Virtual memory provides the illusion of physical memory. The abstraction allows a process to assume that its memory space both is contiguous and begins at location 0. This simplifies the process' view of memory and hides the underlying physical locations of the process' memory. The physical memory corresponding to the virtual memory need not be contiguous. Indeed, some of the locations in virtual memory may have no corresponding physical addresses until the process references them.
Like virtual memory, a virtual machine provides the illusion of a physical machine. The abstraction allows operating systems to assume that they are running directly on the hardware. This allows one to run the operating system, and allows the operating system to run processes, with no changes in either the operating system or the programs. A second, lower “virtual machine monitor” runs directly on the hardware and provides the illusion of hardware to the operating systems run above it. The physical machine may support many virtual machines, each running its own operating system.
This chapter reviews the structure of a virtual machine.
A virtual machine runs on a virtual machine monitor. That monitor virtualizes the resources of the underlying system and presents to each virtual machine the illusion that it and it alone is using the hardware.
EXAMPLE: IBM's VM/370 and its successors provide each user with the illusion that she has complete access to the resources of a single IBM mainframe system. Many users will use the same physical machine, but each one is isolated from the others. (See Figure 33-1.)
![A virtual machine environment, with five virtual machines each running a different operating system. The control program (CP) manages their interactions with the physical resources. The middle virtual machine is running a virtual system within a virtual system. (Adapted from [294], pages 606 and 607.)](http://imgdetail.ebookreading.net/software_development/21/0201440997/0201440997__computer-security-art__0201440997__graphics__33fig01.gif)
Figure 33-1. A virtual machine environment, with five virtual machines each running a different operating system. The control program (CP) manages their interactions with the physical resources. The middle virtual machine is running a virtual system within a virtual system. (Adapted from [294], pages 606 and 607.)
The virtual machine monitor runs at the highest level of privilege. It keeps track of the state of each virtual machine just as an ordinary operating system keeps track of the states of its processes. When a privileged instruction is executed, the hardware causes a trap to the virtual machine monitor. The monitor services the interrupt and restores the state of the caller.
The Digital Equipment Corporation VAX/VMM project examined the issues of privilege in virtual machines [554]. Consider the requirements for a computer architecture to be virtualizable [810].
Definition 33–1. A sensitive instruction is an instruction that discloses or alters the state of privilege of the processor. A sensitive data structure is a data structure that contains information about the state of privilege of the system.
A computer architecture is virtualizable if it meets the following requirements.
All sensitive instructions cause traps when executed by processes at lower levels of privilege.
All references to sensitive data structures cause traps when executed by processes at lower levels of privilege.
If the hardware supports n levels of privilege, each virtual machine must appear to support n levels of privilege. However, only the virtual machine monitor can run at the highest level of privilege. This makes n – 1 levels of privilege available to each virtual machine. The virtual machine monitor virtualizes the levels of privilege. This technique is called ring compression.
One interesting approach to privilege is to divide users into different classes and control access to the system by limiting the access of each class.
The virtual machine monitor manages the physical resources by distributing them among the virtual machines as appropriate. Each virtual machine therefore appears to have a reduced amount of resources. For example, if the control program is to allocate space on a single disk for ten virtual machines, it will divide the disk into ten minidisks. Each virtual machine will have access to a different portion of the physical disk.The size of each minidisk is less than the size of the actual disk (although the sizes of the ten minidisks may differ). The virtual machine monitor handles the mapping from the minidisk address (presented to it by the virtual machine) and the physical disk.
On an ordinary machine, paging occurs at the highest level of privilege. When a virtual machine attempts to page, it does so from the virtual machine's level of privilege. The attempt to read from, or write to, the disk causes a trap to the virtual machine monitor. At that point, the request is handled as any other request for I/O. However, two problems unique to virtual machines arise.
First, because of the way some operating systems are designed, some pages may be accessible only to processes running at the highest level of privilege, but the virtual machine operating systems run at a lower level of privilege. The virtual machine must change the protection level of these pages to the appropriate level of privilege.
The second problem is performance. The virtual machine monitor paging its own data or instructions is transparent to the virtual machines. If the virtual machines attempt to page, the virtual machine monitor must handle the request as described above. If the virtual machine operating system pages heavily, this indirection may cause significant delays.
1: | The second example in Section 33.2.1 states that “user level processes can alter page table entries, so references to those data structures also fail to meet the second requirement.” How can an operating system prevent a user level process from altering its page table entries? |
2: | Suppose a virtual machine monitor (call it VMM-1) is running another virtual machine monitor (VMM-2), which in turn is running a version of the Linux operating system. The user running the Linux system is editing a file. The user requests that the editor write the file to disk.
|