1 /****************************************************************************
3 * Realmode X86 Emulator Library
5 * Copyright (C) 1996-1999 SciTech Software, Inc.
6 * Copyright (C) David Mosberger-Tang
7 * Copyright (C) 1999 Egbert Eich
9 * ========================================================================
11 * Permission to use, copy, modify, distribute, and sell this software and
12 * its documentation for any purpose is hereby granted without fee,
13 * provided that the above copyright notice appear in all copies and that
14 * both that copyright notice and this permission notice appear in
15 * supporting documentation, and that the name of the authors not be used
16 * in advertising or publicity pertaining to distribution of the software
17 * without specific, written prior permission. The authors makes no
18 * representations about the suitability of this software for any purpose.
19 * It is provided "as is" without express or implied warranty.
21 * THE AUTHORS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
22 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
23 * EVENT SHALL THE AUTHORS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
24 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
25 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
26 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
27 * PERFORMANCE OF THIS SOFTWARE.
29 * ========================================================================
33 * Developer: Kendall Bennett
35 * Description: This file includes subroutines which are related to
36 * instruction decoding and accessess of immediate data via IP. etc.
38 ****************************************************************************/
40 /* $XFree86: xc/extras/x86emu/src/x86emu/decode.c,v 1.8 2000/12/13 03:19:34 tsi Exp $ */
42 #include "x86emu/x86emui.h"
43 #include "cfe_console.h"
45 /*----------------------------- Implementation ----------------------------*/
47 /****************************************************************************
49 Handles any pending asychronous interrupts.
50 ****************************************************************************/
51 static void x86emu_intr_handle(void)
55 if (M
.x86
.intr
& INTR_SYNCH
) {
57 if (_X86EMU_intrTab
[intno
]) {
58 (*_X86EMU_intrTab
[intno
])(intno
);
60 push_word((u16
)M
.x86
.R_FLG
);
63 push_word(M
.x86
.R_CS
);
64 M
.x86
.R_CS
= mem_access_word(intno
* 4 + 2);
65 push_word(M
.x86
.R_IP
);
66 M
.x86
.R_IP
= mem_access_word(intno
* 4);
72 /****************************************************************************
74 intrnum - Interrupt number to raise
77 Raise the specified interrupt to be handled before the execution of the
79 ****************************************************************************/
80 void x86emu_intr_raise(
83 M
.x86
.intno
= intrnum
;
84 M
.x86
.intr
|= INTR_SYNCH
;
91 /****************************************************************************
93 Main execution loop for the emulator. We return from here when the system
94 halts, which is normally caused by a stack fault when we return from the
95 original real mode call.
96 ****************************************************************************/
97 void X86EMU_exec(void)
102 DB(x86emu_end_instr();)
105 DB( if (CHECK_IP_FETCH())
106 x86emu_check_ip_access();)
107 /* If debugging, save the IP and CS values. */
108 SAVE_IP_CS(M
.x86
.R_CS
, M
.x86
.R_IP
);
109 INC_DECODED_INST_LEN(1);
111 if (M
.x86
.intr
& INTR_HALTED
) {
112 DB( printk("halted\n");
113 X86EMU_trace_regs();)
116 if (((M
.x86
.intr
& INTR_SYNCH
) && (M
.x86
.intno
== 0 || M
.x86
.intno
== 2)) ||
117 !ACCESS_FLAG(F_IF
)) {
118 x86emu_intr_handle();
122 if (inb(0x3f8 + 5) & 1) {
123 M
.x86
.debug
|= DEBUG_STEP_F
| DEBUG_DECODE_F
| DEBUG_TRACE_F
;
126 op1
= (*sys_rdb
)(((u32
)M
.x86
.R_CS
<< 4) + (M
.x86
.R_IP
++));
127 (*x86emu_optab
[op1
])(op1
);
131 /****************************************************************************
