1 /* assemble.c code generation for the Netwide Assembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the license given in the file "LICENSE"
6 * distributed in the NASM archive.
8 * the actual codes (C syntax, i.e. octal):
9 * \0 - terminates the code. (Unless it's a literal of course.)
10 * \1, \2, \3 - that many literal bytes follow in the code stream
11 * \4, \6 - the POP/PUSH (respectively) codes for CS, DS, ES, SS
12 * (POP is never used for CS) depending on operand 0
13 * \5, \7 - the second byte of POP/PUSH codes for FS, GS, depending
15 * \10..\13 - a literal byte follows in the code stream, to be added
16 * to the register value of operand 0..3
17 * \14..\17 - a signed byte immediate operand, from operand 0..3
18 * \20..\23 - a byte immediate operand, from operand 0..3
19 * \24..\27 - an unsigned byte immediate operand, from operand 0..3
20 * \30..\33 - a word immediate operand, from operand 0..3
21 * \34..\37 - select between \3[0-3] and \4[0-3] depending on 16/32 bit
22 * assembly mode or the operand-size override on the operand
23 * \40..\43 - a long immediate operand, from operand 0..3
24 * \44..\47 - select between \3[0-3], \4[0-3] and \5[4-7]
25 * depending on the address size of the instruction.
26 * \50..\53 - a byte relative operand, from operand 0..3
27 * \54..\57 - a qword immediate operand, from operand 0..3
28 * \60..\63 - a word relative operand, from operand 0..3
29 * \64..\67 - select between \6[0-3] and \7[0-3] depending on 16/32 bit
30 * assembly mode or the operand-size override on the operand
31 * \70..\73 - a long relative operand, from operand 0..3
32 * \74..\77 - a word constant, from the _segment_ part of operand 0..3
33 * \1ab - a ModRM, calculated on EA in operand a, with the spare
34 * field the register value of operand b.
35 * \140..\143 - an immediate word or signed byte for operand 0..3
36 * \144..\147 - or 2 (s-field) into opcode byte if operand 0..3
37 * is a signed byte rather than a word. Opcode byte follows.
38 * \150..\153 - an immediate dword or signed byte for operand 0..3
39 * \154..\157 - or 2 (s-field) into opcode byte if operand 0..3
40 * is a signed byte rather than a word. Opcode byte follows.
41 * \160..\163 - this instruction uses DREX rather than REX, with the
42 * OC0 field set to 0, and the dest field taken from
44 * \164..\167 - this instruction uses DREX rather than REX, with the
45 * OC0 field set to 1, and the dest field taken from
47 * \170 - encodes the literal byte 0. (Some compilers don't take
48 * kindly to a zero byte in the _middle_ of a compile time
49 * string constant, so I had to put this hack in.)
50 * \171 - placement of DREX suffix in the absence of an EA
51 * \2ab - a ModRM, calculated on EA in operand a, with the spare
52 * field equal to digit b.
53 * \310 - indicates fixed 16-bit address size, i.e. optional 0x67.
54 * \311 - indicates fixed 32-bit address size, i.e. optional 0x67.
55 * \312 - (disassembler only) marker on LOOP, LOOPxx instructions.
56 * \313 - indicates fixed 64-bit address size, 0x67 invalid.
57 * \314 - (disassembler only) invalid with REX.B
58 * \315 - (disassembler only) invalid with REX.X
59 * \316 - (disassembler only) invalid with REX.R
60 * \317 - (disassembler only) invalid with REX.W
61 * \320 - indicates fixed 16-bit operand size, i.e. optional 0x66.
62 * \321 - indicates fixed 32-bit operand size, i.e. optional 0x66.
63 * \322 - indicates that this instruction is only valid when the
64 * operand size is the default (instruction to disassembler,
65 * generates no code in the assembler)
66 * \323 - indicates fixed 64-bit operand size, REX on extensions only.
67 * \324 - indicates 64-bit operand size requiring REX prefix.
68 * \330 - a literal byte follows in the code stream, to be added
69 * to the condition code value of the instruction.
70 * \331 - instruction not valid with REP prefix. Hint for
71 * disassembler only; for SSE instructions.
72 * \332 - REP prefix (0xF2 byte) used as opcode extension.
73 * \333 - REP prefix (0xF3 byte) used as opcode extension.
74 * \334 - LOCK prefix used instead of REX.R
75 * \335 - disassemble a rep (0xF3 byte) prefix as repe not rep.
76 * \340 - reserve <operand 0> bytes of uninitialized storage.
77 * Operand 0 had better be a segmentless constant.
78 * \364 - operand-size prefix (0x66) not permitted
79 * \365 - address-size prefix (0x67) not permitted
80 * \366 - operand-size prefix (0x66) used as opcode extension
81 * \367 - address-size prefix (0x67) used as opcode extension
82 * \370,\371,\372 - match only if operand 0 meets byte jump criteria.
83 * 370 is used for Jcc, 371 is used for JMP.
