1 /* assemble.c code generation for the Netwide Assembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the licence given in the file "Licence"
6 * distributed in the NASM archive.
8 * the actual codes (C syntax, i.e. octal):
9 * \0 - terminates the code. (Unless it's a literal of course.)
10 * \1, \2, \3 - that many literal bytes follow in the code stream
11 * \4, \6 - the POP/PUSH (respectively) codes for CS, DS, ES, SS
12 * (POP is never used for CS) depending on operand 0
13 * \5, \7 - the second byte of POP/PUSH codes for FS, GS, depending
15 * \10..\13 - a literal byte follows in the code stream, to be added
16 * to the register value of operand 0..3
17 * \14..\17 - a signed byte immediate operand, from operand 0..3
18 * \20..\23 - a byte immediate operand, from operand 0..3
19 * \24..\27 - an unsigned byte immediate operand, from operand 0..3
20 * \30..\33 - a word immediate operand, from operand 0..3
21 * \34..\37 - select between \3[0-3] and \4[0-3] depending on 16/32 bit
22 * assembly mode or the operand-size override on the operand
23 * \40..\43 - a long immediate operand, from operand 0..3
24 * \44..\47 - select between \3[0-3], \4[0-3] and \5[4-7]
25 * depending on the address size of the instruction.
26 * \50..\53 - a byte relative operand, from operand 0..3
27 * \54..\57 - a qword immediate operand, from operand 0..3
28 * \60..\63 - a word relative operand, from operand 0..3
29 * \64..\67 - select between \6[0-3] and \7[0-3] depending on 16/32 bit
30 * assembly mode or the operand-size override on the operand
31 * \70..\73 - a long relative operand, from operand 0..3
32 * \74..\77 - a word constant, from the _segment_ part of operand 0..3
33 * \1ab - a ModRM, calculated on EA in operand a, with the spare
34 * field the register value of operand b.
35 * \140..\143 - an immediate word or signed byte for operand 0..3
36 * \144..\147 - or 2 (s-field) into next opcode byte if operand 0..3
37 * is a signed byte rather than a word.
38 * \150..\153 - an immediate dword or signed byte for operand 0..3
39 * \154..\157 - or 2 (s-field) into next opcode byte if operand 0..3
40 * is a signed byte rather than a dword.
41 * \160..\163 - this instruction uses DREX rather than REX, with the
42 * OC0 field set to 0, and the dest field taken from
44 * \164..\167 - this instruction uses DREX rather than REX, with the
45 * OC0 field set to 1, and the dest field taken from
47 * \170 - encodes the literal byte 0. (Some compilers don't take
48 * kindly to a zero byte in the _middle_ of a compile time
49 * string constant, so I had to put this hack in.)
50 * \171 - placement of DREX suffix in the absence of an EA
51 * \2ab - a ModRM, calculated on EA in operand a, with the spare
52 * field equal to digit b.
53 * \310 - indicates fixed 16-bit address size, i.e. optional 0x67.
54 * \311 - indicates fixed 32-bit address size, i.e. optional 0x67.
55 * \312 - (disassembler only) marker on LOOP, LOOPxx instructions.
56 * \313 - indicates fixed 64-bit address size, 0x67 invalid.
57 * \320 - indicates fixed 16-bit operand size, i.e. optional 0x66.
58 * \321 - indicates fixed 32-bit operand size, i.e. optional 0x66.
59 * \322 - indicates that this instruction is only valid when the
60 * operand size is the default (instruction to disassembler,
61 * generates no code in the assembler)
62 * \323 - indicates fixed 64-bit operand size, REX on extensions only.
63 * \324 - indicates 64-bit operand size requiring REX prefix.
64 * \330 - a literal byte follows in the code stream, to be added
65 * to the condition code value of the instruction.
66 * \331 - instruction not valid with REP prefix. Hint for
67 * disassembler only; for SSE instructions.
68 * \332 - REP prefix (0xF2 byte) used as opcode extension.
69 * \333 - REP prefix (0xF3 byte) used as opcode extension.
70 * \334 - LOCK prefix used instead of REX.R
71 * \335 - disassemble a rep (0xF3 byte) prefix as repe not rep.
72 * \340 - reserve <operand 0> bytes of uninitialized storage.
73 * Operand 0 had better be a segmentless constant.
74 * \364 - operand-size prefix (0x66) not permitted
75 * \365 - address-size prefix (0x67) not permitted
76 * \366 - operand-size prefix (0x66) used as opcode extension
77 * \367 - address-size prefix (0x67) used as opcode extension
78 * \370,\371,\372 - match only if operand 0 meets byte jump criteria.
79 * 370 is used for Jcc, 371 is used for JMP.
80 * \373 - assemble 0x03 if bits==16, 0x05 if bits==32;
81 * used for conditional jump over longer jump
99 int sib_present; /* is a SIB byte necessary? */
100 int bytes; /* # of bytes of offset needed */
101 int size; /* lazy - this is sib+bytes+1 */
102 uint8_t modrm, sib, rex, rip; /* the bytes themselves */
105 static uint32_t cpu; /* cpu level received from nasm.c */
106 static efunc errfunc;
107 static struct ofmt *outfmt;
108 static ListGen *list;
110 static int64_t calcsize(int32_t, int64_t, int, insn *, const char *);
111 static void gencode(int32_t, int64_t, int, insn *, const char *, int64_t);
112 static int matches(const struct itemplate *, insn *, int bits);
113 static int32_t regflag(const operand *);
114 static int32_t regval(const operand *);
115 static int rexflags(int, int32_t, int);
116 static int op_rexflags(const operand *, int);
117 static ea *process_ea(operand *, ea *, int, int, int, int32_t, int);
118 static void add_asp(insn *, int);
120 static int has_prefix(insn * ins, enum prefix_pos pos, enum prefixes prefix)
122 return ins->prefixes[pos] == prefix;
125 static void assert_no_prefix(insn * ins, enum prefix_pos pos)
127 if (ins->prefixes[pos])
128 errfunc(ERR_NONFATAL, "invalid %s prefix",
129 prefix_name(ins->prefixes[pos]));
132 static const char *size_name(int size)
152 static void warn_overflow(int size, int64_t data)
155 int64_t lim = ((int64_t)1 << (size*8))-1;
157 if (data < ~lim || data > lim)
158 errfunc(ERR_WARNING, "%s data exceeds bounds", size_name(size));
162 * This routine wrappers the real output format's output routine,
163 * in order to pass a copy of the data off to the listing file
164 * generator at the same time.
