KVM Fundamentals and Architecture - Concepts and Terminology

l KVM: Kernel-based Virtual Machine, kernel-based virtual machine

l VMM: Virtual Machine Monitor, virtual machine monitor, in the KVM virtualization environment, the KVM kernel.

l VM: Virtual Machine, virtual machine, that is, Guest machine.

l Full Virtualization: Guest OS can be run without any changes. There are two implementations: software-assisted implementation and hardware-assisted implementation.

ü Software-assisted implementation of full virtualization: generally using priority compression (Ring Compression) and binary translation (Binary Translation). Since some privileged instructions must run on the privilege level Ring0, such as LGDT, usually the OS kernel runs Ring0, so in the virtualized environment, VMM has no Ring available. The general principle of priority compression is to make the VMM run on Ring0, the Guest OS kernel to run on Ring1, and the Guest OS user to run on Ring3. Priority compression handles most of the privileged instructions correctly, but due to virtualization vulnerabilities in the x86 architecture (some sensitive instructions cannot be captured), binary translation methods are used to handle these virtualization vulnerabilities: VMM scans and modifies the guest binary code, Sensitive instructions that cannot be captured are converted to instructions that support virtualization.

ü Full virtualization of hardware-assisted implementation: relying on hardware virtualization features (such as Intel VT-x), the basic idea is to add enough virtualization capabilities to the hardware architecture to enable it to intercept the guest. All sensitive instructions in the OS and simulated.

l Paravirtualization: The Guest OS needs to be modified to replace sensitive instructions that cannot be "snap" to resolve the capture of sensitive instructions.

l VT-x: Intel provides VT-x (Intel Virtualization for x86) technology for CPU virtualization (AMD SVM also provides similar functionality), VT-x introduces a new working mode VMX (Virtual Machine eXtension), the CPU in this mode has two modes of operation: root mode (VMX root operation) and non-root mode (VMX non-root operation). In each mode of operation, there is a separate Ring0-Ring3.

ü VMM runs in root mode. For KVM virtualization environment, the KVM host runs in root mode. The kernel in the host runs Ring0 in the root mode, and the user mode program in the host (such as Qemu) -kvm) Run3 running in root mode.

ü Guest runs in non-root mode, the kernel in Guest runs in Ring0 in non-root mode, and the user-mode program in Guest runs in Ring3 in non-root mode.

In addition, VT-x introduces a new set of instructions, including VMLAUNCH/VMRESUME (for launching VM-Entry), VMREAD/VMWRITE (for configuring VMCS), and so on.

l VM-Exit/VM-Entry: In the VT-x environment, in non-root mode (that is, in the Guest), the execution of sensitive instructions triggers "to fall into" & is called VM-Exit. When VM-Exit occurs, the CPU automatically switches from non-root mode to root mode, and then the VMM can further process or simulate the sensitive instructions that trigger VM-Exit.

The VM-Entry corresponds to VM-Entry. This operation is initiated by the VMM. Usually, it is caused by the VMM scheduling a Guest (or VCPU) runtime. At this time, the CPU automatically switches from the root mode to the non-root mode. .

l VMCS: In the VT-x environment, VMCS (Virtual Machine Control Structure) was introduced to better support CPU virtualization. VMCS is used to save the relevant state required by the virtual CPU, such as the value of the register of the CPU in the root mode and the non-root mode, the reason of the VM-Exit, etc. When the CPU generates VM-Exit and VM-Entry, it automatically queries and To update VMCS, VMM can also control the behavior of the CPU by configuring VMCS.