{"id":37939,"date":"2019-10-31T22:20:41","date_gmt":"2019-10-31T19:20:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obshhie-printsipy-raboty-qemu-kvm\/"},"modified":"2019-10-31T22:20:41","modified_gmt":"2019-10-31T19:20:41","slug":"obshhie-printsipy-raboty-qemu-kvm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obshhie-printsipy-raboty-qemu-kvm","title":{"rendered":"Obecn\u00e9 principy fungov\u00e1n\u00ed QEMU-KVM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Obecn\u00e9
\n
\nMoje aktu\u00e1ln\u00ed porozum\u011bn\u00ed:<\/p>\n

1) KVM<\/h2>\n

\nKVM (Kernel-based Virtual Machine) \u2013 hypervisor (VMM \u2013 Virtual Machine Manager), kter\u00fd funguje jako modul v opera\u010dn\u00edm syst\u00e9mu Linux. Hypervisor je pot\u0159ebn\u00fd k tomu, aby spou\u0161t\u011bl ur\u010dit\u00e9 software ve fiktivn\u00edm (virtu\u00e1ln\u00edm) prost\u0159ed\u00ed a p\u0159itom skr\u00fdval skute\u010dn\u00fd fyzick\u00fd hardware, na kter\u00e9m tento software b\u011b\u017e\u00ed. Hypervisor slou\u017e\u00ed jako \u201epropojka\u201c mezi fyzick\u00fdm hardwarem (hostitelem) a virtu\u00e1ln\u00edm OS (hostem).<\/p>\n

Jeliko\u017e je KVM standardn\u00edm modulem j\u00e1dra Linuxu, z\u00edsk\u00e1v\u00e1 od j\u00e1dra v\u0161echny pot\u0159ebn\u00e9 v\u00fdhody (pr\u00e1ce s pam\u011bt\u00ed, pl\u00e1nov\u00e1n\u00ed atd.). A t\u00edm p\u00e1dem v\u0161echny tyto v\u00fdhody maj\u00ed i hosty (proto\u017ee host\u00e9 b\u011b\u017e\u00ed na hypervisoru, kter\u00fd funguje na\/se j\u00e1drem OS Linux).<\/p>\n

KVM je velmi rychl\u00fd, ale s\u00e1m o sob\u011b nesta\u010d\u00ed pro spu\u0161t\u011bn\u00ed virtu\u00e1ln\u00edho OS, proto\u017ee k tomu je pot\u0159eba emulace I\/O. Pro I\/O (procesor, disky, s\u00ed\u0165, video, PCI, USB, s\u00e9riov\u00e9 porty atd.) KVM vyu\u017e\u00edv\u00e1 QEMU.
\n<\/a><\/noindex><\/p>\n

2) QEMU<\/h2>\n

\nQEMU (Quick Emulator) \u2013 emul\u00e1tor r\u016fzn\u00fdch za\u0159\u00edzen\u00ed, kter\u00fd umo\u017e\u0148uje spou\u0161t\u011bt opera\u010dn\u00ed syst\u00e9my ur\u010den\u00e9 pro jednu architekturu na jin\u00e9 (nap\u0159. ARM \u2013> x86). Krom\u011b procesoru QEMU emuluje r\u016fzn\u00e1 perifern\u00ed za\u0159\u00edzen\u00ed: s\u00ed\u0165ov\u00e9 karty, HDD, grafick\u00e9 karty, PCI, USB atd.<\/p>\n

Funguje to takto:<\/p>\n

Instrukce\/bin\u00e1rn\u00ed k\u00f3d (nap\u0159. ARM) jsou konvertov\u00e1ny na mezikod nez\u00e1visl\u00fd na platform\u011b pomoc\u00ed konvertoru TCG (Tiny Code Generator) a tento mezik\u00f3d je pot\u00e9 konvertov\u00e1n na c\u00edlov\u00e9 instrukce\/k\u00f3d (nap\u0159. x86).<\/p>\n

ARM \u2013> mezik\u00f3d \u2013> x86<\/p>\n

V podstat\u011b m\u016f\u017eete spou\u0161t\u011bt virtu\u00e1ln\u00ed stroje na QEMU na jak\u00e9mkoli hostiteli, i na star\u00fdch modelech procesor\u016f, kter\u00e9 nepodporuj\u00ed Intel VT-x (Intel Virtualization Technology) \/ AMD SVM (AMD Secure Virtual Machine). Nicm\u00e9n\u011b v takov\u00e9m p\u0159\u00edpad\u011b to bude fungovat velmi pomalu, proto\u017ee vykon\u00e1van\u00fd bin\u00e1rn\u00ed k\u00f3d je nutn\u00e9 p\u0159ekompilovat za b\u011bhu dvakr\u00e1t pomoc\u00ed TCG (TCG je Just-in-Time compiler).<\/p>\n