84 * \373 - assemble 0x03 if bits==16, 0x05 if bits==32;
85 * used for conditional jump over longer jump
103 int sib_present; /* is a SIB byte necessary? */
104 int bytes; /* # of bytes of offset needed */
105 int size; /* lazy - this is sib+bytes+1 */
106 uint8_t modrm, sib, rex, rip; /* the bytes themselves */
109 static uint32_t cpu; /* cpu level received from nasm.c */
110 static efunc errfunc;
111 static struct ofmt *outfmt;
112 static ListGen *list;
114 static int64_t calcsize(int32_t, int64_t, int, insn *, const char *);
115 static void gencode(int32_t, int64_t, int, insn *, const char *, int64_t);
116 static int matches(const struct itemplate *, insn *, int bits);
117 static int32_t regflag(const operand *);
118 static int32_t regval(const operand *);
119 static int rexflags(int, int32_t, int);
120 static int op_rexflags(const operand *, int);
121 static ea *process_ea(operand *, ea *, int, int, int, int32_t, int);
122 static void add_asp(insn *, int);
124 static int has_prefix(insn * ins, enum prefix_pos pos, enum prefixes prefix)
126 return ins->prefixes[pos] == prefix;
129 static void assert_no_prefix(insn * ins, enum prefix_pos pos)
131 if (ins->prefixes[pos])
132 errfunc(ERR_NONFATAL, "invalid %s prefix",
133 prefix_name(ins->prefixes[pos]));
136 static const char *size_name(int size)
156 static void warn_overflow(int size, int64_t data)
159 int64_t lim = ((int64_t)1 << (size*8))-1;
161 if (data < ~lim || data > lim)
162 errfunc(ERR_WARNING | ERR_WARN_NOV, "%s data exceeds bounds", size_name(size));
166 * This routine wrappers the real output format's output routine,
167 * in order to pass a copy of the data off to the listing file
168 * generator at the same time.
170 static void out(int64_t offset, int32_t segto, const void *data,
171 enum out_type type, uint64_t size,
172 int32_t segment, int32_t wrt)
174 static int32_t lineno = 0; /* static!!! */
175 static char *lnfname = NULL;
178 if (type == OUT_ADDRESS && segment == NO_SEG && wrt == NO_SEG) {
180 * This is a non-relocated address, and we're going to
181 * convert it into RAWDATA format.
186 errfunc(ERR_PANIC, "OUT_ADDRESS with size > 8");
190 WRITEADDR(q, *(int64_t *)data, size);
195 list->output(offset, data, type, size);
198 * this call to src_get determines when we call the
199 * debug-format-specific "linenum" function
200 * it updates lineno and lnfname to the current values
201 * returning 0 if "same as last time", -2 if lnfname
202 * changed, and the amount by which lineno changed,
203 * if it did. thus, these variables must be static
206 if (src_get(&lineno, &lnfname)) {
207 outfmt->current_dfmt->linenum(lnfname, lineno, segto);
210 outfmt->output(segto, data, type, size, segment, wrt);
213 static int jmp_match(int32_t segment, int64_t offset, int bits,
214 insn * ins, const char *code)
219 if (c != 0370 && c != 0371)
221 if (ins->oprs[0].opflags & OPFLAG_FORWARD) {
222 if ((optimizing < 0 || (ins->oprs[0].type & STRICT))
226 return (pass0 == 0); /* match a forward reference */
228 isize = calcsize(segment, offset, bits, ins, code);
229 if (ins->oprs[0].segment != segment)
231 isize = ins->oprs[0].offset - offset - isize; /* isize is now the delta */
232 if (isize >= -128L && isize <= 127L)
233 return 1; /* it is byte size */
238 int64_t assemble(int32_t segment, int64_t offset, int bits, uint32_t cp,
239 insn * instruction, struct ofmt *output, efunc error,
242 const struct itemplate *temp;
247 int64_t start = offset;
248 int64_t wsize = 0; /* size for DB etc. */
250 errfunc = error; /* to pass to other functions */
252 outfmt = output; /* likewise */
253 list = listgen; /* and again */
255 switch (instruction->opcode) {
282 int32_t t = instruction->times;
285 "instruction->times < 0 (%ld) in assemble()", t);
287 while (t--) { /* repeat TIMES times */
288 for (e = instruction->eops; e; e = e->next) {
289 if (e->type == EOT_DB_NUMBER) {
291 if (e->segment != NO_SEG)
292 errfunc(ERR_NONFATAL,
293 "one-byte relocation attempted");
295 uint8_t out_byte = e->offset;
296 out(offset, segment, &out_byte,
297 OUT_RAWDATA, 1, NO_SEG, NO_SEG);
299 } else if (wsize > 8) {
300 errfunc(ERR_NONFATAL, "integer supplied to a DT or DO"
303 out(offset, segment, &e->offset,
304 OUT_ADDRESS, wsize, e->segment, e->wrt);
306 } else if (e->type == EOT_DB_STRING) {
309 out(offset, segment, e->stringval,
310 OUT_RAWDATA, e->stringlen, NO_SEG, NO_SEG);
311 align = e->stringlen % wsize;
314 align = wsize - align;
316 "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0",
317 OUT_RAWDATA, align, NO_SEG, NO_SEG);
319 offset += e->stringlen + align;
322 if (t > 0 && t == instruction->times - 1) {
324 * Dummy call to list->output to give the offset to the
327 list->output(offset, NULL, OUT_RAWDATA, 0);
