kit

asm.c (42671B)

---

 /* ARM32 (Thumb-2) textual-assembler frontend.
  *
  * Implements the per-instruction `insn` hook the shared assembler driver
  * (src/asm/asm.c) calls once per source line. Operands are parsed off the
  * AsmDriver token stream and encoded via the isa.h inline encoders, emitting
  * each Thumb-2 instruction as little-endian half-words (hw1 first for the
  * 32-bit forms). Mirrors src/arch/riscv/asm.c (descriptor lookup + format
  * dispatch) and src/arch/aa64/asm.c (the ArchAsmOps printer-side seam).
  *
  * Mnemonic resolution: the driver composes dotted mnemonics (so `mov.w`,
  * `b.w`, `ldr.w` arrive whole). A condition-code suffix (`bne`, `beq.w`,
  * `moveq`) is stripped here to recover the base mnemonic + condition. The
  * `.syntax unified` / `.thumb` directives are consumed by the shared driver. */
 #include "arch/arm32/asm.h"
 
 #include <string.h>
 
 #include "arch/arm32/isa.h"
 #include "arch/arm32/regs.h"
 #include "arch/arch.h"
 #include "asm/asm_helpers.h"
 #include "asm/asm_lex.h"
 #include "cg/cgir.h"
 #include "core/arena.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/strbuf.h"
 #include "obj/obj.h"
 
 struct Arm32Asm {
   ArchAsm base;
   Compiler* c;
 
   const AsmConstraint* outs;
   Operand* out_ops;
   const AsmConstraint* ins;
   const Operand* in_ops;
   const Sym* clobbers;
   u32 nout;
   u32 nin;
   u32 nclob;
 };
 
 /* ---- byte emit (LE half-words, hw1 first for 32-bit) ---- */
 static void emit_t16(AsmDriver* d, u16 hw) {
   u8 b[2] = {(u8)(hw & 0xffu), (u8)((hw >> 8) & 0xffu)};
   mc_emit_bytes(asm_driver_mc(d), b, sizeof b);
 }
 static void emit_t32(AsmDriver* d, u32 instr) {
   u32 hw1 = (instr >> 16) & 0xffffu, hw2 = instr & 0xffffu;
   u8 b[4] = {(u8)(hw1 & 0xffu), (u8)((hw1 >> 8) & 0xffu), (u8)(hw2 & 0xffu),
              (u8)((hw2 >> 8) & 0xffu)};
   mc_emit_bytes(asm_driver_mc(d), b, sizeof b);
 }
 
 /* Construct a Slice (KitSlice's first member is a union, so the brace-init form
  * needs nesting; this helper keeps the call sites clean). */
 static Slice arm_slice(const char* s, size_t len) {
   Slice sl;
   sl.s = s;
   sl.len = len;
   return sl;
 }
 
 Arm32Asm* arm32_asm_open(Compiler* c) {
   Arm32Asm* a = arena_new(c->tu, Arm32Asm);
   memset(a, 0, sizeof *a);
   a->base.insn = NULL;
   a->base.destroy = NULL;
   a->c = c;
   return a;
 }
 
 void arm32_asm_close(Arm32Asm* a) { (void)a; }
 
 void arm32_inline_bind(Arm32Asm* a, const AsmConstraint* outs, u32 nout,
                        Operand* out_ops, const AsmConstraint* ins, u32 nin,
                        const Operand* in_ops, const Sym* clobbers, u32 nclob) {
   a->outs = outs;
   a->out_ops = out_ops;
   a->ins = ins;
   a->in_ops = in_ops;
   a->clobbers = clobbers;
   a->nout = nout;
   a->nin = nin;
   a->nclob = nclob;
 }
 
 static void render_reg(StrBuf* sb, u32 r) {
   strbuf_putc(sb, 'r');
   if (r >= 10u) strbuf_putc(sb, (char)('0' + (r / 10u)));
   strbuf_putc(sb, (char)('0' + (r % 10u)));
 }
 
 static void render_imm(StrBuf* sb, i64 v) {
   strbuf_putc(sb, '#');
   strbuf_put_i64(sb, v);
 }
 
 static void render_indirect(StrBuf* sb, Reg base, i32 ofs) {
   strbuf_putc(sb, '[');
   render_reg(sb, (u32)base);
   if (ofs != 0) {
     strbuf_puts(sb, ", ");
     render_imm(sb, (i64)ofs);
   }
   strbuf_putc(sb, ']');
 }
 
 _Noreturn static void inline_panic(Arm32Asm* a, const char* msg) {
   SrcLoc loc = {0, 0, 0};
   compiler_panic(a->c, loc, "inline asm: %.*s",
                  SLICE_ARG(slice_from_cstr(msg)));
 }
 
 static u32 lookup_named(Arm32Asm* a, Sym needle) {
   for (u32 k = 0; k < a->nout; ++k) {
     if (a->outs[k].name == needle) return k;
   }
   for (u32 k = 0; k < a->nin; ++k) {
     if (a->ins[k].name == needle) return a->nout + k;
   }
   return (u32)-1;
 }
 
 static void render_operand(Arm32Asm* a, StrBuf* sb, u32 idx, int form) {
   u32 ntot = a->nout + a->nin;
   if (idx >= ntot) inline_panic(a, "operand index out of range");
   const Operand* op =
       (idx < a->nout) ? &a->out_ops[idx] : &a->in_ops[idx - a->nout];
   if (form == 3) {
     if (op->kind != OPK_INDIRECT) inline_panic(a, "%a on non-memory operand");
     if (op->v.ind.index != CG_LOCAL_NONE)
       inline_panic(a, "%a on indexed memory operand");
     render_indirect(sb, op->v.ind.base, op->v.ind.ofs);
     return;
   }
   if (form != 0) inline_panic(a, "unsupported ARM32 inline asm modifier");
   switch (op->kind) {
     case ARM32_INLINE_OPK_REG:
       if (op->pad[0] == ARM32_INLINE_OPCLS_FP)
         inline_panic(a, "arm32 inline asm has no FP register constraints");
       render_reg(sb, (u32)op->v.local);
       return;
     case OPK_IMM:
       render_imm(sb, op->v.imm);
       return;
     case OPK_INDIRECT:
       if (op->v.ind.index != CG_LOCAL_NONE)
         inline_panic(a, "indexed memory operand in inline asm");
       render_indirect(sb, op->v.ind.base, op->v.ind.ofs);
       return;
     default:
       inline_panic(a, "unsupported operand kind for %N");
   }
 }
 
