In this series we look at the various aspects of Virtualization and in particular the OS virtualization. We start with a high level introduction to virtualization and then deep dive in further series. The intent here is to understand what a virtual machine means and what is happening under the hoods.

With virtual machines, multiple OSes will share the same hardware resources with virtualized representation of each of the resource available to the VM. So a VM can continue to do block operations on a disk (in this case it’s a virtual disk), thinking that it’s the only OS running on the hardware.

To virtualize the OS a special piece of software is used. This is termed as the hypervisor. The hypervisor itself has 2 parts

1. VMM — used for trap and emulate the privileged instruction set
2. Device Model — for virtualizing the i/o

VMs are pretty similar to OS process .VMs execute in a hardware isolated virtual address space and at a lower privilege level then the Host OS. The primary difference between a process and a VM is the ABI exposed by the host to the VM. In case of process the ABI has things like network sockets, FD etc while in case of a full fledged OS virtualization the ABI will be virtual disk, network cards etc. Since the hardware is not available directly (though in some cases it can be) to the VM the role of VMM is to trap privileged instructions on CPU as well as access to the hardware like disk/network card.

Here we talk about only single level of virtualization. Nested virtualization will be covered in coming blogs.

VMM has to support 3 basic properties

1. Isolation — Isolated guests from each other

2. Equivalency — should behave as is with or without virt. This means we run majority (almost all) instructions on the physical hardware without any translation etc.

3. Performance — The VM should perform as good as it running without any virtualization. This again means that the overhead of running a VM should be minimal.

According to Popek Goldberg principle for Virtualization

All sensitive instructions must also be privileged. x86 some instructions are sensitive but not privileged. This means running them in userspace would not cause a trap. In effect this means
they are not virtualizable. Example of such an instruction is POPF
Privileged instructions cause a trap in user mode.

We look at 3 aspects of virtualization in context of system level virtualization. This means that the VMM has to take care of these 3 resources when running a virtualized system on top.
1. CPU
2. Memory
3. I/O

VMM should not allow access to privileged state to the VM. Things like manipulating the state of certain registers should not be allowed from the VM. The VMM should always trap and emulate those calls.

Handle exceptions, interrupts — This means that say a network call was issued from within a virtual machine. The same will be trapped in VMM and emulated. On receipt of packets an interrupt is generated by the cpu and the same has to be delivered back to the actual virtual machine for which this is supposed to.

Today VMM handle cpu virtualization by running majority of the instructions natively and only trap for certain privileged instructions. This means the performance is almost as good as native code running directly on the hardware.

VMM should handle memory mapped IO by mapping the calls to the virtual device mapped memory in the guest to the actual physical device mapped memory. For this the VMM should control the physical memory mappings. Guest physical to host physical

The device model of the Hypervisor handles the i/o virtualization again by trap and emulation and taking care of interrupts delivery back to the specific virtual machine.

In next blog I intend to go over some more details in aspects around hardware assisted virtualization and individual aspects like cpu memory and i/o virtualization.

I also intend to cover alternate approaches to i/o virtualization like hypervisor by pass and SRIOV in coming blogs.

Updated Part 2 on Memory Virtualization

Disclaimer : The views expressed above are personal and not of the company I work for.