Xen and the Art of Virtualization Paul Barham

Xen and the Art of Virtualization Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt & Andrew Warfield Presented by Judy Fischbach CS 533 - Concepts of Operating Systems

Overview l Motivations l How Xen works l Comparisons among Xen, hardware, and VMWare. l 9/30/2020 Xen and VMWare both designed for x 86 architecture CS 533 - Concepts of Operating Systems 2

Virtualization Challenges l Speed l Performance l Security l Resource Isolation l Functionality l Xen’s 9/30/2020 design goal CS 533 - Concepts of Operating Systems 3

Types of virtualization l Two l Full Virtualization l l Disco and VMWare Paravirtualization l 9/30/2020 categories exist Xen CS 533 - Concepts of Operating Systems 4

VMM Approach l In traditional VMM (Virtual Machine Monitor) the virtual hardware is functionally equivalent to the physical hardware Possibly difficult to implement (x 86 systems in particular) l Potentially useful to provide real and virtual resource information l l 9/30/2020 The “guest” machine would not have access to this information CS 533 - Concepts of Operating Systems 5

Xen Approach Virtual machine is NOT 100% functionally equivalent to the hardware l Xen uses paravirtualization instead l Paravirtualization is a process where the guest operating system is modified to run in parallel with other modified systems l l l 9/30/2020 Advantage: Improved performance Disadvantage: The hosted operating system must be modified before it can be hosted by the Xen Hypervisor (can be difficult) CS 533 - Concepts of Operating Systems 6

Xen Design 9/30/2020 CS 533 - Concepts of Operating Systems 7

Definitions l Guest Operating System l l The operating system that Xen hosts Domain l The virtual machine under which a guest operating system executes Guest OS and a domain similar to idea of a program and a process l Hypervisor l l 9/30/2020 A particular Xen version which handles low level functionality CS 533 - Concepts of Operating Systems 8

Xen Implementation l What Xen does differently-l CPU l l Memory Management l l 9/30/2020 Virtual Address Translation Physical Memory Device I/O l l Virtualization of the CPU Scheduling Time & Timers Network Disk Control Transfer CS 533 - Concepts of Operating Systems 9

CPU l Most change is required here by the guest OS l Xen takes exception to the basic idea that an OS is the most privileged l Privileged instructions l 9/30/2020 Instructions are paravirtualized by requiring to be validated/executed within Xen CS 533 - Concepts of Operating Systems 10

CPU Virtualization easier with x 86 l Why? l Has built in security levels (Rings 0, 1, 2, 3) l Ring 0 – OS Software (most privileged) l Ring 3 – User software l Ring 1 & 2 – Not used l Xen modifies the OS to execute on Ring 1 l 9/30/2020 CS 533 - Concepts of Operating Systems 11

CPU Scheduling and Timers Borrowed Virtual Time algorithm is used in scheduling domains l Important to lessen problems of one domain executing code that might impact another domain. l Provides several different types of timers l l 9/30/2020 Real Timer Virtual Timer Wall Clock Timer CS 533 - Concepts of Operating Systems 12

Control Transfer l Exceptions and Events Memory faults and software traps l Generally virtualized through Xen’s event handler l Two most frequent exceptions are: l System calls l Page faults l System calls and page faults are two examples of a ‘fast’ handler (one in which doesn’t use the hypervisor) l 9/30/2020 CS 533 - Concepts of Operating Systems 13

Paravirtualization of the MMU Paravirtualization 9/30/2020 CS 533 - Concepts of Operating Systems Full Virtualization 14

Virtual Memory l When the guest OS requires a new page table, it allocates it from its own memory store l l l After allocation it becomes registered with Xen OS then gives up all memory write privileges All subsequent updates must be validated by Xen Guest OS’s generally batch these update requests to amortize the cost of calling the hypervisor Segmentation is virtualized likewise 9/30/2020 CS 533 - Concepts of Operating Systems 15

Virtual Memory l Xen uses a design where l l The guest OS’s themselves are responsible for allocation and managing their own hardware pages Xen itself is located in an unused section at the top of address space to ensure that it is never paged out This differs from the approach that Disco takes l Disco VMM goes a second level deeper in it’s indirection. l l 9/30/2020 A VMM within VMM CS 533 - Concepts of Operating Systems 16

Memory Management l Memory Management can be challenging l The key points No software managed TLB exists in x 86 l The TLB is not tagged which implies it must be flushed on a context switch l 9/30/2020 CS 533 - Concepts of Operating Systems 17

Device I/O Management l Data is transferred to and from domains through a buffer descriptor ring l Based on producer consumer pointers l One set used within guest OS l Another set used within Hypervisor l This allows separation between data and event notification 9/30/2020 CS 533 - Concepts of Operating Systems 18

Hypervisor Control l In Xen l Domain 0 is given greater access to the hardware and the hypervisor. It has: l l l A guest OS running above the domain Hypervisor Manager software to manage elements within other existing domains. In VMWare l 9/30/2020 Host OS acts underneath the domain. CS 533 - Concepts of Operating Systems 19

Disk I/O Comparisons Disco Vm. Ware Xen Interface Allows the guest OS access for Disk to the raw device I/O Domain 0 has direct access to disk and houses virtual block device (VBD) mgmt software Allows a “virtual disk” creation (binary file in the host OS file system controlled by the VM) The VBD makes use of the ring mechanism Subsequent domains confine their disk access through the VBD management software Maintains tighter control over disk access and allows “batching” of disk requests 9/30/2020 CS 533 - Concepts of Operating Systems 20

New Domain Creation l Domain 0 is privileged l New domains are created by Domain 0 l l 9/30/2020 Reduces the hypervisor complexity Allows for a better debug environment CS 533 - Concepts of Operating Systems 21

Networking in computers are important these days. l Because of this, Xen provides a “Virtual Firewall” l l l Domain 0 creates firewall rules Data transmission uses a buffer ring for outgoing Data reception uses a different buffer ring for ingoing Incoming data packets are analyzed according to Virtual Firewall rules If any Virtual Firewall rules broken, packet is dropped 9/30/2020 CS 533 - Concepts of Operating Systems 22

Other Hardware Block diagram for Xen illustrates that the idea of Xen enabled hardware drivers still exists l VMWare operates similarly. l Two examples: l l A sound card is installed, host machine will detect that you have a Sound Blaster enabled sound card. A video driver is installed on guest OS to improve video performance (from VMWare). Don’t forget, one more important part of virtualization. l 9/30/2020 Any other resources that the guest OS can access must be virtualized, not just the memory and cpu! CS 533 - Concepts of Operating Systems 23

Citations l Diagrams l 9/30/2020 from the following paper http: //i 30 www. ira. uka. de/teaching/coursedoc uments/90/Xen. pdf CS 533 - Concepts of Operating Systems 24