Appendix D: Glossary
The definitions here fix a term at the layer where it belongs. That matters in virtualization: a hardware VM exit is not necessarily a return to userspace, a guest-physical address is not a host virtual address, and a virtio device is not the same thing as its MMIO or PCI transport.
A
ACPI (Advanced Configuration and Power Interface). A firmware-defined table and bytecode interface through which an operating system discovers and configures a machine. Current Firecracker can provide ACPI on x86_64; this is a machine-description path, not a conventional BIOS boot sequence. See Chapter 10.
APIC. The x86 Advanced Programmable Interrupt Controller family. A local APIC belongs to one logical processor; an I/O APIC accepts device interrupt inputs and routes them to local APICs. KVM can emulate these controllers in the kernel. See Chapter 7.
B
Balloon. A cooperative virtio memory device. The host requests a target; the guest driver returns pages or reclaims them later. A balloon changes which guest pages are available to the guest, not the VM's configured address-space layout. See Chapter 6.
C
cgroup. A Linux mechanism for grouping processes and applying accounting or resource controls. Firecracker's Jailer can place the VMM in configured cgroups, but using the Jailer does not itself create CPU, memory, or I/O limits. The containerd book covers controller semantics; see Chapter 18 for the Firecracker boundary.
CPU template. A Firecracker policy that modifies guest-visible CPU features or registers to obtain a chosen compatibility or mitigation profile. It is not a model of a different physical processor. See Chapter 15.
D
Device tree. A data structure that describes processors, memory, buses, interrupts, and devices to an operating system. Firecracker uses a flattened device tree for aarch64 direct kernel boot. See Chapter 10.
Dirty page. A guest-memory page whose contents changed during a tracking interval. KVM can record vCPU writes; a VMM must also account for writes it performs through its own mappings. Dirty sets support differential snapshots and migration. See Chapter 6 and Chapter 16.
E
EPT (Extended Page Tables). Intel's hardware second-stage translation from guest-physical to host-physical addresses. EPT permissions also give KVM a way to trap accesses. See Chapter 6.
eventfd. A Linux file descriptor backed by a 64-bit counter and used for event notification. KVM's irqfd and ioeventfd APIs connect eventfds to guest interrupt and I/O paths. See Chapter 7.
G
GIC (Generic Interrupt Controller). Arm's interrupt-controller
architecture. KVM exposes in-kernel GIC devices on arm64, commonly through
KVM_CREATE_DEVICE; it is not the Arm spelling of an x86 APIC register set.
See Chapter 7.
GPA, GVA, HPA, and HVA. A guest virtual address (GVA) is translated by the guest page tables to a guest physical address (GPA). EPT or NPT translates the GPA to a host physical address (HPA). A host virtual address (HVA) belongs to the VMM process; KVM memslots associate GPA ranges with those userspace mappings so KVM can construct and maintain the second stage. See Chapter 6.
GSI (Global System Interrupt). A KVM routing-table index used to identify a guest interrupt source. A GSI route can target an irqchip input or an MSI message. It is a VMM/KVM routing namespace, not necessarily a physical host wire. See Chapter 7.
H
Hypervisor. Software that provides or manages virtual-machine execution. The term can cover a hardware-facing kernel component, a complete VMM, or a platform. In this book, name KVM or the userspace VMM when that distinction matters instead of relying on Type 1 or Type 2 labels.
I
ioeventfd. A KVM registration that signals an eventfd when the guest writes
to a matching PIO or MMIO address. The matching write does not return through
the vCPU's KVM_RUN userspace-exit path. A device backend still wakes and does
the work. See Chapter 8.
IOMMU. An I/O memory-management unit translates and constrains DMA from a device. This is separate from EPT/NPT, which translate CPU accesses for a guest, although passthrough designs coordinate both mappings.
irqfd. A KVM registration that binds an eventfd to a guest interrupt. When the eventfd is signaled, KVM injects through the configured GSI route without requiring the vCPU thread to return to userspace merely to request injection. See Chapter 7.
J
Jailer. Firecracker's privileged launcher. It prepares a mount-isolated filesystem view, device nodes, optional namespaces and cgroups, resource limits, and target credentials, then replaces itself with Firecracker. It is a host containment layer, not part of the guest. See Chapter 18.
K
KVM (Kernel-based Virtual Machine). The Linux virtualization subsystem and
userspace API exposed through /dev/kvm, VM fds, vCPU fds, and device fds.
KVM runs vCPUs and provides in-kernel virtualization services; it does not by
itself supply a complete userspace machine model. See
Chapter 5.
KVM exit. Informal shorthand that must be qualified. It can mean a
hardware VM exit handled inside KVM or a successful return from KVM_RUN with
a KVM_EXIT_* reason for userspace. The first does not imply the second. See
Chapter 8.
KVM_RUN. The vCPU ioctl that enters guest execution. Inputs and exit data
are exchanged through the vCPU fd's shared struct kvm_run mapping. A return
value of zero selects a KVM_EXIT_* union member; -1 is an error path such as
EINTR. See Appendix C.
M
Memslot. A KVM record associating a guest-physical range with a
userspace-backed memory range and flags. The VMM creates or updates it with
KVM_SET_USER_MEMORY_REGION or its extended form. A memslot is mapping
metadata, not the memory allocation itself. See
Chapter 6.
MicroVM. A design category for hardware virtual machines whose VMM and machine model intentionally omit broad compatibility features. It is not a standard ABI, fixed device count, security level, or latency guarantee. Firecracker, Cloud Hypervisor, and crosvm make different choices within this space. See Chapter 3 and Chapter 23.
