             break;
1743
1744         case 0362:
1745         case 0363:
1746             bytes[0] = c - 0362 + 0xf2;
1747             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1748             offset += 1;
1749             break;
1750
1751         case 0364:
1752         case 0365:
1753             break;
1754
1755         case 0366:
1756         case 0367:
1757             *bytes = c - 0366 + 0x66;
1758             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1759             offset += 1;
1760             break;
1761
1762         case 0370:
1763         case 0371:
1764         case 0372:
1765             break;
1766
1767         case 0373:
1768             *bytes = bits == 16 ? 3 : 5;
1769             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1770             offset += 1;
1771             break;
1772
1773         default:               /* can't do it by 'case' statements */
1774             if (c >= 0100 && c <= 0277) {       /* it's an EA */
1775                 ea ea_data;
1776                 int rfield;
1777                 int32_t rflags;
1778                 uint8_t *p;
1779                 int32_t s;
1780
1781                 if (c <= 0177) {
1782                     /* pick rfield from operand b */
1783                     rflags = regflag(&ins->oprs[c & 7]);
1784                     rfield = nasm_regvals[ins->oprs[c & 7].basereg];
1785                 } else {
1786                     /* rfield is constant */
1787                     rflags = 0;
1788                     rfield = c & 7;
1789                 }
1790
1791                 if (!process_ea
1792                     (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1793                      ins->addr_size, rfield, rflags)) {
1794                     errfunc(ERR_NONFATAL, "invalid effective address");
1795                 }
1796
1797
1798                 p = bytes;
1799                 *p++ = ea_data.modrm;
1800                 if (ea_data.sib_present)
1801                     *p++ = ea_data.sib;
1802
1803                 /* DREX suffixes come between the SIB and the displacement */
1804                 if (ins->rex & REX_D) {
1805                     *p++ =
1806                         (ins->drexdst << 4) |
1807                         (ins->rex & REX_OC ? 0x08 : 0) |
1808                         (ins->rex & (REX_R|REX_X|REX_B));
1809                     ins->rex = 0;
1810                 }
1811
1812                 s = p - bytes;
1813                 out(offset, segment, bytes, OUT_RAWDATA, s, NO_SEG, NO_SEG);
1814
1815                 switch (ea_data.bytes) {
1816                 case 0:
1817                     break;
1818                 case 1:
1819                     if (ins->oprs[(c >> 3) & 7].segment != NO_SEG) {
1820                         data = ins->oprs[(c >> 3) & 7].offset;
1821                         out(offset, segment, &data, OUT_ADDRESS, 1,
1822                             ins->oprs[(c >> 3) & 7].segment,
1823                             ins->oprs[(c >> 3) & 7].wrt);
1824                     } else {
1825                         *bytes = ins->oprs[(c >> 3) & 7].offset;
1826                         out(offset, segment, bytes, OUT_RAWDATA, 1,
1827                             NO_SEG, NO_SEG);
1828                     }
1829                     s++;
1830                     break;
1831                 case 8:
1832                 case 2:
1833                 case 4:
1834                     data = ins->oprs[(c >> 3) & 7].offset;
1835                     warn_overflow(ea_data.bytes, data);
1836                     out(offset, segment, &data,
1837                         ea_data.rip ?  OUT_REL4ADR : OUT_ADDRESS,
1838                         ea_data.bytes,
1839                         ins->oprs[(c >> 3) & 7].segment,
1840                         ins->oprs[(c >> 3) & 7].wrt);
1841                     s += ea_data.bytes;
1842                     break;
1843                 }
1844                 offset += s;
1845             } else {
1846                 errfunc(ERR_PANIC, "internal instruction table corrupt"
1847                         ": instruction code 0x%02X given", c);
1848             }
1849         }
1850     }
1851 }
1852
1853 static int32_t regflag(const operand * o)
1854 {
1855     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1856         errfunc(ERR_PANIC, "invalid operand passed to regflag()");
1857     }
1858     return nasm_reg_flags[o->basereg];
1859 }
1860
1861 static int32_t regval(const operand * o)
1862 {
1863     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1864         errfunc(ERR_PANIC, "invalid operand passed to regval()");
