superfury wrote on 2025-07-12, 14:53:

But when you enable Pentium's (and newer) VME mode, the extra bits below the IOPB table (interrupt redirection bitmap(IRB)) will (when cleared) cause interrupts to be handled in a 8086 (IVT) way apparently?

Yes

Will the CPU effectively force the IDTR's base and limit to 8086-compatiblity values (base 0 limit 3FFh) in that case?

No, the IDTR register is unaffected.

Also, what happens when there's less than 32 bytes (256 IVT entries) between the IOPB pointer and the location it's pointing to? So for example, if you set it to 31 bytes ahead of the IOPB pointer, will it fetch into the top 8 bits for IVT entries 0-8?

Didn't try that, but I guess the answer is yes - the bits for IVT entries 0-7 will be taken from the hibyte of the IOPB offset field in the TSS.

Baron von Riedesel wrote on 2025-07-12, 16:02:

Yes […]
Show full quote

superfury wrote on 2025-07-12, 14:53:

But when you enable Pentium's (and newer) VME mode, the extra bits below the IOPB table (interrupt redirection bitmap(IRB)) will (when cleared) cause interrupts to be handled in a 8086 (IVT) way apparently?

Yes

Will the CPU effectively force the IDTR's base and limit to 8086-compatiblity values (base 0 limit 3FFh) in that case?

No, the IDTR register is unaffected.

Also, what happens when there's less than 32 bytes (256 IVT entries) between the IOPB pointer and the location it's pointing to? So for example, if you set it to 31 bytes ahead of the IOPB pointer, will it fetch into the top 8 bits for IVT entries 0-8?

Didn't try that, but I guess the answer is yes - the bits for IVT entries 0-7 will be taken from the hibyte of the IOPB offset field in the TSS.

What I mean is that the interrupt is handled like in real mode, but instead of using the base/limit from the IDTR fields, it'll use the base field as 0 and limit as 3FFh, thus placing the IVT at linear address 0 and full 256 entries of valid vectors.
And I assume that the hidden IDTR Access Rights byte (that is exposed by System Management Mode(SMM)) is also forced to be interpreted as 0x92 as that's what's loaded into it at reset to prevent faulting?

What happens if the TSS limit is below 103 or the entry violates this limit (after calculating it's address from the IOPB)?
Bochs seems to imply a #GP(0) in both cases, but then again it's prefixed with BX_ERROR, so perhaps it's not sure?