assemble.c

   1 /* assemble.c   code generation for the Netwide Assembler
   2  *
   3  * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
   4  * Julian Hall. All rights reserved. The software is
   5  * redistributable under the license given in the file "LICENSE"
   6  * distributed in the NASM archive.
   7  *
   8  * the actual codes (C syntax, i.e. octal):
   9  * \0            - terminates the code. (Unless it's a literal of course.)
  10  * \1, \2, \3    - that many literal bytes follow in the code stream
  11  * \4, \6        - the POP/PUSH (respectively) codes for CS, DS, ES, SS
  12  *                 (POP is never used for CS) depending on operand 0
  13  * \5, \7        - the second byte of POP/PUSH codes for FS, GS, depending
  14  *                 on operand 0
  15  * \10..\13      - a literal byte follows in the code stream, to be added
  16  *                 to the register value of operand 0..3
  17  * \14..\17      - a signed byte immediate operand, from operand 0..3
  18  * \20..\23      - a byte immediate operand, from operand 0..3
  19  * \24..\27      - an unsigned byte immediate operand, from operand 0..3
  20  * \30..\33      - a word immediate operand, from operand 0..3
  21  * \34..\37      - select between \3[0-3] and \4[0-3] depending on 16/32 bit
  22  *                 assembly mode or the operand-size override on the operand
  23  * \40..\43      - a long immediate operand, from operand 0..3
  24  * \44..\47      - select between \3[0-3], \4[0-3] and \5[4-7]
  25  *                 depending on the address size of the instruction.
  26  * \50..\53      - a byte relative operand, from operand 0..3
  27  * \54..\57      - a qword immediate operand, from operand 0..3
  28  * \60..\63      - a word relative operand, from operand 0..3
  29  * \64..\67      - select between \6[0-3] and \7[0-3] depending on 16/32 bit
  30  *                 assembly mode or the operand-size override on the operand
  31  * \70..\73      - a long relative operand, from operand 0..3
  32  * \74..\77       - a word constant, from the _segment_ part of operand 0..3
  33  * \1ab          - a ModRM, calculated on EA in operand a, with the spare
  34  *                 field the register value of operand b.
  35  * \140..\143    - an immediate word or signed byte for operand 0..3
  36  * \144..\147    - or 2 (s-field) into opcode byte if operand 0..3
  37  *                  is a signed byte rather than a word.  Opcode byte follows.
  38  * \150..\153     - an immediate dword or signed byte for operand 0..3
  39  * \154..\157    - or 2 (s-field) into opcode byte if operand 0..3
  40  *                  is a signed byte rather than a dword.  Opcode byte follows.
  41  * \160..\163    - this instruction uses DREX rather than REX, with the
  42  *                 OC0 field set to 0, and the dest field taken from
  43  *                 operand 0..3.
  44  * \164..\167    - this instruction uses DREX rather than REX, with the
  45  *                 OC0 field set to 1, and the dest field taken from
  46  *                 operand 0..3.
  47  * \171          - placement of DREX suffix in the absence of an EA
  48  * \172\ab       - the register number from operand a in bits 7..4, with
  49  *                 the 4-bit immediate from operand b in bits 3..0.
  50  * \173\xab      - the register number from operand a in bits 7..4, with
  51  *                 the value b in bits 3..0.
  52  * \174\a        - the register number from operand a in bits 7..4, and
  53  *                 an arbitrary value in bits 3..0 (assembled as zero.)
  54  * \2ab          - a ModRM, calculated on EA in operand a, with the spare
  55  *                 field equal to digit b.
  56  * \250..\253    - same as \150..\153, except warn if the 64-bit operand
  57  *                 is not equal to the truncated and sign-extended 32-bit
  58  *                 operand; used for 32-bit immediates in 64-bit mode.
  59  * \260..\263    - this instruction uses VEX rather than REX, with the
  60  *                 V field taken from operand 0..3.
  61  * \270          - this instruction uses VEX rather than REX, with the
  62  *                 V field set to 1111b.
  63  *
  64  * VEX prefixes are followed by the sequence:
  65  * \mm\wlp         where mm is the M field; and wlp is:
  66  *                 00 0ww lpp
  67  *                 [w0] ww = 0 for W = 0
  68  *                 [w1] ww = 1 for W = 1
  69  *                 [wx] ww = 2 for W don't care (always assembled as 0)
  70  *                 [ww] ww = 3 for W used as REX.W
  71  *
  72  *
  73  * \310          - indicates fixed 16-bit address size, i.e. optional 0x67.
  74  * \311          - indicates fixed 32-bit address size, i.e. optional 0x67.
  75  * \312          - (disassembler only) marker on LOOP, LOOPxx instructions.
  76  * \313          - indicates fixed 64-bit address size, 0x67 invalid.
  77  * \314          - (disassembler only) invalid with REX.B
  78  * \315          - (disassembler only) invalid with REX.X
  79  * \316          - (disassembler only) invalid with REX.R
  80  * \317          - (disassembler only) invalid with REX.W
  81  * \320          - indicates fixed 16-bit operand size, i.e. optional 0x66.
  82  * \321          - indicates fixed 32-bit operand size, i.e. optional 0x66.
  83  * \322          - indicates that this instruction is only valid when the
  84  *                 operand size is the default (instruction to disassembler,
  85  *                 generates no code in the assembler)
  86  * \323          - indicates fixed 64-bit operand size, REX on extensions only.
  87  * \324          - indicates 64-bit operand size requiring REX prefix.
  88  * \330          - a literal byte follows in the code stream, to be added
  89  *                 to the condition code value of the instruction.
  90  * \331          - instruction not valid with REP prefix.  Hint for
  91  *                 disassembler only; for SSE instructions.
  92  * \332          - REP prefix (0xF2 byte) used as opcode extension.
  93  * \333          - REP prefix (0xF3 byte) used as opcode extension.
  94  * \334          - LOCK prefix used instead of REX.R
  95  * \335          - disassemble a rep (0xF3 byte) prefix as repe not rep.
  96  * \336          - force a REP(E) prefix (0xF2) even if not specified.
  97  * \337          - force a REPNE prefix (0xF3) even if not specified.
  98  *                 \336-\337 are still listed as prefixes in the disassembler.
  99  * \340          - reserve <operand 0> bytes of uninitialized storage.
 100  *                 Operand 0 had better be a segmentless constant.
 101  * \360          - no SSE prefix (== \364\331)
 102  * \361          - 66 SSE prefix (== \366\331)
 103  * \362          - F2 SSE prefix (== \364\332)
 104  * \363          - F3 SSE prefix (== \364\333)
 105  * \364          - operand-size prefix (0x66) not permitted
 106  * \365          - address-size prefix (0x67) not permitted
 107  * \366          - operand-size prefix (0x66) used as opcode extension
 108  * \367          - address-size prefix (0x67) used as opcode extension
 109  * \370,\371,\372 - match only if operand 0 meets byte jump criteria.
 110  *                 370 is used for Jcc, 371 is used for JMP.
 111  * \373          - assemble 0x03 if bits==16, 0x05 if bits==32;
 112  *                 used for conditional jump over longer jump
 113  */
 114
 115 #include "compiler.h"
 116
 117 #include <stdio.h>
 118 #include <string.h>
 119 #include <inttypes.h>
 120
 121 #include "nasm.h"
 122 #include "nasmlib.h"
 123 #include "assemble.h"
 124 #include "insns.h"
 125 #include "tables.h"
 126
 127 /* Initialized to zero by the C standard */
 128 static const uint8_t const_zero_buf[256];
 129
 130 typedef struct {
 131     int sib_present;                 /* is a SIB byte necessary? */
 132     int bytes;                       /* # of bytes of offset needed */
 133     int size;                        /* lazy - this is sib+bytes+1 */
 134     uint8_t modrm, sib, rex, rip;    /* the bytes themselves */
 135 } ea;
 136
 137 static uint32_t cpu;            /* cpu level received from nasm.c */
 138 static efunc errfunc;
 139 static struct ofmt *outfmt;
 140 static ListGen *list;
 141
 142 static int64_t calcsize(int32_t, int64_t, int, insn *, const uint8_t *);
 143 static void gencode(int32_t, int64_t, int, insn *, const uint8_t *, int64_t);
 144 static int matches(const struct itemplate *, insn *, int bits);
 145 static int32_t regflag(const operand *);
 146 static int32_t regval(const operand *);
 147 static int rexflags(int, int32_t, int);
 148 static int op_rexflags(const operand *, int);
 149 static ea *process_ea(operand *, ea *, int, int, int, int32_t);
 150 static void add_asp(insn *, int);
 151
 152 static int has_prefix(insn * ins, enum prefix_pos pos, enum prefixes prefix)
 153 {
 154     return ins->prefixes[pos] == prefix;
 155 }
 156
 157 static void assert_no_prefix(insn * ins, enum prefix_pos pos)
 158 {
 159     if (ins->prefixes[pos])
 160         errfunc(ERR_NONFATAL, "invalid %s prefix",
 161                 prefix_name(ins->prefixes[pos]));
 162 }
 163
 164 static const char *size_name(int size)
 165 {
 166     switch (size) {
 167     case 1:
 168         return "byte";
 169     case 2:
 170         return "word";
 171     case 4:
 172         return "dword";
 173     case 8:
 174         return "qword";
 175     case 10:
 176         return "tword";
 177     case 16:
 178         return "oword";
 179     case 32:
 180         return "yword";
 181     default:
 182         return "???";
 183     }
 184 }
 185
 186 static void warn_overflow(int size, int64_t data)
 187 {
 188     if (size < 8) {
 189         int64_t lim = ((int64_t)1 << (size*8))-1;
 190
 191         if (data < ~lim || data > lim)
 192             errfunc(ERR_WARNING | ERR_WARN_NOV,
 193                     "%s data exceeds bounds", size_name(size));
 194     }
 195 }
 196 /*
 197  * This routine wrappers the real output format's output routine,
 198  * in order to pass a copy of the data off to the listing file
 199  * generator at the same time.
 200  */
 201 static void out(int64_t offset, int32_t segto, const void *data,
 202                 enum out_type type, uint64_t size,
 203                 int32_t segment, int32_t wrt)
 204 {
 205     static int32_t lineno = 0;     /* static!!! */
 206     static char *lnfname = NULL;
 207     uint8_t p[8];
 208
 209     if (type == OUT_ADDRESS && segment == NO_SEG && wrt == NO_SEG) {
 210         /*
 211          * This is a non-relocated address, and we're going to
 212          * convert it into RAWDATA format.
