Xen users - Aug 2010 - how does hypervisor isolates DomU from Dom0

I am not clear with the working of hypervisor xen.
How does an instruction executed by kernel in Ring0 of DomU gets
mapped or executed by hypervisor and then is excuted in Dom0.
Is this thing some where on the wiki page?

-- 
Tapas

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

I am not clear with the working of hypervisor xen.
How does an instruction executed by kernel in Ring0 of DomU gets
mapped or executed by hypervisor and then is excuted in Dom0.
Is this thing some where on the wiki page?



-- 
Tapas
http://mightydreams.blogspot.com
http://wiki.xensource.com/xenwiki/Xen_on_4_app_servers

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On Mon, Aug 16, 2010 at 01:55:25AM +0530, Tapas Mishra
wrote:
> I am not clear with the working of hypervisor xen.
> How does an instruction executed by kernel in Ring0 of DomU gets
> mapped or executed by hypervisor and then is excuted in Dom0.
> Is this thing some where on the wiki page?
> 
Xen hypervisor runs in ring0.
Xen PV domUs don''t run in ring0, instead they run in ring1.

In case of Xen HVM guests the Xen hypervisor runs in ring -1,
with help of the CPU virtualization extensions (Intel VT / AMD-V), 
so the HVM guest kernel can run in it''s own private virtual ring0.

And what do you mean with "then is executed in dom0" ?

Dom0 is another guest VM, but it has some more privileges 
(direct access to the hardware) and responsibilities 
(run management toolstack and provide virtual disks and nics for other guests).

-- Pasi


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On Mon, Aug 16, 2010 at 2:18 AM, Pasi Kärkkäinen <pasik@iki.fi> wrote:

> In case of Xen HVM guests the Xen hypervisor runs in ring -1,
Can you point me to some section of code to the above ?
> And what do you mean with "then is executed in dom0" ?
That question was due to some confusion.
I was discussing about AMD instruction sets for Xen with some one we
had this confusion so this question came.
> Dom0 is another guest VM, but it has some more privileges
I am not clear with this Dom0 is another guest ?
Can you give a link
specially to the code.


-- 
Tapas
http://mightydreams.blogspot.com
http://wiki.xensource.com/xenwiki/Xen_on_4_app_servers

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On Mon, Aug 16, 2010 at 04:29:36PM +0530, Tapas Mishra
wrote:
> On Mon, Aug 16, 2010 at 2:18 AM, Pasi Kärkkäinen <pasik@iki.fi>
wrote:
> 
> 
> > In case of Xen HVM guests the Xen hypervisor runs in ring -1,
> Can you point me to some section of code to the above ?
> 
Not really. Someone familiar with the code might be able to help..
> > And what do you mean with "then is executed in dom0" ?
> That question was due to some confusion.
> I was discussing about AMD instruction sets for Xen with some one we
> had this confusion so this question came.
> 
Ok.
> > Dom0 is another guest VM, but it has some more privileges
> I am not clear with this Dom0 is another guest ?
> Can you give a link
> specially to the code.
> 
Just run "xm list" and you see Domain-0 in the list. 

Or take a look at the boottime messages.. first Xen hypervisor
is started (the lines starting with XEN), and when Xen hypervisor
is started it boots up the first guest VM: dom0 Linux. So you see
dom0 Linux boot messages after Xen boot messages.

-- Pasi


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

> Or take a look at the boottime messages.. first Xen hypervisor
> is started (the lines starting with XEN), and when Xen hypervisor
> is started it boots up the first guest VM: dom0 Linux. So you see
> dom0 Linux boot messages after Xen boot messages.
Yes this I have noticed.
So dom0 is just a guest for the hypervisor but a previleged guest.
-- 
Tapas
http://mightydreams.blogspot.com
http://wiki.xensource.com/xenwiki/Xen_on_4_app_servers

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On Mon, Aug 16, 2010 at 08:42:20PM +0530, Tapas Mishra
wrote:
> > Or take a look at the boottime messages.. first Xen hypervisor
> > is started (the lines starting with XEN), and when Xen hypervisor
> > is started it boots up the first guest VM: dom0 Linux. So you see
> > dom0 Linux boot messages after Xen boot messages.
> Yes this I have noticed.
> So dom0 is just a guest for the hypervisor but a previleged guest.
>
Yes, correct.

