From 293d2ed31ccceb8bcbd59a4d7c237296406459d3 Mon Sep 17 00:00:00 2001 From: Adam Lesinski Date: Thu, 4 Jun 2026 10:58:33 -0700 Subject: [PATCH] Enable nested virtualization on x86_64 (all flavors) Build KVM into the x86_64 guest kernel so the microVM can act as an L1 hypervisor and run L2 guests. Adds a new x86_64/nested-virt.conf fragment enabling CONFIG_VIRTUALIZATION, CONFIG_KVM, and both the Intel (VMX) and AMD (SVM) backends as built-ins (modules are disabled). The fragment lives under x86_64/ so it is picked up by every build via get_kernel_frag_path's `ls ${arch_path}/*.conf`, covering both the base and ebpf flavors with no build-script or CI changes. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../kernel/configs/fragments/common/base.conf | 2 +- .../configs/fragments/x86_64/nested-virt.conf | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 packaging/kernel/configs/fragments/x86_64/nested-virt.conf diff --git a/packaging/kernel/configs/fragments/common/base.conf b/packaging/kernel/configs/fragments/common/base.conf index 59a31de..dfc19aa 100644 --- a/packaging/kernel/configs/fragments/common/base.conf +++ b/packaging/kernel/configs/fragments/common/base.conf @@ -5,7 +5,7 @@ CONFIG_MODULES=n CONFIG_SECTION_MISMATCH_WARN_ONLY=y CONFIG_SMP=y -# Note, no nested VM support enabled here +# Nested VM support is enabled per-arch (see x86_64/nested-virt.conf) # Note, no virt enabled baloon yet CONFIG_INPUT=y diff --git a/packaging/kernel/configs/fragments/x86_64/nested-virt.conf b/packaging/kernel/configs/fragments/x86_64/nested-virt.conf new file mode 100644 index 0000000..bfe2aa6 --- /dev/null +++ b/packaging/kernel/configs/fragments/x86_64/nested-virt.conf @@ -0,0 +1,14 @@ +# Nested virtualization support. +# +# Build KVM into the guest kernel so the microVM can itself act as an L1 +# hypervisor and run L2 guests. Modules are disabled (CONFIG_MODULES=n in +# common/base.conf), so everything is built-in (=y). +# +# Both Intel (VMX) and AMD (SVM) backends are enabled so the same kernel image +# works on either host CPU. Whether L2 guests can actually run still depends on +# the host exposing nested virt (kvm_intel/kvm_amd nested=1) and the virtual CPU +# advertising VMX/SVM to the L1 guest. +CONFIG_VIRTUALIZATION=y +CONFIG_KVM=y +CONFIG_KVM_INTEL=y +CONFIG_KVM_AMD=y