Editing Virtual 8086 mode

{{short description|Feature of specific microprocessor}}
{{Refimprove|date=December 2009}}
{{X86 Processor Modes}}

In the [[Intel 80386|80386]] [[microprocessor]] and later, '''virtual 8086 mode''' (also called '''virtual real mode''', '''V86-mode''', or '''VM86''') allows the execution of [[real mode]] applications that are [[protected mode#Real mode application compatibility|incapable of running]] directly in [[protected mode]] while the processor is running a protected mode operating system. It is a [[hardware virtualization]] technique that allowed multiple 8086 processors to be emulated by the 386 chip. It emerged from the painful experiences with the [[Intel_80286#Protected_mode|80286 protected mode]], which by itself was not suitable to run concurrent real-mode applications well.<ref>{{cite web|url=http://www.infoworld.com/article/2664741/computer-hardware/sending-software-to-do-hardware-s-job.html|title=Sending software to do hardware's job|first1=Tom|last1=Yager|publisher=[[InfoWorld]]|date=November 5, 2004|access-date=January 27, 2014}}</ref> [[John Crawford (engineer)|John Crawford]] developed the Virtual Mode bit at the register set, paving the way to this environment.<ref>Gnomes, Lee; "Behind The Scenes: The Making of the 386", Intel Corporation, Special 32-Bit Issue Solutions, November/December 1985, page 19</ref>

VM86 mode uses a [[x86 memory segmentation|segmentation]] scheme identical to that of real mode (for compatibility reasons), which creates 20-bit linear addresses in the same manner as 20-bit physical addresses are created in real mode, but are subject to protected mode's memory [[paging]] mechanism.

==Overview==
The virtual 8086 mode is a mode for a [[task state segment|protected-mode task]]. Consequently, the processor can switch between VM86 and non-VM86 tasks, enabling multitasking legacy ([[DOS]]) applications.

To use virtual 8086 mode, an operating system sets up a virtual 8086 mode monitor, which is a program that manages the real-mode program and emulates or filters access to system hardware and software resources.  The monitor must run at [[privilege level]] 0 and in protected mode. Only the 8086 program runs in VM86 mode and at privilege level 3. When the real-mode program attempts to do things like access certain I/O ports to use hardware devices or access certain regions in its memory space, the CPU traps these events and calls the V86 monitor, which examines what the real mode program is trying to do and either acts as a proxy to interface with the hardware, emulates the intended function the real-mode program was trying to access, or terminates the real-mode program if it is trying to do something that cannot either be allowed or be adequately supported (such as reboot the machine, set a video display into a mode that is not supported by the hardware and is not emulated, or write over operating system code).

The V86 monitor can also deny permission gently by emulating the failure of a requested operation&mdash;for example, it can make a disk drive always appear not ready when in fact it has not even checked the drive but simply will not permit the real-mode program to access it.  Also, the V86 monitor can do things like map memory pages, intercept calls and interrupts, and preempt the real-mode program, allowing real-mode programs to be multitasked like protected-mode programs.  By intercepting the hardware and software I/O of the real-mode program and tracking the state that the V86 program expects, it can allow multiple programs to share the same hardware without interfering with each other.{{Efn|For example, if one program writes to a display, then another program gets control and writes to the same display, and then the first program gets control back, it will try to use the display as if the second program had not changed it.  The V86 monitor can intercept the display writes, keep track of the display state for each program, and switch the real display between them according to which program the user has selected to interact with presently.  The V86 monitor emulates independent displays for each program using only one real display.}}  So V86 mode provides a way for real-mode programs designed for a single-tasking environment (like DOS{{Efn|[[DOS]] is mentioned because it was especially the extensive library of existing DOS programs that Intel had in mind when they designed V86 mode.}}) to run concurrently in a multitasking environment.