 213          */
 214         uint8_t *q = p;
 215
 216         if (size > 8) {
 217             errfunc(ERR_PANIC, "OUT_ADDRESS with size > 8");
 218             return;
 219         }
 220
 221         WRITEADDR(q, *(int64_t *)data, size);
 222         data = p;
 223         type = OUT_RAWDATA;
 224     }
 225
 226     list->output(offset, data, type, size);
 227
 228     /*
 229      * this call to src_get determines when we call the
 230      * debug-format-specific "linenum" function
 231      * it updates lineno and lnfname to the current values
 232      * returning 0 if "same as last time", -2 if lnfname
 233      * changed, and the amount by which lineno changed,
 234      * if it did. thus, these variables must be static
 235      */
 236
 237     if (src_get(&lineno, &lnfname)) {
 238         outfmt->current_dfmt->linenum(lnfname, lineno, segto);
 239     }
 240
 241     outfmt->output(segto, data, type, size, segment, wrt);
 242 }
 243
 244 static bool jmp_match(int32_t segment, int64_t offset, int bits,
 245                      insn * ins, const uint8_t *code)
 246 {
 247     int64_t isize;
 248     uint8_t c = code[0];
 249
 250     if ((c != 0370 && c != 0371) || (ins->oprs[0].type & STRICT))
 251         return false;
 252     if (!optimizing)
 253         return false;
 254     if (optimizing < 0 && c == 0371)
 255         return false;
 256
 257     isize = calcsize(segment, offset, bits, ins, code);
 258     if (ins->oprs[0].segment != segment)
 259         return false;
 260
 261     isize = ins->oprs[0].offset - offset - isize; /* isize is delta */
 262     return (isize >= -128 && isize <= 127); /* is it byte size? */
 263 }
 264
 265 int64_t assemble(int32_t segment, int64_t offset, int bits, uint32_t cp,
 266               insn * instruction, struct ofmt *output, efunc error,
 267               ListGen * listgen)
 268 {
 269     const struct itemplate *temp;
 270     int j;
 271     int size_prob;
 272     int64_t insn_end;
 273     int32_t itimes;
 274     int64_t start = offset;
 275     int64_t wsize = 0;             /* size for DB etc. */
 276
 277     errfunc = error;            /* to pass to other functions */
 278     cpu = cp;
 279     outfmt = output;            /* likewise */
 280     list = listgen;             /* and again */
 281
 282     switch (instruction->opcode) {
 283     case -1:
 284         return 0;
 285     case I_DB:
 286         wsize = 1;
 287         break;
 288     case I_DW:
 289         wsize = 2;
 290         break;
 291     case I_DD:
 292         wsize = 4;
 293         break;
 294     case I_DQ:
 295         wsize = 8;
 296         break;
 297     case I_DT:
 298         wsize = 10;
 299         break;
 300     case I_DO:
 301         wsize = 16;
 302         break;
 303     case I_DY:
 304         wsize = 32;
 305         break;
 306     default:
 307         break;
 308     }
 309
 310     if (wsize) {
 311         extop *e;
 312         int32_t t = instruction->times;
 313         if (t < 0)
 314             errfunc(ERR_PANIC,
 315                     "instruction->times < 0 (%ld) in assemble()", t);
 316
 317         while (t--) {           /* repeat TIMES times */
 318             for (e = instruction->eops; e; e = e->next) {
 319                 if (e->type == EOT_DB_NUMBER) {
 320                     if (wsize == 1) {
 321                         if (e->segment != NO_SEG)
 322                             errfunc(ERR_NONFATAL,
 323                                     "one-byte relocation attempted");
 324                         else {
 325                             uint8_t out_byte = e->offset;
 326                             out(offset, segment, &out_byte,
 327                                 OUT_RAWDATA, 1, NO_SEG, NO_SEG);
 328                         }
 329                     } else if (wsize > 8) {
 330                         errfunc(ERR_NONFATAL,
 331                                 "integer supplied to a DT, DO or DY"
 332                                 " instruction");
 333                     } else
 334                         out(offset, segment, &e->offset,
 335                             OUT_ADDRESS, wsize, e->segment, e->wrt);
 336                     offset += wsize;
 337                 } else if (e->type == EOT_DB_STRING ||
 338                            e->type == EOT_DB_STRING_FREE) {
 339                     int align;
 340
 341                     out(offset, segment, e->stringval,
 342                         OUT_RAWDATA, e->stringlen, NO_SEG, NO_SEG);
 343                     align = e->stringlen % wsize;
 344
 345                     if (align) {
 346                         align = wsize - align;
 347                         out(offset, segment, const_zero_buf,
 348                             OUT_RAWDATA, align, NO_SEG, NO_SEG);
 349                     }
 350                     offset += e->stringlen + align;
 351                 }
 352             }
 353             if (t > 0 && t == instruction->times - 1) {
 354                 /*
 355                  * Dummy call to list->output to give the offset to the
 356                  * listing module.
 357                  */
 358                 list->output(offset, NULL, OUT_RAWDATA, 0);
 359                 list->uplevel(LIST_TIMES);
 360             }
 361         }
 362         if (instruction->times > 1)
 363             list->downlevel(LIST_TIMES);
 364         return offset - start;
 365     }
 366
 367     if (instruction->opcode == I_INCBIN) {
 368         const char *fname = instruction->eops->stringval;
 369         FILE *fp;
 370
 371         fp = fopen(fname, "rb");
 372         if (!fp) {
 373             error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
 374                   fname);
 375         } else if (fseek(fp, 0L, SEEK_END) < 0) {
 376             error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
 377                   fname);
 378         } else {
 379             static char buf[4096];
 380             size_t t = instruction->times;
 381             size_t base = 0;
 382             size_t len;
 383
 384             len = ftell(fp);
 385             if (instruction->eops->next) {
 386                 base = instruction->eops->next->offset;
 387                 len -= base;
 388                 if (instruction->eops->next->next &&
 389                     len > (size_t)instruction->eops->next->next->offset)
 390                     len = (size_t)instruction->eops->next->next->offset;
 391             }
 392             /*
 393              * Dummy call to list->output to give the offset to the
 394              * listing module.
 395              */
 396             list->output(offset, NULL, OUT_RAWDATA, 0);
 397             list->uplevel(LIST_INCBIN);
 398             while (t--) {
 399                 size_t l;
 400
 401                 fseek(fp, base, SEEK_SET);
 402                 l = len;
 403                 while (l > 0) {
 404                     int32_t m =
 405                         fread(buf, 1, (l > (int32_t) sizeof(buf) ? (int32_t) sizeof(buf) : l),
 406                               fp);
 407                     if (!m) {
 408                         /*
 409                          * This shouldn't happen unless the file
 410                          * actually changes while we are reading
 411                          * it.
 412                          */
 413                         error(ERR_NONFATAL,
 414                               "`incbin': unexpected EOF while"
 415                               " reading file `%s'", fname);
 416                         t = 0;  /* Try to exit cleanly */
 417                         break;
 418                     }
 419                     out(offset, segment, buf, OUT_RAWDATA, m,
 420                         NO_SEG, NO_SEG);
 421                     l -= m;
 422                 }
 423             }
 424             list->downlevel(LIST_INCBIN);
 425             if (instruction->times > 1) {
 426                 /*
 427                  * Dummy call to list->output to give the offset to the
 428                  * listing module.
 429                  */
 430                 list->output(offset, NULL, OUT_RAWDATA, 0);
 431                 list->uplevel(LIST_TIMES);
 432                 list->downlevel(LIST_TIMES);
 433             }
 434             fclose(fp);
 435             return instruction->times * len;
 436         }
 437         return 0;               /* if we're here, there's an error */
 438     }
 439
 440     /* Check to see if we need an address-size prefix */
 441     add_asp(instruction, bits);
 442
 443     size_prob = false;
 444
 445     for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++){
 446         int m = matches(temp, instruction, bits);
 447         if (m == 100 ||
 448             (m == 99 && jmp_match(segment, offset, bits,
 449                                   instruction, temp->code))) {
 450             /* Matches! */
 451             const uint8_t *codes = temp->code;
 452             int64_t insn_size = calcsize(segment, offset, bits,
 453                                       instruction, codes);
 454             itimes = instruction->times;
 455             if (insn_size < 0)  /* shouldn't be, on pass two */
 456                 error(ERR_PANIC, "errors made it through from pass one");
 457             else
 458                 while (itimes--) {
 459                     for (j = 0; j < MAXPREFIX; j++) {
 460                         uint8_t c = 0;
 461                         switch (instruction->prefixes[j]) {
 462                         case P_LOCK:
 463                             c = 0xF0;
 464                             break;
 465                         case P_REPNE:
 466                         case P_REPNZ:
 467                             c = 0xF2;
 468                             break;
 469                         case P_REPE:
 470                         case P_REPZ:
 471                         case P_REP:
 472                             c = 0xF3;
 473                             break;
 474                         case R_CS:
 475                             if (bits == 64) {
 476                                 error(ERR_WARNING,
 477                                       "cs segment base generated, but will be ignored in 64-bit mode");
 478                             }
 479                             c = 0x2E;
 480                             break;
 481                         case R_DS:
 482                             if (bits == 64) {
 483                                 error(ERR_WARNING,
 484                                       "ds segment base generated, but will be ignored in 64-bit mode");
 485                             }
 486                             c = 0x3E;
 487                             break;
 488                         case R_ES:
 489                            if (bits == 64) {
 490                                 error(ERR_WARNING,
 491                                       "es segment base generated, but will be ignored in 64-bit mode");
 492                            }
 493                             c = 0x26;
 494                             break;
 495                         case R_FS:
 496                             c = 0x64;
 497                             break;
 498                         case R_GS:
 499                             c = 0x65;
 500                             break;
 501                         case R_SS:
 502                             if (bits == 64) {
 503                                 error(ERR_WARNING,
 504                                       "ss segment base generated, but will be ignored in 64-bit mode");
 505                             }
 506                             c = 0x36;
 507                             break;
 508                         case R_SEGR6:
 509                         case R_SEGR7:
 510                             error(ERR_NONFATAL,
 511                                   "segr6 and segr7 cannot be used as prefixes");
 512                             break;
 513                         case P_A16:
 514                             if (bits == 64) {
 515                                 error(ERR_NONFATAL,
 516                                       "16-bit addressing is not supported "
 517                                       "in 64-bit mode");
 518                             } else if (bits != 16)
 519                                 c = 0x67;
 520                             break;
 521                         case P_A32:
 522                             if (bits != 32)
 523                                 c = 0x67;
 524                             break;
 525                         case P_A64:
 526                             if (bits != 64) {
 527                                 error(ERR_NONFATAL,
 528                                       "64-bit addressing is only supported "
 529                                       "in 64-bit mode");
 530                             }
 531                             break;
 532                         case P_ASP:
 533                             c = 0x67;
 534                             break;
 535                         case P_O16:
 536                             if (bits != 16)
 537                                 c = 0x66;
 538                             break;
 539                         case P_O32:
 540                             if (bits == 16)
 541                                 c = 0x66;
 542                             break;
 543                         case P_O64:
 544                             /* REX.W */
 545                             break;
 546                         case P_OSP:
 547                             c = 0x66;
 548                             break;
 549                         case P_none:
 550                             break;
 551                         default:
 552                             error(ERR_PANIC, "invalid instruction prefix");
 553                         }
 554                         if (c != 0) {
 555                             out(offset, segment, &c, OUT_RAWDATA, 1,
 556                                 NO_SEG, NO_SEG);
 557                             offset++;
 558                         }
 559                     }
 560                     insn_end = offset + insn_size;
 561                     gencode(segment, offset, bits, instruction, codes,
 562                             insn_end);
 563                     offset += insn_size;
 564                     if (itimes > 0 && itimes == instruction->times - 1) {
 565                         /*
 566                          * Dummy call to list->output to give the offset to the
 567                          * listing module.
