--- ols_2007-anthony-2/harper/background.tex 2007-04-07 21:27:06.000000000 -0500
+++ ols_2007-anthony-2.new/harper/background.tex 2007-04-07 22:20:16.000000000 -0500
@@ -93,41 +93,36 @@
in guest mode.
Both of these requirements are violated by Intel and AMD Processors
-prior to 2007. Nevertheless VMware, and later Xen, both successfully
+prior to 2005. Nevertheless VMware, and later Xen, both successfully
virtualized these older platforms by figuring out new methods and
working with x86 privilege levels in an unanticipated way.
The x86 processor architecture has four privilege levels for segment
-descriptors and two for page
-descriptors. \textit{Privileged} instructions are
-modify control registers or otherwise are able to alter the protection
+descriptors and two for page descriptors. \textit{Privileged} instructions are
+able to modify control registers or otherwise alter the protection
and isolation characteristics of segments and pages on the
-platform. Privileged instructions must run at the highest privilege
-level (0). On most x86 processors prior to 2007, however, there are
-some non-privileged instructions that can also alter the protection
-and isolation characteristics of the platform without causing a
-trap. These instructions are safe when a single OS is in control of
-the entire platform. However, when multiple OS's are running as
-guests, these ``non-virtualizable'' instructions can violate guest
-isolation.
-
+platform. Privileged instructions must run at the highest protection
+level (ring 0). All x86 processors prior to the introduction of hardware
+virtualization fail to generate a trap on a number of instructions when issued
+outside of ring 0. These ``non-virtualizable'' instructions prevent the
+traditional trap-and-emulate virtualization method from functioning.
\textit{Ring compression} is the technique of loading a guest kernel
-in a less-privileged protection zone, usually ring three (the least
+in a less-privileged protection zone, usually ring 3 (the least
privileged) for user space and ring 1 for the guest kernel (or ring 3
-for the \texttt{x86\_64} guest kernel. In this manner every time the
-guest kernel executes a privileged instruction the processor traps
+for the \texttt{x86\_64} guest kernel). In this manner every time the guest
+kernel executes a trappable privileged instruction the processor enters
into the hypervisor (fulfilling the first requirement above, the
-ability to monitor the guest). The hypervisor at that point is in
-control and can either disallow or continue the trapped instruction.
+ability to monitor the guest) giving the hypervisor full control to
+disallow or emulate the trapped instruction.
Ring compression \textit{almost} works to simulate a monitor mode on
-x86 hardware. It is not a complete solution because some x86
+x86 hardware. It is not a complete solution because some x86
instructions that should cause a trap in certain situations do not.
\subsection{Paravirtualization and Binary Translation}
-On x86 CPUS prior to 2007 there are some cases where non-privileged
+On x86 CPUS prior to 2005 there are some cases where non-privileged
instructions can alter isolation mechanisms. These include pushing or
poping flags or segment registers, and returning from
interrupts---instructions that are safe when only one OS is running on
@@ -156,13 +151,13 @@
\subsection{x86 Hardware Virtualization Support}
Beginning in late 2005 when Intel started shipping Intel-VT
-extensions, many x86 processors have included both a host
+extensions, x86 processors gained the ability to have both a host
and a guest mode. These two modes co-exist with the four levels of
-segment privileges and two levels of page privileges. AMD also
-provides processors with AMD-V extensions. Intel-VT and AMD-V are
+segment privileges and two levels of page privileges. AMD also provides
+processors similar features with their AMD-V extensions. Intel-VT and AMD-V are
similar in their major features and programming structure.
-With Intel-VT and AMD-V hardware ring compression and binary translation are
+With Intel-VT and AMD-V, hardware ring compression and binary translation are
obviated by the new hardware instructions. The first generation
of Intel and AMD virtualization support remedied many of the
\textit{functional} shortcomings of x86 hardware, but not the most
@@ -173,10 +168,9 @@
and cache misses, and by providing multi-level memory management
support directly in hardware.
-KVM implements a virtual machine monitor using AMD-V and Intel-VT processor
-instructions. Interestingly, KVM does this as a loadable kernel
-module. By loading a kernel module you can turn Linux into a virtual
-machine monitor--if you have the right hardware.
+KVM provides a user-space interface for using AMD-V and Intel-VT processor
+instructions. Interestingly, KVM does this as a loadable kernel module which
+turns Linux into a virtual machine monitor--if you have the right hardware.
\section{Linux x86 Virtualization Techniques in More Detail}