Tedy samotn\u00fd QEMU je velmi skv\u011bl\u00fd, ale funguje velmi pomalu.<\/p>\n

3) Ochrann\u00e1 kola<\/h2>\n

\n\"Obecn\u00e9
\n
\nBin\u00e1rn\u00ed programov\u00fd k\u00f3d na procesorech nepracuje jen tak, ale je um\u00edst\u011bn na r\u016fzn\u00fdch \u00farovn\u00edch (kruz\u00edch \/ ochrann\u00fdch krou\u017ec\u00edch) s r\u016fzn\u00fdmi \u00farovn\u011bmi p\u0159\u00edstupu k dat\u016fm, od nejprivilegovan\u011bj\u0161\u00edho (Ring 0) a\u017e po nejomezen\u011bj\u0161\u00ed, regulovan\u00e9ho a \"s uta\u017een\u00fdmi \u0161rouby\" (Ring 3).<\/p>\n

Opera\u010dn\u00ed syst\u00e9m (j\u00e1dro OS) funguje na \u00farovni Ring 0 (j\u00e1drov\u00fd re\u017eim) a m\u016f\u017ee pou\u017e\u00edvat jak\u00e1koliv data a za\u0159\u00edzen\u00ed bez omezen\u00ed. U\u017eivatelk\u00e9 aplikace b\u011b\u017e\u00ed na \u00farovni Ring 3 (u\u017eivatelsk\u00fd re\u017eim) a nemohou si d\u011blat, co cht\u011bj\u00ed; m\u00edsto toho mus\u00ed v\u017edy \u017e\u00e1dat o p\u0159\u00edstup k prov\u00e1d\u011bn\u00ed ur\u010dit\u00e9 operace (u\u017eivatelsk\u00e9 aplikace maj\u00ed p\u0159\u00edstup pouze k vlastn\u00edm dat\u016fm a nemohou \u201ezasahovat\u201c do \u201eciz\u00edho prostoru\u201c). Ring 1 a 2 jsou ur\u010deny pro ovlada\u010de.<\/p>\n

P\u0159ed vyn\u00e1lezem Intel VT-x \/ AMD SVM pracovaly hypervizory na Ring 0, zat\u00edmco host\u00e9 fungovali na Ring 1. Proto\u017ee Ring 1 nem\u00e1 dostate\u010dn\u00e1 pr\u00e1va pro norm\u00e1ln\u00ed fungov\u00e1n\u00ed OS, musel hypervizor p\u0159i ka\u017ed\u00e9m privilegovan\u00e9m vol\u00e1n\u00ed od hostitelsk\u00e9ho syst\u00e9mu upravit toto vol\u00e1n\u00ed a prov\u00e9st ho na Ring 0 (n\u011bco podobn\u00e9ho tomu, co d\u011bl\u00e1 QEMU). Tedy hostitelsk\u00fd bin\u00e1rn\u00ed k\u00f3d NE<\/i><\/b> byl prov\u00e1d\u011bn p\u0159\u00edmo na procesoru a poka\u017ed\u00e9 podl\u00e9hal n\u011bkolika mezi\u00faprav\u00e1m.<\/p>\n

N\u00e1klady byly zna\u010dn\u00e9 a to byl velk\u00fd probl\u00e9m, proto v\u00fdrobci procesor\u016f nez\u00e1visle na sob\u011b vydali roz\u0161\u00ed\u0159enou sadu instrukc\u00ed (Intel VT-x \/ AMD SVM), kter\u00e9 umo\u017enily vykon\u00e1vat k\u00f3d hostitelsk\u00fdch OS P\u0158\u00cdMO<\/i><\/b> na procesoru hostitele (bez zbyte\u010dn\u00fdch mezistup\u0148\u016f, jak tomu bylo d\u0159\u00edve).<\/p>\n

S p\u0159\u00edchodem Intel VT-x \/ AMD SVM byl vytvo\u0159en nov\u00fd speci\u00e1ln\u00ed \u00farove\u0148 Ring -1 (minus jedna). A nyn\u00ed na n\u011bm b\u011b\u017e\u00ed hypervizor, zat\u00edmco host\u00e9 jsou na Ring 0 a maj\u00ed privilegovan\u00fd p\u0159\u00edstup k CPU.<\/p>\n

Tedy v\u00fdsledkem je:<\/p>\n