1865     }
1866     return nasm_regvals[o->basereg];
1867 }
1868
1869 static int op_rexflags(const operand * o, int mask)
1870 {
1871     int32_t flags;
1872     int val;
1873
1874     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1875         errfunc(ERR_PANIC, "invalid operand passed to op_rexflags()");
1876     }
1877
1878     flags = nasm_reg_flags[o->basereg];
1879     val = nasm_regvals[o->basereg];
1880
1881     return rexflags(val, flags, mask);
1882 }
1883
1884 static int rexflags(int val, int32_t flags, int mask)
1885 {
1886     int rex = 0;
1887
1888     if (val >= 8)
1889         rex |= REX_B|REX_X|REX_R;
1890     if (flags & BITS64)
1891         rex |= REX_W;
1892     if (!(REG_HIGH & ~flags))   /* AH, CH, DH, BH */
1893         rex |= REX_H;
1894     else if (!(REG8 & ~flags) && val >= 4) /* SPL, BPL, SIL, DIL */
1895         rex |= REX_P;
1896
1897     return rex & mask;
1898 }
1899
1900 static int matches(const struct itemplate *itemp, insn * instruction, int bits)
1901 {
1902     int i, size[MAX_OPERANDS], asize, oprs, ret;
1903
1904     ret = 100;
1905
1906     /*
1907      * Check the opcode
1908      */
1909     if (itemp->opcode != instruction->opcode)
1910         return 0;
1911
1912     /*
1913      * Count the operands
1914      */
1915     if (itemp->operands != instruction->operands)
1916         return 0;
1917
1918     /*
1919      * Check that no spurious colons or TOs are present
1920      */
1921     for (i = 0; i < itemp->operands; i++)
1922         if (instruction->oprs[i].type & ~itemp->opd[i] & (COLON | TO))
1923             return 0;
1924
1925     /*
1926      * Process size flags
1927      */
1928     if (itemp->flags & IF_ARMASK) {
1929         memset(size, 0, sizeof size);
1930
1931         i = ((itemp->flags & IF_ARMASK) >> IF_ARSHFT) - 1;
1932
1933         switch (itemp->flags & IF_SMASK) {
1934         case IF_SB:
1935             size[i] = BITS8;
1936             break;
1937         case IF_SW:
1938             size[i] = BITS16;
1939             break;
1940         case IF_SD:
1941             size[i] = BITS32;
1942             break;
1943         case IF_SQ:
1944             size[i] = BITS64;
1945             break;
1946         case IF_SO:
1947             size[i] = BITS128;
1948             break;
1949         case IF_SY:
1950             size[i] = BITS256;
1951             break;
1952         case IF_SZ:
1953             switch (bits) {
1954             case 16:
1955                 size[i] = BITS16;
1956                 break;
1957             case 32:
1958                 size[i] = BITS32;
1959                 break;
1960             case 64:
1961                 size[i] = BITS64;
1962                 break;
1963             }
1964             break;
1965         default:
1966             break;
1967         }
1968     } else {
1969         asize = 0;
1970         switch (itemp->flags & IF_SMASK) {
1971         case IF_SB:
1972             asize = BITS8;
1973             break;
1974         case IF_SW:
1975             asize = BITS16;
1976             break;
1977         case IF_SD:
1978             asize = BITS32;
1979             break;
1980         case IF_SQ:
1981             asize = BITS64;
1982             break;
1983         case IF_SO:
1984             asize = BITS128;
1985             break;
1986         case IF_SY:
1987             asize = BITS256;
1988             break;
1989         case IF_SZ:
1990             switch (bits) {
1991             case 16:
1992                 asize = BITS16;
1993                 break;
1994             case 32:
1995                 asize = BITS32;
1996                 break;
1997             case 64:
1998                 asize = BITS64;
1999                 break;
2000             }
2001             break;
2002         default:
2003             break;
2004         }
2005         for (i = 0; i < MAX_OPERANDS; i++)
2006             size[i] = asize;
2007     }
2008
2009     /*
2010      * Check that the operand flags all match up
2011      */
2012     for (i = 0; i < itemp->operands; i++) {
2013         int32_t type = instruction->oprs[i].type;
2014         if (!(type & SIZE_MASK))
2015             type |= size[i];
2016
2017         if (itemp->opd[i] & SAME_AS) {
2018             int j = itemp->opd[i] & ~SAME_AS;
2019             if (type != instruction->oprs[j].type ||
2020                 instruction->oprs[i].basereg != instruction->oprs[j].basereg)
2021                 return 0;
2022         } else if (itemp->opd[i] & ~type ||
2023             ((itemp->opd[i] & SIZE_MASK) &&
