Hypervisor Architecture
A hypervisor lets several virtual machines share one physical computer while keeping each guest operating system isolated. Its architecture controls CPU execution, memory translation, interrupts, and device access between guests and hardware.
itVirtualization, containers, and orchestration | OpenSkills.info
Intro
Hypervisor Architecture
A hypervisor, also called a virtual machine monitor, creates virtual machines and controls their access to physical hardware. Each virtual machine presents a guest operating system with virtual processors, memory, interrupts, and devices. The guest behaves as though it owns a computer, while the hypervisor preserves isolation and schedules shared resources.
The architecture is larger than the privileged core alone. A usable virtualization system also needs a virtual machine manager, device models, host drivers, firmware, and a management plane. These parts may share one process, run in separate processes, live in a privileged management partition, or move onto dedicated hardware. Placement changes performance, failure boundaries, and attack surface.
The execution boundary
Most ordinary guest instructions execute directly on a physical processor. Hardware virtualization adds a guest execution mode and a control structure for each virtual processor. On Intel processors, VMX operation uses VM-entry and VM-exit transitions. AMD Secure Virtual Machine architecture provides corresponding guest execution and intercept controls.
The hypervisor selects events that must trap. A privileged register access, selected instruction, interrupt condition, or device access can cause a VM exit. The processor saves guest state and transfers control to the hypervisor. The hypervisor emulates an allowed result, injects an exception, updates virtual state, or asks a user-space device model to finish the operation. It then resumes the guest through VM entry.
VM exits are necessary control points, but each transition consumes work. A sound architecture lets safe instructions run natively and intercepts only operations that affect isolation or virtual machine state.
CPU and interrupt virtualization
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/traditional-virtualization-primer.html
Supports
- Defines hosts, guests, VMMs, native guest execution, intercepted privileged operations, device models, and privileged management operating systems.
- https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html
Supports
- Documents VMX operation, VM entry, VM exit, execution controls, interrupt virtualization, EPT, and processor state virtualization.
- https://docs.amd.com/v/u/en-US/40332_4.09_APM_PUB
Supports
- Documents Secure Virtual Machine operation, intercepts, virtual machine state, and nested paging on AMD64 processors.
- https://docs.kernel.org/virt/kvm/api.html
Supports
- Documents KVM virtual machine and vCPU creation, guest-memory mapping, vCPU execution, exits, and user-space interaction.
- https://www.qemu.org/docs/master/system/introduction.html
Supports
- Explains system emulation, accelerators, device models, and QEMU's relationship with KVM.
- https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/architecture
Supports
- Documents Hyper-V partitions, the root partition, virtual processors, memory isolation, VMBus, synthetic devices, and IOMMU use.
- https://docs.kernel.org/driver-api/vfio.html
Supports
- Documents secure user-space device access, IOMMU isolation, device groups, DMA mappings, and reset concerns.
- https://libvirt.org/migration.html
Supports
- Documents migration flows, hypervisor connections, shared and non-shared storage, and network requirements.
- https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/the-nitro-system-journey.html
Supports
- Documents the 2017 C5 milestone, removal of domain zero, KVM-based minimized VMM, and I/O offload to Nitro Cards.
- https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/the-components-of-the-nitro-system.html
Supports
- Documents Nitro Controller, Nitro Cards, hypervisor responsibilities, SR-IOV assignment, minimized services, and control-plane separation.
- https://www.vm.ibm.com/history/vm40hist.pdf
Supports
- Records the CP-67 lineage beginning in 1966 and the VM/370 release in August 1972.
- https://doi.org/10.1145/361011.361073
Supports
- Records the 1974 formal model for virtual machine monitors and its resource-control, equivalence, and efficiency properties.
- https://dl.acm.org/doi/10.1145/96267.96279
Supports
- Grounds the software techniques that made x86 virtualization practical before processor virtualization extensions.
- https://www.cl.cam.ac.uk/research/srg/netos/papers/2003-xensosp.pdf
Supports
- Documents Xen's 2003 paravirtualized architecture, domains, resource management, and performance goals.
- https://www.kernel.org/doc/ols/2007/ols2007v1-pages-225-230.pdf
Supports
- Documents KVM's integration of hardware virtualization into Linux and its availability with Linux 2.6.20.
- https://news.microsoft.com/source/2008/03/19/microsoft-reaches-virtualization-milestone-with-release-candidate-of-hyper-v/
Supports
- Records Hyper-V as hypervisor-based virtualization software for Windows Server 2008 and its 2008 release-candidate milestone.
- https://github.com/sindresorhus/awesome
Supports
- Provides the required starting point for awesome-list discovery.
- https://github.com/Wenzel/awesome-virtualization
Supports
- Identifies Firecracker, Cloud Hypervisor, crosvm, ACRN, Bareflank, mainstream hypervisors, research papers, and processor-virtualization chronology.
- https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md
Supports
- Documents Firecracker's KVM boundary, per-microVM process, vCPU threads, narrow device model, shared queues, and sandboxing.
- https://www.cloudhypervisor.org/docs/
Supports
- Documents the project's cloud-workload VMM, KVM requirements, virtual devices, boot paths, and control interface.
- https://crosvm.dev/
Supports
- Describes a hosted VMM that runs untrusted guests and isolates virtual devices in separate sandboxes.
- https://projectacrn.github.io/latest/developer-guides/hld/index.html
Supports
- Documents the type 1 hypervisor, Service VM, User VMs, CPU and memory virtualization, interrupt handling, and I/O models.
- https://bareflank.github.io/hypervisor/
Supports
- Describes an SDK and examples for prototyping hypervisor extensions and VMX-root behavior.
- https://www.vmware.com/products/cloud-infrastructure/vsphere
Supports
- Grounds VMware vSphere and ESXi as a server virtualization platform with a bare-metal hypervisor and centralized management.
- https://www.proxmox.com/en/products/proxmox-virtual-environment/overview
Supports
- Documents a virtualization platform that manages KVM virtual machines with clustering, storage, networking, and migration services.
- https://www.nutanix.com/products/ahv
Supports
- Documents AHV's placement inside the Nutanix infrastructure stack and its VM lifecycle and management role.
- https://www.virtualbox.org/manual/UserManual.html
Supports
- Documents a hosted cross-platform VMM, virtual hardware, guest additions, networking, storage, and snapshots.
- https://xenproject.org/
Supports
- Grounds Xen as an open-source type 1 hypervisor with a privileged control domain and multiple guest types.
- https://docs.xcp-ng.org/
Supports
- Documents a Xen-based virtualization platform, XAPI management stack, storage, networking, and migration operations.
- https://www.redhat.com/en/technologies/cloud-computing/openshift/virtualization
Supports
- Documents KVM-based virtual machines managed alongside container workloads through Kubernetes control-plane resources.