166 static void out(int64_t offset, int32_t segto, const void *data,
167 uint64_t type, int32_t segment, int32_t wrt)
169 static int32_t lineno = 0; /* static!!! */
170 static char *lnfname = NULL;
172 if ((type & OUT_TYPMASK) == OUT_ADDRESS) {
173 if (segment != NO_SEG || wrt != NO_SEG) {
175 * This address is relocated. We must write it as
176 * OUT_ADDRESS, so there's no work to be done here.
178 list->output(offset, data, type);
180 uint8_t p[8], *q = p;
182 * This is a non-relocated address, and we're going to
183 * convert it into RAWDATA format.
185 if ((type & OUT_SIZMASK) == 4) {
186 WRITELONG(q, *(int32_t *)data);
187 list->output(offset, p, OUT_RAWDATA + 4);
188 } else if ((type & OUT_SIZMASK) == 8) {
189 WRITEDLONG(q, *(int64_t *)data);
190 list->output(offset, p, OUT_RAWDATA + 8);
192 WRITESHORT(q, *(int32_t *)data);
193 list->output(offset, p, OUT_RAWDATA + 2);
196 } else if ((type & OUT_TYPMASK) == OUT_RAWDATA) {
197 list->output(offset, data, type);
198 } else if ((type & OUT_TYPMASK) == OUT_RESERVE) {
199 list->output(offset, NULL, type);
200 } else if ((type & OUT_TYPMASK) == OUT_REL2ADR ||
201 (type & OUT_TYPMASK) == OUT_REL4ADR) {
202 list->output(offset, data, type);
206 * this call to src_get determines when we call the
207 * debug-format-specific "linenum" function
208 * it updates lineno and lnfname to the current values
209 * returning 0 if "same as last time", -2 if lnfname
210 * changed, and the amount by which lineno changed,
211 * if it did. thus, these variables must be static
214 if (src_get(&lineno, &lnfname)) {
215 outfmt->current_dfmt->linenum(lnfname, lineno, segto);
218 outfmt->output(segto, data, type, segment, wrt);
221 static int jmp_match(int32_t segment, int64_t offset, int bits,
222 insn * ins, const char *code)
227 if (c != 0370 && c != 0371)
229 if (ins->oprs[0].opflags & OPFLAG_FORWARD) {
230 if ((optimizing < 0 || (ins->oprs[0].type & STRICT))
234 return (pass0 == 0); /* match a forward reference */
236 isize = calcsize(segment, offset, bits, ins, code);
237 if (ins->oprs[0].segment != segment)
239 isize = ins->oprs[0].offset - offset - isize; /* isize is now the delta */
240 if (isize >= -128L && isize <= 127L)
241 return 1; /* it is byte size */
246 int64_t assemble(int32_t segment, int64_t offset, int bits, uint32_t cp,
247 insn * instruction, struct ofmt *output, efunc error,
250 const struct itemplate *temp;
255 int64_t start = offset;
256 int64_t wsize = 0; /* size for DB etc. */
258 errfunc = error; /* to pass to other functions */
260 outfmt = output; /* likewise */
261 list = listgen; /* and again */
263 switch (instruction->opcode) {
290 int32_t t = instruction->times;
293 "instruction->times < 0 (%ld) in assemble()", t);
295 while (t--) { /* repeat TIMES times */
296 for (e = instruction->eops; e; e = e->next) {
297 if (e->type == EOT_DB_NUMBER) {
299 if (e->segment != NO_SEG)
300 errfunc(ERR_NONFATAL,
301 "one-byte relocation attempted");
303 uint8_t out_byte = e->offset;
304 out(offset, segment, &out_byte,
305 OUT_RAWDATA + 1, NO_SEG, NO_SEG);
307 } else if (wsize > 8) {
308 errfunc(ERR_NONFATAL, "integer supplied to a DT or DO"
311 out(offset, segment, &e->offset,
312 OUT_ADDRESS + wsize, e->segment, e->wrt);
314 } else if (e->type == EOT_DB_STRING) {
317 out(offset, segment, e->stringval,
318 OUT_RAWDATA + e->stringlen, NO_SEG, NO_SEG);
319 align = e->stringlen % wsize;
322 align = wsize - align;
323 out(offset, segment, "\0\0\0\0\0\0\0\0",
324 OUT_RAWDATA + align, NO_SEG, NO_SEG);
326 offset += e->stringlen + align;
329 if (t > 0 && t == instruction->times - 1) {
331 * Dummy call to list->output to give the offset to the
334 list->output(offset, NULL, OUT_RAWDATA);
335 list->uplevel(LIST_TIMES);
338 if (instruction->times > 1)
339 list->downlevel(LIST_TIMES);
340 return offset - start;
343 if (instruction->opcode == I_INCBIN) {
344 static char fname[FILENAME_MAX];
347 char *prefix = "", *combine;
348 char **pPrevPath = NULL;
350 len = FILENAME_MAX - 1;
351 if (len > instruction->eops->stringlen)
352 len = instruction->eops->stringlen;
353 strncpy(fname, instruction->eops->stringval, len);
356 while (1) { /* added by alexfru: 'incbin' uses include paths */
357 combine = nasm_malloc(strlen(prefix) + len + 1);
358 strcpy(combine, prefix);
359 strcat(combine, fname);
361 if ((fp = fopen(combine, "rb")) != NULL) {
367 pPrevPath = pp_get_include_path_ptr(pPrevPath);
368 if (pPrevPath == NULL)
374 error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
376 else if (fseek(fp, 0L, SEEK_END) < 0)
377 error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