133 Halts the system by setting the halted system flag.
134 ****************************************************************************/
135 void X86EMU_halt_sys(void)
137 M
.x86
.intr
|= INTR_HALTED
;
140 /****************************************************************************
142 mod - Mod value from decoded byte
143 regh - Reg h value from decoded byte
144 regl - Reg l value from decoded byte
147 Raise the specified interrupt to be handled before the execution of the
150 NOTE: Do not inline this function, as (*sys_rdb) is already inline!
151 ****************************************************************************/
152 void fetch_decode_modrm(
159 DB( if (CHECK_IP_FETCH())
160 x86emu_check_ip_access();)
161 fetched
= (*sys_rdb
)(((u32
)M
.x86
.R_CS
<< 4) + (M
.x86
.R_IP
++));
162 INC_DECODED_INST_LEN(1);
163 *mod
= (fetched
>> 6) & 0x03;
164 *regh
= (fetched
>> 3) & 0x07;
165 *regl
= (fetched
>> 0) & 0x07;
168 /****************************************************************************
170 Immediate byte value read from instruction queue
173 This function returns the immediate byte from the instruction queue, and
174 moves the instruction pointer to the next value.
176 NOTE: Do not inline this function, as (*sys_rdb) is already inline!
177 ****************************************************************************/
178 u8
fetch_byte_imm(void)
182 DB( if (CHECK_IP_FETCH())
183 x86emu_check_ip_access();)
184 fetched
= (*sys_rdb
)(((u32
)M
.x86
.R_CS
<< 4) + (M
.x86
.R_IP
++));
185 INC_DECODED_INST_LEN(1);
189 /****************************************************************************
191 Immediate word value read from instruction queue
194 This function returns the immediate byte from the instruction queue, and
195 moves the instruction pointer to the next value.
197 NOTE: Do not inline this function, as (*sys_rdw) is already inline!
198 ****************************************************************************/
199 u16
fetch_word_imm(void)
203 DB( if (CHECK_IP_FETCH())
204 x86emu_check_ip_access();)
205 fetched
= (*sys_rdw
)(((u32
)M
.x86
.R_CS
<< 4) + (M
.x86
.R_IP
));
207 INC_DECODED_INST_LEN(2);
211 /****************************************************************************
213 Immediate lone value read from instruction queue
216 This function returns the immediate byte from the instruction queue, and
217 moves the instruction pointer to the next value.
219 NOTE: Do not inline this function, as (*sys_rdw) is already inline!
220 ****************************************************************************/
221 u32
fetch_long_imm(void)
225 DB( if (CHECK_IP_FETCH())
226 x86emu_check_ip_access();)
227 fetched
= (*sys_rdl
)(((u32
)M
.x86
.R_CS
<< 4) + (M
.x86
.R_IP
));
229 INC_DECODED_INST_LEN(4);
233 /****************************************************************************
235 Value of the default data segment
238 Inline function that returns the default data segment for the current
241 On the x86 processor, the default segment is not always DS if there is
242 no segment override. Address modes such as -3[BP] or 10[BP+SI] all refer to
243 addresses relative to SS (ie: on the stack). So, at the minimum, all
244 decodings of addressing modes would have to set/clear a bit describing
245 whether the access is relative to DS or SS. That is the function of the
246 cpu-state-varible M.x86.mode. There are several potential states:
248 repe prefix seen (handled elsewhere)
249 repne prefix seen (ditto)
258 ds/ss select (in absense of override)
