A DOS application running in a VDM may access I/O ports directly using the normal 8086 I/O instructions (such as, IN and OUT). These instructions are not considered IOPL-sensitive and do not normally generate a general protection exception; the operating system checks the I/O privilege map in the VDM's task state segment to determine whether to allow the instruction to execute or to generate a general protection exception. This allows DOS applications to access hardware devices using the normal DOS device drivers from within a VDM.
When access to a device must be shared with other applications, however, a virtual device driver is required, and the VDM may not directly access the I/O port. At initialization time, the virtual device driver issues a call to the VDHSetIOHookState() device helper function, which sets the appropriate bit in the I/O privilege map.
When a DOS application subsequently issues an instruction for the I/O port: