search

barotto / IBMulator

The IBM PS/1 emulator.
https://barotto.github.io/IBMulator
GNU General Public License v3.0
111 stars 4 forks source link

Incomplete CPU data in savestate can result in guest OS crash after a restore #69

Closed barotto closed 5 months ago

barotto commented 2 years ago

In some (still unknown) circumstances, overwriting a slot results in a corrupted savestate.

Noticed during testing Windows 3.1 in 386 mode. Trying to load the savestate ends in Windows crashing to the DOS prompt. Hard to replicate (not even sure it's specific to overwriting a slot.)

Cause finally determined. It's not savestate corruption. See below.

barotto commented 10 months ago

Not encountered yet on v0.17. Closing for now.

barotto commented 6 months ago

It's back. Apparently the EIP register is restored with a wrong value (a small offset from the correct one).

barotto commented 6 months ago

The state of the CPU is not entirely saved into a savestate file, specifically the decoded data of the previously executed instruction. If the state is saved during the execution of an instruction with a REP prefix, after a restore the repeated instruction must be decoded again. This can't be done correctly without resetting the prefetch queue (which is currently not done hence the crash of the running guest program). Unfortunately resetting the prefetch queue can potentially break programs with self modifying code.