 /* ---- operand parse helpers ---- */
 static int sym_to_cstr(AsmDriver* d, Sym s, char* out, size_t cap) {
   Slice sl = pool_slice(asm_driver_pool(d), s);
   if (!sl.s || sl.len >= cap) return 0;
   memcpy(out, sl.s, sl.len);
   out[sl.len] = '\0';
   return 1;
 }
 
 static u32 parse_reg(AsmDriver* d) {
   AsmTok t = asm_driver_next(d);
   char name[16];
   uint32_t idx = 0;
   if (t.kind != ASM_TOK_IDENT || !sym_to_cstr(d, t.v.ident, name, sizeof name) ||
       arm32_register_index(name, &idx) != 0 || idx > 15u)
     asm_driver_panic(d, "arm32 asm: bad core register");
   return idx;
 }
 
 static void expect_comma(AsmDriver* d) {
   if (!asm_driver_eat_comma(d)) asm_driver_panic(d, "arm32 asm: expected ','");
 }
 
 /* 1 if the next token is a core register name (used to disambiguate the
  * register vs modified-immediate data-processing forms by operand shape). */
 static int peek_is_reg(AsmDriver* d) {
   AsmTok t = asm_driver_peek(d);
   char name[16];
   uint32_t idx;
   if (t.kind != ASM_TOK_IDENT) return 0;
   if (!sym_to_cstr(d, t.v.ident, name, sizeof name)) return 0;
   return arm32_register_index(name, &idx) == 0 && idx <= 15u;
 }
 
 /* Parse a #-prefixed immediate constant. The `#` is optional (GNU as accepts
  * both); a bare expression is also accepted. */
 static i64 parse_imm(AsmDriver* d) {
   (void)asm_driver_eat_punct(d, '#');
   return asm_driver_parse_const(d);
 }
 
 /* A modified-immediate operand: encode via thumb_expand_imm_encode, panicking
  * if the value isn't representable (the assembler does not materialize). */
 static u32 parse_modimm(AsmDriver* d) {
   i64 v = parse_imm(d);
   u32 out12;
   if (!thumb_expand_imm_encode((u32)v, &out12))
     asm_driver_panic(d, "arm32 asm: immediate not a modified-immediate");
   return out12;
 }
 
 /* `[Rn]` / `[Rn, #imm]` — returns base in *base_out, signed displacement in
  * *disp_out. Pre/post-index and shifted-index modes are a follow-on. */
 static void parse_mem(AsmDriver* d, u32* base_out, i64* disp_out) {
   asm_driver_expect_punct(d, '[', "'[' in arm32 memory operand");
   *base_out = parse_reg(d);
   *disp_out = 0;
   if (asm_driver_eat_comma(d)) *disp_out = parse_imm(d);
   asm_driver_expect_punct(d, ']', "']' in arm32 memory operand");
 }
 
 /* Register list `{r0, r1, lr}` -> bitmask. */
 static u32 parse_reglist(AsmDriver* d) {
   u32 mask = 0;
   asm_driver_expect_punct(d, '{', "'{' in arm32 register list");
   for (;;) {
     u32 r = parse_reg(d);
     mask |= (1u << r);
     if (!asm_driver_eat_comma(d)) break;
   }
   asm_driver_expect_punct(d, '}', "'}' in arm32 register list");
   return mask;
 }
 
 /* `#:lower16:sym` / `#:upper16:sym` modifier -> 1 + reloc kind, sym, addend.
  * The leading `#` is optional; returns 0 if no `:modifier:` is present. */
 static int parse_movw_mod(AsmDriver* d, RelocKind* kind_out, ObjSymId* sym_out,
                           i64* off_out, int is_movt) {
   (void)asm_driver_eat_punct(d, '#');
   if (!asm_driver_tok_is_punct(asm_driver_peek(d), ':')) return 0;
   (void)asm_driver_next(d); /* ':' */
   {
     AsmTok name = asm_driver_next(d);
     Slice s;
     RelocKind k;
     if (name.kind != ASM_TOK_IDENT)
       asm_driver_panic(d, "arm32 asm: expected relocation modifier");
     s = pool_slice(asm_driver_pool(d), name.v.ident);
     if (slice_eq_cstr(s, "lower16"))
       k = R_ARM_THM_MOVW_ABS_NC;
     else if (slice_eq_cstr(s, "upper16"))
       k = R_ARM_THM_MOVT_ABS;
     else
       asm_driver_panic(d, "arm32 asm: unsupported relocation modifier");
     if ((k == R_ARM_THM_MOVT_ABS) != (is_movt != 0))
       asm_driver_panic(d, "arm32 asm: lower16/upper16 mismatched with movw/movt");
     asm_driver_expect_punct(d, ':', "':' closing relocation modifier");
     {
       ObjSymId sym = OBJ_SYM_NONE;
       i64 off = 0;
       asm_driver_parse_sym_expr(d, &sym, &off);
       *kind_out = k;
       *sym_out = sym;
       *off_out = off;
     }
     return 1;
   }
 }
 
 /* Optional shift `, lsl #n` etc. on a register operand; returns the shift type
  * (0..3) and amount, 0/0 if absent. */
 static u32 parse_opt_shift(AsmDriver* d, u32* amount_out) {
   Slice s;
   AsmTok t;
   *amount_out = 0;
   t = asm_driver_peek(d);
   if (t.kind != ASM_TOK_IDENT) return 0;
   s = pool_slice(asm_driver_pool(d), t.v.ident);
   u32 type;
   if (slice_eq_cstr(s, "lsl"))
     type = 0;
   else if (slice_eq_cstr(s, "lsr"))
     type = 1;
   else if (slice_eq_cstr(s, "asr"))
     type = 2;
   else if (slice_eq_cstr(s, "ror"))
     type = 3;
   else
     return 0;
   (void)asm_driver_next(d); /* the shift mnemonic */
   *amount_out = (u32)parse_imm(d);
   return type;
 }
 
 /* Barrier option: `sy` (full system) or a bare numeric. */
 static u32 parse_barrier_opt(AsmDriver* d) {
   AsmTok t = asm_driver_peek(d);
   if (t.kind == ASM_TOK_IDENT) {
     Slice s = pool_slice(asm_driver_pool(d), t.v.ident);
     if (slice_eq_cstr(s, "sy")) {
       (void)asm_driver_next(d);
       return 0xfu;
     }
   }
   if (asm_driver_at_eol(d)) return 0xfu; /* default SY */
   return (u32)asm_driver_parse_const(d) & 0xfu;
 }
 
