Protection of Processes Security and privacy of data is challenging currently. Protecting information – Not limited to hardware. – Depends on innovation in computer architecture and systems software. Virtual Memory – Architecture support for protecting processes from each other. Virtual Machines 1

Protection via Virtual Memory … (1) Data blocks – between main memory and cache. Pages – between secondary storage and main memory. Translation Lookaside Buffer (TLB) – cache to provide translation from virtual to physical address. 2

Protection via Virtual Machines … (1) Emulation that provides standard software interface. VMs that provide complete system-level environment at binary ISA (Instruction Level Architecture) level. These are called OS Virtual Machines. – Examples: IBM z/VM, VMWare ESX Server, etc.. Provides illusion that users of VM have entire computer control, including OS. One computer can run multiple VMs and support multiple OSes.  In conventional platform, one OS “owns” all hardware.  In VM, multiple OSes share hardware resources. 3

Protection via Virtual Memory … (4) Most popular memory protection scheme – Add protection restrictions to each page in virtual memory. – Page Table Mapping from virtual address space to physical address space. Protection restrictions (can user read, write, execute from this page?) are included in page table against each page entry. Only OS can update page table  paging mechanism provides access protection. – TLB Provides faster address translation (from virtual to physical address). Two parts: tag portion and data portion. Tag portion: Portions of virtual address. Data portion: Physical page address, Protection field, Valid bit, Use bit, Dirty bit. OS changes these bits in page table  this updates TLB entry. 4

Protection via Virtual Memory … (2) Multiprogramming – Multiple programs running concurrently. – Need for protection and sharing of resources among programs. – Process: Running program + state needed to run. – Context / Process switch: Switch from one process to another. OS and architecture allow processes to share hardware without interfering with each other. Types of processes – User process Access to local processor state only. – OS / Kernel / Supervisor process Access to entire processor state. 5

Protection via Virtual Memory … (3) To prevent processes from interfering with each other, architecture must provide the following. 1.At least two modes: user mode and OS mode. 2.Provide a processor state that a user process can use but not write. 1.Example: user/supervisor mode bit(s), memory protection information. 2.Because OS cannot have control if user processes grant themselves supervisor privileges. 3.Mechanism for processor to go from user to supervisor mode and vice versa. 1.Using system call; PC is saved; processor switches to user/supervisor mode; executes; return to supervisor/user mode; continue earlier subroutine. 4.Mechanism to protect memory state of a process during context switch, without having to swap process to disk. 6

Protection via Virtual Memory … (5) Insufficient – Depends on accuracy of OS and hardware. – OSes are huge programs. – Flaws in OS lead to vulnerabilities. Hence – Look for protection in a smaller code base than full OS.  Virtual Machines. 7

Protection via Virtual Machines … (2) Hypervisor – A.k.a. Virtual Machine Monitor (VMM). – Software that supports VMs. – Determines how to map virtual resources to physical resources. – Physical resource is time-shared / partitioned / emulated in software. – VMM is much smaller than OS (~ 10K l.o.c.). Host – Underlying hardware platform. Guest – VMs that share the host’s resources through the VMM. 8

Protection via Virtual Machines … (3) Other benefits of Virtual Machines. – Managing Software VMs provide abstractions to run complete software stacks, such as entire OSes. – Managing Hardware Servers – allow applications to run on compatible OSes on dedicated hardware  improves dependability. VMs allow these applications and OSes to run independently on shared hardware  reduces need for multiple servers. 9

Requirements of a Virtual Machine Monitor Provide interface to guest software. Isolate the state of guests from each other. Protect itself from guest software and OSes. Qualitative requirements – Guest software behaviour on VM = behaviour on native hardware; except for performance-related behaviour. – Guest software should not be able to change real system resources directly. 10