者：Timo虛擬化技20世紀60年代被提出，那時計算機系統非常龐大，并且操作起來非常方法，通過這種方法，一個操作系統可以運行在一個孤立的虛擬機上面。虛擬機器理和分配也是它的職責之一。近年來，隨著In和AMD提供實現虛擬化的技術支持，使 摘 引 定 2.3.1等 結 用Linux作為虛擬機監視 KVM控制接 總 引提供了一些相互的環境供程序運行。在20世紀80年代，隨著x86體系結構的出現以及硬件價格的下降，人們可以承受最近幾虛擬化技術再次變得熱門。In和AMD拓展了x86處理器下的IA32CPU市場，因此現在幾乎所有的PC機以及服務器都支持虛擬化。合意味著通過在物理主機上將每個服務運行在一個虛擬機上從而達到優化低負荷的工源的消和減少費。當荷長的時候，要物理主來完成服務，那些被關閉的主機會重新開啟，而一些虛擬機則會遷移到他們上面運行。三章，我們介紹KVM是如何作為linux的擴展而實現VMM的功能。系統-虛擬在客戶機上的操作系統稱為客戶機操作系統（guestOS）。VMM控制和。它向用戶提供一些用于管理虛擬機的工具，這些工具提供了諸如啟動或關一個虛擬機通常有至少一個虛擬CPU。VMM對所有正在運行的虛擬機上的CPUVMM提供一些調度。通常，VMMCPU去分配特定的物理CPU。虛擬機監視器還需要解決內存管理的問題。VMM將一定數量的物理內存映射到虛個VMM味不同的虛擬機提供幾乎一樣的設備，這就使得在在運行相同VMM的不同物理機上對虛擬機進行遷移非常簡單，而虛擬I/O設備的驅動僅僅需要在安裝一次。圖1:虛擬機監視器（VMM）結為了實現x86架構下的虛擬機監視器，硬件支持是必須具備的。借助CPU實現的統資源的一個子集，操作系統和CPU使用了等級。圖2：CPU等在任何給定的時間，x86CPU都運行在一個特定的等級。圖2以環的形式展示了這些等級。Ring0是最多的，而ring3是最少的。通過這種環形結構保護的資源有：I/O端口和CPU指令。操作系統通常運行在ring0，它通過最多的等級進行資源管理和提供到硬件設備的通信。所有的應用程序運行在ring3。ring1和ring2大為只有運行在ring0的代碼才能夠執行這些操作，這就要求VMM運行在最多的一VMMring0ring0，客戶機操作向系統不得不運行在其他的具有更少的ring層或者進行修改運行在用戶模式下。In和AMD這是x86架構下虛擬化的一個主要的，所以他們引進了InVT技術以及AMDSVM技術作為IA-32指令集的擴展以更好的支持虛擬化。這些擴展使得KVM可以運行一個要求進入內核模式或較低ring層的客戶機。它相當的物理機擁有的等量的內存。VMM將物理內存分成許多連續的固定長度的內存虛擬內存是不是被拷物理內存區。為了解決這個問題，VMM持有一張保存有所有個虛擬機的內存地址可以作的時候，VMM首先使用虛擬內存管理工具去恢復它。隨著In 擴展頁表（EPT）以及AMD嵌套頁表（NPT）的引進，VMM可以使用了VMM的性能。是運行在ring0層，這導致虛擬機無法執行任何的指令。為了解決這個問題，客戶操作系統需要進行修改以實現一些接口。VMM通過使用這些接口對虛擬機進行控制并修改。因此，使用半虛擬化方法運行windows虛擬機是無法實現的。這種方法允許在一臺主機上運行多個相互的虛擬機，每個虛擬機都運行自己的運行不進行修改的操作系統。VMMI/O設備。這確保一KVM-基于內核的虛擬20089Qumranet公司，從那之后，KVM變得更加產品化。Redhat公司KVM視作下一代虛擬化技RHEL5.4版本之后，KVM被廣泛用于RHELAMD2.6.20版本之后，KVM作為一部分被集成在了linux內核之中，因此，大部分內核比較新的linux操作系統都可以使用LKMKVM還受益于開源操作系統的在世界范圍內的因為無論linux在新的算法、驅動以及任何方面有所發展，KVM都會同樣獲得更好的發展。Linux擁有運行多個虛擬機所需要的所有機制。這些機制我們在2.2章節中已經提KVMlinux3展示的那樣，linux變成3：KVM架KVM主機上的虛擬機。參考文獻中作x86體系時，InAMD尚未EPT或者NPT，KVM開發者添加了頁表。在2008年5月，這些技術支KVM內核模塊被加載之后，/dev/kvm設備節點出現在文件系統中。這是一序。ioctl函數通常被用作在特地的操作系統中為用戶態的程序提供和設備聯系的接口。且啟動虛擬CPU。為了向虛擬機提供硬盤、cd驅動器、網卡等硬件設備，KVM使用了高度改進了QEMU。QEMUPC平臺，包括圖像、QEMU進程和特定的模擬設備箱關聯。當虛擬機進行讀寫操作時，這些KVM截獲，然后傳送給和虛擬機相關聯的QEMU進行處理。4描繪KVM的執行模塊。它通過一個環形的行為來操作虛擬機。這些行為被我們在3.1.1章節中提到的三個模式所分離。圖4：KVM執行模user-mode：KVMioctl()I/O操作初I/O操作退出客戶模式，內核模式執行必要的任務并且重新進入執行流程。如果諸如一直到需要KVM支持的指令被調用，或者一個錯誤或外部中斷發生。擬機從它上面一些信息。QEMU通過模擬硬盤和它的操作來模擬客戶虛擬機的操I/O操作更加是降低了虛擬機的執行速度的瓶virtio半虛擬化設備模塊的支持，KVMQEMU模擬設備的性能上。virtioVMM的獨立驅動以改善讀寫性能。事實上，一個半虛擬化驅動的程序被用來模擬I/O操作，而不是直接地使用物總CPU制造商提出了能夠有效的建立虛擬機監視系統的工具，VMMx86架構上。KVMCPU工具操作虛擬機的虛擬化解決方案，這些虛擬機使用使用虛擬化。KVM允許多種多樣KVM被設計為一個內核模塊，一旦加載了KVM，linux就變為了一臺虛擬機監視器。由于研發者不想重寫框架，KVMlinux內核的機制去管理計算資源并且受益提供給虛擬機的模擬設備在性能上表現并不好KVM提供了對virtio設備模塊的支持。由于半虛擬化驅動不需要模擬特定的設備，這使得在它I/O性能上有很大的提升。