copy / copy/v86

Inhibit interrupts after MOV SS and POP SS

Open
#1,631 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
23.5k
Forks
1.9k
Avg merge
2d 14h
Merged PRs (30d)
7

Description

With this fixed, I've been able to install Windows 98 SE three times in a row from within v86. It's super stable now. I have not tried Windows 95.

Intel's Manual, Volume 2B for `POP`, says:
_Loading the SS register with a POP instruction suppresses or inhibits some debug exceptions and inhibits interrupts on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of the next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruction (POP ESP) before an event can be delivered._

Turns out `POP SS` + `MOV SP` is performed by Windows 9x's `SMARTDRV.EXE`. Without the documented behavior, a pending IRQ can slip through and corrupt memory. I've seen it manifest in two ways:
- #GP in `KRNL386.EXE` during setup: `SUWIN` at `0001:81E1` and `W98SETUP` at `0001:813B`
- Random #UDs

Found by Daybreak Blue xhigh in ~4 hours. Feel free to check out [this AI commit](https://github.com/jlxip/slop86/commit/3cf874626ad642d31d2d8d11ccaba75984070b79).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the emulator's handling of MOV SS and POP SS, then follow how pending IRQs are delivered at the next instruction boundary. Reproduce the Windows 98 SE SMARTDRV scenario and verify that the documented inhibition prevents the reported #GP and random #UD failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.