260 Each of the above 7 items are handled with a bit in the mode field.
261 ****************************************************************************/
262 _INLINE u32
get_data_segment(void)
264 #define GET_SEGMENT(segment)
265 switch (M
.x86
.mode
& SYSMODE_SEGMASK
) {
266 case 0: /* default case: use ds register */
267 case SYSMODE_SEGOVR_DS
:
268 case SYSMODE_SEGOVR_DS
| SYSMODE_SEG_DS_SS
:
270 case SYSMODE_SEG_DS_SS
: /* non-overridden, use ss register */
272 case SYSMODE_SEGOVR_CS
:
273 case SYSMODE_SEGOVR_CS
| SYSMODE_SEG_DS_SS
:
275 case SYSMODE_SEGOVR_ES
:
276 case SYSMODE_SEGOVR_ES
| SYSMODE_SEG_DS_SS
:
278 case SYSMODE_SEGOVR_FS
:
279 case SYSMODE_SEGOVR_FS
| SYSMODE_SEG_DS_SS
:
281 case SYSMODE_SEGOVR_GS
:
282 case SYSMODE_SEGOVR_GS
| SYSMODE_SEG_DS_SS
:
284 case SYSMODE_SEGOVR_SS
:
285 case SYSMODE_SEGOVR_SS
| SYSMODE_SEG_DS_SS
:
289 printk("error: should not happen: multiple overrides.\n");
296 /****************************************************************************
298 offset - Offset to load data from
301 Byte value read from the absolute memory location.
303 NOTE: Do not inline this function as (*sys_rdX) is already inline!
304 ****************************************************************************/
309 if (CHECK_DATA_ACCESS())
310 x86emu_check_data_access((u16
)get_data_segment(), offset
);
312 return (*sys_rdb
)((get_data_segment() << 4) + offset
);
315 /****************************************************************************
317 offset - Offset to load data from
320 Word value read from the absolute memory location.
322 NOTE: Do not inline this function as (*sys_rdX) is already inline!
323 ****************************************************************************/
328 if (CHECK_DATA_ACCESS())
329 x86emu_check_data_access((u16
)get_data_segment(), offset
);
331 return (*sys_rdw
)((get_data_segment() << 4) + offset
);
334 /****************************************************************************
336 offset - Offset to load data from
339 Long value read from the absolute memory location.
341 NOTE: Do not inline this function as (*sys_rdX) is already inline!
342 ****************************************************************************/
347 if (CHECK_DATA_ACCESS())
348 x86emu_check_data_access((u16
)get_data_segment(), offset
);
350 return (*sys_rdl
)((get_data_segment() << 4) + offset
);
353 /****************************************************************************
355 segment - Segment to load data from
356 offset - Offset to load data from
359 Byte value read from the absolute memory location.
361 NOTE: Do not inline this function as (*sys_rdX) is already inline!
362 ****************************************************************************/
363 u8
fetch_data_byte_abs(
368 if (CHECK_DATA_ACCESS())
369 x86emu_check_data_access(segment
, offset
);
371 return (*sys_rdb
)(((u32
)segment
<< 4) + offset
);
374 /****************************************************************************
376 segment - Segment to load data from
377 offset - Offset to load data from
380 Word value read from the absolute memory location.
382 NOTE: Do not inline this function as (*sys_rdX) is already inline!
383 ****************************************************************************/
384 u16
fetch_data_word_abs(
389 if (CHECK_DATA_ACCESS())
390 x86emu_check_data_access(segment
, offset
);
392 return (*sys_rdw
)(((u32
)segment
<< 4) + offset
);
395 /****************************************************************************
397 segment - Segment to load data from
398 offset - Offset to load data from
401 Long value read from the absolute memory location.
403 NOTE: Do not inline this function as (*sys_rdX) is already inline!
404 ****************************************************************************/
405 u32
fetch_data_long_abs(
410 if (CHECK_DATA_ACCESS())
411 x86emu_check_data_access(segment
, offset
);
413 return (*sys_rdl
)(((u32
)segment
<< 4) + offset
);
416 /****************************************************************************
418 offset - Offset to store data at
422 Writes a word value to an segmented memory location. The segment used is
423 the current 'default' segment, which may have been overridden.
425 NOTE: Do not inline this function as (*sys_wrX) is already inline!
426 ****************************************************************************/
427 void store_data_byte(
432 if (CHECK_DATA_ACCESS())
433 x86emu_check_data_access((u16
)get_data_segment(), offset
);
435 (*sys_wrb
)((get_data_segment() << 4) + offset
, val
);
438 /****************************************************************************
440 offset - Offset to store data at
444 Writes a word value to an segmented memory location. The segment used is
445 the current 'default' segment, which may have been overridden.
