NEC V20/V30 Bug Howard Vigorita New York Amateur Computer Club I recently saw a message from Jonathan Platt on a Florida bulletin board which mentioned rumors of a bug in the NEC V20/V30 processor. For those of you that are interested, I've documented the bug below using a V30 chip. Basically, the NEC chips fail to implement the 2 byte version of the POP instruction. This is not a serious bug; the Intel register PUSH & POP instructions are duplicated in two sets of instructions and all the assemblers and compilers I've seen default to the shorter single byte set in favor of the two byte set. For those unfamiliar with the longer PUSH/POP form, the two byte form of the PUSH (which works) will be shown first. The 'debug' program is fed input from the 'testpush' file. The AX register is loaded with FFFF hex, pushed onto the stack with the two byte PUSH, then POPed into the CX register with the single byte POP opcode. Note that the two byte PUSH is entered using a DB to load in the FFF0 opcode. The '-u' command issued below shows that although debug's '-a' command defaults to the short form POP, the long form is interpreted properly when encountered. A>debug < testpush -a 100 0A7F:0100 mov ax,ffff 0A7F:0103 db ff,f0 0A7F:0105 pop cx 0A7F:0106 nop 0A7F:0107 -u 100,106 0A7F:0100 B8FFFF MOV AX,FFFF 0A7F:0103 FFF0 PUSH AX 0A7F:0105 59 POP CX 0A7F:0106 90 NOP -g =100 106 AX=FFFF BX=0000 CX=FFFF DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000 DS=0A7F ES=0A7F SS=0A7F CS=0A7F IP=0106 NV UP DI PL NZ NA PO NC 0A7F:0106 90 NOP -q The CX register ended up with FFFF hex as expected. But the inverse operation does not work on the NEC chip. Below, 'testpop' feeds input to 'debug'. The AX register is loaded with FFFF, a one byte opcode PUSH AX is done, followed by the two byte form of the POP into CX. Again, the two byte POP is implemented by DB'ing its 8FC1 opcode. Although the SP register (stack pointer) is properly adjusted by the POP, the FFFF hex does not end up in CX as it should: A>debug < testpop -a 100 0A7F:0100 mov ax,ffff 0A7F:0103 push ax 0A7F:0104 db 8f,c1 0A7F:0106 nop 0A7F:0107 -u 100,106 0A7F:0100 B8FFFF MOV AX,FFFF 0A7F:0103 50 PUSH AX 0A7F:0104 8FC1 POP CX 0A7F:0106 90 NOP -g =100 106 AX=FFFF BX=0000 CX=0000 DX=0000 SP=FFEE BP=0000 SI=0000 DI=0000 DS=0A7F ES=0A7F SS=0A7F CS=0A7F IP=0106 NV UP DI PL NZ NA PO NC 0A7F:0106 90 NOP -q The above 'feature' can be exploited in distinguishing between NEC and Intel chips. It is much simpler than the technique of issuing a unique NEC instruction and intercepting the error trap interrupt.