Outline Basic VM Concepts Formal Definitions Virtualization Theorems

Slides:



Advertisements
Similar presentations
Computer-System Structures Er.Harsimran Singh
Advertisements

Virtualization Dr. Michael L. Collard
Popek & Goldberg’s notation
Operating Systems Lecture 10 Issues in Paging and Virtual Memory Adapted from Operating Systems Lecture Notes, Copyright 1997 Martin C. Rinard. Zhiqing.
Programming Languages Marjan Sirjani 2 2. Language Design Issues Design to Run efficiently : early languages Easy to write correctly : new languages.
Formal Requirements for Virtualizable Third Generation Architectures Gerald J. Popek University of California, Los Angeles and Robert P. Goldberg Honeywell.
CMPT 300: Operating Systems I Dr. Mohamed Hefeeda
CS-3013 & CS-502, Summer 2006 Virtual Machine Systems1 CS-502 Operating Systems Slides excerpted from Silbershatz, Ch. 2.
CSS 372 Lecture 1 Course Overview: CSS 372 Web page Syllabus Lab Ettiquette Lab Report Format Review of CSS 371: Simple Computer Architecture Traps Interrupts.
Processes 1 CS502 Spring 2006 Processes Week 2 – CS 502.
OS Spring’03 Introduction Operating Systems Spring 2003.
Figure 1.1 Interaction between applications and the operating system.
CSCI2413 Lecture 6 Operating Systems Memory Management 2 phones off (please)
November 1, 2004Introduction to Computer Security ©2004 Matt Bishop Slide #29-1 Chapter 33: Virtual Machines Virtual Machine Structure Virtual Machine.
Slide 3-1 Copyright © 2004 Pearson Education, Inc. Operating Systems: A Modern Perspective, Chapter 3 Operating System Organization.
Virtualization Technology Prof D M Dhamdhere CSE Department IIT Bombay Moving towards Virtualization… Department of Computer Science and Engineering, IIT.
System Calls 1.
Protection and the Kernel: Mode, Space, and Context.
Systems Security & Audit Operating Systems security.
Chapter 1. Introduction What is an Operating System? Mainframe Systems
Topics covered: Memory subsystem CSE243: Introduction to Computer Architecture and Hardware/Software Interface.
Virtualization Concepts Presented by: Mariano Diaz.
Silberschatz, Galvin, and Gagne  Applied Operating System Concepts Module 2: Computer-System Structures Computer System Operation I/O Structure.
1 CSE Department MAITSandeep Tayal Computer-System Structures Computer System Operation I/O Structure Storage Structure Storage Hierarchy Hardware Protection.
2: Computer-System Structures
Chapter 3 Process Description and Control
Operating Systems ECE344 Ashvin Goel ECE University of Toronto OS-Related Hardware.
Virtualization Part 2 – VMware. Virtualization 2 CS5204 – Operating Systems VMware: binary translation Hypervisor VMM Base Functionality (e.g. scheduling)
Formal Requirements for Virtualizable Third Generation Architectures
CS533 Concepts of Operating Systems Jonathan Walpole.
The IBM VM CS450/550 Section 2 Stephen Kam. IBM VM - Origins Originally an experimental OS called “CP-67” Designed to run on the IBM System/360 Model.
Unit-1 Introduction Prepared by: Prof. Harish I Rathod
Computers Operating System Essentials. Operating Systems PROGRAM HARDWARE OPERATING SYSTEM.
 Virtual machine systems: simulators for multiple copies of a machine on itself.  Virtual machine (VM): the simulated machine.  Virtual machine monitor.
1 Text Reference: Warford. 2 Computer Architecture: The design of those aspects of a computer which are visible to the programmer. Architecture Organization.
Virtual 8086 Mode  The supports execution of one or more 8086, 8088, 80186, or programs in an protected-mode environment.  An 8086.
1 Compiler Construction (CS-636) Muhammad Bilal Bashir UIIT, Rawalpindi.
CE Operating Systems Lecture 2 Low level hardware support for operating systems.
Operating Systems 1 K. Salah Module 1.2: Fundamental Concepts Interrupts System Calls.
1 CS.217 Operating System By Ajarn..Sutapart Sappajak,METC,MSIT Chapter 2 Computer-System Structures Slide 1 Chapter 2 Computer-System Structures.
1 Computer Systems II Introduction to Processes. 2 First Two Major Computer System Evolution Steps Led to the idea of multiprogramming (multiple concurrent.
CE Operating Systems Lecture 2 Low level hardware support for operating systems.
Processor Structure and Function Chapter8:. CPU Structure  CPU must:  Fetch instructions –Read instruction from memory  Interpret instructions –Instruction.
Protection of Processes Security and privacy of data is challenging currently. Protecting information – Not limited to hardware. – Depends on innovation.
Virtualizing a Multiprocessor Machine on a Network of Computers Easy & efficient utilization of distributed resources Goal Kenji KanedaYoshihiro OyamaAkinori.
CSCI/CMPE 4334 Operating Systems Review: Exam 1 1.
1 Virtualization "Virtualization software makes it possible to run multiple operating systems and multiple applications on the same server at the same.
CS 695 Topics in Virtualization and Cloud Computing, Autumn 2012 CS 695 Topics in Virtualization and Cloud Computing More Introduction + Processor Virtualization.
Introduction to Operating Systems Concepts
VIRTUALIZATION.
Virtualization D. J. Foreman 2009.
Modularity Most useful abstractions an OS wants to offer can’t be directly realized by hardware Modularity is one technique the OS uses to provide better.
Operating System Structure
Applied Operating System Concepts
Virtualization Dr. Michael L. Collard
Mechanism: Address Translation
Formal Virtual Machines
Module: Handling Exceptions
Virtualization Techniques
Computer-System Architecture
Module 2: Computer-System Structures
Memory Management Tasks
Operating Systems Lecture 3.
Introduction to Operating Systems
Module 2: Computer-System Structures
Operating Systems: A Modern Perspective, Chapter 3
Outline Operating System Organization Operating System Examples
Module 2: Computer-System Structures
Module 2: Computer-System Structures
Mechanism: Address Translation
Presentation transcript:

