  Today's mainstream virtualization systems comprise of two cooperative
components: a kernel-resident driver that accesses virtualization hardware and
a user-level helper process that provides VM management and I/O virtualization.
However, this virtualization architecture has intrinsic issues in both security
(a large attack surface) and performance. While there is a long thread of work
trying to minimize the kernel-resident driver by offloading functions to user
mode, they face a fundamental tradeoff between security and performance: more
offloading may reduce the kernel attack surface, yet increase the runtime ring
crossings between the helper process and the driver, and thus more performance
cost.
  This paper explores a new design called delegated virtualization, which
completely separates the control plane (the kernel driver) from the data plane
(the helper process) and thus eliminates the kernel driver from runtime
intervention. The resulting user-level hypervisor, called DuVisor, can handle
all VM operations without trapping into the kernel once the kernel driver has
done the initialization. DuVisor retrofits existing hardware virtualization
support with a new delegated virtualization extension to directly handle VM
exits, configure virtualization registers, manage the stage-2 page table and
virtual devices in user mode. We have implemented the hardware extension on an
open-source RISC-V CPU and built a Rust-based hypervisor atop the hardware.
Evaluation on FireSim shows that DuVisor outperforms KVM by up to 47.96\% in a
variety of real-world applications and significantly reduces the attack
surface.