380 static char buf[2048];
381 int32_t t = instruction->times;
385 if (instruction->eops->next) {
386 base = instruction->eops->next->offset;
388 if (instruction->eops->next->next &&
389 len > instruction->eops->next->next->offset)
390 len = instruction->eops->next->next->offset;
393 * Dummy call to list->output to give the offset to the
396 list->output(offset, NULL, OUT_RAWDATA);
397 list->uplevel(LIST_INCBIN);
401 fseek(fp, base, SEEK_SET);
405 fread(buf, 1, (l > (int32_t) sizeof(buf) ? (int32_t) sizeof(buf) : l),
409 * This shouldn't happen unless the file
410 * actually changes while we are reading
414 "`incbin': unexpected EOF while"
415 " reading file `%s'", fname);
416 t = 0; /* Try to exit cleanly */
419 out(offset, segment, buf, OUT_RAWDATA + m,
424 list->downlevel(LIST_INCBIN);
425 if (instruction->times > 1) {
427 * Dummy call to list->output to give the offset to the
430 list->output(offset, NULL, OUT_RAWDATA);
431 list->uplevel(LIST_TIMES);
432 list->downlevel(LIST_TIMES);
435 return instruction->times * len;
437 return 0; /* if we're here, there's an error */
440 /* Check to see if we need an address-size prefix */
441 add_asp(instruction, bits);
445 for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++){
446 int m = matches(temp, instruction, bits);
449 m += jmp_match(segment, offset, bits, instruction, temp->code);
451 if (m == 100) { /* matches! */
452 const char *codes = temp->code;
453 int64_t insn_size = calcsize(segment, offset, bits,
455 itimes = instruction->times;
456 if (insn_size < 0) /* shouldn't be, on pass two */
457 error(ERR_PANIC, "errors made it through from pass one");
460 for (j = 0; j < MAXPREFIX; j++) {
462 switch (instruction->prefixes[j]) {
478 "cs segment base generated, but will be ignored in 64-bit mode");
485 "ds segment base generated, but will be ignored in 64-bit mode");
492 "es segment base generated, but will be ignored in 64-bit mode");
505 "ss segment base generated, but will be ignored in 64-bit mode");
512 "segr6 and segr7 cannot be used as prefixes");
517 "16-bit addressing is not supported "
519 } else if (bits != 16)
529 "64-bit addressing is only supported "
553 error(ERR_PANIC, "invalid instruction prefix");
556 out(offset, segment, &c, OUT_RAWDATA + 1,
561 insn_end = offset + insn_size;
562 gencode(segment, offset, bits, instruction, codes,
565 if (itimes > 0 && itimes == instruction->times - 1) {
567 * Dummy call to list->output to give the offset to the
570 list->output(offset, NULL, OUT_RAWDATA);
571 list->uplevel(LIST_TIMES);
574 if (instruction->times > 1)
575 list->downlevel(LIST_TIMES);
576 return offset - start;
577 } else if (m > 0 && m > size_prob) {
583 if (temp->opcode == -1) { /* didn't match any instruction */
586 error(ERR_NONFATAL, "operation size not specified");
589 error(ERR_NONFATAL, "mismatch in operand sizes");
592 error(ERR_NONFATAL, "no instruction for this cpu level");
595 error(ERR_NONFATAL, "instruction not supported in 64-bit mode");
599 "invalid combination of opcode and operands");
606 int64_t insn_size(int32_t segment, int64_t offset, int bits, uint32_t cp,
607 insn * instruction, efunc error)
609 const struct itemplate *temp;
611 errfunc = error; /* to pass to other functions */
614 if (instruction->opcode == -1)
617 if (instruction->opcode == I_DB || instruction->opcode == I_DW ||
618 instruction->opcode == I_DD || instruction->opcode == I_DQ ||
619 instruction->opcode == I_DT || instruction->opcode == I_DO) {
621 int32_t isize, osize, wsize = 0; /* placate gcc */
624 switch (instruction->opcode) {
647 for (e = instruction->eops; e; e = e->next) {
651 if (e->type == EOT_DB_NUMBER)
653 else if (e->type == EOT_DB_STRING)
654 osize = e->stringlen;
656 align = (-osize) % wsize;
659 isize += osize + align;
661 return isize * instruction->times;
664 if (instruction->opcode == I_INCBIN) {
665 char fname[FILENAME_MAX];
668 char *prefix = "", *combine;
669 char **pPrevPath = NULL;
671 len = FILENAME_MAX - 1;
672 if (len > instruction->eops->stringlen)
673 len = instruction->eops->stringlen;
674 strncpy(fname, instruction->eops->stringval, len);
677 /* added by alexfru: 'incbin' uses include paths */
679 combine = nasm_malloc(strlen(prefix) + len + 1);
680 strcpy(combine, prefix);
681 strcat(combine, fname);
683 if ((fp = fopen(combine, "rb")) != NULL) {
689 pPrevPath = pp_get_include_path_ptr(pPrevPath);
690 if (pPrevPath == NULL)
696 error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
698 else if (fseek(fp, 0L, SEEK_END) < 0)
699 error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
704 if (instruction->eops->next) {
