> What about an L2 guest executing VMLOAD or VMSAVE which isn't
> intercepted? Don't we have to redirect it's reads and writes to
> host_vmcb?
Yes, that needs to target the host_vmcb then. This is buggy in the
patch-set. Thanks for pointing this out :)
>> Hmm, how about naming them l1_vmcb and l2_vmcb? The comment explaining
>> why vmload/vmsave always happens on l1_vmcb is needed anyway then.
>
> In a later patch you introduce n_vmcb. I think it makes sense to name
> that vmcb02?
Just for my understanding, what stands the first '0' for? The '1' and
'2' make sense, but the '0' seems to be redundant?
> Even the exising code would be good to document. So when a reader sees
> some bit, they can compare it to the document and see why it's that way.
I tried to put comments into the code to document the most complicated
parts. But there is certainly room for improvement. Overall, I think the
best place is to keep those comments in the code and not open another
document for it.
>> The long-term plan is certainly to merge code with nested-vmx where
>> possible and move logic into generic KVM code. The first item that comes
>> to mind here is to create a single place where a vmexit is emulated and
>> let all other place which do that today just signal that it is required.
>
> I'm not very concerned about reuse with nvmx except for architectural
> code like interrupts. Of course, if it turns out simple I'm all for it,
> but if it's hard or uglifies the code, let it be.
Yes, the interrupt code is another part that probably can be made
generic.
The nested-mmu code is already generic. Nested-VMX should be able to
make use of it with only minor modifications.