 568                          */
 569                         list->output(offset, NULL, OUT_RAWDATA, 0);
 570                         list->uplevel(LIST_TIMES);
 571                     }
 572                 }
 573             if (instruction->times > 1)
 574                 list->downlevel(LIST_TIMES);
 575             return offset - start;
 576         } else if (m > 0 && m > size_prob) {
 577             size_prob = m;
 578         }
 579     }
 580
 581     if (temp->opcode == -1) {   /* didn't match any instruction */
 582         switch (size_prob) {
 583         case 1:
 584             error(ERR_NONFATAL, "operation size not specified");
 585             break;
 586         case 2:
 587             error(ERR_NONFATAL, "mismatch in operand sizes");
 588             break;
 589         case 3:
 590             error(ERR_NONFATAL, "no instruction for this cpu level");
 591             break;
 592         case 4:
 593             error(ERR_NONFATAL, "instruction not supported in 64-bit mode");
 594             break;
 595         default:
 596             error(ERR_NONFATAL,
 597                   "invalid combination of opcode and operands");
 598             break;
 599         }
 600     }
 601     return 0;
 602 }
 603
 604 int64_t insn_size(int32_t segment, int64_t offset, int bits, uint32_t cp,
 605                insn * instruction, efunc error)
 606 {
 607     const struct itemplate *temp;
 608
 609     errfunc = error;            /* to pass to other functions */
 610     cpu = cp;
 611
 612     if (instruction->opcode == -1)
 613         return 0;
 614
 615     if (instruction->opcode == I_DB || instruction->opcode == I_DW ||
 616         instruction->opcode == I_DD || instruction->opcode == I_DQ ||
 617         instruction->opcode == I_DT || instruction->opcode == I_DO ||
 618         instruction->opcode == I_DY) {
 619         extop *e;
 620         int32_t isize, osize, wsize = 0;   /* placate gcc */
 621
 622         isize = 0;
 623         switch (instruction->opcode) {
 624         case I_DB:
 625             wsize = 1;
 626             break;
 627         case I_DW:
 628             wsize = 2;
 629             break;
 630         case I_DD:
 631             wsize = 4;
 632             break;
 633         case I_DQ:
 634             wsize = 8;
 635             break;
 636         case I_DT:
 637             wsize = 10;
 638             break;
 639         case I_DO:
 640             wsize = 16;
 641             break;
 642         case I_DY:
 643             wsize = 32;
 644             break;
 645         default:
 646             break;
 647         }
 648
 649         for (e = instruction->eops; e; e = e->next) {
 650             int32_t align;
 651
 652             osize = 0;
 653             if (e->type == EOT_DB_NUMBER)
 654                 osize = 1;
 655             else if (e->type == EOT_DB_STRING ||
 656                      e->type == EOT_DB_STRING_FREE)
 657                 osize = e->stringlen;
 658
 659             align = (-osize) % wsize;
 660             if (align < 0)
 661                 align += wsize;
 662             isize += osize + align;
 663         }
 664         return isize * instruction->times;
 665     }
 666
 667     if (instruction->opcode == I_INCBIN) {
 668         const char *fname = instruction->eops->stringval;
 669         FILE *fp;
 670         size_t len;
 671
 672         fp = fopen(fname, "rb");
 673         if (!fp)
 674             error(ERR_NONFATAL, "`incbin': unable to open file `%s'",
 675                   fname);
 676         else if (fseek(fp, 0L, SEEK_END) < 0)
 677             error(ERR_NONFATAL, "`incbin': unable to seek on file `%s'",
 678                   fname);
 679         else {
 680             len = ftell(fp);
 681             fclose(fp);
 682             if (instruction->eops->next) {
 683                 len -= instruction->eops->next->offset;
 684                 if (instruction->eops->next->next &&
 685                     len > (size_t)instruction->eops->next->next->offset) {
 686                     len = (size_t)instruction->eops->next->next->offset;
 687                 }
 688             }
 689             return instruction->times * len;
 690         }
 691         return 0;               /* if we're here, there's an error */
 692     }
 693
 694     /* Check to see if we need an address-size prefix */
 695     add_asp(instruction, bits);
 696
 697     for (temp = nasm_instructions[instruction->opcode]; temp->opcode != -1; temp++) {
 698         int m = matches(temp, instruction, bits);
 699         if (m == 100 ||
 700             (m == 99 && jmp_match(segment, offset, bits,
 701                                   instruction, temp->code))) {
 702             /* we've matched an instruction. */
 703             int64_t isize;
 704             const uint8_t *codes = temp->code;
 705             int j;
 706
 707             isize = calcsize(segment, offset, bits, instruction, codes);
 708             if (isize < 0)
 709                 return -1;
 710             for (j = 0; j < MAXPREFIX; j++) {
 711                 switch (instruction->prefixes[j]) {
 712                 case P_A16:
 713                     if (bits != 16)
 714                         isize++;
 715                     break;
 716                 case P_A32:
 717                     if (bits != 32)
 718                         isize++;
 719                     break;
 720                 case P_O16:
 721                     if (bits != 16)
 722                         isize++;
 723                     break;
 724                 case P_O32:
 725                     if (bits == 16)
 726                         isize++;
 727                     break;
 728                 case P_A64:
 729                 case P_O64:
 730                 case P_none:
 731                     break;
 732                 default:
 733                     isize++;
 734                     break;
 735                 }
 736             }
 737             return isize * instruction->times;
 738         }
 739     }
 740     return -1;                  /* didn't match any instruction */
 741 }
 742
 743 static bool possible_sbyte(operand *o)
 744 {
 745     return !(o->opflags & OPFLAG_FORWARD) &&
 746         optimizing >= 0 && !(o->type & STRICT) &&
 747         o->wrt == NO_SEG && o->segment == NO_SEG;
 748 }
 749
 750 /* check that opn[op]  is a signed byte of size 16 or 32 */
 751 static bool is_sbyte16(operand *o)
 752 {
 753     int16_t v;
 754
 755     if (!possible_sbyte(o))
 756         return false;
 757
 758     v = o->offset;
 759     return v >= -128 && v <= 127;
 760 }
 761
 762 static bool is_sbyte32(operand *o)
 763 {
 764     int32_t v;
 765
 766     if (!possible_sbyte(o))
 767         return false;
 768
 769     v = o->offset;
 770     return v >= -128 && v <= 127;
 771 }
 772
 773 /* check that  opn[op]  is a signed byte of size 32; warn if this is not
 774    the original value when extended to 64 bits */
 775 static bool is_sbyte64(operand *o)
 776 {
 777     int64_t v64;
 778     int32_t v32;
 779
 780     /* dead in the water on forward reference or External */
 781     if (!possible_sbyte(o))
 782         return false;
 783
 784     v64 = o->offset;
 785     v32 = (int32_t)v64;
 786
 787     warn_overflow(32, v64);
 788
 789     return v32 >= -128 && v32 <= 127;
 790 }
 791 static int64_t calcsize(int32_t segment, int64_t offset, int bits,
 792                      insn * ins, const uint8_t *codes)
 793 {
 794     int64_t length = 0;
 795     uint8_t c;
 796     int rex_mask = ~0;
 797     struct operand *opx;
 798
 799     ins->rex = 0;               /* Ensure REX is reset */
 800
 801     if (ins->prefixes[PPS_OSIZE] == P_O64)
 802         ins->rex |= REX_W;
 803
 804     (void)segment;              /* Don't warn that this parameter is unused */
 805     (void)offset;               /* Don't warn that this parameter is unused */
 806
 807     while (*codes) {
 808         c = *codes++;
 809         opx = &ins->oprs[c & 3];
 810         switch (c) {
 811         case 01:
 812         case 02:
 813         case 03:
 814             codes += c, length += c;
 815             break;
 816         case 04:
 817         case 05:
 818         case 06:
 819         case 07:
 820             length++;
 821             break;
 822         case 010:
 823         case 011:
 824         case 012:
 825         case 013:
 826             ins->rex |=
 827                 op_rexflags(opx, REX_B|REX_H|REX_P|REX_W);
 828             codes++, length++;
 829             break;
 830         case 014:
 831         case 015:
 832         case 016:
 833         case 017:
 834             length++;
 835             break;
 836         case 020:
 837         case 021:
 838         case 022:
 839         case 023:
 840             length++;
 841             break;
 842         case 024:
 843         case 025:
 844         case 026:
 845         case 027:
 846             length++;
 847             break;
 848         case 030:
 849         case 031:
 850         case 032:
 851         case 033:
 852             length += 2;
 853             break;
 854         case 034:
 855         case 035:
 856         case 036:
 857         case 037:
 858             if (opx->type & (BITS16 | BITS32 | BITS64))
 859                 length += (opx->type & BITS16) ? 2 : 4;
 860             else
 861                 length += (bits == 16) ? 2 : 4;
 862             break;
 863         case 040:
 864         case 041:
 865         case 042:
 866         case 043:
 867             length += 4;
 868             break;
 869         case 044:
 870         case 045:
 871         case 046:
 872         case 047:
 873             length += ins->addr_size >> 3;
 874             break;
 875         case 050:
 876         case 051:
 877         case 052:
 878         case 053:
 879             length++;
 880             break;
 881         case 054:
 882         case 055:
 883         case 056:
 884         case 057:
 885             length += 8; /* MOV reg64/imm */
 886             break;
 887         case 060:
 888         case 061:
 889         case 062:
 890         case 063:
 891             length += 2;
 892             break;
 893         case 064:
 894         case 065:
 895         case 066:
 896         case 067:
 897             if (opx->type & (BITS16 | BITS32 | BITS64))
 898                 length += (opx->type & BITS16) ? 2 : 4;
 899             else
 900                 length += (bits == 16) ? 2 : 4;
 901             break;
 902         case 070:
 903         case 071:
 904         case 072:
 905         case 073:
 906             length += 4;
 907             break;
 908         case 074:
 909         case 075:
 910         case 076:
 911         case 077:
 912             length += 2;
 913             break;
 914         case 0140:
 915         case 0141:
 916         case 0142:
 917         case 0143:
 918             length += is_sbyte16(opx) ? 1 : 2;
 919             break;
 920         case 0144:
 921         case 0145:
 922         case 0146:
 923         case 0147:
 924             codes++;
 925             length++;