705 len -= instruction->eops->next->offset;
706 if (instruction->eops->next->next &&
707 len > instruction->eops->next->next->offset) {
708 len = instruction->eops->next->next->offset;
711 return instruction->times * len;
713 return 0; /* if we're here, there's an error */
716 /* Check to see if we need an address-size prefix */
717 add_asp(instruction, bits);
719 for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++) {
720 int m = matches(temp, instruction, bits);
722 m += jmp_match(segment, offset, bits, instruction, temp->code);
725 /* we've matched an instruction. */
727 const char *codes = temp->code;
730 isize = calcsize(segment, offset, bits, instruction, codes);
733 for (j = 0; j < MAXPREFIX; j++) {
734 switch (instruction->prefixes[j]) {
760 return isize * instruction->times;
763 return -1; /* didn't match any instruction */
766 /* check that opn[op] is a signed byte of size 16 or 32,
767 and return the signed value*/
768 static int is_sbyte(insn * ins, int op, int size)
773 ret = !(ins->forw_ref && ins->oprs[op].opflags) && /* dead in the water on forward reference or External */
775 !(ins->oprs[op].type & STRICT) &&
776 ins->oprs[op].wrt == NO_SEG && ins->oprs[op].segment == NO_SEG;
778 v = ins->oprs[op].offset;
780 v = (int16_t)v; /* sign extend if 16 bits */
782 return ret && v >= -128L && v <= 127L;
785 static int64_t calcsize(int32_t segment, int64_t offset, int bits,
786 insn * ins, const char *codes)
793 ins->rex = 0; /* Ensure REX is reset */
795 if (ins->prefixes[PPS_OSIZE] == P_O64)
798 (void)segment; /* Don't warn that this parameter is unused */
799 (void)offset; /* Don't warn that this parameter is unused */
803 opx = &ins->oprs[c & 3];
808 codes += c, length += c;
821 op_rexflags(opx, REX_B|REX_H|REX_P|REX_W);
852 if (opx->type & (BITS16 | BITS32 | BITS64))
853 length += (opx->type & BITS16) ? 2 : 4;
855 length += (bits == 16) ? 2 : 4;
867 length += ins->addr_size >> 3;
879 length += 8; /* MOV reg64/imm */
891 if (opx->type & (BITS16 | BITS32 | BITS64))
892 length += (opx->type & BITS16) ? 2 : 4;
894 length += (bits == 16) ? 2 : 4;
912 length += is_sbyte(ins, c & 3, 16) ? 1 : 2;
925 length += is_sbyte(ins, c & 3, 32) ? 1 : 4;
940 ins->drexdst = regval(&ins->oprs[c & 3]);
947 ins->rex |= REX_D|REX_OC;
948 ins->drexdst = regval(&ins->oprs[c & 3]);
963 length += (bits != 16) && !has_prefix(ins, PPS_ASIZE, P_A16);
966 length += (bits != 32) && !has_prefix(ins, PPS_ASIZE, P_A32);
971 if (bits != 64 || has_prefix(ins, PPS_ASIZE, P_A16) ||
972 has_prefix(ins, PPS_ASIZE, P_A32))
976 length += (bits != 16);
979 length += (bits == 16);
1006 if (ins->oprs[0].segment != NO_SEG)
1007 errfunc(ERR_NONFATAL, "attempt to reserve non-constant"
1008 " quantity of BSS space");
1010 length += ins->oprs[0].offset << (c & 3);
1026 default: /* can't do it by 'case' statements */
1027 if (c >= 0100 && c <= 0277) { /* it's an EA */
1031 ea_data.rex = 0; /* Ensure ea.REX is initially 0 */
1034 /* pick rfield from operand b */
1035 rflags = regflag(&ins->oprs[c & 7]);
1036 rfield = regvals[ins->oprs[c & 7].basereg];
1043 (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1044 ins->addr_size, rfield, rflags, ins->forw_ref)) {
1045 errfunc(ERR_NONFATAL, "invalid effective address");
1048 ins->rex |= ea_data.rex;
1049 length += ea_data.size;
1052 errfunc(ERR_PANIC, "internal instruction table corrupt"
1053 ": instruction code 0x%02X given", c);
1058 ins->rex &= rex_mask;
1060 if (ins->rex & REX_D) {
1061 if (ins->rex & REX_H) {
1062 errfunc(ERR_NONFATAL, "cannot use high register in drex instruction");
1065 if (bits != 64 && ((ins->rex & (REX_W|REX_X|REX_B)) ||
1066 ins->drexdst > 7)) {
1067 errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1071 } else if (ins->rex & REX_REAL) {
1072 if (ins->rex & REX_H) {
1073 errfunc(ERR_NONFATAL, "cannot use high register in rex instruction");
1075 } else if (bits == 64) {
1077 } else if ((ins->rex & REX_L) &&
1078 !(ins->rex & (REX_P|REX_W|REX_X|REX_B)) &&
1081 assert_no_prefix(ins, PPS_LREP);
1084 errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1092 #define EMIT_REX() \
1093 if (!(ins->rex & REX_D) && (ins->rex & REX_REAL) && (bits == 64)) { \
1094 ins->rex = (ins->rex & REX_REAL)|REX_P; \
1095 out(offset, segment, &ins->rex, OUT_RAWDATA+1, NO_SEG, NO_SEG); \
1100 static void gencode(int32_t segment, int64_t offset, int bits,
1101 insn * ins, const char *codes, int64_t insn_end)
1103 static char condval[] = { /* conditional opcodes */
1104 0x7, 0x3, 0x2, 0x6, 0x2, 0x4, 0xF, 0xD, 0xC, 0xE, 0x6, 0x2,
1105 0x3, 0x7, 0x3, 0x5, 0xE, 0xC, 0xD, 0xF, 0x1, 0xB, 0x9, 0x5,
1106 0x0, 0xA, 0xA, 0xB, 0x8, 0x4
