Nested KVM(the ability to run kvm on kvm) configuration

Its possible to configure nested KVM to deploy kvm guests. Its not a very ideal scenario for production environment but could be a better option to run Proof of Concept (PoC) for both standalone and clustered kvm platform.

• Standalone KVM Platform: virsh/virt-manager
• Clustered KVM Platform: oVirt/Openstack

Fig-01: Low level Nested KVM Architecture 

Both Intel and AMD processors support this feature. Following procedure can help to enable the nested KVM virtualization.

[a] On Intel based KVM hypervisor:

    To check if the nested KVM Kernel parameter is enabled:

    # cat /sys/module/kvm_intel/parameters/nested

      N

    Create the following file:
    # cat > /etc/modprobe.d/kvm-nested.conf <<_EOF
      options kvm-intel nested=1
      _EOF

    Make sure no VM is running and remove & add the KVM module:

    # modprobe -r kvm_intel
    # modprobe -a kvm_intel

    Ensure that KVM module is loaded now:

    # lsmod | egrep ^kvm
      kvm_intel  174841 80
      kvm        578558 1 kvm_intel

    # cat /sys/module/kvm_intel/parameters/nested
      Y

[b] On AMD based KVM hypervisor:

    To check if the nested KVM Kernel parameter is enabled:

    # cat /sys/module/kvm_amd/parameters/nested

      0

    Create the following file:
    # cat > /etc/modprobe.d/kvm-nested.conf <<_EOF
      options kvm-amd nested=1
      _EOF

    Make sure no VM is running and remove & add the KVM module:

    # modprobe -r kvm_amd
    # modprobe -a kvm_amd

    Ensure that KVM module is loaded now:

    # lsmod | egrep ^kvm
      kvm_amd  174841 80
      kvm      578558 1 kvm_amd

    # cat /sys/module/kvm_amd/parameters/nested
      1

    

    Now expose Virtualization Extensions to guest hypervisor VM by editing the VM’s libvirt XML configuration using virsh utility on the physical KVM host:

    # virsh edit <vm_name>

    Add 'host-passthrough' to expose the host CPU features to the virtual machine:

    <cpu mode='host-passthrough'>

    </cpu>

    ==: With the above change the guest hypervisor is now ready to host new vm. :==