Formal Requirements for Virtualizable Third Generation Architectures Grad Operating System Mini-Project Authors: Gerald J. Popek, and Robert P. Goldberg Presented by: Yiji Zhang

Outline Basic VM Concepts Formal Definitions Virtualization Theorems Contribution

Outline Basic VM Concepts Formal Definitions Virtualization Theorems Contribution

Basic VM Concepts Virtual Machine (VM) efficient, isolated duplicate of the real machine the environment created by the virtual machine monitor VMM Hardware VM The virtual machine monitor

Basic VM Concepts Virtual machine monitor (VMM) a piece of software three properties: 1) Equivalence: program run under the VMM = run on the original machine directly 2) Efficiency: statistically dominant subset of virtual processor's instructions be executed by real processor 3) Resource control: has complete control of resources

Outline Basic VM Concepts Formal Definitions Virtualization Theorems Contribution

Formal Definitions Three formal definitions Model of 3rd generation machine Instruction behavior Virtual machine monitor

Model of 3rd Generation Machine Overview simplified conventional 3rd generation machine with a processor with linear, uniformly addressable memory without I/O instructions without interrupts Machine behavior The machine can exist in any one of a finite number of states S, where S = <E, M, P, R>.

Model of 3rd Generation Machine Behavior of the computer: state (S) E: executable storage R: relocation-bounds register S=<E, M, P, R> M: processor mode P: program count

Model of 3rd Generation Machine Behavior of the computer: state-space (S) E: executable storage word or byte addressed memory; E[i]: contents of the ith unit of storage in E R: relocation-bounds register S=<E, M, P, R> M: processor mode P: program count

Model of 3rd Generation Machine Behavior of the computer: state-space (S) E: executable storage R: relocation-bounds register S=<E, M, P, R> M: processor mode 2 types supervisor (s) user (u) P: program count

Model of 3rd Generation Machine Behavior of the computer: state-space (S) E: executable storage R: relocation-bounds register S=<E, M, P, R> M: processor mode P: program count address relative to register; index

Model of 3rd Generation Machine Behavior of the computer: state-space (S) E: executable storage R: relocation-bounds register R = (l, b) relocation part l: absolute address bound part b: absolute size of virtual memory S=<E, M, P, R> M: processor mode P: program count

Model of 3rd Generation Machine Program status word (PSW) the contents of the triple <M, P, R> used for other definitions and proof later Instruction (i) a function from one set of states (C) to another. i: C  C e.g. i(S1) = S2 i(E1, M1, P1, R1) = (E2, M2, P2, R2)

Model of 3rd Generation Machine Trap 1. Definition 2. Particular kind of trap

Model of 3rd Generation Machine Trap 1. Definition An instruction is said to trap if i(E1, M1, P1, R1) = (E2, M2, P2, R2) where E2[i] = E1[j], for 0<j<q E2[0] = (M1, P1, R1) (M2, P2, R2) = E1[1]

Model of 3rd Generation Machine Trap 1. Definition An instruction is said to trap if i(E1, M1, P1, R1) = (E2, M2, P2, R2) where E2[i] = E1[j], for 0<j<q E2[0] = (M1, P1, R1) (M2, P2, R2) = E1[1] 1. Save the current state 2. Pass control of a pre-specified routine by changing PSW

