A few weeks ago I had the questionable pleasance of diving into the math elimination handler of WIN87EM.DLL, the Windows 3.1 math emulator and FPU assistance library. Actually WIN87EM.DLL appears to have been archetypal shipped alongside Windows 3.0, and the type in Windows 3.1 is additional or small identical. The type shipped alongside Windows 3.11 is byte for byte identical to the one in Windows 3.1.
The chief function of WIN87EM.DLL is, as the name suggests, an x87 floating-point emulator. It appears to be an outgrowth of the math emulation packages shipped alongside many Microsoft languages. But equal on a scheme alongside x87 hardware, WIN87EM.DLL has several activity to do.
Namely WIN87EM.DLL intercepts math errors (exceptions). Depending on the scheme type, WIN87EM.DLL hooks either NMI vector 2 (PC and PC/XT) or IRQ 13 (PC/AT and compatibles).
The math interrupt handler in WIN87EM.DLL is very, very strange. It bears all the hallmarks of code that was written, rewritten, rewritten again, hacked, tweaked, modified, and eventually beaten into submission equal if the author(s) had no genuine idea why it eventually worked.
Now, x87 math error handing is a extremely tricky topic anywhere many particulars changed complete FPU and CPU generations, and Intel had a fair portion of bugs in this area. But the code in WIN87EM.DLL looks extremely much akin the outcome of changes made in desperation until it worked somehow, equal although the changes made small or no sense.
What WIN87EM.DLL Does
The IRQ 13 handler in WIN87EM.DLL performs the following steps:
- Disable interrupts (CLI)
- PUSH and POP the AX enroll 70 times, perchance it volition dilatory things down
- Write zero to I/O harbor F0h to apparent the PC/AT FPU error latch
- Mask a choice of interrupts
- Write an EOI to the expert interrupt controller (but not slave)
- Execute the FNSTSW education to shop the FPU position term (but lone that)
- PUSH and POP the AX enroll 16 times, since speed kills
- Write zero to I/O harbor F0h again, in case it didn’t activity the archetypal time
- Execute the FNCLEX education to apparent pending FPU exceptions
- Write zero to I/O harbor F0h again, since third time’s the charm
- PUSH and POP the AX enroll 16 times, since it was so much fun final time
- Execute the FNCLEX education again, fair to be really sure
- PUSH and POP the AX enroll 16 times, since it’s the item to do
- Write zero to I/O harbor F0h again, since three times power not have been enough
- Finally jump to code that doesn’t appearance crazy
The not so insane looking code executes FNSTENV to shop the FPU environment, swaps in the earlier saved position term (which was subsequently changed by FNCLEX), examines the code at the stored FPU error pointer to see if education prefixes have to be skipped (that is anywhere things may crash), enables interrupts alongside STI, and eventually jumps to average code that’s executed on the two PCs and ATs and handles the genuine math error.
All in all, the math error interrupt handler in WIN87EM.DLL makes extremely small sense. I am extremely doubtful that, for example, penning to I/O harbor F0h four times does item useful, or that executing FNCLEX twice is improved than doing it once. However, it is entirely imaginable that the additional period it takes power do something. Likewise the slowdown loops that shove and pop AX are extremely improbable to be necessary, but may have done item apparently helpful on several particular system.
The code really does appearance akin a desperate attempt to create things work, and there is several possible that it is the outcome of trying to assistance damaged hardware. Other akin error handlers I looked at don’t appear nearly as complicated and are much additional “by the book”.
We’ll likely never cognize why the code ended up so crazy, but we can speculate.
