Virtualization & Containers

binary translation

Binary translation is the clever trick that let people virtualize the old x86 even though its hardware did not cooperate with trap-and-emulate. Recall the problem: a few sensitive x86 instructions did the wrong thing silently instead of trapping, so the hypervisor never got a chance to intervene. The fix is to not trust those instructions to behave — instead, scan the guest's machine code just before it runs and rewrite the dangerous instructions into safe ones that call into the hypervisor. It is like a careful proof-reader who reads each page of a script just before the actor performs it and quietly swaps out any line that would cause a real explosion for a faked one.

Concretely, the hypervisor does this dynamically and only where needed. The guest's ordinary user-mode code is left alone and runs directly at full speed. But the guest's kernel code is examined block by block as it is about to execute: harmless instructions are copied through unchanged, while each problematic instruction is translated into an equivalent sequence that traps or jumps into the hypervisor so the right virtual behaviour happens. The translated blocks are cached, so a hot loop is translated once and then reused. This approach requires no changes to the guest operating system at all, which is why it is called full virtualization — an unmodified OS runs as-is.

Binary translation was the technology that made x86 virtualization commercially real (VMware pioneered it) years before CPUs added hardware help. Its honest cost is the work of translating and the indirection it adds, especially for kernel-heavy or I/O-heavy workloads. Once Intel VT-x and AMD-V arrived, hardware-assisted virtualization let the hypervisor lean on the CPU instead, and binary translation faded from the fast path — but it remains a landmark technique and is still used where hardware support is missing.

As a guest kernel is about to run a block of code containing a sensitive instruction that would silently misbehave, the hypervisor rewrites that one instruction into a call into itself, leaves the rest of the block untouched, caches the result, and then runs the patched block. Next time the same code runs, the cached translation is reused with no re-scanning.

The hypervisor rewrites dangerous guest instructions on the fly, then caches the result.

Binary translation gives full virtualization (the guest OS is unmodified), which contrasts with paravirtualization, where the guest is deliberately changed to cooperate. Both were answers to the same x86 problem; hardware-assisted virtualization later made both far less necessary for CPU work.

Also called
full virtualization via binary translation全虛擬化