2024              ((itemp->opd[i] ^ type) & SIZE_MASK))) {
2025             if ((itemp->opd[i] & ~type & ~SIZE_MASK) ||
2026                 (type & SIZE_MASK))
2027                 return 0;
2028             else
2029                 return 1;
2030         }
2031     }
2032
2033     /*
2034      * Check operand sizes
2035      */
2036     if (itemp->flags & (IF_SM | IF_SM2)) {
2037         oprs = (itemp->flags & IF_SM2 ? 2 : itemp->operands);
2038         asize = 0;
2039         for (i = 0; i < oprs; i++) {
2040             if ((asize = itemp->opd[i] & SIZE_MASK) != 0) {
2041                 int j;
2042                 for (j = 0; j < oprs; j++)
2043                     size[j] = asize;
2044                 break;
2045             }
2046         }
2047     } else {
2048         oprs = itemp->operands;
2049     }
2050
2051     for (i = 0; i < itemp->operands; i++) {
2052         if (!(itemp->opd[i] & SIZE_MASK) &&
2053             (instruction->oprs[i].type & SIZE_MASK & ~size[i]))
2054             return 2;
2055     }
2056
2057     /*
2058      * Check template is okay at the set cpu level
2059      */
2060     if (((itemp->flags & IF_PLEVEL) > cpu))
2061         return 3;
2062
2063     /*
2064      * Check if instruction is available in long mode
2065      */
2066     if ((itemp->flags & IF_NOLONG) && (bits == 64))
2067         return 4;
2068
2069     /*
2070      * Check if special handling needed for Jumps
2071      */
2072     if ((uint8_t)(itemp->code[0]) >= 0370)
2073         return 99;
2074
2075     return ret;
2076 }
2077
2078 static ea *process_ea(operand * input, ea * output, int bits,
2079                       int addrbits, int rfield, int32_t rflags)
2080 {
2081     bool forw_ref = !!(input->opflags & OPFLAG_FORWARD);
2082
2083     output->rip = false;
2084
2085     /* REX flags for the rfield operand */
2086     output->rex |= rexflags(rfield, rflags, REX_R|REX_P|REX_W|REX_H);
2087
2088     if (!(REGISTER & ~input->type)) {   /* register direct */
2089         int i;
2090         int32_t f;
2091
2092         if (input->basereg < EXPR_REG_START /* Verify as Register */
2093             || input->basereg >= REG_ENUM_LIMIT)
2094             return NULL;
2095         f = regflag(input);
2096         i = nasm_regvals[input->basereg];
2097
2098         if (REG_EA & ~f)
2099             return NULL;        /* Invalid EA register */
2100
2101         output->rex |= op_rexflags(input, REX_B|REX_P|REX_W|REX_H);
2102
2103         output->sib_present = false;             /* no SIB necessary */
2104         output->bytes = 0;  /* no offset necessary either */
2105         output->modrm = 0xC0 | ((rfield & 7) << 3) | (i & 7);
2106     } else {                    /* it's a memory reference */
2107         if (input->basereg == -1
2108             && (input->indexreg == -1 || input->scale == 0)) {
2109             /* it's a pure offset */
2110             if (bits == 64 && (~input->type & IP_REL)) {
2111               int scale, index, base;
2112               output->sib_present = true;
2113               scale = 0;
2114               index = 4;
2115               base = 5;
2116               output->sib = (scale << 6) | (index << 3) | base;
2117               output->bytes = 4;
2118               output->modrm = 4 | ((rfield & 7) << 3);
2119               output->rip = false;
2120             } else {
2121               output->sib_present = false;
2122               output->bytes = (addrbits != 16 ? 4 : 2);
2123               output->modrm = (addrbits != 16 ? 5 : 6) | ((rfield & 7) << 3);
2124               output->rip = bits == 64;
2125             }
2126         } else {                /* it's an indirection */
2127             int i = input->indexreg, b = input->basereg, s = input->scale;
2128             int32_t o = input->offset, seg = input->segment;
2129             int hb = input->hintbase, ht = input->hinttype;
2130             int t;
2131             int it, bt;
2132             int32_t ix, bx;     /* register flags */
2133
2134             if (s == 0)
2135                 i = -1;         /* make this easy, at least */
2136
2137             if (i >= EXPR_REG_START && i < REG_ENUM_LIMIT) {
2138                 it = nasm_regvals[i];
2139                 ix = nasm_reg_flags[i];
2140             } else {
2141                 it = -1;
2142                 ix = 0;
2143             }
2144
2145             if (b >= EXPR_REG_START && b < REG_ENUM_LIMIT) {
2146                 bt = nasm_regvals[b];
2147                 bx = nasm_reg_flags[b];
2148             } else {
2149                 bt = -1;
2150                 bx = 0;
2151             }
2152