KVM-Thekernel-basedvirtualTimo13.FebruarVirtualizationhasbeenintroducedinthe1960s,whencomputingsystemswerelargeandexpensivetooperate.Italloweduserstosharethecomputingresourcesofthosemachinesbyrunningtheirtasksinparallel.Nowadaysvirtualizationisahypetopicagainandthereareaplentyofscopesofapplication.Virtualizationallowstorunseveralvirtualmachinesontopofahost.Thisworkfocusesonthesystem-virtualizationapproach,wherebyawholeoperatingsystemrunsinanisolatedvirtualmachine.AVirtualMachineMonitorisusedtooper-atethesevirtualmachines.Itrepresentsasmalllayerofindirectionbetweenthephysicalhardwareandthevirtualmachines.Schedulingofcomputingtimeandmemorymanagementisalsopartofthevirtualmachinemonitorsresponsibilities.InrecentyearsInandAMDreleasedhardwaresupportforimplementingthese,whichpromisesbetterperformance.KVMisthefirstvirtualizationsolutionthathasbeenintegratedintothevanillalinuxkernel.Thisworkpresentsitsbriefhistory.Followedbymoretechnicalconsiderationsofitsarchitectureandexecutionmodel. System- VirtualMachine Hardware Privilege Memory Virtualization KVM–Kernel-basedVirtual Linuxasa Resource TheKVMcontrol Emulationof Execution- Paravirtualdevice Virtualizationisnotanewtechnology.Inthe1960scomputingsystemswereaslargeasaroomandveryexpensivetooperate.Inthosedaysonlyoneapplicationcouldbeexecutedononepieceofhardwareataparticulartime.Thentime-sharinghadbeenintroducedtoexecuteseveralapplicationssimultaneously.Onemajordrawbackofthisapproachwasthelackofisolationoftherunningapplications.IfapplicationAcausedahardwareerrorallotherrunningapplicationswereaffected.Toisolatethese,virtualizationprovidedseveralisolatedenvironmentstoranthemInthe1970shardwarearchitecturesbecamevirtualizationaware.IBMmain-framesallowedtheadministratorstopartitiontherealhardwareandprovideiso-latedenvironmentsforeachapplication.Inthe1980s,asthex86architecturearoseandthepricesofhardwarefelt,itbecameaffordabletorunonecomputerperapplication.Alsooperatingsystemssupportedmultitaskingandtherewasnoneedfortime-sharinganymore.Asaconsequencevirtualizationbecamehistory.Inthelastcoupleofyearsvirtualizationexperiencedacomeback.InandAMDextendedtheIA32instructonsetofx86processorstosupportvirtualiza-tion.SincethesearethebigplayersontheCPUmarket,nearlyanyrecentPCandserversupportsvirtualization.Today,virtualizationismainlyusedforconsolidation.Therearemanytypesofconsolidationandthefollowingexamplesshouldgiveabasicideaaboutit.Alotofserversarerunningataverylowloadbutstillconsumingahugeamountofenergy.Serverconsolidationmeanswork-loadoptimizationoftheseserversbyrunningeachofthemasaVirtualMachine(VM)onvirtualizationhosts.WhencontentionislowtheseVMsaredynamicallymigratedtofewervirtualizationhostandshutdowntheotherstoreduceenergyconsumptionandlowercosts.Iftheloadincreasesandmorehostsareneededtofulfillserverlevelobjectives,thesearestartedagainandsomeVMsaremigratedontothem.Anotherexampleisapplicationconsolidation,wherevirtualizationisusedtore-placetheoldhardwareofalegacysystem.Ithelpstoprovideanenvironment1whichmimicstheoldhardwareandrunsthelegacySandboxingisanotherpurposeofvirtualization.Itismainlyusedtoincreasese-curitybyrunningpotentiallyinsecureapplicationsinsideaVM.Soanapplicationrunsinitsisolatedenvironment,whilespecialistscanobserveitsbehaviour.Thusmalwareandothermalicioussoftwarecouldbefoundbeforeit’sdeployedonamachinewithaccesstothenetworkofacompany.TherearevarioustechniquestoprovideandoperateVMs,oneofthoseareVirtualMachineMonitors(VMM).SuchaVMMrepresentsasoftwarelayerofindirection,runningontopofthehardware.ItoperatesallVMsrunninguponit.Insection2wecoverthisapproachandtoday’shardwaresupportforimplementingaVMM.Basedonthatinsection3wepresentKVMasalinuxextensionthatturnsitintoaVMM.System-Sincevirtualizationisasettledtopic,thereareseveraldefinitionsonit.Thefollowingisageneraldefinitionofvirtualizationgivenby[CB05]:“Virtualizationisatechnologythatcombinesordividescomputingre-sourcestopresentoneormanyoperatingenvironmentsusingmethod-ologieslikehardwareandsoftwarepartitioningoraggregation,partialorcompletemachinesimulation,emulation,time-sharing,andmanyThismeans,thatvirtualizationusestechniquesto fromtherealhardwareandprovidesisolatedenvironments,socalledVirtualMachines.Thesearecapabletorunvariousapplicationsorevenawholeoperatingsystem.Agoalnotmen-tionedinthedefinitionistohavenearlytonativeperformanceforrunningVMs.Thisisaveryimportantpoint,becausetheusersalwayswanttogetthemostoutoftheirhardware.Mostofthemarenotwillingtointroducevirtualization2technology,ifahugeamountofCPUpoweriswastedbymanagingVMs.Aswellasvirtualizationingeneral,systemvirtualizationiswelldefined“AsystemVMprovidesacompleteenvironmentinwhichansystemandmanyprocesses,possiblybelongingtomultipleusers,coexist.”Thecompleteenvironment,inthiscase,meansanenvironmentthatprovidesusualhardwarelikeethernetcontrollers,CPUsorharddiskdrivestoanoperatingsys-tem(OS)whichrunsinsideofit.AserverwithrealhardwareattachedtoitcommonlyrunsseveralVM’s.SuchaserveriscalledvirtualizationhostandtheVM’srunningontopofitarecalledguests.TheOSthatrunsinsideaguestiscalledguestForthiswork,unlessotherwisespecified,byvirtualizationweunderstandsystem-VirtualMachineAVirtualMachineMonitor,alsocalledhypervisor,isapieceofsoftwareorhard-warethatrunsontopofthehostshardware(Figure1).ItrepresentsalayerofindirectionbetweenthephysicalhardwareandtheVMsrunningonelayerabove.AllguestsarecontrolledandmonitoredbytheVMM.Itprovidestoolstotheuserstomanagethem.ThesetoolsallowtodoseveraloperationslikestartingorstoaguestormigratingVMsbetweenhosts.AVMusuallyhasatleastonevirtualCPU.TheVMMmapsthevirtualCPU(s)ofallactuallyrunningVMstothephysicalCPU(s)ofthehost.Hence,thereareusuallymoreVMsrunningonahostthanphysicalCPUsareattachedtoit,causestheneedofsomekindofscheduling.ThereforeaVMMusesacertainschedul-ingmechanismtoassignacertainshareofthephysicalCPUstoeachvirtualCPU.3Figure1:VMMArchitectureAVMMhastodealwithmemorymanagement,also.Itmapsanamountofphys-icalmemoryintotheVMsaddressspaceandalsohastohandlefragmentationofmemoryandswap.SincesomeVMsneedmorememorythanothers,theamountofassignedmemoryisdefinedandoftendynamicallyadjustedbyusingthemanagementtools.Usually,theVMsdon’thaveaccesstothephysicalhardwareanddon’tevenknowaboutiteither.Onlyifdirectaccessisdesired,devicesmaybepassedthroughdirectly.Forrunninglegacysoftwarethismaybeapoint.ButinmorecommonscenariostheVMMprovidesvirtualI/Odeviceslikenetworkcards,harddisksandcddrives.SinceaVMMprovidesdifferentVMsmostlywithsamehardware,itismucheasiertomigratethembetweenhostsrunningthesameVMM.ThedriversforthevirtualI/Odevicesneedtobeinstalledonlyonceinthiscase.HardwareToimplementaVirtualMachineMonitoronax86architecture,hardwareassis-tanceisneeded.TheprivilegelevelsimplementedbytheCPUtorestricttasksthatprocessescando,areoneaspect.AnotheroneisthememorymanagementthatisemulatedbytheVMMwhichtendstobeinefficient.Hardwaresupportcouldleadtoanincreasedperformanceofthevirtualmachinesbysupportinga4PrivilegeThemostmodernoperatingsystemsdon’tallowapplicationstoexecutecertainoperations.OnlytheOSmayloaddriversoraccessthehardwaredirectly,forexample.Torestrictallrunningapplicationstoonlyasubsetoftheresources,theOSandtheCPUconspireusingprivilegelevels.Figure2:CPUprivilegeAsdescribedin[Dua08]ax86CPUrunsinaspecificprivilegedlevelatanygiventime.Figure2showstheselevelsasrings.Ring0isthemostprivilegedandring3istheleastprivileged.Theresourcesthatareprotectedthroughtheringsare:memory,I/OportsandCPUinstructions.Theoperatingsystemtypicallyrunsinring0.Itneedsthemostprivilegedleveltodoresourcemanagementandprovideaccesstothehardware.Alltheapplicationsruninring3.Ring1and2arewidelyunused.FromaOSspointofviewring0iscalledkernel-modeandring3user-mode.Asmentionedinsection2.2theVMMneedstoaccessthememory,CPUandI/Odevicesofthehost.Sinceonlycoderunninginring0isallowedtoperformthese5operations,itneedstoruninthemostprivilegedring,nexttothekernel.AnoperatingsysteminstalledinaVMalsoexpectstoaccessalltheresourcesandinorderofthatrunninginring0liketheVMMdoes.Duetothefactthatonlyonekernelcanruninring0atthesametime,theguestOSshavetoruninanotherringwithlessprivilegesorhavetobemodifiedtoruninuser-mode.InandAMDrealizedthatthisisamajorchallengeofvirtualizationonthex86architecture.SotheyintroducedInVTandAMDSVMasanextensionoftheIA-32instructionsetforbettersupportofvirtualization.TheseextensionsallowtheVMMtorunaguestOSthatexpectstoruninkernel-mode,inalowerprivilegedring.MemoryInordertorunseveralVMsontopofaserver,amultipleoftheamountofmem-orythatisattachedtoacommonserverisneeded.SinceeachVMrunsanentireoperatingsystemandapplicationsonthat,itis