Notes on virtualization.

Virtualization and CPU Virtualization

1. What is virtualization

Virtualization:
Using software or hardware techniques to abstract the resources of a single physical computer (CPU, memory, storage, network) into multiple logical computing environments (virtual machines, VMs), so that multiple operating systems can run independently on the same hardware.

• Hypervisor (virtual machine monitor): the core layer that manages and schedules virtual machines.
• Guest OS: the operating system running inside a virtual machine.
• Host OS: the operating system running on the physical machine.

In one sentence: virtualization lets “one physical machine pretend to be multiple independent machines”.

2. Why we need virtualization

• Efficient resource utilization: improves the utilization of CPU, memory and other hardware.
• Isolation and security: virtual machines do not affect one another.
• Elasticity and migration: supports snapshots, migration and cloning.
• The foundation of cloud computing: virtualization is the core technology behind IaaS (Infrastructure as a Service).

3. The core mechanism of virtualization: Trap & Emulate

When the Guest OS executes a privileged operation (such as accessing I/O or modifying page tables):

1. Trap: the CPU raises an exception, suspends the virtual machine and switches to the Hypervisor;
2. Emulate: the Hypervisor emulates the effect of executing the instruction;
3. Resume: control returns to the Guest, which continues executing.

The essence of virtualization: make the Guest “believe it is running directly on the hardware”, while in reality every sensitive operation is controlled by the Hypervisor.

4. The core problem of CPU virtualization and its solutions

1. Challenge: sensitive non-privileged instructions

• Some instructions that access hardware (I/O, page-table modification) do not trap when executed at a non-privileged level;
• As a result the Hypervisor cannot intercept them → virtualization fails.

2. Evolution of the solutions

5. Hardware-assisted virtualization (Intel VT-x)

1. Mode division

• Root Mode: runs the Hypervisor, with the highest privilege.
• Non-root Mode: runs the Guest OS; the virtualized environment.

2. Key mechanisms

• VM Entry: entering the virtual machine from the Hypervisor (Root → Non-root).
• VM Exit: the virtual machine exits to the host after executing a sensitive instruction or hitting an exception (Non-root → Root).
• VMCS (Virtual Machine Control Structure):
  A data structure inside the CPU used to store Guest/Host state and control information.

VT-x lets the hardware perform trapping and resuming automatically, greatly improving virtualization performance and compatibility.

6. How KVM/QEMU implement virtualization

1
2

用户态 QEMU ───→  内核态 KVM ───→  硬件 VT-x
  （模拟器）         （接口模块）       （执行单元）

Execution flow:

1. QEMU opens /dev/kvm to create the device and the vCPUs;
2. It calls ioctl(KVM_RUN) to start the virtual machine;
3. The Guest executes in non-root mode;
4. A VM Exit is triggered → control returns to KVM → emulation → re-entry.

QEMU handles the logic outside the virtual machine (I/O emulation),
KVM handles the kernel-space virtualization logic (CPU scheduling, memory mapping),
VT-x provides the underlying hardware support.

7. Interrupt virtualization

• Physical interrupts cannot be delivered directly into a virtual machine.
• The Hypervisor must intercept physical interrupts and then inject virtual interrupts into the Guest.
• Newer technologies (Intel APICv, ARM GICv4) support direct interrupt injection (Posted Interrupts), reducing the trapping overhead.

8. Core flow chart of CPU virtualization

1
2
3
4
5
6
7

Guest OS (Non-root mode)
   │ 执行特权指令
   ▼
[VM Exit] → Hypervisor (Root mode)
   │ 模拟操作 (Emulate)
   ▼
[VM Entry] → Guest 继续执行

CPU virtualization = trap-and-emulate + hardware assistance + state management.

It lets the operating system “believe” it owns the hardware,
while every sensitive operation remains under the Hypervisor’s control.

Translated from the Chinese original.