Virtualization

• It creates a software abstraction over physical hardware so multiple isolated OSes or processes can share the same machine
• The physical machine is the host; each virtual machine is a guest

Hypervisor

• aka Virtual Machine Monitor (VMM)
• It sits between hardware and guests, allocating CPU, memory, and devices
• guest OS communicates with the hypervisor via hypercalls
  • analogous to how a user-space app communicates with the OS via system calls
  • system call: user app —> kernel
  • hypercall: guest OS —> hypervisor
• Type 1 (Bare-metal): runs directly on hardware, beneath any OS
  • lower overhead, production-grade
  • Examples:
    • Hyper-V, KVM (desktop/dev)
    • VMware ESXi, Xen (server/enterprise)
• Type 2 (Hosted): runs as an app on top of a host OS; has its own built-in virtualization engine
  • easier to set up, slightly more overhead
  • Examples:
    • VirtualBox
    • VMware Workstation
    • Parallels Desktop
  • Note: GUI tools like Virt-Manager or UTM are not Type-2; they have no engine of their own and just wrap an underlying hypervisor (KVM, QEMU)

flowchart TD
    G1[Guest OS 1] & G2[Guest OS 2] --> H[Hypervisor / VMM]
    H --> HOS[Host OS]
    HOS --> HW[Physical Hardware]

Virtualization Techniques

• Full Virtualization: guest runs the same CPU arch as host; instructions execute directly on hardware
  • requires hardware virtualization support: Intel VT-x, AMD-V, Apple Silicon HVF
  • near-native performance
• Paravirtualization: guest OS is modified to call the hypervisor directly (hypercalls) instead of emulating hardware
  • no special hardware needed
  • example: virtio drivers (paravirtualized disk/network drivers used in KVM VMs)
• Binary Translation: translates guest ISA to host ISA ahead-of-time or at runtime
  • examples: Rosetta 2, QEMU TCG (Tiny Code Generator)
• Emulation: guest runs a different CPU arch; every instruction is interpreted in software
  • 10–100x slower than native
  • can run any arch on any host
  • example: QEMU without KVM

Technique	HW Support Needed?	Performance
Full Virtualization	Yes (Intel VT-x / AMD-V / Apple HVF)	Near-native
Paravirtualization	No	Good
Binary Translation	No	Moderate
Emulation	No	Slow

QEMU

• open-source machine emulator and virtualizer; not a hypervisor itself
• two modes depending on whether a hardware accelerator is available:
  • emulation mode (QEMU + TCG): translates guest CPU instructions in software; slow but can run any arch on any host
  • virtualization mode (QEMU + accelerator): QEMU handles device emulation; CPU/memory handed off to the accelerator for near-native speed
• accelerator varies by platform:
  • Linux: KVM
  • macOS: HVF (Hypervisor.framework)
  • Windows: WHPX (Windows Hypervisor Platform)

Virtual Devices

• Hypervisor presents virtual devices to the guest OS instead of exposing physical hardware directly
• Types:
  • Emulated: mimics a real hardware device; guest uses an unmodified driver; slower
    • examples: Intel E1000 NIC, IDE controller
  • Paravirtualized: guest uses a special driver that knows it’s in a VM; communicates directly with hypervisor; faster
    • example: virtio drivers (disk, network, display)

Virtual Networking Modes

• NAT: VM shares the host’s IP; host does address translation
  • simplest setup; VM cannot be reached from outside the host
  • Port Forwarding: rule that maps a host port to a VM port so the host (or outside) can reach a service inside the VM
    • example: host:8080 —> vm:80 to access a web server running in the VM
• Bridged: VM gets its own IP on the same network as the host
  • visible to other machines on the network
• Host-only: VM can only communicate with the host; isolated from outside

Virtual Disk Formats

Format	Used By	Notes
qcow2	QEMU / KVM	supports snapshots, copy-on-write, compression
vmdk	VMware	widely compatible across VMware tools
vhd / vhdx	Hyper-V	vhdx supports larger disks and better performance
vdi	VirtualBox	VirtualBox native format

Guest Additions / Integration Services

• drivers and tools installed inside the guest OS to improve VM usability
• names vary by hypervisor:
  • VirtualBox: Guest Additions
  • VMware: VMware Tools
  • Hyper-V: Integration Services (built into modern Windows/Linux guests)
  • KVM/QEMU:
    • qemu-guest-agent: host-guest communication (graceful shutdown, file transfer, guest info)
    • spice-vdagent: clipboard sync and display auto-resize when using SPICE display protocol
    • virtio drivers: paravirtualized disk/network/display
      • already built into the Linux kernel
      • Windows guests need the VirtIO Windows Drivers package
      • https://github.com/virtio-win/virtio-win-pkg-scripts
    • virtio-fs: paravirtualized shared folders between host and guest (replaces older 9p protocol)
  • Apple Virtualization.framework: no separate additions needed; virtio drivers built into Linux kernel handle everything; shared folders via virtio-fs
• features they unlock:
  • shared clipboard between host and guest
  • drag-and-drop file transfer
  • shared folders (mount a host directory inside the guest)
  • better display resolution and auto-resize
  • improved mouse integration (no more captured cursor)

Virtual CD/DVD (ISO Mounting)

• attach an .iso file as a virtual optical drive inside the VM
• primary use case: installing an OS by booting the VM from an ISO image
• can be attached/detached at runtime without rebooting

