Bridging the Semantic Gap in Virtual Machines with Host-Injected Extended Berkeley Packet Filter Code

Applications in virtual machines (VMs) rely on the guest Operating System (OS), which views only virtualized hardware, creating a semantic gap between this abstraction and the real execution managed by the hypervisor and host OS. Existing paravirtualization techniques bridge this gap through service-specific solutions, but implementing and extending these solutions can require changes to guest kernel components and host-side support, such as adding new hypercalls. We present a generic framework combining one-time paravirtualization during deployment with host-injected extended Berkeley Packet Filter (eBPF) programs, allowing different services to reuse the same guest infrastructure. After this initial setup, new services can be introduced by supplying additional eBPF programs, without modifying the shared guest infrastructure. Our prototype demonstrates how the same framework supports CPU pinning, dynamic memory expansion, and firewall offloading. In the evaluated benchmarks, these services achieve approximately 3.4-fold throughput with hyperthread-aware CPU pinning compared with execution without this mechanism and approximately 2.7-fold speedup with dynamic memory expansion compared with a fixed-memory configuration that resorts to swapping. Firewall offloading preserves legitimate traffic under a denial-of-service attack that prevents communication with guest-side filtering. These results demonstrate the framework’s applicability across different services; the contribution lies in their implementation through a common, extensible infrastructure.