 /* =====================================================================
  * Mnemonic resolution: strip a trailing condition-code suffix to recover the
  * base mnemonic + condition (e.g. `bne`->`b`/ne, `beq.w`->`b.w`/eq,
  * `moveq`->`mov`/eq). Returns the base descriptor and writes *cond_out
  * (ARM_CC_AL if unconditional). The condition is encoded only by the branch
  * formats; DP/etc. conditional forms require an enclosing IT block and the
  * assembler accepts the suffix but the IT instruction supplies the predicate.
  * ===================================================================== */
 static const Arm32InsnDesc* resolve_mnemonic(AsmDriver* d, Slice mn,
                                              u32* cond_out) {
   const Arm32InsnDesc* desc = arm32_asm_find(mn);
   *cond_out = ARM_CC_AL;
   if (desc) return desc;
   /* Try a trailing ".w" + 2-char cond (e.g. "bne.w" -> base "b.w"). */
   if (mn.len >= 4 && mn.s[mn.len - 2] == '.' && mn.s[mn.len - 1] == 'w') {
     int cv = arm32_cond_from_name(arm_slice(mn.s + mn.len - 4, 2));
     if (cv >= 0) {
       char buf[24];
       size_t base = mn.len - 4;
       if (base + 2 < sizeof buf) {
         memcpy(buf, mn.s, base);
         buf[base] = '.';
         buf[base + 1] = 'w';
         desc = arm32_asm_find(arm_slice(buf, base + 2));
         if (desc) {
           *cond_out = (u32)cv;
           return desc;
         }
       }
     }
   }
   /* Try a trailing 2-char cond (e.g. "bne" -> "b", "moveq" -> "mov"). */
   if (mn.len >= 2) {
     int cv = arm32_cond_from_name(arm_slice(mn.s + mn.len - 2, 2));
     if (cv >= 0) {
       desc = arm32_asm_find(arm_slice(mn.s, mn.len - 2));
       if (desc) {
         *cond_out = (u32)cv;
         return desc;
       }
     }
   }
   asm_driver_panic(d, "arm32 asm: unsupported instruction");
 }
 
 /* Encode the third operand of a general `add`/`sub rd, rn, <#imm | rm>` once rd
  * and rn are parsed and the separating comma consumed. There is no 16-bit
  * non-flag add/sub-immediate or 3-register form, so a register third operand
  * takes the 32-bit add.w/sub.w, and an immediate takes the densest of: the
  * 16-bit sp-adjust / add-from-sp forms, the 32-bit modified-immediate
  * (add.w/sub.w), then the 12-bit addw/subw. A negative immediate flips the
  * operation. The 16-bit hi-register `add rdn, rm` (2 operands) is handled at the
  * call site, not here. */
 static void arm_asm_addsub_third(AsmDriver* d, int is_sub, u32 rd, u32 rn) {
   i64 simm;
   u32 mag, out12;
   if (peek_is_reg(d)) {
     u32 rm = parse_reg(d);
     emit_t32(d, is_sub ? arm_sub_reg(rd, rn, rm) : arm_add_reg(rd, rn, rm));
     return;
   }
   simm = parse_imm(d);
   if (simm < 0) {
     is_sub = !is_sub;
     simm = -simm;
   }
   mag = (u32)simm;
   if (rd == 13u && rn == 13u && (mag & 3u) == 0u && (mag >> 2) <= 0x7fu) {
     emit_t16(d, (u16)((is_sub ? 0xb080u : 0xb000u) | ((mag >> 2) & 0x7fu)));
   } else if (!is_sub && rn == 13u && rd <= 7u && (mag & 3u) == 0u &&
              (mag >> 2) <= 0xffu) {
     emit_t16(d, (u16)(0xa800u | ((rd & 7u) << 8) | ((mag >> 2) & 0xffu)));
   } else if (thumb_expand_imm_encode(mag, &out12)) {
     emit_t32(d, arm_dp_imm(is_sub ? 13u : 8u, 0u, rd, rn, out12));
   } else if (mag <= 0xfffu) {
     emit_t32(d, is_sub ? arm_sub_imm12(rd, rn, mag) : arm_add_imm12(rd, rn, mag));
   } else {
     asm_driver_panic(d, "arm32 asm: add/sub immediate not encodable");
   }
 }
 