 926             break;
 927         case 0150:
 928         case 0151:
 929         case 0152:
 930         case 0153:
 931             length += is_sbyte32(opx) ? 1 : 4;
 932             break;
 933         case 0154:
 934         case 0155:
 935         case 0156:
 936         case 0157:
 937             codes++;
 938             length++;
 939             break;
 940         case 0160:
 941         case 0161:
 942         case 0162:
 943         case 0163:
 944             length++;
 945             ins->rex |= REX_D;
 946             ins->drexdst = regval(opx);
 947             break;
 948         case 0164:
 949         case 0165:
 950         case 0166:
 951         case 0167:
 952             length++;
 953             ins->rex |= REX_D|REX_OC;
 954             ins->drexdst = regval(opx);
 955             break;
 956         case 0171:
 957             break;
 958         case 0172:
 959         case 0173:
 960         case 0174:
 961             codes++;
 962             length++;
 963             break;
 964         case 0250:
 965         case 0251:
 966         case 0252:
 967         case 0253:
 968             length += is_sbyte64(opx) ? 1 : 4;
 969             break;
 970         case 0260:
 971         case 0261:
 972         case 0262:
 973         case 0263:
 974             ins->rex |= REX_V;
 975             ins->drexdst = regval(opx);
 976             ins->vex_m = *codes++;
 977             ins->vex_wlp = *codes++;
 978             break;
 979         case 0270:
 980             ins->rex |= REX_V;
 981             ins->drexdst = 0;
 982             ins->vex_m = *codes++;
 983             ins->vex_wlp = *codes++;
 984             break;
 985         case 0300:
 986         case 0301:
 987         case 0302:
 988         case 0303:
 989             break;
 990         case 0310:
 991             if (bits == 64)
 992                 return -1;
 993             length += (bits != 16) && !has_prefix(ins, PPS_ASIZE, P_A16);
 994             break;
 995         case 0311:
 996             length += (bits != 32) && !has_prefix(ins, PPS_ASIZE, P_A32);
 997             break;
 998         case 0312:
 999             break;
1000         case 0313:
1001             if (bits != 64 || has_prefix(ins, PPS_ASIZE, P_A16) ||
1002                 has_prefix(ins, PPS_ASIZE, P_A32))
1003                 return -1;
1004             break;
1005         case 0314:
1006         case 0315:
1007         case 0316:
1008         case 0317:
1009             break;
1010         case 0320:
1011             length += (bits != 16);
1012             break;
1013         case 0321:
1014             length += (bits == 16);
1015             break;
1016         case 0322:
1017             break;
1018         case 0323:
1019             rex_mask &= ~REX_W;
1020             break;
1021         case 0324:
1022             ins->rex |= REX_W;
1023             break;
1024         case 0330:
1025             codes++, length++;
1026             break;
1027         case 0331:
1028             break;
1029         case 0332:
1030         case 0333:
1031             length++;
1032             break;
1033         case 0334:
1034             ins->rex |= REX_L;
1035             break;
1036         case 0335:
1037             break;
1038         case 0336:
1039             if (!ins->prefixes[PPS_LREP])
1040                 ins->prefixes[PPS_LREP] = P_REP;
1041             break;
1042         case 0337:
1043             if (!ins->prefixes[PPS_LREP])
1044                 ins->prefixes[PPS_LREP] = P_REPNE;
1045             break;
1046         case 0340:
1047             if (ins->oprs[0].segment != NO_SEG)
1048                 errfunc(ERR_NONFATAL, "attempt to reserve non-constant"
1049                         " quantity of BSS space");
1050             else
1051                 length += ins->oprs[0].offset;
1052             break;
1053         case 0360:
1054             break;
1055         case 0361:
1056         case 0362:
1057         case 0363:
1058             length++;
1059             break;
1060         case 0364:
1061         case 0365:
1062             break;
1063         case 0366:
1064         case 0367:
1065             length++;
1066             break;
1067         case 0370:
1068         case 0371:
1069         case 0372:
1070             break;
1071         case 0373:
1072             length++;
1073             break;
1074         default:               /* can't do it by 'case' statements */
1075             if (c >= 0100 && c <= 0277) {       /* it's an EA */
1076                 ea ea_data;
1077                 int rfield;
1078                 int32_t rflags;
1079                 ea_data.rex = 0;           /* Ensure ea.REX is initially 0 */
1080
1081                 if (c <= 0177) {
1082                     /* pick rfield from operand b */
1083                     rflags = regflag(&ins->oprs[c & 7]);
1084                     rfield = nasm_regvals[ins->oprs[c & 7].basereg];
1085                 } else {
1086                     rflags = 0;
1087                     rfield = c & 7;
1088                 }
1089
1090                 if (!process_ea
1091                     (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1092                      ins->addr_size, rfield, rflags)) {
1093                     errfunc(ERR_NONFATAL, "invalid effective address");
1094                     return -1;
1095                 } else {
1096                     ins->rex |= ea_data.rex;
1097                     length += ea_data.size;
1098                 }
1099             } else {
1100                 errfunc(ERR_PANIC, "internal instruction table corrupt"
1101                         ": instruction code 0x%02X given", c);
1102             }
1103         }
1104     }
1105
1106     ins->rex &= rex_mask;
1107
1108     if (ins->rex & REX_V) {
1109         int bad32 = REX_R|REX_W|REX_X|REX_B;
1110
1111         if (ins->rex & REX_H) {
1112             errfunc(ERR_NONFATAL, "cannot use high register in vex instruction");
1113             return -1;
1114         }
1115         switch (ins->vex_wlp & 030) {
1116         case 000:
1117         case 020:
1118             ins->rex &= ~REX_W;
1119             break;
1120         case 010:
1121             ins->rex |= REX_W;
1122             bad32 &= ~REX_W;
1123             break;
1124         case 030:
1125             /* Follow REX_W */
1126             break;
1127         }
1128
1129         if (bits != 64 && ((ins->rex & bad32) || ins->drexdst > 7)) {
1130             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1131             return -1;
1132         }
1133         if (ins->vex_m != 1 || (ins->rex & (REX_W|REX_R|REX_B)))
1134             length += 3;
1135         else
1136             length += 2;
1137     } else if (ins->rex & REX_D) {
1138         if (ins->rex & REX_H) {
1139             errfunc(ERR_NONFATAL, "cannot use high register in drex instruction");
1140             return -1;
1141         }
1142         if (bits != 64 && ((ins->rex & (REX_R|REX_W|REX_X|REX_B)) ||
1143                            ins->drexdst > 7)) {
1144             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1145             return -1;
1146         }
1147         length++;
1148     } else if (ins->rex & REX_REAL) {
1149         if (ins->rex & REX_H) {
1150             errfunc(ERR_NONFATAL, "cannot use high register in rex instruction");
1151             return -1;
1152         } else if (bits == 64) {
1153             length++;
1154         } else if ((ins->rex & REX_L) &&
1155                    !(ins->rex & (REX_P|REX_W|REX_X|REX_B)) &&
1156                    cpu >= IF_X86_64) {
1157             /* LOCK-as-REX.R */
1158             assert_no_prefix(ins, PPS_LREP);
1159             length++;
1160         } else {
1161             errfunc(ERR_NONFATAL, "invalid operands in non-64-bit mode");
1162             return -1;
1163         }
1164     }
1165
1166     return length;
1167 }
1168
1169 #define EMIT_REX()                                                      \
1170     if (!(ins->rex & (REX_D|REX_V)) && (ins->rex & REX_REAL) && (bits == 64)) { \
1171         ins->rex = (ins->rex & REX_REAL)|REX_P;                         \
1172         out(offset, segment, &ins->rex, OUT_RAWDATA, 1, NO_SEG, NO_SEG); \
1173         ins->rex = 0;                                                   \
1174         offset += 1; \
1175     }
1176
1177 static void gencode(int32_t segment, int64_t offset, int bits,
1178                     insn * ins, const uint8_t *codes, int64_t insn_end)
1179 {
1180     static char condval[] = {   /* conditional opcodes */
1181         0x7, 0x3, 0x2, 0x6, 0x2, 0x4, 0xF, 0xD, 0xC, 0xE, 0x6, 0x2,
1182         0x3, 0x7, 0x3, 0x5, 0xE, 0xC, 0xD, 0xF, 0x1, 0xB, 0x9, 0x5,
1183         0x0, 0xA, 0xA, 0xB, 0x8, 0x4
1184     };
1185     uint8_t c;
1186     uint8_t bytes[4];
1187     int64_t size;
1188     int64_t data;
1189     struct operand *opx;
1190
1191     while (*codes) {
1192         c = *codes++;
1193         opx = &ins->oprs[c & 3];
1194         switch (c) {
1195         case 01:
1196         case 02:
1197         case 03:
1198             EMIT_REX();
1199             out(offset, segment, codes, OUT_RAWDATA, c, NO_SEG, NO_SEG);
1200             codes += c;
1201             offset += c;
1202             break;
1203
1204         case 04:
1205         case 06:
1206             switch (ins->oprs[0].basereg) {
1207             case R_CS:
1208                 bytes[0] = 0x0E + (c == 0x04 ? 1 : 0);
1209                 break;
1210             case R_DS:
1211                 bytes[0] = 0x1E + (c == 0x04 ? 1 : 0);
1212                 break;
1213             case R_ES:
1214                 bytes[0] = 0x06 + (c == 0x04 ? 1 : 0);
1215                 break;
1216             case R_SS:
1217                 bytes[0] = 0x16 + (c == 0x04 ? 1 : 0);
1218                 break;
1219             default:
1220                 errfunc(ERR_PANIC,
1221                         "bizarre 8086 segment register received");
1222             }
1223             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1224             offset++;
1225             break;
1226
1227         case 05:
1228         case 07:
1229             switch (ins->oprs[0].basereg) {
1230             case R_FS:
1231                 bytes[0] = 0xA0 + (c == 0x05 ? 1 : 0);
1232                 break;
1233             case R_GS:
1234                 bytes[0] = 0xA8 + (c == 0x05 ? 1 : 0);
1235                 break;
1236             default:
1237                 errfunc(ERR_PANIC,
1238                         "bizarre 386 segment register received");
1239             }
1240             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1241             offset++;
1242             break;
1243
1244         case 010:
1245         case 011:
1246         case 012:
1247         case 013:
1248             EMIT_REX();
1249             bytes[0] = *codes++ + ((regval(opx)) & 7);
1250             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1251             offset += 1;
1252             break;
1253
1254         case 014:
1255         case 015:
1256         case 016:
1257         case 017:
