{"id":37939,"date":"2019-10-31T22:20:41","date_gmt":"2019-10-31T19:20:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obshhie-printsipy-raboty-qemu-kvm\/"},"modified":"2019-10-31T22:20:41","modified_gmt":"2019-10-31T19:20:41","slug":"obshhie-printsipy-raboty-qemu-kvm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obshhie-printsipy-raboty-qemu-kvm","title":{"rendered":"Principet e p\u00ebrgjithshme t\u00eb pun\u00ebs s\u00eb QEMU-KVM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Principet
\n
\nKuptimi im aktual:<\/p>\n

1) KVM<\/h2>\n

\nKVM (Kernel-based Virtual Machine) \u2013 nj\u00eb hipervizor (VMM \u2013 Menaxhuesi i Makinerive Virtuale), i cili funksionon si nj\u00eb modul n\u00eb OS Linux. Hipervizori \u00ebsht\u00eb i nevojsh\u00ebm p\u00ebr t\u00eb ekzekutuar ndonj\u00eb softuer n\u00eb nj\u00eb mjedis t\u00eb papar\u00eb (virtual) dhe n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb t'i fsheh\u00eb k\u00ebtij softueri harduerin fizik real mbi t\u00eb cilin funksionon ky softuer. Hipervizori funksionon si nj\u00eb \"nd\u00ebrmjet\u00ebs\" midis harduerit fizik (host) dhe OS virtuale (mysafir).<\/p>\n

Duke qen\u00eb se KVM \u00ebsht\u00eb nj\u00eb modul standard i kernelit Linux, ai merr t\u00eb gjitha p\u00ebrfitimet nga b\u00ebrthama (puna me memorien, planifikuesi, etj.). Prandaj, n\u00eb fund t\u00eb fundit, t\u00eb gjitha k\u00ebto avantazhe arrihen edhe nga mysafir\u00ebt (pasi mysafir\u00ebt funksionojn\u00eb n\u00eb hipervizorin, i cili punon n\u00eb \/ n\u00eb b\u00ebrtham\u00ebn e OS Linux).<\/p>\n

KVM \u00ebsht\u00eb shum\u00eb i shpejt\u00eb, por vet\u00eb ai nuk mjafton p\u00ebr t\u00eb ekzekutuar nj\u00eb OS virtuale, pasi nevojitet gjithashtu emulimi i I\/O. P\u00ebr I\/O (procesori, disqet, rrjeti, video, PCI, USB, porte seriale, etj.) KVM p\u00ebrdor QEMU.
\n<\/a><\/noindex><\/p>\n

2) QEMU<\/h2>\n

\nQEMU (Quick Emulator) \u2013 nj\u00eb emulator i pajisjeve t\u00eb ndryshme, i cili lejon ekzekutimin e sistemeve operative t\u00eb destinuara p\u00ebr nj\u00eb arkitektur\u00eb, n\u00eb nj\u00eb tjet\u00ebr (p.sh., ARM -> x86). P\u00ebrve\u00e7 procesorit, QEMU emulon pajisje periferike t\u00eb ndryshme: kartela rrjeti, HDD, kartela video, PCI, USB etj.<\/p>\n

Kjo ndodh k\u00ebshtu:<\/p>\n

Udh\u00ebzimet \/ kodi binar (p.sh., ARM) konvertohen n\u00eb kod t\u00eb nd\u00ebrmjet\u00ebm platform\u00ebs, me ndihm\u00ebn e konvertuesit TCG (Tiny Code Generator) dhe pastaj ky kod binar i platform\u00ebs konvertohet n\u00eb udh\u00ebzime \/ kodin p\u00ebrkat\u00ebs (p.sh., x86).<\/p>\n

ARM -> kod_i_nd\u00ebrmjet\u00ebm -> x86<\/p>\n

N\u00eb thelb, ju mund t\u00eb ekzekutoni makinat virtuale n\u00eb QEMU n\u00eb \u00e7do host, madje edhe me modele t\u00eb vjetra procesor\u00ebsh q\u00eb nuk mb\u00ebshtesin Intel VT-x (Intel Virtualization Technology) \/ AMD SVM (AMD Secure Virtual Machine). Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast, kjo do t\u00eb funksionoj\u00eb mjaft ngadal\u00eb, pasi kodi binar q\u00eb ekzekutohet duhet t\u00eb rikompilohet n\u00eb fluks dy her\u00eb, duke p\u00ebrdorur TCG (TCG \u00ebsht\u00eb nj\u00eb kompilator Just-in-Time).<\/p>\n

