System structure¶

Modern CPUs introduces another privileged level below ring 0 (kernel) for virtualization. It still blocks some sensitive instructions, but it enables most of the privileged instructions so that KVM can directly execute instead of doing system calls.

To tie this perfectly into your OS studies, there is just one slight terminology tweak to make your understanding flawless: in traditional VMs, the Guest OS isn't voluntarily making a "system call" to the Host. Instead, it's triggering an Exception (or Fault).

Here is the exact breakdown of why traditional VMs suffer such massive performance penalties compared to KVM:

The Traditional VM Nightmare (Trap-and-Emulate)¶

Because the traditional VM guest kernel is forced to run in User Mode (Ring 3), it lacks the actual hardware privileges it thinks it has.

Imagine the Guest OS simply wants to do something basic for a kernel, like updating its own internal page tables (Memory Management).

1. The Guest OS executes the privileged instruction.
2. The physical CPU sees a User Mode program trying to do kernel work and throws a hardware fault (trap).
3. The CPU context-switches to the Host OS (Ring 0).
4. The Host OS context-switches to the VM software (e.g., VirtualBox) running in User Mode (Ring 3).
5. The VM software analyzes the fault, realizes the Guest OS was just trying to update its page tables, and emulates the result in software memory.
6. The CPU context-switches back to the Host OS (Ring 0).
7. The CPU context-switches back to the Guest OS (Ring 3) to resume execution.

This violent chain of context switches happens thousands of times per second. It absolutely shreds CPU performance and destroys cache locality.

The KVM Elegance (Hardware-Assisted)¶

Because KVM uses the CPU's VMX extensions to give the Guest OS a true (but sandboxed) Ring 0:

1. The Guest OS executes the exact same privileged instruction to update its page tables.
2. The physical CPU sees the Guest OS is in the Non-Root Ring 0, realizes this instruction only affects the VM's isolated sandbox, and executes it natively in the silicon.

Zero faults. Zero context switches. Zero emulation. KVM only steps in (via VM-Exit) for the absolute bare minimum of operations—specifically, when the Guest OS tries to touch shared physical hardware, like sending a packet out of the physical network card or writing to the physical SSD.

By eliminating the massive overhead of software exceptions for internal kernel operations, KVM allows the virtual machine to run at what is commonly called near bare-metal performance.