447 NOTE: Do not inline this function as (*sys_wrX) is already inline!
448 ****************************************************************************/
449 void store_data_word(
454 if (CHECK_DATA_ACCESS())
455 x86emu_check_data_access((u16
)get_data_segment(), offset
);
457 (*sys_wrw
)((get_data_segment() << 4) + offset
, val
);
460 /****************************************************************************
462 offset - Offset to store data at
466 Writes a long value to an segmented memory location. The segment used is
467 the current 'default' segment, which may have been overridden.
469 NOTE: Do not inline this function as (*sys_wrX) is already inline!
470 ****************************************************************************/
471 void store_data_long(
476 if (CHECK_DATA_ACCESS())
477 x86emu_check_data_access((u16
)get_data_segment(), offset
);
479 (*sys_wrl
)((get_data_segment() << 4) + offset
, val
);
482 /****************************************************************************
484 segment - Segment to store data at
485 offset - Offset to store data at
489 Writes a byte value to an absolute memory location.
491 NOTE: Do not inline this function as (*sys_wrX) is already inline!
492 ****************************************************************************/
493 void store_data_byte_abs(
499 if (CHECK_DATA_ACCESS())
500 x86emu_check_data_access(segment
, offset
);
502 (*sys_wrb
)(((u32
)segment
<< 4) + offset
, val
);
505 /****************************************************************************
507 segment - Segment to store data at
508 offset - Offset to store data at
512 Writes a word value to an absolute memory location.
514 NOTE: Do not inline this function as (*sys_wrX) is already inline!
515 ****************************************************************************/
516 void store_data_word_abs(
522 if (CHECK_DATA_ACCESS())
523 x86emu_check_data_access(segment
, offset
);
525 (*sys_wrw
)(((u32
)segment
<< 4) + offset
, val
);
528 /****************************************************************************
530 segment - Segment to store data at
531 offset - Offset to store data at
535 Writes a long value to an absolute memory location.
537 NOTE: Do not inline this function as (*sys_wrX) is already inline!
538 ****************************************************************************/
539 void store_data_long_abs(
545 if (CHECK_DATA_ACCESS())
546 x86emu_check_data_access(segment
, offset
);
548 (*sys_wrl
)(((u32
)segment
<< 4) + offset
, val
);
551 /****************************************************************************
553 reg - Register to decode
556 Pointer to the appropriate register
559 Return a pointer to the register given by the R/RM field of the
560 modrm byte, for byte operands. Also enables the decoding of instructions.
561 ****************************************************************************/
562 u8
* decode_rm_byte_register(
592 return NULL
; /* NOT REACHED OR REACHED ON ERROR */
595 /****************************************************************************
597 reg - Register to decode
600 Pointer to the appropriate register
603 Return a pointer to the register given by the R/RM field of the
604 modrm byte, for word operands. Also enables the decoding of instructions.
605 ****************************************************************************/
606 u16
* decode_rm_word_register(
636 return NULL
; /* NOTREACHED OR REACHED ON ERROR */
639 /****************************************************************************
641 reg - Register to decode
644 Pointer to the appropriate register
647 Return a pointer to the register given by the R/RM field of the
648 modrm byte, for dword operands. Also enables the decoding of instructions.
649 ****************************************************************************/
650 u32
* decode_rm_long_register(
655 DECODE_PRINTF("EAX");
658 DECODE_PRINTF("ECX");
661 DECODE_PRINTF("EDX");
664 DECODE_PRINTF("EBX");
667 DECODE_PRINTF("ESP");
670 DECODE_PRINTF("EBP");
673 DECODE_PRINTF("ESI");
676 DECODE_PRINTF("EDI");
680 return NULL
; /* NOTREACHED OR REACHED ON ERROR */
683 /****************************************************************************
685 reg - Register to decode
688 Pointer to the appropriate register
691 Return a pointer to the register given by the R/RM field of the
692 modrm byte, for word operands, modified from above for the weirdo
693 special case of segreg operands. Also enables the decoding of instructions.