1112 struct operand *opx;
1116 opx = &ins->oprs[c & 3];
1122 out(offset, segment, codes, OUT_RAWDATA + c, NO_SEG, NO_SEG);
1129 switch (ins->oprs[0].basereg) {
1131 bytes[0] = 0x0E + (c == 0x04 ? 1 : 0);
1134 bytes[0] = 0x1E + (c == 0x04 ? 1 : 0);
1137 bytes[0] = 0x06 + (c == 0x04 ? 1 : 0);
1140 bytes[0] = 0x16 + (c == 0x04 ? 1 : 0);
1144 "bizarre 8086 segment register received");
1146 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1152 switch (ins->oprs[0].basereg) {
1154 bytes[0] = 0xA0 + (c == 0x05 ? 1 : 0);
1157 bytes[0] = 0xA8 + (c == 0x05 ? 1 : 0);
1161 "bizarre 386 segment register received");
1163 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1172 bytes[0] = *codes++ + ((regval(opx)) & 7);
1173 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1181 if (opx->offset < -128 || opx->offset > 127) {
1182 errfunc(ERR_WARNING, "signed byte value exceeds bounds");
1185 if (opx->segment != NO_SEG) {
1187 out(offset, segment, &data, OUT_ADDRESS + 1,
1188 opx->segment, opx->wrt);
1190 bytes[0] = opx->offset;
1191 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG,
1201 if (opx->offset < -256 || opx->offset > 255) {
1202 errfunc(ERR_WARNING, "byte value exceeds bounds");
1204 if (opx->segment != NO_SEG) {
1206 out(offset, segment, &data, OUT_ADDRESS + 1,
1207 opx->segment, opx->wrt);
1209 bytes[0] = opx->offset;
1210 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG,
1220 if (opx->offset < 0 || opx->offset > 255)
1221 errfunc(ERR_WARNING, "unsigned byte value exceeds bounds");
1222 if (opx->segment != NO_SEG) {
1224 out(offset, segment, &data, OUT_ADDRESS + 1,
1225 opx->segment, opx->wrt);
1227 bytes[0] = opx->offset;
1228 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG,
1239 if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1240 warn_overflow(2, data);
1241 out(offset, segment, &data, OUT_ADDRESS + 2,
1242 opx->segment, opx->wrt);
1250 if (opx->type & (BITS16 | BITS32))
1251 size = (opx->type & BITS16) ? 2 : 4;
1253 size = (bits == 16) ? 2 : 4;
1255 if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1256 warn_overflow(size, data);
1257 out(offset, segment, &data, OUT_ADDRESS + size,
1258 opx->segment, opx->wrt);
1267 out(offset, segment, &data, OUT_ADDRESS + 4,
1268 opx->segment, opx->wrt);
1277 size = ins->addr_size >> 3;
1278 if (opx->segment == NO_SEG &&
1280 warn_overflow(size, data);
1281 out(offset, segment, &data, OUT_ADDRESS + size,
1282 opx->segment, opx->wrt);
1290 if (opx->segment != segment)
1291 errfunc(ERR_NONFATAL,
1292 "short relative jump outside segment");
1293 data = opx->offset - insn_end;
1294 if (data > 127 || data < -128)
1295 errfunc(ERR_NONFATAL, "short jump is out of range");
1297 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1305 data = (int64_t)opx->offset;
1306 out(offset, segment, &data, OUT_ADDRESS + 8,
1307 opx->segment, opx->wrt);
1315 if (opx->segment != segment) {
1317 out(offset, segment, &data,
1318 OUT_REL2ADR + insn_end - offset,
1319 opx->segment, opx->wrt);
1321 data = opx->offset - insn_end;
1322 out(offset, segment, &data,
1323 OUT_ADDRESS + 2, NO_SEG, NO_SEG);
1332 if (opx->type & (BITS16 | BITS32 | BITS64))
1333 size = (opx->type & BITS16) ? 2 : 4;
1335 size = (bits == 16) ? 2 : 4;
1336 if (opx->segment != segment) {
1337 int64_t reltype = (size == 2 ? OUT_REL2ADR : OUT_REL4ADR);
1339 out(offset, segment, &data, reltype + insn_end - offset,
1340 opx->segment, opx->wrt);
1342 data = opx->offset - insn_end;
1343 out(offset, segment, &data,
1344 OUT_ADDRESS + size, NO_SEG, NO_SEG);
1353 if (opx->segment != segment) {
1355 out(offset, segment, &data,
1356 OUT_REL4ADR + insn_end - offset,
1357 opx->segment, opx->wrt);
1359 data = opx->offset - insn_end;
1360 out(offset, segment, &data,
1361 OUT_ADDRESS + 4, NO_SEG, NO_SEG);
1370 if (opx->segment == NO_SEG)
1371 errfunc(ERR_NONFATAL, "value referenced by FAR is not"
1374 out(offset, segment, &data, OUT_ADDRESS + 2,
1375 outfmt->segbase(1 + opx->segment),
1385 if (is_sbyte(ins, c & 3, 16)) {
1387 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG,
1391 if (opx->segment == NO_SEG &&
1393 warn_overflow(2, data);
1394 out(offset, segment, &data, OUT_ADDRESS + 2,
1395 opx->segment, opx->wrt);
1406 bytes[0] = *codes++;
1407 if (is_sbyte(ins, c & 3, 16))
1408 bytes[0] |= 2; /* s-bit */
1409 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1418 if (is_sbyte(ins, c & 3, 32)) {
1420 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG,
1424 out(offset, segment, &data, OUT_ADDRESS + 4,
1425 opx->segment, opx->wrt);
1436 bytes[0] = *codes++;
1437 if (is_sbyte(ins, c & 3, 32))
