NPX ERROR

Under certain conditions, the numeric coprocessor fails to generate exception 9 -- coprocessor segment overrun. This exception is the NPX's General Protection (GP) error counterpart. On the '486 where the NPX is on the same piece of silicon as the CPU, exception 9 is not used, and the error is reported as exception 13 -- as you would expect. However, when storing an 8-byte IEEE floating point number from the NPX into memory, the NPX fails to generate the applicable exception under a certain set of conditions:

• 64k data segment
• The first four bytes of data lie within the segment limit,
• while the last four bytes lie outside the segment limit
• The op code address operand is 16-bits

FSTP [DI], FSTP [FFFC] will both fail to generate the applicable exception. Using any other offset from FFF9-FFFF will properly generate the exception.

Other conditions may fail to generate the error, but in the above circumstances, the error is easily verified. For example, you may want to try generating this error with a non-64k data segment to see what happens.The file INT09.ASM contains source code demonstrating the bug. The source code is well documented to help explain the nature of the error. The source code checks for both INT09 ('386) and INT13 ('486) to detect the error. I have found that the '486 contains the same bug -- but obviously relative to exception 13, not exception 9.

View source code:
ftp://ftp.x86.org/pub/x86/source/int09/int09.asm
ftp://ftp.x86.org/pub/x86/source/386load/macros.386

Download entire source code archive:
ftp://ftp.x86.org/pub/x86/dloads/INT09.ZIP

Back to secrets and bugs