Scribd
Upload
51 views

v20 Bug

The document summarizes a bug in the NEC V20/V30 processor where it fails to implement the two byte version of the POP instruction. It demonstrates through assembly code examples that while the two byte PUSH instruction works properly, pushing a value onto the stack and then using the two byte POP to retrieve it does not work, as the value does not get copied to the destination register. This distinguishes the NEC chip from Intel chips and can be used to detect the chip manufacturer.

Uploaded by

Виктор Перепёлкин
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
51 views

v20 Bug

The document summarizes a bug in the NEC V20/V30 processor where it fails to implement the two byte version of the POP instruction. It demonstrates through assembly code examples that while the two byte PUSH instruction works properly, pushing a value onto the stack and then using the two byte POP to retrieve it does not work, as the value does not get copied to the destination register. This distinguishes the NEC chip from Intel chips and can be used to detect the chip manufacturer.

Uploaded by

Виктор Перепёлкин
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

NEC V20/V30 Bug

Howard Vigorita
New York Amateur Computer Club

I recently saw a message from Jonathan Platt on a Florida bulletin


board which mentioned rumors of a bug in the NEC V20/V30 processor.
For those of you that are interested, I've documented the bug below
using a V30 chip. Basically, the NEC chips fail to implement the 2
byte version of the POP instruction. This is not a serious bug;
the Intel register PUSH & POP instructions are duplicated in two
sets of instructions and all the assemblers and compilers I've seen
default to the shorter single byte set in favor of the two byte
set.

For those unfamiliar with the longer PUSH/POP form, the two byte
form of the PUSH (which works) will be shown first. The 'debug'
program is fed input from the 'testpush' file. The AX register is
loaded with FFFF hex, pushed onto the stack with the two byte PUSH,
then POPed into the CX register with the single byte POP opcode.
Note that the two byte PUSH is entered using a DB to load in the
FFF0 opcode. The '-u' command issued below shows that although
debug's '-a' command defaults to the short form POP, the long form
is interpreted properly when encountered.

A>debug < testpush

-a 100

0A7F:0100 mov ax,ffff


0A7F:0103 db ff,f0
0A7F:0105 pop cx
0A7F:0106 nop
0A7F:0107

-u 100,106

0A7F:0100 B8FFFF MOV AX,FFFF


0A7F:0103 FFF0 PUSH AX
0A7F:0105 59 POP CX
0A7F:0106 90 NOP

-g =100 106

AX=FFFF BX=0000 CX=FFFF DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000


DS=0A7F ES=0A7F SS=0A7F CS=0A7F IP=0106 NV UP DI PL NZ NA PO NC
0A7F:0106 90 NOP

-q

The CX register ended up with FFFF hex as expected.

But the inverse operation does not work on the NEC chip. Below, 'testpop'
feeds input to 'debug'. The AX register is loaded with FFFF, a one byte
opcode PUSH AX is done, followed by the two byte form of the POP into CX.
Again, the two byte POP is implemented by DB'ing its 8FC1 opcode. Although
the SP register (stack pointer) is properly adjusted by the POP, the FFFF
hex does not end up in CX as it should:

A>debug < testpop


-a 100

0A7F:0100 mov ax,ffff


0A7F:0103 push ax
0A7F:0104 db 8f,c1
0A7F:0106 nop
0A7F:0107

-u 100,106

0A7F:0100 B8FFFF MOV AX,FFFF


0A7F:0103 50 PUSH AX
0A7F:0104 8FC1 POP CX
0A7F:0106 90 NOP

-g =100 106

AX=FFFF BX=0000 CX=0000 DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000


DS=0A7F ES=0A7F SS=0A7F CS=0A7F IP=0106 NV UP DI PL NZ NA PO NC
0A7F:0106 90 NOP

-q

The above 'feature' can be exploited in distinguishing between NEC and


Intel chips. It is much simpler than the technique of issuing a unique
NEC instruction and intercepting the error trap interrupt.
##########

You might also like