a hypervisor
/ HY-per-vy-zor /
A hypervisor is the program that creates virtual machines and acts as referee between them and the real hardware. If a virtual machine is like a tenant who believes they have a whole apartment, the hypervisor is the building manager who actually owns the building, hands each tenant a key to a slice of it, and makes sure one tenant can never walk into another's flat or tamper with the wiring. It is sometimes called the virtual machine monitor (VMM), and the two names mean the same thing.
Mechanically, the hypervisor runs at the highest privilege level and the guests run below it. It gives each VM a virtual CPU, decides which VM gets to use the real CPU and when (scheduling), maps each guest's memory onto real frames, and pretends to be the guest's disks and network. The crucial part is interception: whenever a guest executes a sensitive instruction that could affect the shared machine — touching control registers, doing I/O, changing memory mappings — control traps into the hypervisor, which checks it, performs the safe equivalent, and resumes the guest. Ordinary, harmless instructions are allowed to run directly on the real CPU at full speed, which is why virtualization can be fast.
Hypervisors come in two families. A type 1 (bare-metal) hypervisor runs directly on the hardware with no host OS beneath it (Xen, VMware ESXi, Microsoft Hyper-V), which is the data-centre and cloud workhorse. A type 2 (hosted) hypervisor runs as an ordinary application on top of a normal operating system (VirtualBox, VMware Workstation), which is convenient on a personal computer. Either way, the hypervisor is the trusted layer that everything depends on — so a bug in it is serious, because it can break the isolation between all the VMs it hosts.
On a cloud server, the hypervisor is running eight customer VMs. VM number 3 tries to write directly to the disk controller's registers. Instead of letting it touch the real hardware, the hypervisor traps the attempt, writes the data into the file that backs VM 3's virtual disk, reports success, and lets VM 3 carry on — the other seven VMs never even notice.
The hypervisor intercepts a privileged action and quietly does the safe thing instead.
The hypervisor is the trusted computing base for every VM it runs: its isolation is only as good as its own code. This is why a hypervisor escape — a guest breaking out into the hypervisor or another guest — is treated as one of the most serious bugs in cloud security.