-- Pasi


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

>>> On 2010/08/15 at 14:19, Tapas Mishra <mightydreams@gmail.com>
wrote:
> I am not clear with the working of hypervisor xen.
> How does an instruction executed by kernel in Ring0 of DomU gets
> mapped or executed by hypervisor and then is excuted in Dom0.
> Is this thing some where on the wiki page?
I''m not all that familiar with the internals of Xen, but I think the
high-level answer to your question is, it depends.  It depends on what type of
domU you''re running.  Paravirtualized domUs are aware that they are
virtualized and that they do not have ring 0 access, so I''m guessing
they do not attempt to execute instructions in ring 0 without passing it through
to the hypervisor, which brokers those requests.  HVM domUs, on the other hand,
are full machines (more along the lines of how VMware does virtualization) that
can run an unmodified kernel.  So, kernels in HVM domUs attempt to access ring 0
resources, which must then be translated by the HVM and passed on to the
hypervisor.

That''s my understanding of how it works...

-Nick



--------
This e-mail may contain confidential and privileged material for the sole use of
the intended recipient.  If this email is not intended for you, or you are not
responsible for the delivery of this message to the intended recipient, please
note that this message may contain SEAKR Engineering (SEAKR)
Privileged/Proprietary Information.  In such a case, you are strictly prohibited
from downloading, photocopying, distributing or otherwise using this message,
its contents or attachments in any way.  If you have received this message in
error, please notify us immediately by replying to this e-mail and delete the
message from your mailbox.  Information contained in this message that does not
relate to the business of SEAKR is neither endorsed by nor attributable to
SEAKR.

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Ok.

On Mon, Aug 16, 2010 at 10:21 PM, Nick Couchman <Nick.Couchman@seakr.com>
wrote:
>>>> On 2010/08/15 at 14:19, Tapas Mishra
<mightydreams@gmail.com> wrote:
>> I am not clear with the working of hypervisor xen.
>> How does an instruction executed by kernel in Ring0 of DomU gets
>> mapped or executed by hypervisor and then is excuted in Dom0.
>> Is this thing some where on the wiki page?
>
> I''m not all that familiar with the internals of Xen, but I think
the high-level answer to your question is, it depends.  It depends on what type
of domU you''re running.  Paravirtualized domUs are aware that they are
virtualized and that they do not have ring 0 access, so I''m guessing
they do not attempt to execute instructions in ring 0 without passing it through
to the hypervisor, which brokers those requests.  HVM domUs, on the other hand,
are full machines (more along the lines of how VMware does virtualization) that
can run an unmodified kernel.  So, kernels in HVM domUs attempt to access ring 0
resources, which must then be translated by the HVM and passed on to the
hypervisor.
>
> That''s my understanding of how it works...
>
> -Nick
>
>
>
> --------
> This e-mail may contain confidential and privileged material for the sole
use of the intended recipient.  If this email is not intended for you, or you
are not responsible for the delivery of this message to the intended recipient,
please note that this message may contain SEAKR Engineering (SEAKR)
Privileged/Proprietary Information.  In such a case, you are strictly prohibited
from downloading, photocopying, distributing or otherwise using this message,
its contents or attachments in any way.  If you have received this message in
error, please notify us immediately by replying to this e-mail and delete the
message from your mailbox.  Information contained in this message that does not
relate to the business of SEAKR is neither endorsed by nor attributable to
SEAKR.
>


-- 
Tapas
http://mightydreams.blogspot.com
http://wiki.xensource.com/xenwiki/Xen_on_4_app_servers

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users