1438 bytes[0] |= 2; /* s-bit */
1439 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1456 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1462 (ins->drexdst << 4) |
1463 (ins->rex & REX_OC ? 0x08 : 0) |
1464 (ins->rex & (REX_R|REX_X|REX_B));
1466 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1477 if (bits == 32 && !has_prefix(ins, PPS_ASIZE, P_A16)) {
1479 out(offset, segment, bytes,
1480 OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1487 if (bits != 32 && !has_prefix(ins, PPS_ASIZE, P_A32)) {
1489 out(offset, segment, bytes,
1490 OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1506 out(offset, segment, bytes,
1507 OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1516 out(offset, segment, bytes,
1517 OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1532 *bytes = *codes++ ^ condval[ins->condition];
1533 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1542 *bytes = c - 0332 + 0xF2;
1543 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1548 if (ins->rex & REX_R) {
1550 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1553 ins->rex &= ~(REX_L|REX_R);
1562 if (ins->oprs[0].segment != NO_SEG)
1563 errfunc(ERR_PANIC, "non-constant BSS size in pass two");
1565 int64_t size = ins->oprs[0].offset << (c & 3);
1567 out(offset, segment, NULL,
1568 OUT_RESERVE + size, NO_SEG, NO_SEG);
1579 *bytes = c - 0366 + 0x66;
1580 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1590 *bytes = bits == 16 ? 3 : 5;
1591 out(offset, segment, bytes, OUT_RAWDATA + 1, NO_SEG, NO_SEG);
1595 default: /* can't do it by 'case' statements */
1596 if (c >= 0100 && c <= 0277) { /* it's an EA */
1604 /* pick rfield from operand b */
1605 rflags = regflag(&ins->oprs[c & 7]);
1606 rfield = regvals[ins->oprs[c & 7].basereg];
1608 /* rfield is constant */
1614 (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1615 ins->addr_size, rfield, rflags, ins->forw_ref)) {
1616 errfunc(ERR_NONFATAL, "invalid effective address");
1621 *p++ = ea_data.modrm;
1622 if (ea_data.sib_present)
1625 /* DREX suffixes come between the SIB and the displacement */
1626 if (ins->rex & REX_D) {
1628 (ins->drexdst << 4) |
1629 (ins->rex & REX_OC ? 0x08 : 0) |
1630 (ins->rex & (REX_R|REX_X|REX_B));
1635 out(offset, segment, bytes, OUT_RAWDATA + s,
1638 switch (ea_data.bytes) {
1642 if (ins->oprs[(c >> 3) & 7].segment != NO_SEG) {
1643 data = ins->oprs[(c >> 3) & 7].offset;
1644 out(offset, segment, &data, OUT_ADDRESS + 1,
1645 ins->oprs[(c >> 3) & 7].segment,
1646 ins->oprs[(c >> 3) & 7].wrt);
1648 *bytes = ins->oprs[(c >> 3) & 7].offset;
1649 out(offset, segment, bytes, OUT_RAWDATA + 1,
1657 data = ins->oprs[(c >> 3) & 7].offset;
1658 warn_overflow(ea_data.bytes, data);
1659 out(offset, segment, &data,
1660 (ea_data.rip ? OUT_REL4ADR : OUT_ADDRESS)
1662 ins->oprs[(c >> 3) & 7].segment,
1663 ins->oprs[(c >> 3) & 7].wrt);
1669 errfunc(ERR_PANIC, "internal instruction table corrupt"
1670 ": instruction code 0x%02X given", c);
1676 static int32_t regflag(const operand * o)
1678 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1679 errfunc(ERR_PANIC, "invalid operand passed to regflag()");
1681 return reg_flags[o->basereg];
1684 static int32_t regval(const operand * o)
1686 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1687 errfunc(ERR_PANIC, "invalid operand passed to regval()");
1689 return regvals[o->basereg];
1692 static int op_rexflags(const operand * o, int mask)
1697 if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1698 errfunc(ERR_PANIC, "invalid operand passed to op_rexflags()");
1701 flags = reg_flags[o->basereg];
1702 val = regvals[o->basereg];
1704 return rexflags(val, flags, mask);
1707 static int rexflags(int val, int32_t flags, int mask)
1712 rex |= REX_B|REX_X|REX_R;
1715 if (!(REG_HIGH & ~flags)) /* AH, CH, DH, BH */
1717 else if (!(REG8 & ~flags) && val >= 4) /* SPL, BPL, SIL, DIL */
1723 static int matches(const struct itemplate *itemp, insn * instruction, int bits)
1725 int i, size[MAX_OPERANDS], asize, oprs, ret;
1732 if (itemp->opcode != instruction->opcode)
1736 * Count the operands
1738 if (itemp->operands != instruction->operands)
1742 * Check that no spurious colons or TOs are present
1744 for (i = 0; i < itemp->operands; i++)
1745 if (instruction->oprs[i].type & ~itemp->opd[i] & (COLON | TO))
1749 * Check that the operand flags all match up
1751 for (i = 0; i < itemp->operands; i++) {
1752 if (itemp->opd[i] & SAME_AS) {
1753 int j = itemp->opd[i] & ~SAME_AS;
1754 if (instruction->oprs[i].type != instruction->oprs[j].type ||
1755 instruction->oprs[i].basereg != instruction->oprs[j].basereg)