328 list->uplevel(LIST_TIMES);
331 if (instruction->times > 1)
332 list->downlevel(LIST_TIMES);
333 return offset - start;
336 if (instruction->opcode == I_INCBIN) {
337 static char fname[FILENAME_MAX];
340 char *prefix = "", *combine;
341 char **pPrevPath = NULL;
343 len = FILENAME_MAX - 1;
344 if (len > instruction->eops->stringlen)
345 len = instruction->eops->stringlen;
346 strncpy(fname, instruction->eops->stringval, len);
349 while (1) { /* added by alexfru: 'incbin' uses include paths */
350 combine = nasm_malloc(strlen(prefix) + len + 1);
351 strcpy(combine, prefix);
352 strcat(combine, fname);
354 if ((fp = fopen(combine, "rb")) != NULL) {
360 pPrevPath = pp_get_include_path_ptr(pPrevPath);
361 if (pPrevPath == NULL)
367 error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
369 else if (fseek(fp, 0L, SEEK_END) < 0)
370 error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
373 static char buf[2048];
374 int32_t t = instruction->times;
378 if (instruction->eops->next) {
379 base = instruction->eops->next->offset;
381 if (instruction->eops->next->next &&
382 len > instruction->eops->next->next->offset)
383 len = instruction->eops->next->next->offset;
386 * Dummy call to list->output to give the offset to the
389 list->output(offset, NULL, OUT_RAWDATA, 0);
390 list->uplevel(LIST_INCBIN);
394 fseek(fp, base, SEEK_SET);
398 fread(buf, 1, (l > (int32_t) sizeof(buf) ? (int32_t) sizeof(buf) : l),
402 * This shouldn't happen unless the file
403 * actually changes while we are reading
407 "`incbin': unexpected EOF while"
408 " reading file `%s'", fname);
409 t = 0; /* Try to exit cleanly */
412 out(offset, segment, buf, OUT_RAWDATA, m,
417 list->downlevel(LIST_INCBIN);
418 if (instruction->times > 1) {
420 * Dummy call to list->output to give the offset to the
423 list->output(offset, NULL, OUT_RAWDATA, 0);
424 list->uplevel(LIST_TIMES);
425 list->downlevel(LIST_TIMES);
428 return instruction->times * len;
430 return 0; /* if we're here, there's an error */
433 /* Check to see if we need an address-size prefix */
434 add_asp(instruction, bits);
438 for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++){
439 int m = matches(temp, instruction, bits);
442 m += jmp_match(segment, offset, bits, instruction, temp->code);
444 if (m == 100) { /* matches! */
445 const char *codes = temp->code;
446 int64_t insn_size = calcsize(segment, offset, bits,
448 itimes = instruction->times;
449 if (insn_size < 0) /* shouldn't be, on pass two */
450 error(ERR_PANIC, "errors made it through from pass one");
453 for (j = 0; j < MAXPREFIX; j++) {
455 switch (instruction->prefixes[j]) {
471 "cs segment base generated, but will be ignored in 64-bit mode");
478 "ds segment base generated, but will be ignored in 64-bit mode");
485 "es segment base generated, but will be ignored in 64-bit mode");
498 "ss segment base generated, but will be ignored in 64-bit mode");
505 "segr6 and segr7 cannot be used as prefixes");
510 "16-bit addressing is not supported "
512 } else if (bits != 16)
522 "64-bit addressing is only supported "
546 error(ERR_PANIC, "invalid instruction prefix");
549 out(offset, segment, &c, OUT_RAWDATA, 1,
554 insn_end = offset + insn_size;
555 gencode(segment, offset, bits, instruction, codes,
558 if (itimes > 0 && itimes == instruction->times - 1) {
560 * Dummy call to list->output to give the offset to the
563 list->output(offset, NULL, OUT_RAWDATA, 0);
564 list->uplevel(LIST_TIMES);
567 if (instruction->times > 1)
568 list->downlevel(LIST_TIMES);
569 return offset - start;
570 } else if (m > 0 && m > size_prob) {
576 if (temp->opcode == -1) { /* didn't match any instruction */
579 error(ERR_NONFATAL, "operation size not specified");
582 error(ERR_NONFATAL, "mismatch in operand sizes");
585 error(ERR_NONFATAL, "no instruction for this cpu level");
588 error(ERR_NONFATAL, "instruction not supported in 64-bit mode");
592 "invalid combination of opcode and operands");
599 int64_t insn_size(int32_t segment, int64_t offset, int bits, uint32_t cp,
600 insn * instruction, efunc error)
602 const struct itemplate *temp;
604 errfunc = error; /* to pass to other functions */
607 if (instruction->opcode == -1)
610 if (instruction->opcode == I_DB || instruction->opcode == I_DW ||
611 instruction->opcode == I_DD || instruction->opcode == I_DQ ||
612 instruction->opcode == I_DT || instruction->opcode == I_DO) {
614 int32_t isize, osize, wsize = 0; /* placate gcc */
617 switch (instruction->opcode) {
640 for (e = instruction->eops; e; e = e->next) {
644 if (e->type == EOT_DB_NUMBER)
646 else if (e->type == EOT_DB_STRING)
647 osize = e->stringlen;
649 align = (-osize) % wsize;
652 isize += osize + align;
654 return isize * instruction->times;
657 if (instruction->opcode == I_INCBIN) {