694 ****************************************************************************/
695 u16
* decode_rm_seg_register(
715 DECODE_PRINTF("ILLEGAL SEGREG");
719 return NULL
; /* NOT REACHED OR REACHED ON ERROR */
723 /****************************************************************************
725 sib - SIB value to decode
728 Offset in memory for the address decoding
731 Return the offset given by the specified SIB byte.
733 NOTE: The code which specifies the corresponding segment (ds vs ss)
734 below in the case of [BP+..]. The assumption here is that at the
735 point that this subroutine is called, the bit corresponding to
736 SYSMODE_SEG_DS_SS will be zero. After every instruction
737 except the segment override instructions, this bit (as well
738 as any bits indicating segment overrides) will be clear. So
739 if a SS access is needed, set this bit. Otherwise, DS access
740 occurs (unless any of the segment override bits are set).
741 ****************************************************************************/
742 static unsigned decode_sib_address(
745 unsigned ss
,index
,base
;
749 index
= (sib
>> 3) & 7;
754 DECODE_PRINTF("[EAX");
758 DECODE_PRINTF("[ECX");
762 DECODE_PRINTF("[EDX");
766 DECODE_PRINTF("[EBX");
770 DECODE_PRINTF("[ESP");
774 DECODE_PRINTF("[invalid");
775 addr
= M
.x86
.R_ESP
;/* incorrect */
778 DECODE_PRINTF("[invalid");
779 addr
= M
.x86
.R_ESP
;/* incorrect */
782 DECODE_PRINTF("[invalid");
783 addr
= M
.x86
.R_ESP
; /* incorrect */
789 DECODE_PRINTF("+EAX");
790 addr
+= M
.x86
.R_EAX
*(1<<ss
);
793 DECODE_PRINTF("+ECX");
794 addr
+= M
.x86
.R_ECX
*(1<<ss
);
797 DECODE_PRINTF("+EDX");
798 addr
+= M
.x86
.R_EDX
*(1<<ss
);
801 DECODE_PRINTF("+EBX");
802 addr
+= M
.x86
.R_EBX
*(1<<ss
);
807 DECODE_PRINTF("+EBP");
808 addr
+= M
.x86
.R_EBP
*(1<<ss
);
811 DECODE_PRINTF("+ESI");
812 addr
+= M
.x86
.R_ESI
*(1<<ss
);
815 DECODE_PRINTF("+EDI");
816 addr
+= M
.x86
.R_EDI
*(1<<ss
);
825 DECODE_PRINTF("*2]");
828 DECODE_PRINTF("*4]");
831 DECODE_PRINTF("*8]");
839 /****************************************************************************
841 rm - RM value to decode
844 Offset in memory for the address decoding
847 Return the offset given by mod=00 addressing. Also enables the
848 decoding of instructions.
850 NOTE: The code which specifies the corresponding segment (ds vs ss)
851 below in the case of [BP+..]. The assumption here is that at the
852 point that this subroutine is called, the bit corresponding to
853 SYSMODE_SEG_DS_SS will be zero. After every instruction
854 except the segment override instructions, this bit (as well
855 as any bits indicating segment overrides) will be clear. So
856 if a SS access is needed, set this bit. Otherwise, DS access
857 occurs (unless any of the segment override bits are set).