1757 } else if (itemp->opd[i] & ~instruction->oprs[i].type ||
1758 ((itemp->opd[i] & SIZE_MASK) &&
1759 ((itemp->opd[i] ^ instruction->oprs[i].type) & SIZE_MASK))) {
1760 if ((itemp->opd[i] & ~instruction->oprs[i].type & ~SIZE_MASK) ||
1761 (instruction->oprs[i].type & SIZE_MASK))
1769 * Check operand sizes
1771 if (itemp->flags & IF_ARMASK) {
1772 memset(size, 0, sizeof size);
1774 switch (itemp->flags & IF_ARMASK) {
1788 break; /* Shouldn't happen */
1790 switch (itemp->flags & IF_SMASK) {
1811 switch (itemp->flags & IF_SMASK) {
1814 oprs = itemp->operands;
1818 oprs = itemp->operands;
1822 oprs = itemp->operands;
1826 oprs = itemp->operands;
1830 oprs = itemp->operands;
1835 for (i = 0; i < MAX_OPERANDS; i++)
1839 if (itemp->flags & (IF_SM | IF_SM2)) {
1840 oprs = (itemp->flags & IF_SM2 ? 2 : itemp->operands);
1842 for (i = 0; i < oprs; i++) {
1843 if ((asize = itemp->opd[i] & SIZE_MASK) != 0) {
1845 for (j = 0; j < oprs; j++)
1851 oprs = itemp->operands;
1854 for (i = 0; i < itemp->operands; i++) {
1855 if (!(itemp->opd[i] & SIZE_MASK) &&
1856 (instruction->oprs[i].type & SIZE_MASK & ~size[i]))
1861 * Check template is okay at the set cpu level
1863 if (((itemp->flags & IF_PLEVEL) > cpu))
1867 * Check if instruction is available in long mode
1869 if ((itemp->flags & IF_NOLONG) && (bits == 64))
1873 * Check if special handling needed for Jumps
1875 if ((uint8_t)(itemp->code[0]) >= 0370)
1881 static ea *process_ea(operand * input, ea * output, int bits,
1882 int addrbits, int rfield, int32_t rflags, int forw_ref)
1884 output->rip = false;
1886 /* REX flags for the rfield operand */
1887 output->rex |= rexflags(rfield, rflags, REX_R|REX_P|REX_W|REX_H);
1889 if (!(REGISTER & ~input->type)) { /* register direct */
1893 if (input->basereg < EXPR_REG_START /* Verify as Register */
1894 || input->basereg >= REG_ENUM_LIMIT)
1897 i = regvals[input->basereg];
1900 return NULL; /* Invalid EA register */
1902 output->rex |= op_rexflags(input, REX_B|REX_P|REX_W|REX_H);
1904 output->sib_present = false; /* no SIB necessary */
1905 output->bytes = 0; /* no offset necessary either */
1906 output->modrm = 0xC0 | ((rfield & 7) << 3) | (i & 7);
1907 } else { /* it's a memory reference */
1908 if (input->basereg == -1
1909 && (input->indexreg == -1 || input->scale == 0)) {
1910 /* it's a pure offset */
1911 if (bits == 64 && (~input->type & IP_REL)) {
1912 int scale, index, base;
1913 output->sib_present = true;
1917 output->sib = (scale << 6) | (index << 3) | base;
1919 output->modrm = 4 | ((rfield & 7) << 3);
1920 output->rip = false;
1922 output->sib_present = false;
1923 output->bytes = (addrbits != 16 ? 4 : 2);
1924 output->modrm = (addrbits != 16 ? 5 : 6) | ((rfield & 7) << 3);
1925 output->rip = bits == 64;
1927 } else { /* it's an indirection */
1928 int i = input->indexreg, b = input->basereg, s = input->scale;
1929 int32_t o = input->offset, seg = input->segment;
1930 int hb = input->hintbase, ht = input->hinttype;
1933 int32_t ix, bx; /* register flags */
1936 i = -1; /* make this easy, at least */
1938 if (i >= EXPR_REG_START && i < REG_ENUM_LIMIT) {
1946 if (b >= EXPR_REG_START && b < REG_ENUM_LIMIT) {
1954 /* check for a 32/64-bit memory reference... */
1955 if ((ix|bx) & (BITS32|BITS64)) {
1956 /* it must be a 32/64-bit memory reference. Firstly we have
1957 * to check that all registers involved are type E/Rxx. */
1958 int32_t sok = BITS32|BITS64;
1961 if (!(REG64 & ~ix) || !(REG32 & ~ix))
1969 return NULL; /* Invalid register */
1970 if (~sok & bx & SIZE_MASK)
1971 return NULL; /* Invalid size */
1975 /* While we're here, ensure the user didn't specify
1977 if (input->disp_size == 16 || input->disp_size == 64)
1980 if (addrbits == 16 ||
1981 (addrbits == 32 && !(sok & BITS32)) ||
1982 (addrbits == 64 && !(sok & BITS64)))
1985 /* now reorganize base/index */
1986 if (s == 1 && bt != it && bt != -1 && it != -1 &&
1987 ((hb == b && ht == EAH_NOTBASE)
1988 || (hb == i && ht == EAH_MAKEBASE))) {
1989 /* swap if hints say so */
1990 t = bt, bt = it, it = t;
1991 t = bx, bx = ix, ix = t;
1993 if (bt == it) /* convert EAX+2*EAX to 3*EAX */
1994 bt = -1, bx = 0, s++;
1995 if (bt == -1 && s == 1 && !(hb == it && ht == EAH_NOTBASE)) {
1996 /* make single reg base, unless hint */
1997 bt = it, bx = ix, it = -1, ix = 0;
1999 if (((s == 2 && it != REG_NUM_ESP
2000 && !(input->eaflags & EAF_TIMESTWO)) || s == 3
2001 || s == 5 || s == 9) && bt == -1)
2002 bt = it, bx = ix, s--; /* convert 3*EAX to EAX+2*EAX */
2003 if (it == -1 && (bt & 7) != REG_NUM_ESP
2004 && (input->eaflags & EAF_TIMESTWO))
2005 it = bt, ix = bx, bt = -1, bx = 0, s = 1;
