{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/hypervisor","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/hypervisor/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/hypervisor/"},"term":{"en":"Hypervisor","da":"Hypervisor"},"aka":{"en":["virtual machine monitor","VMM"],"da":["VMM"]},"domain":["platform"],"cluster":"cloud","layer":"infrastructure","status":"current","era":1967,"summary":{"en":"The layer of software that splits one physical computer into several virtual machines and keeps them apart.","da":"Det lag software, der deler én fysisk computer op i flere virtuelle maskiner og holder dem adskilt."},"body":{"formal":{"en":"Software that creates and runs virtual machines, handing each a share of the real processor, memory and devices while stopping one from reading or changing another; a type 1 hypervisor runs straight on the hardware, a type 2 on top of an operating system.","da":"Software, der skaber og kører virtuelle maskiner, giver hver en del af den rigtige processor, hukommelse og enheder og forhindrer, at én maskine kan læse eller ændre en anden; en type 1-hypervisor kører direkte på hardwaren, en type 2 oven på et styresystem."},"plain":{"en":"Like the caretaker of an apartment block who divides up the space, water and heat between the flats and makes sure no tenant can walk into a neighbour's home.","da":"Som viceværten i en ejendom, der fordeler plads, vand og varme mellem lejlighederne og sørger for, at ingen lejer kan gå ind hos naboen."},"inPractice":{"en":"A hospital region runs two hundred virtual machines on a handful of servers; when a flaw in the hypervisor is announced, the IT operations manager moves machines aside and patches every host within the week.","da":"En region kører to hundrede virtuelle maskiner på en håndfuld servere; når der offentliggøres en fejl i hypervisoren, flytter den IT-driftsansvarlige maskinerne til side og patcher alle værter inden for ugen."},"whyItMatters":{"en":"Every virtual machine on a host depends on it to stay separate, so a single hole in the hypervisor can hand an attacker all of them at once.","da":"Alle virtuelle maskiner på en vært er afhængige af den for at holde sig adskilt, så ét hul i hypervisoren kan give en angriber adgang til dem alle på én gang."}},"deepDive":{"en":"The theory goes back to Popek and Goldberg (1974), who stated three requirements for a virtual machine monitor (equivalence, resource control and efficiency) and proved that classic trap-and-emulate virtualisation works when every sensitive instruction is also privileged, so it traps when run in user mode. Classic x86 violated this: instructions such as POPF silently behave differently in ring 3 instead of trapping. VMware worked around it from 1999 with dynamic binary translation of guest kernel code, and Xen (2003) with paravirtualisation, where the modified guest kernel issues hypercalls. Intel VT-x (2005) and AMD-V (2006) then added a hardware root/non-root mode with VM entries and exits controlled by a per-vCPU structure (VMCS on Intel, VMCB on AMD). Second-level address translation (Intel EPT, AMD NPT) later removed the costly shadow page tables, and an IOMMU (VT-d, AMD-Vi) made device passthrough and SR-IOV safe.\n\nThe type 1/type 2 split comes from Goldberg's 1973 thesis. VMware ESXi, Microsoft Hyper-V and Xen are type 1; in Hyper-V and Xen a privileged partition (the root partition, dom0) runs a full OS for management and drivers, but the hypervisor sits beneath it. VirtualBox and VMware Workstation are type 2. KVM, merged into Linux 2.6.20 in 2007, turns the Linux kernel itself into the hypervisor, with QEMU in user space providing device emulation, so its classification is debated. Large clouds run lean derivatives: AWS Nitro builds on KVM and offloads networking and storage to dedicated cards, and Firecracker is a minimal Rust VMM for microVMs.