Xen binary rewriting method

Question

In full virtualization, what is the CPL of guest OS? in paravertualiation, CPL of guest OS is 1(ring 1) is it same in full virtualization?

and I heard that some of the x86 privileged instructions are not easily handled, thus "binary rewriting" method is required...

how does this "binary rewriting" happens?? I understand that in virtualization, CPU is not emulated. so how can hypervisor change the binary instruction codes before the CPU executes them?? do they predict the next instruction on memory and update the memory contents before CPU gets there?? if this is true, I think hypervisor code(performing binary rewriting) needs to intercept the CPU every time before some instruction of guest OS is executed. I think this is absurd.

specific explanation will be appreciated. thank you in advance..!!

Answer 1

If by full virtualization, you mean hardware supported virtualization, then the CPL of the guest is identical to if it was running on bare-metal.

Xen never rewrites the binary.

This is something that VMWare (as far as I understand). To the best of my understanding (but I have never seen the VMWare source code), the method consists of basically doing runtime patching of code that needs to run differently - typically, this involves replacing an existing op-code with something else - either causing a trap to the hypervisor, or a replacement set of code that "does the right thing". If I understand how this works in VMWare is that the hypervisor "learns" the code by single-stepping through a block, and either applies binary patches or marks the section as "clear" (doesn't need changing). The next time this code gets executed, it has already been patched or is clear, so it can run at "full speed".

In Xen, using paravirtualization (ring compression), then the code in the OS has been modified to be aware of the virtualized environment, and as such is "trusted" to understand certain things. But the hypervisor will still trap for example writes to the page-table (otherwise someone could write a malicious kernel module that modifies the page-table to map in another guest's memory, or some such).

The HVM method does intercept CERTAIN instructions - but the rest of the code runs at normal full speed, thanks to the hardware support in modern processors, such as SVM in AMD and VMX in Intel processors. ARM has a similar technology in the latest models of their processors, but I'm not sure what the name of it is.

I'm not sure if I've answered quite all of your questions, if I've missed something, or it's not clear enough, feel free to ask...