Гипервизор: виртуализация и виртуальные машины.

Piece of software or hardware that creates and runs virtual machines

A hypervisor, also known as a virtual machine monitor (VMM) or virtualizer, is a type of computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called a host machine, and each virtual machine is called a guest machine. The hypervisor presents the guest operating systems with a virtual operating platform and manages the execution of the guest operating systems. Unlike an emulator, the guest executes most instructions on the native hardware. Multiple instances of a variety of operating systems may share the virtualized hardware resources: for example, Linux, Windows, and macOS instances can all run on a single physical x86 machine. This contrasts with operating system–level virtualization, where all instances (usually called containers) must share a single kernel, though the guest operating systems can differ in user space, such as different Linux distributions with the same kernel. The term hypervisor is a variant of supervisor, a traditional term for the kernel of an operating system: the hypervisor is the supervisor of the supervisors, with hyper used as a stronger variant of super The term dates to circa 1970; IBM coined it for the 360/65 and later used it for the DIAG handler of CP 67. In the earlier CP/CMS (1967) system, the term Control Program was used instead.

The first hypervisors providing full virtualization were the test tool SIMMON and the one off IBM CP 40 research system, which began production use in January 1967 and became the first version of the IBM CP/CMS operating system. CP 40 ran on a S/360 40 modified at the Cambridge Scientific Center to support dynamic address translation, a feature that enabled virtualization. Prior to this time, computer hardware had only been virtualized to the extent to allow multiple user applications to run concurrently, such as in CTSS and IBM M44/44X. With CP 40, the hardware's supervisor state was virtualized as well, allowing multiple operating systems to run concurrently in separate virtual machine contexts. Programmers soon implemented CP 40 (as CP 67) for the IBM System/360 67, the first production computer system capable of full virtualization. IBM shipped this machine in 1966; it included page translation table hardware for virtual memory and other techniques that allowed a full virtualization of all kernel tasks, including I/O and interrupt handling. (Note that the "official" operating system, the ill fated TSS/360, did not employ full virtualization.) Both CP 40 and CP 67 began production use in 1967. CP/CMS was available to IBM customers from 1968 to early 1970s, in source code form without support. CP/CMS formed part of IBM's attempt to build robust time sharing systems for its mainframe computers. By running multiple operating systems concurrently, the hypervisor increased system robustness and stability: Even if one operating system crashed, the others would continue working without interruption. Indeed, this even allowed beta or experimental versions of operating systemsor even of new hardwareto be deployed and debugged, without jeopardizing the stable main production system, and without requiring costly additional development systems. IBM announced its System/370 series in 1970 without the virtual memory feature needed for virtualization, but added it in the August 1972 Advanced Function announcement. Virtualization has been featured in all successor systems, such that all modern day IBM mainframes, including the zSeries line, retain backward compatibility with the 1960s era IBM S/360 line. The 1972 announcement also included VM/370, a reimplementation of CP/CMS for the S/370. Unlike CP/CMS, IBM provided support for this version (though it was still distributed in source code form for several releases). VM stands for Virtual Machine, emphasizing that all, not just some, of the hardware interfaces are virtualized. Both VM and CP/CMS enjoyed early acceptance and rapid development by universities, corporate users, and time sharing vendors, as well as within IBM. Users played an active role in ongoing development, anticipating trends seen in modern open source projects. However, in a series of disputed and bitter battles, time sharing lost out to batch processing through IBM political infighting, and VM remained IBM's "other" mainframe operating system for decades, losing to MVS. It enjoyed a resurgence of popularity and support from 2000 as the z/VM product, for example as the platform for Linux on IBM Z. As mentioned above, the VM control program includes a hypervisor call handler that intercepts DIAG ("Diagnose", opcode x'83') instructions used within a virtual machine. This provides fast path non virtualized execution of file system access and other operations (DIAG is a model dependent privileged instruction, not used in normal programming, and thus is not virtualized. It is therefore available for use as a signal to the "host" operating system). When first implemented in CP/CMS release 3.1, this use of DIAG provided an operating system interface that was analogous to the System/360 Supervisor Call instruction (SVC), but that did not require altering or extending the system's virtualization of SVC. In 1985 IBM introduced the PR/SM hypervisor to manage logical partitions (LPAR).

X86 virtualization was introduced in the 1990s, with its emulation being included in Bochs. Intel and AMD released their first x86 processors with hardware virtualisation in 2005 with Intel VT x (code named Vanderpool) and AMD V (code named Pacifica). An alternative approach requires modifying the guest operating system to make a system call to the underlying hypervisor, rather than executing machine I/O instructions that the hypervisor simulates. This is called paravirtualization in Xen, a "hypercall" in Parallels Workstation, and a "DIAGNOSE code" in IBM VM. Some microkernels, such as Mach and L4, are flexible enough to allow paravirtualization of guest operating systems.

Embedded hypervisors, targeting embedded systems and certain real time operating system (RTOS) environments, are designed with different requirements when compared to desktop and enterprise systems, including robustness, security and real time capabilities. The resource constrained nature of many embedded systems, especially battery powered mobile systems, imposes a further requirement for small memory size and low overhead. Finally, in contrast to the ubiquity of the x86 architecture in the PC world, the embedded world uses a wider variety of architectures and less standardized environments. Support for virtualization requires memory protection (in the form of a memory management unit or at least a memory protection unit) and a distinction between user mode and privileged mode, which rules out most microcontrollers. This still leaves x86, MIPS, ARM and PowerPC as widely deployed architectures on medium to high end embedded systems. As manufacturers of embedded systems usually have the source code to their operating systems, they have less need for full virtualization in this space. Instead, the performance advantages of paravirtualization make this usually the virtualization technology of choice. Nevertheless, ARM and MIPS have recently added full virtualization support as an IP option and has included it in their latest high end processors and architecture versions, such as ARM Cortex A15 MPCore and ARMv8 EL2. Other differences between virtualization in server/desktop and embedded environments include requirements for efficient sharing of resources across virtual machines, high bandwidth, low latency inter VM communication, a global view of scheduling and power management, and fine grained control of information flows.

The use of hypervisor technology by malware and rootkits installing themselves as a hypervisor below the operating system, known as hyperjacking, can make them more difficult to detect because the malware could intercept any operations of the operating system (such as someone entering a password) without the anti malware software necessarily detecting it (since the malware runs below the entire operating system). Implementation of the concept has allegedly occurred in the SubVirt laboratory rootkit (developed jointly by Microsoft and University of Michigan researchers) as well as in the Blue Pill malware package. However, such assertions have been disputed by others who claim that it would be possible to detect the presence of a hypervisor based rootkit. In 2009, researchers from Microsoft and North Carolina State University demonstrated a hypervisor layer anti rootkit called Hooksafe that can provide generic protection against kernel mode rootkits.