mendedtoassignasmuchmemorytoaVMasacomparablephysicalmachinewouldhave.TheVMMsplitsthephysicalmemoryofthehostintocontiguousblocksoffixedlengthandmapsitintotheaddressspaceprovidedtoaVM.Mostmodernsystemsareusingvirtualmemorymanagement.Thistechniqueal-lowstoprovidethepreviouslymentionedcontiguousblocksofmemorytoaVM,althoughitisfragmentedalloverthephysicalmemoryorevenpartiallystoredontheharddisk.Inthiscaseithastobecopiedbacktomemorybythevirtualmemorymanagementfirst,whenaccessed.SinceaVMisunawareofthephysicaladdressofitsaddressspace,itcan’tfigureoutwhetherpartsofitsvirtualmemoryhastobecopiedornot.Toachievethat,theVMMholdsasocalledshadowpagetablethatstoresthephysicallocationofthevirtualmemoryofallVMs.Thus,anytimeaVMwritestoitsmemory,theoperationhastobeinterceptedtokeeptheshadowpagesuptodate.WhenaswappedaddressisaccessedtheVMMfirstusesthevirtualmemorymanagementtorestoreit.6WiththeintroductionofIn’sExtendedPagingTables(EPT)andAMD’sNestedPagingTables(NPT)aVMMcanusehardwaresupportforthetranslationbe-tweenvirtualandphysicalmemory.ThisreducestheoverheadofholdingshadowpagesandincreasestheperformanceofaVMM[Bha09].VirtualizationWiththeproblemsandsolutionsmentionedintheprevioussectioninmind,wenowtakealookattwotechniquestorealizesystemvirtualization.Theparavirtualizationapproachallowseachguesttorunafulloperatingsystem.Butthesedonotruninring0.Duetothatalltheprivilegedinstructionscan’tbeexecutedbyaguest.Inorderofthat,modificationstotheguestoperatingsystemsarerequiredtoimplementaninterface.ThisisusedbytheVMMtotakeovercontrolandhandletherestrictedinstructionsfortheVM.Theparavirtualizationapproachpromisesnearlytonativeperformancebutlacksinthesupportforclosedsourceoperatingsystems[NAL+06].Toapplythementionedmodifications,thesourcecodeofthekernelofanoperatingsystemhastobepatched.Thus,runningWindowsinaVMisimpossibleusingparavirtualization.Thisapproachallowstooperateseveraloperatingsystemsontopofahostingsystem,eachrunningintoitsownisolatedVM.TheVMMuseshardwaresupportasdescribedinsection2.3.1tooperatethese,whichallowstoruntheguestop-eratingsystemswithoutmodifications.TheVMMprovidesI/OdevicesforeachVM,whichiscommonlydonebyemulatingolderhardware.ThisensuresthataguestOShasdriversupportforthesedevices.Becauseoftheemulatedpartsfullvirtualizationisnotasfastasparavirtualization.ButifoneneedstorunaclosedsourceOSs,itistheonlyviabletechniquetodoso.7KVM–Kernel-basedVirtualKVMhasbeeninitiallydevelopedbyQumranet,asmallcompanylocatedinis-rael.RedhatacquiredQumranetinseptember2008,whenKVMbecamemoreproductionready.TheyseeKVMasthenextgenerationofvirtualizationtechnol-ogy.NowadaysitisusedasthedefaultVMMinRedhatEnterpriseLinux(RHEL)sinceversion5.4andtheRedhatEnterpriseVirtualizationforServers1.QumranetreleasedthecodeofKVMtotheopensourcecommunity.Today,wellknowncompanieslikeIBM,InandAMDcounttothelistofcontributorsoftheproject.Sinceversion2.6.20KVMispartofthevanillalinuxkernelandthusavailableonthemostlinux-basedoperatingsystemswithanewerkernel.Further-moreitbenefitsfromtheworldclassdevelopmentoftheopensourceoperatingsystem,becauseiflinuxgainsbetterperformancethroughnewalgorithms,driversorwhatsoeverKVMalsoperformsbetter.KVMisasystem-virtualizationsolutionthatusesfullvirtualizationtorunVMs.Ithasasmallcodebase,sinceitwasdesignedtoleveragethefacilitiesprovidedbyhardwaresupportforvirtualizationasdescribedinsection2.3.KVMrunsmainlyonthex86architecture,butIA64andIBMs390supportwasaddedrecently.LinuxasaLinuxhasallthemechanismsaVMMneedstooperateseveralVMs.Wealreadymentionedthesemechanismsinsection2.2.Sothedevelopersdidn’treinventthewheelandaddedonlyfewcomponentstosupportvirtualization.KVMisimple-mentedasakernelmodulethatcanbeloadedtoextendlinuxbythesecapabilities.Thus,linuxisturnedintoaVMM,asshowninfigure3.Inanormallinuxenvironmenteachprocessrunseitherinuser-modeorinkernel-mode.KVMintroducesathirdmode,theguest-mode.Thereforeitreliesona 8Figure3:KVMArchitecturevirtualizationcapableCPUwitheitherInVTorAMDSVMextensions.Aprocessinguest-modehasitsownkernel-modeanduser-mode.Thus,itisabletorunanoperatingsystem.SuchprocessesarerepresentingtheVMsrunningonaKVMhost.In[Qum06]theauthorstateswhatthemodesareusedforfromahostspointofview:user-mode:I/Owhenguestneedstoaccesskernel-mode:switchintoguest-modeandhandleexitsduetoI/Oguest-mode:executeguestcode,whichistheguestOSexceptResourceTheKVMdevelopersaimedtoreuseasmuchcodeaspossible.Duetothattheymainlymodifiedthelinuxmemorymanagement,toallowmapphysicalmemoryintotheVMsaddressspace.Thereforetheyaddedshadowpagetables,thatwereneededintheearlydaysofx86virtualization,whenInandAMDhadnotreleasedEPTrespectivelyNPTyet.OnMay2008supportforthesetechnolo-gieshasbeenintroduced.InmodernoperatingsystemstherearemanymoreprocessesthanCPUsavailabletorunthem.TheschedulerofanoperatingsystemcomputesanorderinthateachprocessisassignedtooneoftheavailableCPUs.Inthisway,allrunningprocessesaresharethecomputingtime.SincetheKVMdeveloperswantedto9reusemostofthemechanismsoflinux,theysimplyimplementedeachVMasaprocess,relyingonitsschedulertoassigncomputingpowertotheVMs.TheKVMcontrolOncetheKVMkernelmodulehasbeenloaded,the/dev/kvmdevicenodeappearsinthefilesystem.ThisisaspecialdevicenodethatrepresentstheinterfaceofKVM.Itallowstocontrolthehypervisorthroughasetofioctls.Thesearecom-monlyusedincertainoperatingsystemsasaninterfaceforprocessesrunninginuser-modetocommunicatewithadriver.Theioctl()systemcallallowstoexe-cuteseveraloperationstocreatenewvirtualmachines,assignmemorytoavirtualmachine,assignandstartvirtualCPUs.EmulationofToprovidehardwarelikeharddisks,cddrivesornetworkcardstotheVMs,KVMusesahighlymodifiedQEMU2.Thisisasocalledplatformvirtualizationtool,whichallowstoemulateanentirepcplatformincludinggraphics,networking,diskdrivesandmanymore.ForeachVMaQEMUprocessisstartedinuser-modeandcertainemulateddevicesarevirtuallyattachedtothese.WhenaVMperformsI/Ooperations,theseareinterceptedbyKVMandredirectedtotheQEMUprocessregardingtotheguest.Execution-Figure4depictstheexecutionmodelofKVM.ThisisaloopofactionsusedtooperatetheVMs.Theseactionsareseparatedbythethreemodeswementionedearlierinsection3.1.1.In[KKL+07]Kivityetal.describedtheKVMexecutionmodelandstatedwhichtasksaredoneinwhichmode:user-mode:TheKVMmoduleiscalledusingioclt()toexecuteguestcodeuntilI/Ooperationsinitiatedbytheguestoranexternaleventoccurs.Such2Figure4:KVMexecutionmodelaneventmaybethearrivalofanetworkpackage,whichcouldbethereplyofanetworkpackagesentbythehostearlier.Sucheventsareexpressedassignalsthatleadstoaninterruptionofguestcodeexecution.kernel-mode:Thekernelcausesthehardwaretoexecuteguestcodenatively.IftheprocessorexitstheguestduetopendingmemoryorI/Ooperations,thekernelperformsthenecessarytasksandresumestheflowofexecution.IfexternaleventssuchassignalsorI/Ooperationsinitiatedbytheguestexists,itexitstotheuser-mode.guest-mode:Thisisonthehardwarelevel,wheretheextendedinstructionsetofavirtualizationcapableCPUisusedtoexecutethenativecode,untilaninstructioniscalledthatneedsassistancebyKVM,afaultoranexternalWhileaVMruns,thereareplentyofswitchesbetweenthesemodes.Fromkernel-modetoguest-modeswitchesandviceversaareveryfast,becausethereisonlynativecodethatisexecutedontheunderlyinghardware.WhenI/Ooperationsoccurandtheflowofexecutionswitchestotheuser-mode,emulationofthevirtualI/Odevicescomesintoplay.Thus,alotofI/Oexitsandswitchestouser-modeareexpected.Imagineanemulatedharddiskandaguestreadingcertainblocksfromit.ThenQEMUemulatestheoperationsbysimulatingthebehaviouroftheharddiskandthecontrolleritisconnectedto.Toperformtheguestsreadoperation,itreadsthecorrespondingblocksfromalargefileandreturnsthedatatotheguest.Thus,user-modeemulatedI/OtendstobeabottleneckwhichslowsdowntheexecutionofaVM.ParavirtualdeviceWiththesupportforthevirtio[Rus08]paravirtualdevicemode