 /* Encode + emit one instruction for the matched descriptor. */
 static void assemble_one(AsmDriver* d, const Arm32InsnDesc* desc, u32 cond) {
   Slice mn = desc->mnemonic;
   switch ((Arm32Format)desc->fmt) {
     case ARM_FMT_NONE: {
       emit_t16(d, (u16)(desc->match & 0xffffu));
       return;
     }
     case ARM_FMT_DP_REG:
     case ARM_FMT_SHIFT_REG: {
       u32 rd = parse_reg(d);
       u32 rn, rm;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       /* hw1 = base|rn, hw2 = (rd<<8)|rm (shift-reg uses hw2 0xF000 base). */
       if ((Arm32Format)desc->fmt == ARM_FMT_SHIFT_REG)
         emit_t32(d, desc->match | (rn << 16) | (rd << 8) | rm);
       else
         emit_t32(d, desc->match | (rn << 16) | (rd << 8) | rm);
       return;
     }
     case ARM_FMT_DP_IMM: {
       /* The mnemonic table prefers the modified-immediate row, but `add.w r0,
        * r1, r2` etc. take a register third operand. Dispatch on shape: a
        * register operand emits the shifted-register form (hw1 0xEAxx; the
        * op4/S selector bits sit in the same positions as the imm form). */
       u32 rd = parse_reg(d), rn;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       if (peek_is_reg(d)) {
         u32 rm = parse_reg(d);
         u32 base = (desc->match & ~(0xf000u << 16)) | (0xea00u << 16);
         emit_t32(d, base | (rn << 16) | (rd << 8) | rm);
       } else {
         u32 out12 = parse_modimm(d);
         u32 i = (out12 >> 11) & 1u, imm3 = (out12 >> 8) & 7u,
             imm8 = out12 & 0xffu;
         emit_t32(d, desc->match | (i << 26) | (rn << 16) | (imm3 << 12) |
                         (rd << 8) | imm8);
       }
       return;
     }
     case ARM_FMT_MOV_IMM: {
       /* `mov.w rd, #imm` (this row) or `mov.w rd, rm` (register form). The
        * register form is ORR rd, 1111, rm (hw1 0xEA4F for MOV / 0xEA6F MVN). */
       u32 rd = parse_reg(d);
       expect_comma(d);
       if (peek_is_reg(d)) {
         u32 rm = parse_reg(d);
         u32 mvn = slice_eq_cstr(mn, "mvn.w");
         emit_t32(d, arm_t32(mvn ? 0xea6fu : 0xea4fu, (rd << 8) | rm));
         return;
       }
       {
         u32 out12 = parse_modimm(d);
         u32 i = (out12 >> 11) & 1u, imm3 = (out12 >> 8) & 7u,
             imm8 = out12 & 0xffu;
         emit_t32(d, desc->match | (i << 26) | (imm3 << 12) | (rd << 8) | imm8);
       }
       return;
     }
     case ARM_FMT_MOV_REG: {
       u32 rd = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, desc->match | (rd << 8) | rm);
       return;
     }
     case ARM_FMT_CMP_REG: {
       u32 rn = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, desc->match | (rn << 16) | rm);
       return;
     }
     case ARM_FMT_CMP_IMM: {
       u32 rn = parse_reg(d), out12;
       expect_comma(d);
       if (peek_is_reg(d)) {
         u32 rm = parse_reg(d);
         u32 base = (desc->match & ~(0xf000u << 16)) | (0xea00u << 16);
         emit_t32(d, base | (rn << 16) | rm);
         return;
       }
       out12 = parse_modimm(d);
       {
         u32 i = (out12 >> 11) & 1u, imm3 = (out12 >> 8) & 7u,
             imm8 = out12 & 0xffu;
         emit_t32(d, desc->match | (i << 26) | (rn << 16) | (imm3 << 12) | imm8);
       }
       return;
     }
     case ARM_FMT_MOVW: {
       int is_movt = slice_eq_cstr(mn, "movt");
       u32 rd = parse_reg(d);
       RelocKind k;
       ObjSymId sym;
       i64 off;
       expect_comma(d);
       if (parse_movw_mod(d, &k, &sym, &off, is_movt)) {
         MCEmitter* mc = asm_driver_mc(d);
         u32 base = is_movt ? arm_movt(rd, 0) : arm_movw(rd, 0);
         mc_emit_reloc_at(mc, mc->section_id, mc_pos(mc), k, sym, off, 0, 0);
         emit_t32(d, base);
       } else {
         u32 imm16 = (u32)parse_imm(d) & 0xffffu;
         emit_t32(d, is_movt ? arm_movt(rd, imm16) : arm_movw(rd, imm16));
       }
       return;
     }
     case ARM_FMT_ADDW: {
       u32 rd = parse_reg(d), rn, imm12;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       imm12 = (u32)parse_imm(d) & 0xfffu;
       emit_t32(d, slice_eq_cstr(mn, "subw") ? arm_sub_imm12(rd, rn, imm12)
                                             : arm_add_imm12(rd, rn, imm12));
       return;
     }
     case ARM_FMT_SHIFT_IMM: {
       u32 type = (desc->match >> 4) & 3u; /* hw2[5:4] */
       u32 rd = parse_reg(d), rm, sh;
       expect_comma(d);
       rm = parse_reg(d);
       expect_comma(d);
       sh = (u32)parse_imm(d);
       emit_t32(d, arm_shift_imm(type, rd, rm, sh));
       return;
     }
     case ARM_FMT_MUL: {
       u32 rd = parse_reg(d), rn, rm;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, arm_mul(rd, rn, rm));
       return;
     }
     case ARM_FMT_MLA: {
       u32 rd = parse_reg(d), rn, rm, ra;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       expect_comma(d);
       ra = parse_reg(d);
       emit_t32(d, slice_eq_cstr(mn, "mls") ? arm_mls(rd, rn, rm, ra)
                                            : arm_mla(rd, rn, rm, ra));
       return;
     }
     case ARM_FMT_DIV: {
       u32 rd = parse_reg(d), rn, rm;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, slice_eq_cstr(mn, "udiv") ? arm_udiv(rd, rn, rm)
                                             : arm_sdiv(rd, rn, rm));
       return;
     }
     case ARM_FMT_MULL: {
       u32 rdlo = parse_reg(d), rdhi, rn, rm;
       expect_comma(d);
       rdhi = parse_reg(d);
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, slice_eq_cstr(mn, "smull") ? arm_smull(rdlo, rdhi, rn, rm)
                                              : arm_umull(rdlo, rdhi, rn, rm));
       return;
     }
     case ARM_FMT_EXT: {
       u32 rd = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, desc->match | (rd << 8) | rm);
       return;
     }
     case ARM_FMT_REV: {
       u32 rd = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       /* match has rm in hw1[3:0] and hw2[3:0]; both equal rm for REV/CLZ. */
       emit_t32(d, (desc->match & 0xfff0fff0u) | (rm << 16) | (rd << 8) | rm);
       return;
     }
     case ARM_FMT_BFX: {
       u32 rd = parse_reg(d), rn, lsb, width;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       lsb = (u32)parse_imm(d);
       expect_comma(d);
       width = (u32)parse_imm(d);
       emit_t32(d, slice_eq_cstr(mn, "ubfx") ? arm_ubfx(rd, rn, lsb, width)
                                             : arm_sbfx(rd, rn, lsb, width));
       return;
     }
     case ARM_FMT_BFI: {
       u32 rd = parse_reg(d), rn, lsb, width;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       lsb = (u32)parse_imm(d);
       expect_comma(d);
       width = (u32)parse_imm(d);
       emit_t32(d, arm_bfi(rd, rn, lsb, width));
       return;
     }
     case ARM_FMT_BFC: {
       u32 rd = parse_reg(d), lsb, width;
       expect_comma(d);
       lsb = (u32)parse_imm(d);
       expect_comma(d);
       width = (u32)parse_imm(d);
       emit_t32(d, arm_bfc(rd, lsb, width));
       return;
     }
     case ARM_FMT_SAT: {
       /* SSAT/USAT rd, #sat, rm (no-shift first cut; mnemonic picks signed vs
        * unsigned). */
       u32 rd = parse_reg(d), sat, rm;
       expect_comma(d);
       sat = (u32)parse_imm(d);
       expect_comma(d);
       rm = parse_reg(d);
       emit_t32(d, slice_eq_cstr(mn, "usat") ? arm_usat(rd, sat, rm)
                                             : arm_ssat(rd, sat, rm));
       return;
     }
     case ARM_FMT_QADD: {
       /* QADD/QSUB/QDADD/QDSUB rd, rm, rn (ARM operand order). */
       u32 rd = parse_reg(d), rm, rn;
       expect_comma(d);
       rm = parse_reg(d);
       expect_comma(d);