==Usage==
It is used to execute certain [[DOS]] programs in 
[[FlexOS 386]] (since 1987), [[Concurrent DOS 386]] (since 1987), [[Windows/386 2.10]] (since 1987), [[DESQview#DESQview and QEMM|DESQview 386]] (since 1988), [[Windows 3.0|Windows 3.x]] (since 1990), [[Multiuser DOS]] (since 1991), [[Windows for Workgroups|Windows for Workgroups 3.1x]] (since 1992), [[OS/2]] 2.x (since 1992), [[4690 Operating System|4690 OS]] (since 1993), [[Multiuser DOS#REAL/32|REAL/32]] (since 1995) running in [[Windows 3.0|386 Enhanced Mode]] as well as in [[Windows 95]], [[Windows 98|98]], [[Windows 98 SE|98 SE]] and [[Windows ME|ME]] through [[virtual DOS machine]]s, in [[SCO UNIX]] through [[Merge (software)|Merge]], and in [[Linux]] through [[DOSEMU]]. (Other [[DOS]] programs which use protected mode execute using user mode under the emulator.) [[Virtual DOS machine#NTVDM|NTVDM]] in [[x86]] Windows NT-based operating systems also use VM86 mode,<ref>{{cite web|url=http://www.microsoft.com/resources/documentation/windowsnt/4/workstation/reskit/en-us/archi.mspx?pf=true#E5PAE |title=Windows NT 4.0 Workstation Architecture|website=[[Microsoft]]}}</ref> but with very limited direct hardware access. Some boot loaders (e.g. [[GRUB]]) use the [[protected mode]], and execute the [[BIOS interrupt calls]] in Virtual 8086 mode.<ref>{{Cite journal|last=Mike Wang|title=Grub2 Booting Process|date=21 June 2016 |url=https://www.slideshare.net/MikeWang45/grub2-booting-process}}</ref><ref>{{Cite web|title=Virtual 8086 Mode - OSDev Wiki|url=https://wiki.osdev.org/Virtual_8086_Mode|access-date=2020-12-10|website=wiki.osdev.org}}</ref>

==Memory addressing and interrupts==
The most common problem by running 8086 code from protected mode is [[memory addressing]] which is totally different between [[protected mode]] and [[real mode]].
As mentioned, by working under VM86 mode the [[x86 memory segmentation|segmentation]] mechanism is reconfigured to work just like under real mode, but the [[paging]] mechanism is still active, and it is transparent to the real mode code; thus, [[memory protection]] is still applicable, and so is the isolation of the address space.

When interrupts (hardware, software and int instruction) occur, the processor switches off the VM86 mode and returns to work in full protected mode to handle the interrupt. Also, before servicing the interrupt, the DS, ES, FS, and GS registers are pushed on the new stack and zeroed.

=={{anchor|VME}}Virtual-8086 mode extensions (VME)==
The Pentium architecture added a number of enhancements to the virtual 8086 mode. These were however documented by Intel only starting with the subsequent [[P6 (microarchitecture)]];<ref name="Shanley1998">{{cite book|author=T. Shanley|title=Pentium Pro and Pentium II System Architecture|url=https://books.google.com/books?id=MLJClvCYh34C&pg=PA427|year=1998|publisher=Addison-Wesley |isbn=978-0-201-30973-7|pages=427, 465–480}}</ref> their more recent formal name is Virtual-8086 Mode Extensions, abbreviated VME<ref>{{cite book|url=https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-3a-3b-3c-and-3d-system-programming-guide.html|title=Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (3A, 3B, 3C & 3D): System Programming Guide|page=2{{hyphen}}17|publisher=[[Intel]]|date=May 2020}}</ref> (older documentation may use "Virtual 8086 mode enhancements" as the VME acronym expansion).<ref name="Shanley1998"/> Some later Intel 486 chips also support it.<ref>{{cite web|url=http://www.gossamer-threads.com/lists/linux/kernel/585146?do=post_view_threaded#585146 |title=Mailing List Archive: Re: 2.6.14: CR4 not needed to be inspected on the 486 anymore? |publisher=Gossamer-threads.com |access-date=2014-02-20}}</ref><ref name="pvi1">{{cite web|url=http://www.rcollins.org/articles/pvi1/pvi1.html |title=Pentium Protected Mode Virtual Interrupts (PVI) |publisher=Rcollins.org |access-date=2014-02-20}}</ref> The enhancements address mainly the 8086 virtualization overhead, with a particular focus on (virtual) interrupts.<ref name="Shanley1998"/><ref>{{cite web|url=http://www.rcollins.org/articles/vme1/ |title=Virtual Mode Extensions on the Pentium Processor |publisher=Rcollins.org |access-date=2014-02-20}}</ref> Before the extensions were publicly documented in the P6 documentation, the official documentation referred to the famed [[Appendix H]], which was omitted from the public documentation and shared only with selected partners under [[Non-disclosure agreement|NDA]].

