The Xen Hypervisor
This chapter is from the book
This chapter is from the book
This chapter is from the book
The Xen hypervisor is the heart of Xen. It sits between the guest domains and the physical hardware, allocating and controlling resources, enforcing protection and isolation. It literally defines the virtual machine interfaces seen by guest domains. In this chapter, we describe the Xen hypervisor and how it interacts with guest domains. We discuss a special privileged domain, called Domain0, that is used to administer normal guest domains and to control the physical hardware. We also discuss the Xen management daemon, known as xend, that passes control requests to the Xen hypervisor. Finally, we describe XenStore, a database of configuration information used to communicate between domains.
Xen Hypervisor
The Xen hypervisor sits above the physical hardware and presents guest domains with a virtual hardware interface. In this way, it defines the virtual machine that guest domains see instead of the physical hardware. The Xen hypervisor runs on any Xen system, including when running the Xen LiveCD as described in Chapter 2, "A Quick Tour with the Xen LiveCD." Figure 3.1 illustrates the relationship between the hypervisor, the virtual guests, and the physical hardware.
)
Figure 3.1 The relationship of the hypervisor to the physical hardware and guest domains
To minimize modifications to guest operating systems and user level applications running inside guest domains, it is important that the virtual machine look as much like the underlying physical machine as possible. Exposing a completely different virtual machine would mean that none of the standard application level software would run. However, the hypervisor does make some changes in the machine interface it exposes to guest domains.
The following list summarizes the role of the hypervisor:
- The hypervisor gives each guest domain a portion of the full physical machine resources. Multiple guests running on the same physical machine must share the available resources. Therefore, the hypervisor does not generally expose the full power of the underlying machine to any one guest. Instead, it allocates a portion of the resources to each guest domain. It can either attempt to partition resources evenly or in a biased fashion to favor some guests over others. It grants each guest a limited amount of memory and allows each guest only its fair share of the CPU. Similarly, it may not want all guests to have access to every physical device in the system and thus it only exposes the devices it wants each guest to see. Sometimes, it may even create virtual devices that have no corresponding underlying physical device—for example, a virtual network interface.
- The hypervisor exports simplified devices to guest domains. Rather than emulating the actual physical devices exactly, the hypervisor exposes idealized devices. For example, it doesn't matter whether the network interface card is a 3Com Etherlink or a Linksys wireless card; it can be exposed to guest domains as a generic network class device. Similarly, storage devices are exposed to guest operating systems as generic block devices. This makes it much easier to move guests between physical systems. It also makes it much easier to develop a new operating system or port an existing operating system to a new platform because the operating system running inside a guest VM only needs to support a device driver for each generic class of devices rather than all the possible physical devices. A device driver for the actual physical device need only be running in one domain, such as Domain0.
- The hypervisor can modify portions of the physical architecture that are difficult to fully virtualize. The x86 architecture has been notoriously hard to virtualize. Xen exposes a slightly simplified version of the x86 architecture to guest operating systems to make it easier to virtualize efficiently. Care was taken to make sure that these changes only affected the operating systems running in the guest domains and not the user level applications. Operating systems had to be "ported" to the modified virtual machine architecture.