DuVisor: a User-level Hypervisor Through Delegated Virtualization

Abstract

Today's mainstream virtualization systems comprise of two cooperative components: a kernel-resident driver that accesses virtualization hardware and a user-level helper process that provides VM management and I/O virtualization. However, this virtualization architecture has intrinsic issues in both security (a large attack surface) and performance. While there is a long thread of work trying to minimize the kernel-resident driver by offloading functions to user mode, they face a fundamental tradeoff between security and performance: more offloading may reduce the kernel attack surface, yet increase the runtime ring crossings between the helper process and the driver, and thus more performance cost.This paper explores a new design called delegated virtualization, which completely separates the control plane (the kernel driver) from the data plane (the helper process) and thus eliminates the kernel driver from runtime intervention. The resulting user-level hypervisor, called DuVisor, can handle all VM operations without trapping into the kernel once the kernel driver has done the initialization. DuVisor retrofits existing hardware virtualization support with a new delegated virtualization extension to directly handle VM exits, configure virtualization registers, manage the stage-2 page table and virtual devices in user mode. We have implemented the hardware extension on an open-source RISC-V CPU and built a Rust-based hypervisor atop the hardware. Evaluation on FireSim shows that DuVisor outperforms KVM by up to 47.96% in a variety of real-world applications and significantly reduces the attack surface.

RISC-V Instruction Set Architecture Extensions: A Survey

“…These new hardware features promote the research of virtualization security. Chen et al [50] proposed delegated virtualization and developed the user-level hypervisor DuVisor on RISC-V. Depicted in Figure 10, DV-Ext is a custom delegated virtualization extension that contains a set of additional registers and corresponding instructions. DuVisor can use the hardware features provided by DV-Ext to directly handle VM operations in user mode without trapping into the kernel, reducing virtualization overhead.…”

“…In addition to the enclave, trusted VM for RISC-V is also a potential research direction recently. Traditional trusted VMs have the problem of tight coupling between hardware virtualization and kernel mode, such as relying on the kernel to drive hardware extensions [50]. This problem creates an unnecessary performance-security tradeoff.…”