658 char fname[FILENAME_MAX];
661 char *prefix = "", *combine;
662 char **pPrevPath = NULL;
664 len = FILENAME_MAX - 1;
665 if (len > instruction->eops->stringlen)
666 len = instruction->eops->stringlen;
667 strncpy(fname, instruction->eops->stringval, len);
670 /* added by alexfru: 'incbin' uses include paths */
672 combine = nasm_malloc(strlen(prefix) + len + 1);
673 strcpy(combine, prefix);
674 strcat(combine, fname);
676 if ((fp = fopen(combine, "rb")) != NULL) {
682 pPrevPath = pp_get_include_path_ptr(pPrevPath);
683 if (pPrevPath == NULL)
689 error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
691 else if (fseek(fp, 0L, SEEK_END) < 0)
692 error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
697 if (instruction->eops->next) {
698 len -= instruction->eops->next->offset;
699 if (instruction->eops->next->next &&
700 len > instruction->eops->next->next->offset) {
701 len = instruction->eops->next->next->offset;
704 return instruction->times * len;
706 return 0; /* if we're here, there's an error */
709 /* Check to see if we need an address-size prefix */
710 add_asp(instruction, bits);
712 for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++) {
713 int m = matches(temp, instruction, bits);
715 m += jmp_match(segment, offset, bits, instruction, temp->code);
718 /* we've matched an instruction. */
720 const char *codes = temp->code;
723 isize = calcsize(segment, offset, bits, instruction, codes);
726 for (j = 0; j < MAXPREFIX; j++) {
727 switch (instruction->prefixes[j]) {
753 return isize * instruction->times;
756 return -1; /* didn't match any instruction */
759 /* check that opn[op] is a signed byte of size 16 or 32,
760 and return the signed value*/
761 static int is_sbyte(insn * ins, int op, int size)
766 ret = !(ins->forw_ref && ins->oprs[op].opflags) && /* dead in the water on forward reference or External */
768 !(ins->oprs[op].type & STRICT) &&
769 ins->oprs[op].wrt == NO_SEG && ins->oprs[op].segment == NO_SEG;
771 v = ins->oprs[op].offset;
773 v = (int16_t)v; /* sign extend if 16 bits */
775 return ret && v >= -128L && v <= 127L;
778 static int64_t calcsize(int32_t segment, int64_t offset, int bits,
779 insn * ins, const char *codes)
786 ins->rex = 0; /* Ensure REX is reset */
788 if (ins->prefixes[PPS_OSIZE] == P_O64)
791 (void)segment; /* Don't warn that this parameter is unused */
792 (void)offset; /* Don't warn that this parameter is unused */
796 opx = &ins->oprs[c & 3];
801 codes += c, length += c;
814 op_rexflags(opx, REX_B|REX_H|REX_P|REX_W);
845 if (opx->type & (BITS16 | BITS32 | BITS64))
846 length += (opx->type & BITS16) ? 2 : 4;
848 length += (bits == 16) ? 2 : 4;
860 length += ins->addr_size >> 3;
872 length += 8; /* MOV reg64/imm */
884 if (opx->type & (BITS16 | BITS32 | BITS64))
885 length += (opx->type & BITS16) ? 2 : 4;
887 length += (bits == 16) ? 2 : 4;
905 length += is_sbyte(ins, c & 3, 16) ? 1 : 2;
918 length += is_sbyte(ins, c & 3, 32) ? 1 : 4;
933 ins->drexdst = regval(&ins->oprs[c & 3]);
940 ins->rex |= REX_D|REX_OC;
941 ins->drexdst = regval(&ins->oprs[c & 3]);
956 length += (bits != 16) && !has_prefix(ins, PPS_ASIZE, P_A16);
959 length += (bits != 32) && !has_prefix(ins, PPS_ASIZE, P_A32);
964 if (bits != 64 || has_prefix(ins, PPS_ASIZE, P_A16) ||
965 has_prefix(ins, PPS_ASIZE, P_A32))
974 length += (bits != 16);
977 length += (bits == 16);
1002 if (ins->oprs[0].segment != NO_SEG)
1003 errfunc(ERR_NONFATAL, "attempt to reserve non-constant"
1004 " quantity of BSS space");
1006 length += ins->oprs[0].offset;
1022 default: /* can't do it by 'case' statements */
1023 if (c >= 0100 && c <= 0277) { /* it's an EA */
1027 ea_data.rex = 0; /* Ensure ea.REX is initially 0 */
1030 /* pick rfield from operand b */
1031 rflags = regflag(&ins->oprs[c & 7]);
1032 rfield = regvals[ins->oprs[c & 7].basereg];
1039 (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1040 ins->addr_size, rfield, rflags, ins->forw_ref)) {
1041 errfunc(ERR_NONFATAL, "invalid effective address");
1044 ins->rex |= ea_data.rex;
1045 length += ea_data.size;
1048 errfunc(ERR_PANIC, "internal instruction table corrupt"
1049 ": instruction code 0x%02X given", c);
1054 ins->rex &= rex_mask;
1056 if (ins->rex & REX_D) {
1057 if (ins->rex & REX_H) {
1058 errfunc(ERR_NONFATAL, "cannot use high register in drex instruction");
1061 if (bits != 64 && ((ins->rex & (REX_W|REX_X|REX_B)) ||
1062 ins->drexdst > 7)) {
1063 errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1067 } else if (ins->rex & REX_REAL) {
1068 if (ins->rex & REX_H) {
1069 errfunc(ERR_NONFATAL, "cannot use high register in rex instruction");
1071 } else if (bits == 64) {
1073 } else if ((ins->rex & REX_L) &&
1074 !(ins->rex & (REX_P|REX_W|REX_X|REX_B)) &&
1077 assert_no_prefix(ins, PPS_LREP);