2006 /* convert [NOSPLIT EAX] to sib format with 0x0 displacement */
2007 if (s == 1 && it == REG_NUM_ESP) {
2008 /* swap ESP into base if scale is 1 */
2009 t = it, it = bt, bt = t;
2010 t = ix, ix = bx, bx = t;
2012 if (it == REG_NUM_ESP
2013 || (s != 1 && s != 2 && s != 4 && s != 8 && it != -1))
2014 return NULL; /* wrong, for various reasons */
2016 output->rex |= rexflags(it, ix, REX_X);
2017 output->rex |= rexflags(bt, bx, REX_B);
2019 if (it == -1 && (bt & 7) != REG_NUM_ESP) {
2028 if (rm != REG_NUM_EBP && o == 0 &&
2029 seg == NO_SEG && !forw_ref &&
2031 (EAF_BYTEOFFS | EAF_WORDOFFS)))
2033 else if (input->eaflags & EAF_BYTEOFFS ||
2034 (o >= -128 && o <= 127 && seg == NO_SEG
2036 && !(input->eaflags & EAF_WORDOFFS)))
2042 output->sib_present = false;
2043 output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2044 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2047 int mod, scale, index, base;
2067 default: /* then what the smeg is it? */
2068 return NULL; /* panic */
2076 if (base != REG_NUM_EBP && o == 0 &&
2077 seg == NO_SEG && !forw_ref &&
2079 (EAF_BYTEOFFS | EAF_WORDOFFS)))
2081 else if (input->eaflags & EAF_BYTEOFFS ||
2082 (o >= -128 && o <= 127 && seg == NO_SEG
2084 && !(input->eaflags & EAF_WORDOFFS)))
2090 output->sib_present = true;
2091 output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2092 output->modrm = (mod << 6) | ((rfield & 7) << 3) | 4;
2093 output->sib = (scale << 6) | (index << 3) | base;
2095 } else { /* it's 16-bit */
2098 /* check for 64-bit long mode */
2102 /* check all registers are BX, BP, SI or DI */
2103 if ((b != -1 && b != R_BP && b != R_BX && b != R_SI
2104 && b != R_DI) || (i != -1 && i != R_BP && i != R_BX
2105 && i != R_SI && i != R_DI))
2108 /* ensure the user didn't specify DWORD/QWORD */
2109 if (input->disp_size == 32 || input->disp_size == 64)
2112 if (s != 1 && i != -1)
2113 return NULL; /* no can do, in 16-bit EA */
2114 if (b == -1 && i != -1) {
2119 if ((b == R_SI || b == R_DI) && i != -1) {
2124 /* have BX/BP as base, SI/DI index */
2126 return NULL; /* shouldn't ever happen, in theory */
2127 if (i != -1 && b != -1 &&
2128 (i == R_BP || i == R_BX || b == R_SI || b == R_DI))
2129 return NULL; /* invalid combinations */
2130 if (b == -1) /* pure offset: handled above */
2131 return NULL; /* so if it gets to here, panic! */
2135 switch (i * 256 + b) {
2136 case R_SI * 256 + R_BX:
2139 case R_DI * 256 + R_BX:
2142 case R_SI * 256 + R_BP:
2145 case R_DI * 256 + R_BP:
2163 if (rm == -1) /* can't happen, in theory */
2164 return NULL; /* so panic if it does */
2166 if (o == 0 && seg == NO_SEG && !forw_ref && rm != 6 &&
2167 !(input->eaflags & (EAF_BYTEOFFS | EAF_WORDOFFS)))
2169 else if (input->eaflags & EAF_BYTEOFFS ||
2170 (o >= -128 && o <= 127 && seg == NO_SEG
2172 && !(input->eaflags & EAF_WORDOFFS)))
2177 output->sib_present = false; /* no SIB - it's 16-bit */
2178 output->bytes = mod; /* bytes of offset needed */
2179 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2184 output->size = 1 + output->sib_present + output->bytes;
2188 static void add_asp(insn *ins, int addrbits)
2193 valid = (addrbits == 64) ? 64|32 : 32|16;
2195 switch (ins->prefixes[PPS_ASIZE]) {
2206 valid &= (addrbits == 32) ? 16 : 32;
2212 for (j = 0; j < ins->operands; j++) {
2213 if (!(MEMORY & ~ins->oprs[j].type)) {
2216 /* Verify as Register */
2217 if (ins->oprs[j].indexreg < EXPR_REG_START
2218 || ins->oprs[j].indexreg >= REG_ENUM_LIMIT)
2221 i = reg_flags[ins->oprs[j].indexreg];
2223 /* Verify as Register */
2224 if (ins->oprs[j].basereg < EXPR_REG_START
2225 || ins->oprs[j].basereg >= REG_ENUM_LIMIT)
2228 b = reg_flags[ins->oprs[j].basereg];
2230 if (ins->oprs[j].scale == 0)
2234 int ds = ins->oprs[j].disp_size;
2235 if ((addrbits != 64 && ds > 8) ||
2236 (addrbits == 64 && ds == 16))
2256 if (valid & addrbits) {
2257 ins->addr_size = addrbits;
2258 } else if (valid & ((addrbits == 32) ? 16 : 32)) {
2259 /* Add an address size prefix */
2260 enum prefixes pref = (addrbits == 32) ? P_A16 : P_A32;
2261 ins->prefixes[PPS_ASIZE] = pref;
2262 ins->addr_size = (addrbits == 32) ? 16 : 32;
2265 errfunc(ERR_NONFATAL, "impossible combination of address sizes");
2266 ins->addr_size = addrbits; /* Error recovery */
2269 defdisp = ins->addr_size == 16 ? 16 : 32;
2271 for (j = 0; j < ins->operands; j++) {
2272 if (!(MEM_OFFS & ~ins->oprs[j].type) &&
2273 (ins->oprs[j].disp_size ? ins->oprs[j].disp_size : defdisp)
2274 != ins->addr_size) {
2275 /* mem_offs sizes must match the address size; if not,
2276 strip the MEM_OFFS bit and match only EA instructions */
2277 ins->oprs[j].type &= ~(MEM_OFFS & ~MEMORY);