2153             /* check for a 32/64-bit memory reference... */
2154             if ((ix|bx) & (BITS32|BITS64)) {
2155                 /* it must be a 32/64-bit memory reference. Firstly we have
2156                  * to check that all registers involved are type E/Rxx. */
2157                 int32_t sok = BITS32|BITS64;
2158
2159                 if (it != -1) {
2160                     if (!(REG64 & ~ix) || !(REG32 & ~ix))
2161                         sok &= ix;
2162                     else
2163                         return NULL;
2164                 }
2165
2166                 if (bt != -1) {
2167                     if (REG_GPR & ~bx)
2168                         return NULL; /* Invalid register */
2169                     if (~sok & bx & SIZE_MASK)
2170                         return NULL; /* Invalid size */
2171                     sok &= bx;
2172                 }
2173
2174                 /* While we're here, ensure the user didn't specify
2175                    WORD or QWORD. */
2176                 if (input->disp_size == 16 || input->disp_size == 64)
2177                     return NULL;
2178
2179                 if (addrbits == 16 ||
2180                     (addrbits == 32 && !(sok & BITS32)) ||
2181                     (addrbits == 64 && !(sok & BITS64)))
2182                     return NULL;
2183
2184                 /* now reorganize base/index */
2185                 if (s == 1 && bt != it && bt != -1 && it != -1 &&
2186                     ((hb == b && ht == EAH_NOTBASE)
2187                      || (hb == i && ht == EAH_MAKEBASE))) {
2188                     /* swap if hints say so */
2189                     t = bt, bt = it, it = t;
2190                     t = bx, bx = ix, ix = t;
2191                 }
2192                 if (bt == it)     /* convert EAX+2*EAX to 3*EAX */
2193                     bt = -1, bx = 0, s++;
2194                 if (bt == -1 && s == 1 && !(hb == it && ht == EAH_NOTBASE)) {
2195                     /* make single reg base, unless hint */
2196                     bt = it, bx = ix, it = -1, ix = 0;
2197                 }
2198                 if (((s == 2 && it != REG_NUM_ESP
2199                       && !(input->eaflags & EAF_TIMESTWO)) || s == 3
2200                      || s == 5 || s == 9) && bt == -1)
2201                     bt = it, bx = ix, s--; /* convert 3*EAX to EAX+2*EAX */
2202                 if (it == -1 && (bt & 7) != REG_NUM_ESP
2203                     && (input->eaflags & EAF_TIMESTWO))
2204                     it = bt, ix = bx, bt = -1, bx = 0, s = 1;
2205                 /* convert [NOSPLIT EAX] to sib format with 0x0 displacement */
2206                 if (s == 1 && it == REG_NUM_ESP) {
2207                     /* swap ESP into base if scale is 1 */
2208                     t = it, it = bt, bt = t;
2209                     t = ix, ix = bx, bx = t;
2210                 }
2211                 if (it == REG_NUM_ESP
2212                     || (s != 1 && s != 2 && s != 4 && s != 8 && it != -1))
2213                     return NULL;        /* wrong, for various reasons */
2214
2215                 output->rex |= rexflags(it, ix, REX_X);
2216                 output->rex |= rexflags(bt, bx, REX_B);
2217
2218                 if (it == -1 && (bt & 7) != REG_NUM_ESP) {
2219                     /* no SIB needed */
2220                     int mod, rm;
2221
2222                     if (bt == -1) {
2223                         rm = 5;
2224                         mod = 0;
2225                     } else {
2226                         rm = (bt & 7);
2227                         if (rm != REG_NUM_EBP && o == 0 &&
2228                                 seg == NO_SEG && !forw_ref &&
2229                                 !(input->eaflags &
2230                                   (EAF_BYTEOFFS | EAF_WORDOFFS)))
2231                             mod = 0;
2232                         else if (input->eaflags & EAF_BYTEOFFS ||
2233                                  (o >= -128 && o <= 127 && seg == NO_SEG
2234                                   && !forw_ref
2235                                   && !(input->eaflags & EAF_WORDOFFS)))
2236                             mod = 1;
2237                         else
2238                             mod = 2;
2239                     }
2240
2241                     output->sib_present = false;
2242                     output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2243                     output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2244                 } else {
2245                     /* we need a SIB */