1080 errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1088 #define EMIT_REX() \
1089 if (!(ins->rex & REX_D) && (ins->rex & REX_REAL) && (bits == 64)) { \
1090 ins->rex = (ins->rex & REX_REAL)|REX_P; \
1091 out(offset, segment, &ins->rex, OUT_RAWDATA, 1, NO_SEG, NO_SEG); \
1096 static void gencode(int32_t segment, int64_t offset, int bits,
1097 insn * ins, const char *codes, int64_t insn_end)
1099 static char condval[] = { /* conditional opcodes */
1100 0x7, 0x3, 0x2, 0x6, 0x2, 0x4, 0xF, 0xD, 0xC, 0xE, 0x6, 0x2,
1101 0x3, 0x7, 0x3, 0x5, 0xE, 0xC, 0xD, 0xF, 0x1, 0xB, 0x9, 0x5,
1102 0x0, 0xA, 0xA, 0xB, 0x8, 0x4
1108 struct operand *opx;
1112 opx = &ins->oprs[c & 3];
1118 out(offset, segment, codes, OUT_RAWDATA, c, NO_SEG, NO_SEG);
1125 switch (ins->oprs[0].basereg) {
1127 bytes[0] = 0x0E + (c == 0x04 ? 1 : 0);
1130 bytes[0] = 0x1E + (c == 0x04 ? 1 : 0);
1133 bytes[0] = 0x06 + (c == 0x04 ? 1 : 0);
1136 bytes[0] = 0x16 + (c == 0x04 ? 1 : 0);
1140 "bizarre 8086 segment register received");
1142 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1148 switch (ins->oprs[0].basereg) {
1150 bytes[0] = 0xA0 + (c == 0x05 ? 1 : 0);
1153 bytes[0] = 0xA8 + (c == 0x05 ? 1 : 0);
1157 "bizarre 386 segment register received");
1159 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1168 bytes[0] = *codes++ + ((regval(opx)) & 7);
1169 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1177 if (opx->offset < -128 || opx->offset > 127) {
1178 errfunc(ERR_WARNING | ERR_WARN_NOV,
1179 "signed byte value exceeds bounds");
1182 if (opx->segment != NO_SEG) {
1184 out(offset, segment, &data, OUT_ADDRESS, 1,
1185 opx->segment, opx->wrt);
1187 bytes[0] = opx->offset;
1188 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1198 if (opx->offset < -256 || opx->offset > 255) {
1199 errfunc(ERR_WARNING | ERR_WARN_NOV,
1200 "byte value exceeds bounds");
1202 if (opx->segment != NO_SEG) {
1204 out(offset, segment, &data, OUT_ADDRESS, 1,
1205 opx->segment, opx->wrt);
1207 bytes[0] = opx->offset;
1208 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1218 if (opx->offset < 0 || opx->offset > 255)
1219 errfunc(ERR_WARNING | ERR_WARN_NOV,
1220 "unsigned byte value exceeds bounds");
1221 if (opx->segment != NO_SEG) {
1223 out(offset, segment, &data, OUT_ADDRESS, 1,
1224 opx->segment, opx->wrt);
1226 bytes[0] = opx->offset;
1227 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1238 if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1239 warn_overflow(2, data);
1240 out(offset, segment, &data, OUT_ADDRESS, 2,
1241 opx->segment, opx->wrt);
1249 if (opx->type & (BITS16 | BITS32))
1250 size = (opx->type & BITS16) ? 2 : 4;
1252 size = (bits == 16) ? 2 : 4;
1254 if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1255 warn_overflow(size, data);
1256 out(offset, segment, &data, OUT_ADDRESS, size,
1257 opx->segment, opx->wrt);
1266 if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1267 warn_overflow(4, data);
1268 out(offset, segment, &data, OUT_ADDRESS, 4,
1269 opx->segment, opx->wrt);
1278 size = ins->addr_size >> 3;
1279 if (opx->segment == NO_SEG &&
1281 warn_overflow(size, data);
1282 out(offset, segment, &data, OUT_ADDRESS, size,
1283 opx->segment, opx->wrt);
1291 if (opx->segment != segment)
1292 errfunc(ERR_NONFATAL,
1293 "short relative jump outside segment");
1294 data = opx->offset - insn_end;
1295 if (data > 127 || data < -128)
1296 errfunc(ERR_NONFATAL, "short jump is out of range");
1298 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1306 data = (int64_t)opx->offset;
1307 out(offset, segment, &data, OUT_ADDRESS, 8,
1308 opx->segment, opx->wrt);
1316 if (opx->segment != segment) {
1318 out(offset, segment, &data,
1319 OUT_REL2ADR, insn_end - offset,
1320 opx->segment, opx->wrt);
1322 data = opx->offset - insn_end;
1323 out(offset, segment, &data,
1324 OUT_ADDRESS, 2, NO_SEG, NO_SEG);
1333 if (opx->type & (BITS16 | BITS32 | BITS64))
1334 size = (opx->type & BITS16) ? 2 : 4;
1336 size = (bits == 16) ? 2 : 4;
1337 if (opx->segment != segment) {
1339 out(offset, segment, &data,
1340 size == 2 ? OUT_REL2ADR : OUT_REL4ADR,
1341 insn_end - offset, opx->segment, opx->wrt);
1343 data = opx->offset - insn_end;
1344 out(offset, segment, &data,
1345 OUT_ADDRESS, size, NO_SEG, NO_SEG);
1354 if (opx->segment != segment) {
1356 out(offset, segment, &data,
1357 OUT_REL4ADR, insn_end - offset,
1358 opx->segment, opx->wrt);
1360 data = opx->offset - insn_end;
1361 out(offset, segment, &data,
1362 OUT_ADDRESS, 4, NO_SEG, NO_SEG);
1371 if (opx->segment == NO_SEG)
1372 errfunc(ERR_NONFATAL, "value referenced by FAR is not"
1375 out(offset, segment, &data, OUT_ADDRESS, 2,
1376 outfmt->segbase(1 + opx->segment),
1386 if (is_sbyte(ins, c & 3, 16)) {