Activating VME is done by setting bit number 0 (0x1 in value) of [[control register#CR4|CR4]]. Because the VME interrupt speed-up enhancements were found useful for non-VM86 protected tasks, they can also be enabled separately by setting only bit number 1 (0x2 in value), which is called PVI (Protected Mode Virtual Interrupts).<ref name="Shanley1998"/><ref name="pvi1"/> Detecting whether a processor supports VME (including PVI) is done using the [[CPUID]] instruction, with an initial EAX value of 0x1, by testing the value of second bit (bit number 1, 0x2 in value) in EDX register, which is set if VME is supported by the processor.<ref>{{cite book|url=https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-2a-2b-2c-and-2d-instruction-set-reference-a-z.html|title=Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 2 (2A, 2B, 2C & 2D): Instruction Set Reference, A-Z|pages=3{{hyphen}}199,3{{hyphen}}221,3{{hyphen}}222|publisher=[[Intel]]|date=May 2020}}</ref><ref name="Shanley1998"/> In Linux, this latter bit is reported as the {{mono|vme}} [[CPU flag (x86)|flag]] in the {{mono|/proc/[[cpuinfo]]}} file, under the "flags" section.

In virtual 8086 mode, the basic idea is that when IOPL is less than 3, PUSHF/POPF/STI/CLI/INT/IRET instructions will treat the value of VIF in the real 32-bit EFLAGS register as the value of IF in the simulated 16-bit FLAGS register (32-bit PUSHFD/POPFD continues to GP fault). VIP will cause a GP fault on the setting of simulated IF, directing the OS to process any pending interrupts. PVI is the same idea but only affects CLI/STI instructions.

First generation [[AMD Ryzen]] CPUs have been found to feature a broken VME implementation.<ref>{{cite web|url=http://www.os2museum.com/wp/vme-broken-on-amd-ryzen/|title=VME Broken on AMD Ryzen|date=May 12, 2017|author=Michal Necasek|website=OS/2 Museum}}</ref> The second generation Ryzen (2000 series) has fixed this issue.<ref>{{cite web|url=https://support.amd.com/TechDocs/55449_Fam_17h_M_00h-0Fh_Rev_Guide.pdf|title=Revision Guide for AMD Family 17h Models 00h-0Fh Processors|date=June 2018|website=[[Advanced Micro Devices|AMD]]}}</ref>

==64-bit and VMX support==
Virtual 8086 mode is not available in [[x86-64]] [[long mode]], although it is still present on x86-64 capable processors running in [[x86-64#Legacy mode|legacy mode]].

