Interrupt descriptor table explained

The interrupt descriptor table (IDT) is a data structure used by the x86 architecture to implement an interrupt vector table. The IDT is used by the processor to determine the memory addresses of the handlers to be executed on interrupts and exceptions.

The details in the description below apply specifically to the x86 architecture. Other architectures have similar data structures, but may behave differently.

The IDT consists of 256 interrupt vectors and the use of the IDT is triggered by three types of events: processor exceptions, hardware interrupts, and software interrupts, which together are referred to as interrupts:

Real mode

In real mode, the interrupt table is called IVT (interrupt vector table). Up to the 80286, the IVT always resided at the same location in memory, ranging from 0x0000 to 0x03ff, and consisted of 256 far pointers. Hardware interrupts may be mapped to any of the vectors by way of a programmable interrupt controller. On the 80286 and later, the size and locations of the IVT can be changed in the same way as it is done with the IDT (Interrupt descriptor table) in protected mode (i.e., via the LIDT (Load Interrupt Descriptor Table Register) instruction) though it does not change the format of it.[3]

BIOS interrupts

See main article: BIOS interrupt call. The BIOS provides simple real-mode access to a subset of hardware facilities by registering interrupt handlers. They are invoked as software interrupts with the INT assembly instruction and the parameters are passed via registers. These interrupts are used for various tasks like detectingthe system memory layout, configuring VGA output and modes, and accessing the disk early in the boot process.

Protected and long mode

The IDT is an array of descriptors stored consecutively in memory and indexed by the vector number. It is not necessary to use all of the possible entries: it is sufficient to populate the table up to the highest interrupt vector used, and set the IDT length portion of the accordingly.

The IDTR register is used to store both the linear base address and the limit (length in bytes minus 1) of the IDT. When an interrupt occurs, the processor multiplies the interrupt vector by the entry size (8 for protected mode, 16 for long mode) and adds the result to the IDT base address.[4] If the address is inside the table, the DPL is checked and the interrupt is handled based on the gate type.

The descriptors may be either interrupt gates, trap gates or, for 32-bit protected mode only, task gates. Interrupt and trap gates point to a memory location containing code to execute by specifying both a segment (present in either the GDT or LDT) and an offset within that segment. The only difference between trap and interrupt gates is that interrupt gates will disable further processor handling of maskable hardware interrupts, making them suitable to handle hardware-generated interrupts (conversely, trap gates are useful for handling software interrupts and exceptions). A task gate will cause the currently active task-state segment to be switched, using the hardware task switch mechanism to effectively hand over use of the processor to another program, thread or process.

Common IDT layouts

Official Intel layout

All INT_NUM between 0x0 and 0x1F, inclusive, are reserved for exceptions by Intel.[5] INT_NUM bigger than 0x1F are to be used for interrupt routines.

INT_NUMEvent TypeShort Description
0x00Processor ExceptionDivision by zero
0x01Processor ExceptionSingle-step interrupt (see trap flag)
0x02Processor ExceptionNMI
0x03Processor ExceptionBreakpoint (which benefits from the shorter 0xCC encoding of INT 3)
0x04Processor ExceptionOverflow
0x05Processor ExceptionBound Range Exceeded
0x06Processor ExceptionInvalid Opcode
0x07Processor ExceptionCoprocessor not available
0x08Processor ExceptionDouble Fault
0x09Processor ExceptionCoprocessor Segment Overrun (386 or earlier only)
0x0AProcessor ExceptionInvalid Task State Segment
0x0BProcessor ExceptionSegment not present
0x0CProcessor ExceptionStack Segment Fault
0x0DProcessor ExceptionGeneral Protection Fault
0x0EProcessor ExceptionPage Fault
0x0FProcessor Exceptionreserved
0x10Processor Exceptionx87 Floating Point Exception
0x11Processor ExceptionAlignment Check
0x12Processor ExceptionMachine Check
0x13Processor ExceptionSIMD Floating-Point Exception
0x14Processor ExceptionVirtualization Exception
0x15Processor ExceptionControl Protection Exception (only available with CET)
0x16-0x1FProcessor Exceptionreserved
0x20-0x27Hardware InterruptIRQ 0-7
0x70-0x77Hardware InterruptIRQ 8-15

IBM PC layout

The IBM PC (BIOS and MS-DOS runtime) does not follow the official Intel layout beyond the first five exception vectors implemented in the original 8086. Interrupt 5 is already used for handling the Print Screen key, IRQ 0-7 is mapped to INT_NUM 0x08-0x0F, and BIOS is using most of the vectors in the 0x10-0x1F range as part of its API.[6]

Hooking

Some Windows programs hook calls to the IDT. This involves writing a kernel mode driver that intercepts calls to the IDT and adds in its own processing. This has never been officially supported by Microsoft, but was not programmatically prevented on its operating systems until 64-bit versions of Windows, where a driver that attempts to use a kernel mode hook will cause the machine to bug check.[7]

See also

References

General

External links

Notes and References

  1. Web site: Exceptions - OSDev Wiki. 2021-04-17. wiki.osdev.org.
  2. Web site: Friesen . Brandon . IRQs and PICs . Bran's Kernel Development Tutorial . 6 June 2024.
  3. Intel® 64 and IA-32 Architectures Software Developer’s Manual, 20.1.4 Interrupt and Exception Handling
  4. Intel® 64 and IA-32 Architectures Software Developer’s Manual, 6.12.1 Exception- or Interrupt-Handler Procedures
  5. Web site: Exceptions - OSDev Wiki. 2021-04-17. wiki.osdev.org.
  6. Web site: Jurgens . David . Interrupt Table as Implemented by System BIOS/DOS . HelpPC Reference Library . 6 June 2024.
  7. Web site: Patching Policy for x64-Based Systems . . If the operating system detects one of these modifications or any other unauthorized patch, it will generate a bug check and shut down the system..