I am familiar with the dynamic translation and the trap-and-emulate (Type1 Hypervisor) concepts. What makes me confused is that many articles usually combine dynamic translation and type 1 hypervisor, like the following the figure.
In my opinion, when using dynamic translation (e.g., qemu), we usually emulate a set of fake CPU registers and update them based on guest instructions, which means the emulated code usually has the same privilege mode as the hypervisor. But for type 1 hypervisor, they should be in different privileged modes.
Therefore, I wonder before Intel-VT/AMD-SVM (hardware-assisted virtualization) shows up, does legacy x86 support type 1 hypervisor? If yes, how does it emulate sensitive instructions that failed to raise traps across different privileges?
Does legacy x86 support type 1 hypervisor?
Yes, it does.
If yes, how does it emulate sensitive instructions that failed to raise traps across different privileges?
By using binary translation: the sensitive instructions are replaced with other instructions that emulate the behavior of the sensitive instructions properly.