Model of 3rd Generation Machine Trap 2. Particular kind of trap: memory trap caused by accessing an address which is over the bounds in relocation-bounds register R(l, b) or physical memory micro-sequence: where a is the address to be accessed, l is relocation, q is the total size of memory, and b is the bound if a + l ≥ q then trap; if a ≥ b then trap

Formal Definitions Three formal definitions Model of 3rd generation machine Instruction behavior Virtual machine monitor

Instruction Behavior privileged instruction sensitive instruction control sensitive instruction behavior sensitive instruction innocuous instructions

Instruction Behavior privileged instruction sensitive instruction control sensitive instruction behavior sensitive instruction innocuous instructions

Privileged Instruction Definition Instruction i is privileged iff for any pair of states S1 = <e, s, p ,r> and S2 = <e, u, p ,r> in which i(S1) and i(S2) do not memory trap: i(S2) traps and i(S1) does not.

Privileged Instruction Definition independent of the virtualization process the only difference Instruction i is privileged iff for any pair of states S1 = <e, s, p ,r> and S2 = <e, u, p ,r> in which i(S1) and i(S2) do not memory trap: i(S2) traps and i(S1) does not. privileged instruction trap

Instruction Behavior privileged instruction sensitive instruction control sensitive instruction behavior sensitive instruction innocuous instructions

Sensitive Instruction Control sensitive control sensitive instructions: affect or potentially affect the control of VMM over recourses no isolated condition codes or other complications by which instructions can interact An instruction i is control sensitive if there exists a state S1 = <e1, m1, p1, r1>, and i(S1) = S2 = <e2, m2, p2, r2> such that i(S1) does not memory trap, and either: (a) r1≠r2, or (b) m1 ≠ m2, or both.

Sensitive Instruction Behavior sensitive…

Sensitive Instruction Behavior sensitive… First introduce new notations… operator ⊕: r’ = r ⊕ x = (l+x, b), which means the relocation register has had its base value shifted by the value of x E | R: which means the contents of the part of the memory which can be effected by the instruction E | r = E’ | r ⊕ x: for 0≤i≤b, E[l + i] = E’[l + x + i]

Sensitive Instruction Behavior sensitive (finally!) the effect of the executions depends on the value of the relocation-bounds register. An instruction i is behavior sensitive if there exists an integer x and states: (a) S1 = <e | r, m1, p, r>, and (b) S2 = <e | r ⊕ x, m2, p, r ⊕ x >, where (c) i(S1) = <e1 | r, m1, p1, r>, (d) i(S2) = <e2 | r ⊕ x, m2, p2, r ⊕ x >, and (e) neither i(S1) or i(S2) memory trap, such that either (a) e1 | r ≠ e2 | r ⊕ x, or (b) p1≠ p2, or both.

Instruction Behavior privileged instruction sensitive instruction control sensitive instruction behavior sensitive instruction innocuous instructions

Innocuous Instructions The instructions which are neither privileged instruction nor sensitive instructions.

Formal Definitions Three formal definitions Model of 3rd generation machine Instruction behavior Virtual machine monitor

Virtual Machine Monitor VMM a particular piece of software, called a control program, that exhibits certain properties

Virtual Machine Monitor Control program modules CP = <D, A, {vi}> Control Program (CP) Dispatcher (D) Allocator (A) Interpreters

Virtual Machine Monitor Control program modules CP = <D, A, {vi}> Control Program (CP) top level module decide which module to call Dispatcher (D) Allocator (A) Interpreters

Virtual Machine Monitor Control program modules CP = <D, A, {vi}> Control Program (CP) invoked by dispatcher when an attempted execution is to change the resources Dispatcher (D) Allocator (A) Interpreters

Virtual Machine Monitor Control program modules CP = <D, A, {vi}> Control Program (CP) one interpreter routine per privileged instruction to simulate the effect of trapped instruction Dispatcher (D) Allocator (A) Interpreters

Virtual Machine Monitor Control program modules CP = <D, A, {vi}> Control Program (CP) one interpreter routine per privileged instruction to simulate the effect of trapped instructions Dispatcher (D) Allocator (A) Interpreters vi: set of interpretive routines

Virtual Machine Monitor VMM properties Recall Basic VM Concept… three properties (of VMM): 1) Equivalence: program run under the VMM = run on the original machine directly 2) Efficiency: statistically dominant subset of virtual processor's instructions be executed by real processor 3) Resource control: has complete control of resources

Virtual Machine Monitor VMM properties Recall Basic VM Concept… three properties (of VMM): 1) Equivalence: program run under the VMM = run on the original machine directly 2) Efficiency: statistically dominant subset of virtual processor's instructions be executed by real processor 3) Resource control: has complete control of resources Now more formally...