       rn = parse_reg(d);
       emit_t32(d, slice_eq_cstr(mn, "qsub")    ? arm_qsub(rd, rm, rn)
                   : slice_eq_cstr(mn, "qdadd") ? arm_qdadd(rd, rm, rn)
                   : slice_eq_cstr(mn, "qdsub") ? arm_qdsub(rd, rm, rn)
                                                : arm_qadd(rd, rm, rn));
       return;
     }
     case ARM_FMT_LDST_T3: {
       u32 rt = parse_reg(d), base;
       i64 disp;
       expect_comma(d);
       parse_mem(d, &base, &disp);
       if (disp < 0) {
         /* negative offset -> emit the T4 (±imm8) form. */
         u32 t4 = (desc->match & 0xfff00000u) - 0x00100000u; /* not used */
         (void)t4;
         asm_driver_panic(d, "arm32 asm: use the T4 (#-imm8) form for negative offsets");
       }
       emit_t32(d, (desc->match & 0xfff00000u) | (base << 16) | (rt << 12) |
                       ((u32)disp & 0xfffu));
       return;
     }
     case ARM_FMT_LDST_T4: {
       u32 rt = parse_reg(d), base;
       i64 disp;
       u32 add, imm8;
       expect_comma(d);
       parse_mem(d, &base, &disp);
       add = disp >= 0 ? 1u : 0u;
       imm8 = (u32)(disp < 0 ? -disp : disp) & 0xffu;
       emit_t32(d, (desc->match & 0xfff00000u) | (base << 16) | (rt << 12) |
                       0xc00u | (add << 9) | imm8);
       return;
     }
     case ARM_FMT_LDREX: {
       u32 rt = parse_reg(d), base;
       i64 disp = 0;
       expect_comma(d);
       parse_mem(d, &base, &disp);
       emit_t32(d, arm_ldrex(rt, base, (u32)(disp / 4)));
       return;
     }
     case ARM_FMT_STREX: {
       u32 rd = parse_reg(d), rt, base;
       i64 disp = 0;
       expect_comma(d);
       rt = parse_reg(d);
       expect_comma(d);
       parse_mem(d, &base, &disp);
       emit_t32(d, arm_strex(rd, rt, base, (u32)(disp / 4)));
       return;
     }
     case ARM_FMT_PUSHPOP: {
       u32 list = parse_reglist(d);
       emit_t32(d, slice_eq_cstr(mn, "pop.w") ? arm_pop_w(list)
                                              : arm_push_w(list));
       return;
     }
     case ARM_FMT_BARRIER: {
       u32 opt = parse_barrier_opt(d);
       emit_t32(d, (desc->match & 0xfffffff0u) | (opt & 0xfu));
       return;
     }
     case ARM_FMT_TB: {
       u32 rn, rm, sh;
       asm_driver_expect_punct(d, '[', "'[' in tbb/tbh operand");
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       (void)parse_opt_shift(d, &sh); /* lsl #1 for tbh — implied by mnemonic */
       asm_driver_expect_punct(d, ']', "']' in tbb/tbh operand");
       emit_t32(d, slice_eq_cstr(mn, "tbh") ? arm_tbh(rn, rm) : arm_tbb(rn, rm));
       return;
     }
     case ARM_FMT_BL: {
       /* Placeholder MUST match codegen's arm_bl(): the THM_CALL reloc is REL and
        * the patcher preserves the field's J1/J2 (XOR-S) base, so an ad-hoc
        * placeholder whose J1/J2 imply a nonzero in-field offset corrupts the
        * applied target (a +0xC00000 skew on cross-object calls). */
       emit_t32(d, arm_bl());                   /* placeholder (== codegen) */
       /* reloc rides the BL we just emitted (offset = its start). */
       {
         MCEmitter* mc = asm_driver_mc(d);
         ObjSymId sym = OBJ_SYM_NONE;
         i64 off = 0;
         u32 pos = mc_pos(mc) - 4u;
         asm_driver_parse_sym_expr(d, &sym, &off);
         mc_emit_reloc_at(mc, mc->section_id, pos, R_ARM_THM_CALL, sym, off, 0,
                          0);
       }
       return;
     }
     case ARM_FMT_BRANCH_T4: {
       emit_t32(d, arm_b_w());
       {
         MCEmitter* mc = asm_driver_mc(d);
         ObjSymId sym = OBJ_SYM_NONE;
         i64 off = 0;
         u32 pos = mc_pos(mc) - 4u;
         asm_driver_parse_sym_expr(d, &sym, &off);
         mc_emit_reloc_at(mc, mc->section_id, pos, R_ARM_THM_JUMP24, sym, off, 0,
                          0);
       }
       return;
     }
     case ARM_FMT_BRANCH_T3: {
       emit_t32(d, arm_b_cond_w(cond));
       {
         MCEmitter* mc = asm_driver_mc(d);
         ObjSymId sym = OBJ_SYM_NONE;
         i64 off = 0;
         u32 pos = mc_pos(mc) - 4u;
         asm_driver_parse_sym_expr(d, &sym, &off);
         mc_emit_reloc_at(mc, mc->section_id, pos, R_ARM_THM_JUMP19, sym, off, 0,
                          0);
       }
       return;
     }
     case ARM_FMT_B16:
     case ARM_FMT_BCC16: {
       /* 16-bit branches: emit the 32-bit wide form so the relocation has the
        * full range (the disassembler still round-trips the wide encoding). */
       if (cond == ARM_CC_AL) {
         emit_t32(d, arm_b_w());
         {
           MCEmitter* mc = asm_driver_mc(d);
           ObjSymId sym = OBJ_SYM_NONE;
           i64 off = 0;
           u32 pos = mc_pos(mc) - 4u;
           asm_driver_parse_sym_expr(d, &sym, &off);
           mc_emit_reloc_at(mc, mc->section_id, pos, R_ARM_THM_JUMP24, sym, off,
                            0, 0);
         }
       } else {
         emit_t32(d, arm_b_cond_w(cond));
         {
           MCEmitter* mc = asm_driver_mc(d);
           ObjSymId sym = OBJ_SYM_NONE;
           i64 off = 0;
           u32 pos = mc_pos(mc) - 4u;
           asm_driver_parse_sym_expr(d, &sym, &off);
           mc_emit_reloc_at(mc, mc->section_id, pos, R_ARM_THM_JUMP19, sym, off,
                            0, 0);
         }
       }
       return;
     }
     case ARM_FMT_CBZ: {
       u32 rn = parse_reg(d);
       i64 imm;
       expect_comma(d);
       (void)asm_driver_eat_punct(d, '#');
       imm = asm_driver_parse_const(d);
       {
         /* imm is the PC-relative byte offset (must be +4..+130, even). The
          * encoded imm6 is (off-4)/2 half-words from the branch. */
         i64 hw = (imm - 4) / 2;
         u32 op = slice_eq_cstr(mn, "cbnz") ? 1u : 0u;
         if (imm < 4 || imm > 130 || (imm & 1))
           asm_driver_panic(d, "arm32 asm: cbz/cbnz target out of range");
         emit_t16(d, arm_cbz_raw(op, rn, (u32)hw));
       }
       return;
     }
     case ARM_FMT_IT: {
       /* `it<x><y><z> cc` — the suffix letters arrive folded into the mnemonic
        * (e.g. "itte"); we recover the mask from the suffix + the firstcond. */
       AsmTok t = asm_driver_next(d);
       Slice ccn;
       int fc;
       u32 mask;
       size_t nletters = mn.len - 2; /* letters after "it" */
       if (t.kind != ASM_TOK_IDENT)
         asm_driver_panic(d, "arm32 asm: IT expects a condition");
       ccn = pool_slice(asm_driver_pool(d), t.v.ident);
       fc = arm32_cond_from_name(ccn);
       if (fc < 0) asm_driver_panic(d, "arm32 asm: bad IT condition");
       /* Build the mask: bit3=1; for each of the up-to-3 suffix letters, bit
        * (3-k) is set to firstcond[0] for 't' (then) or its inverse for 'e'. */
       mask = 0x8u;
       {
         u32 then = (u32)fc & 1u;
         for (size_t k = 0; k < nletters && k < 3; ++k) {
           u32 bit = (mn.s[2 + k] == 't') ? then : (then ^ 1u);
           mask |= (bit << (3u - (u32)(k + 1)));
         }
         /* The lowest set bit position marks the block end. */
         mask |= (1u << (3u - (u32)nletters));
       }
       emit_t16(d, arm_it((u32)fc, mask));
       return;
     }
     case ARM_FMT_MOVHI16: {
       u32 rd = parse_reg(d), rm;
       expect_comma(d);
       /* `mov rd, #imm` selects the 32-bit mov.w (preserving mov's no-flags
        * semantics; conditionalizable inside an IT block as `moveq`/etc.). */
       if (!peek_is_reg(d)) {
         u32 out12;
         if (!thumb_expand_imm_encode((u32)parse_imm(d), &out12))
           asm_driver_panic(d, "arm32 asm: mov immediate not encodable");
         emit_t32(d, arm_mov_imm(rd, out12));
