Hypervisor

The theory goes back to Popek and Goldberg (1974), who stated three requirements for a virtual machine monitor (equivalence, resource control and efficiency) and proved that classic trap-and-emulate virtualisation works when every sensitive instruction is also privileged, so it traps when run in user mode. Classic x86 violated this: instructions such as POPF silently behave differently in ring 3 instead of trapping. VMware worked around it from 1999 with dynamic binary translation of guest kernel code, and Xen (2003) with paravirtualisation, where the modified guest kernel issues hypercalls. Intel VT-x (2005) and AMD-V (2006) then added a hardware root/non-root mode with VM entries and exits controlled by a per-vCPU structure (VMCS on Intel, VMCB on AMD). Second-level address translation (Intel EPT, AMD NPT) later removed the costly shadow page tables, and an IOMMU (VT-d, AMD-Vi) made device passthrough and SR-IOV safe.

The type 1/type 2 split comes from Goldberg's 1973 thesis. VMware ESXi, Microsoft Hyper-V and Xen are type 1; in Hyper-V and Xen a privileged partition (the root partition, dom0) runs a full OS for management and drivers, but the hypervisor sits beneath it. VirtualBox and VMware Workstation are type 2. KVM, merged into Linux 2.6.20 in 2007, turns the Linux kernel itself into the hypervisor, with QEMU in user space providing device emulation, so its classification is debated. Large clouds run lean derivatives: AWS Nitro builds on KVM and offloads networking and storage to dedicated cards, and Firecracker is a minimal Rust VMM for microVMs.

The attack surface is concentrated in emulated devices and the management plane. VENOM (CVE-2015-3456), a buffer overflow in QEMU's virtual floppy controller, allowed escape from guest to host, and VM-escape chains against VMware and virtio devices recur at Pwn2Own. Cross-tenant side channels such as L1 Terminal Fault (2018) forced mitigations like flushing L1 on VM entry and disabling or constraining SMT. Ransomware groups increasingly skip the guests and target ESXi hosts directly, encrypting VM disk files on the datastore, as in the ESXiArgs campaign of 2023.

NIST SP 800-125 (2011) and SP 800-125A Rev. 1 recommend a minimal hypervisor footprint, prompt patching, a management network isolated from guest traffic and strict control of administrative access; in practice hypervisor administrators must be treated as highest-tier admins, since they can read every guest's memory and disks. A hypervisor differs from a container runtime, where all containers share one host kernel; sandboxed runtimes such as Kata Containers and gVisor blur that boundary.