1258             /* XXX: warns for legitimate optimizer actions */
1259             if (opx->offset < -128 || opx->offset > 127) {
1260                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1261                         "signed byte value exceeds bounds");
1262             }
1263
1264             if (opx->segment != NO_SEG) {
1265                 data = opx->offset;
1266                 out(offset, segment, &data, OUT_ADDRESS, 1,
1267                     opx->segment, opx->wrt);
1268             } else {
1269                 bytes[0] = opx->offset;
1270                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1271                     NO_SEG);
1272             }
1273             offset += 1;
1274             break;
1275
1276         case 020:
1277         case 021:
1278         case 022:
1279         case 023:
1280             if (opx->offset < -256 || opx->offset > 255) {
1281                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1282                         "byte value exceeds bounds");
1283             }
1284             if (opx->segment != NO_SEG) {
1285                 data = opx->offset;
1286                 out(offset, segment, &data, OUT_ADDRESS, 1,
1287                     opx->segment, opx->wrt);
1288             } else {
1289                 bytes[0] = opx->offset;
1290                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1291                     NO_SEG);
1292             }
1293             offset += 1;
1294             break;
1295
1296         case 024:
1297         case 025:
1298         case 026:
1299         case 027:
1300             if (opx->offset < 0 || opx->offset > 255)
1301                 errfunc(ERR_WARNING | ERR_WARN_NOV,
1302                         "unsigned byte value exceeds bounds");
1303             if (opx->segment != NO_SEG) {
1304                 data = opx->offset;
1305                 out(offset, segment, &data, OUT_ADDRESS, 1,
1306                     opx->segment, opx->wrt);
1307             } else {
1308                 bytes[0] = opx->offset;
1309                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1310                     NO_SEG);
1311             }
1312             offset += 1;
1313             break;
1314
1315         case 030:
1316         case 031:
1317         case 032:
1318         case 033:
1319             data = opx->offset;
1320             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1321                 warn_overflow(2, data);
1322             out(offset, segment, &data, OUT_ADDRESS, 2,
1323                 opx->segment, opx->wrt);
1324             offset += 2;
1325             break;
1326
1327         case 034:
1328         case 035:
1329         case 036:
1330         case 037:
1331             if (opx->type & (BITS16 | BITS32))
1332                 size = (opx->type & BITS16) ? 2 : 4;
1333             else
1334                 size = (bits == 16) ? 2 : 4;
1335             data = opx->offset;
1336             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1337                 warn_overflow(size, data);
1338             out(offset, segment, &data, OUT_ADDRESS, size,
1339                 opx->segment, opx->wrt);
1340             offset += size;
1341             break;
1342
1343         case 040:
1344         case 041:
1345         case 042:
1346         case 043:
1347             data = opx->offset;
1348             if (opx->segment == NO_SEG && opx->wrt == NO_SEG)
1349                 warn_overflow(4, data);
1350             out(offset, segment, &data, OUT_ADDRESS, 4,
1351                 opx->segment, opx->wrt);
1352             offset += 4;
1353             break;
1354
1355         case 044:
1356         case 045:
1357         case 046:
1358         case 047:
1359             data = opx->offset;
1360             size = ins->addr_size >> 3;
1361             if (opx->segment == NO_SEG &&
1362                 opx->wrt == NO_SEG)
1363                 warn_overflow(size, data);
1364             out(offset, segment, &data, OUT_ADDRESS, size,
1365                 opx->segment, opx->wrt);
1366             offset += size;
1367             break;
1368
1369         case 050:
1370         case 051:
1371         case 052:
1372         case 053:
1373             if (opx->segment != segment)
1374                 errfunc(ERR_NONFATAL,
1375                         "short relative jump outside segment");
1376             data = opx->offset - insn_end;
1377             if (data > 127 || data < -128)
1378                 errfunc(ERR_NONFATAL, "short jump is out of range");
1379             bytes[0] = data;
1380             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1381             offset += 1;
1382             break;
1383
1384         case 054:
1385         case 055:
1386         case 056:
1387         case 057:
1388             data = (int64_t)opx->offset;
1389             out(offset, segment, &data, OUT_ADDRESS, 8,
1390                 opx->segment, opx->wrt);
1391             offset += 8;
1392             break;
1393
1394         case 060:
1395         case 061:
1396         case 062:
1397         case 063:
1398             if (opx->segment != segment) {
1399                 data = opx->offset;
1400                 out(offset, segment, &data,
1401                     OUT_REL2ADR, insn_end - offset,
1402                     opx->segment, opx->wrt);
1403             } else {
1404                 data = opx->offset - insn_end;
1405                 out(offset, segment, &data,
1406                     OUT_ADDRESS, 2, NO_SEG, NO_SEG);
1407             }
1408             offset += 2;
1409             break;
1410
1411         case 064:
1412         case 065:
1413         case 066:
1414         case 067:
1415             if (opx->type & (BITS16 | BITS32 | BITS64))
1416                 size = (opx->type & BITS16) ? 2 : 4;
1417             else
1418                 size = (bits == 16) ? 2 : 4;
1419             if (opx->segment != segment) {
1420                 data = opx->offset;
1421                 out(offset, segment, &data,
1422                     size == 2 ? OUT_REL2ADR : OUT_REL4ADR,
1423                     insn_end - offset, opx->segment, opx->wrt);
1424             } else {
1425                 data = opx->offset - insn_end;
1426                 out(offset, segment, &data,
1427                     OUT_ADDRESS, size, NO_SEG, NO_SEG);
1428             }
1429             offset += size;
1430             break;
1431
1432         case 070:
1433         case 071:
1434         case 072:
1435         case 073:
1436             if (opx->segment != segment) {
1437                 data = opx->offset;
1438                 out(offset, segment, &data,
1439                     OUT_REL4ADR, insn_end - offset,
1440                     opx->segment, opx->wrt);
1441             } else {
1442                 data = opx->offset - insn_end;
1443                 out(offset, segment, &data,
1444                     OUT_ADDRESS, 4, NO_SEG, NO_SEG);
1445             }
1446             offset += 4;
1447             break;
1448
1449         case 074:
1450         case 075:
1451         case 076:
1452         case 077:
1453             if (opx->segment == NO_SEG)
1454                 errfunc(ERR_NONFATAL, "value referenced by FAR is not"
1455                         " relocatable");
1456             data = 0;
1457             out(offset, segment, &data, OUT_ADDRESS, 2,
1458                 outfmt->segbase(1 + opx->segment),
1459                 opx->wrt);
1460             offset += 2;
1461             break;
1462
1463         case 0140:
1464         case 0141:
1465         case 0142:
1466         case 0143:
1467             data = opx->offset;
1468             if (is_sbyte16(opx)) {
1469                 bytes[0] = data;
1470                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1471                     NO_SEG);
1472                 offset++;
1473             } else {
1474                 if (opx->segment == NO_SEG &&
1475                     opx->wrt == NO_SEG)
1476                     warn_overflow(2, data);
1477                 out(offset, segment, &data, OUT_ADDRESS, 2,
1478                     opx->segment, opx->wrt);
1479                 offset += 2;
1480             }
1481             break;
1482
1483         case 0144:
1484         case 0145:
1485         case 0146:
1486         case 0147:
1487             EMIT_REX();
1488             bytes[0] = *codes++;
1489             if (is_sbyte16(opx))
1490                 bytes[0] |= 2;  /* s-bit */
1491             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1492             offset++;
1493             break;
1494
1495         case 0150:
1496         case 0151:
1497         case 0152:
1498         case 0153:
1499             data = opx->offset;
1500             if (is_sbyte32(opx)) {
1501                 bytes[0] = data;
1502                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1503                     NO_SEG);
1504                 offset++;
1505             } else {
1506                 out(offset, segment, &data, OUT_ADDRESS, 4,
1507                     opx->segment, opx->wrt);
1508                 offset += 4;
1509             }
1510             break;
1511
1512         case 0154:
1513         case 0155:
1514         case 0156:
1515         case 0157:
1516             EMIT_REX();
1517             bytes[0] = *codes++;
1518             if (is_sbyte32(opx))
1519                 bytes[0] |= 2;  /* s-bit */
1520             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1521             offset++;
1522             break;
1523
1524         case 0160:
1525         case 0161:
1526         case 0162:
1527         case 0163:
1528         case 0164:
1529         case 0165:
1530         case 0166:
1531         case 0167:
1532             break;
1533
1534         case 0171:
1535             bytes[0] =
1536                 (ins->drexdst << 4) |
1537                 (ins->rex & REX_OC ? 0x08 : 0) |
1538                 (ins->rex & (REX_R|REX_X|REX_B));
1539             ins->rex = 0;
1540             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1541             offset++;
1542             break;
1543
1544         case 0172:
1545             c = *codes++;
1546             opx = &ins->oprs[c >> 3];
1547             bytes[0] = nasm_regvals[opx->basereg] << 4;
1548             opx = &ins->oprs[c & 7];
1549             if (opx->segment != NO_SEG || opx->wrt != NO_SEG) {
1550                 errfunc(ERR_NONFATAL,
1551                         "non-absolute expression not permitted as argument %d",
1552                         c & 7);
1553             } else {
1554                 if (opx->offset & ~15) {
1555                     errfunc(ERR_WARNING | ERR_WARN_NOV,
1556                             "four-bit argument exceeds bounds");
1557                 }
1558                 bytes[0] |= opx->offset & 15;
1559             }
1560             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1561             offset++;
1562             break;
1563
1564         case 0173:
1565             c = *codes++;
1566             opx = &ins->oprs[c >> 4];
