My Current Understanding:
1) KVM
KVM (Kernel-based Virtual Machine) is a hypervisor (VMM – Virtual Machine Manager) that operates as a module on the Linux OS. The hypervisor is needed to run software in a non-existent (virtual) environment while concealing the actual physical hardware on which the software runs. The hypervisor acts as a 'bridge' between the physical hardware (host) and the virtual OS (guest).
Since KVM is a standard module of the Linux kernel, it receives all the necessary benefits from the kernel (memory management, scheduler, etc.). Consequently, all these advantages are also granted to the guests (since the guests operate on a hypervisor that runs on/in the Linux OS kernel).
KVM is very fast, but on its own, it is not enough to run a virtual OS, as I/O emulation is needed. For I/O (CPU, disks, network, video, PCI, USB, serial ports, etc.), KVM uses QEMU.
2) QEMU
QEMU (Quick Emulator) is an emulator for various devices that enables operating systems designed for one architecture to run on another (for example, ARM -> x86). Besides the CPU, QEMU emulates various peripheral devices: network cards, HDDs, graphics cards, PCI, USB, etc.
It works like this:
Instructions/binary code (e.g., ARM) are converted into intermediate platform-independent code using the TCG (Tiny Code Generator) and then this platform-independent binary code is converted into target instructions/code (e.g., x86).
ARM -> intermediate_code -> x86
Essentially, you can run virtual machines on QEMU on any host, even with older processor models that don't support Intel VT-x (Intel Virtualization Technology) / AMD SVM (AMD Secure Virtual Machine). However, in such cases, it will operate quite slowly because the executable binary code needs to be recompiled on the fly twice, using TCG (TCG is a Just-in-Time compiler).
In other words, QEMU itself is incredibly powerful, but it operates very slowly.
3) Protection Rings
Binary program code on processors does not just run randomly, it exists at different levels (rings / Protection rings) with varying levels of data access, from the most privileged (Ring 0) to the most restricted, controlled, and tightly regulated (Ring 3).
The operating system (OS kernel) works at Ring 0 (kernel mode) and can do anything with any data and devices. User applications operate at Ring 3 (user mode) and are not allowed to do whatever they want; instead, they must request access to perform each operation (thus, user applications only have access to their own data and cannot "interfere" with another "sandbox"). Rings 1 and 2 are designated for driver use.
Before the invention of Intel VT-x / AMD SVM, hypervisors operated at Ring 0 while guests operated at Ring 1. Since Ring 1 does not have sufficient rights for the normal functioning of an OS, the hypervisor had to modify each privileged call from the guest system on the fly and execute it at Ring 0 (similar to how QEMU does it). That is, guest binary code DID NOT execute directly on the processor but rather underwent several intermediate modifications each time on the fly.
The overhead was significant, which posed a major problem. Consequently, processor manufacturers independently released an extended set of instructions (Intel VT-x / AMD SVM) allowing guest OS code to be executed DIRECTLY on the host processor (bypassing all the costly intermediate steps that were involved before).
With the appearance of Intel VT-x / AMD SVM, a special new level Ring -1 (minus one) was created. Now, the hypervisor operates at this level while guests run at Ring 0 and gain privileged access to the CPU.
So, in summary:
- the host operates at Ring 0
- guests operate at Ring 0
- the hypervisor operates at Ring -1
4) QEMU-KVM
KVM provides guests with access to Ring 0 and uses QEMU to emulate I/O (processor, disks, network, video, PCI, USB, serial ports, etc. that guests "see" and interact with).
Hence QEMU-KVM (or KVM-QEMU) 🙂
CREDITS
P.S. The text of this article was originally published on the Telegram channel as an answer to a question from one of the channel participants.
Please write in the comments where I may misunderstand the topic or if there’s anything to add.
Thank you!
Source: habr.com
