With this fixed, I've been able to install Windows 98 SE three times in a row from within v86. It's super stable now. I have not tried Windows 95.
Intel's Manual, Volume 2B for POP, says:
Loading the SS register with a POP instruction suppresses or inhibits some debug exceptions and inhibits interrupts on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of the next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruction (POP ESP) before an event can be delivered.
Turns out POP SS + MOV SP is performed by Windows 9x's SMARTDRV.EXE. Without the documented behavior, a pending IRQ can slip through and corrupt memory. I've seen it manifest in two ways:
- #GP in
KRNL386.EXE during setup: SUWIN at 0001:81E1 and W98SETUP at 0001:813B
- Random #UDs
Found by Daybreak Blue xhigh in ~4 hours. Feel free to check out this AI commit.
With this fixed, I've been able to install Windows 98 SE three times in a row from within v86. It's super stable now. I have not tried Windows 95.
Intel's Manual, Volume 2B for
POP, says:Loading the SS register with a POP instruction suppresses or inhibits some debug exceptions and inhibits interrupts on the following instruction boundary. (The inhibition ends after delivery of an exception or the execution of the next instruction.) This behavior allows a stack pointer to be loaded into the ESP register with the next instruction (POP ESP) before an event can be delivered.
Turns out
POP SS+MOV SPis performed by Windows 9x'sSMARTDRV.EXE. Without the documented behavior, a pending IRQ can slip through and corrupt memory. I've seen it manifest in two ways:KRNL386.EXEduring setup:SUWINat0001:81E1andW98SETUPat0001:813BFound by Daybreak Blue xhigh in ~4 hours. Feel free to check out this AI commit.