1567             bytes[0] = nasm_regvals[opx->basereg] << 4;
1568             bytes[0] |= c & 15;
1569             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1570             offset++;
1571             break;
1572
1573         case 0174:
1574             c = *codes++;
1575             opx = &ins->oprs[c];
1576             bytes[0] = nasm_regvals[opx->basereg] << 4;
1577             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1578             offset++;
1579             break;
1580
1581         case 0250:
1582         case 0251:
1583         case 0252:
1584         case 0253:
1585             data = opx->offset;
1586             /* is_sbyte32() is right here, we have already warned */
1587             if (is_sbyte32(opx)) {
1588                 bytes[0] = data;
1589                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG,
1590                     NO_SEG);
1591                 offset++;
1592             } else {
1593                 out(offset, segment, &data, OUT_ADDRESS, 4,
1594                     opx->segment, opx->wrt);
1595                 offset += 4;
1596             }
1597             break;
1598
1599         case 0260:
1600         case 0261:
1601         case 0262:
1602         case 0263:
1603         case 0270:
1604             codes += 2;
1605             if (ins->vex_m != 1 || (ins->rex & (REX_W|REX_X|REX_B))) {
1606                 bytes[0] = 0xc4;
1607                 bytes[1] = ins->vex_m | ((~ins->rex & 7) << 5);
1608                 bytes[2] = ((ins->rex & REX_W) << (7-3)) |
1609                     ((~ins->drexdst & 15)<< 3) | (ins->vex_wlp & 07);
1610                 out(offset, segment, &bytes, OUT_RAWDATA, 3, NO_SEG, NO_SEG);
1611                 offset += 3;
1612             } else {
1613                 bytes[0] = 0xc5;
1614                 bytes[1] = ((~ins->rex & REX_R) << (7-2)) |
1615                     ((~ins->drexdst & 15) << 3) | (ins->vex_wlp & 07);
1616                 out(offset, segment, &bytes, OUT_RAWDATA, 2, NO_SEG, NO_SEG);
1617                 offset += 2;
1618             }
1619             break;
1620
1621         case 0300:
1622         case 0301:
1623         case 0302:
1624         case 0303:
1625             break;
1626
1627         case 0310:
1628             if (bits == 32 && !has_prefix(ins, PPS_ASIZE, P_A16)) {
1629                 *bytes = 0x67;
1630                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1631                 offset += 1;
1632             } else
1633                 offset += 0;
1634             break;
1635
1636         case 0311:
1637             if (bits != 32 && !has_prefix(ins, PPS_ASIZE, P_A32)) {
1638                 *bytes = 0x67;
1639                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1640                 offset += 1;
1641             } else
1642                 offset += 0;
1643             break;
1644
1645         case 0312:
1646             break;
1647
1648         case 0313:
1649             ins->rex = 0;
1650             break;
1651
1652         case 0314:
1653         case 0315:
1654         case 0316:
1655         case 0317:
1656             break;
1657
1658         case 0320:
1659             if (bits != 16) {
1660                 *bytes = 0x66;
1661                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1662                 offset += 1;
1663             } else
1664                 offset += 0;
1665             break;
1666
1667         case 0321:
1668             if (bits == 16) {
1669                 *bytes = 0x66;
1670                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1671                 offset += 1;
1672             } else
1673                 offset += 0;
1674             break;
1675
1676         case 0322:
1677         case 0323:
1678             break;
1679
1680         case 0324:
1681             ins->rex |= REX_W;
1682             break;
1683
1684         case 0330:
1685             *bytes = *codes++ ^ condval[ins->condition];
1686             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1687             offset += 1;
1688             break;
1689
1690         case 0331:
1691             break;
1692
1693         case 0332:
1694         case 0333:
1695             *bytes = c - 0332 + 0xF2;
1696             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1697             offset += 1;
1698             break;
1699
1700         case 0334:
1701             if (ins->rex & REX_R) {
1702                 *bytes = 0xF0;
1703                 out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1704                 offset += 1;
1705             }
1706             ins->rex &= ~(REX_L|REX_R);
1707             break;
1708
1709         case 0335:
1710             break;
1711
1712         case 0336:
1713         case 0337:
1714             break;
1715
1716         case 0340:
1717             if (ins->oprs[0].segment != NO_SEG)
1718                 errfunc(ERR_PANIC, "non-constant BSS size in pass two");
1719             else {
1720                 int64_t size = ins->oprs[0].offset;
1721                 if (size > 0)
1722                     out(offset, segment, NULL,
1723                         OUT_RESERVE, size, NO_SEG, NO_SEG);
1724                 offset += size;
1725             }
1726             break;
1727
1728         case 0360:
1729             break;
1730
1731         case 0361:
1732             bytes[0] = 0x66;
1733             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1734             offset += 1;
1735             break;
1736
1737         case 0362:
1738         case 0363:
1739             bytes[0] = c - 0362 + 0xf2;
1740             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1741             offset += 1;
1742             break;
1743
1744         case 0364:
1745         case 0365:
1746             break;
1747
1748         case 0366:
1749         case 0367:
1750             *bytes = c - 0366 + 0x66;
1751             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1752             offset += 1;
1753             break;
1754
1755         case 0370:
1756         case 0371:
1757         case 0372:
1758             break;
1759
1760         case 0373:
1761             *bytes = bits == 16 ? 3 : 5;
1762             out(offset, segment, bytes, OUT_RAWDATA, 1, NO_SEG, NO_SEG);
1763             offset += 1;
1764             break;
1765
1766         default:               /* can't do it by 'case' statements */
1767             if (c >= 0100 && c <= 0277) {       /* it's an EA */
1768                 ea ea_data;
1769                 int rfield;
1770                 int32_t rflags;
1771                 uint8_t *p;
1772                 int32_t s;
1773
1774                 if (c <= 0177) {
1775                     /* pick rfield from operand b */
1776                     rflags = regflag(&ins->oprs[c & 7]);
1777                     rfield = nasm_regvals[ins->oprs[c & 7].basereg];
1778                 } else {
1779                     /* rfield is constant */
1780                     rflags = 0;
1781                     rfield = c & 7;
1782                 }
1783
1784                 if (!process_ea
1785                     (&ins->oprs[(c >> 3) & 7], &ea_data, bits,
1786                      ins->addr_size, rfield, rflags)) {
1787                     errfunc(ERR_NONFATAL, "invalid effective address");
1788                 }
1789
1790
1791                 p = bytes;
1792                 *p++ = ea_data.modrm;
1793                 if (ea_data.sib_present)
1794                     *p++ = ea_data.sib;
1795
1796                 /* DREX suffixes come between the SIB and the displacement */
1797                 if (ins->rex & REX_D) {
1798                     *p++ =
1799                         (ins->drexdst << 4) |
1800                         (ins->rex & REX_OC ? 0x08 : 0) |
1801                         (ins->rex & (REX_R|REX_X|REX_B));
1802                     ins->rex = 0;
1803                 }
1804
1805                 s = p - bytes;
1806                 out(offset, segment, bytes, OUT_RAWDATA, s, NO_SEG, NO_SEG);
1807
1808                 /*
1809                  * Make sure the address gets the right offset in case
1810                  * the line breaks in the .lst file (BR 1197827)
1811                  */
1812                 offset += s;
1813                 s = 0;
1814
1815                 switch (ea_data.bytes) {
1816                 case 0:
1817                     break;
1818                 case 1:
1819                     if (ins->oprs[(c >> 3) & 7].segment != NO_SEG) {
1820                         data = ins->oprs[(c >> 3) & 7].offset;
1821                         out(offset, segment, &data, OUT_ADDRESS, 1,
1822                             ins->oprs[(c >> 3) & 7].segment,
1823                             ins->oprs[(c >> 3) & 7].wrt);
1824                     } else {
1825                         *bytes = ins->oprs[(c >> 3) & 7].offset;
1826                         out(offset, segment, bytes, OUT_RAWDATA, 1,
1827                             NO_SEG, NO_SEG);
1828                     }
1829                     s++;
1830                     break;
1831                 case 8:
1832                 case 2:
1833                 case 4:
1834                     data = ins->oprs[(c >> 3) & 7].offset;
1835                     warn_overflow(ea_data.bytes, data);
1836                     out(offset, segment, &data,
1837                         ea_data.rip ?  OUT_REL4ADR : OUT_ADDRESS,
1838                         ea_data.bytes,
1839                         ins->oprs[(c >> 3) & 7].segment,
1840                         ins->oprs[(c >> 3) & 7].wrt);
1841                     s += ea_data.bytes;
1842                     break;
1843                 }
1844                 offset += s;
1845             } else {
1846                 errfunc(ERR_PANIC, "internal instruction table corrupt"
1847                         ": instruction code 0x%02X given", c);
1848             }
1849         }
1850     }
1851 }
1852
1853 static int32_t regflag(const operand * o)
1854 {
1855     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1856         errfunc(ERR_PANIC, "invalid operand passed to regflag()");
1857     }
1858     return nasm_reg_flags[o->basereg];
1859 }
1860
1861 static int32_t regval(const operand * o)
1862 {
1863     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1864         errfunc(ERR_PANIC, "invalid operand passed to regval()");
1865     }
1866     return nasm_regvals[o->basereg];
1867 }
1868
1869 static int op_rexflags(const operand * o, int mask)
1870 {
1871     int32_t flags;
1872     int val;
1873
1874     if (o->basereg < EXPR_REG_START || o->basereg >= REG_ENUM_LIMIT) {
1875         errfunc(ERR_PANIC, "invalid operand passed to op_rexflags()");
1876     }
1877
1878     flags = nasm_reg_flags[o->basereg];
1879     val = nasm_regvals[o->basereg];
1880
1881     return rexflags(val, flags, mask);
1882 }
1883
1884 static int rexflags(int val, int32_t flags, int mask)
1885 {
1886     int rex = 0;
1887
1888     if (val >= 8)
1889         rex |= REX_B|REX_X|REX_R;
1890     if (flags & BITS64)
1891         rex |= REX_W;
1892     if (!(REG_HIGH & ~flags))   /* AH, CH, DH, BH */