         return;
       }
       rm = parse_reg(d);
       emit_t16(d, arm_mov_hi(rd, rm));
       return;
     }
     case ARM_FMT_BX: {
       u32 rm = parse_reg(d);
       emit_t16(d, slice_eq_cstr(mn, "blx") ? arm_blx_reg(rm) : arm_bx(rm));
       return;
     }
     case ARM_FMT_BKPT: {
       u32 imm8 = (u32)parse_imm(d) & 0xffu;
       emit_t16(d, slice_eq_cstr(mn, "udf") ? arm_udf(imm8) : arm_bkpt(imm8));
       return;
     }
     case ARM_FMT_EXT16: {
       u32 rd = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       emit_t16(d, (u16)((desc->match & 0xffc0u) | ((rm & 7u) << 3) | (rd & 7u)));
       return;
     }
     case ARM_FMT_DPI8_16: {
       u32 rd = parse_reg(d), imm8;
       expect_comma(d);
       imm8 = (u32)parse_imm(d) & 0xffu;
       emit_t16(d, (u16)((desc->match & 0xf800u) | ((rd & 7u) << 8) | imm8));
       return;
     }
     case ARM_FMT_ADDSUB3_16: {
       u32 rd = parse_reg(d), rn, imm3;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       imm3 = (u32)parse_imm(d) & 7u;
       emit_t16(d, (u16)((desc->match & 0xfe00u) | (imm3 << 6) | ((rn & 7u) << 3) |
                         (rd & 7u)));
       return;
     }
     case ARM_FMT_ADDSUBR_16: {
       u32 rd = parse_reg(d), rn, rm;
       expect_comma(d);
       rn = parse_reg(d);
       expect_comma(d);
       rm = parse_reg(d);
       emit_t16(d, (u16)((desc->match & 0xfe00u) | ((rm & 7u) << 6) |
                         ((rn & 7u) << 3) | (rd & 7u)));
       return;
     }
     case ARM_FMT_SHIFTI_16: {
       u32 rd = parse_reg(d), rm, imm5;
       expect_comma(d);
       rm = parse_reg(d);
       expect_comma(d);
       imm5 = (u32)parse_imm(d) & 0x1fu;
       emit_t16(d, (u16)((desc->match & 0xf800u) | (imm5 << 6) | ((rm & 7u) << 3) |
                         (rd & 7u)));
       return;
     }
     case ARM_FMT_ALU_16: {
       u32 rdn = parse_reg(d), rm;
       expect_comma(d);
       rm = parse_reg(d);
       if (slice_eq_cstr(mn, "muls")) {
         /* muls rdm, rn, rdm — skip the (redundant) third operand if present. */
         if (asm_driver_eat_comma(d)) (void)parse_reg(d);
       }
       emit_t16(d, (u16)((desc->match & 0xffc0u) | ((rm & 7u) << 3) | (rdn & 7u)));
       return;
     }
     case ARM_FMT_HIREG_16: {
       u32 rdn = parse_reg(d), rm;
       expect_comma(d);
       /* `cmp` resolves to this hi-register compare first; an immediate second
        * operand (`cmp rn, #imm`) selects the modified-immediate compare — the
        * 16-bit DPI8 form when rn<=r7 and imm8 fits, else the 32-bit cmp.w. */
       if (!peek_is_reg(d) && slice_eq_cstr(mn, "cmp")) {
         i64 imm = parse_imm(d);
         if (rdn <= 7u && imm >= 0 && imm <= 255)
           emit_t16(d, (u16)(0x2800u | (rdn << 8) | (u32)(imm & 0xffu)));
         else {
           u32 out12;
           if (!thumb_expand_imm_encode((u32)imm, &out12))
             asm_driver_panic(d, "arm32 asm: cmp immediate not encodable");
           emit_t32(d, arm_cmp_imm(rdn, out12));
         }
         return;
       }
       rm = parse_reg(d);
       /* A third operand means the general `add rd, rn, <#imm | rm>` (rd=rdn,
        * rn=rm): there is no 16-bit non-flag add-immediate or 3-register form, so
        * route it through the shared encoder (which also covers the sp-relative
        * forms). Without a third operand this is the 2-operand hi-register
        * `add rdn, rm` below; the old SP-only special case dropped every other
        * immediate. */
       if (slice_eq_cstr(mn, "add") && asm_driver_eat_comma(d)) {
         arm_asm_addsub_third(d, 0, rdn, rm);
         return;
       }
       emit_t16(d, (u16)((desc->match & 0xff00u) | (((rdn >> 3) & 1u) << 7) |
                         ((rm & 0xfu) << 3) | (rdn & 7u)));
       return;
     }
     case ARM_FMT_LDSTI5_16: {
       u32 rt = parse_reg(d), base;
       i64 disp;
       u32 op, scale, imm5;
       expect_comma(d);
       parse_mem(d, &base, &disp);
       op = (desc->match >> 11) & 0x1fu;
       scale = (op <= 0x0du) ? 4u : (op <= 0x0fu) ? 1u : 2u;
       /* A word str/ldr through SP uses the dedicated SP-relative T2 encoding
        * (0x9000/0x9800, imm8*4); the low-register T1 form here would truncate
        * sp(r13) to r5. */
       if (base == 13u && rt <= 7u &&
           (slice_eq_cstr(mn, "str") || slice_eq_cstr(mn, "ldr"))) {
         u32 sp_op = slice_eq_cstr(mn, "ldr") ? 0x9800u : 0x9000u;
         emit_t16(d, (u16)(sp_op | ((rt & 7u) << 8) | (((u32)disp / 4u) & 0xffu)));
         return;
       }
       /* The 16-bit T1 forms only encode low transfer + base registers and a
        * scaled imm5. A high register (e.g. saving sp/lr in the coroutine switch,
        * `str lr, [r0, #36]`), a high base, or an out-of-range / unscalable
        * displacement falls to the 32-bit T3 form (hw1 op|rn, hw2 rt<<12|imm12). */
       if (rt > 7u || base > 7u || disp < 0 || (u32)disp > 31u * scale ||
           (u32)disp % scale != 0u) {
         u32 t3 = (desc->match == 0x6000u)   ? 0xf8c0u   /* str  */
                  : (desc->match == 0x6800u) ? 0xf8d0u   /* ldr  */
                  : (desc->match == 0x7000u) ? 0xf880u   /* strb */
                  : (desc->match == 0x7800u) ? 0xf890u   /* ldrb */
                  : (desc->match == 0x8000u) ? 0xf8a0u   /* strh */
                                             : 0xf8b0u;  /* ldrh */
         if (disp < 0 || disp > 4095)
           asm_driver_panic(d, "arm32 asm: ldr/str offset out of T3 range");
         emit_t32(d, arm_t32(t3 | (base & 0xfu),
                             ((rt & 0xfu) << 12) | ((u32)disp & 0xfffu)));
         return;
       }
       imm5 = ((u32)disp / scale) & 0x1fu;
       emit_t16(d, (u16)((desc->match & 0xf800u) | (imm5 << 6) |
                         ((base & 7u) << 3) | (rt & 7u)));
       return;
     }
     case ARM_FMT_LDSTSP_16: {
       u32 rt = parse_reg(d), base;
       i64 disp;
       expect_comma(d);
       parse_mem(d, &base, &disp);
       emit_t16(d, (u16)((desc->match & 0xf800u) | ((rt & 7u) << 8) |
                         (((u32)disp / 4u) & 0xffu)));
       return;
     }
     case ARM_FMT_ADDSP_16: {
       u32 rd = parse_reg(d), imm8;
       expect_comma(d);
       (void)parse_reg(d); /* sp/pc — implied by the mnemonic/encoding */
       expect_comma(d);
       imm8 = ((u32)parse_imm(d) / 4u) & 0xffu;
       emit_t16(d, (u16)((desc->match & 0xf800u) | ((rd & 7u) << 8) | imm8));
       return;
     }
     case ARM_FMT_ADJSP_16: {
       /* Plain `sub` (and the unreachable plain-`add` row) land here. Parse the
        * real registers and route through the shared add/sub encoder, which picks
        * the 16-bit sp-adjust when rd==rn==sp. Accept the 2-operand shorthand
        * `sub rd, #imm` (== `sub rd, rd, #imm`); the old code assumed sp/sp and
        * silently mis-encoded `sub rN, rN, #imm` as `sub sp, sp, #...`. */
       int is_sub = slice_eq_cstr(mn, "sub");
       u32 rd = parse_reg(d), rn;
       expect_comma(d);
       if (peek_is_reg(d)) {
         rn = parse_reg(d);
         expect_comma(d);
       } else {
         rn = rd;
       }
       arm_asm_addsub_third(d, is_sub, rd, rn);
       return;
     }
     case ARM_FMT_PUSHPOP_16: {
       u32 list = parse_reglist(d);
       u32 lo = list & 0xffu;
       u32 extra = slice_eq_cstr(mn, "pop") ? ((list >> 15) & 1u)
                                            : ((list >> 14) & 1u);
       emit_t16(d, (u16)((desc->match & 0xfe00u) | (extra << 8) | lo));
       return;
     }
   }
   asm_driver_panic(d, "arm32 asm: unhandled instruction format");
 }
 