MMDS (MicroVM Metadata Service). Firecracker's in-process metadata store and small guest-facing network stack. The host manages JSON through the API socket; selected virtio-net devices divert guest traffic to MMDS before the TAP path. V2 requires a session token for metadata reads. See Chapter 17.
MMIO (Memory-Mapped I/O). Device registers placed in a memory address
space and accessed with ordinary loads and stores. In a KVM guest, an access
that no in-kernel owner resolves can return to the VMM as KVM_EXIT_MMIO.
MSI (Message Signaled Interrupt). An interrupt represented as a memory write containing a configured address and data value instead of an asserted pin. KVM GSI routes can describe MSI messages. MSI is not an eventfd; irqfd is one host-side way to trigger a routed guest interrupt.
N
Nested virtualization. Running a guest hypervisor, L1, under a host hypervisor, L0, so that L1 can run its own guest, L2. This is distinct from nested page tables: "nested" names the hypervisor stack here, not the address translation mechanism.
NPT (Nested Page Tables). AMD's hardware second-stage address translation, also called Rapid Virtualization Indexing. Despite the name, NPT does not mean nested virtualization. See Chapter 6.
P
PCI and PCIe. Enumerated peripheral interconnects and configuration models. Virtio devices can use the virtio-PCI transport. Current Firecracker can select PCI transport for all virtio devices and has limited preview hotplug; MMIO remains the default. See Chapter 14.
PIO (Port I/O). The separate x86 I/O-port space accessed by IN and OUT.
An unhandled access can return through KVM_EXIT_IO. PIO has no direct
aarch64 equivalent in this machine model.
PVH. A direct x86 guest boot protocol originally defined for Xen HVM guests. An ELF image can advertise a PVH entry note; current Firecracker uses that entry when present and otherwise uses its Linux boot-protocol path. See Chapter 10.
R
Root and non-root operation. Intel VMX execution modes. The host hypervisor runs in VMX root operation and a guest runs in non-root operation. They are independent of privilege rings: a guest kernel can execute at guest ring 0 while remaining in VMX non-root operation. AMD SVM uses host and guest terminology instead. See Chapter 4.
S
Seccomp. A Linux mechanism that evaluates a BPF policy at syscall entry and returns the policy's action. Firecracker installs different filters for its API, VMM, and vCPU thread categories. Seccomp limits future syscalls; it does not remove existing fds or isolate memory shared inside the process. See Chapter 19.
SLAT (Second-Level Address Translation). The generic name for the hardware translation from GPA to HPA. Intel EPT and AMD NPT are two implementations. KVM documentation also uses TDP, two-dimensional paging.
Snapshot. A serialized continuation point containing guest memory and the VMM, KVM, vCPU, and device state needed to resume. A Firecracker snapshot does not contain its attached block images and does not make cloned state unique. See Chapter 16.
SVM (Secure Virtual Machine). AMD's x86 hardware virtualization
extension, also marketed as AMD-V. It uses VMRUN, #VMEXIT, and the VMCB.
Do not confuse it with a language or security virtual machine. See
Chapter 4.
T
TAP. A Linux virtual network interface whose userspace fd exchanges Ethernet frames with the host networking stack. A virtio-net backend can move frames between guest virtqueues and a TAP fd. TAP attachment does not itself provide routing, filtering, or tenant isolation. See Chapter 21.
TSC (Time Stamp Counter). An x86 counter read by RDTSC or related
instructions. KVM virtualizes its offset, frequency, and migration behavior;
the guest's wall clock is a separate software construction. See
Chapter 7.
V
vCPU. One guest-visible logical processor and its virtualized execution state. KVM represents it with a vCPU fd; a VMM normally gives each running vCPU its own host thread, but that does not imply host CPU pinning. See Chapter 5.
virtio. The OASIS-standard device interface family for virtual machines. It defines feature negotiation, device status, device-specific configuration, virtqueues, and transports. It is not one device or one transport. See Chapter 11.
virtio-MMIO and virtio-PCI. Two transports for presenting virtio devices. MMIO uses a fixed register window and out-of-band discovery; PCI uses PCI configuration, BARs, and interrupt mechanisms. The device protocol above the transport can remain the same. See Chapter 12.
Virtqueue. A virtio buffer-transfer queue. In the split-ring format, the driver publishes descriptor-chain heads through the available ring and the device returns completions through the used ring. Buffer addresses are guest addresses that the device implementation must translate and validate. See Chapter 11.
VM entry and VM exit. Hardware transitions into and out of guest
execution. Intel enters with VMLAUNCH or VMRESUME; AMD enters with
VMRUN. KVM can handle many hardware exits in the kernel and re-enter the
guest without returning KVM_RUN to userspace. See
Chapter 8.
VMCB (Virtual Machine Control Block). AMD's architected memory structure
for SVM guest state, intercept controls, exit information, and entry data. Its
physical address is the operand to VMRUN. See
Chapter 4.
VMCS (Virtual Machine Control Structure). Intel's architected control and
state object for VMX. Software accesses its fields with VMREAD and
VMWRITE, not as a portable C struct. See
Chapter 4.
VMM (Virtual Machine Monitor). The userspace component that assembles a machine around KVM: memory layout, vCPU state, device emulation, boot, I/O, and lifecycle. Firecracker is a VMM and runs one microVM per process. See Chapter 9.
VMX (Virtual Machine Extensions). Intel's x86 hardware virtualization extension, commonly marketed as VT-x. It introduces VMX root/non-root operation, the VMCS, and VM-entry/exit instructions. See Chapter 4.
vsock. The virtio socket device and host/guest address family used for stream or datagram communication without an IP network. A context identifier (CID) addresses a VM endpoint. Vsock is a communication path, not an authorization boundary. See Chapter 14.