\n\nThe attack surface is concentrated in emulated devices and the management plane. VENOM (CVE-2015-3456), a buffer overflow in QEMU's virtual floppy controller, allowed escape from guest to host, and VM-escape chains against VMware and virtio devices recur at Pwn2Own. Cross-tenant side channels such as L1 Terminal Fault (2018) forced mitigations like flushing L1 on VM entry and disabling or constraining SMT. Ransomware groups increasingly skip the guests and target ESXi hosts directly, encrypting VM disk files on the datastore, as in the ESXiArgs campaign of 2023.\n\nNIST SP 800-125 (2011) and SP 800-125A Rev. 1 recommend a minimal hypervisor footprint, prompt patching, a management network isolated from guest traffic and strict control of administrative access; in practice hypervisor administrators must be treated as highest-tier admins, since they can read every guest's memory and disks. A hypervisor differs from a container runtime, where all containers share one host kernel; sandboxed runtimes such as Kata Containers and gVisor blur that boundary.","da":"Teorien går tilbage til Popek og Goldberg (1974), der opstillede tre krav til en virtual machine monitor (ækvivalens, ressourcekontrol og effektivitet) og viste, at klassisk trap-and-emulate-virtualisering virker, når alle følsomme instruktioner også er privilegerede, så de udløser en trap i brugertilstand. Klassisk x86 opfyldte ikke dette: instruktioner som POPF opfører sig i stilhed anderledes i ring 3 i stedet for at trappe. VMware omgik problemet fra 1999 med dynamisk binær oversættelse af gæstens kernekode og Xen (2003) med paravirtualisering, hvor den tilpassede gæstekerne kalder hypervisoren via hypercalls. Intel VT-x (2005) og AMD-V (2006) tilføjede derefter en root/non-root-tilstand i hardwaren med VM entries og exits styret af en struktur pr. vCPU (VMCS hos Intel, VMCB hos AMD). Second-level address translation (Intel EPT, AMD NPT) fjernede siden de dyre shadow page tables, og en IOMMU (VT-d, AMD-Vi) gjorde passthrough af enheder og SR-IOV sikkert.\n\nOpdelingen i type 1 og type 2 stammer fra Goldbergs afhandling fra 1973. VMware ESXi, Microsoft Hyper-V og Xen er type 1; i Hyper-V og Xen kører en privilegeret partition (root-partitionen, dom0) et fuldt styresystem til administration og drivere, men hypervisoren ligger under den. VirtualBox og VMware Workstation er type 2. KVM, der kom ind i Linux 2.6.20 i 2007, gør selve Linux-kernen til hypervisor, mens QEMU i brugerrummet emulerer enhederne, så klassificeringen er omdiskuteret. De store clouds kører slanke afledninger: AWS Nitro bygger på KVM og flytter netværk og lager ud på dedikerede kort, og Firecracker er en minimal VMM skrevet i Rust til microVM'er.\n\nAngrebsfladen er koncentreret i de emulerede enheder og i administrationslaget. VENOM (CVE-2015-3456), et bufferoverløb i QEMU's virtuelle diskettecontroller, gjorde det muligt at bryde ud fra gæst til vært, og kæder af VM escapes mod VMware og virtio-enheder dukker jævnligt op ved Pwn2Own. Sidekanaler mellem kunder som L1 Terminal Fault (2018) tvang afhjælpninger som tømning af L1-cachen ved VM entry og deaktivering eller begrænsning af SMT. Ransomwaregrupper springer i stigende grad gæsterne over og angriber ESXi-værterne direkte ved at kryptere de virtuelle maskiners diskfiler på datastoren, som i ESXiArgs-kampagnen i 2023.\n\nNIST SP 800-125 (2011) og SP 800-125A Rev. 1 anbefaler en minimal hypervisor, hurtig patching, et administrationsnetværk adskilt fra gæsternes trafik og stram kontrol med administrativ adgang; i praksis skal hypervisor-administratorer behandles som administratorer på højeste niveau, fordi de kan læse alle gæsters hukommelse og diske. En hypervisor adskiller sig fra en container-runtime, hvor alle containere deler én værtskerne; sandboxede runtimes som Kata Containers og gVisor udvisker den grænse."},"edges":[{"type":"used-with","to":"platform/iaas","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/operating-system","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"NIST SP 800-125 - Guide to Security for Full Virtualization Technologies","tier":"standard","publisher":"NIST"}],"draft":true}