nVMX: Nested VMX, v11

Hi,

This is the eleventh iteration of the nested VMX patch set, and hopefully the last in this format.

Improvements in this version over the previous one include:

* Overhauled vmcs, cpu, and launched handling (new loaded_vmcs structure and per-cpu linked-list replacing old vcpu linked-list).

* Added missing checks that VMPTRLD was done, in emulating VMLAUNCH and some other VMX instructions.

* prepare_vmcs02 is now void, and cannot fail. Correctly handle the case of apic-access page with an invalid GPA.

* A bunch of corrections to errors and omissions discovered by Kevin Tian.

* Miscellenous function name changes, and other cosmetic improvements.

This new set of patches applies to the current KVM trunk (I checked with 5b186b275c0288c8576d26baebe9019875d68a2b).

Avi, please apply.

Nadav.

About nested VMX:
-----------------

The following 31 patches implement nested VMX support. This feature enables a guest to use the VMX APIs in order to run its own nested guests. In other words, it allows running hypervisors (that use VMX) under KVM. Multiple guest hypervisors can be run concurrently, and each of those can in turn host multiple guests.

The theory behind this work, our implementation, and its performance characteristics were presented in OSDI 2010 (the USENIX Symposium on Operating Systems Design and Implementation). Our paper was titled "The Turtles Project: Design and Implementation of Nested Virtualization", and was awarded "Jay Lepreau Best Paper". The paper is available online, at:

http://www.usenix.org/events/osdi10/tech/full_papers/Ben-Yehuda.pdf

This patch set does not include all the features described in the paper. In particular, this patch set is missing nested EPT (L1 can't use EPT and must use shadow page tables). It is also missing some features required to run VMWare hypervisors as a guest. These missing features will be sent as follow-on patchs.

Running nested VMX:
------------------

The nested VMX feature is currently disabled by default. It must be explicitly enabled with the "nested=1" option to the kvm-intel module.

No modifications are required to user space (qemu). However, qemu's default emulated CPU type (qemu64) does not list the "VMX" CPU feature, so it must be explicitly enabled, by giving qemu one of the following options:

-cpu host (emulated CPU has all features of the real CPU)

-cpu qemu64,+vmx (add just the vmx feature to a named CPU type)

This version was only tested with KVM (64-bit) as a guest hypervisor, and Linux as a nested guest.

Patch statistics:
-----------------

 Documentation/kvm/nested-vmx.txt |  251 ++
 arch/x86/include/asm/kvm_host.h  |    2 
 arch/x86/include/asm/msr-index.h |   12 
 arch/x86/include/asm/vmx.h       |   43 
 arch/x86/kvm/svm.c               |    6 
 arch/x86/kvm/vmx.c               | 2733 +++++++++++++++++++++++++++--
 arch/x86/kvm/x86.c               |   11 
 arch/x86/kvm/x86.h               |    8 
 8 files changed, 2907 insertions(+), 159 deletions(-)

--
Nadav Har'El
IBM Haifa Research Lab