vm86 monitor inside vm

[ququmber]

I've been studying how software like neTraverse merge/win4lin worked in hope to implement smilar vm in an os. The outline, so far what I understand, is as follows:

The software requires modified host kernel which can handle 'MKI' (merge kernel interface?) branded tasks specially. The GPF handler call the added merge hooks on encountering such task.

The program 'boots' by starting a vm86 DOS machine. I believe it to be vm86 cause PE is set and it is running standard real mode

Code: Select all

command.com

from windows 95. win.com is executed which in turn loads

Code: Select all

vmm32.vxd

.

Code: Select all

vmm32

(virtual machine manager), along other things like setting a

Code: Select all

dpmi

host sets up a vm86 monitor. I think these along with other PL0 operations are handled by the fault handlers in host kernel, the

Code: Select all

vmm32

kernel essentially runs in PL3.

But when I open a DOS prompt inside windows 95, it is running under windows, triggering non existing int triggers

Code: Select all

vmm32

specific behaviour (ax is cleared). So the program in DOS is running under

Code: Select all

vmm

? So the 'real' vm monitor (ie the

Code: Select all

GPF

handlers in host kernel) gets the interrupt and somehow forwards to vmm32, and then uses its results?

Is there a better possible explanation for this?

[Octocontrabass]

I've been studying how software like neTraverse merge/win4lin worked in hope to implement smilar vm in an os.

Similar in what way? Do you need your VM to work on computers from the 90s? Modern x86 CPUs have much better virtualization capabilities.

Is there a better possible explanation for this?

Your guess sounds reasonable to me, but I don't think you'll get a clear answer without looking at the code.

[ququmber]

without looking at the code.

The merge is already very propitiatory and I've very little idea about sco openserver kernel to reverse it, Here is a dump of win4lin, where kernel patches and a binary non-standard kernel 'module' can be found. I'm trying to figure out if something more interesting/clever happening than standard hypervisors like vmware/virtualbox from before vt-x days.

Modern x86 CPUs have much better virtualization capabilities

not when nested virtualization is not available