Advanced Virtualization - Full and Para-virtualization

Introduction

Now that you understand the basics of virtualization, let us explore the techniques hypervisors use under the hood. The central challenge of virtualization is this: a guest operating system expects to run at the highest privilege level (Ring 0) and directly control hardware. But the hypervisor cannot allow this — it must intercept sensitive operations to maintain isolation. Different virtualization approaches solve this challenge in different ways.

The Virtualization Challenge

On x86 processors (before hardware virtualization extensions), certain instructions behaved differently in Ring 0 vs Ring 3 but did not trap when executed in Ring 3 — they simply did something different silently. These are called "sensitive but non-privileged" instructions. A guest OS running in Ring 3 would execute these instructions without trapping to the hypervisor, leading to incorrect behavior.

Example: The POPF instruction modifies the interrupt flag when run in Ring 0 but silently ignores it in Ring 3. A guest OS trying to disable interrupts would think it succeeded, but interrupts would continue arriving.

Full Virtualization

In full virtualization, the guest OS runs completely unmodified — it does not know it is virtualized. The hypervisor creates a perfect illusion of physical hardware.

Binary Translation (Software Approach)

Before hardware support existed, VMware pioneered binary translation: the hypervisor scans guest kernel code at runtime and replaces problematic instructions with safe equivalents.

How it works:

1. Guest kernel code is never executed directly
2. Hypervisor translates basic blocks of guest code on-the-fly
3. Sensitive instructions are replaced with calls to hypervisor handlers
4. Translated code is cached for reuse
5. User-mode guest code runs directly (no sensitive instructions)

Performance: 5-20% overhead for kernel-heavy workloads. User-mode code runs at native speed since it contains no privileged instructions.

Trap-and-Emulate (Hardware Approach)

With hardware virtualization (Intel VT-x / AMD-V), the CPU provides a new execution mode for guests. When a guest executes a sensitive instruction, the hardware automatically traps to the hypervisor:

Advantages: No binary translation needed, guest runs unmodified, cleaner design. Disadvantage: VM exits are expensive (500-1000 CPU cycles each). Frequent exits (I/O-heavy workloads) cause significant overhead.

Para-virtualization

In para-virtualization, the guest OS is modified to "know" it is virtualized. Instead of executing sensitive instructions that would trap, the guest explicitly calls the hypervisor through hypercalls — analogous to system calls but from guest to hypervisor.

Xen — The Para-virtualization Pioneer

Xen is the most famous para-virtualized hypervisor. Guest operating systems are modified to replace privileged operations with hypercalls:

• Instead of directly modifying page tables → call Xen's MMU hypercall
• Instead of disabling interrupts → call Xen's event channel API
• Instead of direct I/O → use Xen's split driver model (frontend in guest, backend in privileged domain)

Advantages:

• Lower overhead than binary translation (no runtime code scanning)
• Fewer traps than trap-and-emulate (explicit cooperation)
• Guest can batch hypercalls for efficiency

Disadvantages:

• Requires modifying the guest OS kernel (not possible for closed-source like Windows)
• Maintenance burden — kernel modifications must be updated with each OS version

Modern Approach: Para-virtual Drivers (virtio)

Today's practical compromise: run the guest OS unmodified (full virtualization for CPU and memory) but install para-virtual drivers for I/O devices. The guest kernel is unchanged, but device drivers communicate directly with the hypervisor instead of emulating physical hardware.

virtio is the standard para-virtual I/O framework for Linux guests:

• virtio-net: High-performance virtual network card
• virtio-blk: High-performance virtual disk
• virtio-scsi: Virtual SCSI controller

Memory Virtualization

Each guest OS maintains its own page tables mapping guest-virtual to guest-physical addresses. But guest-physical addresses are not real physical addresses — the hypervisor maps them to actual host-physical addresses.

Shadow Page Tables

The hypervisor maintains a "shadow" page table that directly maps guest-virtual to host-physical. On each guest page table update, the hypervisor intercepts and updates the shadow:

Problem: Every guest page table modification requires a VM exit — extremely expensive for memory-intensive workloads.

Hardware-Assisted (Nested/Extended Page Tables)

Intel EPT and AMD NPT add a second level of hardware page tables:

The hardware walks both page tables automatically — no hypervisor intervention needed for guest page table updates. This eliminates most memory virtualization overhead, reducing VM exit frequency dramatically.

Performance improvement: Shadow page tables cause 10-30% overhead on memory-heavy workloads. EPT/NPT reduces this to 1-5%.

I/O Virtualization

I/O is the most challenging aspect of virtualization because physical devices are designed for a single OS.

Emulated Devices

The hypervisor presents virtual hardware that mimics real devices (e.g., Intel e1000 network card). Guest uses its standard driver. The hypervisor translates I/O operations to actual hardware access.

Advantage: Works with any guest OS, no special drivers needed. Disadvantage: High overhead — every I/O register read/write triggers a VM exit.

SR-IOV (Single Root I/O Virtualization)

A hardware standard that allows a single physical device to present itself as multiple independent virtual devices:

Each VM gets direct hardware access to its Virtual Function — near-native I/O performance with no hypervisor involvement in the data path.

Comparison Summary

Key Takeaways

• Full virtualization = unmodified guest; Para-virtualization = modified guest cooperates with hypervisor
• Hardware virtualization (VT-x/AMD-V) made full virtualization practical and fast
• EPT/NPT solved memory virtualization overhead without shadow page tables
• Modern systems use hybrid approaches: hardware-assisted CPU/memory + para-virtual I/O (virtio)
• SR-IOV provides near-native I/O by giving VMs direct device access
• The trend is toward hardware doing more work, reducing hypervisor complexity and overhead