HyperFresh: Live refresh of hypervisors using nested

Bugs in hypervisors are becoming common as hypervisors grow in size and complexity. Latent bugs, such as memory leaks, can lead to hypervisor failures resulting in complete loss of all its virtual machines (or guests). However, reliable operation of hypervisors, even in the presence of bugs, is critical in cloud platforms. A hypervisor can be regularly restarted, with or without updates, to reset its state, preempt unexpected failures, and extend its operational uptime. However, a hypervisor restart and update is highly disruptive to guests, which must be either migrated to another host, or shut down. We propose HyperFresh, a fast and guest-transparent approach to replace an old, and possibly unstable, hypervisor with a fresh one beneath live unmodified guests. Using nested virtualization, a thin hyperplexor layer runs the hypervisor and its guests. To prepare for refresh, all guest memory is co-mapped in advance to a fresh co-resident hypervisor. When the refresh operation is triggered, the hyperplexor simply switches control of the guest VCPUs and I/O state to the new hypervisor. Our HyperFresh prototype on the KVM/QEMU platform yields switching times of around 100ms with low performance impact on guest workload.