In this lesson, you will learn how the hypervisor abstracts physical hardware to provide the guest kernel with a consistent, isolated view of system resources.
The Illusion of Bare Metal
When a guest kernel boots inside a virtual machine, it behaves as if it has direct control over hardware. However, it is actually running in a restricted mode. The hypervisor—using technologies like KVM (Kernel-based Virtual Machine)—acts as a traffic controller. When the guest kernel attempts to execute a "privileged" instruction (like modifying a page table or communicating with an I/O device), the CPU triggers a "VM exit." This pauses the guest, passes control to the host kernel (the hypervisor), and allows the host to decide how to emulate that request safely.
Presenting Virtual Hardware
To the guest kernel, the hardware appears standard, even if the underlying physical reality is different. This is achieved through emulation or paravirtualization.
For example, when a guest kernel wants to send data to a disk, it doesn't talk to a physical NVMe drive. Instead, it writes to a memory region designated for a virtual device driver (like virtio). The hypervisor monitors these memory regions.
// Conceptual view of a hypervisor intercepting a guest I/O instruction
while (vm_running) {
exit_reason = kvm_run(vcpu);
if (exit_reason == EXIT_REASON_IO_INSTRUCTION) {
// Emulate the hardware response for the guest
handle_virtual_disk_read(vcpu);
}
}
The hypervisor maps these requests to physical resources—such as a file on the host's filesystem representing the guest's virtual disk. By trapping these operations, the hypervisor ensures that one guest cannot access the memory or I/O ports belonging to another guest or the host itself. This creates a sandbox where the guest kernel manages its own "virtual" environment, completely unaware that it is sharing the physical CPU and RAM with other isolated guests.
Key Takeaway: Virtualization is the art of trapping privileged guest operations and emulating their hardware side-effects, allowing multiple kernels to share physical hardware without violating each other's security boundaries.