2246                     int mod, scale, index, base;
2247
2248                     if (it == -1)
2249                         index = 4, s = 1;
2250                     else
2251                         index = (it & 7);
2252
2253                     switch (s) {
2254                     case 1:
2255                         scale = 0;
2256                         break;
2257                     case 2:
2258                         scale = 1;
2259                         break;
2260                     case 4:
2261                         scale = 2;
2262                         break;
2263                     case 8:
2264                         scale = 3;
2265                         break;
2266                     default:   /* then what the smeg is it? */
2267                         return NULL;    /* panic */
2268                     }
2269
2270                     if (bt == -1) {
2271                         base = 5;
2272                         mod = 0;
2273                     } else {
2274                         base = (bt & 7);
2275                         if (base != REG_NUM_EBP && o == 0 &&
2276                                     seg == NO_SEG && !forw_ref &&
2277                                     !(input->eaflags &
2278                                       (EAF_BYTEOFFS | EAF_WORDOFFS)))
2279                             mod = 0;
2280                         else if (input->eaflags & EAF_BYTEOFFS ||
2281                                  (o >= -128 && o <= 127 && seg == NO_SEG
2282                                   && !forw_ref
2283                                   && !(input->eaflags & EAF_WORDOFFS)))
2284                             mod = 1;
2285                         else
2286                             mod = 2;
2287                     }
2288
2289                     output->sib_present = true;
2290                     output->bytes =  (bt == -1 || mod == 2 ? 4 : mod);
2291                     output->modrm = (mod << 6) | ((rfield & 7) << 3) | 4;
2292                     output->sib = (scale << 6) | (index << 3) | base;
2293                 }
2294             } else {            /* it's 16-bit */
2295                 int mod, rm;
2296
2297                 /* check for 64-bit long mode */
2298                 if (addrbits == 64)
2299                     return NULL;
2300
2301                 /* check all registers are BX, BP, SI or DI */
2302                 if ((b != -1 && b != R_BP && b != R_BX && b != R_SI
2303                      && b != R_DI) || (i != -1 && i != R_BP && i != R_BX
2304                                        && i != R_SI && i != R_DI))
2305                     return NULL;
2306
2307                 /* ensure the user didn't specify DWORD/QWORD */
2308                 if (input->disp_size == 32 || input->disp_size == 64)
2309                     return NULL;
2310
2311                 if (s != 1 && i != -1)
2312                     return NULL;        /* no can do, in 16-bit EA */
2313                 if (b == -1 && i != -1) {
2314                     int tmp = b;
2315                     b = i;
2316                     i = tmp;
2317                 }               /* swap */
2318                 if ((b == R_SI || b == R_DI) && i != -1) {
2319                     int tmp = b;
2320                     b = i;
2321                     i = tmp;
2322                 }
2323                 /* have BX/BP as base, SI/DI index */
2324                 if (b == i)
2325                     return NULL;        /* shouldn't ever happen, in theory */
2326                 if (i != -1 && b != -1 &&
2327                     (i == R_BP || i == R_BX || b == R_SI || b == R_DI))
2328                     return NULL;        /* invalid combinations */
2329                 if (b == -1)    /* pure offset: handled above */
2330                     return NULL;        /* so if it gets to here, panic! */
2331
2332                 rm = -1;
2333                 if (i != -1)
2334                     switch (i * 256 + b) {
2335                     case R_SI * 256 + R_BX:
2336                         rm = 0;
2337                         break;
2338                     case R_DI * 256 + R_BX:
2339                         rm = 1;
2340                         break;
2341                     case R_SI * 256 + R_BP:
2342                         rm = 2;
2343                         break;
2344                     case R_DI * 256 + R_BP:
2345                         rm = 3;
2346                         break;
2347                 } else
2348                     switch (b) {
2349                     case R_SI:
2350                         rm = 4;