Virtual Display

• controls how the VM’s screen is rendered
• types:
  • basic emulated (VGA): always works, low performance
  • paravirtualized (virtio-gpu, QXL): better performance, requires guest driver
  • 3D accelerated: unlocked by Guest Additions / VMware Tools; needed for GPU-intensive workloads
• SPICE (Simple Protocol for Independent Computing Environments): remote display protocol designed for VMs
  • developed by Red Hat; default display protocol in Virt-Manager/KVM
  • supports audio, clipboard sync, USB redirection, and multi-monitor out of the box
  • spice-vdagent installed in the guest enables clipboard sync and display auto-resize
  • use virt-viewer as the SPICE client to connect to a remote VM

Hypervisor	Display Protocol	Notes
KVM / QEMU	SPICE (default), VNC (fallback)	spice-vdagent in guest for full features
Hyper-V	RDP (Enhanced Session Mode)	built into Windows
VMware	VMRC (VMware Remote Console)	VMware Tools handles local display
VirtualBox	Proprietary (via Guest Additions)	also supports RDP via Extension Pack
macOS Virtualization.framework	Metal + virtio-gpu	no separate protocol needed

Snapshots

• saves the complete state of a VM (disk + memory) at a point in time
• can roll back to a snapshot if something goes wrong
• use case: take a snapshot before installing untrusted software or making risky changes
• stored as a delta on top of the base disk image (copy-on-write); doesn’t duplicate the full disk

Windows Virtualization

• Hyper-V: Type-1 hypervisor built into Windows; several features are built on top:
  • WSL 2: runs a real Linux kernel inside a lightweight Hyper-V VM
    • Microsoft’s own custom-compiled build with WSL-specific patches (not a stock distro kernel)
    • https://github.com/microsoft/WSL2-Linux-Kernel
    • gives full Linux compatibility on Windows
    • Docker Desktop uses it as its backend
  • Windows Sandbox: disposable isolated Windows desktop for running untrusted executables
    • runs a lightweight Hyper-V VM using the host’s own Windows binaries (copy-on-write, no separate license needed)
    • all changes are discarded on close
  • VBS (Virtualization-Based Security): uses Hyper-V to isolate a protected memory region (Virtual Secure Mode) from the main OS
    • even a compromised Windows kernel cannot access this region
    • use case: credentials and secrets stored in VSM stay safe even if the OS is breached
• Hyper-V Manager: built-in GUI for creating and managing Hyper-V VMs on Windows
• VirtualBox: Type-2 hypervisor, free and open-source
• VMware Workstation Pro: Type-2 hypervisor, free for personal use

Linux Virtualization

• KVM (Kernel-based Virtual Machine): turns Linux into a Type-1 hypervisor via loadable kernel modules
  • two modules load together on x86:
    • kvm.ko: core KVM module (architecture-independent)
    • kvm-intel.ko or kvm-amd.ko: CPU-specific module (interfaces with VT-x or AMD-V)
  • on ARM64 (Apple Silicon running Linux): only kvm.ko is needed; ARM virtualization (EL2) is handled inside it directly
  • once loaded, exposes /dev/kvm: a character device that QEMU talks to via ioctl() calls
  • each VM runs as a regular Linux process
• KVM and QEMU work as a pair
  • KVM handles CPU and memory
  • QEMU handles device emulation (disks, network, USB)
• Virt-Manager: desktop GUI for creating and managing KVM/QEMU VMs on Linux

macOS Virtualization

• macOS has no traditional Type-1 hypervisor; Hypervisor.framework is a user-space API that lets apps access the CPU’s hardware virtualization extensions directly
• Hypervisor.framework (HVF): low-level API for direct CPU virtualization and guest memory access
  • used by Parallels, VMware Fusion, QEMU
• Virtualization.framework: high-level API built on top of HVF
  • handles VM lifecycle, virtio devices (disk, network, display)
  • used by OrbStack, Lima, Docker Desktop
• On Apple Silicon: ARM VMs run at near-native speed; x86 VMs require emulation and are significantly slower
  • x86 apps —> handled by Rosetta 2 (binary translation, near-native, transparent)
  • x86 VMs —> emulated by QEMU (slow; entire machine is emulated in software)
  • x86 containers (Docker) —> Docker runs an ARM64 Linux VM, then uses Rosetta inside it to translate x86 container images

Tool	Built On	Notes
Parallels Desktop	Hypervisor.framework	Best Windows-on-Mac UX, paid
VMware Fusion	Hypervisor.framework	Free for personal use
UTM	QEMU + Hypervisor.framework	Free, open-source; emulates any arch
OrbStack	Virtualization.framework	Fast Linux VMs + containers on Mac
Lima	Virtualization.framework	CLI-focused Linux VMs, nerdctl/Docker

VMs vs Containers

• Containers share the host OS kernel; no hypervisor or separate OS needed
• Built on Linux namespaces (isolation), cgroups (resource limits), and overlayfs (layered images)
• See Docker for details

Aspect	VM	Container
Isolation	Full OS + kernel boundary	Process-level (shared kernel)
Startup	Seconds to minutes	Milliseconds
Size	GBs	MBs
Overhead	High	Low
Security	Stronger	Weaker (gVisor/Kata close the gap)
Use case	Different OSes, strong isolation	Microservices, CI/CD

Platform Comparison

Feature	Windows	Linux	macOS
Native Hypervisor	Hyper-V	KVM	Hypervisor.framework (HVF)
Hypervisor Type	Type-1 (integrated)	Type-1 (kernel module)	User-space API
Default GUI Tool	Hyper-V Manager	Virt-Manager	None
Other GUI Tools	VirtualBox, VMware Workstation	VirtualBox, GNOME Boxes	Parallels, VMware Fusion, UTM, OrbStack