I don't understand a part of the paper Xen and the art of Virtualization. On the topic of virtualizing exception handling (section 2.1.2), the paper states that each guest OS can register a table that maps an exception to the handler that it wants to execute when that exception happens, and then:

Safety is ensured by validating exception handlers when they are presented to Xen. The only required check is that the handler's code segment does not specify execution in ring 0. Since no guest OS can create such a segment, it suffices to compare the specified segment selector to a small number of static values which are reserved by Xen.

My understanding is the following more or less: Xen needs not to worry about the handler code containing privileged instructions, because if that's the case running the instructions fails since the handler runs outside of ring 0 (this is the "no guest OS can create such a segment" part). However, a guest OS might try to register as a handler a memory segment that is actually reserved for Xen and its privileged code. In that case, handling the exception by just jumping to that segment would cause that code to run in ring 0 when handling the exception. So Xen must ensure that guest OSes don't register segments that belong to Xen as exception handlers. Is my understanding of this part correct, or am I wrong?

The next paragraph is:

Apart from this, any other handler problems are fixed up during exception propagation. for example, if the handler's code segment is not present or if the handler is not paged into memory then an appropriate fault will be taken when Xen executes the iret instruction which returns to the handler.Xen detects these double faults by checking the faulting program counter value: if the address resides within the exception-virtualizing code then the offending guest OS is terminated.

I interpret this as: if, while handling a fault by trying to transfer control to the appropriate guest OS handler, a 2nd fault happens because said handler is either non-existent or paged out of memory, the Xen code that handles the 2nd fault will check which code was running that triggered the 2nd fault, and realize that the fault was raised while handling another, "parent" fault. What really confuses me is the last statement "if the address resides within the exception-virtualizing code then the offending guest OS is terminated." I get this for the case where the 2nd fault happened because the handler code doesn't exist. But in the case where the handler is paged out of memory, why would the guest OS be terminated? I'd expect the handler just to be brought into memory from disk.

If needed for context, the underlying architecture is x86.


You must log in to answer this question.

Browse other questions tagged .