2351                         break;
2352                     case R_DI:
2353                         rm = 5;
2354                         break;
2355                     case R_BP:
2356                         rm = 6;
2357                         break;
2358                     case R_BX:
2359                         rm = 7;
2360                         break;
2361                     }
2362                 if (rm == -1)   /* can't happen, in theory */
2363                     return NULL;        /* so panic if it does */
2364
2365                 if (o == 0 && seg == NO_SEG && !forw_ref && rm != 6 &&
2366                     !(input->eaflags & (EAF_BYTEOFFS | EAF_WORDOFFS)))
2367                     mod = 0;
2368                 else if (input->eaflags & EAF_BYTEOFFS ||
2369                          (o >= -128 && o <= 127 && seg == NO_SEG
2370                           && !forw_ref
2371                           && !(input->eaflags & EAF_WORDOFFS)))
2372                     mod = 1;
2373                 else
2374                     mod = 2;
2375
2376                 output->sib_present = false;    /* no SIB - it's 16-bit */
2377                 output->bytes = mod;    /* bytes of offset needed */
2378                 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2379             }
2380         }
2381     }
2382
2383     output->size = 1 + output->sib_present + output->bytes;
2384     return output;
2385 }
2386
2387 static void add_asp(insn *ins, int addrbits)
2388 {
2389     int j, valid;
2390     int defdisp;
2391
2392     valid = (addrbits == 64) ? 64|32 : 32|16;
2393
2394     switch (ins->prefixes[PPS_ASIZE]) {
2395     case P_A16:
2396         valid &= 16;
2397         break;
2398     case P_A32:
2399         valid &= 32;
2400         break;
2401     case P_A64:
2402         valid &= 64;
2403         break;
2404     case P_ASP:
2405         valid &= (addrbits == 32) ? 16 : 32;
2406         break;
2407     default:
2408         break;
2409     }
2410
2411     for (j = 0; j < ins->operands; j++) {
2412         if (!(MEMORY & ~ins->oprs[j].type)) {
2413             int32_t i, b;
2414
2415             /* Verify as Register */
2416             if (ins->oprs[j].indexreg < EXPR_REG_START
2417                 || ins->oprs[j].indexreg >= REG_ENUM_LIMIT)
2418                 i = 0;
2419             else
2420                 i = nasm_reg_flags[ins->oprs[j].indexreg];
2421
2422             /* Verify as Register */
2423             if (ins->oprs[j].basereg < EXPR_REG_START
2424                 || ins->oprs[j].basereg >= REG_ENUM_LIMIT)
2425                 b = 0;
2426             else
2427                 b = nasm_reg_flags[ins->oprs[j].basereg];
2428
2429             if (ins->oprs[j].scale == 0)
2430                 i = 0;
2431
2432             if (!i && !b) {
2433                 int ds = ins->oprs[j].disp_size;
2434                 if ((addrbits != 64 && ds > 8) ||
2435                     (addrbits == 64 && ds == 16))
2436                     valid &= ds;
2437             } else {
2438                 if (!(REG16 & ~b))
2439                     valid &= 16;
2440                 if (!(REG32 & ~b))
2441                     valid &= 32;
2442                 if (!(REG64 & ~b))
2443                     valid &= 64;
2444
2445                 if (!(REG16 & ~i))
2446                     valid &= 16;
2447                 if (!(REG32 & ~i))
2448                     valid &= 32;
2449                 if (!(REG64 & ~i))
2450                     valid &= 64;
2451             }
2452         }
2453     }
2454
2455     if (valid & addrbits) {
2456         ins->addr_size = addrbits;
2457     } else if (valid & ((addrbits == 32) ? 16 : 32)) {
2458         /* Add an address size prefix */
2459         enum prefixes pref = (addrbits == 32) ? P_A16 : P_A32;
2460         ins->prefixes[PPS_ASIZE] = pref;
2461         ins->addr_size = (addrbits == 32) ? 16 : 32;
2462     } else {
2463         /* Impossible... */
2464         errfunc(ERR_NONFATAL, "impossible combination of address sizes");
2465         ins->addr_size = addrbits; /* Error recovery */
2466     }
2467
2468     defdisp = ins->addr_size == 16 ? 16 : 32;
2469
2470     for (j = 0; j < ins->operands; j++) {
2471         if (!(MEM_OFFS & ~ins->oprs[j].type) &&
2472             (ins->oprs[j].disp_size ? ins->oprs[j].disp_size : defdisp)
2473             != ins->addr_size) {
2474             /* mem_offs sizes must match the address size; if not,
2475                strip the MEM_OFFS bit and match only EA instructions */
2476             ins->oprs[j].type &= ~(MEM_OFFS & ~MEMORY);
2477         }
2478     }
2479 }