Linux Kernel Virtualization Explained: How KVM Works

This article provides an overview of how the Linux operating system natively supports virtualization using the Kernel-based Virtual Machine (KVM). By turning the standard Linux kernel into a Type-1 hypervisor, KVM allows the system to run multiple isolated virtual machines directly on bare-metal hardware. You will learn how KVM interacts with hardware-assisted virtualization extensions, manages memory and processing tasks using native kernel subsystems, and interfaces with user-space software to manage virtualized environments.

The Architecture of KVM

Kernel-based Virtual Machine (KVM) is an in-tree module within the Linux kernel (specifically, kvm.ko, alongside processor-specific modules like kvm-intel.ko and kvm-amd.ko). When loaded, KVM extends the core kernel to act as a hypervisor. Rather than running an entirely separate hypervisor layer beneath the operating system, Linux itself becomes the hypervisor, retaining full access to all host hardware, scheduling capabilities, and device drivers.

Hardware-Assisted CPU Virtualization

KVM relies fundamentally on hardware virtualization extensions provided by modern processors, such as Intel VT-x and AMD-V. These hardware extensions introduce a dual-operating mode structure:

• Root Mode: Where the host Linux kernel executes, maintaining unrestricted control over the physical CPU and hardware.
• Non-Root Mode (Guest Mode): Where the guest operating system and its applications execute. Sensitive hardware instructions executed in this mode cause a hardware trap, known as a "VM exit," which switches the CPU back to Root Mode so the Linux kernel can safely handle or emulate the operation before executing a "VM entry" back to the guest.

By offloading the execution of unmodified guest code directly to the physical CPU, KVM achieves near-native computational performance.

Virtual Machines as Standard Linux Processes

One of the defining strengths of KVM is that it does not implement a bespoke scheduler for virtual machines. Instead:

• Every virtual machine is instantiated as a standard Linux process.
• Every virtual CPU (vCPU) is mapped directly to a standard POSIX thread managed by the kernel.

Because vCPUs are regular threads, they are scheduled by the standard Completely Fair Scheduler (CFS) or the newer EEVDF scheduler. This means VMs immediately benefit from kernel features such as CPU affinity (pinning vCPUs to specific physical cores), control groups (cgroups) for resource limiting and prioritization, and NUMA (Non-Uniform Memory Access) balancing.

Memory Virtualization and Management

Guest operating systems require their own physical memory address space. KVM coordinates with the CPU’s hardware memory management unit (MMU) through technologies like Intel Extended Page Tables (EPT) or AMD Nested Page Tables (NPT) to map Guest Physical Addresses (GPA) directly to Host Physical Addresses (HPA).

Furthermore, because VM memory allocations are backed by host virtual memory, KVM leverages core Linux memory management capabilities, including:

• HugePages (and Transparent HugePages): Reduces the overhead of Translation Lookaside Buffer (TLB) misses by using 2MB or 1GB pages instead of default 4KB pages.
• Kernel Samepage Merging (KSM): Scans memory to find identical memory pages across different VMs and merges them into a single read-only page, freeing up host RAM.
• Swapping: Allows overcommitting host memory by swapping inactive guest pages to disk if necessary.

The Division of Labor: KVM and User Space

KVM focuses strictly on managing the CPU and memory. It exposes a character device interface at /dev/kvm, which user-space programs use to create, configure, and run virtual machines via standard ioctl() system calls.

A user-space component, most commonly QEMU, handles the rest of the virtualization stack:

1. Device Emulation: Emulating storage controllers, network cards, graphics adapters, and serial ports.
2. I/O Handling: When a guest attempts I/O operations, KVM traps the request and passes control back to user space (QEMU) to process the I/O.
3. Paravirtualization (Virtio): For optimized performance, KVM and user-space tools support virtio drivers, which bypass legacy device emulation entirely. Virtio provides efficient, cooperative communication channels between the guest and the host for disk and network operations.

By integrating directly into the kernel's existing scheduler, memory manager, and device framework, KVM provides enterprise-grade virtualization without the complexity of maintaining a distinct operating system kernel.