 static void arm32_arch_asm_insn(ArchAsm* base, AsmDriver* d, Sym mnemonic) {
   const Arm32InsnDesc* desc;
   u32 cond = ARM_CC_AL;
   (void)base;
   (void)asm_driver_cur_section(d); /* ensure .text exists */
   desc = resolve_mnemonic(d, pool_slice(asm_driver_pool(d), mnemonic), &cond);
   assemble_one(d, desc, cond);
 }
 
 void arm32_asm_insn(Arm32Asm* a, AsmDriver* d, Sym mnemonic) {
   arm32_arch_asm_insn(&a->base, d, mnemonic);
 }
 
 static void arm32_arch_asm_destroy(ArchAsm* base) { (void)base; }
 
 static void run_one_line(Arm32Asm* a, MCEmitter* mc, const char* text,
                          size_t len) {
   size_t i;
   for (i = 0; i < len; ++i) {
     if (text[i] != ' ' && text[i] != '\t') break;
   }
   if (i == len) return;
 
   AsmLexer* lx = asm_lex_open_mem(a->c, "<inline-asm>", text, len);
   AsmDriver* d = asm_driver_open_inline(a->c, mc, lx);
 
   AsmTok t = asm_driver_peek(d);
   while (t.kind == ASM_TOK_NEWLINE || t.kind == ASM_TOK_HASH) {
     (void)asm_driver_next(d);
     if (t.kind == ASM_TOK_HASH) {
       while (!asm_driver_at_eol(d)) (void)asm_driver_next(d);
     }
     t = asm_driver_peek(d);
   }
   if (t.kind == ASM_TOK_EOF) {
     asm_driver_close_inline(d);
     asm_lex_close(lx);
     return;
   }
   if (t.kind != ASM_TOK_IDENT)
     inline_panic(a, "expected mnemonic at start of inline asm line");
   (void)asm_driver_next(d);
   Sym mn = t.v.ident;
   AsmTok dot = asm_driver_peek(d);
   while (asm_driver_tok_is_punct(dot, '.')) {
     (void)asm_driver_next(d);
     AsmTok rest = asm_driver_next(d);
     if (rest.kind != ASM_TOK_IDENT)
       inline_panic(a, "composite mnemonic: expected ident after '.'");
     Slice hsl = pool_slice(asm_driver_pool(d), mn);
     Slice rsl = pool_slice(asm_driver_pool(d), rest.v.ident);
     char buf[64];
     if (hsl.len + 1u + rsl.len >= sizeof buf)
       inline_panic(a, "composite mnemonic too long");
     memcpy(buf, hsl.s, hsl.len);
     buf[hsl.len] = '.';
     memcpy(buf + hsl.len + 1u, rsl.s, rsl.len);
     mn = pool_intern_slice(asm_driver_pool(d),
                            (Slice){.s = buf, .len = hsl.len + 1u + rsl.len});
     dot = asm_driver_peek(d);
   }
   arm32_asm_insn(a, d, mn);
   asm_driver_close_inline(d);
   asm_lex_close(lx);
 }
 