858 ****************************************************************************/
859 unsigned decode_rm00_address(
866 DECODE_PRINTF("[BX+SI]");
867 return M
.x86
.R_BX
+ M
.x86
.R_SI
;
869 DECODE_PRINTF("[BX+DI]");
870 return M
.x86
.R_BX
+ M
.x86
.R_DI
;
872 DECODE_PRINTF("[BP+SI]");
873 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
874 return M
.x86
.R_BP
+ M
.x86
.R_SI
;
876 DECODE_PRINTF("[BP+DI]");
877 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
878 return M
.x86
.R_BP
+ M
.x86
.R_DI
;
880 /* If SYSMODE_PREFIX_ADDR is set, get the SIB byte */
881 if (M
.x86
.mode
& SYSMODE_PREFIX_ADDR
) {
883 sib
= fetch_byte_imm();
884 return decode_sib_address(sib
);
887 DECODE_PRINTF("[SI]");
891 DECODE_PRINTF("[DI]");
894 offset
= fetch_word_imm();
895 DECODE_PRINTF2("[%04x]", offset
);
898 DECODE_PRINTF("[BX]");
905 /****************************************************************************
907 rm - RM value to decode
910 Offset in memory for the address decoding
913 Return the offset given by mod=01 addressing. Also enables the
914 decoding of instructions.
915 ****************************************************************************/
916 unsigned decode_rm01_address(
919 int displacement
= (s8
)fetch_byte_imm();
922 DECODE_PRINTF2("%d[BX+SI]", displacement
);
923 return M
.x86
.R_BX
+ M
.x86
.R_SI
+ displacement
;
925 DECODE_PRINTF2("%d[BX+DI]", displacement
);
926 return M
.x86
.R_BX
+ M
.x86
.R_DI
+ displacement
;
928 DECODE_PRINTF2("%d[BP+SI]", displacement
);
929 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
930 return M
.x86
.R_BP
+ M
.x86
.R_SI
+ displacement
;
932 DECODE_PRINTF2("%d[BP+DI]", displacement
);
933 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
934 return M
.x86
.R_BP
+ M
.x86
.R_DI
+ displacement
;
936 DECODE_PRINTF2("%d[SI]", displacement
);
937 return M
.x86
.R_SI
+ displacement
;
939 DECODE_PRINTF2("%d[DI]", displacement
);
940 return M
.x86
.R_DI
+ displacement
;
942 DECODE_PRINTF2("%d[BP]", displacement
);
943 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
944 return M
.x86
.R_BP
+ displacement
;
946 DECODE_PRINTF2("%d[BX]", displacement
);
947 return M
.x86
.R_BX
+ displacement
;
950 return 0; /* SHOULD NOT HAPPEN */
953 /****************************************************************************
955 rm - RM value to decode
958 Offset in memory for the address decoding
961 Return the offset given by mod=10 addressing. Also enables the
962 decoding of instructions.
963 ****************************************************************************/
964 unsigned decode_rm10_address(
967 unsigned displacement
= (u16
)fetch_word_imm();
970 DECODE_PRINTF2("%d[BX+SI]", displacement
);
971 return M
.x86
.R_BX
+ M
.x86
.R_SI
+ displacement
;
973 DECODE_PRINTF2("%d[BX+DI]", displacement
);
974 return M
.x86
.R_BX
+ M
.x86
.R_DI
+ displacement
;
976 DECODE_PRINTF2("%d[BP+SI]", displacement
);
977 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
978 return M
.x86
.R_BP
+ M
.x86
.R_SI
+ displacement
;
980 DECODE_PRINTF2("%d[BP+DI]", displacement
);
981 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
982 return M
.x86
.R_BP
+ M
.x86
.R_DI
+ displacement
;
984 DECODE_PRINTF2("%d[SI]", displacement
);
985 return M
.x86
.R_SI
+ displacement
;
987 DECODE_PRINTF2("%d[DI]", displacement
);
988 return M
.x86
.R_DI
+ displacement
;
990 DECODE_PRINTF2("%d[BP]", displacement
);
991 M
.x86
.mode
|= SYSMODE_SEG_DS_SS
;
992 return M
.x86
.R_BP
+ displacement
;
994 DECODE_PRINTF2("%d[BX]", displacement
);
995 return M
.x86
.R_BX
+ displacement
;