Virtual Machine Monitor VMM properties (formally) 1) Equivalence: Any program K executing with a control program resident, with two possible exceptions, performs in a manner indistinguishable from the case when the control program did not exist and K had whatever freedom of access to privileged instructions that the programmer had intended.

Virtual Machine Monitor VMM properties (formally) 1) Equivalence (even more formally) Two machines : S1 and S1' = f(S1) “equivalent” iff: for any state S1, if the real machine halts in state S2 ; then the virtual machine halts in state S2’ = f(S2)

Virtual Machine Monitor VMM properties (formally) 1) Equivalence (even more formally) Two machines : S1 and S1' = f(S1) “equivalent” iff: for any state S1, if the real machine halts in state S2 ; then the virtual machine halts in state S2’ = f(S2) Virtual Machine Map (VM MAP)

Virtual Machine Monitor Virtual machine Map (VM Map) f: Cr  Cv is a one-one homomorphism w.r.t all the operators ei in the instruction sequence set I. where Cr is the set of possible states of the real machine without a VMM, and Cv is the set with VMM. The virtual machine map

Virtual Machine Monitor VMM properties (formally) 2) Efficiency: All innocuous instructions are executed by the hardware directly, with no intervention at all on the part of the control program.

Virtual Machine Monitor VMM properties (formally) 3) Resource control: It must be impossible for that arbitrary program to affect the system resources, i.e. memory, available to it; the allocator of the control program is to be invoked upon any attempt.

Outline Basic VM Concepts Formal Definitions Virtualization Theorems Conclusion

Visualization Theorem THEOREM 1. For any conventional third generation computer, a virtual machine monitor may be constructed if the set of sensitive instructions for that computer is a subset of the set of privileged instructions.

Visualization Theorem THEOREM 1. For any conventional third generation computer, a virtual machine monitor may be constructed if the set of sensitive instructions for that computer is a subset of the set of privileged instructions. which implies all assumptions for: relocation mechanisms, supervisor/user mode, and trap mechanisms the instruction set is of general purpose to support dispatcher, allocator, and table lookup procedure

Visualization Theorem THEOREM 1. For any conventional third generation computer, a virtual machine monitor may be constructed if the set of sensitive instructions for that computer is a subset of the set of privileged instructions. which 1) means: to build a VMM it is sufficient that all instructions that could affect the correct functioning of the VMM always trap and pass control to the VMM

Visualization Theorem THEOREM 1. For any conventional third generation computer, a virtual machine monitor may be constructed if the set of sensitive instructions for that computer is a subset of the set of privileged instructions. which 2) guarantees: the resource control property, and equivalence property

Visualization Theorem THEOREM 1. For any conventional third generation computer, a virtual machine monitor may be constructed if the set of sensitive instructions for that computer is a subset of the set of privileged instructions. which 3) provides: a simple technique for implementing a VMM, called trap-and-emulate virtualization

Visualization Theorem THEOREM 2. A conventional third generation computer is recursively virtualizable if it is: (a) virtualizable, and (b) a VMM without any timing dependencies can be constructed for it.

Visualization Theorem THEOREM 2. A conventional third generation computer is recursively virtualizable if it is: (a) virtualizable, and (b) a VMM without any timing dependencies can be constructed for it. Exceptions: 1) programs with resource bound The theorem limits the number of nested VMMs of the recursion. 2) programs that have time dependencies

Visualization Theorem THEOREM 3. A hybrid virtual machine monitor may be constructed for any conventional third generation machine in which the set of user sensitive instructions are a subset of the set of privileged instructions.

Visualization Theorem THEOREM 3. A hybrid virtual machine monitor may be constructed for any conventional third generation machine in which the set of user sensitive instructions are a subset of the set of privileged instructions. user sensitive instruction: there exists a state S = (E, u, P, R) for which instructions i is control sensitive or behavior sensitive.

Visualization Theorem THEOREM 3. A hybrid virtual machine monitor may be constructed for any conventional third generation machine in which the set of user sensitive instructions are a subset of the set of privileged instructions. user control sensitive: the definition given earlier for control sensitivity holds, with ml in that definition set to user. user behavior sensitive: the definition for location sensitivity holds with the mode of states S1 and S2 equal to user.

Outline Basic VM Concepts Formal Definitions Virtualization Theorems Contribution

Contribution A formal model of a 3rd generation computer system Necessary and sufficient conditions to determine whether a particular 3rd generation machine can support a VMM

Reference Gerald J. Popek and Robert P. Goldberg. 1974. Formal requirements for virtualizable third generation architectures. Commun. ACM 17, 7 (July 1974), 412-421.