KVM: Nested Virtualization Support
This hit me like a sack of bricks, I looked for this before and never found any way of doing it, but I just happened to have found some articles from early last year that showed it was supported. As I’m writing this I’m getting a fully set up UEC cloud going, the proof is in the setup for this as it’ll flat out warn you 2-3 times that you don’t have KVM support, and it hasn’t yet. There are very few steps:
You’ll want to stop libvirtd in some instances, depending on what route you chose. Here we will remove and reinsert the module with nested support.
jason@Desktop:~$ sudo /etc/init.d/libvirt-bin stop jason@Desktop:~$ sudo modprobe -r kvm_amd jason@Desktop:~$ sudo modprobe kvm_amd nested=1
Next we will want to either add a new script to apparmor and the bin directory or change the current symlinked /usr/bin/kvm file. Let’s start off with the safe way, by creating separate script. This one I’ve named kvm-nested.
#!/bin/bash exec /usr/bin/kvm -enable-nesting "$@"
Once that is done, you’ll need to edit the /etc/apparmor.d/abstractions/libvirt-qemu file and add the line below line into it in the section for “the various binaries”.
The one draw back to this method is you will need to manually edit each VM’s xml file to point to that new script /usr/bin/kvm-nested in this line.
The other way which I found more simple was deleting the current kvm symlink to qemu-system-x86_64 and pointing it to the script below.
jason@Desktop:~$ cat /usr/bin/kvm #!/bin/bash /usr/bin/qemu-system-x86_64 -enable-nesting "$@" jason@Desktop:~$ ls -l /usr/bin/kvm lrwxrwxrwx 1 root root 10 2011-01-21 19:13 /usr/bin/kvm -> /usr/bin/kvm-nested
That really should be it, now to keep testing to see if any issues arise.
I wrote this article several years ago and had not touched KVM in just about as long. After starting to test OpenStack, I noticed that KVM now supports passing CPU flags via the -cpu argument. This means you can pass vmx to the guest by adding -cpu +vmx to the KVM argument list.