1. Interrupts in the guest VM A look at the steps needed to “reflect” hardware interrupts back into the ROM-BIOS for servicing

2. The VME-bit in CR4 Our VMX demo-program set the VME-bit (bit #0) in Guest’s Control Register CR4 VMXEVMXE PAEPAE PSEPSE VMEVME 31 13 5 4 0 Legend: VME (Virtual-8086 Extensions): 1=on, 0=off PSE (Page-Size Extensions): 1=on, 0=off PAE (Page-Address Extensions): 1=on, 0=off VMXE (Virtual Machine eXtensions Enabled): 1=yes, 0=no

3. Virtual-8086 Mode Extensions Software interrupt instructions (int $nn) will selectively be directed either to IDT-gates or to IVT-vectors, depending on a ‘bitmap’ located within the Task-State Descriptor This ‘interrupt redirection bitmap’ has 256 bits (one for each 8-bit interrupt-number) Its location within the TSS is immediately ahead of the I/O Permission Bitmap

4. Interrupt-redirection Bitmap 256 bits 65536 bits Task-State Segment = interrupt-redirection bitmap = I/O-permission bitmap = ‘IOMAP’ field (at offset 0x66) Interrupt-redirection Bitmap 256-bits ( = 32 longwords) I/O-Permission Bitmap 65536-bits ( = 8192 bytes) TSS base 25 longwords Legend: 1 = interrupt is directed to IDT 0 = interrupt is directed to IVT

5. Software INTs Only! The interrupt-redirection bitmap does NOT affect any ‘hardware’ interrupts – they are serviced by the interrupt-handlers whose entry-points are specified within the gate- descriptors that comprise the IDT How can the Guest VM in our VMX demo- program handle the ‘hardware’ interrupts generated by the peripheral devices?

6. We’ll modify our VMX demo One change to ‘vmxstep3.s’: guest_RFLAGS: 0x00023202 # IF=1, IOPL=3 One change to ‘vmxdemo.s’: in $0x21, %al# get master-PIC’s mask or $0x10, %al# mask UART interrupt out %al, $0x21# set master-PIC’s mask

7. Modify ‘guest_isrGPF’ We introduce a major modification into the guest’s General Protection Fault-handler, to “reflect” external device-interrupts back to ‘real-mode’ code in the ROM-BIOS that will be executed in ‘Virtual-8086 mode’ The steps needed to do this are based on ‘emulating’ the CPU’s usual response to an external interrupt in 8086 real-mode

8. CPU’s interrupt-response Push FLAGS register onto the stack Clear IF and TF bits in FLAGS register Push CS and IP registers onto the stack Acquire the device’s interrupt-ID number Lookup that ID-number’s interrupt-vector Put that vector’s ‘loword’ into IP register Put that vector’s ‘hiword’ into CS register Then resume CPU’s fetch-execute cycle

9. EFLAGS IDID VIPVIP VIFVIF ACAC VMVM RFRF 0 NTNT I/O PL OFOF DFDF IFIF TFTF SFSF ZFZF 0 AFAF 0 PFPF 1 CFCF 31 21 20 19 18 17 16 14 13 12 11 10 9 8 7 6 4 2 0 IF (Interrupt-Flag): 1=on, 0=off VM (Virtual-8086 Mode): 1=on, 0=off IOPL (Input/Output Permission-Level): =00 (only ring0 can execute ‘in’ and ’out’) =01 (ring0 and ring1 can execute ‘in’ and ‘out’) =10 (ring0, ring1, ring2 can execute ‘in’ and ‘out’) =11 (ring0, ring1, ring2, ring3 can execute ‘in’ and ‘out’) NOTE: Virtual-8086 mode operates at the ‘ring3’ privilege-level

10. PIC masks Each Programmable Interrupt Controller has a ‘mask register’ that allows blocking of the interrupts from specific devices IRQ7IRQ7 IRQ6IRQ6 IRQ5IRQ5 IRQ4IRQ4 IRQ3IRQ3 IRQ2IRQ2 IRQ1IRQ1 IRQ0IRQ0 IRQFIRQF IRQEIRQE IRQDIRQD IRQCIRQC IRQBIRQB IRQAIRQA IRQ9IRQ9 IRQ8IRQ8 I/O Port 0x21 I/O Port 0xA1 Master-PIC mask-register Slave-PIC mask-register

11. GPF stack-frame GS FS DS ES SS SP EFLAGS CS IP error SS0:ESP0 ring0 stack ? ? ? ? ? FLAGS CS IP SS:SP (before) SS:SP (after) ring3 stack

12. GPF error-code selector-index EXTEXT INTINT TITI 15 \3 2 1 0 Legend: EXT (External-event): 1=yes, 0=no INT (Interrupt-table): 1=yes, 0=no TI (Table-Indicator): 1=LDT, 0=GDT Index = Table’s element-number

13. GPF stack-frame GS FS DS ES SS SP EFLAGS CS IP error SS0:ESP0 ring0 stack hiwordloword Interrupt Vector Table hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword hiwordloword