[[Intel VT-x]] brings back the ability to run virtual 8086 mode from x86-64 long mode, but it has to be done by transitioning the (physical) processor to VMX root mode and launching a logical (virtual) processor itself running in virtual 8086 mode.<ref>{{cite book|url=http://www.intel.com/Assets/en_US/PDF/manual/253669.pdf|title=Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3B: System Programming Guide, Part 2|page=29{{hyphen}}1|date=September 2009|publisher=[[Intel]]|quote=a VM entry is allowed only to guests with paging enabled that are in protected mode or in virtual-8086 mode. Guest execution in other processor operating modes need to be specially handled by the VMM|archive-url=https://web.archive.org/web/20100105142519/http://www.intel.com/Assets/en_US/PDF/manual/253669.pdf|archive-date=January 5, 2010}}; see also [http://www.cs.usfca.edu/~cruse/cs686s07/ CS 686: Special Topic: Intel EM64T and VT Extensions (Spring 2007)], [https://www.cs.usfca.edu/~cruse/cs686s07/lesson24.ppt lesson 24] how to do this from Linux (not that the code is pretty dated, so might not work as-is with current kernels) more up-to-date code can be found [http://opensecuritytraining.info/AdvancedX86-VTX.html here]. Also beware that this sample code is more complicated than strictly booting the logical processor in virtual 8086 mode; its ultimate goal is make some real-mode BIOS calls.</ref>

[[Westmere (microarchitecture)|Westmere]] and later Intel processors usually<ref>{{cite web|url=http://ark.intel.com/Products/VirtualizationTechnology |title=Intel Virtualization Technology List |publisher=Ark.intel.com |access-date=2014-02-20 |quote=A list of Intel processors that support VT-x but not EPT|archive-url=https://web.archive.org/web/20140210004823/http://ark.intel.com/Products/VirtualizationTechnology|archive-date=2014-02-10|url-status=dead}}</ref> can start the virtual processor directly in real mode using the "unrestricted guest" feature (which itself requires [[Extended Page Table]]s); this method removes the need to resort to the nested virtual 8086 mode simply to run the legacy BIOS for booting.<ref>[http://2013.asiabsdcon.org/papers/abc2013-P5A-paper.pdf "Intel added unrestricted guest mode on Westmere micro-architecture and later Intel CPUs, it uses EPT to translate guest physical address access to host physical address. With this mode, VMEnter without enable paging is allowed."]</ref><ref>[http://download.intel.com/products/processor/manual/326019.pdf "If the “unrestricted guest” VM-execution control is 1, the “enable EPT” VM-execution control must also be 1"]</ref>

[[AMD-V]] can do virtual 8086 mode in guests, too, but it can also just run the guest in "paged real mode" using the following steps: you create a SVM (Secure Virtual Machine) mode guest with CR0.PE=0, but CR0.PG=1 (that is, with protected mode disabled but paging enabled), which is ordinarily impossible, but is allowed for SVM guests if the host intercepts page faults.<ref>{{Cite book|last=|url=https://www.amd.com/system/files/TechDocs/24593.pdf#G21.1088365|title=AMD64 Architecture Programmer's Manual, Volume 2: System Programming|date=November 2021|publisher=[[Advanced Micro Devices]]|edition=|series=Rev. 3.38|pages=515–516|chapter=15.19 Paged Real Mode|quote=To facilitate virtualization of real mode, the VMRUN instruction may legally load a guest CR0 value with PE = 0 but PG = 1. Likewise, the RSM instruction is permitted to return to paged real mode. This processor mode behaves in every way like real mode, with the exception that paging is applied. The intent is that the VMM run the guest in paged-real mode at CPL0, and with page faults intercepted. The VMM is responsible for setting up a shadow page table that maps guest physical memory to the appropriate system physical addresses.<!-- paragraph break --> The behavior of running a guest in paged real mode without intercepting page faults to the VMM is undefined.}}</ref>

==See also==
* [[IA-32]]
* [[x86 assembly language]]

==Notes==
{{Notelist}}

==References==
{{Reflist|30em}}

{{Intel}}
{{Memory management}}

{{DEFAULTSORT:Virtual 8086 Mode}}
[[Category:X86 operating modes]]
[[Category:Virtualization]]
[[Category:Intel products]]
[[Category:Programming language implementation]]