1893         rex |= REX_H;
1894     else if (!(REG8 & ~flags) && val >= 4) /* SPL, BPL, SIL, DIL */
1895         rex |= REX_P;
1896
1897     return rex & mask;
1898 }
1899
1900 static int matches(const struct itemplate *itemp, insn * instruction, int bits)
1901 {
1902     int i, size[MAX_OPERANDS], asize, oprs, ret;
1903
1904     ret = 100;
1905
1906     /*
1907      * Check the opcode
1908      */
1909     if (itemp->opcode != instruction->opcode)
1910         return 0;
1911
1912     /*
1913      * Count the operands
1914      */
1915     if (itemp->operands != instruction->operands)
1916         return 0;
1917
1918     /*
1919      * Check that no spurious colons or TOs are present
1920      */
1921     for (i = 0; i < itemp->operands; i++)
1922         if (instruction->oprs[i].type & ~itemp->opd[i] & (COLON | TO))
1923             return 0;
1924
1925     /*
1926      * Process size flags
1927      */
1928     if (itemp->flags & IF_ARMASK) {
1929         memset(size, 0, sizeof size);
1930
1931         i = ((itemp->flags & IF_ARMASK) >> IF_ARSHFT) - 1;
1932
1933         switch (itemp->flags & IF_SMASK) {
1934         case IF_SB:
1935             size[i] = BITS8;
1936             break;
1937         case IF_SW:
1938             size[i] = BITS16;
1939             break;
1940         case IF_SD:
1941             size[i] = BITS32;
1942             break;
1943         case IF_SQ:
1944             size[i] = BITS64;
1945             break;
1946         case IF_SO:
1947             size[i] = BITS128;
1948             break;
1949         case IF_SY:
1950             size[i] = BITS256;
1951             break;
1952         case IF_SZ:
1953             switch (bits) {
1954             case 16:
1955                 size[i] = BITS16;
1956                 break;
1957             case 32:
1958                 size[i] = BITS32;
1959                 break;
1960             case 64:
1961                 size[i] = BITS64;
1962                 break;
1963             }
1964             break;
1965         default:
1966             break;
1967         }
1968     } else {
1969         asize = 0;
1970         switch (itemp->flags & IF_SMASK) {
1971         case IF_SB:
1972             asize = BITS8;
1973             break;
1974         case IF_SW:
1975             asize = BITS16;
1976             break;
1977         case IF_SD:
1978             asize = BITS32;
1979             break;
1980         case IF_SQ:
1981             asize = BITS64;
1982             break;
1983         case IF_SO:
1984             asize = BITS128;
1985             break;
1986         case IF_SY:
1987             asize = BITS256;
1988             break;
1989         case IF_SZ:
1990             switch (bits) {
1991             case 16:
1992                 asize = BITS16;
1993                 break;
1994             case 32:
1995                 asize = BITS32;
1996                 break;
1997             case 64:
1998                 asize = BITS64;
1999                 break;
2000             }
2001             break;
2002         default:
2003             break;
2004         }
2005         for (i = 0; i < MAX_OPERANDS; i++)
2006             size[i] = asize;
2007     }
2008
2009     /*
2010      * Check that the operand flags all match up
2011      */
2012     for (i = 0; i < itemp->operands; i++) {
2013         int32_t type = instruction->oprs[i].type;
2014         if (!(type & SIZE_MASK))
2015             type |= size[i];
2016
2017         if (itemp->opd[i] & SAME_AS) {
2018             int j = itemp->opd[i] & ~SAME_AS;
2019             if (type != instruction->oprs[j].type ||
2020                 instruction->oprs[i].basereg != instruction->oprs[j].basereg)
2021                 return 0;
2022         } else if (itemp->opd[i] & ~type ||
2023             ((itemp->opd[i] & SIZE_MASK) &&
2024              ((itemp->opd[i] ^ type) & SIZE_MASK))) {
2025             if ((itemp->opd[i] & ~type & ~SIZE_MASK) ||
2026                 (type & SIZE_MASK))
2027                 return 0;
2028             else
2029                 return 1;
2030         }
2031     }
2032
2033     /*
2034      * Check operand sizes
2035      */
2036     if (itemp->flags & (IF_SM | IF_SM2)) {
2037         oprs = (itemp->flags & IF_SM2 ? 2 : itemp->operands);
2038         asize = 0;
2039         for (i = 0; i < oprs; i++) {
2040             if ((asize = itemp->opd[i] & SIZE_MASK) != 0) {
2041                 int j;
2042                 for (j = 0; j < oprs; j++)
2043                     size[j] = asize;
2044                 break;
2045             }
2046         }
2047     } else {
2048         oprs = itemp->operands;
2049     }
2050
2051     for (i = 0; i < itemp->operands; i++) {
2052         if (!(itemp->opd[i] & SIZE_MASK) &&
2053             (instruction->oprs[i].type & SIZE_MASK & ~size[i]))
2054             return 2;
2055     }
2056
2057     /*
2058      * Check template is okay at the set cpu level
2059      */
2060     if (((itemp->flags & IF_PLEVEL) > cpu))
2061         return 3;
2062
2063     /*
2064      * Check if instruction is available in long mode
2065      */
2066     if ((itemp->flags & IF_NOLONG) && (bits == 64))
2067         return 4;
2068
2069     /*
2070      * Check if special handling needed for Jumps
2071      */
2072     if ((uint8_t)(itemp->code[0]) >= 0370)
2073         return 99;
2074
2075     return ret;
2076 }
2077
2078 static ea *process_ea(operand * input, ea * output, int bits,
2079                       int addrbits, int rfield, int32_t rflags)
2080 {
2081     bool forw_ref = !!(input->opflags & OPFLAG_FORWARD);
2082
2083     output->rip = false;
2084
2085     /* REX flags for the rfield operand */
2086     output->rex |= rexflags(rfield, rflags, REX_R|REX_P|REX_W|REX_H);
2087
2088     if (!(REGISTER & ~input->type)) {   /* register direct */
2089         int i;
2090         int32_t f;
2091
2092         if (input->basereg < EXPR_REG_START /* Verify as Register */
2093             || input->basereg >= REG_ENUM_LIMIT)
2094             return NULL;
2095         f = regflag(input);
2096         i = nasm_regvals[input->basereg];
2097
2098         if (REG_EA & ~f)
2099             return NULL;        /* Invalid EA register */
2100
2101         output->rex |= op_rexflags(input, REX_B|REX_P|REX_W|REX_H);
2102
2103         output->sib_present = false;             /* no SIB necessary */
2104         output->bytes = 0;  /* no offset necessary either */
2105         output->modrm = 0xC0 | ((rfield & 7) << 3) | (i & 7);
2106     } else {                    /* it's a memory reference */
2107         if (input->basereg == -1
2108             && (input->indexreg == -1 || input->scale == 0)) {
2109             /* it's a pure offset */
2110             if (bits == 64 && (~input->type & IP_REL)) {
2111               int scale, index, base;
2112               output->sib_present = true;
2113               scale = 0;
2114               index = 4;
2115               base = 5;
2116               output->sib = (scale << 6) | (index << 3) | base;
2117               output->bytes = 4;
2118               output->modrm = 4 | ((rfield & 7) << 3);
2119               output->rip = false;
2120             } else {
2121               output->sib_present = false;
2122               output->bytes = (addrbits != 16 ? 4 : 2);
2123               output->modrm = (addrbits != 16 ? 5 : 6) | ((rfield & 7) << 3);
2124               output->rip = bits == 64;
2125             }
2126         } else {                /* it's an indirection */
2127             int i = input->indexreg, b = input->basereg, s = input->scale;
2128             int32_t o = input->offset, seg = input->segment;
2129             int hb = input->hintbase, ht = input->hinttype;
2130             int t;
2131             int it, bt;
2132             int32_t ix, bx;     /* register flags */
2133
2134             if (s == 0)
2135                 i = -1;         /* make this easy, at least */
2136
2137             if (i >= EXPR_REG_START && i < REG_ENUM_LIMIT) {
2138                 it = nasm_regvals[i];
2139                 ix = nasm_reg_flags[i];
2140             } else {
2141                 it = -1;
2142                 ix = 0;
2143             }
2144
2145             if (b >= EXPR_REG_START && b < REG_ENUM_LIMIT) {
2146                 bt = nasm_regvals[b];
2147                 bx = nasm_reg_flags[b];
2148             } else {
2149                 bt = -1;
2150                 bx = 0;
2151             }
2152
2153             /* check for a 32/64-bit memory reference... */
2154             if ((ix|bx) & (BITS32|BITS64)) {
2155                 /* it must be a 32/64-bit memory reference. Firstly we have
2156                  * to check that all registers involved are type E/Rxx. */
2157                 int32_t sok = BITS32|BITS64;
2158
2159                 if (it != -1) {
2160                     if (!(REG64 & ~ix) || !(REG32 & ~ix))
2161                         sok &= ix;
2162                     else
2163                         return NULL;
2164                 }
2165
2166                 if (bt != -1) {
2167                     if (REG_GPR & ~bx)
2168                         return NULL; /* Invalid register */
2169                     if (~sok & bx & SIZE_MASK)
2170                         return NULL; /* Invalid size */
2171                     sok &= bx;
2172                 }
2173
2174                 /* While we're here, ensure the user didn't specify
2175                    WORD or QWORD. */
2176                 if (input->disp_size == 16 || input->disp_size == 64)
2177                     return NULL;
2178
2179                 if (addrbits == 16 ||
2180                     (addrbits == 32 && !(sok & BITS32)) ||
2181                     (addrbits == 64 && !(sok & BITS64)))
2182                     return NULL;
2183
2184                 /* now reorganize base/index */
2185                 if (s == 1 && bt != it && bt != -1 && it != -1 &&
2186                     ((hb == b && ht == EAH_NOTBASE)
2187                      || (hb == i && ht == EAH_MAKEBASE))) {
2188                     /* swap if hints say so */
2189                     t = bt, bt = it, it = t;
2190                     t = bx, bx = ix, ix = t;
2191                 }
2192                 if (bt == it)     /* convert EAX+2*EAX to 3*EAX */
2193                     bt = -1, bx = 0, s++;
2194                 if (bt == -1 && s == 1 && !(hb == it && ht == EAH_NOTBASE)) {
2195                     /* make single reg base, unless hint */
2196                     bt = it, bx = ix, it = -1, ix = 0;
2197                 }
2198                 if (((s == 2 && it != REG_NUM_ESP
2199                       && !(input->eaflags & EAF_TIMESTWO)) || s == 3
2200                      || s == 5 || s == 9) && bt == -1)
2201                     bt = it, bx = ix, s--; /* convert 3*EAX to EAX+2*EAX */
2202                 if (it == -1 && (bt & 7) != REG_NUM_ESP
2203                     && (input->eaflags & EAF_TIMESTWO))
2204                     it = bt, ix = bx, bt = -1, bx = 0, s = 1;
2205                 /* convert [NOSPLIT EAX] to sib format with 0x0 displacement */
2206                 if (s == 1 && it == REG_NUM_ESP) {
