[Paper Review] DuVisor: a User-level Hypervisor Through Delegated Virtualization

Jiahao Chen, Dingji Li+5 more|arXiv (Cornell University)|Jan 24, 2022

Security and Verification in Computing4 citations

TL;DR

DuVisor introduces a user-level hypervisor that eliminates kernel runtime intervention in virtualization by leveraging a novel hardware extension called Delegated Virtualization Extension (DV-Ext). By delegating all VM management—VM exits, register configuration, stage-2 page tables, and virtual devices—to user space, DuVisor achieves up to 47.96% better performance than KVM while significantly reducing the attack surface.

ABSTRACT

Today's mainstream virtualization systems comprise of two cooperative components: a kernel-resident driver that accesses virtualization hardware and a user-level helper process that provides VM management and I/O virtualization. However, this virtualization architecture has intrinsic issues in both security (a large attack surface) and performance. While there is a long thread of work trying to minimize the kernel-resident driver by offloading functions to user mode, they face a fundamental tradeoff between security and performance: more offloading may reduce the kernel attack surface, yet increase the runtime ring crossings between the helper process and the driver, and thus more performance cost. This paper explores a new design called delegated virtualization, which completely separates the control plane (the kernel driver) from the data plane (the helper process) and thus eliminates the kernel driver from runtime intervention. The resulting user-level hypervisor, called DuVisor, can handle all VM operations without trapping into the kernel once the kernel driver has done the initialization. DuVisor retrofits existing hardware virtualization support with a new delegated virtualization extension to directly handle VM exits, configure virtualization registers, manage the stage-2 page table and virtual devices in user mode. We have implemented the hardware extension on an open-source RISC-V CPU and built a Rust-based hypervisor atop the hardware. Evaluation on FireSim shows that DuVisor outperforms KVM by up to 47.96\% in a variety of real-world applications and significantly reduces the attack surface.

Motivation & Objective

• To address the fundamental security-performance tradeoff in traditional hypervisors, where minimizing kernel components increases ring crossings and performance cost.
• To eliminate the kernel driver’s runtime involvement in virtualization, reducing the Trusted Computing Base (TCB) and attack surface.
• To enable full virtualization control in user space by retrofitting existing hardware with a new hardware extension (DV-Ext).
• To demonstrate that user-level hypervisors can achieve high performance and strong isolation without relying on kernel-mode components for VM operation.
• To validate the feasibility and performance benefits of a fully user-space hypervisor using a RISC-V-based prototype and FireSim evaluation.

Proposed method

• Designing and implementing a Delegated Virtualization Extension (DV-Ext) that reuses existing virtualization hardware with minimal modifications to enable user-mode handling of VM exits and virtualization state.
• Retrofitting an open-source RISC-V CPU with DV-Ext to expose hardware virtualization interfaces directly to user space.
• Building a Rust-based user-level hypervisor (DuVisor) that manages all VM operations—including stage-2 page table management, virtual device I/O, and register configuration—without trapping into kernel mode.
• Using user-level interrupts and physical memory protection (PMP) to securely isolate and control virtualized resources from user space.
• Minimizing system calls and world switches by eliminating the need for kernel involvement in VM exit processing and resource management.
• Leveraging existing hardware virtualization features (e.g., RISC-V SBI, stage-2 translation) while extending them to support user-mode delegation.

Experimental results

Research questions

• RQ1 Can a fully user-level hypervisor be built that eliminates runtime kernel involvement in virtualization while maintaining high performance and strong security?
• RQ2 How does delegating virtualization functions to user space affect performance compared to traditional kernel-resident drivers?
• RQ3 What hardware extensions are required to securely and efficiently delegate VM exit handling and virtualization state management to user space?
• RQ4 To what extent can the attack surface of a hypervisor be reduced by removing the kernel driver from runtime operation?
• RQ5 Can the performance of a user-level hypervisor match or exceed that of mainstream kernel-based hypervisors like KVM?

Key findings

• DuVisor outperforms KVM by up to 47.96% in a variety of real-world workloads on FireSim, demonstrating significant performance gains.
• The attack surface of the hypervisor is drastically reduced, as the kernel driver is only used for initialization and fatal fault handling, not runtime operations.
• DuVisor successfully handles all VM operations—including VM exits, register configuration, stage-2 page table management, and virtual I/O—entirely in user space.
• The system achieves high performance by eliminating costly ring crossings and world switches that occur in traditional hypervisors due to frequent kernel calls.
• The hardware extension (DV-Ext) is minimally invasive, reusing existing virtualization features while enabling secure user-mode control.
• The prototype implementation on an open-source RISC-V CPU confirms the feasibility and practicality of the delegated virtualization approach.