1388 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1392 if (opx->segment == NO_SEG &&
1394 warn_overflow(2, data);
1395 out(offset, segment, &data, OUT_ADDRESS, 2,
1396 opx->segment, opx->wrt);
1406 bytes[0] = *codes++;
1407 if (is_sbyte(ins, c & 3, 16))
1408 bytes[0] |= 2; /* s-bit */
1409 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1418 if (is_sbyte(ins, c & 3, 32)) {
1420 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1424 out(offset, segment, &data, OUT_ADDRESS, 4,
1425 opx->segment, opx->wrt);
1435 bytes[0] = *codes++;
1436 if (is_sbyte(ins, c & 3, 32))
1437 bytes[0] |= 2; /* s-bit */
1438 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1455 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1461 (ins->drexdst << 4) |
1462 (ins->rex & REX_OC ? 0x08 : 0) |
1463 (ins->rex & (REX_R|REX_X|REX_B));
1465 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1476 if (bits == 32 && !has_prefix(ins, PPS_ASIZE, P_A16)) {
1478 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1485 if (bits != 32 && !has_prefix(ins, PPS_ASIZE, P_A32)) {
1487 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1509 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1518 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1533 *bytes = *codes++ ^ condval[ins->condition];
1534 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1543 *bytes = c - 0332 + 0xF2;
1544 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1549 if (ins->rex & REX_R) {
1551 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1554 ins->rex &= ~(REX_L|REX_R);
1561 if (ins->oprs[0].segment != NO_SEG)
1562 errfunc(ERR_PANIC, "non-constant BSS size in pass two");
1564 int64_t size = ins->oprs[0].offset;
1566 out(offset, segment, NULL,
1567 OUT_RESERVE, size, NO_SEG, NO_SEG);
1578 *bytes = c - 0366 + 0x66;
1579 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1589 *bytes = bits == 16 ? 3 : 5;
1590 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1594 default: /* can't do it by 'case' statements */
1595 if (c >= 0100 && c <= 0277) { /* it's an EA */
1603 /* pick rfield from operand b */
1604 rflags = regflag(&ins->oprs[c & 7]);
1605 rfield = regvals[ins->oprs[c & 7].basereg];
1607 /* rfield is constant */
1613 (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1614 ins->addr_size, rfield, rflags, ins->forw_ref)) {
1615 errfunc(ERR_NONFATAL, "invalid effective address");
1620 *p++ = ea_data.modrm;
1621 if (ea_data.sib_present)
1624 /* DREX suffixes come between the SIB and the displacement */
1625 if (ins->rex & REX_D) {
1627 (ins->drexdst << 4) |
1628 (ins->rex & REX_OC ? 0x08 : 0) |
1629 (ins->rex & (REX_R|REX_X|REX_B));
1634 out(offset, segment, bytes, OUT_RAWDATA, s, NO_SEG, NO_SEG);
1636 switch (ea_data.bytes) {
1640 if (ins->oprs[(c >> 3) & 7].segment != NO_SEG) {
1641 data = ins->oprs[(c >> 3) & 7].offset;
1642 out(offset, segment, &data, OUT_ADDRESS, 1,
1643 ins->oprs[(c >> 3) & 7].segment,
1644 ins->oprs[(c >> 3) & 7].wrt);
1646 *bytes = ins->oprs[(c >> 3) & 7].offset;
1647 out(offset, segment, bytes, OUT_RAWDATA, 1,
1655 data = ins->oprs[(c >> 3) & 7].offset;
1656 warn_overflow(ea_data.bytes, data);
1657 out(offset, segment, &data,
1658 ea_data.rip ? OUT_REL4ADR : OUT_ADDRESS,
1660 ins->oprs[(c >> 3) & 7].segment,
1661 ins->oprs[(c >> 3) & 7].wrt);
1667 errfunc(ERR_PANIC, "internal instruction table corrupt"
1668 ": instruction code 0x%02X given", c);
1674 static int32_t regflag(const operand * o)
1676 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1677 errfunc(ERR_PANIC, "invalid operand passed to regflag()");
1679 return reg_flags[o->basereg];
1682 static int32_t regval(const operand * o)
1684 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1685 errfunc(ERR_PANIC, "invalid operand passed to regval()");
1687 return regvals[o->basereg];
1690 static int op_rexflags(const operand * o, int mask)
1695 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1696 errfunc(ERR_PANIC, "invalid operand passed to op_rexflags()");
1699 flags = reg_flags[o->basereg];
1700 val = regvals[o->basereg];
1702 return rexflags(val, flags, mask);
1705 static int rexflags(int val, int32_t flags, int mask)
1710 rex |= REX_B|REX_X|REX_R;
1713 if (!(REG_HIGH & ~flags)) /* AH, CH, DH, BH */
1715 else if (!(REG8 & ~flags) && val >= 4) /* SPL, BPL, SIL, DIL */
1721 static int matches(const struct itemplate *itemp, insn * instruction, int bits)
1723 int i, size[MAX_OPERANDS], asize, oprs, ret;
1730 if (itemp->opcode != instruction->opcode)
1734 * Count the operands
1736 if (itemp->operands != instruction->operands)
1740 * Check that no spurious colons or TOs are present
1742 for (i = 0; i < itemp->operands; i++)
1743 if (instruction->oprs[i].type & ~itemp->opd[i] & (COLON | TO))
1747 * Check that the operand flags all match up