Pra, vet\u00eb QEMU \u00ebsht\u00eb jasht\u00ebzakonisht i bukur, por punon shum\u00eb ngadal\u00eb.<\/p>\n

3) Rrethet e mbrojtjes<\/h2>\n

\n\"Principet
\n
\nKodi programit binar n\u00eb procesor\u00eb funksionon jo thjesht k\u00ebshtu, por ndodhet n\u00eb nivele t\u00eb ndryshme (rrethe \/ Rrethet e Mbrojtjes) me nivele t\u00eb ndryshme aksesesh n\u00eb t\u00eb dh\u00ebna, nga m\u00eb privilegjiuese (Ring 0), deri te m\u00eb t\u00eb kufizuar, t\u00eb rregulluar dhe \"t\u00eb ngjeshur\" (Ring 3).<\/p>\n

Sistemi operativ (n\u00ebnd\u00ebrmarrja e OS) funksionon n\u00eb Ring 0 (modalitetin kernel) dhe mund t\u00eb b\u00ebj\u00eb \u00e7far\u00ebdo me \u00e7do t\u00eb dh\u00ebn\u00eb dhe pajisje. Aplikacionet e p\u00ebrdoruesve funksionojn\u00eb n\u00eb nivelin Ring 3 (modaliteti i p\u00ebrdoruesit) dhe nuk kan\u00eb t\u00eb drejt\u00eb t\u00eb b\u00ebjn\u00eb \u00e7far\u00eb t\u00eb duan, por \u00e7do her\u00eb duhet t\u00eb k\u00ebrkojn\u00eb akses p\u00ebr t\u00eb kryer nj\u00eb operacion (pra, aplikacionet e p\u00ebrdoruesve kan\u00eb qasje vet\u00ebm n\u00eb t\u00eb dh\u00ebnat e veta dhe nuk mund t\u00eb \"nd\u00ebrhyjn\u00eb\" n\u00eb \"sandkast\u00ebn\" e t\u00eb tjer\u00ebve). Ring 1 dhe 2 jan\u00eb p\u00ebr t'u p\u00ebrdorur nga drejtuesit.<\/p>\n

Para shpikjes s\u00eb Intel VT-x \/ AMD SVM, hipervizor\u00ebt punonin n\u00eb Ring 0, nd\u00ebrsa mysafir\u00ebt punonin n\u00eb Ring 1. Duke qen\u00eb se Ring 1 nuk kishte mjaft t\u00eb drejta p\u00ebr t\u00eb funksionuar normalisht sistemi operativ, me \u00e7do thirrje t\u00eb privilegjuar nga sistemi mysafir, hipervizorit i duhej t\u00eb modifikonte n\u00eb flak\u00eb k\u00ebt\u00eb thirrje dhe ta kryente at\u00eb n\u00eb Ring 0 (af\u00ebrsisht ashtu si\u00e7 b\u00ebn QEMU). Pra, kodi binar mysafir NUK<\/i><\/b> ekzekutohej drejtp\u00ebrdrejt n\u00eb procesor, por \u00e7do her\u00eb kalonte disa modifikime nd\u00ebrmjet\u00ebsuese.<\/p>\n

Kostot kishin qen\u00eb t\u00eb m\u00ebdha dhe kjo ishte nj\u00eb problem i madh dhe at\u00ebher\u00eb prodhuesit e procesor\u00ebve, pa ndihm\u00ebn e nj\u00ebri-tjetrit, nxorr\u00ebn nj\u00eb set t\u00eb avancuar instrukcionesh (Intel VT-x \/ AMD SVM), q\u00eb lejojn\u00eb ekzekutimin e kodit t\u00eb sistemeve operative mysafir\u00eb DREJT\u00cb<\/i><\/b> n\u00eb procesorin e hostit (duke kaluar t\u00eb gjitha fazat nd\u00ebrmjet\u00ebsuese t\u00eb kushtueshme, si\u00e7 ishin m\u00eb par\u00eb).<\/p>\n

Me shfaqjen e Intel VT-x \/ AMD SVM, u krijua nj\u00eb nivel t\u00eb ri t\u00eb ve\u00e7ant\u00eb Ring -1 (minus nj\u00eb). Tani, atje punon hipervizori, nd\u00ebrsa mysafir\u00ebt punojn\u00eb n\u00eb Ring 0 dhe marrin akses t\u00eb privilegjuar n\u00eb CPU.<\/p>\n

Pra, n\u00eb fund:<\/p>\n