2207                     /* swap ESP into base if scale is 1 */
2208                     t = it, it = bt, bt = t;
2209                     t = ix, ix = bx, bx = t;
2210                 }
2211                 if (it == REG_NUM_ESP
2212                     || (s != 1 && s != 2 && s != 4 && s != 8 && it != -1))
2213                     return NULL;        /* wrong, for various reasons */
2214
2215                 output->rex |= rexflags(it, ix, REX_X);
2216                 output->rex |= rexflags(bt, bx, REX_B);
2217
2218                 if (it == -1 && (bt & 7) != REG_NUM_ESP) {
2219                     /* no SIB needed */
2220                     int mod, rm;
2221
2222                     if (bt == -1) {
2223                         rm = 5;
2224                         mod = 0;
2225                     } else {
2226                         rm = (bt & 7);
2227                         if (rm != REG_NUM_EBP && o == 0 &&
2228                                 seg == NO_SEG && !forw_ref &&
2229                                 !(input->eaflags &
2230                                   (EAF_BYTEOFFS | EAF_WORDOFFS)))
2231                             mod = 0;
2232                         else if (input->eaflags & EAF_BYTEOFFS ||
2233                                  (o >= -128 && o <= 127 && seg == NO_SEG
2234                                   && !forw_ref
2235                                   && !(input->eaflags & EAF_WORDOFFS)))
2236                             mod = 1;
2237                         else
2238                             mod = 2;
2239                     }
2240
2241                     output->sib_present = false;
2242                     output->bytes = (bt == -1 || mod == 2 ? 4 : mod);
2243                     output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2244                 } else {
2245                     /* we need a SIB */
2246                     int mod, scale, index, base;
2247
2248                     if (it == -1)
2249                         index = 4, s = 1;
2250                     else
2251                         index = (it & 7);
2252
2253                     switch (s) {
2254                     case 1:
2255                         scale = 0;
2256                         break;
2257                     case 2:
2258                         scale = 1;
2259                         break;
2260                     case 4:
2261                         scale = 2;
2262                         break;
2263                     case 8:
2264                         scale = 3;
2265                         break;
2266                     default:   /* then what the smeg is it? */
2267                         return NULL;    /* panic */
2268                     }
2269
2270                     if (bt == -1) {
2271                         base = 5;
2272                         mod = 0;
2273                     } else {
2274                         base = (bt & 7);
2275                         if (base != REG_NUM_EBP && o == 0 &&
2276                                     seg == NO_SEG && !forw_ref &&
2277                                     !(input->eaflags &
2278                                       (EAF_BYTEOFFS | EAF_WORDOFFS)))
2279                             mod = 0;
2280                         else if (input->eaflags & EAF_BYTEOFFS ||
2281                                  (o >= -128 && o <= 127 && seg == NO_SEG
2282                                   && !forw_ref
2283                                   && !(input->eaflags & EAF_WORDOFFS)))
2284                             mod = 1;
2285                         else
2286                             mod = 2;
2287                     }
2288
2289                     output->sib_present = true;
2290                     output->bytes =  (bt == -1 || mod == 2 ? 4 : mod);
2291                     output->modrm = (mod << 6) | ((rfield & 7) << 3) | 4;
2292                     output->sib = (scale << 6) | (index << 3) | base;
2293                 }
2294             } else {            /* it's 16-bit */
2295                 int mod, rm;
2296
2297                 /* check for 64-bit long mode */
2298                 if (addrbits == 64)
2299                     return NULL;
2300
2301                 /* check all registers are BX, BP, SI or DI */
2302                 if ((b != -1 && b != R_BP && b != R_BX && b != R_SI
2303                      && b != R_DI) || (i != -1 && i != R_BP && i != R_BX
2304                                        && i != R_SI && i != R_DI))
2305                     return NULL;
2306
2307                 /* ensure the user didn't specify DWORD/QWORD */
2308                 if (input->disp_size == 32 || input->disp_size == 64)
2309                     return NULL;
2310
2311                 if (s != 1 && i != -1)
2312                     return NULL;        /* no can do, in 16-bit EA */
2313                 if (b == -1 && i != -1) {
2314                     int tmp = b;
2315                     b = i;
2316                     i = tmp;
2317                 }               /* swap */
2318                 if ((b == R_SI || b == R_DI) && i != -1) {
2319                     int tmp = b;
2320                     b = i;
2321                     i = tmp;
2322                 }
2323                 /* have BX/BP as base, SI/DI index */
2324                 if (b == i)
2325                     return NULL;        /* shouldn't ever happen, in theory */
2326                 if (i != -1 && b != -1 &&
2327                     (i == R_BP || i == R_BX || b == R_SI || b == R_DI))
2328                     return NULL;        /* invalid combinations */
2329                 if (b == -1)    /* pure offset: handled above */
2330                     return NULL;        /* so if it gets to here, panic! */
2331
2332                 rm = -1;
2333                 if (i != -1)
2334                     switch (i * 256 + b) {
2335                     case R_SI * 256 + R_BX:
2336                         rm = 0;
2337                         break;
2338                     case R_DI * 256 + R_BX:
2339                         rm = 1;
2340                         break;
2341                     case R_SI * 256 + R_BP:
2342                         rm = 2;
2343                         break;
2344                     case R_DI * 256 + R_BP:
2345                         rm = 3;
2346                         break;
2347                 } else
2348                     switch (b) {
2349                     case R_SI:
2350                         rm = 4;
2351                         break;
2352                     case R_DI:
2353                         rm = 5;
2354                         break;
2355                     case R_BP:
2356                         rm = 6;
2357                         break;
2358                     case R_BX:
2359                         rm = 7;
2360                         break;
2361                     }
2362                 if (rm == -1)   /* can't happen, in theory */
2363                     return NULL;        /* so panic if it does */
2364
2365                 if (o == 0 && seg == NO_SEG && !forw_ref && rm != 6 &&
2366                     !(input->eaflags & (EAF_BYTEOFFS | EAF_WORDOFFS)))
2367                     mod = 0;
2368                 else if (input->eaflags & EAF_BYTEOFFS ||
2369                          (o >= -128 && o <= 127 && seg == NO_SEG
2370                           && !forw_ref
2371                           && !(input->eaflags & EAF_WORDOFFS)))
2372                     mod = 1;
2373                 else
2374                     mod = 2;
2375
2376                 output->sib_present = false;    /* no SIB - it's 16-bit */
2377                 output->bytes = mod;    /* bytes of offset needed */
2378                 output->modrm = (mod << 6) | ((rfield & 7) << 3) | rm;
2379             }
2380         }
2381     }
2382
2383     output->size = 1 + output->sib_present + output->bytes;
2384     return output;
2385 }
2386
2387 static void add_asp(insn *ins, int addrbits)
2388 {
2389     int j, valid;
2390     int defdisp;
2391
2392     valid = (addrbits == 64) ? 64|32 : 32|16;
2393
2394     switch (ins->prefixes[PPS_ASIZE]) {
2395     case P_A16:
2396         valid &= 16;
2397         break;
2398     case P_A32:
2399         valid &= 32;
2400         break;
2401     case P_A64:
2402         valid &= 64;
2403         break;
2404     case P_ASP:
2405         valid &= (addrbits == 32) ? 16 : 32;
2406         break;
2407     default:
2408         break;
2409     }
2410
2411     for (j = 0; j < ins->operands; j++) {
2412         if (!(MEMORY & ~ins->oprs[j].type)) {
2413             int32_t i, b;
2414
2415             /* Verify as Register */
2416             if (ins->oprs[j].indexreg < EXPR_REG_START
2417                 || ins->oprs[j].indexreg >= REG_ENUM_LIMIT)
2418                 i = 0;
2419             else
2420                 i = nasm_reg_flags[ins->oprs[j].indexreg];
2421
2422             /* Verify as Register */
2423             if (ins->oprs[j].basereg < EXPR_REG_START
2424                 || ins->oprs[j].basereg >= REG_ENUM_LIMIT)
2425                 b = 0;
2426             else
2427                 b = nasm_reg_flags[ins->oprs[j].basereg];
2428
2429             if (ins->oprs[j].scale == 0)
2430                 i = 0;
2431
2432             if (!i && !b) {
2433                 int ds = ins->oprs[j].disp_size;
2434                 if ((addrbits != 64 && ds > 8) ||
2435                     (addrbits == 64 && ds == 16))
2436                     valid &= ds;
2437             } else {
2438                 if (!(REG16 & ~b))
2439                     valid &= 16;
2440                 if (!(REG32 & ~b))
2441                     valid &= 32;
2442                 if (!(REG64 & ~b))
2443                     valid &= 64;
2444
2445                 if (!(REG16 & ~i))
2446                     valid &= 16;
2447                 if (!(REG32 & ~i))
2448                     valid &= 32;
2449                 if (!(REG64 & ~i))
2450                     valid &= 64;
2451             }
2452         }
2453     }
2454
2455     if (valid & addrbits) {
2456         ins->addr_size = addrbits;
2457     } else if (valid & ((addrbits == 32) ? 16 : 32)) {
2458         /* Add an address size prefix */
2459         enum prefixes pref = (addrbits == 32) ? P_A16 : P_A32;
2460         ins->prefixes[PPS_ASIZE] = pref;
2461         ins->addr_size = (addrbits == 32) ? 16 : 32;
2462     } else {
2463         /* Impossible... */
2464         errfunc(ERR_NONFATAL, "impossible combination of address sizes");
2465         ins->addr_size = addrbits; /* Error recovery */
2466     }
2467
2468     defdisp = ins->addr_size == 16 ? 16 : 32;
2469
2470     for (j = 0; j < ins->operands; j++) {
2471         if (!(MEM_OFFS & ~ins->oprs[j].type) &&
2472             (ins->oprs[j].disp_size ? ins->oprs[j].disp_size : defdisp)
2473             != ins->addr_size) {
2474             /* mem_offs sizes must match the address size; if not,
2475                strip the MEM_OFFS bit and match only EA instructions */
2476             ins->oprs[j].type &= ~(MEM_OFFS & ~MEMORY);
2477         }
2478     }
2479 }