1749 for (i = 0; i < itemp->operands; i++) {
1750 if (itemp->opd[i] & SAME_AS) {
1751 int j = itemp->opd[i] & ~SAME_AS;
1752 if (instruction->oprs[i].type != instruction->oprs[j].type ||
1753 instruction->oprs[i].basereg != instruction->oprs[j].basereg)
1755 } else if (itemp->opd[i] & ~instruction->oprs[i].type ||
1756 ((itemp->opd[i] & SIZE_MASK) &&
1757 ((itemp->opd[i] ^ instruction->oprs[i].type) & SIZE_MASK))) {
1758 if ((itemp->opd[i] & ~instruction->oprs[i].type & ~SIZE_MASK) ||
1759 (instruction->oprs[i].type & SIZE_MASK))
1767 * Check operand sizes
1769 if (itemp->flags & IF_ARMASK) {
1770 memset(size, 0, sizeof size);
1772 switch (itemp->flags & IF_ARMASK) {
1786 break; /* Shouldn't happen */
1788 switch (itemp->flags & IF_SMASK) {
1809 switch (itemp->flags & IF_SMASK) {
1812 oprs = itemp->operands;
1816 oprs = itemp->operands;
1820 oprs = itemp->operands;
1824 oprs = itemp->operands;
1828 oprs = itemp->operands;
1833 for (i = 0; i < MAX_OPERANDS; i++)
1837 if (itemp->flags & (IF_SM | IF_SM2)) {
1838 oprs = (itemp->flags & IF_SM2 ? 2 : itemp->operands);
1840 for (i = 0; i < oprs; i++) {
1841 if ((asize = itemp->opd[i] & SIZE_MASK) != 0) {
1843 for (j = 0; j < oprs; j++)
1849 oprs = itemp->operands;
1852 for (i = 0; i < itemp->operands; i++) {
1853 if (!(itemp->opd[i] & SIZE_MASK) &&
1854 (instruction->oprs[i].type & SIZE_MASK & ~size[i]))
1859 * Check template is okay at the set cpu level
1861 if (((itemp->flags & IF_PLEVEL) > cpu))
1865 * Check if instruction is available in long mode
1867 if ((itemp->flags & IF_NOLONG) && (bits == 64))
1871 * Check if special handling needed for Jumps
1873 if ((uint8_t)(itemp->code[0]) >= 0370)
1879 static ea *process_ea(operand * input, ea * output, int bits,
1880 int addrbits, int rfield, int32_t rflags, int forw_ref)
1882 output->rip = false;
1884 /* REX flags for the rfield operand */
1885 output->rex |= rexflags(rfield, rflags, REX_R|REX_P|REX_W|REX_H);
1887 if (!(REGISTER & ~input->type)) { /* register direct */
1891 if (input->basereg < EXPR_REG_START /* Verify as Register */
1892 || input->basereg >= REG_ENUM_LIMIT)
1895 i = regvals[input->basereg];
1898 return NULL; /* Invalid EA register */
1900 output->rex |= op_rexflags(input, REX_B|REX_P|REX_W|REX_H);
1902 output->sib_present = false; /* no SIB necessary */
1903 output->bytes = 0; /* no offset necessary either */
1904 output->modrm = 0xC0 | ((rfield & 7) << 3) | (i & 7);
1905 } else { /* it's a memory reference */
1906 if (input->basereg == -1
1907 && (input->indexreg == -1 || input->scale == 0)) {
1908 /* it's a pure offset */
1909 if (bits == 64 && (~input->type & IP_REL)) {
1910 int scale, index, base;
1911 output->sib_present = true;
1915 output->sib = (scale << 6) | (index << 3) | base;
1917 output->modrm = 4 | ((rfield & 7) << 3);
1918 output->rip = false;
1920 output->sib_present = false;
1921 output->bytes = (addrbits != 16 ? 4 : 2);
1922 output->modrm = (addrbits != 16 ? 5 : 6) | ((rfield & 7) << 3);
1923 output->rip = bits == 64;
1925 } else { /* it's an indirection */
1926 int i = input->indexreg, b = input->basereg, s = input->scale;
1927 int32_t o = input->offset, seg = input->segment;
1928 int hb = input->hintbase, ht = input->hinttype;
1931 int32_t ix, bx; /* register flags */
1934 i = -1; /* make this easy, at least */
1936 if (i >= EXPR_REG_START && i < REG_ENUM_LIMIT) {
1944 if (b >= EXPR_REG_START && b < REG_ENUM_LIMIT) {
1952 /* check for a 32/64-bit memory reference... */
1953 if ((ix|bx) & (BITS32|BITS64)) {
1954 /* it must be a 32/64-bit memory reference. Firstly we have
1955 * to check that all registers involved are type E/Rxx. */
1956 int32_t sok = BITS32|BITS64;
1959 if (!(REG64 & ~ix) || !(REG32 & ~ix))
1967 return NULL; /* Invalid register */
1968 if (~sok & bx & SIZE_MASK)
1969 return NULL; /* Invalid size */
1973 /* While we're here, ensure the user didn't specify
1975 if (input->disp_size == 16 || input->disp_size == 64)
1978 if (addrbits == 16 ||
1979 (addrbits == 32 && !(sok & BITS32)) ||
1980 (addrbits == 64 && !(sok & BITS64)))
1983 /* now reorganize base/index */
1984 if (s == 1 && bt != it && bt != -1 && it != -1 &&
1985 ((hb == b && ht == EAH_NOTBASE)
1986 || (hb == i && ht == EAH_MAKEBASE))) {
1987 /* swap if hints say so */
1988 t = bt, bt = it, it = t;
1989 t = bx, bx = ix, ix = t;
1991 if (bt == it) /* convert EAX+2*EAX to 3*EAX */
1992 bt = -1, bx = 0, s++;
1993 if (bt == -1 && s == 1 && !(hb == it && ht == EAH_NOTBASE)) {
1994 /* make single reg base, unless hint */
1995 bt = it, bx = ix, it = -1, ix = 0;
1997 if (((s == 2 && it != REG_NUM_ESP
1998 && !(input->eaflags & EAF_TIMESTWO)) || s == 3
1999 || s == 5 || s == 9) && bt == -1)
2000 bt = it, bx = ix, s--; /* convert 3*EAX to EAX+2*EAX */