 static void render_and_run_line(Arm32Asm* a, MCEmitter* mc, StrBuf* sb,
                                 const char* start, const char* end) {
   strbuf_reset(sb);
   for (const char* p = start; p < end; ++p) {
     char c = *p;
     if (c != '%') {
       strbuf_putc(sb, c);
       continue;
     }
     if (p + 1 >= end) inline_panic(a, "trailing '%' in template");
     char n = *(p + 1);
     if (n == '%') {
       strbuf_putc(sb, '%');
       ++p;
       continue;
     }
     int form = 0;
     if (n == 'a') {
       form = 3;
       ++p;
       if (p + 1 >= end) inline_panic(a, "trailing '%' modifier in template");
       n = *(p + 1);
     }
     if (n == '[') {
       const char* nbeg = p + 2;
       const char* nend = nbeg;
       while (nend < end && *nend != ']') ++nend;
       if (nend == end) inline_panic(a, "unterminated %[name]");
       Sym needle = pool_intern_slice(
           a->c->global, (Slice){.s = nbeg, .len = (size_t)(nend - nbeg)});
       u32 idx = lookup_named(a, needle);
       if (idx == (u32)-1)
         inline_panic(a, "%[name] does not match any constraint");
       p = nend;
       render_operand(a, sb, idx, form);
       continue;
     }
     if (n < '0' || n > '9') inline_panic(a, "expected digit after '%'");
     u32 idx = (u32)(n - '0');
     ++p;
     if (p + 1 < end && *(p + 1) >= '0' && *(p + 1) <= '9') {
       idx = idx * 10u + (u32)(*(p + 1) - '0');
       ++p;
     }
     render_operand(a, sb, idx, form);
   }
   if (sb->truncated) inline_panic(a, "inline asm line buffer overflow");
   run_one_line(a, mc, strbuf_cstr(sb), strbuf_len(sb));
 }
 
 void arm32_asm_run_template(Arm32Asm* a, MCEmitter* mc, const char* tmpl) {
   if (!tmpl || !*tmpl) return;
 
   char buf[512];
   StrBuf sb;
   strbuf_init(&sb, buf, sizeof buf);
 
   const char* line_start = tmpl;
   int bracket = 0;
   char quote = 0;
   for (const char* p = tmpl;; ++p) {
     char c = *p;
     if (c == '\0') {
       render_and_run_line(a, mc, &sb, line_start, p);
       break;
     }
     if (quote) {
       if (c == '\\' && *(p + 1)) {
         ++p;
         continue;
       }
       if (c == quote) quote = 0;
       continue;
     }
     if (c == '"' || c == '\'') {
       quote = c;
       continue;
     }
     if (c == '[') {
       ++bracket;
       continue;
     }
     if (c == ']' && bracket > 0) {
       --bracket;
       continue;
     }
     if ((c == '\n' || c == ';') && bracket == 0) {
       render_and_run_line(a, mc, &sb, line_start, p);
       line_start = p + 1;
     }
   }
 }
 
 /* ---- textual-assembly operand syntax (printer <-> parser seam) ----
  * Inverse of the `.s` parsers above. ARM uses the GNU-as `:lower16:`/`:upper16:`
  * prefix form for MOVW/MOVT symbol halves and bare numeric targets for branches
  * (the symbolizer synthesizes labels for the local-branch set). */
 static int arm32_reloc_operand(u16 kind, KitObjFmt fmt, ArchRelocOperand* out) {
   (void)fmt;
   out->prefix = "";
   out->suffix = "";
   out->addend_bias = 0;
   out->emit_anchor = 0;
   out->ref_anchor = 0;
   switch (kind) {
     case R_ARM_THM_MOVW_ABS_NC:
       out->surg = ARCH_RELOC_SURG_TAIL;
       out->prefix = "#:lower16:";
       return 1;
     case R_ARM_THM_MOVT_ABS:
       out->surg = ARCH_RELOC_SURG_TAIL;
       out->prefix = "#:upper16:";
       return 1;
     case R_ARM_THM_CALL:
     case R_ARM_THM_JUMP24:
     case R_ARM_THM_JUMP19:
       out->surg = ARCH_RELOC_SURG_TAIL;
       return 1;
     default:
       return 0; /* R_ABS32 / R_REL32 / TLS -> keep numeric */
   }
 }
 
 /* Intra-section local branches whose target the disassembler renders
  * numerically; cc -S synthesizes a label there. Calls (bl) are excluded. */
 static int arm32_is_local_branch(KitSlice m) {
   if (m.len >= 1 && m.s[0] == 'b') {
     if (slice_eq_cstr(m, "b") || slice_eq_cstr(m, "b.w")) return 1;
     if (slice_eq_cstr(m, "cbz") || slice_eq_cstr(m, "cbnz")) return 1;
     /* b<cond> / b<cond>.w */
     {
       size_t base = m.len;
       if (m.len >= 3 && m.s[m.len - 2] == '.' && m.s[m.len - 1] == 'w')
         base = m.len - 2;
       if (base == 3) {
         if (arm32_cond_from_name(arm_slice(m.s + 1, 2)) >= 0) return 1;
       }
     }
   }
   return 0;
 }
 
 const ArchAsmOps arm32_asm_ops = {
     .reloc_operand = arm32_reloc_operand,
     .is_local_branch = arm32_is_local_branch,
     /* ARM EABI: function symbols carry a Thumb (LSB) ISA-state bit; the
      * standalone assembler's `.thumb_func` / `.size . - SYM` / label-define
      * bookkeeping keys off this flag (see ArchAsmOps). */
     .thumb_function_symbols = 1,
 };
 
 ArchAsm* arm32_arch_asm_new(Compiler* c) {
   Arm32Asm* a = arm32_asm_open(c);
   a->base.insn = arm32_arch_asm_insn;
   a->base.destroy = arm32_arch_asm_destroy;
   return &a->base;
 }