{"id":37939,"date":"2019-10-31T22:20:41","date_gmt":"2019-10-31T19:20:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obshhie-printsipy-raboty-qemu-kvm\/"},"modified":"2019-10-31T22:20:41","modified_gmt":"2019-10-31T19:20:41","slug":"obshhie-printsipy-raboty-qemu-kvm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obshhie-printsipy-raboty-qemu-kvm","title":{"rendered":"Parimet e p\u00ebrgjithshme t\u00eb funksionimit t\u00eb QEMU-KVM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Parimet
\n
\nKuptimi im aktual:<\/p>\n

1) KVM<\/h2>\n

\nKVM (Virtual Machine e Bazuar n\u00eb Linux) \u00ebsht\u00eb nj\u00eb hipervizor (VMM \u2013 Menaxheri i Makineris\u00eb Virtuale), q\u00eb funksionon si nj\u00eb modul n\u00eb sistemin operativ Linux. Hipervizori nevojitet p\u00ebr t\u00eb ekzekutuar ndonj\u00eb software n\u00eb nj\u00eb mjedis t\u00eb pamundur (virtual) dhe, po ashtu, p\u00ebr t\u00eb fshehur nga ky software pajisjet fizike reale, mbi t\u00eb cilat funksionon ky software. Hipervizori vepron si nj\u00eb \u2018nd\u00ebrmjet\u00ebs\u2019 mes pajisjes fizike (hostit) dhe sistemit operativ virtual (mysafir).<\/p>\n

Duke qen\u00eb se KVM \u00ebsht\u00eb nj\u00eb modul standard i b\u00ebrtham\u00ebs Linux, ai merr nga b\u00ebrthama t\u00eb gjitha avantazhet e nevojshme (puna me kujtes\u00ebn, planifikuesi, etj.). Prandaj, n\u00eb fund, t\u00eb gjitha k\u00ebto p\u00ebrfitime i shkojn\u00eb edhe mysafir\u00ebve (pasi mysafir\u00ebt funksionojn\u00eb mbi hipervizorin, i cili funksionon n\u00eb\/n\u00eb b\u00ebrtham\u00ebn e sistemit operativ Linux).<\/p>\n

KVM \u00ebsht\u00eb shum\u00eb i shpejt\u00eb, por ai vet\u00ebm nuk mjafton p\u00ebr t\u00eb ekzekutuar nj\u00eb sistem operativ virtual, sepse p\u00ebr k\u00ebt\u00eb nevojitet nj\u00eb imitim I\/O. P\u00ebr I\/O (procesori, disk\u00ebt, rrjeti, video, PCI, USB, porta seriale, etj.) KVM p\u00ebrdor QEMU.
\n<\/a><\/noindex><\/p>\n

2) QEMU<\/h2>\n

\nQEMU (Quick Emulator) \u2013 nj\u00eb emulator p\u00ebr pajisje t\u00eb ndryshme, i cili lejon q\u00eb t\u00eb ethet sisteme operative t\u00eb destinuara p\u00ebr nj\u00eb arkitektur\u00eb, t\u00eb funksionojn\u00eb n\u00eb nj\u00eb tjet\u00ebr (p\u00ebr shembull, ARM \u2013> x86). P\u00ebrve\u00e7 procesorit, QEMU emulon pajisje periferike t\u00eb ndryshme: karta rrjeti, HDD, karta grafike, PCI, USB etj.<\/p>\n

Funksionon k\u00ebshtu:<\/p>\n

Udh\u00ebzimet\/kodi binar (p\u00ebr shembull, ARM) konvertohen n\u00eb kod nd\u00ebrmjet\u00ebs, t\u00eb pavarur nga platforma, p\u00ebrmes konvertuesit TCG (Tiny Code Generator), dhe pastaj ky kod i pavarur nga platforma konvertohet n\u00eb instruksione\/kod p\u00ebrfundimtar (p\u00ebr shembull, x86).<\/p>\n

ARM \u2013> kod_nd\u00ebrmjet\u00ebs \u2013> x86<\/p>\n

N\u00eb thelb, mund t\u00eb ekzekutoni makina virtuale n\u00eb QEMU n\u00eb \u00e7do host, edhe me modele t\u00eb lashta procesor\u00ebsh, q\u00eb nuk mb\u00ebshtesin Intel VT-x (Intel Virtualization Technology) \/ AMD SVM (AMD Secure Virtual Machine). Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast, do t\u00eb funksionoj\u00eb shum\u00eb ngadal\u00eb, p\u00ebr shkak se kodi binar i ekzekutuesh\u00ebm duhet t\u00eb rikonvertohet n\u00eb flutur dy her\u00eb, p\u00ebrmes TCG (TCG \u00ebsht\u00eb nj\u00eb kompiler Just-in-Time).<\/p>\n