2001 if (it == -1 && (bt & 7) != REG_NUM_ESP
2002 && (input->eaflags & EAF_TIMESTWO))
2003 it = bt, ix = bx, bt = -1, bx = 0, s = 1;
2004 /* convert [NOSPLIT EAX] to sib format with 0x0 displacement */
2005 if (s == 1 && it == REG_NUM_ESP) {
2006 /* swap ESP into base if scale is 1 */
2007 t = it, it = bt, bt = t;
2008 t = ix, ix = bx, bx = t;
2010 if (it == REG_NUM_ESP
2011 || (s != 1 && s != 2 && s != 4 && s != 8 && it != -1))
2012 return NULL; /* wrong, for various reasons */
2014 output->rex |= rexflags(it, ix, REX_X);
2015 output->rex |= rexflags(bt, bx, REX_B);
2017 if (it == -1 && (bt & 7) != REG_NUM_ESP) {
2026 if (rm != REG_NUM_EBP && o == 0 &&
2027 seg == NO_SEG && !forw_ref &&
2029 (EAF_BYTEOFFS | EAF_WORDOFFS)))
2031 else if (input->eaflags & EAF_BYTEOFFS ||
2032 (o >= -128 && o <= 127 && seg == NO_SEG
2034 && !(input->eaflags & EAF_WORDOFFS)))
2040 output->sib_present = false;
2041 output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2042 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2045 int mod, scale, index, base;
2065 default: /* then what the smeg is it? */
2066 return NULL; /* panic */
2074 if (base != REG_NUM_EBP && o == 0 &&
2075 seg == NO_SEG && !forw_ref &&
2077 (EAF_BYTEOFFS | EAF_WORDOFFS)))
2079 else if (input->eaflags & EAF_BYTEOFFS ||
2080 (o >= -128 && o <= 127 && seg == NO_SEG
2082 && !(input->eaflags & EAF_WORDOFFS)))
2088 output->sib_present = true;
2089 output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2090 output->modrm = (mod << 6) | ((rfield & 7) << 3) | 4;
2091 output->sib = (scale << 6) | (index << 3) | base;
2093 } else { /* it's 16-bit */
2096 /* check for 64-bit long mode */
2100 /* check all registers are BX, BP, SI or DI */
2101 if ((b != -1 && b != R_BP && b != R_BX && b != R_SI
2102 && b != R_DI) || (i != -1 && i != R_BP && i != R_BX
2103 && i != R_SI && i != R_DI))
2106 /* ensure the user didn't specify DWORD/QWORD */
2107 if (input->disp_size == 32 || input->disp_size == 64)
2110 if (s != 1 && i != -1)
2111 return NULL; /* no can do, in 16-bit EA */
2112 if (b == -1 && i != -1) {
2117 if ((b == R_SI || b == R_DI) && i != -1) {
2122 /* have BX/BP as base, SI/DI index */
2124 return NULL; /* shouldn't ever happen, in theory */
2125 if (i != -1 && b != -1 &&
2126 (i == R_BP || i == R_BX || b == R_SI || b == R_DI))
2127 return NULL; /* invalid combinations */
2128 if (b == -1) /* pure offset: handled above */
2129 return NULL; /* so if it gets to here, panic! */
2133 switch (i * 256 + b) {
2134 case R_SI * 256 + R_BX:
2137 case R_DI * 256 + R_BX:
2140 case R_SI * 256 + R_BP:
2143 case R_DI * 256 + R_BP:
2161 if (rm == -1) /* can't happen, in theory */
2162 return NULL; /* so panic if it does */
2164 if (o == 0 && seg == NO_SEG && !forw_ref && rm != 6 &&
2165 !(input->eaflags & (EAF_BYTEOFFS | EAF_WORDOFFS)))
2167 else if (input->eaflags & EAF_BYTEOFFS ||
2168 (o >= -128 && o <= 127 && seg == NO_SEG
2170 && !(input->eaflags & EAF_WORDOFFS)))
2175 output->sib_present = false; /* no SIB - it's 16-bit */
2176 output->bytes = mod; /* bytes of offset needed */
2177 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2182 output->size = 1 + output->sib_present + output->bytes;
2186 static void add_asp(insn *ins, int addrbits)
2191 valid = (addrbits == 64) ? 64|32 : 32|16;
2193 switch (ins->prefixes[PPS_ASIZE]) {
2204 valid &= (addrbits == 32) ? 16 : 32;
2210 for (j = 0; j < ins->operands; j++) {
2211 if (!(MEMORY & ~ins->oprs[j].type)) {
2214 /* Verify as Register */
2215 if (ins->oprs[j].indexreg < EXPR_REG_START
2216 || ins->oprs[j].indexreg >= REG_ENUM_LIMIT)
2219 i = reg_flags[ins->oprs[j].indexreg];
2221 /* Verify as Register */
2222 if (ins->oprs[j].basereg < EXPR_REG_START
2223 || ins->oprs[j].basereg >= REG_ENUM_LIMIT)
2226 b = reg_flags[ins->oprs[j].basereg];
2228 if (ins->oprs[j].scale == 0)
2232 int ds = ins->oprs[j].disp_size;
2233 if ((addrbits != 64 && ds > 8) ||
2234 (addrbits == 64 && ds == 16))
2254 if (valid & addrbits) {
2255 ins->addr_size = addrbits;
2256 } else if (valid & ((addrbits == 32) ? 16 : 32)) {
2257 /* Add an address size prefix */
2258 enum prefixes pref = (addrbits == 32) ? P_A16 : P_A32;
2259 ins->prefixes[PPS_ASIZE] = pref;
2260 ins->addr_size = (addrbits == 32) ? 16 : 32;
2263 errfunc(ERR_NONFATAL, "impossible combination of address sizes");
2264 ins->addr_size = addrbits; /* Error recovery */
2267 defdisp = ins->addr_size == 16 ? 16 : 32;
2269 for (j = 0; j < ins->operands; j++) {
2270 if (!(MEM_OFFS & ~ins->oprs[j].type) &&
2271 (ins->oprs[j].disp_size ? ins->oprs[j].disp_size : defdisp)
2272 != ins->addr_size) {
2273 /* mem_offs sizes must match the address size; if not,
2274 strip the MEM_OFFS bit and match only EA instructions */
2275 ins->oprs[j].type &= ~(MEM_OFFS & ~MEMORY);