https://blog.corneschi.ro/tags/kvm/Recent content in Kvm on Daniel CorneschiHugoenDaniel CorneschiSat, 10 Oct 2026 11:07:45 +0300https://blog.corneschi.ro/cheatsheet/kvm/Sat, 10 Oct 2026 00:00:00 +0000https://blog.corneschi.ro/cheatsheet/kvm/<h2 id="architecture">Architecture</h2> <ul> <li><strong>libvirt</strong> (<code>virsh</code>, <code>virt-install</code>, <code>virt-manager</code>) starts and manages one <strong>QEMU</strong> process per VM.</li> <li>QEMU runs the guest&rsquo;s CPU through the <strong>KVM</strong> kernel module, via <code>ioctl()</code> calls on <code>/dev/kvm</code>. KVM uses the CPU&rsquo;s VT-x or AMD-V extensions.</li> <li><strong>Emulated NIC (e1000, VM 1):</strong> every packet goes through the NIC emulated by QEMU in user space, then to the VM&rsquo;s <strong>tap</strong> device in the host (<code>vnet0</code>, … in <code>virsh domiflist</code>).</li> <li><strong>virtio-net (VM 2):</strong> with <strong>vhost-net</strong>, which libvirt uses by default when <code>/dev/vhost-net</code> exists, packets go from the guest&rsquo;s virtqueues straight to a vhost-net kernel thread and the tap device. QEMU only sets it up, which is why virtio is much faster (see Recommended Settings).</li> <li><strong>Bridge:</strong> the tap devices are ports of a Linux bridge. With your own <strong><code>br0</code></strong>, the physical NIC is a port of the same bridge. libvirt&rsquo;s NAT network <strong><code>virbr0</code></strong> (<code>virsh net-info default</code>) has no physical port: the host routes and NATs its traffic (nftables or iptables) before it reaches the NIC.</li> </ul> <p><a href="kvm-architecture.svg" title="Open the diagram full size"><img src="https://blog.corneschi.ro/cheatsheet/kvm/kvm-architecture.svg" alt="KVM architecture: libvirt starts one QEMU process per VM. An emulated e1000 NIC sends packets through QEMU in user space to a tap device; virtio-net with vhost-net sends them from the guest’s virtqueues straight to the vhost-net thread in the host kernel. Tap devices are ports of a Linux bridge: br0 has the physical NIC as a port, virbr0 is routed and NATed by the host. QEMU uses the KVM module through /dev/kvm" loading="lazy" decoding="async"> </a></p>