Pra, QEMU \u00ebsht\u00eb i shk\u00eblqyer vet\u00eb p\u00ebr vet\u00eb, por funksionon shum\u00eb ngadal\u00eb.<\/p>\n

3) Rringat e mbrojtjes<\/h2>\n

\n\"Parimet
\n
\nKodi binar i programeve n\u00eb procesor\u00eb nuk funksionon thjesht k\u00ebshtu, por ndodhet n\u00eb nivele t\u00eb ndryshme (unaza \/ Protection rings) me nivele t\u00eb ndryshme qasjeje n\u00eb t\u00eb dh\u00ebna, nga m\u00eb privilegjuari (Ring 0), deri te ai m\u00eb i kufizuar, rregullohet dhe \"me vida t\u00eb ngushta\" (Ring 3).<\/p>\n

Sistemi operativ (kernel i OS) punon n\u00eb Ring 0 (kernel mode) dhe mund t\u00eb b\u00ebj\u00eb \u00e7far\u00ebdo me \u00e7do t\u00eb dh\u00ebna dhe pajisje. Aplikacionet e p\u00ebrdoruesve punojn\u00eb n\u00eb nivelin Ring 3 (user mode) dhe nuk kan\u00eb t\u00eb drejt\u00eb t\u00eb b\u00ebjn\u00eb \u00e7do gj\u00eb q\u00eb duan, por \u00e7do her\u00eb duhet t\u00eb k\u00ebrkojn\u00eb qasje p\u00ebr t\u00eb realizuar nj\u00eb operacion t\u00eb caktuar (n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, aplikacionet e p\u00ebrdoruesve kan\u00eb qasje vet\u00ebm n\u00eb t\u00eb dh\u00ebnat e tyre dhe nuk mund t\u00eb \"hyjn\u00eb\" n\u00eb \"sandbox-in\" e t\u00eb tjer\u00ebve). Ring 1 dhe 2 jan\u00eb t\u00eb destinuara p\u00ebr p\u00ebrdorim nga drejtuesit.<\/p>\n

Para shpikjen e Intel VT-x \/ AMD SVM, hipervizor\u00ebt punonin n\u00eb Ring 0, nd\u00ebrsa mysafir\u00ebt punonin n\u00eb Ring 1. Duke qen\u00eb se Ring 1 nuk kishte mjaft privilegje p\u00ebr funksionimin normal t\u00eb OS-s\u00eb, p\u00ebr \u00e7do thirrje privilegjuar nga sistemi mysafir, hipervizorit i duhej t\u00eb modifikonte n\u00eb koh\u00eb reale k\u00ebt\u00eb thirrje dhe ta ekzekutonte n\u00eb Ring 0 (af\u00ebrsisht ashtu si\u00e7 b\u00ebn QEMU). Dometh\u00ebn\u00eb, kodi binar i mysafirit N\u00cb<\/i><\/b> nuk ekzekutohej drejtp\u00ebrdrejt n\u00eb procesor, por \u00e7do her\u00eb kalonte n\u00ebp\u00ebr disa modifikime nd\u00ebrmjet\u00ebse n\u00eb koh\u00eb reale.<\/p>\n

Shpenzimet ishin t\u00eb konsiderueshme dhe kjo ishte nj\u00eb problem i madh dhe at\u00ebher\u00eb prodhuesit e procesor\u00ebve, p\u00ebrve\u00e7 t\u00eb tjer\u00ebve, lan\u00e7uan nj\u00eb grup t\u00eb avancuar instruksionesh (Intel VT-x \/ AMD SVM), duke lejuar ekzekutimin e kodit t\u00eb sistemeve mysafire DREJTP\u00cbRDREJT<\/i><\/b> n\u00eb procesorin e hostit (duke kaluar \u00e7do hap t\u00eb nd\u00ebrmjet\u00ebm t\u00eb shtrenjt\u00eb, si\u00e7 kishte ndodhur m\u00eb par\u00eb).<\/p>\n

Me ardhjen e Intel VT-x \/ AMD SVM, u krijua nj\u00eb nivel i ri special Ring -1 (minus nj\u00eb). Dhe tani mbi t\u00eb punon hipervizori, nd\u00ebrsa mysafir\u00ebt punojn\u00eb n\u00eb Ring 0 dhe marrin qasje privilegjuar n\u00eb CPU.<\/p>\n

Dometh\u00ebn\u00eb, n\u00eb fund:<\/p>\n