  System-level virtualization introduces critical vulnerabilities to failures
of the software components that implement virtualization -- the virtualization
infrastructure (VI). To mitigate the impact of such failures, we introduce a
resilient VI (RVI) that can recover individual VI components from failure,
caused by hardware or software faults, transparently to the hosted virtual
machines (VMs). Much of the focus is on the ReHype mechanism for recovery from
hypervisor failures, that can lead to state corruption and to inconsistencies
among the states of system components. ReHype's implementation for the Xen
hypervisor was done incrementally, using fault injection results to identify
sources of critical corruption and inconsistencies. This implementation
involved 900 LOC, with memory space overhead of 2.1MB. Fault injection
campaigns, with a variety of fault types, show that ReHype can successfully
recover, in less than 750ms, from over 88% of detected hypervisor failures. In
addition to ReHype, recovery mechanisms for the other VI components are
described. The overall effectiveness of our RVI is evaluated hosting a Web
service application, on a cluster of VMs. With faults in any VI component, for
over 87% of detected failures, our recovery mechanisms allow services provided
by the application to be continuously maintained despite the resulting failures
of VI components.
